[client] Debug: add process tree and window inventory to GUI memory dumps

The webview runs in child processes whose memory the Go runtime profiles
cannot see, so each snapshot now also records the whole process tree with
RSS/VMS plus PSS and Private_Dirty from smaps_rollup on Linux, and the live
Wails window inventory. Snapshots now run at startup, 2 and 5 minutes.

client/android/client.go

@@ -82,8 +82,6 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
-	// Identifies the running profile for the SSO login hint; see profile_state.go.
-	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -104,12 +102,11 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
-	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -119,16 +116,6 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
-// authSnapshot returns the config together with the path it was loaded from, in
-// one lock: the path identifies the profile whose account email backs the login
-// hint, so reading it separately could pair one profile's config with another's
-// hint when a profile switch lands in between.
-func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
-	c.stateMu.RLock()
-	defer c.stateMu.RUnlock()
-	return c.config, c.cfgPath, c.connectClient
-}
-
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -181,7 +168,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
+	auth := NewAuthWithConfig(ctx, cfg)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -189,7 +176,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -230,7 +217,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 

client/android/login.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -63,14 +61,11 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
-// file the config was loaded from; it identifies the profile whose account email
-// backs the login_hint.
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
 	return &Auth{
-		ctx:     ctx,
-		config:  config,
-		cfgPath: cfgPath,
+		ctx:    ctx,
+		config: config,
 	}
 }
 
@@ -163,14 +158,12 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
-	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
-		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -178,42 +171,17 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Stored after Login, not before: a rejected token must not leave a hint
-	// pointing at an account that cannot be used.
-	if email != "" && a.cfgPath != "" {
-		if err := writeProfileEmail(a.cfgPath, email); err != nil {
-			log.Warnf("failed to store profile account email: %v", err)
-		}
-	}
-
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
-// loginHintSetter is implemented by both concrete flows (PKCE and device code)
-// but absent from the OAuthFlow interface, hence the assertion below — the same
-// way internal/auth wires it in authenticateWithPKCEFlow.
-type loginHintSetter interface {
-	SetLoginHint(hint string)
-}
-
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
-	// leaves the choice to the IdP, which is how accounts get switched.
-	if a.cfgPath != "" {
-		if hint := readProfileEmail(a.cfgPath); hint != "" {
-			if setter, ok := oAuthFlow.(loginHintSetter); ok {
-				setter.SetLoginHint(hint)
-			}
-		}
-	}
-
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/profile_manager.go

@@ -13,17 +13,18 @@ import (
 )
 
 const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID   string
-	Name string
-	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login or was logged out. See profile_state.go.
-	Email    string
+	ID       string
+	Name     string
 	IsActive bool
 }
 
@@ -100,7 +101,6 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
-			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,22 +123,7 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{
-		ID:       prof.ID.String(),
-		Name:     prof.Name,
-		Email:    pm.profileEmail(prof.ID.String()),
-		IsActive: true,
-	}, nil
-}
-
-// profileEmail returns the account email recorded for a profile. Display-only, so
-// an unresolvable path degrades to "" rather than an error.
-func (pm *ProfileManager) profileEmail(id string) string {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return ""
-	}
-	return readProfileEmail(configPath)
+	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
 }
 
 // SwitchProfile switches to a different profile
@@ -200,11 +185,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// Not fatal: a stale hint costs an account switch, not the logout itself.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -1,108 +0,0 @@
-package android
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/util"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// profileAccountSuffix names the file holding the profile's account email.
-	// Deliberately not ".state.json", which desktop uses for the same data:
-	// there the email and the engine's state manager live in different
-	// directories, but on Android both resolve under files/, so sharing the name
-	// would have the two overwrite each other — the state manager rewrites the
-	// whole file from its own keys (see statemanager.Manager.PersistState), and
-	// this package's writer does the same in reverse.
-	profileAccountSuffix = ".account.json"
-)
-
-// profileAccountPathFor derives the account file path from a profile's config
-// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
-//
-// Deriving from the config path rather than resolving the active profile keeps
-// the write on the profile the login actually ran for: Auth.login runs in a
-// goroutine, so the active profile can change under a flow already in flight.
-func profileAccountPathFor(configPath string) (string, error) {
-	if configPath == "" {
-		return "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	stem := strings.TrimSuffix(base, filepath.Ext(base))
-	if stem == "" || stem == "." {
-		return "", fmt.Errorf("config path %q has no filename stem", configPath)
-	}
-
-	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
-}
-
-// readProfileEmail returns the account email stored for the profile whose config
-// lives at configPath. A missing or unreadable file yields "", which leaves the
-// account choice to the IdP.
-func readProfileEmail(configPath string) string {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		log.Debugf("no profile account path for login hint: %v", err)
-		return ""
-	}
-
-	var state profilemanager.ProfileState
-	if _, err := util.ReadJson(accountPath, &state); err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("failed to read profile account for login hint: %v", err)
-		}
-		return ""
-	}
-
-	return state.Email
-}
-
-// writeProfileEmail records the account email for the profile whose config lives
-// at configPath, so later logins can pass it as an OIDC login_hint. An empty
-// email is ignored rather than blanking what is already stored.
-func writeProfileEmail(configPath string, email string) error {
-	if email == "" {
-		return nil
-	}
-
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	state := profilemanager.ProfileState{Email: email}
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
-		return fmt.Errorf("write profile account: %w", err)
-	}
-
-	return nil
-}
-
-// removeProfileEmail drops the stored account email. Called on logout: while the
-// email is on disk it goes out as a login_hint, which would steer the next login
-// straight back into the account just logged out of. Mirrors the desktop UI's
-// RemoveProfileState call.
-func removeProfileEmail(configPath string) error {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("remove profile account: %w", err)
-	}
-
-	return nil
-}

client/android/profile_state_test.go

@@ -1,161 +0,0 @@
-package android
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestProfileAccountPathFor(t *testing.T) {
-	tests := []struct {
-		name       string
-		configPath string
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "default profile",
-			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
-		},
-		{
-			name:       "id profile",
-			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
-		},
-		{
-			name:       "legacy name-keyed profile is handled the same way",
-			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
-		},
-		{
-			name:       "empty path is rejected",
-			configPath: "",
-			wantErr:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := profileAccountPathFor(tt.configPath)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected an error, got path %q", got)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-
-	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
-	if err != nil {
-		t.Fatalf("id profile: %v", err)
-	}
-
-	if defaultAccount == idAccount {
-		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
-	}
-}
-
-// The account file must never land on the engine state file: on Android both
-// resolve under files/, and the state manager rewrites the whole file from its
-// own keys, so sharing a path would have the two overwrite each other. The
-// expected names here mirror ProfileManager.GetStateFilePath.
-func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	cases := []struct {
-		configPath  string
-		engineState string
-	}{
-		{
-			configPath:  filepath.Join(root, defaultConfigFilename),
-			engineState: filepath.Join(root, "state.json"),
-		},
-		{
-			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
-			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
-		},
-	}
-
-	for _, c := range cases {
-		account, err := profileAccountPathFor(c.configPath)
-		if err != nil {
-			t.Fatalf("%s: %v", c.configPath, err)
-		}
-		if account == c.engineState {
-			t.Errorf("account file collides with the engine state file: %q", account)
-		}
-	}
-}
-
-func TestWriteThenReadProfileEmail(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email before a login, got %q", got)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("got %q, want %q", got, email)
-	}
-
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("remove: %v", err)
-	}
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after logout, got %q", got)
-	}
-
-	// Logout may run on a never-logged-in profile, so a second remove must pass.
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("second remove should be a no-op: %v", err)
-	}
-}
-
-func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if err := writeProfileEmail(configPath, ""); err != nil {
-		t.Fatalf("write empty: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
-	}
-}
-
-func ensureDirFor(t *testing.T, path string) error {
-	t.Helper()
-	return os.MkdirAll(filepath.Dir(path), 0o700)
-}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, cfgPath, cc := c.authSnapshot()
+	cfg, _, cc := c.stateSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,10 +293,7 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
-	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	a := &Auth{ctx: ctx, config: cfg}
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/internal/engine.go

@@ -48,7 +48,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -187,7 +186,7 @@ type EngineServices struct {
 type Engine struct {
 	// signal is a Signal Service client
 	signal   signal.Client
-	signaler *signaling.Signaler
+	signaler *peer.Signaler
 	// mgmClient is a Management Service client
 	mgmClient mgm.Client
 	// peerConns is a map that holds all the peers that are known to this peer
@@ -330,7 +329,7 @@ func NewEngine(
 		ctx:                ctx,
 		cancel:             cancel,
 		signal:             services.SignalClient,
-		signaler:           signaling.NewSignaler(services.SignalClient, config.WgPrivateKey),
+		signaler:           peer.NewSignaler(services.SignalClient, config.WgPrivateKey),
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
@@ -2816,7 +2815,7 @@ func createFile(path string) error {
 	return file.Close()
 }
 
-func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
+func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 	remoteCred, err := signal.UnMarshalCredential(msg)
 	if err != nil {
 		return nil, err
@@ -2832,9 +2831,9 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 	}
 
 	// Handle optional SessionID
-	var sessionID *icemaker.SessionID
+	var sessionID *peer.ICESessionID
 	if sessionBytes := msg.GetBody().GetSessionId(); sessionBytes != nil {
-		if id, err := icemaker.SessionIDFromBytes(sessionBytes); err != nil {
+		if id, err := peer.ICESessionIDFromBytes(sessionBytes); err != nil {
 			log.Warnf("Invalid session ID in message: %v", err)
 			sessionID = nil // Set to nil if conversion fails
 		} else {
@@ -2844,8 +2843,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	offerAnswer := peer.OfferAnswer{
+		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
 			Pwd:   remoteCred.Pwd,
 		},

client/internal/peer/conn_status.go

@@ -1,5 +1,18 @@
 package peer
 
+import (
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// StatusIdle indicate the peer is in disconnected state
+	StatusIdle ConnStatus = iota
+	// StatusConnecting indicate the peer is in connecting state
+	StatusConnecting
+	// StatusConnected indicate the peer is in connected state
+	StatusConnected
+)
+
 // connStatusInputs is the primitive-valued snapshot of the state that drives the
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
@@ -8,7 +21,24 @@ type connStatusInputs struct {
 	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
 	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
 	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local ICE worker exists (false in force-relay mode)
+	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
 	iceStatusConnecting bool // statusICE is anything other than Disconnected
 	iceInProgress       bool // a negotiation is currently in flight
 }
+
+// ConnStatus describe the status of a peer's connection
+type ConnStatus int32
+
+func (s ConnStatus) String() string {
+	switch s {
+	case StatusConnecting:
+		return "Connecting"
+	case StatusConnected:
+		return "Connected"
+	case StatusIdle:
+		return "Idle"
+	default:
+		log.Errorf("unknown status: %d", s)
+		return "INVALID_PEER_CONNECTION_STATUS"
+	}
+}

client/internal/peer/conn_status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"testing"

client/internal/peer/conn_test.go

@@ -3,33 +3,28 @@ package peer
 import (
 	"context"
 	"fmt"
-	"net/netip"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/metricsstages"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
 
+var testDispatcher = dispatcher.NewConnectionDispatcher()
+
 var connConf = ConnConfig{
 	Key:         "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	LocalKey:    "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	Timeout:     time.Second,
 	LocalWgPort: 51820,
-	WgConfig: WgConfig{
-		AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-	},
 	ICEConfig: ice.Config{
 		InterfaceBlackList: nil,
 	},
@@ -57,37 +52,92 @@ func TestConn_GetKey(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 
 	sd := ServiceDependencies{
-		SrWatcher: swWatcher,
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
 	got := conn.GetKey()
 
 	assert.Equal(t, got, connConf.Key, "they should be equal")
 }
 
-// TestConn_DiscardMessagesWhenNotOpened: signal messages posted to a not yet
-// opened connection must be discarded without blocking or panicking.
-func TestConn_DiscardMessagesWhenNotOpened(t *testing.T) {
+func TestConn_OnRemoteOffer(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 	sd := ServiceDependencies{
-		StatusRecorder: status.NewRecorder("https://mgm"),
-		SrWatcher:      swWatcher,
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteOffer(OfferAnswer{
+		IceCredentials: IceCredentials{
 			UFrag: "test",
 			Pwd:   "test",
 		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
+	}
+}
+
+func TestConn_OnRemoteAnswer(t *testing.T) {
+	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
+	sd := ServiceDependencies{
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
+	}
+	conn, err := NewConn(connConf, sd)
+	if err != nil {
+		return
+	}
+
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteAnswer(OfferAnswer{
+		IceCredentials: IceCredentials{
+			UFrag: "test",
+			Pwd:   "test",
+		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
 	}
-	conn.OnRemoteOffer(offerAnswer)
-	conn.OnRemoteAnswer(offerAnswer)
-	conn.OnRemoteCandidate(nil, nil)
-	conn.Close(false)
 }
 
 func TestConn_presharedKey(t *testing.T) {
@@ -270,7 +320,7 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		ctx:           context.Background(),
 		config:        cfg,
 		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &metricsstages.MetricsStages{},
+		metricsStages: &MetricsStages{},
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)
@@ -289,20 +339,20 @@ func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
 		"reaching the threshold must report the peer disconnected once")
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
 }
 
@@ -314,12 +364,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
-	conn.handleWGCheckSuccess()
+	conn.onWGCheckSuccess()
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
 }
@@ -327,30 +377,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 // TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
 // there is no per-peer key state to reset; repeated timeouts must not report
 // disconnects.
-func TestConn_handleEvent_DropsStaleWGTimeout(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	staleCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-	for i := 0; i < wgTimeoutEscalationThreshold; i++ {
-		conn.handleEvent(evWGTimeout{ctx: staleCtx})
-	}
-	assert.Empty(t, disconnected, "timeouts from a cancelled watcher must be dropped")
-
-	liveCtx := context.Background()
-	for i := 0; i < wgTimeoutEscalationThreshold; i++ {
-		conn.handleEvent(evWGTimeout{ctx: liveCtx})
-	}
-	assert.Len(t, disconnected, 1, "timeouts from the live watcher must be dispatched")
-}
-
 func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	var disconnected []string
 	conn := newWGTimeoutTestConn(false, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }

client/internal/peer/conntype/priority.go

@@ -1,4 +1,4 @@
-package worker
+package conntype
 
 import (
 	"fmt"

client/internal/peer/dispatcher/dispatcher.go

@@ -0,0 +1,52 @@
+package dispatcher
+
+import (
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/peer/id"
+)
+
+type ConnectionListener struct {
+	OnConnected    func(peerID id.ConnID)
+	OnDisconnected func(peerID id.ConnID)
+}
+
+type ConnectionDispatcher struct {
+	listeners map[*ConnectionListener]struct{}
+	mu        sync.Mutex
+}
+
+func NewConnectionDispatcher() *ConnectionDispatcher {
+	return &ConnectionDispatcher{
+		listeners: make(map[*ConnectionListener]struct{}),
+	}
+}
+
+func (e *ConnectionDispatcher) AddListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.listeners[listener] = struct{}{}
+}
+
+func (e *ConnectionDispatcher) RemoveListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	delete(e.listeners, listener)
+}
+
+func (e *ConnectionDispatcher) NotifyConnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnConnected(peerConnID)
+	}
+}
+
+func (e *ConnectionDispatcher) NotifyDisconnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnDisconnected(peerConnID)
+	}
+}

