- Revert typos in turnCfg string

- merge main
2026-04-30 22:26:42 +00:00 · 2024-07-08 15:05:29 +02:00
parent 836072098b 85e991ff78
commit b3715b5fad
286 changed files with 11781 additions and 6153 deletions
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -1,11 +1,13 @@
 package server

 import (
+	"context"
 	"fmt"
 	"net"
 	"strings"
 	"time"

+	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"

@@ -19,6 +21,11 @@ import (
 type PeerSync struct {
 	// WireGuardPubKey is a peers WireGuard public key
 	WireGuardPubKey string
+	// Meta is the system information passed by peer, must be always present
+	Meta nbpeer.PeerSystemMeta
+	// UpdateAccountPeers indicate updating account peers,
+	// which occurs when the peer's metadata is updated
+	UpdateAccountPeers bool
 }

 // PeerLogin used as a data object between the gRPC API and AccountManager on Login request.
@@ -39,8 +46,8 @@ type PeerLogin struct {

 // GetPeers returns a list of peers under the given account filtering out peers that do not belong to a user if
 // the current user is not an admin.
-func (am *DefaultAccountManager) GetPeers(accountID, userID string) ([]*nbpeer.Peer, error) {
-	account, err := am.Store.GetAccount(accountID)
+func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID string) ([]*nbpeer.Peer, error) {
+	account, err := am.Store.GetAccount(ctx, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -73,7 +80,7 @@ func (am *DefaultAccountManager) GetPeers(accountID, userID string) ([]*nbpeer.P

 	// fetch all the peers that have access to the user's peers
 	for _, peer := range peers {
-		aclPeers, _ := account.getPeerConnectionResources(peer.ID, approvedPeersMap)
+		aclPeers, _ := account.getPeerConnectionResources(ctx, peer.ID, approvedPeersMap)
 		for _, p := range aclPeers {
 			peersMap[p.ID] = p
 		}
@@ -88,7 +95,7 @@ func (am *DefaultAccountManager) GetPeers(accountID, userID string) ([]*nbpeer.P
 }

 // MarkPeerConnected marks peer as connected (true) or disconnected (false)
-func (am *DefaultAccountManager) MarkPeerConnected(peerPubKey string, connected bool, realIP net.IP, account *Account) error {
+func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubKey string, connected bool, realIP net.IP, account *Account) error {
 	peer, err := account.FindPeerByPubKey(peerPubKey)
 	if err != nil {
 		return err
@@ -107,7 +114,7 @@ func (am *DefaultAccountManager) MarkPeerConnected(peerPubKey string, connected
 	if am.geo != nil && realIP != nil {
 		location, err := am.geo.Lookup(realIP)
 		if err != nil {
-			log.Warnf("failed to get location for peer %s realip: [%s]: %v", peer.ID, realIP.String(), err)
+			log.WithContext(ctx).Warnf("failed to get location for peer %s realip: [%s]: %v", peer.ID, realIP.String(), err)
 		} else {
 			peer.Location.ConnectionIP = realIP
 			peer.Location.CountryCode = location.Country.ISOCode
@@ -115,7 +122,7 @@ func (am *DefaultAccountManager) MarkPeerConnected(peerPubKey string, connected
 			peer.Location.GeoNameID = location.City.GeonameID
 			err = am.Store.SavePeerLocation(account.Id, peer)
 			if err != nil {
-				log.Warnf("could not store location for peer %s: %s", peer.ID, err)
+				log.WithContext(ctx).Warnf("could not store location for peer %s: %s", peer.ID, err)
 			}
 		}
 	}
@@ -128,24 +135,24 @@ func (am *DefaultAccountManager) MarkPeerConnected(peerPubKey string, connected
 	}

 	if peer.AddedWithSSOLogin() && peer.LoginExpirationEnabled && account.Settings.PeerLoginExpirationEnabled {
-		am.checkAndSchedulePeerLoginExpiration(account)
+		am.checkAndSchedulePeerLoginExpiration(ctx, account)
 	}

 	if oldStatus.LoginExpired {
 		// we need to update other peers because when peer login expires all other peers are notified to disconnect from
 		// the expired one. Here we notify them that connection is now allowed again.
-		am.updateAccountPeers(account)
+		am.updateAccountPeers(ctx, account)
 	}

 	return nil
 }

 // UpdatePeer updates peer. Only Peer.Name, Peer.SSHEnabled, and Peer.LoginExpirationEnabled can be updated.
-func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
-	unlock := am.Store.AcquireAccountWriteLock(accountID)
+func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
+	unlock := am.Store.AcquireAccountWriteLock(ctx, accountID)
 	defer unlock()

