sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 08:59:08 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,416 Commits 606 Branches 380 Tags
965deb4e682aa0620efcf2e7d74cb4863c9f7fff
Commit Graph
1323 Commits
Author SHA1 Message Date
Dmitri Dolguikh e35a0f3318 added PrivateServiceCandidates 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 18:04:11 +02:00
pascal 56c411babd fixed networks query and extended error wrapping 2026-08-03 17:52:33 +02:00
Dmitri Dolguikh 164b2baa4d Merge remote-tracking branch 'origin/revert/component-types' into revert/component-types 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 17:29:42 +02:00
Dmitri Dolguikh 0b29c6ed1a adding buildPrivateServiceCandidates 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 17:29:09 +02:00
pascal 724b61440b use new path on initial sync 2026-08-03 17:27:58 +02:00
pascal 22590ad66e hookup network map store 2026-08-03 17:27:24 +02:00
Dmitri Dolguikh b8e004ea89 also build proxy-cluster to peer idx 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 14:58:53 +02:00
Dmitri Dolguikh e2797360f4 support for applied zone candidates 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 14:32:54 +02:00
Dmitri Dolguikh 2f399f1e6e wire up dnssettings 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 14:12:27 +02:00
Dmitri Dolguikh 82c1e18264 renamed allowed_user_ids.go to user.got 2026-08-03 13:54:22 +02:00
Dmitri Dolguikh ce9023bd27 wire up accountsettings 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 13:51:25 +02:00
Dmitri Dolguikh 7d33356776 support for group to user ids 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 13:47:14 +02:00
Pascal Fischer f9b412228e [management] fix handling of empty network map during decode and encode (#6987) 2026-08-03 13:20:53 +02:00
Maycon Santos 2bfd9fcffe [management] Resolve agent network permissions per submodule (#7030) 
## Describe your changes

Agent Network gates providers, policies, guardrails, budgets, usage,
access logs, and settings behind the single `agent_network` permission
module, so access is all-or-nothing: a future delegated role cannot be
scoped to a subset of the area (for example usage-only visibility).

This introduces dotted submodules (`agent_network.providers`,
`.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`)
and resolves grants with a cascade: exact module first, then its parent,
then the role's `AutoAllowNew` default. The agent network manager now
validates each operation against its matching submodule. `usage`
(aggregated counters, overview) is deliberately separate from `logs`
(request-level entries, which can contain captured prompts).

No role definitions change. No built-in role carries an explicit
`agent_network` entry, so every role resolves the submodules exactly as
it resolved the parent module before — pinned by a test that compares
each built-in role's answer on every submodule against its answer on
`agent_network`. Role additions that use these submodules come
separately.
 2026-08-03 12:45:17 +02:00
Brad Ison 7639655883 [management] Generic gRPC extension seam for external modules (#6894) 
## Describe your changes

This adds an extension point to the management server for registering
additional gRPC services. We already have a generic integrations system
and dependency injection for server components. This closes the gap on
being able to also extend the gRPC API cleanly.

## Issue ticket number and link

N/A

## Stack

<!-- branch-stack -->

### Checklist
- [ ] Is it a bug fix
- [ ] Is a typo/documentation fix
- [x] Is a feature enhancement
- [ ] It is a refactor
- [ ] Created tests that fail without the change (if possible)
- [ ] This change does **not** modify the public API, gRPC protocols,
functionality behavior, CLI / service flags, or introduce a new feature
— **OR** I have discussed it with the NetBird team beforehand (link the
issue / Slack thread in the description). See
[CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first).

> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).

## Documentation
Select exactly one:

- [ ] I added/updated documentation for this change
- [x] Documentation is **not needed** for this change (explain why)

No docs needed. This is strictly a small internal plumbing enhancement /
refactor.