client/internal/peer/event.go

@@ -1,83 +0,0 @@
-package peer
-
-import (
-	"context"
-	"time"
-
-	"github.com/pion/ice/v4"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/worker"
-	"github.com/netbirdio/netbird/route"
-)
-
-// event is a message processed by the Conn event loop. All mutable Conn state
-// is owned by that loop; producers deliver events through the mailbox and
-// never mutate Conn state directly.
-type event any
-
-// staleableEvent is implemented by events tied to the lifetime of a transport
-// component (WG watcher, ICE agent, relay connection). Each such component runs
-// under its own context, cancelled when the component is superseded; an event
-// carrying a cancelled context is dropped at dispatch time. A cancel performed
-// by an earlier event in the same drained batch already suppresses it.
-type staleableEvent interface {
-	isStale() bool
-}
-
-// evClose asks the event loop to tear down the connection. done is closed
-// once the teardown finished.
-type evClose struct {
-	signalToRemote bool
-	done           chan struct{}
-}
-
-type evRemoteOffer struct {
-	offer signaling.OfferAnswer
-}
-
-type evRemoteAnswer struct {
-	answer signaling.OfferAnswer
-}
-
-type evRemoteCandidate struct {
-	candidate ice.Candidate
-	haRoutes  route.HAMap
-}
-
-type evICEReady struct {
-	priority worker.ConnPriority
-	info     worker.ICEConnInfo
-}
-
-type evICEDown struct {
-	sessionChanged bool
-}
-
-type evRelayReady struct {
-	info worker.RelayConnInfo
-}
-
-type evRelayDown struct{}
-
-// evRelayDialDone reports that the relay dial helper goroutine finished,
-// successfully or not, so the loop may dispatch a pending offer.
-type evRelayDialDone struct{}
-
-type evWGTimeout struct {
-	ctx context.Context
-}
-
-func (e evWGTimeout) isStale() bool { return e.ctx.Err() != nil }
-
-// evWGHandshake reports the first WireGuard handshake of the current watcher run.
-type evWGHandshake struct {
-	when time.Time
-}
-
-// evWGCheckOK reports a watcher check that observed a fresh handshake,
-// including handshakes of connections that were already up.
-type evWGCheckOK struct{}
-
-// evGuardTick asks the loop to send a new offer to restore connectivity.
-type evGuardTick struct{}

client/internal/peer/guard/ice_monitor.go

@@ -21,6 +21,8 @@ const (
 )
 
 type ICEMonitor struct {
+	ReconnectCh chan struct{}
+
 	iFaceDiscover stdnet.ExternalIFaceDiscover
 	iceConfig     icemaker.Config
 	tickerPeriod  time.Duration
@@ -32,6 +34,7 @@ type ICEMonitor struct {
 func NewICEMonitor(iFaceDiscover stdnet.ExternalIFaceDiscover, config icemaker.Config, period time.Duration) *ICEMonitor {
 	log.Debugf("prepare ICE monitor with period: %s", period)
 	cm := &ICEMonitor{
+		ReconnectCh:   make(chan struct{}, 1),
 		iFaceDiscover: iFaceDiscover,
 		iceConfig:     config,
 		tickerPeriod:  period,

client/internal/peer/handshaker.go

@@ -0,0 +1,246 @@
+package peer
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+var (
+	ErrSignalIsNotReady = errors.New("signal is not ready")
+)
+
+// IceCredentials ICE protocol credentials struct
+type IceCredentials struct {
+	UFrag string
+	Pwd   string
+}
+
+// OfferAnswer represents a session establishment offer or answer
+type OfferAnswer struct {
+	IceCredentials IceCredentials
+	// WgListenPort is a remote WireGuard listen port.
+	// This field is used when establishing a direct WireGuard connection without any proxy.
+	// We can set the remote peer's endpoint with this port.
+	WgListenPort int
+
+	// Version of NetBird Agent
+	Version string
+	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
+	// This value is the local Rosenpass server public key when sending the message
+	RosenpassPubKey []byte
+	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
+	// This value is the local Rosenpass server address when sending the message
+	RosenpassAddr string
+
+	// relay server address
+	RelaySrvAddress string
+	// RelaySrvIP is the IP the remote peer is connected to on its
+	// relay server. Used as a dial target if DNS for RelaySrvAddress
+	// fails. Zero value if the peer did not advertise an IP.
+	RelaySrvIP netip.Addr
+	// SessionID is the unique identifier of the session, used to discard old messages
+	SessionID *ICESessionID
+}
+
+func (o *OfferAnswer) hasICECredentials() bool {
+	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
+}
+
+type Handshaker struct {
+	mu            sync.Mutex
+	log           *log.Entry
+	config        ConnConfig
+	signaler      *Signaler
+	ice           *WorkerICE
+	relay         *WorkerRelay
+	metricsStages *MetricsStages
+	// relayListener is not blocking because the listener is using a goroutine to process the messages
+	// and it will only keep the latest message if multiple offers are received in a short time
+	// this is to avoid blocking the handshaker if the listener is doing some heavy processing
+	// and also to avoid processing old offers if multiple offers are received in a short time
+	// the listener will always process the latest offer
+	relayListener *AsyncOfferListener
+	iceListener   func(remoteOfferAnswer *OfferAnswer)
+
+	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
+	// When false, the local side skips ICE listener dispatch and suppresses ICE credentials in responses.
+	remoteICESupported atomic.Bool
+
+	// remoteOffersCh is a channel used to wait for remote credentials to proceed with the connection
+	remoteOffersCh chan OfferAnswer
+	// remoteAnswerCh is a channel used to wait for remote credentials answer (confirmation of our offer) to proceed with the connection
+	remoteAnswerCh chan OfferAnswer
+}
+
+func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
+	h := &Handshaker{
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
+	}
+	// assume remote supports ICE until we learn otherwise from received offers
+	h.remoteICESupported.Store(ice != nil)
+	return h
+}
+
+func (h *Handshaker) RemoteICESupported() bool {
+	return h.remoteICESupported.Load()
+}
+
+func (h *Handshaker) AddRelayListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.relayListener = NewAsyncOfferListener(offer)
+}
+
+func (h *Handshaker) AddICEListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.iceListener = offer
+}
+
+func (h *Handshaker) Listen(ctx context.Context) {
+	for {
+		select {
+		case remoteOfferAnswer := <-h.remoteOffersCh:
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+
+			if err := h.sendAnswer(); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
+		case remoteOfferAnswer := <-h.remoteAnswerCh:
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+		case <-ctx.Done():
+			h.log.Infof("stop listening for remote offers and answers")
+			return
+		}
+	}
+}
+
+func (h *Handshaker) SendOffer() error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.sendOffer()
+}
+
+// OnRemoteOffer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteOffer(offer OfferAnswer) {
+	select {
+	case h.remoteOffersCh <- offer:
+		return
+	default:
+		h.log.Warnf("skipping remote offer message because receiver not ready")
+		// connection might not be ready yet to receive so we ignore the message
+		return
+	}
+}
+
+// OnRemoteAnswer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteAnswer(answer OfferAnswer) {
+	select {
+	case h.remoteAnswerCh <- answer:
+		return
+	default:
+		// connection might not be ready yet to receive so we ignore the message
+		h.log.Warnf("skipping remote answer message because receiver not ready")
+		return
+	}
+}
+
+// sendOffer prepares local user credentials and signals them to the remote peer
+func (h *Handshaker) sendOffer() error {
+	if !h.signaler.Ready() {
+		return ErrSignalIsNotReady
+	}
+
+	offer := h.buildOfferAnswer()
+	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+
+	return h.signaler.SignalOffer(offer, h.config.Key)
+}
+
+func (h *Handshaker) sendAnswer() error {
+	answer := h.buildOfferAnswer()
+	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+
+	return h.signaler.SignalAnswer(answer, h.config.Key)
+}
+
+func (h *Handshaker) buildOfferAnswer() OfferAnswer {
+	answer := OfferAnswer{
+		WgListenPort:    h.config.LocalWgPort,
+		Version:         version.NetbirdVersion(),
+		RosenpassPubKey: h.config.RosenpassConfig.PubKey,
+		RosenpassAddr:   h.config.RosenpassConfig.Addr,
+	}
+
+	if h.ice != nil && h.RemoteICESupported() {
+		uFrag, pwd := h.ice.GetLocalUserCredentials()
+		sid := h.ice.SessionID()
+		answer.IceCredentials = IceCredentials{uFrag, pwd}
+		answer.SessionID = &sid
+	}
+
+	if addr, ip, err := h.relay.RelayInstanceAddress(); err == nil {
+		answer.RelaySrvAddress = addr
+		answer.RelaySrvIP = ip
+	}
+
+	return answer
+}
+
+func (h *Handshaker) updateRemoteICEState(offer *OfferAnswer) {
+	hasICE := offer.hasICECredentials()
+	prev := h.remoteICESupported.Swap(hasICE)
+	if prev != hasICE {
+		if hasICE {
+			h.log.Infof("remote peer started sending ICE credentials")
+		} else {
+			h.log.Infof("remote peer stopped sending ICE credentials")
+			if h.ice != nil {
+				h.ice.Close()
+			}
+		}
+	}
+}

client/internal/peer/handshaker_listener.go

@@ -0,0 +1,62 @@
+package peer
+
+import (
+	"sync"
+)
+
+type callbackFunc func(remoteOfferAnswer *OfferAnswer)
+
+func (oa *OfferAnswer) SessionIDString() string {
+	if oa.SessionID == nil {
+		return "unknown"
+	}
+	return oa.SessionID.String()
+}
+
+type AsyncOfferListener struct {
+	fn      callbackFunc
+	running bool
+	latest  *OfferAnswer
+	mu      sync.Mutex
+}
+
+func NewAsyncOfferListener(fn callbackFunc) *AsyncOfferListener {
+	return &AsyncOfferListener{
+		fn: fn,
+	}
+}
+
+func (o *AsyncOfferListener) Notify(remoteOfferAnswer *OfferAnswer) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	// Store the latest offer
+	o.latest = remoteOfferAnswer
+
+	// If already running, the running goroutine will pick up this latest value
+	if o.running {
+		return
+	}
+
+	// Start processing
+	o.running = true
+
+	// Process in a goroutine to avoid blocking the caller
+	go func(remoteOfferAnswer *OfferAnswer) {
+		for {
+			o.fn(remoteOfferAnswer)
+
+			o.mu.Lock()
+			if o.latest == nil {
+				// No more work to do
+				o.running = false
+				o.mu.Unlock()
+				return
+			}
+			remoteOfferAnswer = o.latest
+			// Clear the latest to mark it as being processed
+			o.latest = nil
+			o.mu.Unlock()
+		}
+	}(remoteOfferAnswer)
+}

client/internal/peer/handshaker_listener_test.go

@@ -0,0 +1,39 @@
+package peer
+
+import (
+	"testing"
+	"time"
+)
+
+func Test_newOfferListener(t *testing.T) {
+	dummyOfferAnswer := &OfferAnswer{}
+	runChan := make(chan struct{}, 10)
+
+	longRunningFn := func(remoteOfferAnswer *OfferAnswer) {
+		time.Sleep(1 * time.Second)
+		runChan <- struct{}{}
+	}
+
+	hl := NewAsyncOfferListener(longRunningFn)
+
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+
+	// Wait for exactly 2 callbacks
+	for i := 0; i < 2; i++ {
+		select {
+		case <-runChan:
+		case <-time.After(3 * time.Second):
+			t.Fatal("Timeout waiting for callback")
+		}
+	}
+
+	// Verify no additional callbacks happen
+	select {
+	case <-runChan:
+		t.Fatal("Unexpected additional callback")
+	case <-time.After(100 * time.Millisecond):
+		t.Log("Correctly received exactly 2 callbacks")
+	}
+}

client/internal/peer/iface.go

@@ -0,0 +1,22 @@
+package peer
+
+import (
+	"net"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+type WGIface interface {
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	RemovePeer(peerKey string) error
+	GetStats() (map[string]configurer.WGStats, error)
+	GetProxy() wgproxy.Proxy
+	Address() wgaddr.Address
+	RemoveEndpointAddress(key string) error
+}

client/internal/peer/listener.go

@@ -0,0 +1,11 @@
+package peer
+
+// Listener is a callback type about the NetBird network connection state
+type Listener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}

client/internal/peer/mailbox.go

@@ -1,116 +0,0 @@
-package peer
-
-import (
-	"sync"
-)
-
-// maxQueuedCandidates bounds the remote candidate queue; on overflow the
-// oldest candidate is dropped. Lost candidates are recovered by the next
-// offer exchange triggered by the guard.
-const maxQueuedCandidates = 128
-
-// mailbox is the coalescing inbox of the Conn event loop. Posting never
-// blocks. Per message kind either the latest value wins (offer, answer,
-// guard tick), the values queue in bounded FIFO order (candidates) or in
-// unbounded FIFO order (lifecycle and transport state changes, which are
-// low-volume and must not be lost). A new offer flushes the queued
-// candidates because they belong to the superseded session.
-type mailbox struct {
-	mu     sync.Mutex
-	closed bool
-
-	lifecycle  []event
-	transport  []event
-	offer      *evRemoteOffer
-	answer     *evRemoteAnswer
-	candidates []evRemoteCandidate
-	guardTick  bool
-
-	wake chan struct{}
-}
-
-func newMailbox() *mailbox {
-	return &mailbox{
-		wake: make(chan struct{}, 1),
-	}
-}
-
-// post stores the event and wakes the loop. It reports false if the mailbox
-// is already closed and the event was not accepted.
-func (m *mailbox) post(ev event) bool {
-	m.mu.Lock()
-	if m.closed {
-		m.mu.Unlock()
-		return false
-	}
-
-	switch e := ev.(type) {
-	case evClose:
-		m.lifecycle = append(m.lifecycle, e)
-	case evRemoteOffer:
-		m.offer = &e
-		m.candidates = nil
-	case evRemoteAnswer:
-		m.answer = &e
-	case evRemoteCandidate:
-		if len(m.candidates) >= maxQueuedCandidates {
-			m.candidates = m.candidates[1:]
-		}
-		m.candidates = append(m.candidates, e)
-	case evGuardTick:
-		m.guardTick = true
-	default:
-		m.transport = append(m.transport, ev)
-	}
-	m.mu.Unlock()
-
-	select {
-	case m.wake <- struct{}{}:
-	default:
-	}
-	return true
-}
-
-// drain returns the pending events in processing order: lifecycle first,
-// then transport state changes, the coalesced offer and answer, the queued
-// candidates and finally the guard tick.
-func (m *mailbox) drain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.drainLocked()
-}
-
-// closeAndDrain marks the mailbox closed so further posts are rejected and
-// returns the events that were still pending.
-func (m *mailbox) closeAndDrain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.closed = true
-	return m.drainLocked()
-}
-
-func (m *mailbox) drainLocked() []event {
-	evs := make([]event, 0, len(m.lifecycle)+len(m.transport)+len(m.candidates)+3)
-	evs = append(evs, m.lifecycle...)
-	evs = append(evs, m.transport...)
-	if m.offer != nil {
-		evs = append(evs, *m.offer)
-	}
-	if m.answer != nil {
-		evs = append(evs, *m.answer)
-	}
-	for _, c := range m.candidates {
-		evs = append(evs, c)
-	}
-	if m.guardTick {
-		evs = append(evs, evGuardTick{})
-	}
-
-	m.lifecycle = nil
-	m.transport = nil
-	m.offer = nil
-	m.answer = nil
-	m.candidates = nil
-	m.guardTick = false
-	return evs
-}

client/internal/peer/mailbox_test.go

@@ -1,128 +0,0 @@
-package peer
-
-import (
-	"testing"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMailbox_OfferCoalescing(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 1}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 2}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 3}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "consecutive offers must coalesce to a single event")
-	offer, ok := evs[0].(evRemoteOffer)
-	require.True(t, ok, "coalesced event must be an offer")
-	assert.Equal(t, 3, offer.offer.WgListenPort, "the newest offer must win")
-}
-
-func TestMailbox_OfferFlushesCandidates(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "candidates of the superseded session must be flushed")
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "only the offer must remain after the flush")
-}
-
-func TestMailbox_CandidatesKeepOrderAfterOffer(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 3)
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "offer must be processed before the candidates")
-	for _, ev := range evs[1:] {
-		_, ok := ev.(evRemoteCandidate)
-		assert.True(t, ok, "candidates posted after the offer must survive")
-	}
-}
-
-func TestMailbox_CandidateQueueBounded(t *testing.T) {
-	mb := newMailbox()
-
-	for i := 0; i < maxQueuedCandidates+10; i++ {
-		require.True(t, mb.post(evRemoteCandidate{}))
-	}
-
-	evs := mb.drain()
-	assert.Len(t, evs, maxQueuedCandidates, "candidate queue must stay bounded")
-}
-
-func TestMailbox_DrainOrder(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evRemoteAnswer{answer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evICEDown{sessionChanged: true}))
-	require.True(t, mb.post(evClose{}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 6)
-
-	_, ok := evs[0].(evClose)
-	assert.True(t, ok, "lifecycle events must come first")
-	_, ok = evs[1].(evRelayDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[2].(evICEDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[3].(evRemoteOffer)
-	assert.True(t, ok, "offer must come after transport events")
-	_, ok = evs[4].(evRemoteAnswer)
-	assert.True(t, ok, "answer must come after the offer")
-	_, ok = evs[5].(evGuardTick)
-	assert.True(t, ok, "guard tick must come last")
-}
-
-func TestMailbox_GuardTickCoalesced(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	evs := mb.drain()
-	assert.Len(t, evs, 1, "guard ticks must coalesce to a single event")
-}
-
-func TestMailbox_PostAfterCloseRejected(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	leftovers := mb.closeAndDrain()
-	assert.Len(t, leftovers, 1, "pending events must be returned on close")
-
-	assert.False(t, mb.post(evRelayDown{}), "posts must be rejected after close")
-	assert.Empty(t, mb.drain(), "no events must remain after close")
-}
-
-func TestMailbox_WakeSignal(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	select {
-	case <-mb.wake:
-	default:
-		t.Fatal("wake signal must be pending after posts")
-	}
-
-	assert.Len(t, mb.drain(), 2, "a single wake must deliver all pending events")
-}

client/internal/peer/metrics_saver.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"sync"

client/internal/peer/metrics_saver_test.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"testing"

client/internal/peer/notifier.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"
@@ -11,16 +11,6 @@ const (
 	stateDisconnecting
 )
 