-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccount(ctx, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -155,7 +162,7 @@ func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nb
 		return nil, status.Errorf(status.NotFound, "peer %s not found", update.ID)
 	}

-	update, err = am.integratedPeerValidator.ValidatePeer(update, peer, userID, accountID, am.GetDNSDomain(), account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	update, err = am.integratedPeerValidator.ValidatePeer(ctx, update, peer, userID, accountID, am.GetDNSDomain(), account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
 	if err != nil {
 		return nil, err
 	}
@@ -166,7 +173,7 @@ func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nb
 		if !update.SSHEnabled {
 			event = activity.PeerSSHDisabled
 		}
-		am.StoreEvent(userID, peer.IP.String(), accountID, event, peer.EventMeta(am.GetDNSDomain()))
+		am.StoreEvent(ctx, userID, peer.IP.String(), accountID, event, peer.EventMeta(am.GetDNSDomain()))
 	}

 	if peer.Name != update.Name {
@@ -181,7 +188,7 @@ func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nb

 		peer.DNSLabel = newLabel

-		am.StoreEvent(userID, peer.ID, accountID, activity.PeerRenamed, peer.EventMeta(am.GetDNSDomain()))
+		am.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRenamed, peer.EventMeta(am.GetDNSDomain()))
 	}

 	if peer.LoginExpirationEnabled != update.LoginExpirationEnabled {
@@ -196,27 +203,27 @@ func (am *DefaultAccountManager) UpdatePeer(accountID, userID string, update *nb
 		if !update.LoginExpirationEnabled {
 			event = activity.PeerLoginExpirationDisabled
 		}
-		am.StoreEvent(userID, peer.IP.String(), accountID, event, peer.EventMeta(am.GetDNSDomain()))
+		am.StoreEvent(ctx, userID, peer.IP.String(), accountID, event, peer.EventMeta(am.GetDNSDomain()))

 		if peer.AddedWithSSOLogin() && peer.LoginExpirationEnabled && account.Settings.PeerLoginExpirationEnabled {
-			am.checkAndSchedulePeerLoginExpiration(account)
+			am.checkAndSchedulePeerLoginExpiration(ctx, account)
 		}
 	}

 	account.UpdatePeer(peer)

-	err = am.Store.SaveAccount(account)
+	err = am.Store.SaveAccount(ctx, account)
 	if err != nil {
 		return nil, err
 	}

-	am.updateAccountPeers(account)
+	am.updateAccountPeers(ctx, account)

 	return peer, nil
 }

 // deletePeers will delete all specified peers and send updates to the remote peers. Don't call without acquiring account lock
-func (am *DefaultAccountManager) deletePeers(account *Account, peerIDs []string, userID string) error {
+func (am *DefaultAccountManager) deletePeers(ctx context.Context, account *Account, peerIDs []string, userID string) error {

 	// the first loop is needed to ensure all peers present under the account before modifying, otherwise
 	// we might have some inconsistencies
@@ -233,13 +240,13 @@ func (am *DefaultAccountManager) deletePeers(account *Account, peerIDs []string,
 	// the 2nd loop performs the actual modification
 	for _, peer := range peers {

-		err := am.integratedPeerValidator.PeerDeleted(account.Id, peer.ID)
+		err := am.integratedPeerValidator.PeerDeleted(ctx, account.Id, peer.ID)
 		if err != nil {
 			return err
 		}

 		account.DeletePeer(peer.ID)
-		am.peersUpdateManager.SendUpdate(peer.ID,
+		am.peersUpdateManager.SendUpdate(ctx, peer.ID,
 			&UpdateMessage{
 				Update: &proto.SyncResponse{
 					// fill those field for backward compatibility
@@ -255,41 +262,41 @@ func (am *DefaultAccountManager) deletePeers(account *Account, peerIDs []string,
 					},
 				},
 			})
-		am.peersUpdateManager.CloseChannel(peer.ID)
-		am.StoreEvent(userID, peer.ID, account.Id, activity.PeerRemovedByUser, peer.EventMeta(am.GetDNSDomain()))
+		am.peersUpdateManager.CloseChannel(ctx, peer.ID)
+		am.StoreEvent(ctx, userID, peer.ID, account.Id, activity.PeerRemovedByUser, peer.EventMeta(am.GetDNSDomain()))
 	}

 	return nil
 }

 // DeletePeer removes peer from the account by its IP
-func (am *DefaultAccountManager) DeletePeer(accountID, peerID, userID string) error {
-	unlock := am.Store.AcquireAccountWriteLock(accountID)
+func (am *DefaultAccountManager) DeletePeer(ctx context.Context, accountID, peerID, userID string) error {
+	unlock := am.Store.AcquireAccountWriteLock(ctx, accountID)
 	defer unlock()

