WIP

.github/workflows/golangci-lint.yml

@@ -45,7 +45,7 @@ jobs:
             display_name: Linux
     name: ${{ matrix.display_name }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 25
+    timeout-minutes: 15
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -79,4 +79,4 @@ jobs:
           skip-cache: true
           skip-save-cache: true
           cache-invalidation-interval: 0
-          args: --timeout=20m
+          args: --timeout=12m

client/android/client.go

@@ -247,9 +247,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/cmd/root.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"net"
 	"os"
 	"os/signal"
 	"path"
@@ -79,6 +80,8 @@ var (
 	updateSettingsDisabled bool
 	captureEnabled         bool
 	networksDisabled       bool
+	socketOwner            string
+	strictSocketDisabled   bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -143,10 +146,12 @@ func init() {
 
 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
+		// Named pipe (not loopback TCP): the pipe SDDL gates who may connect and
+		// the pipe client token carries the caller's SID for per-RPC authorization.
+		defaultDaemonAddr = "npipe://netbird"
 	}
 
-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -265,16 +270,31 @@ func FlagNameToEnvVar(cmdFlag string, prefix string) string {
 }
 
 // DialClientGRPCServer returns client connection to the daemon server.
+//
+// The daemon reads the caller's kernel identity from the transport (SO_PEERCRED
+// on a Unix socket, the client token on a Windows named pipe), so the client
+// side uses insecure (plaintext) credentials — it needs no cooperation to be
+// identified. For npipe addresses we install a context dialer since gRPC's
+// resolver does not understand Windows named pipes.
 func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, error) {
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()
 
-	return grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(addr, "tcp://"),
+	opts := []grpc.DialOption{
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 		grpc.WithBlock(),
-	)
+	}
+
+	target := strings.TrimPrefix(addr, "tcp://")
+	if strings.HasPrefix(addr, "npipe://") {
+		path := pipePath(strings.TrimPrefix(addr, "npipe://"))
+		opts = append(opts, grpc.WithContextDialer(func(dialCtx context.Context, _ string) (net.Conn, error) {
+			return dialNamedPipe(dialCtx, path)
+		}))
+		target = "passthrough:///netbird-daemon-pipe"
+	}
+
+	return grpc.DialContext(ctx, target, opts...)
 }
 
 // WithBackOff execute function in backoff cycle.

client/cmd/service.go

@@ -56,6 +56,9 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
 	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
+	serviceCmd.PersistentFlags().StringVar(&socketOwner, "socket-owner", "", "user to own the daemon control socket; restricts it to that user plus the netbird group (0660). If unset, the first client to connect claims ownership (trust-on-first-use). Persisted via: netbird service install --socket-owner")
+	serviceCmd.PersistentFlags().BoolVar(&strictSocketDisabled, "disable-strict-socket", false, "leave the daemon control socket world-writable (0666) instead of restricting it (root-only, discouraged). Persisted via: netbird service install --disable-strict-socket")
+
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
 		`You can specify a comma-separated list of KEY=VALUE pairs. ` +

client/cmd/service_controller.go

@@ -5,6 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"runtime"
 	"time"
 
 	"github.com/kardianos/service"
@@ -13,12 +14,31 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
 
+// daemonServerOptions returns the gRPC server options that install peer-identity
+// transport credentials on the daemon control channel. Identity extraction is
+// only possible over a Unix socket (SO_PEERCRED) or Windows named pipe (client
+// token); over TCP, or on platforms without a peer-credential primitive, the
+// daemon runs without per-caller authorization and logs a warning.
+func daemonServerOptions(network string) []grpc.ServerOption {
+	creds := ipcauth.NewTransportCredentials()
+	if creds == nil {
+		log.Warnf("daemon control channel has no peer-identity primitive on %s; per-caller authorization is disabled", runtime.GOOS)
+		return nil
+	}
+	if network == "tcp" {
+		log.Warnf("daemon is listening on TCP (%s); peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
+		return nil
+	}
+	return []grpc.ServerOption{grpc.Creds(creds)}
+}
+
 func validateJSONSocketFlags() error {
 	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
 		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
@@ -37,8 +57,13 @@ func (p *program) Start(svc service.Service) error {
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
-	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
-	p.serv = grpc.NewServer()
+	network, _, err := parseListenAddress(daemonAddr)
+	if err != nil {
+		return fmt.Errorf("parse daemon address: %w", err)
+	}
+
+	// in any case, even if configuration does not exist we run daemon to serve the CLI gRPC API.
+	p.serv = grpc.NewServer(daemonServerOptions(network)...)
 
 	daemonListener, err := listenOnAddress(daemonAddr)
 	if err != nil {
@@ -62,7 +87,8 @@ func (p *program) Start(svc service.Service) error {
 			defer jsonListener.Close()
 		}
 
-		if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
+		serveListener, err := secureDaemonListener(daemonListener)
+		if err != nil {
 			log.Error(err)
 			return
 		}
@@ -84,6 +110,7 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstanceMu.Unlock()
 
 		if jsonListener != nil {
+			log.Warnf("JSON gateway (--enable-json-socket) re-dials the daemon locally as the daemon's own identity and BYPASSES per-caller authorization; restrict access to %s separately", jsonSocket)
 			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
 				log.Fatalf("failed to start daemon JSON server: %v", err)
 			}
@@ -92,7 +119,7 @@ func (p *program) Start(svc service.Service) error {
 		}
 
 		log.Printf("started daemon server: %v", daemonListener.address)
-		if err := p.serv.Serve(daemonListener.Listener); err != nil {
+		if err := p.serv.Serve(serveListener); err != nil {
 			log.Errorf("failed to serve daemon requests: %v", err)
 		}
 	}()

client/cmd/service_installer.go

@@ -71,6 +71,14 @@ func buildServiceArguments() []string {
 		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
 	}
 
+	if socketOwner != "" {
+		args = append(args, "--socket-owner", socketOwner)
+	}
+
+	if strictSocketDisabled {
+		args = append(args, "--disable-strict-socket")
+	}
+
 	return args
 }
 

client/cmd/service_params.go

@@ -32,6 +32,8 @@ type serviceParams struct {
 	EnableCapture         bool              `json:"enable_capture,omitempty"`
 	DisableNetworks       bool              `json:"disable_networks,omitempty"`
 	EnableJSONSocket      bool              `json:"enable_json_socket,omitempty"`
+	SocketOwner           string            `json:"socket_owner,omitempty"`
+	DisableStrictSocket   bool              `json:"disable_strict_socket,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -86,6 +88,8 @@ func currentServiceParams() *serviceParams {
 		EnableCapture:         captureEnabled,
 		DisableNetworks:       networksDisabled,
 		EnableJSONSocket:      enableJSONSocket,
+		SocketOwner:           socketOwner,
+		DisableStrictSocket:   strictSocketDisabled,
 	}
 
 	if len(serviceEnvVars) > 0 {
@@ -165,6 +169,14 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		networksDisabled = params.DisableNetworks
 	}
 
+	if !serviceCmd.PersistentFlags().Changed("socket-owner") {
+		socketOwner = params.SocketOwner
+	}
+
+	if !serviceCmd.PersistentFlags().Changed("disable-strict-socket") {
+		strictSocketDisabled = params.DisableStrictSocket
+	}
+
 	applyServiceEnvParams(cmd, params)
 }
 

client/cmd/service_pipe_other.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// listenNamedPipe is unsupported off Windows; named pipes are a Windows-only transport.
+func listenNamedPipe(string) (net.Listener, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}
+
+// dialNamedPipe is unsupported off Windows.
+func dialNamedPipe(context.Context, string) (net.Conn, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}

client/cmd/service_pipe_windows.go

@@ -0,0 +1,32 @@
+//go:build windows
+
+package cmd
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"github.com/Microsoft/go-winio"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// listenNamedPipe creates the daemon control named pipe with a tight SDDL
+// (SYSTEM + Administrators + interactive users). ListenPipe fails if the pipe
+// already exists (first-instance semantics), which prevents a squatting process
+// from pre-creating it — we surface that error loudly rather than falling back.
+func listenNamedPipe(path string) (net.Listener, error) {
+	return winio.ListenPipe(path, &winio.PipeConfig{
+		SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
+	})
+}
+
+// dialNamedPipe connects to the daemon control named pipe.
+func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
+	if deadline, ok := ctx.Deadline(); ok {
+		timeout := time.Until(deadline)
+		return winio.DialPipe(path, &timeout)
+	}
+	return winio.DialPipeContext(ctx, path)
+}

client/cmd/service_socket.go

@@ -26,6 +26,15 @@ func listenOnAddress(addr string) (*socketListener, error) {
 		return nil, err
 	}
 
+	if network == "npipe" {
+		path := pipePath(address)
+		listener, err := listenNamedPipe(path)
+		if err != nil {
+			return nil, err
+		}
+		return &socketListener{Listener: listener, network: network, address: path}, nil
+	}
+
 	if network == "unix" {
 		removeStaleUnixSocket(address)
 	}
@@ -45,13 +54,23 @@ func parseListenAddress(addr string) (string, string, error) {
 	}
 
 	switch network {
-	case "unix", "tcp":
+	case "unix", "tcp", "npipe":
 		return network, address, nil
 	default:
 		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
 	}
 }
 
+// pipePath maps a daemon-addr npipe name (e.g. "netbird" from "npipe://netbird")
+// to a Windows named-pipe path (\\.\pipe\netbird). A caller may also pass a full
+// \\.\pipe\ path, which is returned unchanged.
+func pipePath(name string) string {
+	if strings.HasPrefix(name, `\\`) {
+		return name
+	}
+	return `\\.\pipe\` + name
+}
+
 func removeStaleUnixSocket(path string) {
 	stat, err := os.Lstat(path)
 	if err != nil {

client/cmd/service_socket_perms_other.go

@@ -0,0 +1,11 @@
+//go:build windows
+
+package cmd
+
+import "net"
+
+// secureDaemonListener is a no-op on Windows: the named-pipe SDDL gates who may
+// connect (Layer 1), and the pipe client token supplies per-RPC identity.
+func secureDaemonListener(l *socketListener) (net.Listener, error) {
+	return l.Listener, nil
+}

client/cmd/service_socket_perms_unix.go

@@ -0,0 +1,225 @@
+//go:build !windows && !ios && !android
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"os/user"
+	"strconv"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/shell"
+)
+
+// secureDaemonListener applies the Layer-1 access control to the daemon control
+// socket and returns the listener to serve on. For a Unix socket this restricts
+// the socket to an owner (plus the netbird group); for anything else it is a
+// no-op (TCP is legacy/unauthenticated; named pipes are gated by their SDDL).
+func secureDaemonListener(l *socketListener) (net.Listener, error) {
+	if l.network != "unix" {
+		return l.Listener, nil
+	}
+
+	owner := effectiveSocketOwner()
+	switch {
+	case strictSocketDisabled:
+		// Root-only opt-out (via service.json): leave it world-writable.
+		if err := os.Chmod(l.address, 0666); err != nil {
+			return nil, fmt.Errorf("set daemon socket permissions: %w", err)
+		}
+		log.Warnf("daemon control socket left world-writable (0666) by --disable-strict-socket")
+		return l.Listener, nil
+
+	case owner != "":
+		// Seeded owner (flag, MDM, or persisted TOFU result): restrict before
+		// serving so there is no open window.
+		uid, err := lookupUser(owner)
+		if err != nil {
+			return nil, fmt.Errorf("lookup socket owner %q: %w", owner, err)
+		}
+		if err := restrictSocket(l.address, uid); err != nil {
+			return nil, fmt.Errorf("restrict socket to %q: %w", owner, err)
+		}
+		return l.Listener, nil
+
+	default:
+		// Trust-on-first-use: open the socket now; tofuListener locks it to the
+		// first caller's uid on the first connection.
+		if err := os.Chmod(l.address, 0666); err != nil {
+			return nil, fmt.Errorf("set daemon socket permissions: %w", err)
+		}
+		return &tofuListener{Listener: l.Listener, path: l.address, owner: -1}, nil
+	}
+}
+
+func lookupUser(username string) (int, error) {
+	u, err := shell.LookupWithGetent(username)
+	if err != nil {
+		return -1, fmt.Errorf("lookup user %s: %w", username, err)
+	}
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil {
+		return -1, fmt.Errorf("parse uid %s: %w", u.Uid, err)
+	}
+	return uid, nil
+}
+
+// addGroup creates a system group if it doesn't already exist and returns the gid.
+// Must run as root.
+func addGroup(name string) (int, error) {
+	group, err := shell.LookupGroupWithGetent(name)
+	if err == nil {
+		gid, err := strconv.ParseInt(group.Gid, 10, 64)
+		return int(gid), err
+	}
+
+	groupadd, err := exec.LookPath("groupadd")
+	if err != nil {
+		// Fallback for Alpine/BusyBox systems.
+		if groupadd, err = exec.LookPath("addgroup"); err != nil {
+			return -1, errors.New("neither groupadd nor addgroup found")
+		}
+	}
+
+	// Use --system for a service/daemon group (no login, low GID).
+	out, err := exec.Command(groupadd, "--system", name).CombinedOutput()
+	if err != nil {
+		return -1, fmt.Errorf("create group %q: %w: %s", name, err, out)
+	}
+	if group, err := shell.LookupGroupWithGetent(name); err == nil {
+		gid, err := strconv.ParseInt(group.Gid, 10, 64)
+		return int(gid), err
+	}
+	return -1, fmt.Errorf("lookup group %q: %w", name, err)
+}
+
+// restrictSocket locks the unix socket down to the owner uid plus the netbird
+// group (0660). If the group cannot be created or applied, it fails closed to
+// owner-only 0600 — it never leaves the socket world-writable.
+func restrictSocket(path string, uid int) error {
+	gid, err := addGroup("netbird")
+	if err != nil {
+		log.Errorf("create netbird group, failing closed to owner-only 0600: %v", err)
+		return chownChmod(path, uid, -1, 0600)
+	}
+	if err := chownChmod(path, uid, gid, 0660); err != nil {
+		log.Errorf("apply netbird group to socket, failing closed to owner-only 0600: %v", err)
+		return chownChmod(path, uid, -1, 0600)
+	}
+	return nil
+}
+
+// chownChmod sets ownership and mode on the socket. A gid of -1 leaves the
+// group unchanged.
+func chownChmod(path string, uid, gid int, mode os.FileMode) error {
+	if err := os.Chown(path, uid, gid); err != nil {
+		return fmt.Errorf("chown socket %s: %w", path, err)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		return fmt.Errorf("chmod socket %s: %w", path, err)
+	}
+	return nil
+}
+
+// tofuListener implements trust-on-first-use for the daemon control socket.
+// The socket starts world-writable; the first caller's uid (read via SO_PEERCRED)
+// becomes the owner. On that first connection the socket is restricted and the
+// owner persisted so the open window never reopens on later starts. Connections
+// that raced in during the open window and are neither the owner nor root are
+// dropped. Changing the socket mode does not disturb the already-open
+// connection, so the first caller's request is served normally.
+type tofuListener struct {
+	net.Listener
+	path  string
+	mu    sync.Mutex
+	owner int // -1 until claimed
+}
+
+func (l *tofuListener) Accept() (net.Conn, error) {
+	for {
+		c, err := l.Listener.Accept()
+		if err != nil {
+			return nil, err
+		}
+
+		id, err := ipcauth.PeerIdentity(c)
+		if err != nil {
+			log.Errorf("read peer credentials, dropping connection: %v", err)
+			_ = c.Close()
+			continue
+		}
+		uid := int(id.UID)
+
+		l.mu.Lock()
+		if l.owner == -1 {
+			if err := restrictSocket(l.path, uid); err != nil {
+				l.mu.Unlock()
+				_ = c.Close()
+				// Refuse to serve on a socket we could not lock down.
+				return nil, fmt.Errorf("restrict socket on first connection: %w", err)
+			}
+			l.owner = uid
+			persistSocketOwner(uid)
+			log.Infof("control socket restricted to first caller (uid %d)", uid)
+			l.mu.Unlock()
+			return c, nil
+		}
+		owner := l.owner
+		l.mu.Unlock()
+
+		// New connects are already gated by the 0660 perms set above; this only
+		// drops anything that slipped in during the brief open window.
+		if uid != owner && uid != 0 {
+			log.Warnf("dropping non-owner connection (uid %d) during socket bootstrap", uid)
+			_ = c.Close()
+			continue
+		}
+		return c, nil
+	}
+}
+
+// effectiveSocketOwner returns the configured socket owner: the --socket-owner
+// flag when set, otherwise the owner persisted by a previous TOFU migration.
+func effectiveSocketOwner() string {
+	if socketOwner != "" {
+		return socketOwner
+	}
+	params, err := loadServiceParams()
+	if err != nil {
+		log.Errorf("load service params for socket owner: %v", err)
+		return ""
+	}
+	if params != nil {
+		return params.SocketOwner
+	}
+	return ""
+}
+
+// persistSocketOwner records the TOFU-selected owner (by username) so the next
+// daemon start restricts the socket immediately, with no open window.
+func persistSocketOwner(uid int) {
+	u, err := user.LookupId(strconv.Itoa(uid))
+	if err != nil {
+		log.Errorf("resolve uid %d to username for persistence: %v", uid, err)
+		return
+	}
+	params, err := loadServiceParams()
+	if err != nil {
+		log.Errorf("load service params to persist socket owner: %v", err)
+		return
+	}
+	if params == nil {
+		params = currentServiceParams()
+	}
+	params.SocketOwner = u.Username
+	if err := saveServiceParams(params); err != nil {
+		log.Errorf("persist socket owner: %v", err)
+	}
+}

client/internal/auth/auth.go

@@ -351,7 +351,6 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.BlockLANAccess,
 		a.config.BlockInbound,
 		a.config.DisableIPv6,
-		a.config.SyncMessageVersion,
 		a.config.EnableSSHRoot,
 		a.config.EnableSSHSFTP,
 		a.config.EnableSSHLocalPortForwarding,

client/internal/connect.go

@@ -618,7 +618,6 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		BlockLANAccess:      config.BlockLANAccess,
 		BlockInbound:        config.BlockInbound,
 		DisableIPv6:         config.DisableIPv6,
-		SyncMessageVersion:  config.SyncMessageVersion,
 
 		LazyConnection: lazyconn.ParseState(config.LazyConnection),
 
@@ -694,7 +693,6 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.BlockLANAccess,
 		config.BlockInbound,
 		config.DisableIPv6,
-		config.SyncMessageVersion,
 		config.EnableSSHRoot,
 		config.EnableSSHSFTP,
 		config.EnableSSHLocalPortForwarding,

client/internal/debug/debug.go

@@ -676,7 +676,6 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString(fmt.Sprintf("BlockLANAccess: %v\n", g.internalConfig.BlockLANAccess))
 	configContent.WriteString(fmt.Sprintf("BlockInbound: %v\n", g.internalConfig.BlockInbound))
 	configContent.WriteString(fmt.Sprintf("DisableIPv6: %v\n", g.internalConfig.DisableIPv6))
-	configContent.WriteString(fmt.Sprintf("SyncMessageVersion: %v\n", g.internalConfig.SyncMessageVersion))
 
 	if g.internalConfig.DisableNotifications != nil {
 		configContent.WriteString(fmt.Sprintf("DisableNotifications: %v\n", *g.internalConfig.DisableNotifications))

client/internal/debug/debug_test.go

@@ -887,8 +887,6 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		ClientCertKeyPath:             "/tmp/key",
 		LazyConnection:                "on",
 		MTU:                           1280,
-		DisableIPv6:                   true,
-		SyncMessageVersion:            func(v int) *int { return &v }(1),
 	}
 
 	for _, anonymize := range []bool{false, true} {

client/internal/engine.go

@@ -64,10 +64,7 @@ import (
 	"github.com/netbirdio/netbird/route"
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	types "github.com/netbirdio/netbird/shared/management/types"
 	"github.com/netbirdio/netbird/shared/netiputil"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
@@ -150,7 +147,6 @@ type EngineConfig struct {
 	BlockLANAccess      bool
 	BlockInbound        bool
 	DisableIPv6         bool
-	SyncMessageVersion  *int
 
 	// LazyConnection is the MDM-sourced lazy-connection override; StateUnset defers to
 	// the env var and management feature flag.
@@ -224,13 +220,6 @@ type Engine struct {
 	// networkSerial is the latest CurrentSerial (state ID) of the network sent by the Management service
 	networkSerial uint64
 
-	// latestComponents is the most-recent NetworkMapComponents decoded from
-	// a NetworkMapEnvelope (capability=3 peers only). Held alongside the
-	// NetworkMap that Calculate() produced from it so future incremental
-	// updates have a base to apply changes against. nil for legacy-format
-	// peers. Guarded by syncMsgMux.
-	latestComponents *types.NetworkMapComponents
-
 	networkMonitor *networkmonitor.NetworkMonitor
 
 	sshServer sshServer
@@ -974,12 +963,8 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 
 	e.ApplySessionDeadline(update.GetSessionExpiresAt())
 
-	// Envelope sync responses carry PeerConfig at the top level; legacy
-	// NetworkMap syncs carry it under NetworkMap.PeerConfig.
-	if pc := update.GetPeerConfig(); pc != nil {
-		e.handleAutoUpdateVersion(pc.GetAutoUpdate())
-	} else if nm := update.GetNetworkMap(); nm != nil && nm.GetPeerConfig() != nil {
-		e.handleAutoUpdateVersion(nm.GetPeerConfig().GetAutoUpdate())
+	if update.NetworkMap != nil && update.NetworkMap.PeerConfig != nil {
+		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate)
 	}
 
 	done := e.phase("netbird_config")
@@ -989,47 +974,12 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
-	// Decode the network map from either the components envelope or the
-	// legacy proto.NetworkMap before the posture-check gating below, so the
-	// "is there a network map" decision covers both wire shapes.
-	var (
-		nm         *mgmProto.NetworkMap
-		components *types.NetworkMapComponents
-	)
-	if version := update.GetVersion(); version == int32(sharedgrpc.ComponentNetworkMap) {
-		// Components-format peer: decode the envelope back to typed
-		// components, run Calculate() locally, and convert to the wire
-		// NetworkMap shape the rest of the engine consumes. Components are
-		// retained so future incremental updates can apply deltas instead
-		// of doing a full reconstruction.
-		envelope := update.GetNetworkMapEnvelope()
-		if envelope == nil {
-			return fmt.Errorf("received a SyncReponse indicating use of components network map, but components are missing")
-		}
-
-		localKey := e.config.WgPrivateKey.PublicKey().String()
-		dnsName := ""
-		if pc := update.GetPeerConfig(); pc != nil {
-			// PeerConfig.Fqdn = "<dns_label>.<dns_domain>" — extract the
-			// shared domain by stripping the peer's own label prefix. Falls
-			// back to empty if the FQDN doesn't have the expected shape.
-			dnsName = extractDNSDomainFromFQDN(pc.GetFqdn())
-		}
-		result, err := nbnetworkmap.EnvelopeToNetworkMap(e.ctx, envelope, localKey, dnsName)
-		if err != nil {
-			return fmt.Errorf("decode network map envelope: %w", err)
-		}
-		nm = result.NetworkMap
-		components = result.Components
-	} else {
-		nm = update.GetNetworkMap()
-	}
-
 	// Posture checks are bound to the network map presence:
 	//   NetworkMap != nil, checks present -> apply the received checks
 	//   NetworkMap != nil, checks nil     -> posture checks were removed, clear them
 	//   NetworkMap == nil                 -> config-only update (e.g. relay token rotation),
 	//                                        leave the previously applied checks untouched
+	nm := update.GetNetworkMap()
 	if nm == nil {
 		return nil
 	}
@@ -1042,14 +992,6 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 	}
 
 	done = e.phase("persist")
-	// Only retain the components view when the server sent the envelope
-	// path. A legacy proto.NetworkMap means components == nil; writing it
-	// here would clobber a previously-cached snapshot, breaking the
-	// incremental-delta base on a future envelope sync.
-	if components != nil {
-		e.latestComponents = components
-	}
-
 	e.persistSyncResponse(update)
 	done()
 
@@ -1063,19 +1005,6 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 	return nil
 }
 
