[management] Add support for pagination in GetAllPeers call (#8190)

* use libopenapi OpenAPI generator Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * added a handler for v1alpha1/peers Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * wire up request validator Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * wired up spec-based validation Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * use sync validation; set base url to v1alpha1 Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * moved stuff around, extracted runtime libopenapu deps into runtime_tooling Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * testing /peers path params Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * fixed tests Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * added user schemas and paths Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * use api validation in tests Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * post-merge fixes Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * deleted tmp command used to test validator integration Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * require request body in post/put requests in order to force validation Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * making linter happy Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * switch to api/v1alpha1 Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * go mod tidy Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * keep the original order of middleware: metrics, cors, then auth Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * return 422 on validation errors Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * cleanups Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * more cleanups Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * v1alpha1 spec cleanups Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * no need for a double-pointer Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * more linter fixes Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * removed more double pointers Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * use di to inject api_v0 and api_v1 http routers Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * do not re-add middleware on repeated call to ApiHandler Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * support for pagination and filtering in /peers call Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * calling ApiRouter() now also calls ApiV1Router() Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * adding peer filters Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * introduced paginated GetAllPeers call Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * wire up pagination Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * convert pagination state to query scope Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * peer filter wip Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * implemented peer filter Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * test for filtering by os Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * support for sorting of peers Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * support for ordering + tests Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * more tests Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * wire up total number of records in paginated GetAllPeers call Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * cleaned up GetAllPeers response Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * pacify linter Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * cleanups and fixes Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * moar cleanups Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * pacify linter Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * remove duplicated test Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * make linter happy Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * moving GetAllPeersPaginated to peer manager, p. 1 Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * moving GetAllPeersPaginated to peer manager, p. 2 Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * added peer manager tests for GetPeersPaginated Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * order peers in GetAccountPeersPaginated by their ids by default Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * always order by peer_id, filter out proxies Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * fixed broken tests Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * support for filtering of peers by peer_id in GetAllPeers() Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * filtering by peer_ids Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * use lowercase in 'like' queries, drop ordering by ip Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * drop sort_by ip key Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * drop forced_approve filter Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * replace mac with darwin in peer os filter Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * fix peers query parameter: use peer_ids Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * fixed broken peer_test Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> * responded to feedback Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io> --------- Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
2026-10-20 12:29:09 +02:00 · 2026-10-19 22:19:39 +02:00
parent 36fe467aba
commit 8fef487e42
24 changed files with 1571 additions and 230 deletions
@@ -12,6 +12,7 @@ import (

 	"github.com/netbirdio/netbird/management/server/permissions"

+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/server/api/v1alpha1/peers"
 	"github.com/netbirdio/netbird/management/server/api/v1alpha1/users"
 )
@@ -20,6 +21,7 @@ func NewAPIV1Handler(
 	ctx context.Context,
 	router *mux.Router,
 	accountManager account.Manager,
+	peerManager peersmodule.Manager,
 	networkMapController network_map.Controller,
 	permissionsManager permissions.Manager) (http.Handler, error) {

@@ -30,7 +32,7 @@ func NewAPIV1Handler(

 	router.Use(v1validatorMiddleware.Handler)

-	peersHandler := peers.NewHandler(accountManager, networkMapController, permissionsManager)
+	peersHandler := peers.NewHandler(accountManager, peerManager, networkMapController, permissionsManager)
 	_ = peersHandler.WithEndpointsForRouter(router)

 	usersHandler := users.NewHandler(accountManager)
@@ -6,17 +6,22 @@ import (
 	"fmt"
 	"net/http"
 	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"

 	"github.com/gorilla/mux"
 	log "github.com/sirupsen/logrus"

 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/api/v1alpha1/groups"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -26,12 +31,14 @@ type Handler struct {
 	accountManager       account.Manager
 	permissionsManager   permissions.Manager
 	networkMapController network_map.Controller
+	peersManager         peers.Manager
 }