-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccount(ctx, accountID)
 	if err != nil {
 		return err
 	}

-	err = am.deletePeers(account, []string{peerID}, userID)
+	err = am.deletePeers(ctx, account, []string{peerID}, userID)
 	if err != nil {
 		return err
 	}

-	err = am.Store.SaveAccount(account)
+	err = am.Store.SaveAccount(ctx, account)
 	if err != nil {
 		return err
 	}

-	am.updateAccountPeers(account)
+	am.updateAccountPeers(ctx, account)

 	return nil
 }

 // GetNetworkMap returns Network map for a given peer (omits original peer from the Peers result)
-func (am *DefaultAccountManager) GetNetworkMap(peerID string) (*NetworkMap, error) {
-	account, err := am.Store.GetAccountByPeerID(peerID)
+func (am *DefaultAccountManager) GetNetworkMap(ctx context.Context, peerID string) (*NetworkMap, error) {
+	account, err := am.Store.GetAccountByPeerID(ctx, peerID)
 	if err != nil {
 		return nil, err
 	}
@@ -308,12 +315,12 @@ func (am *DefaultAccountManager) GetNetworkMap(peerID string) (*NetworkMap, erro
 	if err != nil {
 		return nil, err
 	}
-	return account.GetPeerNetworkMap(peer.ID, am.dnsDomain, validatedPeers), nil
+	return account.GetPeerNetworkMap(ctx, peer.ID, am.dnsDomain, validatedPeers), nil
 }

 // GetPeerNetwork returns the Network for a given peer
-func (am *DefaultAccountManager) GetPeerNetwork(peerID string) (*Network, error) {
-	account, err := am.Store.GetAccountByPeerID(peerID)
+func (am *DefaultAccountManager) GetPeerNetwork(ctx context.Context, peerID string) (*Network, error) {
+	account, err := am.Store.GetAccountByPeerID(ctx, peerID)
 	if err != nil {
 		return nil, err
 	}
@@ -328,10 +335,10 @@ func (am *DefaultAccountManager) GetPeerNetwork(peerID string) (*Network, error)
 // to it. We also add the User ID to the peer metadata to identify registrant. If no userID provided, then fail with status.PermissionDenied
 // Each new Peer will be assigned a new next net.IP from the Account.Network and Account.Network.LastIP will be updated (IP's are not reused).
 // The peer property is just a placeholder for the Peer properties to pass further
-func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.Peer) (*nbpeer.Peer, *NetworkMap, error) {
+func (am *DefaultAccountManager) AddPeer(ctx context.Context, setupKey, userID string, peer *nbpeer.Peer) (*nbpeer.Peer, *NetworkMap, []*posture.Checks, error) {
 	if setupKey == "" && userID == "" {
 		// no auth method provided => reject access
-		return nil, nil, status.Errorf(status.Unauthenticated, "no peer auth method provided, please use a setup key or interactive SSO login")
+		return nil, nil, nil, status.Errorf(status.Unauthenticated, "no peer auth method provided, please use a setup key or interactive SSO login")
 	}

 	upperKey := strings.ToUpper(setupKey)
@@ -342,13 +349,13 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		addedByUser = true
 		accountID, err = am.Store.GetAccountIDByUserID(userID)
 	} else {
-		accountID, err = am.Store.GetAccountIDBySetupKey(setupKey)
+		accountID, err = am.Store.GetAccountIDBySetupKey(ctx, setupKey)
 	}
 	if err != nil {
-		return nil, nil, status.Errorf(status.NotFound, "failed adding new peer: account not found")
+		return nil, nil, nil, status.Errorf(status.NotFound, "failed adding new peer: account not found")
 	}