-// extractDNSDomainFromFQDN returns the trailing dotted domain part of the
-// receiving peer's FQDN — the same value the management server fills as
-// dnsName when it builds the legacy NetworkMap. "peer42.netbird.cloud" →
-// "netbird.cloud". An empty string is returned for unrecognized formats.
-func extractDNSDomainFromFQDN(fqdn string) string {
-	for i := 0; i < len(fqdn); i++ {
-		if fqdn[i] == '.' && i+1 < len(fqdn) {
-			return fqdn[i+1:]
-		}
-	}
-	return ""
-}
-
 // updateNetbirdConfig applies the management-provided NetBird configuration:
 // STUN/TURN and relay servers, flow logging and DNS settings. A nil config is a no-op,
 // which is the case for sync updates carrying only a network map.
@@ -1235,7 +1164,6 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
-		e.config.SyncMessageVersion,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
@@ -2104,7 +2032,6 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
-		e.config.SyncMessageVersion,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,

client/internal/ipcauth/creds_stub.go

@@ -0,0 +1,13 @@
+//go:build !linux && !darwin && !freebsd && !windows
+
+package ipcauth
+
+import "google.golang.org/grpc/credentials"
+
+// NewTransportCredentials returns nil on platforms without a peer-identity
+// primitive. The daemon falls back to insecure credentials and skips per-RPC
+// authorization (logging a warning), preserving pre-hardening behavior until
+// the transport gains an identity primitive.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return nil
+}

client/internal/ipcauth/creds_unix.go

@@ -0,0 +1,48 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns gRPC transport credentials that extract the
+// caller's kernel-authenticated identity from a Unix-socket connection and
+// expose it via IdentityFromContext. It is non-nil on platforms with a
+// peer-credential primitive.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return unixCreds{}
+}
+
+// unixCreds implements credentials.TransportCredentials over a Unix socket.
+// The server side reads SO_PEERCRED/LOCAL_PEERCRED during the handshake; the
+// client side is a no-op (the kernel supplies the peer identity to the server
+// without any client cooperation).
+type unixCreds struct{}
+
+func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the peer identity and fails closed if it cannot be read.
+func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := PeerIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (unixCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
+}
+
+func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
+
+func (unixCreds) OverrideServerName(string) error { return nil }

client/internal/ipcauth/creds_windows.go

@@ -0,0 +1,142 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+
+	"golang.org/x/sys/windows"
+	"google.golang.org/grpc/credentials"
+)
+
+var (
+	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
+	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
+	procRevertToSelf               = modadvapi32.NewProc("RevertToSelf")
+)
+
+// Windows group-SID attribute flags (winnt.h): a group only counts toward
+// membership when it is enabled and not marked use-for-deny-only.
+const (
+	seGroupEnabled        = 0x00000004
+	seGroupUseForDenyOnly = 0x00000010
+)
+
+// DefaultPipeSDDL restricts the daemon control pipe to LocalSystem (SY), the
+// Administrators group (BA), and interactive logon users (IU). It deliberately
+// excludes Authenticated Users / Everyone so remote or arbitrary service
+// principals cannot connect. This is the Layer-1 channel gate; the interceptor
+// (Layer 2) further restricts by per-profile ownership.
+func DefaultPipeSDDL() string {
+	return "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;IU)"
+}
+
+// NewTransportCredentials returns gRPC transport credentials that derive the
+// caller's identity from the named-pipe client token, following Microsoft's
+// "Verifying Client Access with ACLs" pattern: ImpersonateNamedPipeClient ->
+// OpenThreadToken -> RevertToSelf. Per threat-model M-NOIMP, impersonation is
+// used only to read the client token for identity, never to perform privileged work.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return winpipeCreds{}
+}
+
+type winpipeCreds struct{}
+
+func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the connecting client's identity from the pipe token.
+// Fails closed if the handle or token cannot be read.
+func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return nil, nil, fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+	handle := windows.Handle(fdConn.Fd())
+
+	id, err := pipeClientIdentity(handle)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (winpipeCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
+}
+
+func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
+
+func (winpipeCreds) OverrideServerName(string) error { return nil }
+
+// pipeClientIdentity reads the connecting client's user SID and enabled group
+// SIDs from the named-pipe handle. The impersonation window is kept as small as
+// possible and pinned to the OS thread (impersonation is thread-local).
+func pipeClientIdentity(handle windows.Handle) (Identity, error) {
+	var pid uint32
+	hasPID := windows.GetNamedPipeClientProcessId(handle, &pid) == nil
+
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	if err := impersonateNamedPipeClient(handle); err != nil {
+		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
+	}
+	defer func() { _ = revertToSelf() }()
+
+	// openAsSelf=true: the token is opened using the daemon's process context
+	// (LocalSystem), not the impersonated client's, so the open always succeeds.
+	var token windows.Token
+	if err := windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
+		return Identity{}, fmt.Errorf("open thread token: %w", err)
+	}
+	defer token.Close()
+
+	tu, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token user: %w", err)
+	}
+
+	tg, err := token.GetTokenGroups()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token groups: %w", err)
+	}
+	var groups []string
+	for _, g := range tg.AllGroups() {
+		if g.Attributes&seGroupEnabled == 0 || g.Attributes&seGroupUseForDenyOnly != 0 {
+			continue
+		}
+		groups = append(groups, g.Sid.String())
+	}
+
+	return Identity{
+		SID:    tu.User.Sid.String(),
+		Groups: groups,
+		PID:    int32(pid),
+		HasPID: hasPID,
+	}, nil
+}
+
+func impersonateNamedPipeClient(h windows.Handle) error {
+	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
+	if r == 0 {
+		return e
+	}
+	return nil
+}
+
+func revertToSelf() error {
+	r, _, e := procRevertToSelf.Call()
+	if r == 0 {
+		return e
+	}
+	return nil
+}

client/internal/ipcauth/identity.go

@@ -0,0 +1,93 @@
+// Package ipcauth provides kernel-authenticated caller identity for the daemon's
+// local IPC (gRPC) channel and the transport credentials that populate it.
+//
+// It is the identity foundation shared by two layers of the local-IPC hardening:
+//   - the socket-permission layer (Layer 1, client/cmd), which reads the peer
+//     identity to gate who may connect and to run trust-on-first-use; and
+//   - the per-RPC authorization interceptor (Layer 2), which reads the same
+//     identity from the gRPC context to enforce per-profile ownership.
+//
+// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
+// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the named-pipe
+// client token. Platforms without a peer-identity primitive get no credentials
+// and therefore no enforcement (the daemon logs a warning and stays open,
+// preserving today's behavior until the transport is hardened).
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+// Identity is the kernel-authenticated identity of a local IPC caller.
+//
+// The zero value is not a valid identity; callers obtain one via
+// IdentityFromContext (which reports presence) or PeerIdentity.
+type Identity struct {
+	// UID and GID are the caller's Unix user ID and primary group ID.
+	// Zero on Windows, where SID is authoritative instead.
+	UID uint32
+	GID uint32
+
+	// PID is the caller's process ID, for audit only. HasPID is false when the
+	// platform cannot supply it (e.g. Darwin/FreeBSD xucred carries no PID).
+	PID    int32
+	HasPID bool
+
+	// SID is the caller's Windows security identifier (empty on Unix).
+	SID string
+
+	// Groups holds the caller's Windows group SIDs, captured from the client
+	// token at handshake time (empty on Unix, where supplementary group
+	// membership is resolved on demand via NSS/getent by the authorizer).
+	Groups []string
+}
+
+// IsWindows reports whether this identity is a Windows principal (SID-based)
+// rather than a Unix uid/gid principal.
+func (i Identity) IsWindows() bool {
+	return i.SID != ""
+}
+
+// String renders the identity for audit logs.
+func (i Identity) String() string {
+	if i.IsWindows() {
+		if i.HasPID {
+			return fmt.Sprintf("sid=%s pid=%d", i.SID, i.PID)
+		}
+		return fmt.Sprintf("sid=%s", i.SID)
+	}
+	if i.HasPID {
+		return fmt.Sprintf("uid=%d gid=%d pid=%d", i.UID, i.GID, i.PID)
+	}
+	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
+}
+
+// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so the
+// interceptor can retrieve it from the request context via IdentityFromContext.
+type AuthInfo struct {
+	credentials.CommonAuthInfo
+	Identity Identity
+}
+
+// AuthType identifies the authentication scheme.
+func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
+
+// IdentityFromContext extracts the caller's kernel-authenticated identity from
+// the gRPC peer context. The second return value is false when no IPC transport
+// credentials were negotiated (e.g. an unsupported platform, or a caller that
+// did not come through the daemon socket) — callers MUST fail closed in that case.
+func IdentityFromContext(ctx context.Context) (Identity, bool) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	info, ok := p.AuthInfo.(AuthInfo)
+	if !ok {
+		return Identity{}, false
+	}
+	return info.Identity, true
+}

client/internal/ipcauth/identity_test.go

@@ -0,0 +1,47 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+func TestIdentityFromContext_NoPeer(t *testing.T) {
+	_, ok := IdentityFromContext(context.Background())
+	assert.False(t, ok, "bare context must report no identity (fail closed)")
+}
+
+func TestIdentityFromContext_WrongAuthInfo(t *testing.T) {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{})
+	_, ok := IdentityFromContext(ctx)
+	assert.False(t, ok, "peer without our AuthInfo must report no identity")
+}
+
+func TestIdentityFromContext_Present(t *testing.T) {
+	want := Identity{UID: 1000, GID: 1000, PID: 4242, HasPID: true}
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       want,
+		},
+	})
+
+	got, ok := IdentityFromContext(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, want, got)
+}
+
+func TestIdentity_String(t *testing.T) {
+	assert.Equal(t, "uid=1000 gid=1000 pid=42", Identity{UID: 1000, GID: 1000, PID: 42, HasPID: true}.String())
+	assert.Equal(t, "uid=1000 gid=1000", Identity{UID: 1000, GID: 1000}.String())
+	assert.Equal(t, "sid=S-1-5-21-1 pid=42", Identity{SID: "S-1-5-21-1", PID: 42, HasPID: true}.String())
+	assert.Equal(t, "sid=S-1-5-21-1", Identity{SID: "S-1-5-21-1"}.String())
+}
+
+func TestIdentity_IsWindows(t *testing.T) {
+	assert.True(t, Identity{SID: "S-1-5-18"}.IsWindows())
+	assert.False(t, Identity{UID: 0}.IsWindows())
+}

client/internal/ipcauth/peercred_bsd.go

@@ -0,0 +1,43 @@
+//go:build darwin || freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via LOCAL_PEERCRED (xucred). xucred
+// carries the uid and group list but no pid, so audit on these platforms is
+// uid/gid-based (HasPID is false); PID via LOCAL_PEERPID is a possible follow-up.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Xucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("LOCAL_PEERCRED: %w", credErr)
+	}
+
+	id := Identity{UID: cred.Uid}
+	// Groups[0] is the effective (primary) GID; guard against an empty list.
+	if cred.Ngroups > 0 {
+		id.GID = cred.Groups[0]
+	}
+	return id, nil
+}

client/internal/ipcauth/peercred_linux.go

@@ -0,0 +1,43 @@
+//go:build linux
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via SO_PEERCRED. The credentials are
+// captured by the kernel at connect() time and cannot be spoofed or changed for
+// the life of the connection.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("SO_PEERCRED: %w", credErr)
+	}
+
+	return Identity{
+		UID:    cred.Uid,
+		GID:    cred.Gid,
+		PID:    cred.Pid,
+		HasPID: true,
+	}, nil
+}

client/internal/ipcauth/peercred_stub.go

@@ -0,0 +1,16 @@
+//go:build !linux && !darwin && !freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// PeerIdentity is unimplemented on platforms without a Unix-socket peer-credential
+// primitive. Windows derives identity from the named-pipe client token instead
+// (see the Windows transport credentials), so it never calls this.
+func PeerIdentity(net.Conn) (Identity, error) {
+	return Identity{}, fmt.Errorf("peer credential check not supported on %s", runtime.GOOS)
+}

client/internal/ipcauth/peercred_unix_test.go

@@ -0,0 +1,113 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPeerIdentity_MatchesCurrentProcess connects to a real Unix socket and
+// verifies the extracted UID/GID match the running process (both ends are us).
+func TestPeerIdentity_MatchesCurrentProcess(t *testing.T) {
+	sock := filepath.Join(t.TempDir(), "peer.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	type result struct {
+		id  Identity
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- result{err: aerr}
+			return
+		}
+		defer func() { _ = c.Close() }()
+		id, ierr := PeerIdentity(c)
+		done <- result{id: id, err: ierr}
+	}()
+
+	client, err := net.Dial("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	res := <-done
+	require.NoError(t, res.err)
+	assert.Equal(t, uint32(os.Getuid()), res.id.UID, "UID should match current process")
+	assert.Equal(t, uint32(os.Getgid()), res.id.GID, "primary GID should match current process")
+}
+
+// TestPeerIdentity_NonUnixConn rejects non-Unix connections (fail closed).
+func TestPeerIdentity_NonUnixConn(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	done := make(chan error, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- aerr
+			return
+		}
+		defer func() { _ = c.Close() }()
+		_, ierr := PeerIdentity(c)
+		done <- ierr
+	}()
+
+	client, err := net.Dial("tcp", ln.Addr().String())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	assert.Error(t, <-done, "PeerIdentity must reject a non-Unix connection")
+}
+
+// TestUnixCreds_ServerHandshake exercises the transport-credentials path end to end.
+func TestUnixCreds_ServerHandshake(t *testing.T) {
+	creds := NewTransportCredentials()
+	require.NotNil(t, creds)
+
+	sock := filepath.Join(t.TempDir(), "hs.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	type result struct {
+		info interface{ AuthType() string }
+		err  error
+	}
+	done := make(chan result, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- result{err: aerr}
+			return
+		}
+		_, ai, herr := creds.ServerHandshake(c)
+		if herr != nil {
+			done <- result{err: herr}
+			return
+		}
+		done <- result{info: ai}
+	}()
+
+	client, err := net.Dial("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	res := <-done
+	require.NoError(t, res.err)
+	ai, ok := res.info.(AuthInfo)
+	require.True(t, ok, "expected ipcauth.AuthInfo, got %T", res.info)
+	assert.Equal(t, uint32(os.Getuid()), ai.Identity.UID)
+	assert.Equal(t, "netbird-ipc-peercred", ai.AuthType())
+}

client/internal/profilemanager/config.go

@@ -96,7 +96,6 @@ type ConfigInput struct {
 	BlockLANAccess      *bool
 	BlockInbound        *bool
 	DisableIPv6         *bool
-	SyncMessageVersion  *int
 
 	DisableNotifications *bool
 
@@ -138,7 +137,6 @@ type Config struct {
 	BlockLANAccess      bool
 	BlockInbound        bool
 	DisableIPv6         bool
-	SyncMessageVersion  *int
 
 	DisableNotifications *bool
 
@@ -589,12 +587,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SyncMessageVersion != nil && *input.SyncMessageVersion != *config.SyncMessageVersion {
-		log.Infof("setting SyncMessageVersion to %v", *input.SyncMessageVersion)
-		*config.SyncMessageVersion = *input.SyncMessageVersion
-		updated = true
-	}
-
 	if input.DisableNotifications != nil && (config.DisableNotifications == nil || *input.DisableNotifications != *config.DisableNotifications) {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")

client/internal/shell/getent_cgo_unix.go

@@ -0,0 +1,29 @@
+//go:build cgo && !osusergo && !windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent with CGO delegates directly to os/user.Lookup.
+// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
+// the NSS stack natively. If it fails, the user truly doesn't exist and
+// getent would also fail.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent with CGO delegates directly to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GroupIdsWithFallback with CGO delegates directly to user.GroupIds.
+// libc's getgrouplist handles NSS groups natively.
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/internal/shell/getent_nocgo_unix.go

@@ -1,6 +1,6 @@
 //go:build (!cgo || osusergo) && !windows
 
-package server
+package shell
 
 import (
 	"os"
@@ -10,10 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
+// LookupWithGetent looks up a user by name, falling back to getent if os/user fails.
 // Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
 // getent goes through the host's NSS stack.
-func lookupWithGetent(username string) (*user.User, error) {
+func LookupWithGetent(username string) (*user.User, error) {
 	u, err := user.Lookup(username)
 	if err == nil {
 		return u, nil
@@ -22,7 +22,7 @@ func lookupWithGetent(username string) (*user.User, error) {
 	stdErr := err
 	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
 
-	u, _, getentErr := runGetent(username)
+	u, _, getentErr := runGetentPasswd(username)
 	if getentErr != nil {
 		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
 		return nil, stdErr
@@ -31,8 +31,26 @@ func lookupWithGetent(username string) (*user.User, error) {
 	return u, nil
 }
 
-// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
-func currentUserWithGetent() (*user.User, error) {
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname,
+// falling back to getent if os/user fails (NSS groups under nocgo).
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	g, err := user.LookupGroup(name)
+	if err == nil {
+		return g, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupGroup(%q) failed, trying getent: %v", name, err)
+	g, getentErr := runGetentGroup(name)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", name, getentErr)
+		return nil, stdErr
+	}
+	return g, nil
+}
+
+// CurrentUserWithGetent gets the current user, falling back to getent if os/user fails.
+func CurrentUserWithGetent() (*user.User, error) {
 	u, err := user.Current()
 	if err == nil {
 		return u, nil
@@ -42,7 +60,7 @@ func currentUserWithGetent() (*user.User, error) {
 	uid := strconv.Itoa(os.Getuid())
 	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
 
-	u, _, getentErr := runGetent(uid)
+	u, _, getentErr := runGetentPasswd(uid)
 	if getentErr != nil {
 		return nil, stdErr
 	}
@@ -50,14 +68,14 @@ func currentUserWithGetent() (*user.User, error) {
 	return u, nil
 }
 
-// groupIdsWithFallback gets group IDs for a user via the id command first,
+// GroupIdsWithFallback gets group IDs for a user via the id command first,
 // falling back to user.GroupIds().
-// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
+// NOTE: unlike LookupWithGetent/CurrentUserWithGetent which try stdlib first,
 // this intentionally tries `id -G` first because without CGO, user.GroupIds()
 // only reads /etc/group and silently returns incomplete results for NSS users
 // (no error, just missing groups). The id command goes through NSS and returns
 // the full set.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
 	ids, err := runIdGroups(u.Username)
 	if err == nil {
 		return ids, nil

client/internal/shell/getent_test.go

@@ -1,4 +1,4 @@
-package server
+package shell
 
 import (
 	"os/user"
@@ -15,7 +15,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := lookupWithGetent(current.Username)
+	u, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Username, u.Username)
 	assert.Equal(t, current.Uid, u.Uid)
@@ -23,7 +23,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 }
 
 func TestLookupWithGetent_NonexistentUser(t *testing.T) {
-	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
+	_, err := LookupWithGetent("nonexistent_user_xyzzy_12345")
 	require.Error(t, err, "should fail for nonexistent user")
 }
 
@@ -31,7 +31,7 @@ func TestCurrentUserWithGetent(t *testing.T) {
 	stdUser, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := currentUserWithGetent()
+	u, err := CurrentUserWithGetent()
 	require.NoError(t, err)
 	assert.Equal(t, stdUser.Uid, u.Uid)
 	assert.Equal(t, stdUser.Username, u.Username)
@@ -41,7 +41,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(current)
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")
 
@@ -56,7 +56,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		// Windows stub always returns empty, which is correct
-		shell := getShellFromGetent("1000")
+		shell := GetShellFromGetent("1000")
 		assert.Empty(t, shell, "Windows stub should return empty")
 		return
 	}
@@ -65,9 +65,9 @@ func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	require.NoError(t, err)
 
 	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
-	shell := getShellFromGetent(current.Uid)
+	shell := GetShellFromGetent(current.Uid)
 	if shell == "" {
-		t.Log("getShellFromGetent returned empty, getent may not be available")
+		t.Log("GetShellFromGetent returned empty, getent may not be available")
 		return
 	}
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
@@ -78,7 +78,7 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 		t.Skip("no root user on Windows")
 	}
 
-	u, err := lookupWithGetent("root")
+	u, err := LookupWithGetent("root")
 	if err != nil {
 		t.Skip("root user not available on this system")
 	}
@@ -86,25 +86,25 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 }
 
 // TestIntegration_FullLookupChain exercises the complete user lookup chain
-// against the real system, testing that all wrappers (lookupWithGetent,
-// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
+// against the real system, testing that all wrappers (LookupWithGetent,
+// CurrentUserWithGetent, GroupIdsWithFallback, GetShellFromGetent) produce
 // consistent and correct results when composed together.
 func TestIntegration_FullLookupChain(t *testing.T) {
-	// Step 1: currentUserWithGetent must resolve the running user.
-	current, err := currentUserWithGetent()
-	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
+	// Step 1: CurrentUserWithGetent must resolve the running user.
+	current, err := CurrentUserWithGetent()
+	require.NoError(t, err, "CurrentUserWithGetent must resolve the running user")
 	require.NotEmpty(t, current.Uid)
 	require.NotEmpty(t, current.Username)
 
-	// Step 2: lookupWithGetent by the same username must return matching identity.
-	byName, err := lookupWithGetent(current.Username)
+	// Step 2: LookupWithGetent by the same username must return matching identity.
+	byName, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
 	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
 	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
 
-	// Step 3: groupIdsWithFallback must return at least the primary GID.
-	groups, err := groupIdsWithFallback(current)
+	// Step 3: GroupIdsWithFallback must return at least the primary GID.
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "user must have at least one group")
 
@@ -120,10 +120,10 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 	}
 	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
 
-	// Step 4: getShellFromGetent should either return a valid shell path or empty
+	// Step 4: GetShellFromGetent should either return a valid shell path or empty
 	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
 	if runtime.GOOS != "windows" {
-		shell := getShellFromGetent(current.Uid)
+		shell := GetShellFromGetent(current.Uid)
 		if shell != "" {
 			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 		}
@@ -131,17 +131,17 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 }
 
 // TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
-// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
+// LookupWithGetent can have their groups resolved via GroupIdsWithFallback,
 // testing the handoff between the two functions as used by the SSH server.
 func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
 	// Simulate the SSH server flow: lookup user, then get their groups.
-	resolved, err := lookupWithGetent(current.Username)
+	resolved, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(resolved)
+	groups, err := GroupIdsWithFallback(resolved)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "resolved user must have groups")
 
@@ -156,7 +156,7 @@ func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 }
 
 // TestIntegration_ShellLookupChain tests the full shell resolution chain
-// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
+// (getShellFromPasswd -> GetShellFromGetent -> $SHELL -> default) on Unix.
 func TestIntegration_ShellLookupChain(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Unix shell lookup not applicable on Windows")
@@ -165,8 +165,8 @@ func TestIntegration_ShellLookupChain(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	// getUserShell is the top-level function used by the SSH server.
-	shell := getUserShell(current.Uid)
-	require.NotEmpty(t, shell, "getUserShell must always return a shell")
+	// GetUserShell is the top-level function used by the SSH server.
+	shell := GetUserShell(current.Uid)
+	require.NotEmpty(t, shell, "GetUserShell must always return a shell")
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 }

client/internal/shell/getent_unix.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package server
+package shell
 
 import (
 	"context"
@@ -14,19 +14,26 @@ import (
 
 const getentTimeout = 5 * time.Second
 
-// getShellFromGetent gets a user's login shell via getent by UID.
+// GetShellFromGetent gets a user's login shell via getent by UID.
 // This is needed even with CGO because getShellFromPasswd reads /etc/passwd
 // directly and won't find NSS-provided users there.
-func getShellFromGetent(userID string) string {
-	_, shell, err := runGetent(userID)
+func GetShellFromGetent(userID string) string {
+	_, shell, err := runGetentPasswd(userID)
 	if err != nil {
 		return ""
 	}
 	return shell
 }
 
-// runGetent executes `getent passwd <query>` and returns the user and login shell.
-func runGetent(query string) (*user.User, string, error) {
+// GetUserFromGetent returns the resolved user from either a uid or username,
+// going through the host's NSS stack.
+func GetUserFromGetent(query string) (*user.User, error) {
+	u, _, err := runGetentPasswd(query)
+	return u, err
+}
+
+// runGetentPasswd executes `getent passwd <query>` and returns the user and login shell.
+func runGetentPasswd(query string) (*user.User, string, error) {
 	if !validateGetentInput(query) {
 		return nil, "", fmt.Errorf("invalid getent input: %q", query)
 	}
@@ -42,7 +49,24 @@ func runGetent(query string) (*user.User, string, error) {
 	return parseGetentPasswd(string(out))
 }
 
-// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+// runGetentGroup executes `getent group <query>` and returns the group.
+func runGetentGroup(query string) (*user.Group, error) {
+	if !validateGetentInput(query) {
+		return nil, fmt.Errorf("invalid getent input: %q", query)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", "group", query).Output()
+	if err != nil {
+		return nil, fmt.Errorf("getent group %s: %w", query, err)
+	}
+
+	return parseGetentGroup(string(out))
+}
+
+// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell".
 func parseGetentPasswd(output string) (*user.User, string, error) {
 	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
 	if len(fields) < 6 {
@@ -67,6 +91,20 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 	}, shell, nil
 }
 
+// parseGetentGroup parses getent group output: "group:x:gid:members".
+func parseGetentGroup(output string) (*user.Group, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 4 {
+		return nil, fmt.Errorf("unexpected getent output (need 4+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" {
+		return nil, fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	return &user.Group{Gid: fields[2], Name: fields[0]}, nil
+}
+
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
 // (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is

client/internal/shell/getent_unix_test.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package server
+package shell
 
 import (
 	"os/exec"
@@ -198,7 +198,7 @@ func TestRunGetent_RootUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, shell, err := runGetent("root")
+	u, shell, err := runGetentPasswd("root")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -211,7 +211,7 @@ func TestRunGetent_ByUID(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, _, err := runGetent("0")
+	u, _, err := runGetentPasswd("0")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -222,15 +222,15 @@ func TestRunGetent_NonexistentUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
+	_, _, err := runGetentPasswd("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }
 
 func TestRunGetent_InvalidInput(t *testing.T) {
-	_, _, err := runGetent("")
+	_, _, err := runGetentPasswd("")
 	assert.Error(t, err)
 
-	_, _, err = runGetent("user\x00name")
+	_, _, err = runGetentPasswd("user\x00name")
 	assert.Error(t, err)
 }
 
@@ -239,7 +239,7 @@ func TestRunGetent_NotAvailable(t *testing.T) {
 		t.Skip("getent is available, can't test missing case")
 	}
 
-	_, _, err := runGetent("root")
+	_, _, err := runGetentPasswd("root")
 	assert.Error(t, err, "should fail when getent is not installed")
 }
 
@@ -286,7 +286,7 @@ func TestGetentResultsMatchStdlib(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Username)
+	getentUser, _, err := runGetentPasswd(current.Username)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match")
@@ -303,7 +303,7 @@ func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Uid)
+	getentUser, _, err := runGetentPasswd(current.Uid)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
@@ -359,7 +359,7 @@ func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 
 	if _, err := exec.LookPath("getent"); err == nil {
-		_, getentShell, getentErr := runGetent(current.Uid)
+		_, getentShell, getentErr := runGetentPasswd(current.Uid)
 		if getentErr == nil && getentShell != "" {
 			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
 		}
@@ -403,7 +403,7 @@ func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
 			continue
 		}
 
-		_, getentShell, err := runGetent(uid)
+		_, getentShell, err := runGetentPasswd(uid)
 		if err != nil {
 			continue
 		}

client/internal/shell/getent_windows.go

@@ -0,0 +1,31 @@
+//go:build windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent on Windows just delegates to os/user.Lookup.
+// Windows does not use NSS/getent; its user lookup works without CGO.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent on Windows just delegates to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent on Windows just delegates to os/user.LookupGroup.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GetShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
+func GetShellFromGetent(_ string) string {
+	return ""
+}
+
+// GroupIdsWithFallback on Windows just delegates to u.GroupIds().
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/internal/shell/shell.go

@@ -1,17 +1,14 @@
-package server
+package shell
 
 import (
 	"bufio"
 	"fmt"
-	"net"
 	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
-	"strconv"
 	"strings"
 
-	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -22,9 +19,9 @@ const (
 	powershellExe = "powershell.exe"
 )
 
-// getUserShell returns the appropriate shell for the given user ID
-// Handles all platform-specific logic and fallbacks consistently
-func getUserShell(userID string) string {
+// GetUserShell returns the appropriate shell for the given user ID.
+// Handles all platform-specific logic and fallbacks consistently.
+func GetUserShell(userID string) string {
 	switch runtime.GOOS {
 	case "windows":
 		return getWindowsUserShell()
@@ -56,7 +53,7 @@ func getUnixUserShell(userID string) string {
 		return shell
 	}
 
-	if shell := getShellFromGetent(userID); shell != "" {
+	if shell := GetShellFromGetent(userID); shell != "" {
 		return shell
 	}
 
@@ -67,7 +64,7 @@ func getUnixUserShell(userID string) string {
 	return defaultUnixShell
 }
 
-// getShellFromPasswd reads the shell from /etc/passwd for the given user ID
+// getShellFromPasswd reads the shell from /etc/passwd for the given user ID.
 func getShellFromPasswd(userID string) string {
 	file, err := os.Open("/etc/passwd")
 	if err != nil {
@@ -101,8 +98,8 @@ func getShellFromPasswd(userID string) string {
 	return ""
 }
 
-// prepareUserEnv prepares environment variables for user execution
-func prepareUserEnv(user *user.User, shell string) []string {
+// PrepareUserEnv prepares environment variables for user execution.
+func PrepareUserEnv(user *user.User, shell string) []string {
 	pathValue := "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 	if runtime.GOOS == "windows" {
 		pathValue = `C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0`
@@ -117,9 +114,9 @@ func prepareUserEnv(user *user.User, shell string) []string {
 	}
 }
 
-// acceptEnv checks if environment variable from SSH client should be accepted
-// This is a whitelist of variables that SSH clients can send to the server
-func acceptEnv(envVar string) bool {
+// AcceptEnv checks if an environment variable from an SSH client should be accepted.
+// This is a whitelist of variables that SSH clients can send to the server.
+func AcceptEnv(envVar string) bool {
 	varName := envVar
 	if idx := strings.Index(envVar, "="); idx != -1 {
 		varName = envVar[:idx]
@@ -156,29 +153,3 @@ func acceptEnv(envVar string) bool {
 
 	return false
 }
-
-// prepareSSHEnv prepares SSH protocol-specific environment variables
-// These variables provide information about the SSH connection itself
-func prepareSSHEnv(session ssh.Session) []string {
-	remoteAddr := session.RemoteAddr()
-	localAddr := session.LocalAddr()
-
-	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
-	if err != nil {
-		remoteHost = remoteAddr.String()
-		remotePort = "0"
-	}
-
-	localHost, localPort, err := net.SplitHostPort(localAddr.String())
-	if err != nil {
-		localHost = localAddr.String()
-		localPort = strconv.Itoa(InternalSSHPort)
-	}
-
-	return []string{
-		// SSH_CLIENT format: "client_ip client_port server_port"
-		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
-		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
-		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
-	}
-}

client/ios/NetBirdSDK/client.go

@@ -233,9 +233,6 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/ssh/server/command_execution_unix.go

@@ -20,6 +20,8 @@ import (
 	"github.com/creack/pty"
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // ptyManager manages Pty file operations with thread safety
@@ -146,10 +148,10 @@ func (s *Server) createShellCommand(ctx context.Context, shell string, args []st
 
 // prepareCommandEnv prepares environment variables for command execution on Unix
 func (s *Server) prepareCommandEnv(_ *log.Entry, localUser *user.User, session ssh.Session) []string {
-	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/command_execution_windows.go

@@ -15,6 +15,7 @@ import (
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
 
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 	"github.com/netbirdio/netbird/client/ssh/server/winpty"
 )
 