-// Listener is a callback type about the NetBird network connection state
-type Listener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
 type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex

client/internal/peer/notifier_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"

client/internal/peer/route.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"net/netip"

client/internal/peer/session_id.go

@@ -1,4 +1,4 @@
-package ice
+package peer
 
 import (
 	"crypto/rand"
@@ -9,26 +9,26 @@ import (
 
 const sessionIDSize = 5
 
-type SessionID string
+type ICESessionID string
 
-// NewSessionID generates a new session ID for distinguishing sessions
-func NewSessionID() (SessionID, error) {
+// NewICESessionID generates a new session ID for distinguishing sessions
+func NewICESessionID() (ICESessionID, error) {
 	b := make([]byte, sessionIDSize)
 	if _, err := io.ReadFull(rand.Reader, b); err != nil {
 		return "", fmt.Errorf("failed to generate session ID: %w", err)
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
-func SessionIDFromBytes(b []byte) (SessionID, error) {
+func ICESessionIDFromBytes(b []byte) (ICESessionID, error) {
 	if len(b) != sessionIDSize {
 		return "", fmt.Errorf("invalid session ID length: %d", len(b))
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
 // Bytes returns the raw bytes of the session ID for protobuf serialization
-func (id SessionID) Bytes() ([]byte, error) {
+func (id ICESessionID) Bytes() ([]byte, error) {
 	if len(id) == 0 {
 		return nil, fmt.Errorf("ICE session ID is empty")
 	}
@@ -42,6 +42,6 @@ func (id SessionID) Bytes() ([]byte, error) {
 	return b, nil
 }
 
-func (id SessionID) String() string {
+func (id ICESessionID) String() string {
 	return string(id)
 }

client/internal/peer/signaler.go

@@ -1,4 +1,4 @@
-package signaling
+package peer
 
 import (
 	"github.com/pion/ice/v4"

client/internal/peer/signaling/handshaker.go

@@ -1,189 +0,0 @@
-package signaling
-
-import (
-	"errors"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-
-	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/version"
-)
-
-var (
-	ErrSignalIsNotReady = errors.New("signal is not ready")
-)
-
-// IceCredentials ICE protocol credentials struct
-type IceCredentials struct {
-	UFrag string
-	Pwd   string
-}
-
-// OfferAnswer represents a session establishment offer or answer
-type OfferAnswer struct {
-	IceCredentials IceCredentials
-	// WgListenPort is a remote WireGuard listen port.
-	// This field is used when establishing a direct WireGuard connection without any proxy.
-	// We can set the remote peer's endpoint with this port.
-	WgListenPort int
-
-	// Version of NetBird Agent
-	Version string
-	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
-	// This value is the local Rosenpass server public key when sending the message
-	RosenpassPubKey []byte
-	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
-	// This value is the local Rosenpass server address when sending the message
-	RosenpassAddr string
-
-	// relay server address
-	RelaySrvAddress string
-	// RelaySrvIP is the IP the remote peer is connected to on its
-	// relay server. Used as a dial target if DNS for RelaySrvAddress
-	// fails. Zero value if the peer did not advertise an IP.
-	RelaySrvIP netip.Addr
-	// SessionID is the unique identifier of the session, used to discard old messages
-	SessionID *icemaker.SessionID
-}
-
-func (o *OfferAnswer) HasICECredentials() bool {
-	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
-}
-
-func (o *OfferAnswer) SessionIDString() string {
-	if o.SessionID == nil {
-		return "unknown"
-	}
-	return o.SessionID.String()
-}
-
-// Config carries the peer-specific values the Handshaker embeds into offers
-// and answers.
-type Config struct {
-	Key             string
-	LocalWgPort     int
-	RosenpassPubKey []byte
-	RosenpassAddr   string
-}
-
-// Credentials are the local ICE credentials and session id the Handshaker embeds in offers.
-type Credentials struct {
-	UFrag     string
-	Pwd       string
-	SessionID icemaker.SessionID
-}
-
-// ICEWorker is the subset of the ICE worker the Handshaker needs to build offers.
-type ICEWorker interface {
-	Credentials() Credentials
-	Close()
-}
-
-// Handshaker keeps the signaling protocol logic: building and sending offers
-// and answers and tracking whether the remote peer supports ICE. Incoming
-// message processing is driven by the Conn event loop.
-type Handshaker struct {
-	mu           sync.Mutex
-	log          *log.Entry
-	config       Config
-	signaler     *Signaler
-	ice          ICEWorker
-	relayManager *relayClient.Manager
-
-	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
-	// When false, the local side skips ICE dispatch and suppresses ICE credentials in responses.
-	remoteICESupported atomic.Bool
-}
-
-func NewHandshaker(log *log.Entry, config Config, signaler *Signaler, ice ICEWorker, relayManager *relayClient.Manager) *Handshaker {
-	h := &Handshaker{
-		log:          log,
-		config:       config,
-		signaler:     signaler,
-		ice:          ice,
-		relayManager: relayManager,
-	}
-	// assume remote supports ICE until we learn otherwise from received offers
-	h.remoteICESupported.Store(ice != nil)
-	return h
-}
-
-func (h *Handshaker) RemoteICESupported() bool {
-	return h.remoteICESupported.Load()
-}
-
-func (h *Handshaker) SendOffer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendOffer()
-}
-
-func (h *Handshaker) SendAnswer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendAnswer()
-}
-
-// sendOffer prepares local user credentials and signals them to the remote peer
-func (h *Handshaker) sendOffer() error {
-	if !h.signaler.Ready() {
-		return ErrSignalIsNotReady
-	}
-
-	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
-
-	return h.signaler.SignalOffer(offer, h.config.Key)
-}
-
-func (h *Handshaker) sendAnswer() error {
-	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
-
-	return h.signaler.SignalAnswer(answer, h.config.Key)
-}
-
-func (h *Handshaker) buildOfferAnswer() OfferAnswer {
-	answer := OfferAnswer{
-		WgListenPort:    h.config.LocalWgPort,
-		Version:         version.NetbirdVersion(),
-		RosenpassPubKey: h.config.RosenpassPubKey,
-		RosenpassAddr:   h.config.RosenpassAddr,
-	}
-
-	if h.ice != nil && h.RemoteICESupported() {
-		creds := h.ice.Credentials()
-		answer.IceCredentials = IceCredentials{creds.UFrag, creds.Pwd}
-		sid := creds.SessionID
-		answer.SessionID = &sid
-	}
-
-	if addr, ip, err := h.relayManager.RelayInstanceAddress(); err == nil {
-		answer.RelaySrvAddress = addr
-		answer.RelaySrvIP = ip
-	}
-
-	return answer
-}
-
-// UpdateRemoteICEState refreshes the remote ICE support flag from a received
-// offer or answer and closes the ICE worker when the remote peer stopped
-// sending ICE credentials. Runs on the Conn event loop.
-func (h *Handshaker) UpdateRemoteICEState(offer *OfferAnswer) {
-	hasICE := offer.HasICECredentials()
-	prev := h.remoteICESupported.Swap(hasICE)
-	if prev != hasICE {
-		if hasICE {
-			h.log.Infof("remote peer started sending ICE credentials")
-		} else {
-			h.log.Infof("remote peer stopped sending ICE credentials")
-			if h.ice != nil {
-				h.ice.Close()
-			}
-		}
-	}
-}

client/internal/peer/state_dump.go

@@ -1,4 +1,4 @@
-package state_dump
+package peer
 
 import (
 	"context"
@@ -6,13 +6,11 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
-type StateDump struct {
+type stateDump struct {
 	log    *log.Entry
-	status *status.Recorder
+	status *Status
 	key    string
 
 	sentOffer       int
@@ -28,15 +26,15 @@ type StateDump struct {
 	mu sync.Mutex
 }
 
-func NewStateDump(key string, log *log.Entry, statusRecorder *status.Recorder) *StateDump {
-	return &StateDump{
+func newStateDump(key string, log *log.Entry, statusRecorder *Status) *stateDump {
+	return &stateDump{
 		log:    log,
 		status: statusRecorder,
 		key:    key,
 	}
 }
 
-func (s *StateDump) Start(ctx context.Context) {
+func (s *stateDump) Start(ctx context.Context) {
 	ticker := time.NewTicker(10 * time.Minute)
 	defer ticker.Stop()
 
@@ -50,25 +48,25 @@ func (s *StateDump) Start(ctx context.Context) {
 	}
 }
 
-func (s *StateDump) RemoteOffer() {
+func (s *stateDump) RemoteOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteOffer++
 }
 
-func (s *StateDump) RemoteCandidate() {
+func (s *stateDump) RemoteCandidate() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteCandidate++
 }
 
-func (s *StateDump) SendOffer() {
+func (s *stateDump) SendOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.sentOffer++
 }
 
-func (s *StateDump) dumpState() {
+func (s *stateDump) dumpState() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -82,41 +80,41 @@ func (s *StateDump) dumpState() {
 		status, s.sentOffer, s.remoteOffer, s.remoteAnswer, s.remoteCandidate, s.p2pConnected, s.switchToRelay, s.wgCheckSuccess, s.relayConnected, s.localProxies)
 }
 
-func (s *StateDump) RemoteAnswer() {
+func (s *stateDump) RemoteAnswer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteAnswer++
 }
 
-func (s *StateDump) P2PConnected() {
+func (s *stateDump) P2PConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.p2pConnected++
 }
 
-func (s *StateDump) SwitchToRelay() {
+func (s *stateDump) SwitchToRelay() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.switchToRelay++
 }
 
-func (s *StateDump) WGcheckSuccess() {
+func (s *stateDump) WGcheckSuccess() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.wgCheckSuccess++
 }
 
-func (s *StateDump) RelayConnected() {
+func (s *stateDump) RelayConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.relayConnected++
 }
 
-func (s *StateDump) NewLocalProxy() {
+func (s *stateDump) NewLocalProxy() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 

client/internal/peer/status/conn_status.go

@@ -1,31 +0,0 @@
-package status
-
-import (
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// StatusIdle indicate the peer is in disconnected state
-	StatusIdle ConnStatus = iota
-	// StatusConnecting indicate the peer is in connecting state
-	StatusConnecting
-	// StatusConnected indicate the peer is in connected state
-	StatusConnected
-)
-
-// ConnStatus describe the status of a peer's connection
-type ConnStatus int32
-
-func (s ConnStatus) String() string {
-	switch s {
-	case StatusConnecting:
-		return "Connecting"
-	case StatusConnected:
-		return "Connected"
-	case StatusIdle:
-		return "Idle"
-	default:
-		log.Errorf("unknown status: %d", s)
-		return "INVALID_PEER_CONNECTION_STATUS"
-	}
-}

client/internal/peer/status/events.go

@@ -1,48 +0,0 @@
-package status
-
-import (
-	"slices"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type EventQueue struct {
-	maxSize int
-	events  []*proto.SystemEvent
-	mutex   sync.RWMutex
-}
-
-func NewEventQueue(size int) *EventQueue {
-	return &EventQueue{
-		maxSize: size,
-		events:  make([]*proto.SystemEvent, 0, size),
-	}
-}
-
-func (q *EventQueue) Add(event *proto.SystemEvent) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.events = append(q.events, event)
-
-	if len(q.events) > q.maxSize {
-		q.events = q.events[len(q.events)-q.maxSize:]
-	}
-}
-
-func (q *EventQueue) GetAll() []*proto.SystemEvent {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return slices.Clone(q.events)
-}
-
-type EventSubscription struct {
-	id     string
-	events chan *proto.SystemEvent
-}
-
-func (s *EventSubscription) Events() <-chan *proto.SystemEvent {
-	return s.events
-}

client/internal/peer/status/full_status.go

@@ -1,122 +0,0 @@
-package status
-
-import (
-	"golang.org/x/exp/maps"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/netbirdio/netbird/client/internal/relay"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// FullStatus contains the full state held by the Recorder instance
-type FullStatus struct {
-	Peers                 []State
-	ManagementState       ManagementState
-	SignalState           SignalState
-	LocalPeerState        LocalPeerState
-	RosenpassState        RosenpassState
-	Relays                []relay.ProbeResult
-	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
-	LazyConnectionEnabled bool
-	Events                []*proto.SystemEvent
-}
-
-// ToProto converts FullStatus to proto.FullStatus.
-func (fs FullStatus) ToProto() *proto.FullStatus {
-	pbFullStatus := proto.FullStatus{
-		ManagementState: &proto.ManagementState{},
-		SignalState:     &proto.SignalState{},
-		LocalPeerState:  &proto.LocalPeerState{},
-		Peers:           []*proto.PeerState{},
-	}
-
-	pbFullStatus.ManagementState.URL = fs.ManagementState.URL
-	pbFullStatus.ManagementState.Connected = fs.ManagementState.Connected
-	if err := fs.ManagementState.Error; err != nil {
-		pbFullStatus.ManagementState.Error = err.Error()
-	}
-
-	pbFullStatus.SignalState.URL = fs.SignalState.URL
-	pbFullStatus.SignalState.Connected = fs.SignalState.Connected
-	if err := fs.SignalState.Error; err != nil {
-		pbFullStatus.SignalState.Error = err.Error()
-	}
-
-	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fs.LocalPeerState.IPv6
-	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
-	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
-	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
-	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
-	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
-	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
-	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
-
-	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
-
-	for _, peerState := range fs.Peers {
-		networks := maps.Keys(peerState.GetRoutes())
-
-		pbPeerState := &proto.PeerState{
-			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
-			PubKey:                     peerState.PubKey,
-			ConnStatus:                 peerState.ConnStatus.String(),
-			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
-			Relayed:                    peerState.Relayed,
-			LocalIceCandidateType:      peerState.LocalIceCandidateType,
-			RemoteIceCandidateType:     peerState.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  peerState.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: peerState.RemoteIceCandidateEndpoint,
-			RelayAddress:               peerState.RelayServerAddress,
-			Fqdn:                       peerState.FQDN,
-			LastWireguardHandshake:     timestamppb.New(peerState.LastWireguardHandshake),
-			BytesRx:                    peerState.BytesRx,
-			BytesTx:                    peerState.BytesTx,
-			RosenpassEnabled:           peerState.RosenpassEnabled,
-			Networks:                   networks,
-			Latency:                    durationpb.New(peerState.Latency),
-			SshHostKey:                 peerState.SSHHostKey,
-		}
-		pbFullStatus.Peers = append(pbFullStatus.Peers, pbPeerState)
-	}
-
-	for _, relayState := range fs.Relays {
-		pbRelayState := &proto.RelayState{
-			URI:       relayState.URI,
-			Available: relayState.Err == nil,
-			Transport: relayState.Transport,
-		}
-		if err := relayState.Err; err != nil {
-			pbRelayState.Error = err.Error()
-		}
-		pbFullStatus.Relays = append(pbFullStatus.Relays, pbRelayState)
-	}
-
-	for _, dnsState := range fs.NSGroupStates {
-		var err string
-		if dnsState.Error != nil {
-			err = dnsState.Error.Error()
-		}
-
-		var servers []string
-		for _, server := range dnsState.Servers {
-			servers = append(servers, server.String())
-		}
-
-		pbDnsState := &proto.NSGroupState{
-			Servers: servers,
-			Domains: dnsState.Domains,
-			Enabled: dnsState.Enabled,
-			Error:   err,
-		}
-		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
-	}
-
-	pbFullStatus.Events = fs.Events
-
-	return &pbFullStatus
-}