-	unlock := am.Store.AcquireAccountWriteLock(accountID)
+	unlock := am.Store.AcquireAccountWriteLock(ctx, accountID)
 	defer func() {
 		if unlock != nil {
 			unlock()
@@ -357,14 +364,14 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P

 	var account *Account
 	// ensure that we consider modification happened meanwhile (because we were outside the account lock when we fetched the account)
-	account, err = am.Store.GetAccount(accountID)
+	account, err = am.Store.GetAccount(ctx, accountID)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	if strings.ToLower(peer.Meta.Hostname) == "iphone" || strings.ToLower(peer.Meta.Hostname) == "ipad" && userID != "" {
 		if am.idpManager != nil {
-			userdata, err := am.lookupUserInCache(userID, account)
+			userdata, err := am.lookupUserInCache(ctx, userID, account)
 			if err == nil && userdata != nil {
 				peer.Meta.Hostname = fmt.Sprintf("%s-%s", peer.Meta.Hostname, strings.Split(userdata.Email, "@")[0])
 			}
@@ -378,7 +385,7 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 	// The connecting peer should be able to recover with a retry.
 	_, err = account.FindPeerByPubKey(peer.Key)
 	if err == nil {
-		return nil, nil, status.Errorf(status.PreconditionFailed, "peer has been already registered")
+		return nil, nil, nil, status.Errorf(status.PreconditionFailed, "peer has been already registered")
 	}

 	opEvent := &activity.Event{
@@ -392,11 +399,11 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		// validate the setup key if adding with a key
 		sk, err := account.FindSetupKey(upperKey)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}

 		if !sk.IsValid() {
-			return nil, nil, status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
+			return nil, nil, nil, status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
 		}

 		account.SetupKeys[sk.Key] = sk.IncrementUsage()
@@ -414,14 +421,14 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P

 	newLabel, err := getPeerHostLabel(peer.Meta.Hostname, existingLabels)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	peer.DNSLabel = newLabel
 	network := account.Network
 	nextIp, err := AllocatePeerIP(network.Net, takenIps)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	registrationTime := time.Now().UTC()
@@ -448,7 +455,7 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 	// add peer to 'All' group
 	group, err := account.GetGroupAll()
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	group.Peers = append(group.Peers, newPeer.ID)

@@ -456,12 +463,12 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 	if addedByUser {
 		groupsToAdd, err = account.getUserGroups(userID)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 	} else {
 		groupsToAdd, err = account.getSetupKeyGroups(upperKey)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 	}

@@ -473,21 +480,21 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		}
 	}

-	newPeer = am.integratedPeerValidator.PreparePeer(account.Id, newPeer, account.GetPeerGroupsList(newPeer.ID), account.Settings.Extra)
+	newPeer = am.integratedPeerValidator.PreparePeer(ctx, account.Id, newPeer, account.GetPeerGroupsList(newPeer.ID), account.Settings.Extra)

 	if addedByUser {
 		user, err := account.FindUser(userID)
 		if err != nil {
-			return nil, nil, status.Errorf(status.Internal, "couldn't find user")
+			return nil, nil, nil, status.Errorf(status.Internal, "couldn't find user")
 		}
 		user.updateLastLogin(newPeer.LastLogin)
 	}

 	account.Peers[newPeer.ID] = newPeer
 	account.Network.IncSerial()
-	err = am.Store.SaveAccount(account)
+	err = am.Store.SaveAccount(ctx, account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	// Account is saved, we can release the lock
@@ -500,61 +507,79 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		opEvent.Meta["setup_key_name"] = setupKeyName
 	}

-	am.StoreEvent(opEvent.InitiatorID, opEvent.TargetID, opEvent.AccountID, opEvent.Activity, opEvent.Meta)
+	am.StoreEvent(ctx, opEvent.InitiatorID, opEvent.TargetID, opEvent.AccountID, opEvent.Activity, opEvent.Meta)

-	am.updateAccountPeers(account)
+	am.updateAccountPeers(ctx, account)

 	approvedPeersMap, err := am.GetValidatedPeers(account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	networkMap := account.GetPeerNetworkMap(newPeer.ID, am.dnsDomain, approvedPeersMap)
-	return newPeer, networkMap, nil
+
+	postureChecks := am.getPeerPostureChecks(account, peer)
+	networkMap := account.GetPeerNetworkMap(ctx, newPeer.ID, am.dnsDomain, approvedPeersMap)
+	return newPeer, networkMap, postureChecks, nil
 }

 // SyncPeer checks whether peer is eligible for receiving NetworkMap (authenticated) and returns its NetworkMap if eligible
-func (am *DefaultAccountManager) SyncPeer(sync PeerSync, account *Account) (*nbpeer.Peer, *NetworkMap, error) {
+func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync PeerSync, account *Account) (*nbpeer.Peer, *NetworkMap, []*posture.Checks, error) {
 	peer, err := account.FindPeerByPubKey(sync.WireGuardPubKey)
 	if err != nil {
-		return nil, nil, status.NewPeerNotRegisteredError()
+		return nil, nil, nil, status.NewPeerNotRegisteredError()
 	}

 	err = checkIfPeerOwnerIsBlocked(peer, account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