@@ -247,10 +248,10 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
-		env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+		env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 		env = append(env, prepareSSHEnv(session)...)
 		for _, v := range session.Environ() {
-			if acceptEnv(v) {
+			if shellutil.AcceptEnv(v) {
 				env = append(env, v)
 			}
 		}
@@ -260,7 +261,7 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	env := userEnv
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}
@@ -273,7 +274,7 @@ func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, privileg
 		return false
 	}
 
-	shell := getUserShell(privilegeResult.User.Uid)
+	shell := shellutil.GetUserShell(privilegeResult.User.Uid)
 	logger.Infof("starting interactive shell: %s", shell)
 
 	s.executeCommandWithPty(logger, session, nil, privilegeResult, ptyReq, nil)
@@ -384,7 +385,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 	}
 
 	username, domain := s.parseUsername(localUser.Username)
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{
 		Shell:    shell,

client/ssh/server/getent_cgo_unix.go

@@ -1,24 +0,0 @@
-//go:build cgo && !osusergo && !windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent with CGO delegates directly to os/user.Lookup.
-// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
-// the NSS stack natively. If it fails, the user truly doesn't exist and
-// getent would also fail.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent with CGO delegates directly to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// groupIdsWithFallback with CGO delegates directly to user.GroupIds.
-// libc's getgrouplist handles NSS groups natively.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/ssh/server/getent_windows.go

@@ -1,26 +0,0 @@
-//go:build windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent on Windows just delegates to os/user.Lookup.
-// Windows does not use NSS/getent; its user lookup works without CGO.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent on Windows just delegates to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// getShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
-func getShellFromGetent(_ string) string {
-	return ""
-}
-
-// groupIdsWithFallback on Windows just delegates to u.GroupIds().
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/ssh/server/ssh_env.go

@@ -0,0 +1,35 @@
+package server
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/gliderlabs/ssh"
+)
+
+// prepareSSHEnv prepares SSH protocol-specific environment variables
+// These variables provide information about the SSH connection itself
+func prepareSSHEnv(session ssh.Session) []string {
+	remoteAddr := session.RemoteAddr()
+	localAddr := session.LocalAddr()
+
+	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
+	if err != nil {
+		remoteHost = remoteAddr.String()
+		remotePort = "0"
+	}
+
+	localHost, localPort, err := net.SplitHostPort(localAddr.String())
+	if err != nil {
+		localHost = localAddr.String()
+		localPort = strconv.Itoa(InternalSSHPort)
+	}
+
+	return []string{
+		// SSH_CLIENT format: "client_ip client_port server_port"
+		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
+		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
+		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
+	}
+}

client/ssh/server/user_utils.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 var (
@@ -23,8 +25,8 @@ func isPlatformUnix() bool {
 
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
-	getCurrentUser         = currentUserWithGetent
-	lookupUser             = lookupWithGetent
+	getCurrentUser         = shellutil.CurrentUserWithGetent
+	lookupUser             = shellutil.LookupWithGetent
 	getCurrentOS           = func() string { return runtime.GOOS }
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 

client/ssh/server/userswitching_unix.go

@@ -16,6 +16,8 @@ import (
 
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // POSIX portable filename character set regex: [a-zA-Z0-9._-]
@@ -160,7 +162,7 @@ func (s *Server) parseUserCredentials(localUser *user.User) (uint32, uint32, []u
 // getSupplementaryGroups retrieves supplementary group IDs for a user.
 // Uses id/getent fallback for NSS users in CGO_ENABLED=0 builds.
 func (s *Server) getSupplementaryGroups(u *user.User) ([]uint32, error) {
-	groupIDStrings, err := groupIdsWithFallback(u)
+	groupIDStrings, err := shellutil.GroupIdsWithFallback(u)
 	if err != nil {
 		return nil, fmt.Errorf("get group IDs for user %s: %w", u.Username, err)
 	}
@@ -196,7 +198,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 		GID:        gid,
 		Groups:     groups,
 		WorkingDir: localUser.HomeDir,
-		Shell:      getUserShell(localUser.Uid),
+		Shell:      shellutil.GetUserShell(localUser.Uid),
 		Command:    session.RawCommand(),
 		PTY:        hasPty,
 	}
@@ -228,7 +230,7 @@ func (s *Server) createPtyCommand(privilegeResult PrivilegeCheckResult, ptyReq s
 func (s *Server) createDirectPtyCommand(session ssh.Session, localUser *user.User, ptyReq ssh.Pty) *exec.Cmd {
 	log.Debugf("creating direct Pty command for user %s (no user switching needed)", localUser.Username)
 
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 	args := s.getShellCommandArgs(shell, session.RawCommand())
 
 	cmd := s.createShellCommand(session.Context(), shell, args)
@@ -245,12 +247,12 @@ func (s *Server) preparePtyEnv(localUser *user.User, ptyReq ssh.Pty, session ssh
 		termType = "xterm-256color"
 	}
 
-	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	env = append(env, fmt.Sprintf("TERM=%s", termType))
 
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/userswitching_windows.go

@@ -13,6 +13,8 @@ import (
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/windows"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // validateUsername validates Windows usernames according to SAM Account Name rules
@@ -104,7 +106,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
 	username, domain := s.parseUsername(localUser.Username)
 
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 
 	rawCmd := session.RawCommand()
 	var command string

client/system/info.go

@@ -79,15 +79,13 @@ type Info struct {
 	EnableSSHLocalPortForwarding  bool
 	EnableSSHRemotePortForwarding bool
 	DisableSSHAuth                bool
-
-	SyncMessageVersion *int
 }
 
 func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool, syncMessageVersion *int,
+	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
 	disableSSHAuth *bool,
 ) {
@@ -105,8 +103,6 @@ func (i *Info) SetFlags(
 	i.BlockInbound = blockInbound
 	i.DisableIPv6 = disableIPv6
 
-	i.SyncMessageVersion = syncMessageVersion
-
 	if enableSSHRoot != nil {
 		i.EnableSSHRoot = *enableSSHRoot
 	}

combined/cmd/config.go

@@ -74,9 +74,6 @@ type ServerConfig struct {
 	ActivityStore           StoreConfig        `yaml:"activityStore"`
 	AuthStore               StoreConfig        `yaml:"authStore"`
 	ReverseProxy            ReverseProxyConfig `yaml:"reverseProxy"`
-
-	SupportedSyncMessageVersions           *int           `yaml:"supportedSyncMessageVersions,omitempty"`
-	PerAccountSupportedSyncMessageVersions map[string]int `yaml:"perAccountSupportedSyncMessageVersions,omitempty"`
 }
 
 // TLSConfig contains TLS/HTTPS settings
@@ -699,18 +696,16 @@ func (c *CombinedConfig) ToManagementConfig() (*nbconfig.Config, error) {
 	httpConfig.AuthCallbackURL = callbackURL + types.ProxyCallbackEndpointFull
 
 	return &nbconfig.Config{
-		Stuns:                              stuns,
-		Relay:                              relayConfig,
-		Signal:                             signalConfig,
-		Datadir:                            mgmt.DataDir,
-		DataStoreEncryptionKey:             mgmt.Store.EncryptionKey,
-		HttpConfig:                         httpConfig,
-		StoreConfig:                        storeConfig,
-		ReverseProxy:                       reverseProxy,
-		DisableDefaultPolicy:               mgmt.DisableDefaultPolicy,
-		EmbeddedIdP:                        embeddedIdP,
-		HighestSupportedSyncMessageVersion: c.Server.SupportedSyncMessageVersions,
-		PerAccountHighestSupportedSyncMessageVersion: c.Server.PerAccountSupportedSyncMessageVersions,
+		Stuns:                  stuns,
+		Relay:                  relayConfig,
+		Signal:                 signalConfig,
+		Datadir:                mgmt.DataDir,
+		DataStoreEncryptionKey: mgmt.Store.EncryptionKey,
+		HttpConfig:             httpConfig,
+		StoreConfig:            storeConfig,
+		ReverseProxy:           reverseProxy,
+		DisableDefaultPolicy:   mgmt.DisableDefaultPolicy,
+		EmbeddedIdP:            embeddedIdP,
 	}, nil
 }
 

combined/cmd/root.go

@@ -31,7 +31,6 @@ import (
 	relayServer "github.com/netbirdio/netbird/relay/server"
 	"github.com/netbirdio/netbird/relay/server/listener"
 	"github.com/netbirdio/netbird/relay/server/listener/ws"
-	syncgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	sharedMetrics "github.com/netbirdio/netbird/shared/metrics"
 	"github.com/netbirdio/netbird/shared/relay/auth"
 	"github.com/netbirdio/netbird/shared/signal/proto"
@@ -506,16 +505,6 @@ func createManagementServer(cfg *CombinedConfig, mgmtConfig *nbconfig.Config) (m
 	}
 	mgmtPort, _ := strconv.Atoi(portStr)
 
-	if err := syncgrpc.ValidateSyncMessageVersion(mgmtConfig.HighestSupportedSyncMessageVersion); err != nil {
-		return nil, err
-	}
-
-	for accountId, version := range mgmtConfig.PerAccountHighestSupportedSyncMessageVersion {
-		if err := syncgrpc.ValidateSyncMessageVersion(&version); err != nil {
-			return nil, fmt.Errorf("unrecognized sync message version in perAccountSupportedSyncMessageVersions for account %s %w", accountId, err)
-		}
-	}
-
 	mgmtSrv := newServer(
 		&mgmtServer.Config{
 			NbConfig:                mgmtConfig,

dns/nameserver.go

@@ -53,7 +53,6 @@ type NameServerGroup struct {
 	ID string `gorm:"primaryKey"`
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `gorm:"index"`
-	PublicID  string `json:"-"`
 	// Name group name
 	Name string
 	// Description group description

go.mod

@@ -30,6 +30,7 @@ require (
 
 require (
 	github.com/DeRuina/timberjack v1.4.2
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
@@ -113,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.111
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -156,7 +157,6 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
@@ -303,6 +303,7 @@ require (
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/wailsapp/wails/webview2 v1.0.27 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect

go.sum

@@ -660,8 +660,10 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111 h1:MKx1nOnhnDuEGrRBmtxLOJq1NERwailu2cI4BvzWhi4=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111/go.mod h1:wrdvmyeCsB/K3YqJDoH8E3MwcN8NXAMnEFaDTW46w60=
+github.com/wailsapp/wails/webview2 v1.0.27 h1:wjgAi/I8BBZ7kUGU8um3XF3ILEfzr96Q2Q1G4GPjMns=
+github.com/wailsapp/wails/webview2 v1.0.27/go.mod h1:zdM4jcO1IaC61RiJL5F1BzgoqBHFIdacz8gPr5exr0o=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

idp/dex/config.go

@@ -308,7 +308,7 @@ func (s *Storage) OpenStorage(logger *slog.Logger) (storage.Storage, error) {
 		if file == "" {
 			return nil, fmt.Errorf("sqlite3 storage requires 'file' config")
 		}
-		return newSQLite3(file).Open(logger)
+		return (&sql.SQLite3{File: file}).Open(logger)
 	case "postgres":
 		dsn, _ := s.Config["dsn"].(string)
 		if dsn == "" {

idp/dex/provider.go

@@ -20,6 +20,7 @@ import (
 	"github.com/dexidp/dex/server"
 	"github.com/dexidp/dex/server/signer"
 	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/sql"
 	"github.com/go-jose/go-jose/v4"
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
@@ -78,7 +79,7 @@ func NewProvider(ctx context.Context, config *Config) (*Provider, error) {
 
 	// Initialize SQLite storage
 	dbPath := filepath.Join(config.DataDir, "oidc.db")
-	sqliteConfig := newSQLite3(dbPath)
+	sqliteConfig := &sql.SQLite3{File: dbPath}
 	stor, err := sqliteConfig.Open(logger)
 	if err != nil {
 		return nil, fmt.Errorf("failed to open storage: %w", err)

idp/dex/sqlite_cgo.go

@@ -1,15 +0,0 @@
-//go:build cgo
-
-package dex
-
-import (
-	sql "github.com/dexidp/dex/storage/sql"
-)
-
-// newSQLite3 builds the dex SQLite3 config. CGO builds use the upstream
-// struct that takes a File path. Non-CGO builds get an empty stub whose
-// Open() returns the dex "SQLite not available" error — correct behaviour
-// for binaries that can't link sqlite3 (e.g. cross-compiled ARM targets).
-func newSQLite3(file string) *sql.SQLite3 {
-	return &sql.SQLite3{File: file}
-}

idp/dex/sqlite_nocgo.go

@@ -1,15 +0,0 @@
-//go:build !cgo
-
-package dex
-
-import (
-	sql "github.com/dexidp/dex/storage/sql"
-)
-
-// newSQLite3 for non-CGO builds. The dex SQLite3 stub has no fields and its
-// Open() returns an error documenting the missing CGO support — correct
-// behaviour for cross-compiled artefacts that never actually run the
-// embedded IdP. The `file` argument is ignored.
-func newSQLite3(_ string) *sql.SQLite3 {
-	return &sql.SQLite3{}
-}

management/cmd/management.go

@@ -25,7 +25,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/grpc"
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/crypt"
 )
@@ -154,20 +153,8 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string) (*nbconfig.Confi
 
 	ApplyCommandLineOverrides(loadedConfig)
 
-	err := grpc.ValidateSyncMessageVersion(loadedConfig.HighestSupportedSyncMessageVersion)
-	if err != nil {
-		return nil, err
-	}
-
-	for account, version := range loadedConfig.PerAccountHighestSupportedSyncMessageVersion {
-		err := grpc.ValidateSyncMessageVersion(&version)
-		if err != nil {
-			return nil, fmt.Errorf("unrecognized sync message version for account %s, %w", account, err)
-		}
-	}
-
 	// Apply EmbeddedIdP config to HttpConfig if embedded IdP is enabled
-	err = ApplyEmbeddedIdPConfig(ctx, loadedConfig)
+	err := ApplyEmbeddedIdPConfig(ctx, loadedConfig)
 	if err != nil {
 		return nil, err
 	}

management/cmd/management_test.go

@@ -4,9 +4,6 @@ import (
 	"context"
 	"os"
 	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/stretchr/testify/assert"
 )
 
 const (
@@ -23,49 +20,34 @@ const (
 		"AuthAudience": "https://stageapp/",
 		"AuthIssuer": "https://something.eu.auth0.com/",
 		"OIDCConfigEndpoint": "https://something.eu.auth0.com/.well-known/openid-configuration"
-	  },
-	  "HighestSupportedSyncMessageVersion": 1,
-	  "PerAccountHighestSupportedSyncMessageVersion": {
-	    "1": 0,
-		"2": 1
 	  }
 	}`
 )
 
-func Test_LoadMgmtConfig(t *testing.T) {
-	tmpFile, err := createConfig(exampleConfig)
-	assert.NoError(t, err)
+func Test_loadMgmtConfig(t *testing.T) {
+	tmpFile, err := createConfig()
+	if err != nil {
+		t.Fatalf("failed to create config: %s", err)
+	}
 
 	cfg, err := LoadMgmtConfig(context.Background(), tmpFile)
-	assert.NoError(t, err)
-	assert.NotEmpty(t, cfg.Relay)
-	assert.NotEmpty(t, cfg.Relay.Addresses)
-	assert.Equal(t, int(grpc.ComponentNetworkMap), *cfg.HighestSupportedSyncMessageVersion)
-	assert.Equal(t, map[string]int{"1": int(grpc.Base), "2": int(grpc.ComponentNetworkMap)}, cfg.PerAccountHighestSupportedSyncMessageVersion)
+	if err != nil {
+		t.Fatalf("failed to load management config: %s", err)
+	}
+	if cfg.Relay == nil {
+		t.Fatalf("config is nil")
+	}
+	if len(cfg.Relay.Addresses) == 0 {
+		t.Fatalf("relay address is empty")
+	}
 }
 
-func Test_LoadMgmtConfig_Empty(t *testing.T) {
-	tmpFile, err := createConfig(`{
-		"HttpConfig": {
-			"AuthAudience": "https://stageapp/",
-			"AuthIssuer": "https://something.eu.auth0.com/",
-			"OIDCConfigEndpoint": "https://something.eu.auth0.com/.well-known/openid-configuration"
-		}
-	}`)
-	assert.NoError(t, err)
-
-	cfg, err := LoadMgmtConfig(context.Background(), tmpFile)
-	assert.NoError(t, err)
-	assert.Nil(t, cfg.HighestSupportedSyncMessageVersion)
-	assert.Nil(t, cfg.PerAccountHighestSupportedSyncMessageVersion)
-}
-
-func createConfig(config string) (string, error) {
+func createConfig() (string, error) {
 	tmpfile, err := os.CreateTemp("", "config.json")
 	if err != nil {
 		return "", err
 	}
-	_, err = tmpfile.Write([]byte(config))
+	_, err = tmpfile.Write([]byte(exampleConfig))
 	if err != nil {
 		return "", err
 	}

management/internals/controllers/network_map/controller/controller.go

@@ -29,7 +29,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
-	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 	"github.com/netbirdio/netbird/util"
@@ -57,10 +56,6 @@ type Controller struct {
 	proxyController port_forwarding.Controller
 
 	integratedPeerValidator integrated_validator.IntegratedValidator
-
-	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
-
-	perAccountServerSupportedSyncMessageVersions map[string]sharedgrpc.SyncMessageVersion
 }
 
 type bufferUpdate struct {
@@ -95,10 +90,8 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		dnsDomain:               dnsDomain,
 		config:                  config,
 
-		proxyController:                              proxyController,
-		EphemeralPeersManager:                        ephemeralPeersManager,
-		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
-		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
+		proxyController:       proxyController,
+		EphemeralPeersManager: ephemeralPeersManager,
 	}
 }
 
@@ -229,53 +222,18 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
 			start = time.Now()
 
-			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
-			var update *proto.SyncResponse
-
-			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
-				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
-				sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
-
-			log.WithContext(ctx).
-				WithFields(log.Fields{
-					"sync_message_version":        commonSyncMessageVersion,
-					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
-					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
-				}).Debug("common highest sync message version")
-
-			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
-				components := account.GetPeerNetworkMapComponents(
-					ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-
-				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
-
-				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
-				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
-
-				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
-					Update:      update,
-					MessageType: network_map.MessageTypeNetworkMap,
-				})
-
-				return
-			}
-
-			nmap := account.GetPeerNetworkMapFromComponents(
-				ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+			remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
+			proxyNetworkMap, ok := proxyNetworkMaps[p.ID]
+			if ok {
+				remotePeerNetworkMap.Merge(proxyNetworkMap)
 			}
 
+			peerGroups := account.GetPeerGroups(p.ID)
 			start = time.Now()
-			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -293,13 +251,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	return nil
 }
 
-func (c *Controller) perAccountOrGlobalSupportedSyncMessageVersions(accountId string) sharedgrpc.SyncMessageVersion {
-	if perAccount, ok := c.perAccountServerSupportedSyncMessageVersions[accountId]; ok {
-		return perAccount
-	}
-	return c.serverSupportedSyncMessageVersion
-}
-
 // UpdatePeers updates all peers that belong to an account.
 // Should be called when changes have to be synced to peers.
 func (c *Controller) UpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error {
@@ -401,53 +352,18 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
 			start = time.Now()
 
-			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
-			var update *proto.SyncResponse
-
-			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
-				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
-				sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
-
-			log.WithContext(ctx).
-				WithFields(log.Fields{
-					"sync_message_version":        commonSyncMessageVersion,
-					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
-					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
-				}).Debug("common highest sync message version")
-
-			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
-				components := account.GetPeerNetworkMapComponents(
-					ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-
-				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
-
-				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
-				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
-
-				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
-					Update:      update,
-					MessageType: network_map.MessageTypeNetworkMap,
-				})
-
-				return
-			}
-
-			nmap := account.GetPeerNetworkMapFromComponents(
-				ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+			remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, p.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
+			proxyNetworkMap, ok := proxyNetworkMaps[p.ID]
+			if ok {
+				remotePeerNetworkMap.Merge(proxyNetworkMap)
 			}
 
+			peerGroups := account.GetPeerGroups(p.ID)
 			start = time.Now()
-			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -535,7 +451,13 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return err
 	}
 
-	proxyNetworkMap := proxyNetworkMaps[peer.ID]
+	remotePeerNetworkMap := account.GetPeerNetworkMapFromComponents(ctx, peerId, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
+
+	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
+	if ok {
+		remotePeerNetworkMap.Merge(proxyNetworkMap)
+	}
+
 	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, peer.AccountID)
 	if err != nil {
 		return fmt.Errorf("failed to get extra settings: %v", err)
@@ -544,45 +466,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 	peerGroups := account.GetPeerGroups(peerId)
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
-	var update *proto.SyncResponse
-
-	commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
-		c.perAccountOrGlobalSupportedSyncMessageVersions(accountId),
-		sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
-
-	log.WithContext(ctx).
-		WithFields(log.Fields{
-			"sync_message_version":        commonSyncMessageVersion,
-			"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(peer.AccountID),
-			"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
-		}).Debug("common highest sync message version")
-
-	if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
-		components := account.GetPeerNetworkMapComponents(
-			ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-
-		// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-		// the client merges it into Calculate()'s output the same
-		// way the legacy server did via NetworkMap.Merge.
-		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
-
-		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
-			Update:      update,
-			MessageType: network_map.MessageTypeNetworkMap,
-		})
-
-		return nil
-	}
-
-	nmap := account.GetPeerNetworkMapFromComponents(
-		ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
-
-	if proxyNetworkMap != nil {
-		nmap.Merge(proxyNetworkMap)
-	}
-
-	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
-
+	update := grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, remotePeerNetworkMap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 		Update:      update,
 		MessageType: network_map.MessageTypeNetworkMap,
@@ -629,65 +513,6 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 	return nil
 }
 
-// GetValidatedPeerWithComponents is the components-format counterpart of
-// GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
-// peers along with the proxy NetworkMap fragment (BYOP / port-forwarding
-// data the legacy server folds in via NetworkMap.Merge). The gRPC layer
-// encodes both into the wire envelope. Callers must gate on capability
-// themselves before dispatching here — this method does NOT branch on it.
-func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*posture.Checks, int64, error) {
-	if isRequiresApproval {
-		network, err := c.repo.GetAccountNetwork(ctx, accountID)
-		if err != nil {
-			return nil, nil, nil, nil, 0, err
-		}
-		return peer, &types.NetworkMapComponents{Network: network.Copy()}, nil, nil, 0, nil
-	}
-
-	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
-	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	c.injectAllProxyPolicies(ctx, account)
-
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
-	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	postureChecks, err := c.getPeerPostureChecks(account, peer.ID)
-	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
-	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	// Fetch the proxy network map fragment for this peer alongside the
-	// components — same single-account-load path the streaming controller
-	// uses, so initial-sync delivers BYOP/forwarding patches synchronously
-	// instead of waiting for the next streaming push.
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, nil, nil, 0, err
-	}
-
-	dnsDomain := c.GetDNSDomain(account.Settings)
-	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
-
-	resourcePolicies := account.GetResourcePoliciesMap()
-	routers := account.GetResourceRoutersMap()
-	groupIDToUserIDs := account.GetActiveGroupUsers()
-	components := account.GetPeerNetworkMapComponents(ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
-
-	return peer, components, proxyNetworkMaps[peer.ID], postureChecks, dnsFwdPort, nil
-}
-
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
 func (c *Controller) BufferUpdateAffectedPeers(ctx context.Context, accountID string, peerIDs []string, reason types.UpdateReason) error {
 	if len(peerIDs) == 0 {

management/internals/controllers/network_map/interface.go

@@ -24,7 +24,6 @@ type Controller interface {
 	UpdateAccountPeer(ctx context.Context, accountId string, peerId string) error
 	BufferUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error
 	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error)
-	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*posture.Checks, int64, error)
 	GetDNSDomain(settings *types.Settings) string
 	StartWarmup(context.Context)
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)

management/internals/controllers/network_map/interface_mock.go

@@ -1,9 +1,9 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: ./interface.go
+// Source: management/internals/controllers/network_map/interface.go
 //
 // Generated by this command:
 //
-//	mockgen -package network_map -destination=interface_mock.go -source=./interface.go -build_flags=-mod=mod
+//	mockgen -package network_map -destination=management/internals/controllers/network_map/interface_mock.go -source=management/internals/controllers/network_map/interface.go -build_flags=-mod=mod
 //
 
 // Package network_map is a generated GoMock package.
@@ -126,27 +126,8 @@ func (mr *MockControllerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkMap", reflect.TypeOf((*MockController)(nil).GetNetworkMap), ctx, peerID)
 }
 
-// GetValidatedPeerWithComponents mocks base method.
-func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*posture.Checks, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetValidatedPeerWithComponents", ctx, isRequiresApproval, accountID, p)
-	ret0, _ := ret[0].(*peer.Peer)
-	ret1, _ := ret[1].(*types.NetworkMapComponents)
-	ret2, _ := ret[2].(*types.NetworkMap)
-	ret3, _ := ret[3].([]*posture.Checks)
-	ret4, _ := ret[4].(int64)
-	ret5, _ := ret[5].(error)
-	return ret0, ret1, ret2, ret3, ret4, ret5
-}
-
-// GetValidatedPeerWithComponents indicates an expected call of GetValidatedPeerWithComponents.
-func (mr *MockControllerMockRecorder) GetValidatedPeerWithComponents(ctx, isRequiresApproval, accountID, p any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetValidatedPeerWithComponents", reflect.TypeOf((*MockController)(nil).GetValidatedPeerWithComponents), ctx, isRequiresApproval, accountID, p)
-}
-
 // GetValidatedPeerWithMap mocks base method.
-func (m *MockController) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error) {
+func (m *MockController) GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*posture.Checks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetValidatedPeerWithMap", ctx, isRequiresApproval, accountID, peerID)
 	ret0, _ := ret[0].(*types.NetworkMap)
@@ -190,7 +171,7 @@ func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID
 }
 
 // OnPeersAdded mocks base method.
-func (m *MockController) OnPeersAdded(ctx context.Context, accountID string, peerIDs, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersAdded(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersAdded", ctx, accountID, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)
@@ -204,7 +185,7 @@ func (mr *MockControllerMockRecorder) OnPeersAdded(ctx, accountID, peerIDs, affe
 }
 
 // OnPeersDeleted mocks base method.
-func (m *MockController) OnPeersDeleted(ctx context.Context, accountID string, peerIDs, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersDeleted(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersDeleted", ctx, accountID, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)
@@ -218,7 +199,7 @@ func (mr *MockControllerMockRecorder) OnPeersDeleted(ctx, accountID, peerIDs, af
 }
 
 // OnPeersUpdated mocks base method.
-func (m *MockController) OnPeersUpdated(ctx context.Context, accountId string, peerIDs, affectedPeerIDs []string) error {
+func (m *MockController) OnPeersUpdated(ctx context.Context, accountId string, peerIDs []string, affectedPeerIDs []string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "OnPeersUpdated", ctx, accountId, peerIDs, affectedPeerIDs)
 	ret0, _ := ret[0].(error)

management/internals/server/config/config.go

@@ -61,10 +61,6 @@ type Config struct {
 	// EmbeddedIdP contains configuration for the embedded Dex OIDC provider.
 	// When set, Dex will be embedded in the management server and serve requests at /oauth2/
 	EmbeddedIdP *idp.EmbeddedIdPConfig
-
-	HighestSupportedSyncMessageVersion *int
-
-	PerAccountHighestSupportedSyncMessageVersion map[string]int
 }
 