client/internal/peer/status/peer_state.go

@@ -1,63 +0,0 @@
-package status
-
-import (
-	"sync"
-	"time"
-
-	"golang.org/x/exp/maps"
-)
-
-// State contains the latest state of a peer
-type State struct {
-	Mux                        *sync.RWMutex
-	IP                         string
-	IPv6                       string
-	PubKey                     string
-	FQDN                       string
-	ConnStatus                 ConnStatus
-	ConnStatusUpdate           time.Time
-	Relayed                    bool
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
-	RelayServerAddress         string
-	LastWireguardHandshake     time.Time
-	BytesTx                    int64
-	BytesRx                    int64
-	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
-}
-
-// AddRoute add a single route to routes map
-func (s *State) AddRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	if s.routes == nil {
-		s.routes = make(map[string]struct{})
-	}
-	s.routes[network] = struct{}{}
-}
-
-// SetRoutes set state routes
-func (s *State) SetRoutes(routes map[string]struct{}) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	s.routes = routes
-}
-
-// DeleteRoute removes a route from the network amp
-func (s *State) DeleteRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	delete(s.routes, network)
-}
-
-// GetRoutes return routes map
-func (s *State) GetRoutes() map[string]struct{} {
-	s.Mux.RLock()
-	defer s.Mux.RUnlock()
-	return maps.Clone(s.routes)
-}

client/internal/peer/status_alias.go

@@ -1,36 +0,0 @@
-package peer
-
-import "github.com/netbirdio/netbird/client/internal/peer/status"
-
-// Transitional aliases re-exporting the peer status recorder from its own
-// package. Callers are being migrated to reference the status package
-// directly; these aliases will be removed once the migration completes.
-type (
-	Status                   = status.Recorder
-	State                    = status.State
-	ConnStatus               = status.ConnStatus
-	FullStatus               = status.FullStatus
-	RouterState              = status.RouterState
-	LocalPeerState           = status.LocalPeerState
-	SignalState              = status.SignalState
-	ManagementState          = status.ManagementState
-	RosenpassState           = status.RosenpassState
-	NSGroupState             = status.NSGroupState
-	ResolvedDomainInfo       = status.ResolvedDomainInfo
-	StatusChangeSubscription = status.StatusChangeSubscription
-	EventQueue               = status.EventQueue
-	EventSubscription        = status.EventSubscription
-	WGIfaceStatus            = status.WGIfaceStatus
-	Listener                 = status.Listener
-	EventListener            = status.EventListener
-)
-
-const (
-	StatusIdle       = status.StatusIdle
-	StatusConnecting = status.StatusConnecting
-	StatusConnected  = status.StatusConnected
-)
-
-var (
-	NewRecorder = status.NewRecorder
-)

client/internal/peer/status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"context"

client/internal/peer/wg_watcher.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -8,7 +8,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
 )
 
 const (
@@ -30,7 +29,7 @@ type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
-	stateDump     *state_dump.StateDump
+	stateDump     *stateDump
 
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
@@ -38,7 +37,7 @@ type WGWatcher struct {
 	resetCh chan struct{}
 }
 
-func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *state_dump.StateDump) *WGWatcher {
+func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *stateDump) *WGWatcher {
 	return &WGWatcher{
 		log:           log,
 		wgIfaceStater: wgIfaceStater,

client/internal/peer/wg_watcher_test.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -9,8 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
 type MocWgIface struct {
@@ -58,7 +56,7 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 	// platforms with coarse clock resolution (Windows), where two time.Now() calls
 	// microseconds apart can return the same instant and read as a timed-out handshake.
 	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -67,18 +65,14 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 
 	firstHandshake := make(chan struct{}, 1)
 	checkSuccess := make(chan struct{}, 1)
-	watcherDone := make(chan struct{})
-	go func() {
-		defer close(watcherDone)
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-			firstHandshake <- struct{}{}
-		}, func() {
-			select {
-			case checkSuccess <- struct{}{}:
-			default:
-			}
-		})
-	}()
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
 
 	stats.advance()
 
@@ -93,11 +87,6 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
 	default:
 	}
-
-	// Wait for the watcher goroutine to exit so it cannot race with other
-	// tests mutating the package-level check timing variables.
-	cancel()
-	<-watcherDone
 }
 
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
@@ -106,7 +95,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -138,7 +127,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	watcher.PrepareInitialHandshake()

client/internal/peer/worker/state.go

@@ -1,4 +1,4 @@
-package peer
+package worker
 
 import (
 	"sync/atomic"
@@ -7,17 +7,17 @@ import (
 )
 
 const (
-	WorkerStatusDisconnected WorkerStatus = iota
-	WorkerStatusConnected
+	StatusDisconnected Status = iota
+	StatusConnected
 )
 
-type WorkerStatus int32
+type Status int32
 
-func (s WorkerStatus) String() string {
+func (s Status) String() string {
 	switch s {
-	case WorkerStatusDisconnected:
+	case StatusDisconnected:
 		return "Disconnected"
-	case WorkerStatusConnected:
+	case StatusConnected:
 		return "Connected"
 	default:
 		log.Errorf("unknown status: %d", s)
@@ -37,16 +37,16 @@ func NewAtomicStatus() *AtomicWorkerStatus {
 }
 
 // Get returns the current connection status
-func (acs *AtomicWorkerStatus) Get() WorkerStatus {
-	return WorkerStatus(acs.status.Load())
+func (acs *AtomicWorkerStatus) Get() Status {
+	return Status(acs.status.Load())
 }
 
 func (acs *AtomicWorkerStatus) SetConnected() {
-	acs.status.Store(int32(WorkerStatusConnected))
+	acs.status.Store(int32(StatusConnected))
 }
 
 func (acs *AtomicWorkerStatus) SetDisconnected() {
-	acs.status.Store(int32(WorkerStatusDisconnected))
+	acs.status.Store(int32(StatusDisconnected))
 }
 
 // String returns the string representation of the current status

client/internal/peer/worker_ice.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -13,9 +13,8 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/route"
@@ -33,68 +32,57 @@ type ICEConnInfo struct {
 	RelayedOnLocal             bool
 }
 
-type ICEDependencies struct {
-	Signaler           *signaling.Signaler
-	IFaceDiscover      stdnet.ExternalIFaceDiscover
-	StatusRecorder     *status.Recorder
-	PortForwardManager *portforward.Manager
-}
-
-type ICE struct {
-	log                *log.Entry
-	key                string
-	iceConfig          icemaker.Config
-	isController       bool
-	onConnReady        func(priority ConnPriority, iceConnInfo ICEConnInfo)
-	onStatusDisconnect func(sessionChanged bool)
-	signaler           *signaling.Signaler
-	iFaceDiscover      stdnet.ExternalIFaceDiscover
-	statusRecorder     *status.Recorder
-	portForwardManager *portforward.Manager
-	hasRelayOnLocally  bool
+type WorkerICE struct {
+	ctx               context.Context
+	log               *log.Entry
+	config            ConnConfig
+	conn              *Conn
+	signaler          *Signaler
+	iFaceDiscover     stdnet.ExternalIFaceDiscover
+	statusRecorder    *Status
+	hasRelayOnLocally bool
 
 	agent             *icemaker.ThreadSafeAgent
 	agentDialerCancel context.CancelFunc
 	agentConnecting   bool      // while it is true, drop all incoming offers
 	lastSuccess       time.Time // with this avoid the too frequent ICE agent recreation
-	// connectedAgent is the agent whose connection was last reported ready; guarded by muxAgent
-	connectedAgent *icemaker.ThreadSafeAgent
 	// remoteSessionID represents the peer's session identifier from the latest remote offer.
-	remoteSessionID icemaker.SessionID
+	remoteSessionID ICESessionID
 	// sessionID is used to track the current session ID of the ICE agent
 	// increase by one when disconnecting the agent
 	// with it the remote peer can discard the already deprecated offer/answer
 	// Without it the remote peer may recreate a workable ICE connection
-	sessionID            icemaker.SessionID
+	sessionID            ICESessionID
 	remoteSessionChanged bool
 	muxAgent             sync.Mutex
 
 	localUfrag string
 	localPwd   string
 
+	// we record the last known state of the ICE agent to avoid duplicate on disconnected events
+	lastKnownState ice.ConnectionState
+
 	// portForwardAttempted tracks if we've already tried port forwarding this session
 	portForwardAttempted bool
 }
 
-func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController bool, onConnReady func(ConnPriority, ICEConnInfo), onStatusDisconnect func(bool), services ICEDependencies, hasRelayOnLocally bool) (*ICE, error) {
-	sessionID, err := icemaker.NewSessionID()
+func NewWorkerICE(ctx context.Context, log *log.Entry, config ConnConfig, conn *Conn, signaler *Signaler, ifaceDiscover stdnet.ExternalIFaceDiscover, statusRecorder *Status, hasRelayOnLocally bool) (*WorkerICE, error) {
+	sessionID, err := NewICESessionID()
 	if err != nil {
 		return nil, err
 	}
 
-	w := &ICE{
-		log:                log,
-		key:                key,
-		iceConfig:          iceConfig,
-		isController:       isController,
-		onConnReady:        onConnReady,
-		onStatusDisconnect: onStatusDisconnect,
-		signaler:           services.Signaler,
-		iFaceDiscover:      services.IFaceDiscover,
-		statusRecorder:     services.StatusRecorder,
-		portForwardManager: services.PortForwardManager,
-		hasRelayOnLocally:  hasRelayOnLocally,
-		sessionID:          sessionID,
+	w := &WorkerICE{
+		ctx:               ctx,
+		log:               log,
+		config:            config,
+		conn:              conn,
+		signaler:          signaler,
+		iFaceDiscover:     ifaceDiscover,
+		statusRecorder:    statusRecorder,
+		hasRelayOnLocally: hasRelayOnLocally,
+		lastKnownState:    ice.ConnectionStateDisconnected,
+		sessionID:         sessionID,
 	}
 
 	localUfrag, localPwd, err := icemaker.GenerateICECredentials()
@@ -106,7 +94,7 @@ func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController
 	return w, nil
 }
 
-func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("OnNewOffer for ICE, serial: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
@@ -130,7 +118,7 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 			}
 		}
 
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -148,8 +136,8 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 	if remoteOfferAnswer.SessionID != nil {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
-	dialerCtx, dialerCancel := context.WithCancel(ctx)
-	agent, err := w.reCreateAgent(ctx, dialerCancel, preferredCandidateTypes)
+	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
+	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -163,14 +151,14 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 		w.remoteSessionID = ""
 	}
 
-	go w.connect(dialerCtx, dialerCancel, agent, remoteOfferAnswer)
+	go w.connect(dialerCtx, agent, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
-func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
+func (w *WorkerICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
-	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.key, candidate.String())
+	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.config.Key, candidate.String())
 	if w.agent == nil {
 		w.log.Warnf("ICE Agent is not initialized yet")
 		return
@@ -197,24 +185,18 @@ func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	}
 }
 
-func (w *ICE) Credentials() signaling.Credentials {
-	w.muxAgent.Lock()
-	defer w.muxAgent.Unlock()
-	return signaling.Credentials{
-		UFrag:     w.localUfrag,
-		Pwd:       w.localPwd,
-		SessionID: w.sessionID,
-	}
+func (w *WorkerICE) GetLocalUserCredentials() (frag string, pwd string) {
+	return w.localUfrag, w.localPwd
 }
 
-func (w *ICE) InProgress() bool {
+func (w *WorkerICE) InProgress() bool {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
 	return w.agentConnecting
 }
 
-func (w *ICE) Close() {
+func (w *WorkerICE) Close() {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -230,10 +212,10 @@ func (w *ICE) Close() {
 	w.agent = nil
 }
 
-func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
 	w.portForwardAttempted = false
 
-	agent, err := icemaker.NewAgent(ctx, w.iFaceDiscover, w.iceConfig, candidates, w.localUfrag, w.localPwd)
+	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
 		return nil, fmt.Errorf("create agent: %w", err)
 	}
@@ -255,7 +237,7 @@ func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc
 	return agent, nil
 }
 
-func (w *ICE) getSessionID() icemaker.SessionID {
+func (w *WorkerICE) SessionID() ICESessionID {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -265,11 +247,11 @@ func (w *ICE) getSessionID() icemaker.SessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -277,19 +259,19 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	w.log.Debugf("agent dial succeeded")
 
 	pair, err := agent.GetSelectedCandidatePair()
 	if err != nil {
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	if pair == nil {
 		w.log.Warnf("selected candidate pair is nil, cannot proceed")
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -317,22 +299,17 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	}
 	w.log.Debugf("on ICE conn is ready to use")
 
+	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
-	if w.agent != agent {
-		w.muxAgent.Unlock()
-		w.log.Debugf("agent has been replaced during connect, dropping obsolete connection")
-		return
-	}
 	w.agentConnecting = false
 	w.lastSuccess = time.Now()
-	w.connectedAgent = agent
 	w.muxAgent.Unlock()
 
-	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
-	w.onConnReady(selectedPriority(pair), ci)
+	// todo: the potential problem is a race between the onConnectionStateChange
+	w.conn.onICEConnectionIsReady(selectedPriority(pair), ci)
 }
 
-func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
+func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
 	cancel()
 	if err := agent.Close(); err != nil {
 		w.log.Warnf("failed to close ICE agent: %s", err)
@@ -346,7 +323,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 
 	if w.agent == agent {
 		// consider to remove from here and move to the OnNewOffer
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -358,7 +335,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 	return sessionChanged
 }
 
-func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
+func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
 	addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(remoteWgPort)))
@@ -367,7 +344,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 		return
 	}
 
-	mux, ok := w.iceConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
+	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
 	if !ok {
 		w.log.Warn("invalid udp mux conversion")
 		return
@@ -380,7 +357,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 
 // onICECandidate is a callback attached to an ICE Agent to receive new local connection candidates
 // and then signals them to the remote peer
-func (w *ICE) onICECandidate(candidate ice.Candidate) {
+func (w *WorkerICE) onICECandidate(candidate ice.Candidate) {
 	// nil means candidate gathering has been ended
 	if candidate == nil {
 		return
@@ -389,9 +366,9 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 	// TODO: reported port is incorrect for CandidateTypeHost, makes understanding ICE use via logs confusing as port is ignored
 	w.log.Debugf("discovered local candidate %s", candidate.String())
 	go func() {
-		err := w.signaler.SignalICECandidate(candidate, w.key)
+		err := w.signaler.SignalICECandidate(candidate, w.config.Key)
 		if err != nil {
-			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.key, err)
+			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.config.Key, err)
 		}
 	}()
 
@@ -401,8 +378,8 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 }
 
 // injectPortForwardedCandidate signals an additional candidate using the pre-created port mapping.
-func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
-	pfManager := w.portForwardManager
+func (w *WorkerICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
+	pfManager := w.conn.portForwardManager
 	if pfManager == nil {
 		return
 	}
@@ -430,7 +407,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 		forwardedCandidate.String(), mapping.InternalPort, mapping.ExternalPort, mapping.NATType, forwardedCandidate.Priority())
 
 	go func() {
-		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.key); err != nil {
+		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.config.Key); err != nil {
 			w.log.Errorf("signal port-forwarded candidate: %v", err)
 		}
 	}()
@@ -438,7 +415,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 
 // createForwardedCandidate creates a new server reflexive candidate with the forwarded port.
 // It uses the NAT gateway's external IP with the forwarded port.
-func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
+func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
 	var externalIP string
 	if mapping.ExternalIP != nil && !mapping.ExternalIP.IsUnspecified() {
 		externalIP = mapping.ExternalIP.String()
@@ -483,9 +460,9 @@ func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *po
 	return candidate, nil
 }
 
-func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
+func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
 	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.key)
+		w.config.Key)
 
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
@@ -494,14 +471,14 @@ func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2
 	}
 
 	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.key, duration); err != nil {
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
 		w.log.Debugf("failed to update latency for peer: %s", err)
 		return
 	}
 }
 
-func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
-	sessionID := w.getSessionID()
+func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
+	sessionID := w.SessionID()
 	stats := agent.GetCandidatePairsStats()
 	localCandidates, _ := agent.GetLocalCandidates()
 	remoteCandidates, _ := agent.GetRemoteCandidates()
@@ -531,44 +508,32 @@ func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
 	}
 }
 