 // NewHandler creates a new peers Handler
-func NewHandler(accountManager account.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
+func NewHandler(accountManager account.Manager, peerManager peers.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
 	return &Handler{
 		accountManager:       accountManager,
+		peersManager:         peerManager,
 		networkMapController: networkMapController,
 		permissionsManager:   permissionsManager,
 	}
@@ -210,14 +217,32 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	nameFilter := r.URL.Query().Get("name")
-	ipFilter := r.URL.Query().Get("ip")
-	macFilter := r.URL.Query().Get("mac")
+	pagination, err := paginationFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}
+
+	filters, err := filtersFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}
+
+	sorting, err := sortingOrderFromQuery(r.URL.Query())
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("error parsing query: %v", err)
+		util.WriteError(r.Context(), &status.Error{ErrorType: status.InvalidArgument, Message: err.Error()}, w)
+		return
+	}

 	accountID, userID := userAuth.AccountId, userAuth.UserId

-	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
+	peers, peerCount, err := h.peersManager.GetPeersPaginated(r.Context(), accountID, userID, pagination, filters, sorting)
 	if err != nil {
+		log.WithContext(r.Context()).Errorf("error getting peers: %v", err)
 		util.WriteError(r.Context(), err, w)
 		return
 	}
@@ -232,35 +257,135 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 	grps, _ := h.accountManager.GetAllGroups(r.Context(), accountID, userID)

 	grpsInfoMap := groups.ToGroupsInfoMap(grps, len(peers))
-	respBody := make([]*apiv1alpha1.PeerBatch, 0, len(peers))
-	for _, peer := range peers {
-		if peer.ProxyMeta.Embedded {
-			continue
-		}
-		respBody = append(respBody, toPeerListItemResponse(peer, grpsInfoMap[peer.ID], dnsDomain, 0))
-	}
-
-	validPeersMap, invalidPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
 	if err != nil {
 		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
 		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
 		return
 	}
-	h.setApprovalRequiredFlag(respBody, validPeersMap, invalidPeersMap)
+
+	respBody := apiv1alpha1.PeerBatch{Peers: make([]apiv1alpha1.Peer, 0, len(peers))}
+	for _, peer := range peers {
+		_, valid := validPeers[peer.ID]
+		reason := invalidPeers[peer.ID]
+
+		respBody.Peers = append(respBody.Peers, *toSinglePeerResponse(peer, grpsInfoMap[peer.ID], dnsDomain, valid, reason))
+	}
+	respBody.Page = pagination.Page
+	respBody.PageSize = pagination.PageSize
+	respBody.PeerCount = peerCount

 	util.WriteJSONObject(r.Context(), w, respBody)
 }

-func (h *Handler) setApprovalRequiredFlag(respBody []*apiv1alpha1.PeerBatch, validPeersMap map[string]struct{}, invalidPeersMap map[string]string) {
-	for _, peer := range respBody {
-		_, ok := validPeersMap[peer.Id]
-		if !ok {
-			peer.ApprovalRequired = true
+func filtersFromQuery(v url.Values) (store.PeerFilters, error) {
+	connected, err := parseBool(v.Get("connected"))
+	if err != nil {
+		return store.PeerFilters{}, err
+	}