 // GetAuthAudiences returns the audience from the http config and device authorization flow config

management/internals/shared/grpc/components_encoder.go

@@ -1,749 +0,0 @@
-package grpc
-
-import (
-	"encoding/base64"
-	"strconv"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
-	nbroute "github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// wgKeyRawLen is the raw byte length of a WireGuard public key.
-const wgKeyRawLen = 32
-
-// ComponentsEnvelopeInput bundles the data the component-format encoder needs.
-// The envelope is fully self-contained — every field needed by the client's
-// local Calculate() comes from the components struct itself. The only
-// externally-supplied data is the receiving peer's PeerConfig (which is
-// computed alongside the components in the network_map controller and reused
-// from the legacy proto path) and the dns_domain string.
-type ComponentsEnvelopeInput struct {
-	Components       *types.NetworkMapComponents
-	PeerConfig       *proto.PeerConfig
-	DNSDomain        string
-	DNSForwarderPort int64
-	// UserIDClaim is the OIDC claim name the client should embed in
-	// SshAuth.UserIDClaim when reconstructing the NetworkMap. Empty value
-	// is OK — client treats empty as "no SshAuth to build".
-	UserIDClaim string
-	// ProxyPatch carries pre-expanded NetworkMap fragments injected by
-	// external controllers (BYOP/port-forwarding). Nil when no proxy data
-	// is present; encoder skips the field in that case.
-	ProxyPatch *proto.ProxyPatch
-}
-
-// EncodeNetworkMapEnvelope converts NetworkMapComponents into the component
-// wire envelope. The encoder is intentionally non-deterministic: it iterates
-// Go maps in their native (random) order. Indexes inside the envelope
-// (peer_indexes, source_group_ids, agent_version_idx, router_peer_indexes)
-// are self-consistent within a single encode, so the decoder reconstructs
-// the same typed objects regardless of emit order. Tests that need to
-// compare envelopes do so semantically via proto round-trip + canonicalize,
-// not byte-equal.
-//
-// Callers must NOT concatenate or merge envelopes from different encodes —
-// index spaces are local to a single envelope.
-func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvelope {
-	c := in.Components
-
-	// Graceful degrade when components is nil — matches the legacy path's
-	// behaviour for missing/unvalidated peers (return a NetworkMap with only
-	// Network populated). The receiver gets an envelope it can decode
-	// without crashing; AccountSettings stays non-nil so client-side
-	// dereferences are safe.
-	if c.IsEmpty() {
-		// Match legacy missing-peer minimum: a NetworkMap with only Network
-		// populated. The receiver gets enough to bootstrap (Network
-		// identifier, dns_domain, account_settings) and the peer itself.
-		return &proto.NetworkMapEnvelope{
-			Payload: &proto.NetworkMapEnvelope_Full{
-				Full: &proto.NetworkMapComponentsFull{
-					PeerConfig: in.PeerConfig,
-					// components.Peers always contains the target peer
-					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},
-					DnsDomain:        in.DNSDomain,
-					DnsForwarderPort: in.DNSForwarderPort,
-					UserIdClaim:      in.UserIDClaim,
-					AccountSettings:  &proto.AccountSettingsCompact{},
-					ProxyPatch:       in.ProxyPatch,
-				},
-			},
-		}
-	}
-
-	// build indexes
-	enc := newComponentEncoder(c)
-	enc.indexAllPeers()
-	routerIdxs := enc.indexRouterPeers(c.RouterPeers)
-	enc.indexAllNetworkResources()
-
-	// Phase 2: gather every policy that any consumer references (peer-pair
-	// policies + resource-only policies) so encodeResourcePoliciesMap can
-	// translate every *Policy pointer to a wire index.
-	allPolicies := unionPolicies(c.Policies, c.ResourcePoliciesMap)
-	policies := enc.encodePolicies(allPolicies)
-
-	// Phase 3: emit. Order of struct field expressions no longer matters:
-	// every encoder either reads from the dedup tables or works on
-	// independent input.
-	full := &proto.NetworkMapComponentsFull{
-		Serial:             networkSerial(c.Network),
-		PeerConfig:         in.PeerConfig,
-		Network:            toAccountNetwork(c.Network),
-		AccountSettings:    toAccountSettingsCompact(c.AccountSettings),
-		DnsForwarderPort:   in.DNSForwarderPort,
-		UserIdClaim:        in.UserIDClaim,
-		ProxyPatch:         in.ProxyPatch,
-		DnsSettings:        enc.encodeDNSSettings(c.DNSSettings),
-		DnsDomain:          in.DNSDomain,
-		CustomZoneDomain:   c.CustomZoneDomain,
-		Peers:              enc.peers,
-		RouterPeerIndexes:  routerIdxs,
-		Policies:           policies,
-		Groups:             enc.encodeGroups(),
-		Routes:             enc.encodeRoutes(c.Routes),
-		NameserverGroups:   enc.encodeNameServerGroups(c.NameServerGroups),
-		AllDnsRecords:      encodeSimpleRecords(c.AllDNSRecords),
-		AccountZones:       encodeCustomZones(c.AccountZones),
-		NetworkResources:   enc.encodeNetworkResources(c.NetworkResources),
-		RoutersMap:         enc.encodeRoutersMap(c.RoutersMap),
-		GroupIdToUserIds:   enc.encodeGroupIDToUserIDs(c.GroupIDToUserIDs),
-		AllowedUserIds:     stringSetToSlice(c.AllowedUserIDs),
-		PostureFailedPeers: enc.encodePostureFailedPeers(c.PostureFailedPeers),
-	}
-
-	return &proto.NetworkMapEnvelope{
-		Payload: &proto.NetworkMapEnvelope_Full{Full: full},
-	}
-}
-
-// networkSerial returns c.Network.CurrentSerial() with a nil guard. The
-// production path always populates c.Network, but the encoder is exported
-// and a hand-built components struct may omit it.
-func networkSerial(n *types.Network) uint64 {
-	if n == nil {
-		return 0
-	}
-	return n.CurrentSerial()
-}
-
-type componentEncoder struct {
-	components *types.NetworkMapComponents
-
-	peerOrder           map[string]uint32
-	peers               []*proto.PeerCompact
-	networkIdToPublicId map[string]string
-}
-
-func newComponentEncoder(c *types.NetworkMapComponents) *componentEncoder {
-	return &componentEncoder{
-		components:          c,
-		peerOrder:           make(map[string]uint32, len(c.Peers)),
-		networkIdToPublicId: make(map[string]string),
-		peers:               make([]*proto.PeerCompact, 0, len(c.Peers)),
-	}
-}
-
-func (e *componentEncoder) indexAllPeers() {
-	for _, p := range e.components.Peers {
-		if p == nil {
-			continue
-		}
-		e.appendPeer(p)
-	}
-}
-
-func (e *componentEncoder) appendPeer(p *nbpeer.Peer) uint32 {
-	if idx, ok := e.peerOrder[p.ID]; ok {
-		return idx
-	}
-	idx := uint32(len(e.peers))
-	e.peerOrder[p.ID] = idx
-	e.peers = append(e.peers, toPeerCompact(p))
-	return idx
-}
-
-// indexRouterPeers ensures every router peer is in the peer dedup table
-// (c.RouterPeers may contain peers not in c.Peers when validation rules drop
-// them) and returns their wire indexes for the RouterPeerIndexes field. Must
-// run before any encoder that resolves peer ids via e.peerOrder.
-func (e *componentEncoder) indexRouterPeers(routers map[string]*nbpeer.Peer) []uint32 {
-	if len(routers) == 0 {
-		return nil
-	}
-	out := make([]uint32, 0, len(routers))
-	for _, p := range routers {
-		if p == nil {
-			continue
-		}
-		out = append(out, e.appendPeer(p))
-	}
-	return out
-}
-
-func (e *componentEncoder) indexAllNetworkResources() {
-	for _, r := range e.components.NetworkResources {
-		e.networkIdToPublicId[r.ID] = r.PublicID
-	}
-}
-
-func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
-	if len(e.components.Groups) == 0 {
-		return nil
-	}
-
-	out := make([]*proto.GroupCompact, 0, len(e.components.Groups))
-	for _, g := range e.components.Groups {
-		peerIdxs := make([]uint32, 0, len(g.Peers))
-		for _, peerID := range g.Peers {
-			if idx, ok := e.peerOrder[peerID]; ok {
-				peerIdxs = append(peerIdxs, idx)
-			}
-		}
-		out = append(out, &proto.GroupCompact{
-			Id:          g.PublicID,
-			PeerIndexes: peerIdxs,
-		})
-	}
-	return out
-}
-
-// encodePolicies flattens Policy{Rules} → []PolicyCompact. Returns the wire
-// list and a map from policy pointer to the indexes of its emitted rules in
-// that list — used by encodeResourcePoliciesMap to translate
-// ResourcePoliciesMap[resourceID][]*Policy into wire-side indexes.
-func (e *componentEncoder) encodePolicies(policies []*types.Policy) []*proto.PolicyCompact {
-	if len(policies) == 0 {
-		return nil
-	}
-
-	out := make([]*proto.PolicyCompact, 0, len(policies))
-
-	for _, pol := range policies {
-		if !pol.Enabled {
-			continue
-		}
-		for _, r := range pol.Rules {
-			if r == nil || !r.Enabled {
-				continue
-			}
-			out = append(out, e.encodePolicyRule(pol, r))
-		}
-	}
-	return out
-}
-
-// encodePolicyRule maps a single PolicyRule under pol to a PolicyCompact entry.
-func (e *componentEncoder) encodePolicyRule(pol *types.Policy, r *types.PolicyRule) *proto.PolicyCompact {
-	return &proto.PolicyCompact{
-		Id:                    pol.PublicID,
-		Action:                networkmap.GetProtoAction(string(r.Action)),
-		Protocol:              networkmap.GetProtoProtocol(string(r.Protocol)),
-		Bidirectional:         r.Bidirectional,
-		Ports:                 portsToUint32(r.Ports),
-		PortRanges:            portRangesToProto(r.PortRanges),
-		SourceGroupIds:        e.groupPublicXids(r.Sources),
-		DestinationGroupIds:   e.groupPublicXids(r.Destinations),
-		AuthorizedUser:        r.AuthorizedUser,
-		AuthorizedGroups:      e.encodeAuthorizedGroups(r.AuthorizedGroups),
-		SourceResource:        e.resourceToProto(r.SourceResource),
-		DestinationResource:   e.resourceToProto(r.DestinationResource),
-		SourcePostureCheckIds: e.postureCheckSeqs(pol.SourcePostureChecks),
-	}
-}
-
-// groupPublicXids maps the xid group IDs in src to their public xids,
-// dropping any group with invalid public xid.
-func (e *componentEncoder) groupPublicXids(src []string) []string {
-	if len(src) == 0 {
-		return nil
-	}
-	out := make([]string, 0, len(src))
-	for _, gid := range src {
-		if id, ok := e.groupPublicXid(gid); ok {
-			out = append(out, id)
-		}
-	}
-	return out
-}
-
-// unionPolicies merges c.Policies with every policy referenced by
-// c.ResourcePoliciesMap, deduplicating by pointer identity. Resource-only
-// policies (relevant to a NetworkResource but not to peer-pair traffic)
-// only live in ResourcePoliciesMap; without this union step they'd be lost
-// from the wire and the client's resource-policy lookup would come back
-// empty.
-func unionPolicies(policies []*types.Policy, resourcePolicies map[string][]*types.Policy) []*types.Policy {
-	// Fast path: non-router peers have no resource-only policies, so the
-	// "union" is identical to `policies`. Skip the dedup map allocation.
-	if len(resourcePolicies) == 0 {
-		return policies
-	}
-	seen := make(map[string]struct{}, len(policies))
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if p == nil {
-			continue
-		}
-		if _, ok := seen[p.ID]; ok {
-			continue
-		}
-		seen[p.ID] = struct{}{}
-		out = append(out, p)
-	}
-	for _, list := range resourcePolicies {
-		for _, p := range list {
-			if p == nil {
-				continue
-			}
-			if _, ok := seen[p.ID]; ok {
-				continue
-			}
-			seen[p.ID] = struct{}{}
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// encodeAuthorizedGroups translates rule.AuthorizedGroups (map keyed by
-// group xid → local-user names) to the wire form (map keyed by group
-// account_seq_id → UserNameList). Groups without a seq id are dropped —
-// matches how source/destination group references handle the same case.
-func (e *componentEncoder) encodeAuthorizedGroups(m map[string][]string) map[string]*proto.UserNameList {
-	if len(m) == 0 {
-		return nil
-	}
-	out := make(map[string]*proto.UserNameList, len(m))
-	for groupID, names := range m {
-		id, ok := e.groupPublicXid(groupID)
-		if !ok {
-			continue
-		}
-		out[id] = &proto.UserNameList{Names: names}
-	}
-	return out
-}
-
-func (e *componentEncoder) groupPublicXid(groupID string) (string, bool) {
-	g, ok := e.components.Groups[groupID]
-	if !ok {
-		return "", false
-	}
-	return g.PublicID, true
-}
-
-// resourceToProto translates types.Resource for the wire. For peer-typed
-// resources the peer id is converted to a peer index into the envelope's
-// peers array. For other resource types only the type string is shipped
-// today (Calculate's resource-typed rule path consults SourceResource only
-// for "peer" — other types fall through to group-based lookup).
-func (e *componentEncoder) resourceToProto(r types.Resource) *proto.ResourceCompact {
-	t, ok := proto.ResourceCompactType_value[string(r.Type)]
-	if !ok || t == 0 || r.ID == "" {
-		return nil
-	}
-	if t == int32(proto.ResourceCompactType_peer) {
-		idx, ok := e.peerOrder[r.ID]
-		if !ok {
-			return nil
-		}
-		return &proto.ResourceCompact{
-			Type:       proto.ResourceCompactType_peer,
-			ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: idx},
-		}
-	}
-
-	publicID, ok := e.networkIdToPublicId[r.ID]
-	if !ok {
-		return nil
-	}
-
-	return &proto.ResourceCompact{
-		Type:       proto.ResourceCompactType(t),
-		ResourceId: &proto.ResourceCompact_Id{Id: publicID},
-	}
-}
-
-// postureCheckSeqs translates a slice of posture-check xids to their
-// public xids. Unresolvable xids are silently dropped — matches how group/peer
-// references handle the same case.
-func (e *componentEncoder) postureCheckSeqs(xids []string) []string {
-	if len(xids) == 0 || len(e.components.PostureCheckXIDToPublicID) == 0 {
-		return nil
-	}
-	out := make([]string, 0, len(xids))
-	for _, xid := range xids {
-		if seq, ok := e.components.PostureCheckXIDToPublicID[xid]; ok {
-			out = append(out, seq)
-		}
-	}
-	return out
-}
-
-// networkSeq translates a Network xid to its public id using
-// the NetworkMapComponents.NetworkXIDToPublicID lookup. Returns (0,false) when
-// the xid isn't known — callers decide whether to skip the parent record.
-func (e *componentEncoder) networkPublicId(xid string) (string, bool) {
-	if xid == "" {
-		return "", false
-	}
-	id, ok := e.components.NetworkXIDToPublicID[xid]
-	if !ok {
-		return "", false
-	}
-	return id, true
-}
-
-func (e *componentEncoder) encodeDNSSettings(s *types.DNSSettings) *proto.DNSSettingsCompact {
-	if s == nil || len(s.DisabledManagementGroups) == 0 {
-		return nil
-	}
-	out := &proto.DNSSettingsCompact{
-		DisabledManagementGroupIds: make([]string, 0, len(s.DisabledManagementGroups)),
-	}
-	for _, gid := range s.DisabledManagementGroups {
-		if id, ok := e.groupPublicXid(gid); ok {
-			out.DisabledManagementGroupIds = append(out.DisabledManagementGroupIds, id)
-		}
-	}
-	return out
-}
-
-func (e *componentEncoder) encodeRoutes(routes []*nbroute.Route) []*proto.RouteRaw {
-	if len(routes) == 0 {
-		return nil
-	}
-	out := make([]*proto.RouteRaw, 0, len(routes))
-	for _, r := range routes {
-		if r == nil {
-			continue
-		}
-		rr := &proto.RouteRaw{
-			Id:                    r.PublicID,
-			NetId:                 string(r.NetID),
-			Description:           r.Description,
-			KeepRoute:             r.KeepRoute,
-			NetworkType:           int32(r.NetworkType),
-			Masquerade:            r.Masquerade,
-			Metric:                int32(r.Metric),
-			Enabled:               r.Enabled,
-			SkipAutoApply:         r.SkipAutoApply,
-			Domains:               r.Domains.ToPunycodeList(),
-			GroupIds:              e.groupPublicXids(r.Groups),
-			AccessControlGroupIds: e.groupPublicXids(r.AccessControlGroups),
-			PeerGroupIds:          e.groupPublicXids(r.PeerGroups),
-		}
-		if r.Network.IsValid() {
-			rr.NetworkCidr = r.Network.String()
-		}
-		if r.Peer != "" {
-			if idx, ok := e.peerOrder[r.Peer]; ok {
-				rr.PeerIndexSet = true
-				rr.PeerIndex = idx
-			}
-		}
-		out = append(out, rr)
-	}
-	return out
-}
-
-func (e *componentEncoder) encodeNameServerGroups(nsgs []*nbdns.NameServerGroup) []*proto.NameServerGroupRaw {
-	if len(nsgs) == 0 {
-		return nil
-	}
-	out := make([]*proto.NameServerGroupRaw, 0, len(nsgs))
-	for _, nsg := range nsgs {
-		if nsg == nil {
-			continue
-		}
-		entry := &proto.NameServerGroupRaw{
-			Id:                   nsg.PublicID,
-			Nameservers:          encodeNameServers(nsg.NameServers),
-			GroupIds:             e.groupPublicXids(nsg.Groups),
-			Primary:              nsg.Primary,
-			Domains:              nsg.Domains,
-			Enabled:              nsg.Enabled,
-			SearchDomainsEnabled: nsg.SearchDomainsEnabled,
-		}
-		out = append(out, entry)
-	}
-	return out
-}
-
-func encodeNameServers(servers []nbdns.NameServer) []*proto.NameServer {
-	if len(servers) == 0 {
-		return nil
-	}
-	out := make([]*proto.NameServer, 0, len(servers))
-	for _, s := range servers {
-		out = append(out, &proto.NameServer{
-			IP:     s.IP.String(),
-			NSType: int64(s.NSType),
-			Port:   int64(s.Port),
-		})
-	}
-	return out
-}
-
-func encodeSimpleRecords(records []nbdns.SimpleRecord) []*proto.SimpleRecord {
-	if len(records) == 0 {
-		return nil
-	}
-	out := make([]*proto.SimpleRecord, 0, len(records))
-	for _, r := range records {
-		out = append(out, &proto.SimpleRecord{
-			Name:  r.Name,
-			Type:  int64(r.Type),
-			Class: r.Class,
-			TTL:   int64(r.TTL),
-			RData: r.RData,
-		})
-	}
-	return out
-}
-
-func encodeCustomZones(zones []nbdns.CustomZone) []*proto.CustomZone {
-	if len(zones) == 0 {
-		return nil
-	}
-	out := make([]*proto.CustomZone, 0, len(zones))
-	for _, z := range zones {
-		out = append(out, &proto.CustomZone{
-			Domain:               z.Domain,
-			Records:              encodeSimpleRecords(z.Records),
-			SearchDomainDisabled: z.SearchDomainDisabled,
-			NonAuthoritative:     z.NonAuthoritative,
-		})
-	}
-	return out
-}
-
-func (e *componentEncoder) encodeNetworkResources(resources []*resourceTypes.NetworkResource) []*proto.NetworkResourceRaw {
-	if len(resources) == 0 {
-		return nil
-	}
-	out := make([]*proto.NetworkResourceRaw, 0, len(resources))
-	for _, r := range resources {
-		if r == nil {
-			continue
-		}
-		entry := &proto.NetworkResourceRaw{
-			Id:          r.PublicID,
-			Name:        r.Name,
-			Description: r.Description,
-			Type:        string(r.Type),
-			Address:     r.Address,
-			DomainValue: r.Domain,
-			Enabled:     r.Enabled,
-		}
-		if id, ok := e.networkPublicId(r.NetworkID); ok {
-			entry.NetworkSeq = id
-		}
-		if r.Prefix.IsValid() {
-			entry.PrefixCidr = r.Prefix.String()
-		}
-		out = append(out, entry)
-	}
-	return out
-}
-
-func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*routerTypes.NetworkRouter) map[string]*proto.NetworkRouterList {
-	if len(routersMap) == 0 {
-		return nil
-	}
-	out := make(map[string]*proto.NetworkRouterList, len(routersMap))
-	for networkXID, routers := range routersMap {
-		if len(routers) == 0 {
-			continue
-		}
-		id, ok := e.networkPublicId(networkXID)
-		if !ok {
-			continue
-		}
-		entries := make([]*proto.NetworkRouterEntry, 0, len(routers))
-		for peerID, r := range routers {
-			if r == nil {
-				continue
-			}
-			entry := &proto.NetworkRouterEntry{
-				Id:           r.PublicID,
-				PeerGroupIds: e.groupPublicXids(r.PeerGroups),
-				Masquerade:   r.Masquerade,
-				Metric:       int32(r.Metric),
-				Enabled:      r.Enabled,
-			}
-			if idx, ok := e.peerOrder[peerID]; ok {
-				entry.PeerIndexSet = true
-				entry.PeerIndex = idx
-			}
-			entries = append(entries, entry)
-		}
-		out[id] = &proto.NetworkRouterList{Entries: entries}
-	}
-	return out
-}
-
-func (e *componentEncoder) encodeGroupIDToUserIDs(m map[string][]string) map[string]*proto.UserIDList {
-	if len(m) == 0 {
-		return nil
-	}
-	out := make(map[string]*proto.UserIDList, len(m))
-	for groupID, userIDs := range m {
-		id, ok := e.groupPublicXid(groupID)
-		if !ok || len(userIDs) == 0 {
-			continue
-		}
-		out[id] = &proto.UserIDList{UserIds: userIDs}
-	}
-	return out
-}
-
-func stringSetToSlice(s map[string]struct{}) []string {
-	if len(s) == 0 {
-		return nil
-	}
-	out := make([]string, 0, len(s))
-	for k := range s {
-		out = append(out, k)
-	}
-	return out
-}
-
-func (e *componentEncoder) encodePostureFailedPeers(m map[string]map[string]struct{}) map[string]*proto.PeerIndexSet {
-	if len(m) == 0 {
-		return nil
-	}
-	out := make(map[string]*proto.PeerIndexSet, len(m))
-	for checkXID, failedPeerIDs := range m {
-		id, ok := e.components.PostureCheckXIDToPublicID[checkXID]
-		if !ok {
-			continue
-		}
-		idxs := make([]uint32, 0, len(failedPeerIDs))
-		for peerID := range failedPeerIDs {
-			if idx, ok := e.peerOrder[peerID]; ok {
-				idxs = append(idxs, idx)
-			}
-		}
-		if len(idxs) == 0 {
-			continue
-		}
-		out[id] = &proto.PeerIndexSet{PeerIndexes: idxs}
-	}
-	return out
-}
-
-// toAccountSettingsCompact always returns a non-nil message — the client
-// dereferences it unconditionally during Calculate(), so a nil here would
-// crash the receiver. A missing types.AccountSettingsInfo on the server
-// (which shouldn't happen in production but the encoder is exported)
-// degrades to login_expiration_enabled = false, which makes
-// LoginExpired() return false for every peer.
-func toAccountSettingsCompact(s *types.AccountSettingsInfo) *proto.AccountSettingsCompact {
-	if s == nil {
-		return &proto.AccountSettingsCompact{}
-	}
-	return &proto.AccountSettingsCompact{
-		PeerLoginExpirationEnabled: s.PeerLoginExpirationEnabled,
-		PeerLoginExpirationNs:      int64(s.PeerLoginExpiration),
-	}
-}
-
-func toAccountNetwork(n *types.Network) *proto.AccountNetwork {
-	if n == nil {
-		return nil
-	}
-	out := &proto.AccountNetwork{
-		Identifier: n.Identifier,
-		NetCidr:    n.Net.String(),
-		Dns:        n.Dns,
-		Serial:     n.CurrentSerial(),
-	}
-	if len(n.NetV6.IP) > 0 {
-		out.NetV6Cidr = n.NetV6.String()
-	}
-	return out
-}
-
-func toPeerCompact(p *nbpeer.Peer) *proto.PeerCompact {
-	pc := &proto.PeerCompact{
-		WgPubKey:               decodeWgKey(p.Key),
-		SshPubKey:              []byte(p.SSHKey),
-		DnsLabel:               p.DNSLabel,
-		AgentVersion:           p.Meta.WtVersion,
-		AddedWithSsoLogin:      p.UserID != "",
-		LoginExpirationEnabled: p.LoginExpirationEnabled,
-		SshEnabled:             p.SSHEnabled,
-		SupportsIpv6:           p.SupportsIPv6(),
-		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
-		ServerSshAllowed:       p.Meta.Flags.ServerSSHAllowed,
-	}
-	if p.LastLogin != nil {
-		pc.LastLoginUnixNano = p.LastLogin.UnixNano()
-	}
-	switch {
-	case !p.IP.IsValid():
-		// leave Ip nil
-	case p.IP.Is4() || p.IP.Is4In6():
-		ip := p.IP.Unmap().As4()
-		pc.Ip = ip[:]
-	default:
-		ip := p.IP.As16()
-		pc.Ip = ip[:]
-	}
-	if p.IPv6.IsValid() {
-		ip := p.IPv6.As16()
-		pc.Ipv6 = ip[:]
-	}
-	return pc
-}
-
-// decodeWgKey returns the raw 32 bytes of a base64-encoded WireGuard public
-// key, or nil for an empty / malformed key.
-func decodeWgKey(s string) []byte {
-	if s == "" {
-		return nil
-	}
-	out := make([]byte, wgKeyRawLen)
-	n, err := base64.StdEncoding.Decode(out, []byte(s))
-	if err != nil || n != wgKeyRawLen {
-		return nil
-	}
-	return out
-}
-
-func portsToUint32(ports []string) []uint32 {
-	if len(ports) == 0 {
-		return nil
-	}
-	out := make([]uint32, 0, len(ports))
-	for _, p := range ports {
-		v, err := strconv.ParseUint(p, 10, 16)
-		if err != nil {
-			continue
-		}
-		out = append(out, uint32(v))
-	}
-	return out
-}
-
-func portRangesToProto(ranges []types.RulePortRange) []*proto.PortInfo_Range {
-	if len(ranges) == 0 {
-		return nil
-	}
-	out := make([]*proto.PortInfo_Range, 0, len(ranges))
-	for _, r := range ranges {
-		out = append(out, &proto.PortInfo_Range{
-			Start: uint32(r.Start),
-			End:   uint32(r.End),
-		})
-	}
-	return out
-}