-func (w *ICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
-	// per-agent state; pion delivers callbacks of one agent sequentially
-	var connected bool
+func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
 	return func(state ice.ConnectionState) {
 		w.log.Debugf("ICE ConnectionState has changed to %s", state.String())
 		switch state {
 		case ice.ConnectionStateConnected:
-			connected = true
+			w.lastKnownState = ice.ConnectionStateConnected
 			w.logSuccessfulPaths(agent)
+			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
 			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
 			// notify the conn.onICEStateDisconnected changes to update the current used priority
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
-			if !connected {
-				return
+			if w.lastKnownState == ice.ConnectionStateConnected {
+				w.lastKnownState = ice.ConnectionStateDisconnected
+				w.conn.onICEStateDisconnected(sessionChanged)
 			}
-			connected = false
-
-			w.muxAgent.Lock()
-			stale := w.connectedAgent != agent
-			if !stale {
-				w.connectedAgent = nil
-			}
-			w.muxAgent.Unlock()
-
-			if stale {
-				w.log.Debugf("suppress disconnected event of replaced ICE agent")
-				return
-			}
-			w.onStatusDisconnect(sessionChanged)
+		default:
+			return
 		}
 	}
 }
 
-func (w *ICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) (*ice.Conn, error) {
-	if w.isController {
+func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
 		return agent.Accept(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
@@ -630,10 +595,10 @@ func isRelayed(pair *ice.CandidatePair) bool {
 	return false
 }
 
-func selectedPriority(pair *ice.CandidatePair) ConnPriority {
+func selectedPriority(pair *ice.CandidatePair) conntype.ConnPriority {
 	if isRelayed(pair) {
-		return ICETurn
+		return conntype.ICETurn
 	} else {
-		return ICEP2P
+		return conntype.ICEP2P
 	}
 }

client/internal/peer/worker_relay.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -10,23 +10,22 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
 type RelayConnInfo struct {
-	RelayedConn     net.Conn
-	RosenpassPubKey []byte
-	RosenpassAddr   string
+	relayedConn     net.Conn
+	rosenpassPubKey []byte
+	rosenpassAddr   string
 }
 
 type WorkerRelay struct {
-	log            *log.Entry
-	key            string
-	isController   bool
-	onConnReady    func(RelayConnInfo)
-	onDisconnected func()
-	relayManager   *relayClient.Manager
+	peerCtx      context.Context
+	log          *log.Entry
+	isController bool
+	config       ConnConfig
+	conn         *Conn
+	relayManager *relayClient.Manager
 
 	relayedConn net.Conn
 	relayLock   sync.Mutex
@@ -34,19 +33,19 @@ type WorkerRelay struct {
 	relaySupportedOnRemotePeer atomic.Bool
 }
 
-func NewWorkerRelay(log *log.Entry, key string, isController bool, onConnReady func(RelayConnInfo), onDisconnected func(), relayManager *relayClient.Manager) *WorkerRelay {
+func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager) *WorkerRelay {
 	r := &WorkerRelay{
-		log:            log,
-		key:            key,
-		isController:   isController,
-		onConnReady:    onConnReady,
-		onDisconnected: onDisconnected,
-		relayManager:   relayManager,
+		peerCtx:      ctx,
+		log:          log,
+		isController: ctrl,
+		config:       config,
+		conn:         conn,
+		relayManager: relayManager,
 	}
 	return r
 }
 
-func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	if !w.isRelaySupported(remoteOfferAnswer) {
 		w.log.Infof("Relay is not supported by remote peer")
 		w.relaySupportedOnRemotePeer.Store(false)
@@ -67,7 +66,7 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 		serverIP = remoteOfferAnswer.RelaySrvIP
 	}
 
-	relayedConn, err := w.relayManager.OpenConn(ctx, srv, w.key, serverIP)
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -89,10 +88,10 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 	}
 
 	w.log.Debugf("peer conn opened via Relay: %s", srv)
-	w.onConnReady(RelayConnInfo{
-		RelayedConn:     relayedConn,
-		RosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
-		RosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
+	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
+		relayedConn:     relayedConn,
+		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
+		rosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
 	})
 }
 
@@ -120,7 +119,7 @@ func (w *WorkerRelay) CloseConn() {
 	}
 }
 
-func (w *WorkerRelay) isRelaySupported(answer *signaling.OfferAnswer) bool {
+func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	if !w.relayManager.HasRelayAddress() {
 		return false
 	}
@@ -135,5 +134,5 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 }
 
 func (w *WorkerRelay) onRelayClientDisconnected() {
-	w.onDisconnected()
+	go w.conn.onRelayDisconnected()
 }

client/server/login_outcome_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/proto"
@@ -25,9 +27,9 @@ func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T
 
 	unreachable := errors.New("create connection: dial context: context deadline exceeded")
 	attempts := 0
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
 		attempts++
-		return false, unreachable
+		return internal.StatusLoginFailed, unreachable
 	}
 
 	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
@@ -53,12 +55,15 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 	s.rootCtx = internal.CtxInitState(context.Background())
 	breakProfilePrivateKey(t, cfgPath)
 
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
+	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		return internal.StatusNeedsLogin, refused
 	}
 
 	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
 	require.Error(t, err)
+	require.NotErrorIs(t, err, refused,
+		"the refusal was handed back to the caller instead of starting the SSO flow")
 
 	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
 	require.NoError(t, stateErr)
@@ -66,32 +71,6 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 		"the SSO flow setup was never reached with the broken key")
 }
 
-func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	var keysTried []string
-	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
-		keysTried = append(keysTried, setupKey)
-		return "", nil
-	}
-
-	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
-	require.NoError(t, err, "the probe's outcome leaked out as the login result")
-	require.NotNil(t, resp)
-	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
-	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusIdle, status)
-}
-
 // breakProfilePrivateKey replaces the profile's private key with an unparseable
 // one, which makes any attempt to build a Management client fail on the spot.
 func breakProfilePrivateKey(t *testing.T, cfgPath string) {

client/server/server.go

@@ -140,8 +140,6 @@ type Server struct {
 	// it to drive the login outcomes that need a server on the other end;
 	// production leaves it nil, and every login goes through loginAttempt.
 	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
-
-	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -386,21 +384,6 @@ func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (i
 	return s.loginAttempt(ctx, setupKey, jwtToken)
 }
 
-func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
-	if s.isLoginRequiredFn != nil {
-		return s.isLoginRequiredFn(ctx)
-	}
-
-	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
-	if err != nil {
-		log.Errorf("failed to create auth client: %v", err)
-		return false, err
-	}
-	defer authClient.Close()
-
-	return authClient.IsLoginRequired(ctx)
-}
-
 // loginAttempt attempts to login using the provided information. It returns
 // StatusNeedsLogin when Management refused the peer's credentials and
 // StatusLoginFailed for every other failure, so callers can tell an
@@ -657,22 +640,22 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	// A probe that errors leaves the login undecided: Management unreachable, a
+	loginStatus, err := s.attemptLogin(ctx, "", "")
+	if err == nil {
+		state.Set(internal.StatusIdle)
+		return &proto.LoginResponse{}, nil
+	}
+
+	// Only an authentication refusal means the peer has to (re-)authenticate.
+	// Any other failure leaves the login undecided: Management unreachable, a
 	// restart mid-request, an internal error. Those are returned for the caller
 	// to retry, because turning them into an SSO prompt asks the user to solve
 	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway. Only Management refusing the
-	// peer's key is a decision, and IsLoginRequired reports that as
-	// needsLogin=true rather than an error.
-	needsLogin, err := s.isLoginRequired(ctx)
-	if err != nil {
-		state.Set(internal.StatusLoginFailed)
+	// while Management is unreachable anyway.
+	if loginStatus != internal.StatusNeedsLogin {
+		state.Set(loginStatus)
 		return nil, err
 	}
-	if !needsLogin {
-		state.Set(internal.StatusIdle)
-		return &proto.LoginResponse{}, nil
-	}
 
 	if msg.SetupKey == "" {
 		hint := ""
@@ -1815,9 +1798,6 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
-	if connectClient.Engine() == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
-	}
 
 	hint := ""
 	if msg.Hint != nil {

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,21 +131,6 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
-    const authenticate = useCallback(async () => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await Events.Emit(EVENT_TRIGGER_LOGIN);
-            await WindowManager.CloseSessionExpiration();
-        } catch (e) {
-            setBusy(false);
-            await errorDialog({
-                Title: t("connect.error.loginTitle"),
-                Message: formatErrorMessage(e),
-            });
-        }
-    }, [busy, t]);
-
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -200,7 +185,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={expired ? authenticate : stay}
+                    onClick={stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/main.go

@@ -95,6 +95,10 @@ func main() {
 		}
 	})
 
+	// Debug patch, not for release: dumps heap/goroutine profiles and the
+	// process tree to /tmp/nbgui for the memory consumption investigation.
+	startMemProfiler(app)
+
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.

client/ui/memprof.go

@@ -0,0 +1,319 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"runtime/pprof"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/shirou/gopsutil/v4/process"
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+)
+
+// memProfOffsets are the snapshot times measured from application startup.
+var memProfOffsets = []time.Duration{0, 2 * time.Minute, 5 * time.Minute}
+
+// memProfMaxDepth bounds the child walk so a cycle in the reported parent links
+// cannot spin forever.
+const memProfMaxDepth = 4
+
+type memProfileSpec struct {
+	profile string
+	file    string
+	debug   int
+}
+
+var memProfileSpecs = []memProfileSpec{
+	{profile: "heap", file: "heap.pprof", debug: 0},
+	{profile: "heap", file: "heap.txt", debug: 1},
+	{profile: "goroutine", file: "goroutine.txt", debug: 1},
+	{profile: "threadcreate", file: "threadcreate.txt", debug: 1},
+}
+
+var memProfStart = time.Now()
+
+// startMemProfiler dumps a profile snapshot at every memProfOffsets mark, each
+// into its own timestamped directory under memProfBaseDir. The first runs once
+// the application is up so the window inventory sees the eagerly created
+// windows. Every failure is logged and never stops the GUI.
+func startMemProfiler(app *application.App) {
+	log.Infof("memory profiler enabled, writing to %s (snapshots at %v after startup)", memProfBaseDir(), memProfOffsets)
+
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go func() {
+			started := time.Now()
+			for _, offset := range memProfOffsets {
+				if wait := time.Until(started.Add(offset)); wait > 0 {
+					time.Sleep(wait)
+				}
+				writeMemProfile(app)
+			}
+		}()
+	})
+}
+
+// memProfBaseDir returns the directory holding the snapshot directories.
+func memProfBaseDir() string {
+	if runtime.GOOS == "windows" {
+		return filepath.Join(os.TempDir(), "nbgui")
+	}
+	return "/tmp/nbgui"
+}
+
+// writeMemProfile creates a <timestamp>-<pid> directory and fills it with the
+// runtime profiles, the memory statistics summary and the process tree.
+func writeMemProfile(app *application.App) {
+	name := fmt.Sprintf("%s-%d", time.Now().Format("20060102-150405"), os.Getpid())
+	dir := filepath.Join(memProfBaseDir(), name)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		log.Warnf("create memory profile dir %s: %v", dir, err)
+		return
+	}
+
+	// The heap profile reports live objects as of the last collection, so force
+	// one to keep inuse_space from counting garbage that is already unreachable.
+	runtime.GC()
+
+	if err := writeMemStats(filepath.Join(dir, "memstats.txt"), app); err != nil {
+		log.Warnf("write memory statistics: %v", err)
+	}
+
+	if err := writeProcTree(filepath.Join(dir, "proctree.txt")); err != nil {
+		log.Warnf("write process tree: %v", err)
+	}
+
+	for _, spec := range memProfileSpecs {
+		if err := writeMemProfileFile(spec, filepath.Join(dir, spec.file)); err != nil {
+			log.Warnf("write %s profile: %v", spec.profile, err)
+		}
+	}
+
+	log.Infof("memory profile written to %s", dir)
+}
+
+// writeMemProfileFile writes a single runtime profile to path.
+func writeMemProfileFile(spec memProfileSpec, path string) error {
+	p := pprof.Lookup(spec.profile)
+	if p == nil {
+		return fmt.Errorf("unknown profile %q", spec.profile)
+	}
+
+	f, err := os.Create(path)
+	if err != nil {
+		return fmt.Errorf("create %s: %w", path, err)
+	}
+	defer func() {
+		if err := f.Close(); err != nil {
+			log.Debugf("close %s: %v", path, err)
+		}
+	}()
+
+	if err := p.WriteTo(f, spec.debug); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// writeMemStats dumps the runtime memory statistics next to the process
+// resident set size. A resident set much larger than Sys means the memory sits
+// outside the Go heap (webview, GTK, other cgo allocations), where the pprof
+// profiles cannot see it.
+func writeMemStats(path string, app *application.App) error {
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "time:           %s\n", time.Now().Format(time.RFC3339))
+	fmt.Fprintf(&b, "uptime:         %s\n", time.Since(memProfStart).Round(time.Second))
+	fmt.Fprintf(&b, "pid:            %d\n", os.Getpid())
+	fmt.Fprintf(&b, "\n")
+
+	rss, vms := processMemory()
+	fmt.Fprintf(&b, "process_rss:    %s\n", rss)
+	fmt.Fprintf(&b, "process_vms:    %s\n", vms)
+	fmt.Fprintf(&b, "\n")
+
+	fmt.Fprintf(&b, "sys:            %s\n", formatMemBytes(m.Sys))
+	fmt.Fprintf(&b, "heap_alloc:     %s\n", formatMemBytes(m.HeapAlloc))
+	fmt.Fprintf(&b, "heap_sys:       %s\n", formatMemBytes(m.HeapSys))
+	fmt.Fprintf(&b, "heap_inuse:     %s\n", formatMemBytes(m.HeapInuse))
+	fmt.Fprintf(&b, "heap_idle:      %s\n", formatMemBytes(m.HeapIdle))
+	fmt.Fprintf(&b, "heap_released:  %s\n", formatMemBytes(m.HeapReleased))
+	fmt.Fprintf(&b, "heap_objects:   %d\n", m.HeapObjects)
+	fmt.Fprintf(&b, "stack_inuse:    %s\n", formatMemBytes(m.StackInuse))
+	fmt.Fprintf(&b, "stack_sys:      %s\n", formatMemBytes(m.StackSys))
+	fmt.Fprintf(&b, "mspan_sys:      %s\n", formatMemBytes(m.MSpanSys))
+	fmt.Fprintf(&b, "mcache_sys:     %s\n", formatMemBytes(m.MCacheSys))
+	fmt.Fprintf(&b, "gc_sys:         %s\n", formatMemBytes(m.GCSys))
+	fmt.Fprintf(&b, "other_sys:      %s\n", formatMemBytes(m.OtherSys))
+	fmt.Fprintf(&b, "next_gc:        %s\n", formatMemBytes(m.NextGC))
+	fmt.Fprintf(&b, "num_gc:         %d\n", m.NumGC)
+	fmt.Fprintf(&b, "\n")
+
+	fmt.Fprintf(&b, "goroutines:     %d\n", runtime.NumGoroutine())
+	fmt.Fprintf(&b, "cgo_calls:      %d\n", runtime.NumCgoCall())
+	fmt.Fprintf(&b, "gomaxprocs:     %d\n", runtime.GOMAXPROCS(0))
+	fmt.Fprintf(&b, "\n")
+
+	writeWindowInventory(&b, app)
+
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// writeWindowInventory lists the live Wails windows. A window that exists holds
+// a webview process even while hidden, so this tells apart a leaked window (the
+// count grows) from windows whose content grew (the count stays put).
+func writeWindowInventory(b *strings.Builder, app *application.App) {
+	windows := app.Window.GetAll()
+	fmt.Fprintf(b, "windows:        %d\n", len(windows))
+	for _, w := range windows {
+		visible := "unknown"
+		if ww, ok := w.(*application.WebviewWindow); ok {
+			visible = strconv.FormatBool(ww.IsVisible())
+		}
+		fmt.Fprintf(b, "  id=%-3d name=%-20q visible=%-7s minimised=%-5t focused=%t\n",
+			w.ID(), w.Name(), visible, w.IsMinimised(), w.IsFocused())
+	}
+}
+
+// writeProcTree dumps this process and its descendants with their memory
+// footprint. The webview runs in child processes whose memory the Go runtime
+// profiles cannot see, so this is what attributes a footprint to a component.
+func writeProcTree(path string) error {
+	self, err := process.NewProcess(int32(os.Getpid()))
+	if err != nil {
+		return fmt.Errorf("open own process: %w", err)
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "time: %s\n", time.Now().Format(time.RFC3339))
+	fmt.Fprintf(&b, "uptime: %s\n\n", time.Since(memProfStart).Round(time.Second))
+	fmt.Fprintf(&b, "%-8s %-8s %-28s %12s %12s %12s %12s\n", "PID", "PPID", "NAME", "RSS", "VMS", "PSS", "PRIV_DIRTY")
+
+	var totalRSS, totalPSS, totalPrivate uint64
+	walkProcTree(&b, self, 0, &totalRSS, &totalPSS, &totalPrivate)
+
+	fmt.Fprintf(&b, "\n%-8s %-8s %-28s %12s %12s %12s %12s\n", "", "", "TOTAL",
+		formatKB(totalRSS), "", formatKB(totalPSS), formatKB(totalPrivate))
+	fmt.Fprintf(&b, "\nPSS and PRIV_DIRTY come from /proc/<pid>/smaps_rollup and are Linux only.\n")
+
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// walkProcTree appends one line per process, depth-first, accumulating totals.
+func walkProcTree(b *strings.Builder, p *process.Process, depth int, totalRSS, totalPSS, totalPrivate *uint64) {
+	name, err := p.Name()
+	if err != nil {
+		name = "unknown"
+	}
+
+	var rss, vms uint64
+	if info, err := p.MemoryInfo(); err == nil {
+		rss, vms = info.RSS, info.VMS
+	}
+
+	pss, private := smapsRollup(p.Pid)
+	*totalRSS += rss
+	*totalPSS += pss
+	*totalPrivate += private
+
+	ppid, err := p.Ppid()
+	if err != nil {
+		ppid = -1
+	}
+
+	fmt.Fprintf(b, "%-8d %-8d %-28s %12s %12s %12s %12s\n", p.Pid, ppid,
+		strings.Repeat("  ", depth)+name, formatKB(rss), formatKB(vms), formatKB(pss), formatKB(private))
+
+	if depth >= memProfMaxDepth {
+		return
+	}
+
+	children, err := p.Children()
+	if err != nil {
+		return
+	}
+	for _, child := range children {
+		walkProcTree(b, child, depth+1, totalRSS, totalPSS, totalPrivate)
+	}
+}
+
+// smapsRollup returns the proportional set size and private dirty bytes of pid,
+// both zero on platforms without /proc.
+func smapsRollup(pid int32) (uint64, uint64) {
+	f, err := os.Open(fmt.Sprintf("/proc/%d/smaps_rollup", pid))
+	if err != nil {
+		return 0, 0
+	}
+	defer func() {
+		if err := f.Close(); err != nil {
+			log.Debugf("close smaps_rollup for %d: %v", pid, err)
+		}
+	}()
+
+	var pss, private uint64
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 2 {
+			continue
+		}
+		kb, err := strconv.ParseUint(fields[1], 10, 64)
+		if err != nil {
+			continue
+		}
+		switch fields[0] {
+		case "Pss:":
+			pss = kb * 1024
+		case "Private_Dirty:":
+			private = kb * 1024
+		}
+	}
+	return pss, private
+}
+
+// processMemory returns the formatted resident and virtual size of this process.
+func processMemory() (string, string) {
+	p, err := process.NewProcess(int32(os.Getpid()))
+	if err != nil {
+		unavailable := fmt.Sprintf("unavailable (%v)", err)
+		return unavailable, unavailable
+	}
+
+	info, err := p.MemoryInfo()
+	if err != nil {
+		unavailable := fmt.Sprintf("unavailable (%v)", err)
+		return unavailable, unavailable
+	}
+
+	return formatMemBytes(info.RSS), formatMemBytes(info.VMS)
+}
+
+// formatMemBytes renders a byte count as megabytes with the raw value kept.
+func formatMemBytes(n uint64) string {
+	return fmt.Sprintf("%8.1f MB (%d bytes)", float64(n)/(1024*1024), n)
+}
+
+// formatKB renders a byte count as megabytes for the process tree columns, and
+// a dash when the platform did not report the value.
+func formatKB(n uint64) string {
+	if n == 0 {
+		return "-"
+	}
+	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
+}