-			reason := invalidPeersMap[peer.Id]
-			peer.DisapprovalReason = &reason
+	approvalRequired, err := parseBool(v.Get("approval_required"))
+	if err != nil {
+		return store.PeerFilters{}, err
+	}
+
+	var isServer *bool
+	if v.Get("kind") != "" {
+		isServer = new(v.Get("kind") == "server")
+		if *isServer && v.Get("user_id") != "" {
+			return store.PeerFilters{}, fmt.Errorf("incompatible filters: kind == server and a non-empty user_id")
 		}
 	}
+	return store.PeerFilters{
+		UserId:           v.Get("user_id"),
+		GroupIds:         v["group_ids"],
+		Connected:        connected,
+		ApprovalRequired: approvalRequired,
+		Os:               v["os"],
+		IP:               v.Get("ip"),
+		MAC:              v.Get("mac"),
+		Name:             v.Get("name"),
+		Hostname:         v.Get("hostname"),
+		IsServer:         isServer,
+		PeersIds:         v["peer_ids"],
+	}, nil
+}
+
+func parseBool(maybeBool string) (*bool, error) {
+	if maybeBool == "" {
+		return nil, nil //nolint:nilnil
+	}
+
+	parsed, err := strconv.ParseBool(maybeBool)
+	if err != nil {
+		return nil, err
+	}
+
+	return new(parsed), nil
+}
+
+func paginationFromQuery(v url.Values) (store.PaginationState, error) {
+	page, err := strconv.Atoi(v.Get("page"))
+	if err != nil {
+		return store.PaginationState{}, err
+	}
+
+	pageSize, err := strconv.Atoi(v.Get("page_size"))
+	if err != nil {
+		return store.PaginationState{}, err
+	}
+
+	return store.PaginationState{
+		Page:     page,
+		PageSize: pageSize,
+	}, nil
+}
+
+func sortingOrderFromQuery(v url.Values) (store.PeerSorting, error) {
+	toret := store.PeerSorting{}
+	sortby, ok := v["sort_by"]
+	if !ok {
+		return toret, nil
+	}
+
+	for i := 0; i < len(sortby); {
+		// ascending sorting order by default
+		sortkey := store.PeerSortingKey{Order: store.AscOrderBy}
+		field, order := parseFieldAndOrder(sortby[i])
+
+		switch field {
+		case "name":
+			sortkey.Field = store.PeerSortByName
+		case "last_seen":
+			sortkey.Field = store.PeerSortByLastSeen
+		case "version":
+			sortkey.Field = store.PeerSortByVersion
+		default:
+			return toret, fmt.Errorf("unable to parse sorting order '%s'", sortby)
+		}
+
+		switch order {
+		case "asc", "":
+			// nop, already set
+		case "desc":
+			sortkey.Order = store.DescOrderBy
+		default:
+			return store.PeerSorting{}, fmt.Errorf("unable to parse sorting order '%s'", sortby)
+		}
+
+		toret.Fields = append(toret.Fields, sortkey)
+		i++
+	}
+
+	return toret, nil
+}
+
+func parseFieldAndOrder(fieldOrder string) (string, string) {
+	maybeFieldAndOrder := strings.SplitN(fieldOrder, ",", 2)
+	if len(maybeFieldAndOrder) == 2 {
+		return strings.TrimSpace(maybeFieldAndOrder[0]), strings.TrimSpace(maybeFieldAndOrder[1])
+	}
+	return strings.TrimSpace(maybeFieldAndOrder[0]), ""
 }

 func parseIPv6(s *string) (netip.Addr, error) {
@@ -337,61 +462,6 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinim
 	return apiPeer
 }