<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/netbird/pr/6894"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img
alt="View with [code]smith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787582002&installation_model_id=427504&pr_number=6894&repository=netbirdio%2Fnetbird&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fnetbird%2Fpull%2F6894&signature=3288061677db243031830964fec8f0f34c82f7fc63a39298cd0b4e3490551060"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img
alt="Autofix with [code]smith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you
need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a gRPC extension mechanism to contribute additional services and
automatically chain extra unary and stream interceptors.
  * Extension shutdown hooks now run as part of server stop.
* Added exported proxy token generation via `GenerateProxyToken()` for
external integrations.
* **Tests**
* Added coverage for extension interceptor/service wiring, extension
shutdown execution, and proxy token generation validation (including
hash consistency and prefix).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 12:26:38 +02:00
Dmitri Dolguikh 993291149c Merge remote-tracking branch 'origin/revert/component-types' into revert/component-types 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 12:20:18 +02:00
Dmitri Dolguikh 98f7ea40a1 added allowed_user_ids call 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 12:19:50 +02:00
pascal 76db9ab94f update integrated validator 2026-08-03 12:11:35 +02:00
Dmitri Dolguikh 9653b15d78 automatically fill empty public ids for view types 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 11:34:22 +02:00
Dmitri Dolguikh 206bb1676b build resourcePolicies map 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-03 10:53:54 +02:00
Dmitri Dolguikh 600b0c752b also return a net resource to groups index from GetGroups call 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-01 11:56:17 +02:00
Dmitri Dolguikh b02736adc3 cleanup network routers retrieval 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-08-01 11:54:14 +02:00
Misha Bragin 0780a806f2 [management, proxy] Management-owned LLM pricing: file-backed defaults + (#6965) 2026-07-31 20:52:56 +02:00
Dmitri Dolguikh 5d6117d2c0 adding network_map_data: compute Routers field 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-31 17:56:52 +02:00
Pascal Fischer aad2702a14 [proxy] remove cluster tag from proxy metrics (#6985) 2026-07-31 16:56:41 +02:00
Dmitri Dolguikh c2f8360b00 adding support for bulding of network_map_data 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-31 15:58:40 +02:00
Dmitri Dolguikh ea1b4d56e8 added support for queries via pgx connection 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-31 15:03:15 +02:00
Dmitri Dolguikh acbe22b831 small cleanups 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-31 13:41:34 +02:00
Dmitri Dolguikh 3b5c8e2298 started moving pg-specific nmap tests to integration_tests/management/network_map_db/pgsql 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-31 12:29:35 +02:00
Dmitri Dolguikh 2baeb4bc0d clean up sql types conversion test 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 19:35:11 +02:00
Dmitri Dolguikh 4bf75fdc97 support for posture-checks 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 18:00:58 +02:00
Dmitri Dolguikh 799f3a3c62 Merge remote-tracking branch 'origin/revert/component-types' into revert/component-types 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 16:03:46 +02:00
Dmitri Dolguikh 129736ad61 support for account settings 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 16:03:19 +02:00
pascal f7be9c4347 legacy network mal and equivalence test 2026-07-30 15:45:15 +02:00
Dmitri Dolguikh e05cb5264d support for dns custom zones 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 15:34:09 +02:00
Dmitri Dolguikh 5a10561ca1 fix handling of string slices 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-30 11:31:53 +02:00
Dmitri Dolguikh 42ce83a8f3 added support for account network 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-29 18:57:08 +02:00
Dmitri Dolguikh e620c86cd4 added support for networkrouters 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-29 18:32:51 +02:00
Dmitri Dolguikh 9dee2d60b9 added support for networkresources 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-29 18:19:34 +02:00
Dmitri Dolguikh 4525014632 support for nameservergroups 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-29 17:59:44 +02:00
Dmitri Dolguikh 23a5c0de4b added support for routes 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-29 17:37:00 +02:00
Pascal Fischer dd2bdc0de3 [management] explicit accountID check when deleting a user (#6944) 2026-07-28 18:34:55 +02:00
Dmitri Dolguikh 25e882004f added retrieval of policies 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-28 18:06:28 +02:00
Dmitri Dolguikh 15003258d2 networkmap read-only interface for pgsql 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-28 16:46:45 +02:00
Viktor Liu 9269b56386 [management] Read reverse-proxy service and target columns in Postgres path (#6886) 2026-07-28 14:46:19 +02:00
Viktor Liu b3f9b82442 [management] Force routing-peer DNS resolution for reverse-proxy domain targets (#6872) 2026-07-28 14:45:57 +02:00
Maycon Santos bab5572a74 [management, proxy] scope agent-network model allowlist per policy/group and provider (#6905) 
## Describe your changes

The model-allowlist guardrail was merged into one account-wide union and
enforced flat on every request, ignoring which policy/group/provider
authorised it. With multiple policies — especially a mix of guardrailed
and un-guardrailed ones — this caused:

- **false-allow**: a model allowlisted for one group/provider leaked to
any caller; and
- **false-deny**: an un-guardrailed policy (intended unrestricted) was
blocked by another policy's allowlist.

Enforcement is now policy/group-aware, mirroring `llm_limit_check`:

- **Management (`SelectPolicyForRequest`) is authoritative.** It uses
the request model (already carried in
`CheckLLMPolicyLimitsRequest.model`, previously ignored) to keep only
applicable policies whose guardrails permit the model; no
allowlist-enabled guardrail = unrestricted. Denies
`llm_policy.model_blocked` when policies govern the (provider, groups)
but none permits the model.
- **Proxy `llm_guardrail` becomes a per-provider fail-closed backstop.**
The synthesiser emits an allowlist only for providers every authorising
policy restricts; the middleware keys off the resolved provider id and
keeps unknown-model fail-closed.
 2026-07-27 20:43:59 +02:00
Dmitri Dolguikh 2af3a5fba5 do not send resource policies map over the wire 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
 2026-07-27 19:00:30 +02:00
pascal a6603a2e0a have explicit network map data type and do calculation from there 2026-07-27 15:17:30 +02:00
Maycon Santosandbraginini 4f6247b5c3 [management, proxy] Add prompt-cache token and cost accounting to agent network usage (#6900) 
Co-authored-by: braginini <bangvalo@gmail.com>
 2026-07-26 21:42:41 +02:00