-	if peerLoginExpired(peer, account.Settings) {
-		return nil, nil, status.Errorf(status.PermissionDenied, "peer login has expired, please log in once more")
+	if peerLoginExpired(ctx, peer, account.Settings) {
+		return nil, nil, nil, status.Errorf(status.PermissionDenied, "peer login has expired, please log in once more")
 	}

-	peerNotValid, isStatusChanged, err := am.integratedPeerValidator.IsNotValidPeer(account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	peer, updated := updatePeerMeta(peer, sync.Meta, account)
+	if updated {
+		err = am.Store.SaveAccount(ctx, account)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		if sync.UpdateAccountPeers {
+			am.updateAccountPeers(ctx, account)
+		}
+	}
+
+	peerNotValid, isStatusChanged, err := am.integratedPeerValidator.IsNotValidPeer(ctx, account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

+	var postureChecks []*posture.Checks
+
 	if peerNotValid {
 		emptyMap := &NetworkMap{
 			Network: account.Network.Copy(),
 		}
-		return peer, emptyMap, nil
+		return peer, emptyMap, postureChecks, nil
 	}

 	if isStatusChanged {
-		am.updateAccountPeers(account)
+		am.updateAccountPeers(ctx, account)
 	}

 	validPeersMap, err := am.GetValidatedPeers(account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	return peer, account.GetPeerNetworkMap(peer.ID, am.dnsDomain, validPeersMap), nil
+	postureChecks = am.getPeerPostureChecks(account, peer)
+
+	return peer, account.GetPeerNetworkMap(ctx, peer.ID, am.dnsDomain, validPeersMap), postureChecks, nil
 }

 // LoginPeer logs in or registers a peer.
 // If peer doesn't exist the function checks whether a setup key or a user is present and registers a new peer if so.
-func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *NetworkMap, error) {
-	accountID, err := am.Store.GetAccountIDByPeerPubKey(login.WireGuardPubKey)
+func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login PeerLogin) (*nbpeer.Peer, *NetworkMap, []*posture.Checks, error) {
+	accountID, err := am.Store.GetAccountIDByPeerPubKey(ctx, login.WireGuardPubKey)
 	if err != nil {
 		if errStatus, ok := status.FromError(err); ok && errStatus.Type() == status.NotFound {
 			// we couldn't find this peer by its public key which can mean that peer hasn't been registered yet.
@@ -567,7 +592,7 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 			if am.geo != nil && login.ConnectionIP != nil {
 				location, err := am.geo.Lookup(login.ConnectionIP)
 				if err != nil {
-					log.Warnf("failed to get location for new peer realip: [%s]: %v", login.ConnectionIP.String(), err)
+					log.WithContext(ctx).Warnf("failed to get location for new peer realip: [%s]: %v", login.ConnectionIP.String(), err)
 				} else {
 					newPeer.Location.ConnectionIP = login.ConnectionIP
 					newPeer.Location.CountryCode = location.Country.ISOCode
@@ -577,49 +602,50 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 				}
 			}

-			return am.AddPeer(login.SetupKey, login.UserID, newPeer)
+			return am.AddPeer(ctx, login.SetupKey, login.UserID, newPeer)
 		}
-		log.Errorf("failed while logging in peer %s: %v", login.WireGuardPubKey, err)
-		return nil, nil, status.Errorf(status.Internal, "failed while logging in peer")
+
+		log.WithContext(ctx).Errorf("failed while logging in peer %s: %v", login.WireGuardPubKey, err)
+		return nil, nil, nil, status.Errorf(status.Internal, "failed while logging in peer")
 	}

-	peer, err := am.Store.GetPeerByPeerPubKey(login.WireGuardPubKey)
+	peer, err := am.Store.GetPeerByPeerPubKey(ctx, login.WireGuardPubKey)
 	if err != nil {
-		return nil, nil, status.NewPeerNotRegisteredError()
+		return nil, nil, nil, status.NewPeerNotRegisteredError()
 	}