client/ui/tray_click_linux.go

@@ -4,26 +4,17 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Expected behaviour per tray host:
-//
-//	Host                           Left click              Right click
-//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
-//	GNOME Shell + AppIndicator     menu only               menu only
-//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
-//
-// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
-// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
-// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
-//
-// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
-// on ANY click and only reports the menu opening via dbusmenu
-// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
-// both buttons raised the main window on top of the menu, and on KDE/Waybar
-// a right click raised it over the freshly opened menu. The netbirdio/wails
-// fork (go.mod replace) drops that heuristic: a menu open never fires
-// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
-// entry; left-click-opens-window is not achievable there anyway, since the
-// host always opens the menu itself.
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_session.go

@@ -27,10 +27,11 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
+		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -307,7 +308,11 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
 		return
 	}
 	if t.svc.WindowManager == nil {

e2e/agentnetwork/management_test.go

@@ -160,19 +160,8 @@ func TestSettingsRoundTrip(t *testing.T) {
 	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
 	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
-	// A cluster different from the pinned one must be rejected; echoing the
-	// pinned one back is valid.
-	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr("attacker.cluster.invalid"),
-		EnableLogCollection:    before.EnableLogCollection,
-		EnablePromptCollection: before.EnablePromptCollection,
-		RedactPii:              before.RedactPii,
-	})
-	requireClientError(t, err)
-
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,

e2e/agentnetwork/settings_bootstrap_test.go

@@ -1,114 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// harnessStartFresh boots a dedicated combined server with its own fresh
-// account and registers its teardown on t.
-func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
-	t.Helper()
-	fresh, err := harness.StartCombined(ctx)
-	if err != nil {
-		return nil, err
-	}
-	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
-	if _, err := fresh.Bootstrap(ctx); err != nil {
-		return nil, err
-	}
-	return fresh, nil
-}
-
-// TestSettingsBootstrapViaPut covers the settings-first bootstrap path on an
-// account that has never been bootstrapped: the GET reads as the defaults
-// with an empty cluster/subdomain/endpoint, a PUT without a cluster has
-// nothing to pin and fails, and a PUT carrying a cluster creates the row and
-// pins it immutably. The shared srv cannot provide that starting state (any
-// provider-creating test bootstraps it, and test order is deliberately not
-// relied on), so this boots a dedicated combined server — the image is
-// already built and cached by TestMain's StartCombined, so the extra cost is
-// one container start.
-func TestSettingsBootstrapViaPut(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	// Before agent-network bootstrap the settings read as the defaults, not
-	// as an error and not as a null body.
-	before, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings on a fresh account must succeed")
-	assert.Empty(t, before.Cluster, "cluster must be empty before bootstrap")
-	assert.Empty(t, before.Subdomain, "subdomain must be empty before bootstrap")
-	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap, not a bare dot")
-	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
-
-	// A PUT without a cluster has nothing to pin the account to.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection: true,
-	})
-	requireClientError(t, err)
-
-	// A PUT carrying a cluster bootstraps the account and applies the
-	// mutable fields from the same request. Every toggle is set away from
-	// its bootstrap default so each assertion can actually fail.
-	const cluster = "e2e.bootstrap.netbird.selfhosted"
-	bootstrapped, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(cluster),
-		EnableLogCollection:    false,
-		EnablePromptCollection: true,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "bootstrap settings via PUT must succeed")
-	assert.Equal(t, cluster, bootstrapped.Cluster, "cluster must be pinned from the request")
-	require.NotEmpty(t, bootstrapped.Subdomain, "subdomain must be assigned at bootstrap")
-	assert.Equal(t, bootstrapped.Subdomain+"."+cluster, bootstrapped.Endpoint, "endpoint must combine subdomain and cluster")
-	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
-	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
-	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
-
-	// The row is persisted: an independent read agrees on every field.
-	after, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after bootstrap must succeed")
-	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
-	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
-	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
-	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
-
-	// Once bootstrapped, later updates may omit the cluster entirely.
-	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection:    true,
-		EnablePromptCollection: false,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "post-bootstrap update without cluster must succeed")
-	assert.Equal(t, cluster, persisted.Cluster, "omitted cluster must keep the pinned value")
-	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
-	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
-
-	// The cluster is immutable: a different value is rejected rather than
-	// silently ignored, and the rejected update must not disturb anything.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:             ptr("other.cluster.invalid"),
-		EnableLogCollection: false,
-	})
-	requireClientError(t, err)
-
-	final, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after the rejected cluster change must succeed")
-	assert.Equal(t, persisted.Cluster, final.Cluster, "rejected update must not change the cluster")
-	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected update must not change the endpoint")
-	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected update must not apply its toggles")
-}

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-beta.3
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -339,5 +339,3 @@ replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
-
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4

go.sum

@@ -490,8 +490,6 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -662,6 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

management/internals/modules/agentnetwork/handlers/handlers_test.go

@@ -17,7 +17,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -62,23 +61,10 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 		Return(true, context.Background(), nil).
 		AnyTimes()
 
-	// Swallow activity events so the mutation paths (create/update/delete)
-	// are exercisable through the HTTP layer.
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().
-		StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-	accounts.EXPECT().
-		UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-
-	manager := agentnetwork.NewManager(st, perms, accounts, nil)
+	manager := agentnetwork.NewManager(st, perms, nil, nil)
 	h := &handler{manager: manager}
 
 	router := mux.NewRouter()
-	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT")
 	h.addPolicyEndpoints(router)
 	h.addConsumptionEndpoints(router)
 	h.addBudgetRuleEndpoints(router)

management/internals/modules/agentnetwork/handlers/providers_handler_test.go

@@ -1,9 +1,7 @@
 package handlers
 
 import (
-	"encoding/json"
 	"math"
-	nethttp "net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -53,50 +51,3 @@ func TestValidate_ModelRates(t *testing.T) {
 		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
 	}
 }
-
-// TestProviderHandler_UpdateReplacesFullState pins the update contract shared
-// with the other PUT endpoints: the request replaces the provider's mutable
-// state, so optional fields absent from the JSON land as their zero values.
-// The two exceptions are server-side: the api_key (a secret — omitted means
-// "not rotated") and the session keypair, both preserved by the manager. The
-// identity headers stay on the wire as explicit empty strings so a cleared
-// value round-trips.
-func TestProviderHandler_UpdateReplacesFullState(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	create := `{
-        "provider_id": "openai_api",
-        "name": "openai",
-        "upstream_url": "https://api.openai.com",
-        "api_key": "sk-test",
-        "enabled": true,
-        "metadata_disabled": true,
-        "skip_tls_verification": true,
-        "extra_values": {"x-portkey-config": "pc-prod-3f2a"},
-        "identity_header_user_id": "x-bf-dim-netbird_user_id",
-        "models": [{"id": "gpt-4o", "input_per_1k": 0.0025, "output_per_1k": 0.01}]
-    }`
-	rec := f.do(t, nethttp.MethodPost, "/agent-network/providers", create)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "create must succeed: %s", rec.Body.String())
-
-	var created api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
-
-	// Minimal update: only the required fields, no api_key. Everything
-	// optional must land as its zero value.
-	update := `{"provider_id": "openai_api", "name": "openai-renamed", "upstream_url": "https://api.openai.com", "enabled": true}`
-	rec = f.do(t, nethttp.MethodPut, "/agent-network/providers/"+created.Id, update)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "update without api_key must succeed (key is preserved): %s", rec.Body.String())
-
-	var updated api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &updated))
-	assert.Equal(t, "openai-renamed", updated.Name, "sent field must apply")
-	assert.True(t, updated.Enabled, "sent field must apply")
-	assert.False(t, updated.MetadataDisabled, "omitted metadata_disabled must land as false — PUT replaces the full state")
-	assert.False(t, updated.SkipTlsVerification, "omitted skip_tls_verification must land as false")
-	assert.Nil(t, updated.ExtraValues, "omitted extra_values must be cleared")
-	assert.Equal(t, "", updated.IdentityHeaderUserId, "omitted identity header must be cleared yet stay on the wire")
-	assert.Empty(t, updated.Models, "omitted models must be cleared")
-	assert.Contains(t, rec.Body.String(), `"identity_header_user_id":""`,
-		"cleared identity header must round-trip as an explicit empty string")
-}

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -10,20 +11,19 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 // addSettingsEndpoints registers the Agent Network settings routes. The
-// settings row is bootstrapped server-side on first provider create or on the
-// first PUT carrying a cluster; GET reads it and PUT applies a partial update
-// of the mutable collection toggles (cluster/subdomain stay immutable).
+// settings row is bootstrapped server-side on first provider create; GET reads
+// it and PUT updates the mutable collection toggles (cluster/subdomain stay
+// immutable).
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
 }
 
-// updateSettings replaces the mutable settings fields on the account's row.
-// A request carrying a cluster bootstraps the row when the account doesn't
-// have one yet.
+// updateSettings applies the collection toggles to the account's settings row.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -48,9 +48,11 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// getSettings returns the account's agent-network settings. Accounts that
-// haven't been bootstrapped yet read as the defaults with an empty cluster,
-// subdomain and endpoint; the manager synthesises that view.
+// getSettings returns the account's agent-network settings. The settings
+// row is bootstrapped on first provider create, so freshly-onboarded
+// accounts have nothing to read. Rather than 404-ing in that case (which
+// the dashboard would have to special-case), return a JSON null with 200
+// so consumers can branch on the body alone.
 func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -60,6 +62,11 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
 	if err != nil {
+		var sErr *status.Error
+		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+			util.WriteJSONObject(r.Context(), w, nil)
+			return
+		}
 		util.WriteError(r.Context(), err, w)
 		return
 	}