management/internals/shared/grpc/components_envelope_response.go

@@ -1,200 +0,0 @@
-package grpc
-
-import (
-	"context"
-
-	integrationsConfig "github.com/netbirdio/management-integrations/integrations/config"
-
-	"github.com/netbirdio/netbird/client/ssh/auth"
-	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
-	"github.com/netbirdio/netbird/management/server/types"
-	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// ToComponentSyncResponse builds a SyncResponse carrying the compact
-// NetworkMapEnvelope for capability-aware peers. The legacy proto.NetworkMap
-// field is intentionally left empty — capable peers ignore it and the
-// envelope alone is the authoritative wire shape.
-//
-// PeerConfig is computed once server-side using the receiving peer's own
-// account-level network metadata. EnableSSH inside PeerConfig is left at
-// peer.SSHEnabled (the peer's local setting); account-policy-driven SSH is
-// computed by the client from the envelope's GroupIDToUserIDs / AllowedUserIDs
-// inside Calculate(), so the SshConfig.SshEnabled bit may flip true on the
-// client even though the server-side PeerConfig reports false.
-func ToComponentSyncResponse(
-	ctx context.Context,
-	config *nbconfig.Config,
-	httpConfig *nbconfig.HttpServerConfig,
-	deviceFlowConfig *nbconfig.DeviceAuthorizationFlow,
-	peer *nbpeer.Peer,
-	turnCredentials *Token,
-	relayCredentials *Token,
-	components *types.NetworkMapComponents,
-	proxyPatch *types.NetworkMap,
-	dnsName string,
-	checks []*posture.Checks,
-	settings *types.Settings,
-	extraSettings *types.ExtraSettings,
-	peerGroups []string,
-	dnsFwdPort int64,
-) *proto.SyncResponse {
-	//
-	// 'component' parameter is expected to never be nil
-	// 'peer' parameter is expected to never be nil
-	//
-	// TODO (dmitri) consider using invariants?
-	//
-	enableSSH := computeSSHEnabledForPeer(components, peer)
-	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH)
-
-	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
-	useSourcePrefixes := peer.SupportsSourcePrefixes()
-
-	userIDClaim := auth.DefaultUserIDClaim
-	if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
-		userIDClaim = httpConfig.AuthUserIDClaim
-	}
-
-	envelope := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-		Components:       components,
-		PeerConfig:       peerConfig,
-		DNSDomain:        dnsName,
-		DNSForwarderPort: dnsFwdPort,
-		UserIDClaim:      userIDClaim,
-		ProxyPatch:       toProxyPatch(proxyPatch, dnsName, includeIPv6, useSourcePrefixes),
-	})
-
-	resp := &proto.SyncResponse{
-		PeerConfig:         peerConfig,
-		NetworkMapEnvelope: envelope,
-		Checks:             toProtocolChecks(ctx, checks),
-		Version:            int32(sharedgrpc.ComponentNetworkMap),
-	}
-
-	nbConfig := toNetbirdConfig(config, turnCredentials, relayCredentials, extraSettings, settings)
-	resp.NetbirdConfig = integrationsConfig.ExtendNetBirdConfig(peer.ID, peerGroups, nbConfig, extraSettings)
-
-	// settings == nil → field stays nil → "no info in this snapshot", client
-	// preserves the deadline it already had. settings non-nil → emit either a
-	// valid deadline or the explicit-zero "disabled" sentinel via
-	// encodeSessionExpiresAt.
-	if settings != nil {
-		resp.SessionExpiresAt = encodeSessionExpiresAt(
-			peer.SessionExpiresAt(settings.PeerLoginExpirationEnabled, settings.PeerLoginExpiration),
-		)
-	}
-
-	return resp
-}
-
-// toProxyPatch converts a proxy-injected *types.NetworkMap into the wire
-// patch the components envelope ships alongside. Returns nil when there are
-// no fragments to merge — proto3 omits a nil message field, so the receiver
-// sees no patch and skips the merge step entirely.
-//
-// We reuse the legacy proto-conversion helpers (toProtocolRoutes,
-// toProtocolFirewallRules, toProtocolRoutesFirewallRules,
-// appendRemotePeerConfig, ForwardingRule.ToProto) because the proxy
-// delivers fragments pre-expanded — there's no raw component shape to
-// derive them from. Components purity isn't violated: proxy data isn't
-// policy-graph-derived, it's externally injected post-Calculate, so the
-// client merges it on top of its locally-computed NetworkMap.
-func toProxyPatch(nm *types.NetworkMap, dnsName string, includeIPv6, useSourcePrefixes bool) *proto.ProxyPatch {
-	if nm == nil {
-		return nil
-	}
-	if len(nm.Peers) == 0 && len(nm.OfflinePeers) == 0 && len(nm.FirewallRules) == 0 &&
-		len(nm.Routes) == 0 && len(nm.RoutesFirewallRules) == 0 && len(nm.ForwardingRules) == 0 {
-		return nil
-	}
-
-	patch := &proto.ProxyPatch{
-		Peers:              networkmap.AppendRemotePeerConfig(nil, nm.Peers, dnsName, includeIPv6),
-		OfflinePeers:       networkmap.AppendRemotePeerConfig(nil, nm.OfflinePeers, dnsName, includeIPv6),
-		FirewallRules:      networkmap.ToProtocolFirewallRules(nm.FirewallRules, includeIPv6, useSourcePrefixes),
-		Routes:             networkmap.ToProtocolRoutes(nm.Routes),
-		RouteFirewallRules: networkmap.ToProtocolRoutesFirewallRules(nm.RoutesFirewallRules),
-	}
-	if len(nm.ForwardingRules) > 0 {
-		patch.ForwardingRules = make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, r := range nm.ForwardingRules {
-			patch.ForwardingRules = append(patch.ForwardingRules, r.ToProto())
-		}
-	}
-	return patch
-}
-
-// computeSSHEnabledForPeer mirrors the SSH-server-activation bit that
-// Calculate() folds into NetworkMap.EnableSSH. Components-format peers
-// receive a freshly-computed PeerConfig.SshConfig.SshEnabled at sync time;
-// without this helper the field would be incorrectly false for any peer
-// that's the destination of an SSH-enabling policy without having
-// peer.SSHEnabled set locally.
-//
-// Mirrors the two activation paths Calculate() uses:
-//  1. Explicit: rule.Protocol == NetbirdSSH and peer is in the rule's
-//     destinations.
-//  2. Legacy implicit: rule covers TCP/22 or TCP/22022 (or ALL), peer is in
-//     destinations, AND the peer has SSHEnabled set locally — this is the
-//     "allow-all/TCP-22 implies SSH activation for SSH-capable peers" path.
-//
-// The full SSH AuthorizedUsers map is still produced by the client when it
-// runs Calculate() over the envelope.
-func computeSSHEnabledForPeer(c *types.NetworkMapComponents, peer *nbpeer.Peer) bool {
-	if c == nil || peer == nil {
-		return false
-	}
-	// Mirror Calculate's `getAllPeersFromGroups` invariant: target peer must
-	// exist in c.Peers, otherwise no rule applies to it.
-	if _, ok := c.Peers[peer.ID]; !ok {
-		return false
-	}
-	for _, policy := range c.Policies {
-		if policy == nil || !policy.Enabled {
-			continue
-		}
-		for _, rule := range policy.Rules {
-			if ruleEnablesSSHForPeer(c, rule, peer) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// ruleEnablesSSHForPeer returns true when rule is active, targets peer, and
-// either explicitly authorises SSH or covers the legacy TCP/22 path while the
-// peer itself has SSH enabled locally.
-func ruleEnablesSSHForPeer(c *types.NetworkMapComponents, rule *types.PolicyRule, peer *nbpeer.Peer) bool {
-	if rule == nil || !rule.Enabled {
-		return false
-	}
-	if !peerInDestinations(c, rule, peer.ID) {
-		return false
-	}
-	if rule.Protocol == types.PolicyRuleProtocolNetbirdSSH {
-		return true
-	}
-	return peer.SSHEnabled && types.PolicyRuleImpliesLegacySSH(rule)
-}
-
-// peerInDestinations reports whether peerID is in any of rule.Destinations'
-// groups (or matches DestinationResource if it's a peer-typed resource —
-// for non-peer types Calculate falls through to group lookup, so we mirror
-// that exactly to avoid silent divergence).
-func peerInDestinations(c *types.NetworkMapComponents, rule *types.PolicyRule, peerID string) bool {
-	if rule.DestinationResource.Type == types.ResourceTypePeer && rule.DestinationResource.ID != "" {
-		return rule.DestinationResource.ID == peerID
-	}
-	for _, groupID := range rule.Destinations {
-		if c.IsPeerInGroup(peerID, groupID) {
-			return true
-		}
-	}
-	return false
-}

management/internals/shared/grpc/components_envelope_response_test.go

@@ -1,184 +0,0 @@
-package grpc
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// TestComputeSSHEnabledForPeer covers both Calculate-mirroring branches:
-// explicit NetbirdSSH protocol, and the legacy implicit case where a
-// TCP/22 (or 22022 / ALL / port-range-covering-22) rule activates SSH when
-// the destination peer has SSHEnabled=true locally.
-func TestComputeSSHEnabledForPeer(t *testing.T) {
-	const targetPeerID = "target"
-	const targetGroupID = "g_dst"
-
-	mkComponents := func(rule *types.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nbpeer.Peer) {
-		peer := &nbpeer.Peer{ID: targetPeerID, SSHEnabled: sshEnabled}
-		group := &types.Group{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
-		return &types.NetworkMapComponents{
-			Peers:  map[string]*nbpeer.Peer{targetPeerID: peer},
-			Groups: map[string]*types.Group{targetGroupID: group},
-			Policies: []*types.Policy{{
-				ID:      "p",
-				Enabled: true,
-				Rules:   []*types.PolicyRule{rule},
-			}},
-		}, peer
-	}
-
-	cases := []struct {
-		name        string
-		peerSSH     bool
-		rule        types.PolicyRule
-		wantEnabled bool
-	}{
-		{
-			name:    "explicit-netbird-ssh-activates-regardless-of-peer-ssh",
-			peerSSH: false,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "implicit-tcp-22-with-peer-ssh",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22"},
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "implicit-tcp-22-without-peer-ssh-disabled",
-			peerSSH: false,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22"},
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: false,
-		},
-		{
-			name:    "implicit-tcp-22022-with-peer-ssh",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22022"},
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "implicit-all-protocol-with-peer-ssh",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolALL,
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "implicit-port-range-covers-22",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled:      true,
-				Protocol:     types.PolicyRuleProtocolTCP,
-				PortRanges:   []types.RulePortRange{{Start: 20, End: 30}},
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "tcp-80-no-ssh",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"80"},
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: false,
-		},
-		{
-			name:    "disabled-rule-skipped",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: false, Protocol: types.PolicyRuleProtocolNetbirdSSH,
-				Destinations: []string{targetGroupID},
-			},
-			wantEnabled: false,
-		},
-		{
-			name:    "peer-not-in-destinations",
-			peerSSH: true,
-			rule: types.PolicyRule{
-				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
-				Destinations: []string{"g_other"}, // target not in this group
-			},
-			wantEnabled: false,
-		},
-		{
-			name:    "peer-typed-destination-resource-matches",
-			peerSSH: false,
-			rule: types.PolicyRule{
-				Enabled:             true,
-				Protocol:            types.PolicyRuleProtocolNetbirdSSH,
-				DestinationResource: types.Resource{ID: targetPeerID, Type: types.ResourceTypePeer},
-			},
-			wantEnabled: true,
-		},
-		{
-			name:    "non-peer-destination-resource-falls-through-to-groups",
-			peerSSH: false,
-			rule: types.PolicyRule{
-				Enabled:             true,
-				Protocol:            types.PolicyRuleProtocolNetbirdSSH,
-				DestinationResource: types.Resource{ID: targetPeerID, Type: "host"}, // wrong type
-				Destinations:        []string{targetGroupID},                        // saved by group fallback
-			},
-			wantEnabled: true,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			c, peer := mkComponents(&tc.rule, tc.peerSSH)
-			got := computeSSHEnabledForPeer(c, peer)
-			assert.Equal(t, tc.wantEnabled, got)
-		})
-	}
-}
-
-// TestComputeSSHEnabledForPeer_TargetMissingFromComponents covers the
-// belt-and-suspenders presence guard mirroring Calculate's
-// getAllPeersFromGroups invariant.
-func TestComputeSSHEnabledForPeer_TargetMissingFromComponents(t *testing.T) {
-	peer := &nbpeer.Peer{ID: "missing", SSHEnabled: true}
-	c := &types.NetworkMapComponents{
-		Peers: map[string]*nbpeer.Peer{}, // target peer NOT present
-		Groups: map[string]*types.Group{
-			"g": {ID: "g", Peers: []string{"missing"}},
-		},
-		Policies: []*types.Policy{{
-			ID: "p", Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
-				Destinations: []string{"g"},
-			}},
-		}},
-	}
-	assert.False(t, computeSSHEnabledForPeer(c, peer),
-		"missing target peer must short-circuit to false, not consult policies")
-}
-
-// TestComputeSSHEnabledForPeer_NilInputs guards the cheap nil-checks at
-// function entry — Calculate doesn't accept nil either, but the helper is
-// exported indirectly via ToComponentSyncResponse and may receive nil
-// components on graceful-degrade paths.
-func TestComputeSSHEnabledForPeer_NilInputs(t *testing.T) {
-	assert.False(t, computeSSHEnabledForPeer(nil, &nbpeer.Peer{ID: "x"}))
-	assert.False(t, computeSSHEnabledForPeer(&types.NetworkMapComponents{}, nil))
-}

management/internals/shared/grpc/conversion.go

@@ -10,20 +10,24 @@ import (
 
 	"github.com/hashicorp/go-version"
 	nbversion "github.com/netbirdio/netbird/version"
+	log "github.com/sirupsen/logrus"
+	goproto "google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	integrationsConfig "github.com/netbirdio/management-integrations/integrations/config"
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 
+	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
+	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/netiputil"
+	"github.com/netbirdio/netbird/shared/sshauth"
 )
 
 const (
@@ -165,8 +169,8 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
 		NetworkMap: &proto.NetworkMap{
 			Serial:     networkMap.Network.CurrentSerial(),
-			Routes:     networkmap.ToProtocolRoutes(networkMap.Routes),
-			DNSConfig:  networkmap.ToProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
+			Routes:     toProtocolRoutes(networkMap.Routes),
+			DNSConfig:  toProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
 			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
 		},
 		Checks: toProtocolChecks(ctx, checks),
@@ -179,7 +183,7 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.NetworkMap.PeerConfig = response.PeerConfig
 
 	remotePeers := make([]*proto.RemotePeerConfig, 0, len(networkMap.Peers)+len(networkMap.OfflinePeers))
-	remotePeers = networkmap.AppendRemotePeerConfig(remotePeers, networkMap.Peers, dnsName, includeIPv6)
+	remotePeers = appendRemotePeerConfig(remotePeers, networkMap.Peers, dnsName, includeIPv6)
 
 	if !shouldSkipSendingDeprecatedRemotePeers(peer.Meta.WtVersion) {
 		response.RemotePeers = remotePeers
@@ -189,13 +193,13 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.RemotePeersIsEmpty = len(remotePeers) == 0
 	response.NetworkMap.RemotePeersIsEmpty = response.RemotePeersIsEmpty
 
-	response.NetworkMap.OfflinePeers = networkmap.AppendRemotePeerConfig(nil, networkMap.OfflinePeers, dnsName, includeIPv6)
+	response.NetworkMap.OfflinePeers = appendRemotePeerConfig(nil, networkMap.OfflinePeers, dnsName, includeIPv6)
 
-	firewallRules := networkmap.ToProtocolFirewallRules(networkMap.FirewallRules, includeIPv6, useSourcePrefixes)
+	firewallRules := toProtocolFirewallRules(networkMap.FirewallRules, includeIPv6, useSourcePrefixes)
 	response.NetworkMap.FirewallRules = firewallRules
 	response.NetworkMap.FirewallRulesIsEmpty = len(firewallRules) == 0
 
-	routesFirewallRules := networkmap.ToProtocolRoutesFirewallRules(networkMap.RoutesFirewallRules)
+	routesFirewallRules := toProtocolRoutesFirewallRules(networkMap.RoutesFirewallRules)
 	response.NetworkMap.RoutesFirewallRules = routesFirewallRules
 	response.NetworkMap.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
@@ -208,7 +212,7 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	}
 
 	if networkMap.AuthorizedUsers != nil {
-		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
+		hashedUsers, machineUsers := buildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim
 		if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
 			userIDClaim = httpConfig.AuthUserIDClaim
@@ -248,6 +252,33 @@ func encodeSessionExpiresAt(deadline time.Time) *timestamppb.Timestamp {
 	return timestamppb.New(deadline)
 }
 
+func buildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]map[string]struct{}) ([][]byte, map[string]*proto.MachineUserIndexes) {
+	userIDToIndex := make(map[string]uint32)
+	var hashedUsers [][]byte
+	machineUsers := make(map[string]*proto.MachineUserIndexes, len(authorizedUsers))
+
+	for machineUser, users := range authorizedUsers {
+		indexes := make([]uint32, 0, len(users))
+		for userID := range users {
+			idx, exists := userIDToIndex[userID]
+			if !exists {
+				hash, err := sshauth.HashUserID(userID)
+				if err != nil {
+					log.WithContext(ctx).Errorf("failed to hash user id %s: %v", userID, err)
+					continue
+				}
+				idx = uint32(len(hashedUsers))
+				userIDToIndex[userID] = idx
+				hashedUsers = append(hashedUsers, hash[:])
+			}
+			indexes = append(indexes, idx)
+		}
+		machineUsers[machineUser] = &proto.MachineUserIndexes{Indexes: indexes}
+	}
+
+	return hashedUsers, machineUsers
+}
+
 func shouldSkipSendingDeprecatedRemotePeers(peerVersion string) bool {
 	if nbversion.IsDevelopmentVersion(peerVersion) {
 		return true
@@ -261,6 +292,51 @@ func shouldSkipSendingDeprecatedRemotePeers(peerVersion string) bool {
 	return precomputedDeprecatedRemotePeersConstraint.Check(peerNBVersion)
 }
 
+func appendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nbpeer.Peer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
+	for _, rPeer := range peers {
+		allowedIPs := []string{rPeer.IP.String() + "/32"}
+		if includeIPv6 && rPeer.IPv6.IsValid() {
+			allowedIPs = append(allowedIPs, rPeer.IPv6.String()+"/128")
+		}
+		dst = append(dst, &proto.RemotePeerConfig{
+			WgPubKey:     rPeer.Key,
+			AllowedIps:   allowedIPs,
+			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
+			Fqdn:         rPeer.FQDN(dnsName),
+			AgentVersion: rPeer.Meta.WtVersion,
+		})
+	}
+	return dst
+}
+
+// toProtocolDNSConfig converts nbdns.Config to proto.DNSConfig using the cache
+func toProtocolDNSConfig(update nbdns.Config, cache *cache.DNSConfigCache, forwardPort int64) *proto.DNSConfig {
+	protoUpdate := &proto.DNSConfig{
+		ServiceEnable:    update.ServiceEnable,
+		CustomZones:      make([]*proto.CustomZone, 0, len(update.CustomZones)),
+		NameServerGroups: make([]*proto.NameServerGroup, 0, len(update.NameServerGroups)),
+		ForwarderPort:    forwardPort,
+	}
+
+	for _, zone := range update.CustomZones {
+		protoZone := convertToProtoCustomZone(zone)
+		protoUpdate.CustomZones = append(protoUpdate.CustomZones, protoZone)
+	}
+
+	for _, nsGroup := range update.NameServerGroups {
+		cacheKey := nsGroup.ID
+		if cachedGroup, exists := cache.GetNameServerGroup(cacheKey); exists {
+			protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, cachedGroup)
+		} else {
+			protoGroup := convertToProtoNameServerGroup(nsGroup)
+			cache.SetNameServerGroup(cacheKey, protoGroup)
+			protoUpdate.NameServerGroups = append(protoUpdate.NameServerGroups, protoGroup)
+		}
+	}
+
+	return protoUpdate
+}
+
 func ToResponseProto(configProto nbconfig.Protocol) proto.HostConfig_Protocol {
 	switch configProto {
 	case nbconfig.UDP:
@@ -278,6 +354,203 @@ func ToResponseProto(configProto nbconfig.Protocol) proto.HostConfig_Protocol {
 	}
 }
 
+func toProtocolRoutes(routes []*nbroute.Route) []*proto.Route {
+	protoRoutes := make([]*proto.Route, 0, len(routes))
+	for _, r := range routes {
+		protoRoutes = append(protoRoutes, toProtocolRoute(r))
+	}
+	return protoRoutes
+}
+
+func toProtocolRoute(route *nbroute.Route) *proto.Route {
+	return &proto.Route{
+		ID:            string(route.ID),
+		NetID:         string(route.NetID),
+		Network:       route.Network.String(),
+		Domains:       route.Domains.ToPunycodeList(),
+		NetworkType:   int64(route.NetworkType),
+		Peer:          route.Peer,
+		Metric:        int64(route.Metric),
+		Masquerade:    route.Masquerade,
+		KeepRoute:     route.KeepRoute,
+		SkipAutoApply: route.SkipAutoApply,
+	}
+}
+
+// toProtocolFirewallRules converts the firewall rules to the protocol firewall rules.
+// When useSourcePrefixes is true, the compact SourcePrefixes field is populated
+// alongside the deprecated PeerIP for forward compatibility.
+// Wildcard rules ("0.0.0.0") are expanded into separate v4 and v6 SourcePrefixes
+// when includeIPv6 is true.
+func toProtocolFirewallRules(rules []*types.FirewallRule, includeIPv6, useSourcePrefixes bool) []*proto.FirewallRule {
+	result := make([]*proto.FirewallRule, 0, len(rules))
+	for i := range rules {
+		rule := rules[i]
+
+		fwRule := &proto.FirewallRule{
+			PolicyID:  []byte(rule.PolicyID),
+			PeerIP:    rule.PeerIP, //nolint:staticcheck // populated for backward compatibility
+			Direction: getProtoDirection(rule.Direction),
+			Action:    getProtoAction(rule.Action),
+			Protocol:  getProtoProtocol(rule.Protocol),
+			Port:      rule.Port,
+		}
+
+		if useSourcePrefixes && rule.PeerIP != "" {
+			result = append(result, populateSourcePrefixes(fwRule, rule, includeIPv6)...)
+		}
+
+		if shouldUsePortRange(fwRule) {
+			fwRule.PortInfo = rule.PortRange.ToProto()
+		}
+
+		result = append(result, fwRule)
+	}
+	return result
+}
+
+// populateSourcePrefixes sets SourcePrefixes on fwRule and returns any
+// additional rules needed (e.g. a v6 wildcard clone when the peer IP is unspecified).
+func populateSourcePrefixes(fwRule *proto.FirewallRule, rule *types.FirewallRule, includeIPv6 bool) []*proto.FirewallRule {
+	addr, err := netip.ParseAddr(rule.PeerIP)
+	if err != nil {
+		return nil
+	}
+
+	if !addr.IsUnspecified() {
+		fwRule.SourcePrefixes = [][]byte{netiputil.EncodeAddr(addr.Unmap())}
+		return nil
+	}
+
+	// IPv4Unspecified/0 is always valid, error is impossible.
+	v4Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv4Unspecified(), 0))
+	fwRule.SourcePrefixes = [][]byte{v4Wildcard}
+
+	if !includeIPv6 {
+		return nil
+	}
+
+	v6Rule := goproto.Clone(fwRule).(*proto.FirewallRule)
+	v6Rule.PeerIP = "::" //nolint:staticcheck // populated for backward compatibility
+	// IPv6Unspecified/0 is always valid, error is impossible.
+	v6Wildcard, _ := netiputil.EncodePrefix(netip.PrefixFrom(netip.IPv6Unspecified(), 0))
+	v6Rule.SourcePrefixes = [][]byte{v6Wildcard}
+	if shouldUsePortRange(v6Rule) {
+		v6Rule.PortInfo = rule.PortRange.ToProto()
+	}
+	return []*proto.FirewallRule{v6Rule}
+}
+
+// getProtoDirection converts the direction to proto.RuleDirection.
+func getProtoDirection(direction int) proto.RuleDirection {
+	if direction == types.FirewallRuleDirectionOUT {
+		return proto.RuleDirection_OUT
+	}
+	return proto.RuleDirection_IN
+}
+
+func toProtocolRoutesFirewallRules(rules []*types.RouteFirewallRule) []*proto.RouteFirewallRule {
+	result := make([]*proto.RouteFirewallRule, len(rules))
+	for i := range rules {
+		rule := rules[i]
+		result[i] = &proto.RouteFirewallRule{
+			SourceRanges: rule.SourceRanges,
+			Action:       getProtoAction(rule.Action),
+			Destination:  rule.Destination,
+			Protocol:     getProtoProtocol(rule.Protocol),
+			PortInfo:     getProtoPortInfo(rule),
+			IsDynamic:    rule.IsDynamic,
+			Domains:      rule.Domains.ToPunycodeList(),
+			PolicyID:     []byte(rule.PolicyID),
+			RouteID:      string(rule.RouteID),
+		}
+	}
+
+	return result
+}
+
+// getProtoAction converts the action to proto.RuleAction.
+func getProtoAction(action string) proto.RuleAction {
+	if action == string(types.PolicyTrafficActionDrop) {
+		return proto.RuleAction_DROP
+	}
+	return proto.RuleAction_ACCEPT
+}
+
+// getProtoProtocol converts the protocol to proto.RuleProtocol.
+func getProtoProtocol(protocol string) proto.RuleProtocol {
+	switch types.PolicyRuleProtocolType(protocol) {
+	case types.PolicyRuleProtocolALL:
+		return proto.RuleProtocol_ALL
+	case types.PolicyRuleProtocolTCP:
+		return proto.RuleProtocol_TCP
+	case types.PolicyRuleProtocolUDP:
+		return proto.RuleProtocol_UDP
+	case types.PolicyRuleProtocolICMP:
+		return proto.RuleProtocol_ICMP
+	default:
+		return proto.RuleProtocol_UNKNOWN
+	}
+}
+
+// getProtoPortInfo converts the port info to proto.PortInfo.
+func getProtoPortInfo(rule *types.RouteFirewallRule) *proto.PortInfo {
+	var portInfo proto.PortInfo
+	if rule.Port != 0 {
+		portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(rule.Port)}
+	} else if portRange := rule.PortRange; portRange.Start != 0 && portRange.End != 0 {
+		portInfo.PortSelection = &proto.PortInfo_Range_{
+			Range: &proto.PortInfo_Range{
+				Start: uint32(portRange.Start),
+				End:   uint32(portRange.End),
+			},
+		}
+	}
+	return &portInfo
+}
+
+func shouldUsePortRange(rule *proto.FirewallRule) bool {
+	return rule.Port == "" && (rule.Protocol == proto.RuleProtocol_UDP || rule.Protocol == proto.RuleProtocol_TCP)
+}
+
+// Helper function to convert nbdns.CustomZone to proto.CustomZone
+func convertToProtoCustomZone(zone nbdns.CustomZone) *proto.CustomZone {
+	protoZone := &proto.CustomZone{
+		Domain:               zone.Domain,
+		Records:              make([]*proto.SimpleRecord, 0, len(zone.Records)),
+		SearchDomainDisabled: zone.SearchDomainDisabled,
+		NonAuthoritative:     zone.NonAuthoritative,
+	}
+	for _, record := range zone.Records {
+		protoZone.Records = append(protoZone.Records, &proto.SimpleRecord{
+			Name:  record.Name,
+			Type:  int64(record.Type),
+			Class: record.Class,
+			TTL:   int64(record.TTL),
+			RData: record.RData,
+		})
+	}
+	return protoZone
+}
+
+// Helper function to convert nbdns.NameServerGroup to proto.NameServerGroup
+func convertToProtoNameServerGroup(nsGroup *nbdns.NameServerGroup) *proto.NameServerGroup {
+	protoGroup := &proto.NameServerGroup{
+		Primary:              nsGroup.Primary,
+		Domains:              nsGroup.Domains,
+		SearchDomainsEnabled: nsGroup.SearchDomainsEnabled,
+		NameServers:          make([]*proto.NameServer, 0, len(nsGroup.NameServers)),
+	}
+	for _, ns := range nsGroup.NameServers {
+		protoGroup.NameServers = append(protoGroup.NameServers, &proto.NameServer{
+			IP:     ns.IP.String(),
+			Port:   int64(ns.Port),
+			NSType: int64(ns.NSType),
+		})
+	}
+	return protoGroup
+}
+
 // buildJWTConfig constructs JWT configuration for SSH servers from management server config
 func buildJWTConfig(config *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow) *proto.JWTConfig {
 	if config == nil || config.AuthAudience == "" {

management/internals/shared/grpc/conversion_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
 )
 
 func TestToProtocolDNSConfigWithCache(t *testing.T) {
@@ -65,13 +64,13 @@ func TestToProtocolDNSConfigWithCache(t *testing.T) {
 	}
 
 	// First run with config1
-	result1 := networkmap.ToProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
+	result1 := toProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
 
 	// Second run with config2
-	result2 := networkmap.ToProtocolDNSConfig(config2, &cache, int64(network_map.DnsForwarderPort))
+	result2 := toProtocolDNSConfig(config2, &cache, int64(network_map.DnsForwarderPort))
 
 	// Third run with config1 again
-	result3 := networkmap.ToProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
+	result3 := toProtocolDNSConfig(config1, &cache, int64(network_map.DnsForwarderPort))
 
 	// Verify that result1 and result3 are identical
 	if !reflect.DeepEqual(result1, result3) {
@@ -103,14 +102,15 @@ func BenchmarkToProtocolDNSConfig(b *testing.B) {
 