-	accSettings, err := am.Store.GetAccountSettings(accountID)
+	accSettings, err := am.Store.GetAccountSettings(ctx, accountID)
 	if err != nil {
-		return nil, nil, status.Errorf(status.Internal, "failed to get account settings: %s", err)
+		return nil, nil, nil, status.Errorf(status.Internal, "failed to get account settings: %s", err)
 	}

 	var isWriteLock bool

 	// duplicated logic from after the lock to have an early exit
-	expired := peerLoginExpired(peer, accSettings)
+	expired := peerLoginExpired(ctx, peer, accSettings)
 	switch {
 	case expired:
-		if err := checkAuth(login.UserID, peer); err != nil {
-			return nil, nil, err
+		if err := checkAuth(ctx, login.UserID, peer); err != nil {
+			return nil, nil, nil, err
 		}
 		isWriteLock = true
-		log.Debugf("peer login expired, acquiring write lock")
+		log.WithContext(ctx).Debugf("peer login expired, acquiring write lock")

 	case peer.UpdateMetaIfNew(login.Meta):
 		isWriteLock = true
-		log.Debugf("peer changed meta, acquiring write lock")
+		log.WithContext(ctx).Debugf("peer changed meta, acquiring write lock")

 	default:
 		isWriteLock = false
-		log.Debugf("peer meta is the same, acquiring read lock")
+		log.WithContext(ctx).Debugf("peer meta is the same, acquiring read lock")
 	}

 	var unlock func()

 	if isWriteLock {
-		unlock = am.Store.AcquireAccountWriteLock(accountID)
+		unlock = am.Store.AcquireAccountWriteLock(ctx, accountID)
 	} else {
-		unlock = am.Store.AcquireAccountReadLock(accountID)
+		unlock = am.Store.AcquireAccountReadLock(ctx, accountID)
 	}
 	defer func() {
 		if unlock != nil {
@@ -628,28 +654,28 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 	}()

 	// fetch the account from the store once more after acquiring lock to avoid concurrent updates inconsistencies
-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccount(ctx, accountID)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	peer, err = account.FindPeerByPubKey(login.WireGuardPubKey)
 	if err != nil {
-		return nil, nil, status.NewPeerNotRegisteredError()
+		return nil, nil, nil, status.NewPeerNotRegisteredError()
 	}

 	err = checkIfPeerOwnerIsBlocked(peer, account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	// this flag prevents unnecessary calls to the persistent store.
 	shouldStoreAccount := false
 	updateRemotePeers := false
-	if peerLoginExpired(peer, account.Settings) {
-		err = checkAuth(login.UserID, peer)
+	if peerLoginExpired(ctx, peer, account.Settings) {
+		err = checkAuth(ctx, login.UserID, peer)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 		// If peer was expired before and if it reached this point, it is re-authenticated.
 		// UserID is present, meaning that JWT validation passed successfully in the API layer.
@@ -660,57 +686,60 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 		// sync user last login with peer last login
 		user, err := account.FindUser(login.UserID)
 		if err != nil {
-			return nil, nil, status.Errorf(status.Internal, "couldn't find user")
+			return nil, nil, nil, status.Errorf(status.Internal, "couldn't find user")
 		}
 		user.updateLastLogin(peer.LastLogin)

-		am.StoreEvent(login.UserID, peer.ID, account.Id, activity.UserLoggedInPeer, peer.EventMeta(am.GetDNSDomain()))
+		am.StoreEvent(ctx, login.UserID, peer.ID, account.Id, activity.UserLoggedInPeer, peer.EventMeta(am.GetDNSDomain()))
 	}

-	isRequiresApproval, isStatusChanged, err := am.integratedPeerValidator.IsNotValidPeer(account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	isRequiresApproval, isStatusChanged, err := am.integratedPeerValidator.IsNotValidPeer(ctx, account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	peer, updated := updatePeerMeta(peer, login.Meta, account)
 	if updated {
 		shouldStoreAccount = true
 	}

-	peer, err = am.checkAndUpdatePeerSSHKey(peer, account, login.SSHKey)
+	peer, err = am.checkAndUpdatePeerSSHKey(ctx, peer, account, login.SSHKey)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}

 	if shouldStoreAccount {
 		if !isWriteLock {
-			log.Errorf("account %s should be stored but is not write locked", accountID)
-			return nil, nil, status.Errorf(status.Internal, "account should be stored but is not write locked")
+			log.WithContext(ctx).Errorf("account %s should be stored but is not write locked", accountID)
+			return nil, nil, nil, status.Errorf(status.Internal, "account should be stored but is not write locked")
 		}
-		err = am.Store.SaveAccount(account)
+		err = am.Store.SaveAccount(ctx, account)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 	}
 	unlock()
 	unlock = nil

 	if updateRemotePeers || isStatusChanged {
-		am.updateAccountPeers(account)
+		am.updateAccountPeers(ctx, account)
 	}