-func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, accessiblePeersCount int) *apiv1alpha1.PeerBatch {
-	osVersion := peer.Meta.OSVersion
-	if osVersion == "" {
-		osVersion = peer.Meta.Core
-	}
-
-	return &apiv1alpha1.PeerBatch{
-		CreatedAt:            peer.CreatedAt,
-		AccessiblePeersCount: accessiblePeersCount,
-		Peer: apiv1alpha1.Peer{
-			PeerMinimum: apiv1alpha1.PeerMinimum{
-				Id:   peer.ID,
-				Name: peer.Name,
-			},
-			Ip:                          peer.IP.String(),
-			Ipv6:                        peerIPv6String(peer),
-			ConnectionIp:                peer.Location.ConnectionIP.String(),
-			Connected:                   peer.Status.Connected,
-			LastSeen:                    peer.Status.LastSeen,
-			Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
-			KernelVersion:               peer.Meta.KernelVersion,
-			GeonameId:                   int(peer.Location.GeoNameID),
-			Version:                     peer.Meta.WtVersion,
-			Groups:                      groupsInfo,
-			SshEnabled:                  peer.SSHEnabled,
-			Hostname:                    peer.Meta.Hostname,
-			UserId:                      peer.UserID,
-			UiVersion:                   peer.Meta.UIVersion,
-			DnsLabel:                    fqdn(peer, dnsDomain),
-			ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
-			LoginExpirationEnabled:      peer.LoginExpirationEnabled,
-			LastLogin:                   peer.GetLastLogin(),
-			LoginExpired:                peer.Status.LoginExpired,
-			CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
-			CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
-			SerialNumber:                peer.Meta.SystemSerialNumber,
-			InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
-			Ephemeral:                   peer.Ephemeral,
-			LocalFlags: &apiv1alpha1.PeerLocalFlags{
-				BlockInbound:          &peer.Meta.Flags.BlockInbound,
-				BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
-				DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
-				DisableDns:            &peer.Meta.Flags.DisableDNS,
-				DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
-				DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
-				LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
-				RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
-				RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
-				ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
-				RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
-			},
-		},
-	}
-}
-
 func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
 	fqdn := peer.FQDN(dnsDomain)
 	if fqdn == "" {
@@ -0,0 +1,191 @@
+package peers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+)
+
+func TestGetPeersPagination(t *testing.T) {
+	peer := &nbpeer.Peer{
+		ID:     testPeerID,
+		Status: &nbpeer.PeerStatus{Connected: true},
+		Meta:   nbpeer.PeerSystemMeta{},
+	}
+
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestPath     string
+		setExpectations func(p *Handler)
+	}{
+		{
+			name:           "GetPeers default paging, filtering, and sorting",
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}), gomock.Any(), gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:           "GetPeers paging",
+			requestPath:    "/peers?page=10&page_size=250",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 10, PageSize: 250}),
+					gomock.Any(), gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers paging with invalid page",
+			requestPath:     "/peers?page=aaa&page_size=250",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers paging with invalid page size",
+			requestPath:     "/peers?page=10&page_size=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:           "GetPeers filtering all valid params",
+			requestPath:    "/peers?user_id=test-user&group_ids=1&group_ids=2&group_ids=3&group_ids=4&peer_ids=peer-1&peer_ids=peer-2&connected=true&approval_required=false&os=linux&os=windows&os=darwin&os=android&os=ios&os=js&ip=10.10.10.10&mac=00:11:22:33:44:55&name=test&hostname=test-host&kind=user_device",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Eq(store.PeerFilters{
+						UserId:           "test-user",
+						GroupIds:         []string{"1", "2", "3", "4"},
+						Connected:        new(true),
+						ApprovalRequired: new(false),
+						Os:               []string{"linux", "windows", "darwin", "android", "ios", "js"},
+						IP:               "10.10.10.10",
+						MAC:              "00:11:22:33:44:55",
+						Name:             "test",
+						Hostname:         "test-host",
+						IsServer:         new(false),
+						PeersIds:         []string{"peer-1", "peer-2"},
+					}),
+					gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:           "GetPeers filtering with kind server",
+			requestPath:    "/peers?kind=server",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Eq(store.PeerFilters{IsServer: new(true)}),
+					gomock.Any()).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers filtering with invalid connected value",
+			requestPath:     "/peers?connected=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid approval_required value",
+			requestPath:     "/peers?approval_required=aaa",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid os value",
+			requestPath:     "/peers?os=nosuchos",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with invalid kind value",
+			requestPath:     "/peers?kind=nosuchkind",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers filtering with conflicting user_id and kind",
+			requestPath:     "/peers?user_id=test-user&kind=server",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:           "GetPeers sorting preserves field ordering",
+			requestPath:    "/peers?sort_by=last_seen&sort_by=name&sort_by=version",
+			expectedStatus: http.StatusOK,
+			setExpectations: func(p *Handler) {
+				p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(),
+					gomock.Eq(store.PaginationState{Page: 1, PageSize: 100}),
+					gomock.Any(),
+					gomock.Eq(store.PeerSorting{
+						Fields: []store.PeerSortingKey{
+							{Field: store.PeerSortByLastSeen, Order: store.AscOrderBy},
+							{Field: store.PeerSortByName, Order: store.AscOrderBy},
+							{Field: store.PeerSortByVersion, Order: store.AscOrderBy},
+						},
+					})).Return(make([]*nbpeer.Peer, 0), 0, nil).AnyTimes()
+			},
+		},
+		{
+			name:            "GetPeers sorting with invalid field",
+			requestPath:     "/peers?sort_by=nosuchfield,asc",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers sorting with invalid field",
+			requestPath:     "/peers?sort_by=nosuchfield,asc",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+		{
+			name:            "GetPeers sorting with invalid sorting order",
+			requestPath:     "/peers?sort_by=name,nosuchorder&sort_by=version",
+			expectedStatus:  http.StatusUnprocessableEntity,
+			setExpectations: func(p *Handler) {},
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			p := initTestMetaData(t, peer)
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodGet, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = p.WithEndpointsForRouter(router)
+
+			tc.setExpectations(p)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			assert.Equal(t, tc.expectedStatus, recorder.Code)
+		})
+	}
+}
@@ -18,6 +18,7 @@ import (
 	"golang.org/x/exp/maps"