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -1,137 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
-// convention shared with the account and DNS settings endpoints: settings
-// always read as a JSON object. Before bootstrap that object carries the
-// defaults with an empty cluster/subdomain/endpoint (the "not bootstrapped"
-// signal) and no timestamps — never a 404 and never the legacy null body.
-func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code,
-		"unbootstrapped account must read as 200 with defaults: got %d body=%s", rec.Code, rec.Body.String())
-	require.NotEqual(t, "null", trimSpace(rec.Body.String()),
-		"the legacy 200+null shape must not come back")
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Empty(t, got.Cluster, "cluster must be empty until bootstrapped")
-	assert.Empty(t, got.Subdomain, "subdomain must be empty until bootstrapped")
-	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped, not a bare dot")
-	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
-	assert.False(t, got.RedactPii, "defaults must show redaction off")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 30, *got.AccessLogRetentionDays, "defaults must show the bootstrap retention")
-	assert.Nil(t, got.CreatedAt, "no timestamps before a row exists")
-	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
-}
-
-// TestSettingsHandler_PutBootstrapsWithCluster covers the settings-first
-// bootstrap path: a PUT carrying a cluster on an unbootstrapped account
-// creates the row (cluster pinned, subdomain assigned) and applies the
-// mutable fields from the same request.
-func TestSettingsHandler_PutBootstrapsWithCluster(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be pinned from the request")
-	assert.NotEmpty(t, got.Subdomain, "subdomain must be assigned at bootstrap")
-	assert.Equal(t, got.Subdomain+".eu.proxy.netbird.io", got.Endpoint, "endpoint must combine subdomain and cluster")
-	assert.True(t, got.EnableLogCollection, "toggle from the bootstrap request must apply")
-	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 30, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
-
-	// The row is now readable via GET.
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
-}
-
-// TestSettingsHandler_PutWithoutClusterOnUnbootstrapped pins that a PUT
-// without a cluster cannot conjure a settings row out of nothing — there is
-// no cluster to pin — and surfaces as 404 like the GET.
-func TestSettingsHandler_PutWithoutClusterOnUnbootstrapped(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
-	assert.Equal(t, http.StatusNotFound, rec.Code,
-		"cluster-less PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "cluster",
-		"the error must point the caller at the bootstrap paths: %s", rec.Body.String())
-}
-
-// TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
-// with the other PUT endpoints: the request replaces every mutable field, so a
-// toggle absent from the JSON lands as its zero value rather than being
-// preserved. Cluster and subdomain survive untouched.
-func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.True(t, got.EnableLogCollection, "sent toggle must apply")
-	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
-	assert.False(t, got.RedactPii, "sent toggle must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 0, *got.AccessLogRetentionDays,
-		"retention absent from the request must land as the zero value — PUT replaces all mutable fields")
-	assert.Equal(t, before.Cluster, got.Cluster, "cluster must survive updates untouched")
-	assert.Equal(t, before.Subdomain, got.Subdomain, "subdomain must survive updates untouched")
-}
-
-// TestSettingsHandler_PutRejectsClusterChange pins cluster immutability: once
-// assigned, a differing cluster is rejected as a validation error instead of
-// being silently ignored, so callers never observe a value other than the one
-// they sent. Echoing the assigned cluster back stays valid, which lets
-// declarative clients send their full desired state idempotently.
-func TestSettingsHandler_PutRejectsClusterChange(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "us.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"cluster change must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": true}`)
-	require.Equal(t, http.StatusOK, rec.Code, "echoing the assigned cluster must stay valid: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be unchanged")
-	assert.True(t, got.RedactPii, "toggle sent alongside the echoed cluster must apply")
-}

management/internals/modules/agentnetwork/manager.go

@@ -207,7 +207,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 	}
 
 	if strings.TrimSpace(bootstrapCluster) != "" {
-		if _, err := m.bootstrapSettingsIfNeeded(ctx, m.store, provider.AccountID, bootstrapCluster); err != nil {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
 			// The provider create has already succeeded; logging the
 			// bootstrap miss matches the plan's PoC behaviour. The synth
 			// path treats a missing settings row as a no-op, and the next
@@ -559,83 +559,40 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
-// UpdateSettings replaces the mutable account-level settings — the collection
-// toggles and retention — on the account's row. When the account has no
-// settings row yet, a non-empty settings.Cluster bootstraps one (same path as
-// first provider create); without it the update fails with NotFound. On an
-// existing row the cluster and subdomain are immutable: a differing
-// settings.Cluster is rejected rather than silently ignored so callers never
-// observe a value other than what they sent. Because the collection toggles
-// change the synthesised service config (prompt-capture gating, access-log
-// emission), a reconcile is triggered so the proxy and peer network maps
-// converge on the new state.
+// UpdateSettings applies the mutable account-level settings — the collection
+// toggles — onto the existing row. Cluster and Subdomain are immutable and are
+// preserved from the persisted row regardless of the input. Because the
+// collection toggles change the synthesised service config (prompt-capture
+// gating, access-log emission), a reconcile is triggered so the proxy and peer
+// network maps converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
 
-	requestedCluster := strings.TrimSpace(settings.Cluster)
-
-	// The row lock from LockingStrengthUpdate only holds for the duration of
-	// the surrounding transaction, so the read, the cluster-immutability
-	// check, and the save must share one — otherwise concurrent PUTs could
-	// interleave between them.
-	var updated *types.Settings
-	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
-		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
-		switch {
-		case err == nil:
-			if requestedCluster != "" && requestedCluster != existing.Cluster {
-				return status.Errorf(status.InvalidArgument, "cluster is immutable once assigned (current: %s)", existing.Cluster)
-			}
-		case isNotFound(err):
-			if requestedCluster == "" {
-				return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; pass cluster to bootstrap them, or create a provider with bootstrap_cluster set")
-			}
-			// Bootstrapping pins the cluster and subdomain — a settings
-			// create on top of the update the caller already passed, matching
-			// the gate on the provider-create bootstrap path.
-			if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
-				return err
-			}
-			existing, err = m.bootstrapSettingsIfNeeded(ctx, tx, settings.AccountID, requestedCluster)
-			if err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("get agent network settings: %w", err)
-		}
-
-		existing.EnableLogCollection = settings.EnableLogCollection
-		existing.EnablePromptCollection = settings.EnablePromptCollection
-		existing.RedactPii = settings.RedactPii
-		existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
-		existing.UpdatedAt = time.Now().UTC()
-
-		if err := tx.SaveAgentNetworkSettings(ctx, existing); err != nil {
-			return fmt.Errorf("save agent network settings: %w", err)
-		}
-		updated = existing
-		return nil
-	})
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+
+	existing.EnableLogCollection = settings.EnableLogCollection
+	existing.EnablePromptCollection = settings.EnablePromptCollection
+	existing.RedactPii = settings.RedactPii
+	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+	existing.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"log_collection":    updated.EnableLogCollection,
-		"prompt_collection": updated.EnablePromptCollection,
-		"redact_pii":        updated.RedactPii,
+		"log_collection":    existing.EnableLogCollection,
+		"prompt_collection": existing.EnablePromptCollection,
+		"redact_pii":        existing.RedactPii,
 	})
 	m.reconcile(ctx, settings.AccountID)
 
-	return updated, nil
-}
-
-// isNotFound reports whether err is a status.NotFound error.
-func isNotFound(err error) bool {
-	var sErr *status.Error
-	return errors.As(err, &sErr) && sErr.Type() == status.NotFound
+	return existing, nil
 }
 
 // validateProviderRefs ensures every destination provider id refers to a
@@ -659,25 +616,22 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 	return nil
 }
 
-// GetSettings returns the agent-network settings row for the account. When no
-// row has been bootstrapped yet, the defaults are returned (without
-// persisting) with cluster and subdomain empty — settings always read as an
-// object, like the account and DNS settings endpoints.
+// GetSettings returns the agent-network settings row for the account.
+// Returns the underlying status.NotFound when no row has been
+// bootstrapped yet (i.e. the account has no providers).
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
 		return nil, err
 	}
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-		return settings, nil
-	case isNotFound(err):
-		return types.DefaultSettings(accountID), nil
-	default:
-		return nil, err
-	}
+	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 }
 
+// bootstrapSettingsIfNeeded creates the per-account agent-network
+// settings row when missing. The cluster comes from the create-time
+// hint the dashboard sends (auto-picked from the active cluster list);
+// the subdomain is picked from the curated wordlist avoiding
+// collisions on the same cluster. Idempotent: if a row already exists
+// it is returned untouched and the hint is ignored.
 // requireSettingsBootstrapPermission gates the one-time settings bootstrap a
 // first provider create performs. Pinning the account's cluster and subdomain
 // is a settings write, so it needs the settings permission on top of the
@@ -687,20 +641,14 @@ func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, ac
 	if err == nil {
 		return nil
 	}
-	if !isNotFound(err) {
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
 		return fmt.Errorf("get agent network settings: %w", err)
 	}
 	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
 }
 
-// bootstrapSettingsIfNeeded creates the per-account agent-network
-// settings row when missing. The cluster comes from the create-time
-// hint the dashboard sends (auto-picked from the active cluster list);
-// the subdomain is picked from the curated wordlist avoiding
-// collisions on the same cluster. Idempotent: if a row already exists
-// it is returned untouched and the hint is ignored. st is the store to
-// operate on — pass the transaction store when calling from within one.
-func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.Store, accountID, providerCluster string) (*types.Settings, error) {
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
 	if accountID == "" {
 		return nil, fmt.Errorf("bootstrap settings: account id is required")
 	}
@@ -708,15 +656,16 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.St
 		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
 	}
 
-	existing, err := st.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	if err == nil {
 		return existing, nil
 	}
-	if !isNotFound(err) {
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
-	siblings, err := st.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -735,12 +684,18 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.St
 	m.labelRngMu.Unlock()
 
 	now := time.Now().UTC()
-	settings := types.DefaultSettings(accountID)
-	settings.Cluster = providerCluster
-	settings.Subdomain = subdomain
-	settings.CreatedAt = now
-	settings.UpdatedAt = now
-	if err := st.SaveAgentNetworkSettings(ctx, settings); err != nil {
+	settings := &types.Settings{
+		AccountID: accountID,
+		Cluster:   providerCluster,
+		Subdomain: subdomain,
+		// Logs on by default; usage is collected regardless. Retention bounds
+		// how long full log rows are kept.
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
+		CreatedAt:              now,
+		UpdatedAt:              now,
+	}
+	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
 		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 	return settings, nil
@@ -943,8 +898,8 @@ func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.Accou
 
 func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
 
-func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.Settings, error) {
-	return types.DefaultSettings(accountID), nil
+func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
+	return nil, status.Errorf(status.NotFound, "agent network settings not found")
 }
 
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {

management/internals/modules/agentnetwork/types/provider.go

@@ -164,7 +164,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 		p.MetadataDisabled = *req.MetadataDisabled
 	}
 	// Identity-header overrides for catalogs flagged Customizable.
-	// Empty or omitted disables stamping for this dimension.
+	// nil pointer = "field omitted on the wire" → leave the stored
+	// value untouched (per the openapi description). Empty string is
+	// an explicit clear that disables stamping for this dimension.
 	if req.IdentityHeaderUserId != nil {
 		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
 	}
@@ -190,20 +192,16 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:          p.ID,
-		ProviderId:  p.ProviderID,
-		Name:        p.Name,
-		UpstreamUrl: p.UpstreamURL,
-		Models:      models,
-		// Always present on the wire so an explicitly cleared header
-		// round-trips as "" instead of vanishing from the response.
-		IdentityHeaderUserId: p.IdentityHeaderUserID,
-		IdentityHeaderGroups: p.IdentityHeaderGroups,
-		Enabled:              p.Enabled,
-		SkipTlsVerification:  p.SkipTLSVerification,
-		MetadataDisabled:     p.MetadataDisabled,
-		CreatedAt:            &created,
-		UpdatedAt:            &updated,
+		Id:                  p.ID,
+		ProviderId:          p.ProviderID,
+		Name:                p.Name,
+		UpstreamUrl:         p.UpstreamURL,
+		Models:              models,
+		Enabled:             p.Enabled,
+		SkipTlsVerification: p.SkipTLSVerification,
+		MetadataDisabled:    p.MetadataDisabled,
+		CreatedAt:           &created,
+		UpdatedAt:           &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
@@ -212,6 +210,14 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		}
 		resp.ExtraValues = &out
 	}
+	if p.IdentityHeaderUserID != "" {
+		v := p.IdentityHeaderUserID
+		resp.IdentityHeaderUserId = &v
+	}
+	if p.IdentityHeaderGroups != "" {
+		v := p.IdentityHeaderGroups
+		resp.IdentityHeaderGroups = &v
+	}
 	return resp
 }
 

management/internals/modules/agentnetwork/types/provider_test.go

@@ -77,41 +77,3 @@ func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
 	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
 	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
 }
-
-// TestProvider_IdentityHeaders_AlwaysOnWire pins that the identity header
-// fields are always present in the API response — an explicitly cleared
-// ("") header must round-trip as "" rather than vanish, so API consumers
-// (e.g. the Terraform provider) never observe a value other than the one
-// they wrote.
-func TestProvider_IdentityHeaders_AlwaysOnWire(t *testing.T) {
-	set := "x-bf-dim-netbird_user_id"
-	empty := ""
-
-	base := func() *api.AgentNetworkProviderRequest {
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "custom",
-			Name:        "bifrost",
-			UpstreamUrl: "https://bifrost.internal",
-		}
-	}
-
-	p := NewProvider("acc-1")
-	resp := p.ToAPIResponse()
-	assert.Equal(t, "", resp.IdentityHeaderUserId, "unset header must surface as empty string, not be omitted")
-	assert.Equal(t, "", resp.IdentityHeaderGroups, "unset header must surface as empty string, not be omitted")
-
-	req := base()
-	req.IdentityHeaderUserId = &set
-	p.FromAPIRequest(req)
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "configured header must round-trip")
-
-	// Omitting the field preserves it.
-	p.FromAPIRequest(base())
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "omitted header must preserve the stored value")
-
-	// An explicit "" clears it AND stays visible on the wire.
-	req = base()
-	req.IdentityHeaderUserId = &empty
-	p.FromAPIRequest(req)
-	assert.Equal(t, "", p.ToAPIResponse().IdentityHeaderUserId, "cleared header must round-trip as empty string")
-}

management/internals/modules/agentnetwork/types/settings.go

@@ -1,7 +1,6 @@
 package types
 
 import (
-	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -43,34 +42,18 @@ type Settings struct {
 // schema cohesive.
 func (Settings) TableName() string { return "agent_network_settings" }
 
-// DefaultSettings returns the settings an account observes before its row is
-// bootstrapped: log collection on with the default retention, everything else
-// off, and no cluster/subdomain assigned yet. Bootstrap persists exactly these
-// values plus the assigned cluster and subdomain, so the pre-bootstrap read
-// and the freshly bootstrapped row agree.
-func DefaultSettings(accountID string) *Settings {
-	return &Settings{
-		AccountID:              accountID,
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: DefaultAccessLogRetentionDays,
-	}
-}
-
 // Endpoint returns the bare hostname agents reach this account at:
-// `<subdomain>.<cluster>`. Empty until both halves are assigned at bootstrap.
+// `<subdomain>.<cluster>`.
 func (s *Settings) Endpoint() string {
-	if s.Cluster == "" || s.Subdomain == "" {
-		return ""
-	}
 	return s.Subdomain + "." + s.Cluster
 }
 
-// ToAPIResponse renders the settings as the API representation. The
-// timestamps are omitted while zero — a default (not yet bootstrapped) view
-// has no persisted row to date.
+// ToAPIResponse renders the settings as the API representation.
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
+	created := s.CreatedAt
+	updated := s.UpdatedAt
 	retention := s.AccessLogRetentionDays
-	resp := &api.AgentNetworkSettings{
+	return &api.AgentNetworkSettings{
 		Cluster:                s.Cluster,
 		Subdomain:              s.Subdomain,
 		Endpoint:               s.Endpoint(),
@@ -78,27 +61,14 @@ func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
 		AccessLogRetentionDays: &retention,
+		CreatedAt:              &created,
+		UpdatedAt:              &updated,
 	}
-	if !s.CreatedAt.IsZero() {
-		created := s.CreatedAt
-		resp.CreatedAt = &created
-	}
-	if !s.UpdatedAt.IsZero() {
-		updated := s.UpdatedAt
-		resp.UpdatedAt = &updated
-	}
-	return resp
 }
 
-// FromAPIRequest applies the request onto the receiver. The mutable
-// collection fields are always replaced with the request values. Cluster
-// participates only in bootstrap and the immutability check (see
-// Manager.UpdateSettings); Subdomain is server-assigned and never taken
-// from a request.
+// FromAPIRequest applies the mutable settings fields from the request. Cluster
+// and Subdomain are immutable and intentionally not touched here.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
-	if req.Cluster != nil {
-		s.Cluster = strings.TrimSpace(*req.Cluster)
-	}
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
 	s.RedactPii = req.RedactPii

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -102,20 +102,11 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
 	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
 
-	// A cluster different from the one pinned at bootstrap must be rejected
-	// outright — never silently swapped or ignored.
-	_, err = mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
-		AccountID:           accountID,
-		Cluster:             "attacker.cluster",
-		EnableLogCollection: true,
-	})
-	require.Error(t, err, "UpdateSettings with a mismatched cluster must fail")
-
-	// Flipping the toggles works with the pinned cluster echoed back (and
-	// with it omitted); the subdomain is never taken from the request.
+	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
+	// immutable fields must be ignored.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Cluster:                clusterAddr,
+		Cluster:                "attacker.cluster",
 		Subdomain:              "evil",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,

management/server/group.go

@@ -6,8 +6,6 @@ import (
 	"fmt"
 	"slices"
 