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				networkmap.ToProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
+				toProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
 			}
 		})
 
 		b.Run(fmt.Sprintf("WithoutCache-Size%d", size), func(b *testing.B) {
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				networkmap.ToProtocolDNSConfig(testData, nil, int64(network_map.DnsForwarderPort))
+				cache := &cache.DNSConfigCache{}
+				toProtocolDNSConfig(testData, cache, int64(network_map.DnsForwarderPort))
 			}
 		})
 	}

management/internals/shared/grpc/server.go

@@ -25,7 +25,6 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/shared/management/client/common"
-	"github.com/netbirdio/netbird/shared/management/grpc"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -246,7 +245,6 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	realIP := getRealIP(ctx)
 	sRealIP := realIP.String()
 	peerMeta := extractPeerMeta(ctx, syncReq.GetMeta())
-
 	userID, err := s.accountManager.GetUserIDByPeerKey(ctx, peerKey.String())
 	if err != nil {
 		s.syncSem.Add(-1)
@@ -685,9 +683,8 @@ func extractPeerMeta(ctx context.Context, meta *proto.PeerSystemMeta) nbpeer.Pee
 			LazyConnectionEnabled: meta.GetFlags().GetLazyConnectionEnabled(),
 			DisableIPv6:           meta.GetFlags().GetDisableIPv6(),
 		},
-		Files:              files,
-		Capabilities:       capabilitiesToInt32(meta.GetCapabilities()),
-		SyncMessageVersion: int(meta.GetSyncMessageVersion()),
+		Files:        files,
+		Capabilities: capabilitiesToInt32(meta.GetCapabilities()),
 	}
 }
 
@@ -1019,43 +1016,7 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		return status.Errorf(codes.Internal, "failed to get peer groups %s", err)
 	}
 
-	dnsName := s.networkMapController.GetDNSDomain(settings)
-
-	var plainResp *proto.SyncResponse
-
-	commonSyncMessageVersion := grpc.HighestCommonSyncMessageVersion(
-		s.perAccountOrGlobalSyncMessageVersions(peer.AccountID),
-		grpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion))
-
-	log.WithContext(ctx).
-		WithFields(log.Fields{
-			"sync_message_version":        commonSyncMessageVersion,
-			"server_sync_message_version": s.perAccountOrGlobalSyncMessageVersions(peer.AccountID),
-			"peer_sync_message_version":   grpc.SyncMessageVersionFromConfig(&peer.Meta.SyncMessageVersion),
-		}).Debug("common highest sync message version")
-
-	if commonSyncMessageVersion == grpc.ComponentNetworkMap {
-		// Capable peer: discard the legacy NetworkMap that SyncAndMarkPeer
-		// computed and recompute the raw components instead. This wastes one
-		// Calculate() call per initial-sync — the component-based wire
-		// format is what the peer actually consumes. The streaming path
-		// (network_map.Controller.UpdateAccountPeers) skips this duplication
-		// because it dispatches by capability before computing.
-		//
-		// TODO: refactor SyncPeer / SyncAndMarkPeer / their mocks + manager
-		// interfaces to return PeerNetworkMapResult so the initial-sync path
-		// stops doing duplicate work. Deferred until the client-side
-		// decoder lands and there's a real deployment of capability=3 peers
-		// worth optimizing for.
-		freshPeer, components, proxyPatch, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
-		if err != nil {
-			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)
-			return status.Errorf(codes.Internal, "failed to build initial sync envelope")
-		}
-		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, freshPeer, turnToken, relayToken, components, proxyPatch, dnsName, freshPostureChecks, settings, settings.Extra, peerGroups, freshDnsFwdPort)
-	} else {
-		plainResp = ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, peer, turnToken, relayToken, networkMap, dnsName, postureChecks, nil, settings, settings.Extra, peerGroups, dnsFwdPort)
-	}
+	plainResp := ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, peer, turnToken, relayToken, networkMap, s.networkMapController.GetDNSDomain(settings), postureChecks, nil, settings, settings.Extra, peerGroups, dnsFwdPort)
 
 	key, err := s.secretsManager.GetWGKey()
 	if err != nil {
@@ -1080,13 +1041,6 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 	return nil
 }
 
-func (s *Server) perAccountOrGlobalSyncMessageVersions(accountId string) grpc.SyncMessageVersion {
-	if version, ok := s.config.PerAccountHighestSupportedSyncMessageVersion[accountId]; ok {
-		return grpc.SyncMessageVersionFromConfig(&version)
-	}
-	return grpc.SyncMessageVersionFromConfig(s.config.HighestSupportedSyncMessageVersion)
-}
-
 // GetDeviceAuthorizationFlow returns a device authorization flow information
 // This is used for initiating an Oauth 2 device authorization grant flow
 // which will be used by our clients to Login

management/server/account.go

@@ -1648,10 +1648,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			return nil
 		}
 
-		for _, g := range newGroupsToCreate {
-			g.PublicID = xid.New().String()
-		}
-
 		if err = transaction.CreateGroups(ctx, userAuth.AccountId, newGroupsToCreate); err != nil {
 			return fmt.Errorf("error saving groups: %w", err)
 		}

management/server/account_test.go

@@ -3170,16 +3170,6 @@ func TestAccount_SetJWTGroups(t *testing.T) {
 		user, err := manager.Store.GetUserByUserID(context.Background(), store.LockingStrengthNone, "user2")
 		assert.NoError(t, err, "unable to get user")
 		assert.Len(t, user.AutoGroups, 1, "new group should be added")
-
-		var newJWTGroup *types.Group
-		for _, g := range groups {
-			if g.Name == "group3" {
-				newJWTGroup = g
-				break
-			}
-		}
-		require.NotNil(t, newJWTGroup, "JIT-created JWT group not found")
-		assert.NotEqual(t, "", newJWTGroup.PublicID, "JIT-created JWT group must have a non-empty PublicID")
 	})
 
 	t.Run("remove all JWT groups when list is empty", func(t *testing.T) {

management/server/group.go

@@ -93,8 +93,6 @@ func (am *DefaultAccountManager) CreateGroup(ctx context.Context, accountID, use
 		events := am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
 		eventsToStore = append(eventsToStore, events...)
 
-		newGroup.PublicID = xid.New().String()
-
 		if err := transaction.CreateGroup(ctx, newGroup); err != nil {
 			return status.Errorf(status.Internal, "failed to create group: %v", err)
 		}
@@ -160,8 +158,6 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 			return err
 		}
 
-		newGroup.PublicID = oldGroup.PublicID
-
 		if err = transaction.UpdateGroup(ctx, newGroup); err != nil {
 			return err
 		}
@@ -239,7 +235,6 @@ func (am *DefaultAccountManager) CreateGroups(ctx context.Context, accountID, us
 			}
 
 			newGroup.AccountID = accountID
-			newGroup.PublicID = xid.New().String()
 
 			if err = transaction.CreateGroup(ctx, newGroup); err != nil {
 				return err
@@ -332,12 +327,6 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 
 		newGroup.AccountID = accountID
 
-		oldGroup, err := transaction.GetGroupByID(ctx, store.LockingStrengthNone, accountID, newGroup.ID)
-		if err != nil {
-			return err
-		}
-		newGroup.PublicID = oldGroup.PublicID
-
 		if err := transaction.UpdateGroup(ctx, newGroup); err != nil {
 			return err
 		}
@@ -352,6 +341,7 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 
 		events = am.prepareGroupEvents(ctx, transaction, accountID, userID, newGroup)
 
+		var err error
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})

management/server/migration/migration.go

@@ -13,7 +13,6 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
@@ -636,50 +635,3 @@ func RemoveDuplicatePeerKeys(ctx context.Context, db *gorm.DB) error {
 
 	return nil
 }
-
-func BackfillPublicIDs[T any](ctx context.Context, db *gorm.DB) error {
-	var model T
-
-	if !db.Migrator().HasTable(&model) {
-		log.WithContext(ctx).Debugf("Table for %T does not exist, no backfill needed", model)
-		return nil
-	}
-
-	stmt := &gorm.Statement{DB: db}
-	err := stmt.Parse(&model)
-	if err != nil {
-		return fmt.Errorf("parse model: %w", err)
-	}
-	tableName := stmt.Schema.Table
-
-	if err := db.Transaction(func(tx *gorm.DB) error {
-		if !tx.Migrator().HasColumn(&model, "public_id") {
-			log.WithContext(ctx).Infof("Column public_id does not exist in table %s, adding it", tableName)
-			if err := tx.Migrator().AddColumn(&model, "public_id"); err != nil {
-				return fmt.Errorf("add column public_id: %w", err)
-			}
-		}
-
-		var rows []map[string]any
-		if err := tx.Table(tableName).Select("id", "public_id").Where("public_id IS NULL").Or("public_id = ''").Find(&rows).Error; err != nil {
-			return fmt.Errorf("failed to find rows with empty public_id: %w", err)
-		}
-
-		if len(rows) == 0 {
-			log.WithContext(ctx).Infof("No rows with empty public_id found in table %s, no migration needed", tableName)
-			return nil
-		}
-
-		for _, row := range rows {
-			if err := tx.Table(tableName).Where("id = ?", row["id"]).Update("public_id", xid.New().String()).Error; err != nil {
-				return fmt.Errorf("failed to update row with id %v: %w", row["id"], err)
-			}
-		}
-		return nil
-	}); err != nil {
-		return err
-	}
-
-	log.WithContext(ctx).Infof("Backfill of empty public_id in table %s completed", tableName)
-	return nil
-}

management/server/nameserver.go

@@ -67,8 +67,6 @@ func (am *DefaultAccountManager) CreateNameServerGroup(ctx context.Context, acco
 			return err
 		}
 
-		newNSGroup.PublicID = xid.New().String()
-
 		if err = transaction.SaveNameServerGroup(ctx, newNSGroup); err != nil {
 			return err
 		}
@@ -118,8 +116,6 @@ func (am *DefaultAccountManager) SaveNameServerGroup(ctx context.Context, accoun
 			return err
 		}
 
-		nsGroupToSave.PublicID = oldNSGroup.PublicID
-
 		if err = transaction.SaveNameServerGroup(ctx, nsGroupToSave); err != nil {
 			return err
 		}

management/server/networks/manager.go

@@ -71,16 +71,9 @@ func (m *managerImpl) CreateNetwork(ctx context.Context, userID string, network
 
 	network.ID = xid.New().String()
 
-	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		network.PublicID = xid.New().String()
-
-		if err := transaction.SaveNetwork(ctx, network); err != nil {
-			return fmt.Errorf("failed to save network: %w", err)
-		}
-		return nil
-	})
+	err = m.store.SaveNetwork(ctx, network)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to save network: %w", err)
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, network.ID, network.AccountID, activity.NetworkCreated, network.EventMeta())
@@ -109,25 +102,14 @@ func (m *managerImpl) UpdateNetwork(ctx context.Context, userID string, network
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		existing, err := transaction.GetNetworkByID(ctx, store.LockingStrengthUpdate, network.AccountID, network.ID)
-		if err != nil {
-			return fmt.Errorf("failed to get network: %w", err)
-		}
-		network.PublicID = existing.PublicID
-
-		if err := transaction.SaveNetwork(ctx, network); err != nil {
-			return fmt.Errorf("failed to save network: %w", err)
-		}
-		return nil
-	})
+	_, err = m.store.GetNetworkByID(ctx, store.LockingStrengthUpdate, network.AccountID, network.ID)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to get network: %w", err)
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, network.ID, network.AccountID, activity.NetworkUpdated, network.EventMeta())
 
-	return network, nil
+	return network, m.store.SaveNetwork(ctx, network)
 }
 
 func (m *managerImpl) DeleteNetwork(ctx context.Context, accountID, userID, networkID string) error {

management/server/networks/manager_test.go

@@ -255,73 +255,3 @@ func Test_UpdateNetworkFailsWithPermissionDenied(t *testing.T) {
 	require.Error(t, err)
 	require.Nil(t, updatedNetwork)
 }
-
-// Test_CreateNetworkAllocatesSeqID verifies that CreateNetwork sets a
-// non-zero AccountSeqID on the persisted network (allocated through the
-// account_seq_counters table).
-func Test_CreateNetworkSetsPublicId(t *testing.T) {
-	ctx := context.Background()
-	const accountID = "testAccountId"
-	const userID = "testAdminId"
-
-	s, cleanUp, err := store.NewTestStoreFromSQL(ctx, "../testdata/networks.sql", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanUp)
-
-	am := mock_server.MockAccountManager{}
-	permissionsManager := permissions.NewManager(s)
-	groupsManager := groups.NewManagerMock()
-	routerManager := routers.NewManagerMock()
-	resourcesManager := resources.NewManager(s, permissionsManager, groupsManager, &am, nil)
-	manager := NewManager(s, permissionsManager, resourcesManager, routerManager, &am)
-
-	created, err := manager.CreateNetwork(ctx, userID, &types.Network{
-		AccountID: accountID,
-		Name:      "seq-allocation-test",
-	})
-	require.NoError(t, err)
-	require.NotEqual(t, "", created.PublicID, "CreateNetwork must allocate a non-zero AccountSeqID")
-}
-
-// Test_UpdateNetworkPreservesSeqID verifies UpdateNetwork does not reset
-// AccountSeqID even when the caller passes a zero value (the shape REST
-// handlers produce because the field is `json:"-"`).
-func Test_UpdateNetworkPreservesPublicId(t *testing.T) {
-	ctx := context.Background()
-	const accountID = "testAccountId"
-	const userID = "testAdminId"
-
-	s, cleanUp, err := store.NewTestStoreFromSQL(ctx, "../testdata/networks.sql", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanUp)
-
-	am := mock_server.MockAccountManager{}
-	permissionsManager := permissions.NewManager(s)
-	groupsManager := groups.NewManagerMock()
-	routerManager := routers.NewManagerMock()
-	resourcesManager := resources.NewManager(s, permissionsManager, groupsManager, &am, nil)
-	manager := NewManager(s, permissionsManager, resourcesManager, routerManager, &am)
-
-	created, err := manager.CreateNetwork(ctx, userID, &types.Network{
-		AccountID: accountID,
-		Name:      "seq-preserve-original",
-	})
-	require.NoError(t, err)
-	originalPublicId := created.PublicID
-	require.NotZero(t, originalPublicId)
-
-	update := &types.Network{
-		AccountID: accountID,
-		ID:        created.ID,
-		Name:      "seq-preserve-renamed",
-	}
-	require.Equal(t, "", update.PublicID, "incoming struct must mirror an HTTP handler shape")
-
-	_, err = manager.UpdateNetwork(ctx, userID, update)
-	require.NoError(t, err)
-
-	got, err := manager.GetNetwork(ctx, accountID, userID, created.ID)
-	require.NoError(t, err)
-	require.Equal(t, originalPublicId, got.PublicID, "PublicID must survive UpdateNetwork")
-	require.Equal(t, "seq-preserve-renamed", got.Name)
-}

management/server/networks/resources/manager.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -147,8 +146,6 @@ func (m *managerImpl) createResourceInTransaction(ctx context.Context, transacti
 		return nil, nil, fmt.Errorf("failed to get network: %w", err)
 	}
 
-	resource.PublicID = xid.New().String()
-
 	if err = transaction.SaveNetworkResource(ctx, resource); err != nil {
 		return nil, nil, fmt.Errorf("failed to save network resource: %w", err)
 	}
@@ -248,7 +245,6 @@ func (m *managerImpl) UpdateResource(ctx context.Context, userID string, resourc
 		if err != nil {
 			return fmt.Errorf("failed to get network resource: %w", err)
 		}
-		resource.PublicID = oldResource.PublicID
 
 		oldGroups, err := m.groupsManager.GetResourceGroupsInTransaction(ctx, transaction, store.LockingStrengthNone, resource.AccountID, resource.ID)
 		if err != nil {

management/server/networks/resources/types/resource.go

@@ -32,7 +32,6 @@ type NetworkResource struct {
 	ID          string `gorm:"primaryKey"`
 	NetworkID   string `gorm:"index"`
 	AccountID   string `gorm:"index"`
-	PublicID    string `json:"-"`
 	Name        string
 	Description string
 	Type        NetworkResourceType
@@ -97,7 +96,6 @@ func (n *NetworkResource) Copy() *NetworkResource {
 		ID:          n.ID,
 		AccountID:   n.AccountID,
 		NetworkID:   n.NetworkID,
-		PublicID:    n.PublicID,
 		Name:        n.Name,
 		Description: n.Description,
 		Type:        n.Type,

management/server/networks/routers/manager.go

@@ -104,8 +104,6 @@ func (m *managerImpl) CreateRouter(ctx context.Context, userID string, router *t
 
 		router.ID = xid.New().String()
 
-		router.PublicID = xid.New().String()
-
 		err = transaction.CreateNetworkRouter(ctx, router)
 		if err != nil {
 			return fmt.Errorf("failed to create network router: %w", err)
@@ -201,11 +199,6 @@ func (m *managerImpl) updateRouterInTransaction(ctx context.Context, transaction
 		return nil, nil, affectedpeers.Change{}, status.NewRouterNotPartOfNetworkError(router.ID, router.NetworkID)
 	}
 
-	// Preserve PublicID from the existing router so the upstream
-	// UpdateNetworkRouter (which does Updates(router) with Select("*"))
-	// doesn't clobber it with the request's zero value.
-	router.PublicID = existing.PublicID
-
 	if err = transaction.UpdateNetworkRouter(ctx, router); err != nil {
 		return nil, nil, affectedpeers.Change{}, fmt.Errorf("failed to update network router: %w", err)
 	}

management/server/networks/routers/types/router.go

@@ -13,7 +13,6 @@ type NetworkRouter struct {
 	ID         string `gorm:"primaryKey"`
 	NetworkID  string `gorm:"index"`
 	AccountID  string `gorm:"index"`
-	PublicID   string `json:"-"`
 	Peer       string
 	PeerGroups []string `gorm:"serializer:json"`
 	Masquerade bool
@@ -82,7 +81,6 @@ func (n *NetworkRouter) Copy() *NetworkRouter {
 		ID:         n.ID,
 		NetworkID:  n.NetworkID,
 		AccountID:  n.AccountID,
-		PublicID:   n.PublicID,
 		Peer:       n.Peer,
 		PeerGroups: n.PeerGroups,
 		Masquerade: n.Masquerade,

management/server/networks/types/network.go

@@ -7,11 +7,8 @@ import (
 )
 
 type Network struct {
-	ID        string `gorm:"primaryKey"`
-	AccountID string `gorm:"index"`
-
-	PublicID string `json:"-"`
-
+	ID          string `gorm:"primaryKey"`
+	AccountID   string `gorm:"index"`
 	Name        string
 	Description string
 }
@@ -44,12 +41,11 @@ func (n *Network) FromAPIRequest(req *api.NetworkRequest) {
 	}
 }
 
-// Copy returns a copy of a network.
+// Copy returns a copy of a posture checks.
 func (n *Network) Copy() *Network {
 	return &Network{
 		ID:          n.ID,
 		AccountID:   n.AccountID,
-		PublicID:    n.PublicID,
 		Name:        n.Name,
 		Description: n.Description,
 	}

management/server/peer/peer.go

@@ -17,9 +17,8 @@ import (
 
 // Peer capability constants mirror the proto enum values.
 const (
-	PeerCapabilitySourcePrefixes      int32 = 1
-	PeerCapabilityIPv6Overlay         int32 = 2
-	PeerCapabilityComponentNetworkMap int32 = 3
+	PeerCapabilitySourcePrefixes int32 = 1
+	PeerCapabilityIPv6Overlay    int32 = 2
 )
 
 // Peer represents a machine connected to the network.
@@ -173,7 +172,6 @@ type PeerSystemMeta struct { //nolint:revive
 	Flags              Flags       `gorm:"serializer:json"`
 	Files              []File      `gorm:"serializer:json"`
 	Capabilities       []int32     `gorm:"serializer:json"`
-	SyncMessageVersion int
 }
 
 func (p PeerSystemMeta) isEqual(other PeerSystemMeta) bool {
@@ -220,14 +218,6 @@ func (p *Peer) SupportsSourcePrefixes() bool {
 	return p.HasCapability(PeerCapabilitySourcePrefixes)
 }
 
-// SupportsComponentNetworkMap reports whether the peer assembles its
-// NetworkMap from server-shipped components instead of consuming a fully
-// expanded NetworkMap. Determines whether the network_map controller skips
-// Calculate() server-side and emits the components envelope.
-func (p *Peer) SupportsComponentNetworkMap() bool {
-	return p.HasCapability(PeerCapabilityComponentNetworkMap)
-}
-
 func capabilitiesEqual(a, b []int32) bool {
 	if len(a) != len(b) {
 		return false
@@ -416,9 +406,6 @@ func diffMeta(oldMeta, newMeta PeerSystemMeta, oldLocation, newLocation Location
 	if !sameMultiset(oldMeta.Files, newMeta.Files) {
 		add("files", fmt.Sprintf("%v", oldMeta.Files), fmt.Sprintf("%v", newMeta.Files))
 	}
-	if oldMeta.SyncMessageVersion != newMeta.SyncMessageVersion {
-		add("sync_meta_version", fmt.Sprintf("%d", oldMeta.SyncMessageVersion), fmt.Sprintf("%d", newMeta.SyncMessageVersion))
-	}
 
 	if !oldLocation.equal(newLocation) {
 		add("connection_ip", oldLocation.ConnectionIP, newLocation.ConnectionIP)

management/server/policy.go

@@ -67,13 +67,10 @@ func (am *DefaultAccountManager) SavePolicy(ctx context.Context, accountID, user
 
 			action = activity.PolicyUpdated
 
-			policy.PublicID = existingPolicy.PublicID
-
 			if err = transaction.SavePolicy(ctx, policy); err != nil {
 				return err
 			}
 		} else {
-			policy.PublicID = xid.New().String()
 			if err = transaction.CreatePolicy(ctx, policy); err != nil {
 				return err
 			}

management/server/posture/checks.go

@@ -49,8 +49,6 @@ type Checks struct {
 	// AccountID is a reference to the Account that this object belongs
 	AccountID string `json:"-" gorm:"index"`
 
-	PublicID string `json:"-"`
-
 	// Checks is a set of objects that perform the actual checks
 	Checks ChecksDefinition `gorm:"serializer:json"`
 }
@@ -169,7 +167,6 @@ func (pc *Checks) Copy() *Checks {
 		Name:        pc.Name,
 		Description: pc.Description,
 		AccountID:   pc.AccountID,
-		PublicID:    pc.PublicID,
 		Checks:      pc.Checks.Copy(),
 	}
 	return checks

management/server/posture_checks.go

@@ -52,15 +52,7 @@ func (am *DefaultAccountManager) SavePostureChecks(ctx context.Context, accountI
 		}
 
 		if isUpdate {
-			existing, err := transaction.GetPostureChecksByID(ctx, store.LockingStrengthNone, accountID, postureChecks.ID)
-			if err != nil {
-				return err
-			}
-			postureChecks.PublicID = existing.PublicID
-
 			action = activity.PostureCheckUpdated
-		} else {
-			postureChecks.PublicID = xid.New().String()
 		}
 
 		postureChecks.AccountID = accountID

management/server/posture_checks_test.go

@@ -563,61 +563,3 @@ func TestArePostureCheckChangesAffectPeers(t *testing.T) {
 		assert.Empty(t, directPeerIDs)
 	})
 }
-
-// TestSavePostureChecks_AllocatesSeqIDOnCreate verifies that the create path
-// (no incoming ID) allocates a non-zero AccountSeqID via the
-// account_seq_counters table.
-func TestSavePostureChecks_AllocatesSeqIDOnCreate(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err)
-
-	account, err := initTestPostureChecksAccount(am)
-	require.NoError(t, err)
-
-	created, err := am.SavePostureChecks(context.Background(), account.Id, adminUserID, &posture.Checks{
-		Name: "seq-allocation-test",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.26.0"},
-		},
-	}, true)
-	require.NoError(t, err)
-	require.NotEqual(t, "", created.PublicID, "SavePostureChecks on create must create PublicID")
-}
-
-// TestSavePostureChecks_PreservesSeqIDOnUpdate verifies the update path does
-// not reset AccountSeqID even when the caller passes a zero value (REST
-// handler shape, because the field is `json:"-"`).
-func TestSavePostureChecks_PreservesSeqIDOnUpdate(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err)
-
-	account, err := initTestPostureChecksAccount(am)
-	require.NoError(t, err)
-
-	created, err := am.SavePostureChecks(context.Background(), account.Id, adminUserID, &posture.Checks{
-		Name: "seq-preserve-original",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.26.0"},
-		},
-	}, true)
-	require.NoError(t, err)
-	originalPublicID := created.PublicID
-	require.NotEqual(t, "", originalPublicID)
-
-	update := &posture.Checks{
-		ID:   created.ID,
-		Name: "seq-preserve-renamed",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.27.0"},
-		},
-	}
-	require.Equal(t, "", update.PublicID, "incoming struct must mirror an HTTP handler shape")
-
-	_, err = am.SavePostureChecks(context.Background(), account.Id, adminUserID, update, false)
-	require.NoError(t, err)
-
-	got, err := am.GetPostureChecks(context.Background(), account.Id, created.ID, adminUserID)
-	require.NoError(t, err)
-	require.Equal(t, originalPublicID, got.PublicID, "PublicID must survive SavePostureChecks update")
-	require.Equal(t, "seq-preserve-renamed", got.Name)
-}

management/server/route.go

@@ -175,8 +175,6 @@ func (am *DefaultAccountManager) CreateRoute(ctx context.Context, accountID stri
 			return err
 		}
 
-		newRoute.PublicID = xid.New().String()
-
 		if err = transaction.SaveRoute(ctx, newRoute); err != nil {
 			return err
 		}
@@ -224,7 +222,6 @@ func (am *DefaultAccountManager) SaveRoute(ctx context.Context, accountID, userI
 		}
 
 		routeToSave.AccountID = accountID
-		routeToSave.PublicID = oldRoute.PublicID
 
 		if err = transaction.SaveRoute(ctx, routeToSave); err != nil {
 			return err

management/server/store/sql_store.go

@@ -642,22 +642,6 @@ func (s *SqlStore) SaveUser(ctx context.Context, user *types.User) error {
 }
 