+	var postureChecks []*posture.Checks
+
 	if isRequiresApproval {
 		emptyMap := &NetworkMap{
 			Network: account.Network.Copy(),
 		}
-		return peer, emptyMap, nil
+		return peer, emptyMap, postureChecks, nil
 	}

 	approvedPeersMap, err := am.GetValidatedPeers(account)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
+	postureChecks = am.getPeerPostureChecks(account, peer)

-	return peer, account.GetPeerNetworkMap(peer.ID, am.dnsDomain, approvedPeersMap), nil
+	return peer, account.GetPeerNetworkMap(ctx, peer.ID, am.dnsDomain, approvedPeersMap), postureChecks, nil
 }

 func checkIfPeerOwnerIsBlocked(peer *nbpeer.Peer, account *Account) error {
@@ -726,23 +755,23 @@ func checkIfPeerOwnerIsBlocked(peer *nbpeer.Peer, account *Account) error {
 	return nil
 }

-func checkAuth(loginUserID string, peer *nbpeer.Peer) error {
+func checkAuth(ctx context.Context, loginUserID string, peer *nbpeer.Peer) error {
 	if loginUserID == "" {
 		// absence of a user ID indicates that JWT wasn't provided.
 		return status.Errorf(status.PermissionDenied, "peer login has expired, please log in once more")
 	}
 	if peer.UserID != loginUserID {
-		log.Warnf("user mismatch when logging in peer %s: peer user %s, login user %s ", peer.ID, peer.UserID, loginUserID)
+		log.WithContext(ctx).Warnf("user mismatch when logging in peer %s: peer user %s, login user %s ", peer.ID, peer.UserID, loginUserID)
 		return status.Errorf(status.Unauthenticated, "can't login")
 	}
 	return nil
 }

-func peerLoginExpired(peer *nbpeer.Peer, settings *Settings) bool {
+func peerLoginExpired(ctx context.Context, peer *nbpeer.Peer, settings *Settings) bool {
 	expired, expiresIn := peer.LoginExpired(settings.PeerLoginExpiration)
 	expired = settings.PeerLoginExpirationEnabled && expired
 	if expired || peer.Status.LoginExpired {
-		log.Debugf("peer's %s login expired %v ago", peer.ID, expiresIn)
+		log.WithContext(ctx).Debugf("peer's %s login expired %v ago", peer.ID, expiresIn)
 		return true
 	}
 	return false
@@ -753,48 +782,48 @@ func updatePeerLastLogin(peer *nbpeer.Peer, account *Account) {
 	account.UpdatePeer(peer)
 }

-func (am *DefaultAccountManager) checkAndUpdatePeerSSHKey(peer *nbpeer.Peer, account *Account, newSSHKey string) (*nbpeer.Peer, error) {
+func (am *DefaultAccountManager) checkAndUpdatePeerSSHKey(ctx context.Context, peer *nbpeer.Peer, account *Account, newSSHKey string) (*nbpeer.Peer, error) {
 	if len(newSSHKey) == 0 {
-		log.Debugf("no new SSH key provided for peer %s, skipping update", peer.ID)
+		log.WithContext(ctx).Debugf("no new SSH key provided for peer %s, skipping update", peer.ID)
 		return peer, nil
 	}

 	if peer.SSHKey == newSSHKey {
-		log.Debugf("same SSH key provided for peer %s, skipping update", peer.ID)
+		log.WithContext(ctx).Debugf("same SSH key provided for peer %s, skipping update", peer.ID)
 		return peer, nil
 	}

 	peer.SSHKey = newSSHKey
 	account.UpdatePeer(peer)

-	err := am.Store.SaveAccount(account)
+	err := am.Store.SaveAccount(ctx, account)
 	if err != nil {
 		return nil, err
 	}

 	// trigger network map update
-	am.updateAccountPeers(account)
+	am.updateAccountPeers(ctx, account)

 	return peer, nil
 }

 // UpdatePeerSSHKey updates peer's public SSH key
-func (am *DefaultAccountManager) UpdatePeerSSHKey(peerID string, sshKey string) error {
+func (am *DefaultAccountManager) UpdatePeerSSHKey(ctx context.Context, peerID string, sshKey string) error {
 	if sshKey == "" {
-		log.Debugf("empty SSH key provided for peer %s, skipping update", peerID)
+		log.WithContext(ctx).Debugf("empty SSH key provided for peer %s, skipping update", peerID)
 		return nil
 	}