 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	peersmodule "github.com/netbirdio/netbird/management/internals/modules/peers"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -127,7 +128,10 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 		}).
 		AnyTimes()

+	peerManager := peersmodule.NewMockManager(ctrl2)
+
 	return &Handler{
+		peersManager: peerManager,
 		accountManager: &mock_server.MockAccountManager{
 			UpdatePeerFunc: func(_ context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
 				var p *nbpeer.Peer
@@ -173,8 +177,8 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 					return nil, fmt.Errorf("user not found")
 				}
 			},
-			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
-				return peers, nil
+			GetPeersFunc: func(_ context.Context, accountID, userID string, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, int, error) {
+				return peers, len(peers), nil
 			},
 			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
 				peersID := make([]string, len(peers))
@@ -220,9 +224,7 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 	}
 }

-// Tests the GetAllPeers endpoint reachable in the route /api/peers
-// Use the metadata generated by initTestMetaData() to check for values
-func TestGetPeers(t *testing.T) {
+func TestGetPeer(t *testing.T) {

 	peer := &nbpeer.Peer{
 		ID:                     testPeerID,
@@ -262,23 +264,13 @@ func TestGetPeers(t *testing.T) {
 		requestPath    string
 		contentType    string
 		requestBody    io.Reader
-		expectedArray  bool
 		expectedPeer   *nbpeer.Peer
 	}{
-		{
-			name:           "GetPeersMetaData",
-			requestType:    http.MethodGet,
-			requestPath:    "/peers",
-			expectedStatus: http.StatusOK,
-			expectedArray:  true,
-			expectedPeer:   peer,
-		},
 		{
 			name:           "GetPeer with update channel",
 			requestType:    http.MethodGet,
 			requestPath:    "/peers/" + testPeerID,
 			expectedStatus: http.StatusOK,
-			expectedArray:  false,
 			expectedPeer:   peer,
 		},
 		{
@@ -287,7 +279,6 @@ func TestGetPeers(t *testing.T) {
 			requestPath:    "/peers/" + testPeerID,
 			contentType:    "application/json",
 			expectedStatus: http.StatusOK,
-			expectedArray:  false,
 			requestBody:    bytes.NewBufferString("{\"login_expiration_enabled\":true,\"name\":\"New Name\",\"ssh_enabled\":true, \"inactivity_expiration_enabled\":true}"),
 			expectedPeer:   expectedUpdatedPeer,
 		},
@@ -330,32 +321,123 @@ func TestGetPeers(t *testing.T) {
 				t.Fatalf("I don't know what I expected; %v", err)
 			}

-			var got *apiv1alpha1.Peer
-			if tc.expectedArray {
-				respBody := []*apiv1alpha1.Peer{}
-				err = json.Unmarshal(content, &respBody)
-				if err != nil {
-					t.Fatalf("Sent content is not in correct json format; %v", err)
-				}
-
-				// hardcode this check for now as we only have two peers in this suite
-				assert.Equal(t, len(respBody), 2)
-
-				for _, peer := range respBody {
-					if peer.Id == testPeerID {
-						got = peer
-					}
-				}
-
-			} else {
-				got = &apiv1alpha1.Peer{}
-				err = json.Unmarshal(content, got)
-				if err != nil {
-					t.Fatalf("Sent content is not in correct json format; %v", err)
-				}
+			var got apiv1alpha1.Peer
+			err = json.Unmarshal(content, &got)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
 			}

-			t.Log(got)
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestGetPeers(t *testing.T) {
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeersMetaData",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			expectedPeer:   peer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+
+			p.peersManager.(*peersmodule.MockManager).EXPECT().GetPeersPaginated(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+				Return([]*nbpeer.Peer{peer, peer1}, 2, nil)
+
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got *apiv1alpha1.Peer
+			respBody := apiv1alpha1.PeerBatch{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, respBody.Page, 1)
+			assert.Equal(t, respBody.PageSize, 100)
+			assert.Equal(t, respBody.PeerCount, 2)
+			assert.Equal(t, len(respBody.Peers), 2)
+
+			for _, peer := range respBody.Peers {
+				if peer.Id == testPeerID {
+					got = &peer
+				}
+			}

 			assert.Equal(t, tc.expectedPeer.Name, got.Name)
 			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)