 // CreateGroups creates the given list of groups to the database.
-// groupUpsertColumns is the explicit allowlist of columns that get updated when
-// CreateGroups / UpdateGroups hit a PK conflict. public_id is intentionally
-// omitted so a caller passing an entity with the zero value (e.g. an HTTP
-// handler-built struct) cannot reset the persisted public_id during an upsert.
-// Keep this in sync with the Group schema in management/server/types/group.go.
-func groupUpsertColumns() clause.Set {
-	return clause.AssignmentColumns([]string{
-		"account_id",
-		"name",
-		"issued",
-		"integration_ref_id",
-		"integration_ref_integration_type",
-		"resources",
-	})
-}
-
 func (s *SqlStore) CreateGroups(ctx context.Context, accountID string, groups []*types.Group) error {
 	if len(groups) == 0 {
 		return nil
@@ -667,9 +651,8 @@ func (s *SqlStore) CreateGroups(ctx context.Context, accountID string, groups []
 		result := tx.
 			Clauses(
 				clause.OnConflict{
-					Columns:   []clause.Column{{Name: "id"}},
 					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
-					DoUpdates: groupUpsertColumns(),
+					UpdateAll: true,
 				},
 			).
 			Omit(clause.Associations).
@@ -693,9 +676,8 @@ func (s *SqlStore) UpdateGroups(ctx context.Context, accountID string, groups []
 		result := tx.
 			Clauses(
 				clause.OnConflict{
-					Columns:   []clause.Column{{Name: "id"}},
 					Where:     clause.Where{Exprs: []clause.Expression{clause.Eq{Column: "groups.account_id", Value: accountID}}},
-					DoUpdates: groupUpsertColumns(),
+					UpdateAll: true,
 				},
 			).
 			Omit(clause.Associations).
@@ -1869,7 +1851,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 	meta_kernel_version, meta_network_addresses, meta_system_serial_number, meta_system_product_name, meta_system_manufacturer,
 	meta_environment, meta_flags, meta_files, meta_capabilities, peer_status_last_seen, peer_status_session_started_at,
 	peer_status_connected, peer_status_login_expired, peer_status_requires_approval, location_connection_ip,
-	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6, meta_sync_message_version
+	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6
 	FROM peers WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
@@ -1891,7 +1873,6 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			metaSystemSerialNumber, metaSystemProductName, metaSystemManufacturer                           sql.NullString
 			locationCountryCode, locationCityName, proxyCluster                                             sql.NullString
 			locationGeoNameID                                                                               sql.NullInt64
-			metaSyncMessageVersion                                                                          sql.NullInt32
 		)
 
 		err := row.Scan(&p.ID, &p.AccountID, &p.Key, &ip, &p.Name, &p.DNSLabel, &p.UserID, &p.SSHKey, &sshEnabled,
@@ -1901,7 +1882,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			&metaSystemSerialNumber, &metaSystemProductName, &metaSystemManufacturer, &env, &flags, &files, &capabilities,
 			&peerStatusLastSeen, &peerStatusSessionStartedAt, &peerStatusConnected, &peerStatusLoginExpired,
 			&peerStatusRequiresApproval, &connIP, &locationCountryCode, &locationCityName, &locationGeoNameID,
-			&proxyEmbedded, &proxyCluster, &ipv6, &metaSyncMessageVersion)
+			&proxyEmbedded, &proxyCluster, &ipv6)
 
 		if err == nil {
 			if lastLogin.Valid {
@@ -2021,9 +2002,6 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 			if connIP != nil {
 				_ = json.Unmarshal(connIP, &p.Location.ConnectionIP)
 			}
-			if metaSyncMessageVersion.Valid {
-				p.Meta.SyncMessageVersion = int(metaSyncMessageVersion.Int32)
-			}
 		}
 		return p, err
 	})
@@ -2079,7 +2057,7 @@ func (s *SqlStore) getUsers(ctx context.Context, accountID string) ([]types.User
 }
 
 func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Group, error) {
-	const query = `SELECT id, account_id, public_id, name, issued, resources, integration_ref_id, integration_ref_integration_type FROM groups WHERE account_id = $1`
+	const query = `SELECT id, account_id, name, issued, resources, integration_ref_id, integration_ref_integration_type FROM groups WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2089,7 +2067,7 @@ func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Gr
 		var resources []byte
 		var refID sql.NullInt64
 		var refType sql.NullString
-		err := row.Scan(&g.ID, &g.AccountID, &g.PublicID, &g.Name, &g.Issued, &resources, &refID, &refType)
+		err := row.Scan(&g.ID, &g.AccountID, &g.Name, &g.Issued, &resources, &refID, &refType)
 		if err == nil {
 			if refID.Valid {
 				g.IntegrationReference.ID = int(refID.Int64)
@@ -2114,7 +2092,7 @@ func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Gr
 }
 
 func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.Policy, error) {
-	const query = `SELECT id, account_id, public_id, name, description, enabled, source_posture_checks FROM policies WHERE account_id = $1`
+	const query = `SELECT id, account_id, name, description, enabled, source_posture_checks FROM policies WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2123,7 +2101,7 @@ func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.
 		var p types.Policy
 		var checks []byte
 		var enabled sql.NullBool
-		err := row.Scan(&p.ID, &p.AccountID, &p.PublicID, &p.Name, &p.Description, &enabled, &checks)
+		err := row.Scan(&p.ID, &p.AccountID, &p.Name, &p.Description, &enabled, &checks)
 		if err == nil {
 			if enabled.Valid {
 				p.Enabled = enabled.Bool
@@ -2141,7 +2119,7 @@ func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.
 }
 
 func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Route, error) {
-	const query = `SELECT id, account_id, public_id, network, domains, keep_route, net_id, description, peer, peer_groups, network_type, masquerade, metric, enabled, groups, access_control_groups, skip_auto_apply FROM routes WHERE account_id = $1`
+	const query = `SELECT id, account_id, network, domains, keep_route, net_id, description, peer, peer_groups, network_type, masquerade, metric, enabled, groups, access_control_groups, skip_auto_apply FROM routes WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2151,7 +2129,7 @@ func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Rou
 		var network, domains, peerGroups, groups, accessGroups []byte
 		var keepRoute, masquerade, enabled, skipAutoApply sql.NullBool
 		var metric sql.NullInt64
-		err := row.Scan(&r.ID, &r.AccountID, &r.PublicID, &network, &domains, &keepRoute, &r.NetID, &r.Description, &r.Peer, &peerGroups, &r.NetworkType, &masquerade, &metric, &enabled, &groups, &accessGroups, &skipAutoApply)
+		err := row.Scan(&r.ID, &r.AccountID, &network, &domains, &keepRoute, &r.NetID, &r.Description, &r.Peer, &peerGroups, &r.NetworkType, &masquerade, &metric, &enabled, &groups, &accessGroups, &skipAutoApply)
 		if err == nil {
 			if keepRoute.Valid {
 				r.KeepRoute = keepRoute.Bool
@@ -2193,7 +2171,7 @@ func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Rou
 }
 
 func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([]nbdns.NameServerGroup, error) {
-	const query = `SELECT id, account_id, public_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled FROM name_server_groups WHERE account_id = $1`
+	const query = `SELECT id, account_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled FROM name_server_groups WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2202,7 +2180,7 @@ func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([
 		var n nbdns.NameServerGroup
 		var ns, groups, domains []byte
 		var primary, enabled, searchDomainsEnabled sql.NullBool
-		err := row.Scan(&n.ID, &n.AccountID, &n.PublicID, &n.Name, &n.Description, &ns, &groups, &primary, &domains, &enabled, &searchDomainsEnabled)
+		err := row.Scan(&n.ID, &n.AccountID, &n.Name, &n.Description, &ns, &groups, &primary, &domains, &enabled, &searchDomainsEnabled)
 		if err == nil {
 			if primary.Valid {
 				n.Primary = primary.Bool
@@ -2238,7 +2216,7 @@ func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([
 }
 
 func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*posture.Checks, error) {
-	const query = `SELECT id, account_id, public_id, name, description, checks FROM posture_checks WHERE account_id = $1`
+	const query = `SELECT id, account_id, name, description, checks FROM posture_checks WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2246,7 +2224,7 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 	checks, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (*posture.Checks, error) {
 		var c posture.Checks
 		var checksDef []byte
-		err := row.Scan(&c.ID, &c.AccountID, &c.PublicID, &c.Name, &c.Description, &checksDef)
+		err := row.Scan(&c.ID, &c.AccountID, &c.Name, &c.Description, &checksDef)
 		if err == nil && checksDef != nil {
 			_ = json.Unmarshal(checksDef, &c.Checks)
 		}
@@ -2426,7 +2404,7 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 }
 
 func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
-	const query = `SELECT id, account_id, public_id, name, description FROM networks WHERE account_id = $1`
+	const query = `SELECT id, account_id, name, description FROM networks WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2443,7 +2421,7 @@ func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networ
 }
 
 func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*routerTypes.NetworkRouter, error) {
-	const query = `SELECT id, network_id, account_id, public_id, peer, peer_groups, masquerade, metric, enabled FROM network_routers WHERE account_id = $1`
+	const query = `SELECT id, network_id, account_id, peer, peer_groups, masquerade, metric, enabled FROM network_routers WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2453,7 +2431,7 @@ func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*
 		var peerGroups []byte
 		var masquerade, enabled sql.NullBool
 		var metric sql.NullInt64
-		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.PublicID, &r.Peer, &peerGroups, &masquerade, &metric, &enabled)
+		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.Peer, &peerGroups, &masquerade, &metric, &enabled)
 		if err == nil {
 			if masquerade.Valid {
 				r.Masquerade = masquerade.Bool
@@ -2481,7 +2459,7 @@ func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*
 }
 
 func (s *SqlStore) getNetworkResources(ctx context.Context, accountID string) ([]*resourceTypes.NetworkResource, error) {
-	const query = `SELECT id, network_id, account_id, public_id, name, description, type, domain, prefix, enabled FROM network_resources WHERE account_id = $1`
+	const query = `SELECT id, network_id, account_id, name, description, type, domain, prefix, enabled FROM network_resources WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
@@ -2490,7 +2468,7 @@ func (s *SqlStore) getNetworkResources(ctx context.Context, accountID string) ([
 		var r resourceTypes.NetworkResource
 		var prefix []byte
 		var enabled sql.NullBool
-		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.PublicID, &r.Name, &r.Description, &r.Type, &r.Domain, &prefix, &enabled)
+		err := row.Scan(&r.ID, &r.NetworkID, &r.AccountID, &r.Name, &r.Description, &r.Type, &r.Domain, &prefix, &enabled)
 		if err == nil {
 			if enabled.Valid {
 				r.Enabled = enabled.Bool
@@ -3852,7 +3830,7 @@ func (s *SqlStore) UpdateGroup(ctx context.Context, group *types.Group) error {
 		return status.Errorf(status.InvalidArgument, "group is nil")
 	}
 
-	if err := s.db.Omit(clause.Associations, "public_id").Save(group).Error; err != nil {
+	if err := s.db.Omit(clause.Associations).Save(group).Error; err != nil {
 		log.WithContext(ctx).Errorf("failed to save group to store: %v", err)
 		return status.Errorf(status.Internal, "failed to save group to store")
 	}
@@ -3940,7 +3918,7 @@ func (s *SqlStore) CreatePolicy(ctx context.Context, policy *types.Policy) error
 
 // SavePolicy saves a policy to the database.
 func (s *SqlStore) SavePolicy(ctx context.Context, policy *types.Policy) error {
-	result := s.db.Session(&gorm.Session{FullSaveAssociations: true}).Omit("public_id").Save(policy)
+	result := s.db.Session(&gorm.Session{FullSaveAssociations: true}).Save(policy)
 	if err := result.Error; err != nil {
 		log.WithContext(ctx).Errorf("failed to save policy to the store: %s", err)
 		return status.Errorf(status.Internal, "failed to save policy to store")

management/server/store/sql_store_test.go

@@ -47,7 +47,6 @@ func runTestForAllEngines(t *testing.T, testDataFile string, f func(t *testing.T
 		}
 		t.Setenv("NETBIRD_STORE_ENGINE", string(engine))
 		store, cleanUp, err := NewTestStoreFromSQL(context.Background(), testDataFile, t.TempDir())
-		assert.NoError(t, err, "engine: ", string(engine))
 		t.Cleanup(cleanUp)
 		assert.NoError(t, err)
 		t.Run(string(engine), func(t *testing.T) {
@@ -562,60 +561,53 @@ func TestSqlStore_GetPeerByIP_NotFound(t *testing.T) {
 }
 
 func TestSqlStore_SavePeer(t *testing.T) {
-	populateFields := testing_helpers.NewPopulateFields()
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanUp)
+	assert.NoError(t, err)
 
-	runTestForAllEngines(t, "../testdata/store.sql", func(t *testing.T, store Store) {
-		account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
-		require.NoError(t, err)
+	account, err := store.GetAccount(context.Background(), "bf1c8084-ba50-4ce7-9439-34653001fc3b")
+	require.NoError(t, err)
 
-		metadata := nbpeer.PeerSystemMeta{}
-		reflectedMetadata := reflect.ValueOf(&metadata).Elem()
+	// save status of non-existing peer
+	peer := &nbpeer.Peer{
+		Key:       "peerkey",
+		ID:        "testpeer",
+		IP:        netip.AddrFrom4([4]byte{127, 0, 0, 1}),
+		IPv6:      netip.MustParseAddr("fd00::1"),
+		Meta:      nbpeer.PeerSystemMeta{Hostname: "testingpeer"},
+		Name:      "peer name",
+		Status:    &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+		CreatedAt: time.Now().UTC(),
+	}
+	ctx := context.Background()
+	err = store.SavePeer(ctx, account.Id, peer)
+	assert.Error(t, err)
+	parsedErr, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 
-		numOfFields, err := populateFields.PopulateAll(reflectedMetadata)
-		assert.NoError(t, err)
-		assert.Equal(t, 32, numOfFields)
+	// save new status of existing peer
+	account.Peers[peer.ID] = peer
 
-		// save status of non-existing peer
-		peer := &nbpeer.Peer{
-			Key:       "peerkey",
-			ID:        "testpeer",
-			IP:        netip.AddrFrom4([4]byte{127, 0, 0, 1}),
-			IPv6:      netip.MustParseAddr("fd00::1"),
-			Meta:      metadata, //nbpeer.PeerSystemMeta{Hostname: "testingpeer"},
-			Name:      "peer name",
-			Status:    &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
-			CreatedAt: time.Now().UTC(),
-		}
-		ctx := context.Background()
-		err = store.SavePeer(ctx, account.Id, peer)
-		assert.Error(t, err)
-		parsedErr, ok := status.FromError(err)
-		require.True(t, ok)
-		require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
+	err = store.SaveAccount(context.Background(), account)
+	require.NoError(t, err)
 
-		// save new status of existing peer
-		account.Peers[peer.ID] = peer
+	updatedPeer := peer.Copy()
+	updatedPeer.Status.Connected = false
+	updatedPeer.Meta.Hostname = "updatedpeer"
 
-		err = store.SaveAccount(context.Background(), account)
-		require.NoError(t, err)
+	err = store.SavePeer(ctx, account.Id, updatedPeer)
+	require.NoError(t, err)
 
-		updatedPeer := peer.Copy()
-		updatedPeer.Status.Connected = false
-		updatedPeer.Meta.Hostname = "updatedpeer"
+	account, err = store.GetAccount(context.Background(), account.Id)
+	require.NoError(t, err)
 
-		err = store.SavePeer(ctx, account.Id, updatedPeer)
-		require.NoError(t, err)
-
-		account, err = store.GetAccount(context.Background(), account.Id)
-		require.NoError(t, err)
-
-		actual := account.Peers[peer.ID]
-		assert.Equal(t, updatedPeer.Meta, actual.Meta)
-		assert.Equal(t, updatedPeer.Status.Connected, actual.Status.Connected)
-		assert.Equal(t, updatedPeer.Status.LoginExpired, actual.Status.LoginExpired)
-		assert.Equal(t, updatedPeer.Status.RequiresApproval, actual.Status.RequiresApproval)
-		assert.WithinDurationf(t, updatedPeer.Status.LastSeen, actual.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
-	})
+	actual := account.Peers[peer.ID]
+	assert.Equal(t, updatedPeer.Meta, actual.Meta)
+	assert.Equal(t, updatedPeer.Status.Connected, actual.Status.Connected)
+	assert.Equal(t, updatedPeer.Status.LoginExpired, actual.Status.LoginExpired)
+	assert.Equal(t, updatedPeer.Status.RequiresApproval, actual.Status.RequiresApproval)
+	assert.WithinDurationf(t, updatedPeer.Status.LastSeen, actual.Status.LastSeen.UTC(), time.Millisecond, "LastSeen should be equal")
 }
 
 func TestSqlStore_SavePeerStatus(t *testing.T) {

management/server/store/store.go

@@ -582,30 +582,6 @@ func getMigrationsPreAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.CleanupOrphanedResources[domain.Domain, types.Account](ctx, db, "account_id")
 		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[types.Policy](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[types.Group](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[route.Route](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[resourceTypes.NetworkResource](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[routerTypes.NetworkRouter](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[dns.NameServerGroup](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[networkTypes.Network](ctx, db)
-		},
-		func(db *gorm.DB) error {
-			return migration.BackfillPublicIDs[posture.Checks](ctx, db)
-		},
 	}
 }
 

management/server/store/store_mock_agentnetwork.go

@@ -0,0 +1,495 @@
+package store
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	gomock "github.com/golang/mock/gomock"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// GetAllAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkProviders", ctx, lockStrength)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkProviders indicates an expected call of GetAllAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkProviders(ctx, lockStrength interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkProviders), ctx, lockStrength)
+}
+
+// GetAgentNetworkMetrics mocks base method.
+func (m *MockStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkMetrics", ctx)
+	ret0, _ := ret[0].(AgentNetworkMetrics)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkMetrics indicates an expected call of GetAgentNetworkMetrics.
+func (mr *MockStoreMockRecorder) GetAgentNetworkMetrics(ctx interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkMetrics", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkMetrics), ctx)
+}
+
+// GetAccountAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkProviders", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkProviders indicates an expected call of GetAccountAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkProviders(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkProviders), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkProviderByID mocks base method.
+func (m *MockStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkProviderByID", ctx, lockStrength, accountID, providerID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkProviderByID indicates an expected call of GetAgentNetworkProviderByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkProviderByID(ctx, lockStrength, accountID, providerID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkProviderByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkProviderByID), ctx, lockStrength, accountID, providerID)
+}
+
+// SaveAgentNetworkProvider mocks base method.
+func (m *MockStore) SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkProvider", ctx, provider)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkProvider indicates an expected call of SaveAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkProvider(ctx, provider interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkProvider), ctx, provider)
+}
+
+// DeleteAgentNetworkProvider mocks base method.
+func (m *MockStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkProvider", ctx, accountID, providerID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkProvider indicates an expected call of DeleteAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkProvider(ctx, accountID, providerID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkProvider), ctx, accountID, providerID)
+}
+
+// GetAccountAgentNetworkPolicies mocks base method.
+func (m *MockStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkPolicies", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkPolicies indicates an expected call of GetAccountAgentNetworkPolicies.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkPolicies(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkPolicies), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkPolicyByID mocks base method.
+func (m *MockStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkPolicyByID", ctx, lockStrength, accountID, policyID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkPolicyByID indicates an expected call of GetAgentNetworkPolicyByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkPolicyByID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkPolicyByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkPolicyByID), ctx, lockStrength, accountID, policyID)
+}
+
+// SaveAgentNetworkPolicy mocks base method.
+func (m *MockStore) SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkPolicy", ctx, policy)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkPolicy indicates an expected call of SaveAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkPolicy(ctx, policy interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkPolicy), ctx, policy)
+}
+
+// DeleteAgentNetworkPolicy mocks base method.
+func (m *MockStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkPolicy", ctx, accountID, policyID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkPolicy indicates an expected call of DeleteAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkPolicy(ctx, accountID, policyID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkPolicy), ctx, accountID, policyID)
+}
+
+// GetAccountAgentNetworkGuardrails mocks base method.
+func (m *MockStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkGuardrails", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkGuardrails indicates an expected call of GetAccountAgentNetworkGuardrails.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkGuardrails(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkGuardrails", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkGuardrails), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkGuardrailByID mocks base method.
+func (m *MockStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkGuardrailByID", ctx, lockStrength, accountID, guardrailID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkGuardrailByID indicates an expected call of GetAgentNetworkGuardrailByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkGuardrailByID(ctx, lockStrength, accountID, guardrailID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkGuardrailByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkGuardrailByID), ctx, lockStrength, accountID, guardrailID)
+}
+
+// SaveAgentNetworkGuardrail mocks base method.
+func (m *MockStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkGuardrail", ctx, guardrail)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkGuardrail indicates an expected call of SaveAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkGuardrail(ctx, guardrail interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkGuardrail), ctx, guardrail)
+}
+
+// DeleteAgentNetworkGuardrail mocks base method.
+func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkGuardrail", ctx, accountID, guardrailID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkGuardrail indicates an expected call of DeleteAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkGuardrail), ctx, accountID, guardrailID)
+}
+
+// GetAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettings", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettings indicates an expected call of GetAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkSettingsByCluster mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
+}
+
+// SaveAgentNetworkSettings mocks base method.
+func (m *MockStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkSettings", ctx, settings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkSettings indicates an expected call of SaveAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkSettings), ctx, settings)
+}
+
+// IncrementAgentNetworkConsumption mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumption", ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumption indicates an expected call of IncrementAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumption), ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+}
+
+// GetAgentNetworkConsumption mocks base method.
+func (m *MockStore) GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumption", ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+	ret0, _ := ret[0].(*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumption indicates an expected call of GetAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumption(ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumption), ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+}
+
+// GetAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumptionBatch", ctx, lockStrength, accountID, keys)
+	ret0, _ := ret[0].(map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumptionBatch indicates an expected call of GetAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumptionBatch(ctx, lockStrength, accountID, keys interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumptionBatch), ctx, lockStrength, accountID, keys)
+}
+
+// IncrementAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumptionBatch", ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumptionBatch indicates an expected call of IncrementAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumptionBatch(ctx, accountID, keys, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumptionBatch), ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+}
+
+// ListAgentNetworkConsumption mocks base method.
+func (m *MockStore) ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListAgentNetworkConsumption", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListAgentNetworkConsumption indicates an expected call of ListAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) ListAgentNetworkConsumption(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).ListAgentNetworkConsumption), ctx, lockStrength, accountID)
+}
+
+// GetAccountAgentNetworkBudgetRules mocks base method.
+func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkBudgetRules", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkBudgetRules indicates an expected call of GetAccountAgentNetworkBudgetRules.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkBudgetRules(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkBudgetRules", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkBudgetRules), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkBudgetRuleByID mocks base method.
+func (m *MockStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkBudgetRuleByID", ctx, lockStrength, accountID, ruleID)
+	ret0, _ := ret[0].(*agentNetworkTypes.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkBudgetRuleByID indicates an expected call of GetAgentNetworkBudgetRuleByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkBudgetRuleByID(ctx, lockStrength, accountID, ruleID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkBudgetRuleByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkBudgetRuleByID), ctx, lockStrength, accountID, ruleID)
+}
+
+// SaveAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkBudgetRule", ctx, rule)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkBudgetRule indicates an expected call of SaveAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkBudgetRule(ctx, rule interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkBudgetRule), ctx, rule)
+}
+
+// DeleteAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkBudgetRule", ctx, accountID, ruleID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkBudgetRule indicates an expected call of DeleteAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
+}
+
+// CreateAgentNetworkAccessLog mocks base method.
+func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkAccessLog", ctx, entry, groups)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkAccessLog indicates an expected call of CreateAgentNetworkAccessLog.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
+}
+
+// CreateAgentNetworkUsage mocks base method.
+func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkUsage", ctx, usage, groups)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkUsage indicates an expected call of CreateAgentNetworkUsage.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkUsage(ctx, usage, groups interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkUsage", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkUsage), ctx, usage, groups)
+}
+
+// GetAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogs", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLog)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogs indicates an expected call of GetAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogs(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogs), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkAccessLogSessions mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogSessions", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLogSession)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogSessions indicates an expected call of GetAgentNetworkAccessLogSessions.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogSessions(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogSessions", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogSessions), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkUsageRows mocks base method.
+func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkUsageRows", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkUsage)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkUsageRows indicates an expected call of GetAgentNetworkUsageRows.
+func (mr *MockStoreMockRecorder) GetAgentNetworkUsageRows(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkUsageRows", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkUsageRows), ctx, lockStrength, accountID, filter)
+}
+
+// DeleteOldAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOldAgentNetworkAccessLogs", ctx, accountID, olderThan)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteOldAgentNetworkAccessLogs indicates an expected call of DeleteOldAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) DeleteOldAgentNetworkAccessLogs(ctx, accountID, olderThan interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAgentNetworkAccessLogs), ctx, accountID, olderThan)
+}
+
+// GetAllAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkSettings", ctx, lockStrength)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkSettings indicates an expected call of GetAllAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkSettings(ctx, lockStrength interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkSettings), ctx, lockStrength)
+}

management/server/telemetry/updatechannel_metrics.go

@@ -10,20 +10,19 @@ import (
 
 // UpdateChannelMetrics represents all metrics related to the UpdateChannel
 type UpdateChannelMetrics struct {
-	createChannelDurationMicro           metric.Int64Histogram
-	closeChannelDurationMicro            metric.Int64Histogram
-	closeChannelsDurationMicro           metric.Int64Histogram
-	closeChannels                        metric.Int64Histogram
-	sendUpdateDurationMicro              metric.Int64Histogram
-	getAllConnectedPeersDurationMicro    metric.Int64Histogram
-	getAllConnectedPeers                 metric.Int64Histogram
-	hasChannelDurationMicro              metric.Int64Histogram
-	calcPostureChecksDurationMicro       metric.Int64Histogram
-	calcPeerNetworkMapDurationMs         metric.Int64Histogram
-	mergeNetworkMapDurationMicro         metric.Int64Histogram
-	toSyncResponseDurationMicro          metric.Int64Histogram
-	toComponentSyncResponseDurationMicro metric.Int64Histogram
-	ctx                                  context.Context
+	createChannelDurationMicro        metric.Int64Histogram
+	closeChannelDurationMicro         metric.Int64Histogram
+	closeChannelsDurationMicro        metric.Int64Histogram
+	closeChannels                     metric.Int64Histogram
+	sendUpdateDurationMicro           metric.Int64Histogram
+	getAllConnectedPeersDurationMicro metric.Int64Histogram
+	getAllConnectedPeers              metric.Int64Histogram
+	hasChannelDurationMicro           metric.Int64Histogram
+	calcPostureChecksDurationMicro    metric.Int64Histogram
+	calcPeerNetworkMapDurationMs      metric.Int64Histogram
+	mergeNetworkMapDurationMicro      metric.Int64Histogram
+	toSyncResponseDurationMicro       metric.Int64Histogram
+	ctx                               context.Context
 }
 
 // NewUpdateChannelMetrics creates an instance of UpdateChannel
@@ -126,29 +125,20 @@ func NewUpdateChannelMetrics(ctx context.Context, meter metric.Meter) (*UpdateCh
 		return nil, err
 	}
 
-	toComponentSyncResponseDurationMicro, err := meter.Int64Histogram("management.updatechannel.tocomponentsyncresponse.duration.micro",
-		metric.WithUnit("microseconds"),
-		metric.WithDescription("Duration of how long it takes to convert components to component sync response"),
-	)
-	if err != nil {
-		return nil, err
-	}
-
 	return &UpdateChannelMetrics{
-		createChannelDurationMicro:           createChannelDurationMicro,
-		closeChannelDurationMicro:            closeChannelDurationMicro,
-		closeChannelsDurationMicro:           closeChannelsDurationMicro,
-		closeChannels:                        closeChannels,
-		sendUpdateDurationMicro:              sendUpdateDurationMicro,
-		getAllConnectedPeersDurationMicro:    getAllConnectedPeersDurationMicro,
-		getAllConnectedPeers:                 getAllConnectedPeers,
-		hasChannelDurationMicro:              hasChannelDurationMicro,
-		calcPostureChecksDurationMicro:       calcPostureChecksDurationMicro,
-		calcPeerNetworkMapDurationMs:         calcPeerNetworkMapDurationMs,
-		mergeNetworkMapDurationMicro:         mergeNetworkMapDurationMicro,
-		toSyncResponseDurationMicro:          toSyncResponseDurationMicro,
-		toComponentSyncResponseDurationMicro: toComponentSyncResponseDurationMicro,
-		ctx:                                  ctx,
+		createChannelDurationMicro:        createChannelDurationMicro,
+		closeChannelDurationMicro:         closeChannelDurationMicro,
+		closeChannelsDurationMicro:        closeChannelsDurationMicro,
+		closeChannels:                     closeChannels,
+		sendUpdateDurationMicro:           sendUpdateDurationMicro,
+		getAllConnectedPeersDurationMicro: getAllConnectedPeersDurationMicro,
+		getAllConnectedPeers:              getAllConnectedPeers,
+		hasChannelDurationMicro:           hasChannelDurationMicro,
+		calcPostureChecksDurationMicro:    calcPostureChecksDurationMicro,
+		calcPeerNetworkMapDurationMs:      calcPeerNetworkMapDurationMs,
+		mergeNetworkMapDurationMicro:      mergeNetworkMapDurationMicro,
+		toSyncResponseDurationMicro:       toSyncResponseDurationMicro,
+		ctx:                               ctx,
 	}, nil
 }
 