-	account, err := am.Store.GetAccountByPeerID(peerID)
+	account, err := am.Store.GetAccountByPeerID(ctx, peerID)
 	if err != nil {
 		return err
 	}

-	unlock := am.Store.AcquireAccountWriteLock(account.Id)
+	unlock := am.Store.AcquireAccountWriteLock(ctx, account.Id)
 	defer unlock()

 	// ensure that we consider modification happened meanwhile (because we were outside the account lock when we fetched the account)
-	account, err = am.Store.GetAccount(account.Id)
+	account, err = am.Store.GetAccount(ctx, account.Id)
 	if err != nil {
 		return err
 	}
@@ -805,30 +834,30 @@ func (am *DefaultAccountManager) UpdatePeerSSHKey(peerID string, sshKey string)
 	}

 	if peer.SSHKey == sshKey {
-		log.Debugf("same SSH key provided for peer %s, skipping update", peerID)
+		log.WithContext(ctx).Debugf("same SSH key provided for peer %s, skipping update", peerID)
 		return nil
 	}

 	peer.SSHKey = sshKey
 	account.UpdatePeer(peer)

-	err = am.Store.SaveAccount(account)
+	err = am.Store.SaveAccount(ctx, account)
 	if err != nil {
 		return err
 	}

 	// trigger network map update
-	am.updateAccountPeers(account)
+	am.updateAccountPeers(ctx, account)

 	return nil
 }

 // GetPeer for a given accountID, peerID and userID error if not found.
-func (am *DefaultAccountManager) GetPeer(accountID, peerID, userID string) (*nbpeer.Peer, error) {
-	unlock := am.Store.AcquireAccountWriteLock(accountID)
+func (am *DefaultAccountManager) GetPeer(ctx context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error) {
+	unlock := am.Store.AcquireAccountWriteLock(ctx, accountID)
 	defer unlock()

-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccount(ctx, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -865,7 +894,7 @@ func (am *DefaultAccountManager) GetPeer(accountID, peerID, userID string) (*nbp
 	}

 	for _, p := range userPeers {
-		aclPeers, _ := account.getPeerConnectionResources(p.ID, approvedPeersMap)
+		aclPeers, _ := account.getPeerConnectionResources(ctx, p.ID, approvedPeersMap)
 		for _, aclPeer := range aclPeers {
 			if aclPeer.ID == peerID {
 				return peer, nil
@@ -886,21 +915,23 @@ func updatePeerMeta(peer *nbpeer.Peer, meta nbpeer.PeerSystemMeta, account *Acco

 // updateAccountPeers updates all peers that belong to an account.
 // Should be called when changes have to be synced to peers.
-func (am *DefaultAccountManager) updateAccountPeers(account *Account) {
+func (am *DefaultAccountManager) updateAccountPeers(ctx context.Context, account *Account) {
 	peers := account.GetPeers()

 	approvedPeersMap, err := am.GetValidatedPeers(account)
 	if err != nil {
-		log.Errorf("failed send out updates to peers, failed to validate peer: %v", err)
+		log.WithContext(ctx).Errorf("failed send out updates to peers, failed to validate peer: %v", err)
 		return
 	}
 	for _, peer := range peers {
 		if !am.peersUpdateManager.HasChannel(peer.ID) {
-			log.Tracef("peer %s doesn't have a channel, skipping network map update", peer.ID)
+			log.WithContext(ctx).Tracef("peer %s doesn't have a channel, skipping network map update", peer.ID)
 			continue
 		}
-		remotePeerNetworkMap := account.GetPeerNetworkMap(peer.ID, am.dnsDomain, approvedPeersMap)
-		update := toSyncResponse(nil, peer, nil, nil, remotePeerNetworkMap, am.GetDNSDomain())
-		am.peersUpdateManager.SendUpdate(peer.ID, &UpdateMessage{Update: update})
+
+		postureChecks := am.getPeerPostureChecks(account, peer)
+		remotePeerNetworkMap := account.GetPeerNetworkMap(ctx, peer.ID, am.dnsDomain, approvedPeersMap)
+		update := toSyncResponse(ctx, nil, peer, nil, nil, remotePeerNetworkMap, am.GetDNSDomain(), postureChecks)
+		am.peersUpdateManager.SendUpdate(ctx, peer.ID, &UpdateMessage{Update: update})
 	}
 }