@@ -203,7 +193,3 @@ func (metrics *UpdateChannelMetrics) CountMergeNetworkMapDuration(duration time.
 func (metrics *UpdateChannelMetrics) CountToSyncResponseDuration(duration time.Duration) {
 	metrics.toSyncResponseDurationMicro.Record(metrics.ctx, duration.Microseconds())
 }
-
-func (metrics *UpdateChannelMetrics) CountToComponentSyncResponseDuration(duration time.Duration) {
-	metrics.toComponentSyncResponseDurationMicro.Record(metrics.ctx, duration.Microseconds())
-}

management/server/types/account.go

@@ -29,6 +29,7 @@ import (
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/version"
 )
 
 const (
@@ -41,8 +42,27 @@ const (
 	PublicCategory  = "public"
 	PrivateCategory = "private"
 	UnknownCategory = "unknown"
+
+	// firewallRuleMinPortRangesVer defines the minimum peer version that supports port range rules.
+	firewallRuleMinPortRangesVer = "0.48.0"
+	// firewallRuleMinNativeSSHVer defines the minimum peer version that supports native SSH features in the firewall rules.
+	firewallRuleMinNativeSSHVer = "0.60.0"
+
+	// nativeSSHPortString defines the default port number as a string used for native SSH connections; this port is used by clients when hijacking ssh connections.
+	nativeSSHPortString = "22022"
+	nativeSSHPortNumber = 22022
+	// defaultSSHPortString defines the standard SSH port number as a string, commonly used for default SSH connections.
+	defaultSSHPortString = "22"
+	defaultSSHPortNumber = 22
 )
 
+type supportedFeatures struct {
+	nativeSSH  bool
+	portRanges bool
+}
+
+type LookupMap map[string]struct{}
+
 // AccountMeta is a struct that contains a stripped down version of the Account object.
 // It doesn't carry any peers, groups, policies, or routes, etc. Just some metadata (e.g. ID, created by, created at, etc).
 type AccountMeta struct {
@@ -1051,7 +1071,7 @@ func (a *Account) GetPeerConnectionResources(ctx context.Context, peer *nbpeer.P
 				default:
 					authorizedUsers[auth.Wildcard] = a.getAllowedUserIDs()
 				}
-			} else if peerInDestinations && PolicyRuleImpliesLegacySSH(rule) && peer.SSHEnabled {
+			} else if peerInDestinations && policyRuleImpliesLegacySSH(rule) && peer.SSHEnabled {
 				sshEnabled = true
 				authorizedUsers[auth.Wildcard] = a.getAllowedUserIDs()
 			}
@@ -1117,15 +1137,15 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
+					rules = append(rules, expandPortsAndRanges(fr, rule, targetPeer)...)
 				}
 
-				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
-					Direction:   direction,
-					DirStr:      strconv.Itoa(direction),
-					ProtocolStr: string(protocol),
-					ActionStr:   string(rule.Action),
-					PortsJoined: strings.Join(rule.Ports, ","),
+				rules = appendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, firewallRuleContext{
+					direction:   direction,
+					dirStr:      strconv.Itoa(direction),
+					protocolStr: string(protocol),
+					actionStr:   string(rule.Action),
+					portsJoined: strings.Join(rule.Ports, ","),
 				})
 			}
 		}, func() ([]*nbpeer.Peer, []*FirewallRule) {
@@ -1133,6 +1153,10 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 		}
 }
 
+func policyRuleImpliesLegacySSH(rule *PolicyRule) bool {
+	return rule.Protocol == PolicyRuleProtocolALL || (rule.Protocol == PolicyRuleProtocolTCP && (portsIncludesSSH(rule.Ports) || portRangeIncludesSSH(rule.PortRanges)))
+}
+
 // PeerSSHEnabledFromPolicies is the network-map-free equivalent of the sshEnabled
 // determination in GetPeerConnectionResources / CalculateNetworkMapFromComponents.
 func PeerSSHEnabledFromPolicies(policies []*Policy, peerID string, peerGroupIDs map[string]struct{}, peerSSHEnabled bool) bool {
@@ -1147,7 +1171,7 @@ func PeerSSHEnabledFromPolicies(policies []*Policy, peerID string, peerGroupIDs
 			}
 
 			isSSHRule := rule.Protocol == PolicyRuleProtocolNetbirdSSH ||
-				(PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled)
+				(policyRuleImpliesLegacySSH(rule) && peerSSHEnabled)
 			if !isSSHRule {
 				continue
 			}
@@ -1174,6 +1198,24 @@ func ruleHasDestination(rule *PolicyRule, peerID string, peerGroupIDs map[string
 	return false
 }
 
+func portRangeIncludesSSH(portRanges []RulePortRange) bool {
+	for _, pr := range portRanges {
+		if (pr.Start <= defaultSSHPortNumber && pr.End >= defaultSSHPortNumber) || (pr.Start <= nativeSSHPortNumber && pr.End >= nativeSSHPortNumber) {
+			return true
+		}
+	}
+	return false
+}
+
+func portsIncludesSSH(ports []string) bool {
+	for _, port := range ports {
+		if port == defaultSSHPortString || port == nativeSSHPortString {
+			return true
+		}
+	}
+	return false
+}
+
 // getAllPeersFromGroups for given peer ID and list of groups
 //
 // Returns a list of peers from specified groups that pass specified posture checks
@@ -1273,7 +1315,7 @@ func (a *Account) getRouteFirewallRules(ctx context.Context, peerID string, poli
 			}
 
 			rulePeers := a.getRulePeers(rule, policy.SourcePostureChecks, peerID, distributionPeers, validatedPeersMap)
-			rules := GenerateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
+			rules := generateRouteFirewallRules(ctx, route, rule, rulePeers, FirewallRuleDirectionIN, includeIPv6)
 			fwRules = append(fwRules, rules...)
 		}
 	}
@@ -1766,6 +1808,96 @@ func (a *Account) createProxyPolicy(svc *service.Service, target *service.Target
 	}
 }
 
+// expandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules
+func expandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
+
+	var expanded []*FirewallRule
+
+	for _, port := range rule.Ports {
+		fr := base
+		fr.Port = port
+		expanded = append(expanded, &fr)
+	}
+
+	for _, portRange := range rule.PortRanges {
+		// prefer PolicyRule.Ports
+		if len(rule.Ports) > 0 {
+			break
+		}
+		fr := base
+
+		if features.portRanges {
+			fr.PortRange = portRange
+		} else {
+			// Peer doesn't support port ranges, only allow single-port ranges
+			if portRange.Start != portRange.End {
+				continue
+			}
+			fr.Port = strconv.FormatUint(uint64(portRange.Start), 10)
+		}
+		expanded = append(expanded, &fr)
+	}
+
+	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == PolicyRuleProtocolNetbirdSSH {
+		expanded = addNativeSSHRule(base, expanded)
+	}
+
+	return expanded
+}
+
+// addNativeSSHRule adds a native SSH rule (port 22022) to the expanded rules if the base rule has port 22 configured.
+func addNativeSSHRule(base FirewallRule, expanded []*FirewallRule) []*FirewallRule {
+	shouldAdd := false
+	for _, fr := range expanded {
+		if isPortInRule(nativeSSHPortString, 22022, fr) {
+			return expanded
+		}
+		if isPortInRule(defaultSSHPortString, 22, fr) {
+			shouldAdd = true
+		}
+	}
+	if !shouldAdd {
+		return expanded
+	}
+
+	fr := base
+	fr.Port = nativeSSHPortString
+	return append(expanded, &fr)
+}
+
+func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
+	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
+}
+
+// shouldCheckRulesForNativeSSH determines whether specific policy rules should be checked for native SSH support.
+// While users can add the nativeSSHPortString, we look for cases when they used port 22 and based on SSH enabled
+// in both management and client, we indicate to add the native port.
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *nbpeer.Peer) bool {
+	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
+}
+
+// peerSupportedFirewallFeatures checks if the peer version supports port ranges.
+func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
+	if version.IsDevelopmentVersion(peerVer) {
+		return supportedFeatures{true, true}
+	}
+
+	var features supportedFeatures
+
+	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	features.nativeSSH = err == nil && meetMinVer
+
+	if features.nativeSSH {
+		features.portRanges = true
+	} else {
+		meetMinVer, err = posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		features.portRanges = err == nil && meetMinVer
+	}
+
+	return features
+}
+
 // filterZoneRecordsForPeers filters DNS records to only include peers to connect.
 // AAAA records are excluded when the requesting peer lacks IPv6 capability.
 func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, peersToConnect, expiredPeers []*nbpeer.Peer) []nbdns.SimpleRecord {

management/server/types/account_components.go

@@ -16,39 +16,6 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-// GetPeerNetworkMapResult dispatches to either the legacy-NetworkMap path or
-// the components path based on the peer's capability and the kill switch.
-// Capable peers (PeerCapabilityComponentNetworkMap) get the raw components
-// shape — the server skips Calculate() entirely for them, saving CPU
-// proportional to the number of capable peers in the account. Legacy peers
-// (or any peer when componentsDisabled is true) get the fully-expanded
-// NetworkMap as before.
-func (a *Account) GetPeerNetworkMapResult(
-	ctx context.Context,
-	peerID string,
-	componentsDisabled bool,
-	peersCustomZone nbdns.CustomZone,
-	accountZones []*zones.Zone,
-	validatedPeersMap map[string]struct{},
-	resourcePolicies map[string][]*Policy,
-	routers map[string]map[string]*routerTypes.NetworkRouter,
-	metrics *telemetry.AccountManagerMetrics,
-	groupIDToUserIDs map[string][]string,
-) PeerNetworkMapResult {
-	peer := a.Peers[peerID]
-	if !componentsDisabled && peer != nil && peer.SupportsComponentNetworkMap() {
-		components := a.GetPeerNetworkMapComponents(
-			ctx, peerID, peersCustomZone, accountZones, validatedPeersMap, resourcePolicies, routers, groupIDToUserIDs,
-		)
-		return PeerNetworkMapResult{Components: components}
-	}
-	return PeerNetworkMapResult{
-		NetworkMap: a.GetPeerNetworkMapFromComponents(
-			ctx, peerID, peersCustomZone, accountZones, validatedPeersMap, resourcePolicies, routers, metrics, groupIDToUserIDs,
-		),
-	}
-}
-
 func (a *Account) GetPeerNetworkMapFromComponents(
 	ctx context.Context,
 	peerID string,
@@ -73,8 +40,8 @@ func (a *Account) GetPeerNetworkMapFromComponents(
 		groupIDToUserIDs,
 	)
 
-	if components.IsEmpty() {
-		return &NetworkMap{Network: components.Network}
+	if components == nil {
+		return &NetworkMap{Network: a.Network.Copy()}
 	}
 
 	nm := CalculateNetworkMapFromComponents(ctx, components)
@@ -104,54 +71,26 @@ func (a *Account) GetPeerNetworkMapComponents(
 	routers map[string]map[string]*routerTypes.NetworkRouter,
 	groupIDToUserIDs map[string][]string,
 ) *NetworkMapComponents {
+
 	peer := a.Peers[peerID]
-	// this can never happen, things are very wrong if it did
-	// TODO (dmitri) maybe consider using invariants?
 	if peer == nil {
-		log.WithField("peer id", peerID).Error("NetworkMapComponents are computed for a peer missing from the account")
-		return EmptyNetworkMapComponents(&NetworkMapComponents{
-			PeerID:  peerID,
-			Network: a.Network.Copy(),
-			// must include the target peer as it's required on the client
-			Peers: map[string]*nbpeer.Peer{peerID: peer},
-		})
+		return nil
 	}
 
 	if _, ok := validatedPeersMap[peerID]; !ok {
-		// Mirror legacy graceful-degrade: GetPeerNetworkMapFromComponents
-		// returns &NetworkMap{Network: a.Network.Copy()} when components is
-		// nil. Match that floor so the receiving client always sees the
-		// account Network identifier, not a fully-empty envelope.
-		return EmptyNetworkMapComponents(&NetworkMapComponents{
-			PeerID:  peerID,
-			Network: a.Network.Copy(),
-			// must include the target peer as it's required on the client
-			Peers: map[string]*nbpeer.Peer{peerID: peer},
-		})
+		return nil
 	}
 
 	components := &NetworkMapComponents{
-		PeerID:                    peerID,
-		Network:                   a.Network.Copy(),
-		NameServerGroups:          make([]*nbdns.NameServerGroup, 0),
-		CustomZoneDomain:          peersCustomZone.Domain,
-		ResourcePoliciesMap:       make(map[string][]*Policy),
-		RoutersMap:                make(map[string]map[string]*routerTypes.NetworkRouter),
-		NetworkResources:          make([]*resourceTypes.NetworkResource, 0),
-		PostureFailedPeers:        make(map[string]map[string]struct{}, len(a.PostureChecks)),
-		RouterPeers:               make(map[string]*nbpeer.Peer),
-		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
-		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
-	}
-	for _, n := range a.Networks {
-		if n != nil {
-			components.NetworkXIDToPublicID[n.ID] = n.PublicID
-		}
-	}
-	for _, pc := range a.PostureChecks {
-		if pc != nil {
-			components.PostureCheckXIDToPublicID[pc.ID] = pc.PublicID
-		}
+		PeerID:              peerID,
+		Network:             a.Network.Copy(),
+		NameServerGroups:    make([]*nbdns.NameServerGroup, 0),
+		CustomZoneDomain:    peersCustomZone.Domain,
+		ResourcePoliciesMap: make(map[string][]*Policy),
+		RoutersMap:          make(map[string]map[string]*routerTypes.NetworkRouter),
+		NetworkResources:    make([]*resourceTypes.NetworkResource, 0),
+		PostureFailedPeers:  make(map[string]map[string]struct{}, len(a.PostureChecks)),
+		RouterPeers:         make(map[string]*nbpeer.Peer),
 	}
 
 	components.AccountSettings = &AccountSettingsInfo{
@@ -163,7 +102,6 @@ func (a *Account) GetPeerNetworkMapComponents(
 
 	components.DNSSettings = &a.DNSSettings
 
-	// relevantPeers always contains the target peer (peerID)
 	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := a.getPeersGroupsPoliciesRoutes(ctx, peerID, peer.SSHEnabled, validatedPeersMap, &components.PostureFailedPeers)
 
 	if len(sshReqs.neededGroupIDs) > 0 {
@@ -271,26 +209,21 @@ func (a *Account) GetPeerNetworkMapComponents(
 			components.ResourcePoliciesMap[resource.ID] = policies
 		}
 
-		// Only expose router peers and the per-network routers_map when this
-		// target peer actually has access to the resource (either as a router
-		// itself or via a policy that includes it as a source). Without this
-		// gate, every peer's envelope was leaking router peers of every
-		// network in the account — accounts with many tenants/networks
-		// shipped tens of unrelated peers in `peers[]` and `routers_map`.
-		if addSourcePeers {
-			components.RoutersMap[resource.NetworkID] = networkRoutingPeers
-			for peerIDKey := range networkRoutingPeers {
-				if p := a.Peers[peerIDKey]; p != nil {
-					if _, exists := components.RouterPeers[peerIDKey]; !exists {
-						components.RouterPeers[peerIDKey] = p
-					}
-					if _, exists := components.Peers[peerIDKey]; !exists {
-						if _, validated := validatedPeersMap[peerIDKey]; validated {
-							components.Peers[peerIDKey] = p
-						}
+		components.RoutersMap[resource.NetworkID] = networkRoutingPeers
+		for peerIDKey := range networkRoutingPeers {
+			if p := a.Peers[peerIDKey]; p != nil {
+				if _, exists := components.RouterPeers[peerIDKey]; !exists {
+					components.RouterPeers[peerIDKey] = p
+				}
+				if _, exists := components.Peers[peerIDKey]; !exists {
+					if _, validated := validatedPeersMap[peerIDKey]; validated {
+						components.Peers[peerIDKey] = p
 					}
 				}
 			}
+		}
+
+		if addSourcePeers {
 			components.NetworkResources = append(components.NetworkResources, resource)
 		}
 	}
@@ -321,44 +254,18 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 
 	relevantPeerIDs[peerID] = a.GetPeer(peerID)
 
-	peerGroupSet := make(map[string]struct{}, 8)
 	for groupID, group := range a.Groups {
 		if slices.Contains(group.Peers, peerID) {
 			relevantGroupIDs[groupID] = a.GetGroup(groupID)
-			peerGroupSet[groupID] = struct{}{}
 		}
 	}
 
 	routeAccessControlGroups := make(map[string]struct{})
 	for _, r := range a.Routes {
-		if r == nil {
-			continue
-		}
-		relevant := r.Peer == peerID
-		if !relevant {
-			for _, groupID := range r.PeerGroups {
-				if _, ok := peerGroupSet[groupID]; ok {
-					relevant = true
-					break
-				}
-			}
-		}
-		if !relevant && r.Enabled {
-			for _, groupID := range r.Groups {
-				if _, ok := peerGroupSet[groupID]; ok {
-					relevant = true
-					break
-				}
-			}
-		}
-		if !relevant {
-			continue
-		}
-
-		for _, groupID := range r.PeerGroups {
+		for _, groupID := range r.Groups {
 			relevantGroupIDs[groupID] = a.GetGroup(groupID)
 		}
-		for _, groupID := range r.Groups {
+		for _, groupID := range r.PeerGroups {
 			relevantGroupIDs[groupID] = a.GetGroup(groupID)
 		}
 		if r.Enabled {
@@ -367,44 +274,6 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 				routeAccessControlGroups[groupID] = struct{}{}
 			}
 		}
-
-		// Include route advertisers in relevantPeerIDs. The envelope
-		// encoder writes route.peer_index by looking up r.Peer in the
-		// shipped peers list; if the advertiser is policy-isolated from
-		// the target peer (no rule edge between them), it would otherwise
-		// be omitted and the decoder would fail to resolve r.Peer, leaving
-		// the client without a WG tunnel target for this route. Legacy
-		// NetworkMap.Routes shipped the WG public key inline, so the
-		// equivalence path doesn't surface this — but the dependency is
-		// real once a client actually tries to use the route.
-		// Gate by validatedPeersMap so non-validated advertisers stay out
-		// (matches the network-resource router behaviour at the bottom of
-		// this loop, and the legacy invariant that only validated peers
-		// reach a client's view).
-		if r.Peer != "" {
-			if _, ok := validatedPeersMap[r.Peer]; ok {
-				if p := a.GetPeer(r.Peer); p != nil {
-					relevantPeerIDs[r.Peer] = p
-				}
-			}
-		}
-		for _, groupID := range r.PeerGroups {
-			g := a.GetGroup(groupID)
-			if g == nil {
-				continue
-			}
-			for _, pid := range g.Peers {
-				if _, exists := relevantPeerIDs[pid]; exists {
-					continue
-				}
-				if _, ok := validatedPeersMap[pid]; !ok {
-					continue
-				}
-				if p := a.GetPeer(pid); p != nil {
-					relevantPeerIDs[pid] = p
-				}
-			}
-		}
 		relevantRoutes = append(relevantRoutes, r)
 	}
 
@@ -484,7 +353,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					default:
 						sshReqs.needAllowedUserIDs = true
 					}
-				} else if PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
+				} else if policyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
 					sshReqs.needAllowedUserIDs = true
 				}
 			}
@@ -617,13 +486,6 @@ func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChe
 	return dest
 }
 
-// filterGroupPeers trims each group's Peers slice to only those peers that
-// also appear in `peers`. Groups whose filtered list is empty are NOT
-// deleted from the map — they're kept so the components wire encoder can
-// still resolve seq references from routes/policies/access-control groups
-// that name them. Calculate() tolerates groups with empty Peers (the inner
-// loops simply iterate zero times), so retaining them is behaviourally a
-// no-op for the legacy path that consumes the same NetworkMapComponents.
 func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer) {
 	for groupID, groupInfo := range *groups {
 		filteredPeers := make([]string, 0, len(groupInfo.Peers))
@@ -633,7 +495,9 @@ func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer)
 			}
 		}
 
-		if len(filteredPeers) != len(groupInfo.Peers) {
+		if len(filteredPeers) == 0 {
+			delete(*groups, groupID)
+		} else if len(filteredPeers) != len(groupInfo.Peers) {
 			ng := groupInfo.Copy()
 			ng.Peers = filteredPeers
 			(*groups)[groupID] = ng

management/server/types/account_test.go

@@ -666,7 +666,7 @@ func Test_ExpandPortsAndRanges_SSHRuleExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer)
+			result := expandPortsAndRanges(tt.base, tt.rule, tt.peer)
 
 			var ports []string
 			for _, fr := range result {

management/server/types/aliases.go

@@ -1,145 +0,0 @@
-package types
-
-import (
-	"context"
-	"math/rand"
-	"net"
-	"net/netip"
-
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	nbroute "github.com/netbirdio/netbird/route"
-	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
-)
-
-// Type aliases for types relocated to shared/management/types so that the
-// client-side compute path can depend on them
-
-type DNSSettings = sharedtypes.DNSSettings
-
-type FirewallRule = sharedtypes.FirewallRule
-
-type Group = sharedtypes.Group
-type GroupPeer = sharedtypes.GroupPeer
-
-type Network = sharedtypes.Network
-type NetworkMap = sharedtypes.NetworkMap
-type ForwardingRule = sharedtypes.ForwardingRule
-
-type Policy = sharedtypes.Policy
-type PolicyUpdateOperation = sharedtypes.PolicyUpdateOperation
-
-type PolicyRule = sharedtypes.PolicyRule
-type PolicyUpdateOperationType = sharedtypes.PolicyUpdateOperationType
-type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
-type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType
-type PolicyRuleDirection = sharedtypes.PolicyRuleDirection
-type RulePortRange = sharedtypes.RulePortRange
-
-type Resource = sharedtypes.Resource
-type ResourceType = sharedtypes.ResourceType
-
-type RouteFirewallRule = sharedtypes.RouteFirewallRule
-
-type NetworkMapComponents = sharedtypes.NetworkMapComponents
-
-var EmptyNetworkMapComponents = sharedtypes.EmptyNetworkMapComponents
-
-type AccountSettingsInfo = sharedtypes.AccountSettingsInfo
-
-type GroupCompact = sharedtypes.GroupCompact
-type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact
-
-type LookupMap = sharedtypes.LookupMap
-type FirewallRuleContext = sharedtypes.FirewallRuleContext
-
-const (
-	GroupIssuedAPI         = sharedtypes.GroupIssuedAPI
-	GroupIssuedJWT         = sharedtypes.GroupIssuedJWT
-	GroupIssuedIntegration = sharedtypes.GroupIssuedIntegration
-	GroupAllName           = sharedtypes.GroupAllName
-)
-
-// Function forwarders preserve types.X(...) call sites that previously
-// resolved to package-local funcs. Plain forwarders (not var aliases) keep
-// the symbol immutable and allow the inliner to flatten the call.
-
-func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
-	return sharedtypes.PolicyRuleImpliesLegacySSH(rule)
-}
-
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
-	return sharedtypes.ExpandPortsAndRanges(base, rule, peer)
-}
-
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
-	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, rc)
-}
-
-func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkMapComponents) *NetworkMap {
-	return sharedtypes.CalculateNetworkMapFromComponents(ctx, components)
-}
-
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
-	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
-}
-
-func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
-	return sharedtypes.AllocateIPv6Subnet(r)
-}
-
-func NewNetwork() *Network {
-	return sharedtypes.NewNetwork()
-}
-
-func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, error) {
-	return sharedtypes.AllocatePeerIP(prefix, takenIps)
-}
-
-func AllocateRandomPeerIP(prefix netip.Prefix) (netip.Addr, error) {
-	return sharedtypes.AllocateRandomPeerIP(prefix)
-}
-
-func AllocateRandomPeerIPv6(prefix netip.Prefix) (netip.Addr, error) {
-	return sharedtypes.AllocateRandomPeerIPv6(prefix)
-}
-
-func ParseRuleString(rule string) (PolicyRuleProtocolType, RulePortRange, error) {
-	return sharedtypes.ParseRuleString(rule)
-}
-
-const (
-	FirewallRuleDirectionIN  = sharedtypes.FirewallRuleDirectionIN
-	FirewallRuleDirectionOUT = sharedtypes.FirewallRuleDirectionOUT
-)
-
-const (
-	ResourceTypePeer   = sharedtypes.ResourceTypePeer
-	ResourceTypeDomain = sharedtypes.ResourceTypeDomain
-	ResourceTypeHost   = sharedtypes.ResourceTypeHost
-	ResourceTypeSubnet = sharedtypes.ResourceTypeSubnet
-)
-
-const (
-	PolicyTrafficActionAccept = sharedtypes.PolicyTrafficActionAccept
-	PolicyTrafficActionDrop   = sharedtypes.PolicyTrafficActionDrop
-)
-
-const (
-	PolicyRuleProtocolALL        = sharedtypes.PolicyRuleProtocolALL
-	PolicyRuleProtocolTCP        = sharedtypes.PolicyRuleProtocolTCP
-	PolicyRuleProtocolUDP        = sharedtypes.PolicyRuleProtocolUDP
-	PolicyRuleProtocolICMP       = sharedtypes.PolicyRuleProtocolICMP
-	PolicyRuleProtocolNetbirdSSH = sharedtypes.PolicyRuleProtocolNetbirdSSH
-)
-
-const (
-	PolicyRuleFlowDirect   = sharedtypes.PolicyRuleFlowDirect
-	PolicyRuleFlowBidirect = sharedtypes.PolicyRuleFlowBidirect
-)
-
-const (
-	DefaultRuleName          = sharedtypes.DefaultRuleName
-	DefaultRuleDescription   = sharedtypes.DefaultRuleDescription
-	DefaultPolicyName        = sharedtypes.DefaultPolicyName
-	DefaultPolicyDescription = sharedtypes.DefaultPolicyDescription
-)

management/server/types/firewall_rule.go

@@ -47,11 +47,11 @@ func (r *FirewallRule) Equal(other *FirewallRule) bool {
 	return reflect.DeepEqual(r, other)
 }
 
-// GenerateRouteFirewallRules generates a list of firewall rules for a given route.
+// generateRouteFirewallRules generates a list of firewall rules for a given route.
 // For static routes, source ranges match the destination family (v4 or v6).
 // For dynamic routes (domain-based), separate v4 and v6 rules are generated
 // so the routing peer's forwarding chain allows both address families.
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	rulesExists := make(map[string]struct{})
 	rules := make([]*RouteFirewallRule, 0)
 

management/server/types/firewall_rule_test.go

@@ -57,7 +57,7 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 		Protocol: PolicyRuleProtocolALL,
 	}
 
-	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1)
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges, "v4 route should only have v4 sources")
@@ -86,7 +86,7 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 		Protocol: PolicyRuleProtocolALL,
 	}
 
-	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1)
 	assert.Equal(t, []string{"fd00::1/128"}, rules[0].SourceRanges, "v6 route should only have v6 sources")
@@ -115,7 +115,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 		Protocol: PolicyRuleProtocolALL,
 	}
 
-	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 2, "dynamic route should produce both v4 and v6 rules")
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
@@ -143,7 +143,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
 		Protocol: PolicyRuleProtocolALL,
 	}
 
-	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
+	rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
 
 	require.Len(t, rules, 1, "no v6 peers means only v4 rule")
 	assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
@@ -173,7 +173,7 @@ func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
 			Protocol: PolicyRuleProtocolALL,
 		}
 
-		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
+		rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
 		assert.Empty(t, rules, "v6 route should produce no rules when includeIPv6 is false")
 	})
 
@@ -190,7 +190,7 @@ func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
 			Protocol: PolicyRuleProtocolALL,
 		}
 
-		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
+		rules := generateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
 		require.Len(t, rules, 1, "dynamic route with includeIPv6=false should produce only v4 rule")
 		assert.Equal(t, []string{"100.64.0.1/32", "100.64.0.2/32"}, rules[0].SourceRanges)
 	})

management/server/types/group.go

@@ -19,8 +19,6 @@ type Group struct {
 	// AccountID is a reference to Account that this object belongs
 	AccountID string `json:"-" gorm:"index"`
 
-	PublicID string `json:"-"`
-
 	// Name visible in the UI
 	Name string
 
@@ -76,7 +74,6 @@ func (g *Group) Copy() *Group {
 	group := &Group{
 		ID:                   g.ID,
 		AccountID:            g.AccountID,
-		PublicID:             g.PublicID,
 		Name:                 g.Name,
 		Issued:               g.Issued,
 		Peers:                make([]string, len(g.Peers)),