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -746,14 +744,6 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
-	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
-	}
-
-	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
-	}
-
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -885,46 +875,6 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
-// isGroupLinkedToReverseProxyService checks if a group is used as an access group
-// of a private reverse proxy service or as a bearer-auth distribution group.
-func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
-	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, svc := range services {
-		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
-			return true, svc
-		}
-		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
-			return true, svc
-		}
-	}
-	return false, nil
-}
-
-// isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
-// agent network policy in the account.
-func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {
-	policies, err := transaction.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving agent network policies while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, policy := range policies {
-		if policy == nil {
-			continue
-		}
-		if slices.Contains(policy.SourceGroups, groupID) {
-			return true, policy
-		}
-	}
-	return false, nil
-}
-
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {

management/server/group_test.go

@@ -18,8 +18,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -127,21 +125,6 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-integration",
 			"only service users with admin power can delete integration group",
 		},
-		{
-			"agent network policy",
-			"grp-for-agent-network-policy",
-			"agent network policy",
-		},
-		{
-			"reverse proxy private service access group",
-			"grp-for-rp-private",
-			"reverse proxy service",
-		},
-		{
-			"reverse proxy bearer distribution group",
-			"grp-for-rp-bearer",
-			"reverse proxy service",
-		},
 	}
 
 	for _, testCase := range testCases {
@@ -235,17 +218,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-integration"},
 			expectedReasons: []string{"only service users with admin power can delete integration group"},
 		},
-		{
-			name:            "agent network policy",
-			groupIDs:        []string{"grp-for-agent-network-policy"},
-			expectedReasons: []string{"agent network policy"},
-		},
-		{
-			name:               "reverse proxy services",
-			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
-			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -313,65 +285,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
-func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err, "Failed to create account manager")
-
-	_, account, err := initTestGroupAccount(am)
-	require.NoError(t, err, "Failed to init testing account")
-
-	deletableGroups := []*types.Group{
-		{
-			ID:        "grp-rp-bearer-disabled",
-			AccountID: account.Id,
-			Name:      "Group only in a disabled bearer auth",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-		{
-			ID:        "grp-rp-nonprivate-access",
-			AccountID: account.Id,
-			Name:      "Group only in a non-private service's access groups",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-	}
-	for _, group := range deletableGroups {
-		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
-	}
-
-	// Disabled bearer auth and stale access groups on a non-private service
-	// are inert configuration and must not block group deletion.
-	services := []*rpservice.Service{
-		{
-			ID:        "rp-svc-bearer-disabled",
-			AccountID: account.Id,
-			Domain:    "bearer-disabled.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            false,
-					DistributionGroups: []string{"grp-rp-bearer-disabled"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-nonprivate-access",
-			AccountID:    account.Id,
-			Domain:       "nonprivate.services.example.com",
-			Private:      false,
-			AccessGroups: []string{"grp-rp-nonprivate-access"},
-		},
-	}
-	for _, svc := range services {
-		require.NoError(t, am.Store.CreateService(context.Background(), svc))
-	}
-
-	for _, group := range deletableGroups {
-		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
-		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
-	}
-}
-
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -493,30 +406,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
-	groupForAgentNetworkPolicy := &types.Group{
-		ID:        "grp-for-agent-network-policy",
-		AccountID: "account-id",
-		Name:      "Group for agent network policies",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPPrivate := &types.Group{
-		ID:        "grp-for-rp-private",
-		AccountID: "account-id",
-		Name:      "Group for private reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPBearer := &types.Group{
-		ID:        "grp-for-rp-bearer",
-		AccountID: "account-id",
-		Name:      "Group for bearer reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -572,66 +461,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
-
-	agentNetworkPolicy := &agentNetworkTypes.Policy{
-		ID:           "example agent network policy",
-		AccountID:    accountID,
-		Name:         "Example agent network policy",
-		Enabled:      true,
-		SourceGroups: []string{groupForAgentNetworkPolicy.ID},
-	}
-	if err := am.Store.SaveAgentNetworkPolicy(context.Background(), agentNetworkPolicy); err != nil {
-		return nil, nil, err
-	}
-
-	// The decoy services are created first so the linkage check has to scan
-	// past services that do not reference the groups under test.
-	rpServices := []*rpservice.Service{
-		{
-			ID:           "rp-svc-private-decoy",
-			AccountID:    accountID,
-			Domain:       "private-decoy.services.example.com",
-			Private:      true,
-			AccessGroups: []string{"unrelated-group"},
-		},
-		{
-			ID:        "rp-svc-bearer-decoy",
-			AccountID: accountID,
-			Domain:    "bearer-decoy.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{"unrelated-group"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-private",
-			AccountID:    accountID,
-			Domain:       "private.services.example.com",
-			Private:      true,
-			AccessGroups: []string{groupForRPPrivate.ID},
-		},
-		{
-			ID:        "rp-svc-bearer",
-			AccountID: accountID,
-			Domain:    "bearer.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{groupForRPBearer.ID},
-				},
-			},
-		},
-	}
-	for _, svc := range rpServices {
-		if err := am.Store.CreateService(context.Background(), svc); err != nil {
-			return nil, nil, err
-		}
-	}
 
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {

management/server/types/account.go

@@ -1707,34 +1707,14 @@ func (a *Account) injectPrivateServicePolicies(svc *service.Service, proxyPeers
 	if len(proxyPeers) == 0 {
 		return
 	}
-	// A service's AccessGroups can name groups that no longer exist — persisted
-	// services and the agent-network synthesiser both carry the ids verbatim from
-	// their own state. An unresolvable source authorises nothing, so drop it here
-	// rather than let the network-map assembly resolve it to a nil group.
-	sources := a.existingGroupIDs(svc.AccessGroups)
-	if len(sources) == 0 {
-		return
-	}
 	for _, proxyPeer := range proxyPeers {
-		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer, sources))
+		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer))
 	}
 }
 
-// existingGroupIDs returns the subset of groupIDs that resolve to a group in the account,
-// preserving the input order.
-func (a *Account) existingGroupIDs(groupIDs []string) []string {
-	out := make([]string, 0, len(groupIDs))
-	for _, groupID := range groupIDs {
-		if _, ok := a.Groups[groupID]; ok {
-			out = append(out, groupID)
-		}
-	}
-	return out
-}
-
-func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer, accessGroups []string) *Policy {
+func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer) *Policy {
 	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
-	sources := append([]string(nil), accessGroups...)
+	sources := append([]string(nil), svc.AccessGroups...)
 	return &Policy{
 		ID:      policyID,
 		Name:    fmt.Sprintf("Private Access to %s", svc.Name),

shared/management/client/rest/agentnetwork.go

@@ -1,381 +0,0 @@
-package rest
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// AgentNetworkAPI APIs for the Agent Network (AI/LLM gateway), do not use directly
-// see more: https://docs.netbird.io/api/resources/agent-network
-type AgentNetworkAPI struct {
-	c *Client
-}
-
-// ListCatalogProviders lists the catalog of supported upstream AI providers
-// (openai_api, anthropic_api, bedrock_api, ...) with their default models and
-// pricing, used to prefill provider create forms.
-func (a *AgentNetworkAPI) ListCatalogProviders(ctx context.Context) ([]api.AgentNetworkCatalogProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/catalog/providers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkCatalogProvider](resp)
-	return ret, err
-}
-
-// ListProviders lists all Agent Network providers
-func (a *AgentNetworkAPI) ListProviders(ctx context.Context) ([]api.AgentNetworkProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkProvider](resp)
-	return ret, err
-}
-
-// GetProvider gets Agent Network provider info
-func (a *AgentNetworkAPI) GetProvider(ctx context.Context, providerID string) (*api.AgentNetworkProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers/"+providerID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// CreateProvider creates a new Agent Network provider. Set
-// request.BootstrapCluster on the account's first provider to bootstrap the
-// per-account gateway endpoint (alternatively bootstrap via UpdateSettings
-// with a cluster).
-func (a *AgentNetworkAPI) CreateProvider(ctx context.Context, request api.PostApiAgentNetworkProvidersJSONRequestBody) (*api.AgentNetworkProvider, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/providers", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// UpdateProvider updates an Agent Network provider. The request replaces the
-// provider's mutable state; only an omitted api_key keeps the stored key
-// (secrets are never required to round-trip).
-func (a *AgentNetworkAPI) UpdateProvider(ctx context.Context, providerID string, request api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody) (*api.AgentNetworkProvider, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/providers/"+providerID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// DeleteProvider deletes an Agent Network provider. Fails while any policy
-// still references the provider — detach it first.
-func (a *AgentNetworkAPI) DeleteProvider(ctx context.Context, providerID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/providers/"+providerID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListPolicies lists all Agent Network policies
-func (a *AgentNetworkAPI) ListPolicies(ctx context.Context) ([]api.AgentNetworkPolicy, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkPolicy](resp)
-	return ret, err
-}
-
-// GetPolicy gets Agent Network policy info
-func (a *AgentNetworkAPI) GetPolicy(ctx context.Context, policyID string) (*api.AgentNetworkPolicy, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies/"+policyID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// CreatePolicy creates a new Agent Network policy
-func (a *AgentNetworkAPI) CreatePolicy(ctx context.Context, request api.PostApiAgentNetworkPoliciesJSONRequestBody) (*api.AgentNetworkPolicy, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/policies", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// UpdatePolicy updates an Agent Network policy
-func (a *AgentNetworkAPI) UpdatePolicy(ctx context.Context, policyID string, request api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody) (*api.AgentNetworkPolicy, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/policies/"+policyID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// DeletePolicy deletes an Agent Network policy
-func (a *AgentNetworkAPI) DeletePolicy(ctx context.Context, policyID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/policies/"+policyID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListGuardrails lists all Agent Network guardrails
-func (a *AgentNetworkAPI) ListGuardrails(ctx context.Context) ([]api.AgentNetworkGuardrail, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkGuardrail](resp)
-	return ret, err
-}
-
-// GetGuardrail gets Agent Network guardrail info
-func (a *AgentNetworkAPI) GetGuardrail(ctx context.Context, guardrailID string) (*api.AgentNetworkGuardrail, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// CreateGuardrail creates a new Agent Network guardrail
-func (a *AgentNetworkAPI) CreateGuardrail(ctx context.Context, request api.PostApiAgentNetworkGuardrailsJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/guardrails", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// UpdateGuardrail updates an Agent Network guardrail
-func (a *AgentNetworkAPI) UpdateGuardrail(ctx context.Context, guardrailID string, request api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/guardrails/"+guardrailID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// DeleteGuardrail deletes an Agent Network guardrail
-func (a *AgentNetworkAPI) DeleteGuardrail(ctx context.Context, guardrailID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListBudgetRules lists all account-level Agent Network budget rules
-func (a *AgentNetworkAPI) ListBudgetRules(ctx context.Context) ([]api.AgentNetworkBudgetRule, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkBudgetRule](resp)
-	return ret, err
-}
-
-// GetBudgetRule gets Agent Network budget rule info
-func (a *AgentNetworkAPI) GetBudgetRule(ctx context.Context, ruleID string) (*api.AgentNetworkBudgetRule, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// CreateBudgetRule creates a new Agent Network budget rule
-func (a *AgentNetworkAPI) CreateBudgetRule(ctx context.Context, request api.PostApiAgentNetworkBudgetRulesJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/budget-rules", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// UpdateBudgetRule updates an Agent Network budget rule
-func (a *AgentNetworkAPI) UpdateBudgetRule(ctx context.Context, ruleID string, request api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/budget-rules/"+ruleID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// DeleteBudgetRule deletes an Agent Network budget rule
-func (a *AgentNetworkAPI) DeleteBudgetRule(ctx context.Context, ruleID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// GetSettings gets the account's Agent Network gateway settings (cluster,
-// subdomain, endpoint, collection toggles). An account that has not been
-// bootstrapped yet — via UpdateSettings with a cluster, or by creating the
-// first provider with bootstrap_cluster set — reads as the defaults with an
-// empty Cluster, Subdomain and Endpoint. Management servers prior to that
-// contract answered 200 with a JSON null body instead; that legacy shape is
-// translated to an APIError matchable via IsNotFound rather than fabricating
-// defaults the server never stated.
-func (a *AgentNetworkAPI) GetSettings(ctx context.Context) (*api.AgentNetworkSettings, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/settings", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	if trimmed := bytes.TrimSpace(body); len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
-		return nil, &APIError{StatusCode: http.StatusNotFound, Message: "agent network settings not found"}
-	}
-	var ret api.AgentNetworkSettings
-	if err := json.Unmarshal(body, &ret); err != nil {
-		return nil, err
-	}
-	return &ret, nil
-}
-
-// UpdateSettings updates the account's Agent Network settings; the request
-// replaces every mutable field (collection toggles and retention). Setting
-// request.Cluster bootstraps the settings row when the account does not have
-// one yet; on a bootstrapped account it must match the assigned cluster (or
-// be nil) and any other value is rejected — the cluster is immutable.
-func (a *AgentNetworkAPI) UpdateSettings(ctx context.Context, request api.PutApiAgentNetworkSettingsJSONRequestBody) (*api.AgentNetworkSettings, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/settings", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkSettings](resp)
-	return &ret, err
-}

shared/management/client/rest/agentnetwork_test.go

@@ -1,497 +0,0 @@
-//go:build integration
-
-package rest_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/client/rest"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-var (
-	testAgentNetworkProvider = api.AgentNetworkProvider{
-		Id:          "ainp_test",
-		ProviderId:  "openai_api",
-		Name:        "OpenAI",
-		UpstreamUrl: "https://api.openai.com",
-		Models:      []api.AgentNetworkProviderModel{},
-		Enabled:     true,
-	}
-
-	testAgentNetworkPolicy = api.AgentNetworkPolicy{
-		Id:                     "ainpol_test",
-		Name:                   "Engineering → OpenAI",
-		Enabled:                true,
-		SourceGroups:           []string{"grp-eng"},
-		DestinationProviderIds: []string{"ainp_test"},
-	}
-
-	testAgentNetworkGuardrail = api.AgentNetworkGuardrail{
-		Id:   "aingr_test",
-		Name: "No secrets",
-	}
-
-	testAgentNetworkBudgetRule = api.AgentNetworkBudgetRule{
-		Id:      "ainbud_test",
-		Name:    "Org monthly ceiling",
-		Enabled: true,
-	}
-
-	testAgentNetworkSettings = api.AgentNetworkSettings{
-		Cluster:                "eu.proxy.netbird.io",
-		Subdomain:              "violet",
-		Endpoint:               "violet.eu.proxy.netbird.io",
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: ptr(30),
-	}
-)
-
-func TestAgentNetwork_ListCatalogProviders_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/catalog/providers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkCatalogProvider{{Id: "openai_api", Name: "OpenAI"}})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListCatalogProviders(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, "openai_api", ret[0].Id)
-	})
-}
-
-func TestAgentNetwork_ListProviders_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkProvider{testAgentNetworkProvider})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListProviders(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkProvider, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "GET", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_GetProvider_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
-		require.Error(t, err)
-		assert.True(t, rest.IsNotFound(err), "a 404 must be matchable via IsNotFound")
-	})
-}
-
-func TestAgentNetwork_CreateProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiAgentNetworkProvidersJSONRequestBody
-			require.NoError(t, json.Unmarshal(reqBytes, &req))
-			assert.Equal(t, "OpenAI", req.Name)
-			require.NotNil(t, req.BootstrapCluster)
-			assert.Equal(t, "eu.proxy.netbird.io", *req.BootstrapCluster)
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateProvider(context.Background(), api.PostApiAgentNetworkProvidersJSONRequestBody{
-			ProviderId:       "openai_api",
-			Name:             "OpenAI",
-			UpstreamUrl:      "https://api.openai.com",
-			ApiKey:           ptr("sk-test"),
-			BootstrapCluster: ptr("eu.proxy.netbird.io"),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			// Omitted optional fields must be absent from the wire (not
-			// zero-valued) so the server-side merge preserves them.
-			assert.NotContains(t, string(reqBytes), "api_key")
-			assert.NotContains(t, string(reqBytes), "models")
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateProvider(context.Background(), "ainp_test", api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody{
-			ProviderId:  "openai_api",
-			Name:        "OpenAI",
-			UpstreamUrl: "https://api.openai.com",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteProvider(context.Background(), "ainp_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListPolicies_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkPolicy{testAgentNetworkPolicy})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListPolicies(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkPolicy, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetPolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetPolicy(context.Background(), "ainpol_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_CreatePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreatePolicy(context.Background(), api.PostApiAgentNetworkPoliciesJSONRequestBody{
-			Name:                   "Engineering → OpenAI",
-			SourceGroups:           []string{"grp-eng"},
-			DestinationProviderIds: []string{"ainp_test"},
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdatePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdatePolicy(context.Background(), "ainpol_test", api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody{
-			Name:                   "Engineering → OpenAI",
-			SourceGroups:           []string{"grp-eng"},
-			DestinationProviderIds: []string{"ainp_test"},
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_DeletePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeletePolicy(context.Background(), "ainpol_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListGuardrails_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkGuardrail{testAgentNetworkGuardrail})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListGuardrails(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkGuardrail, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetGuardrail(context.Background(), "aingr_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_CreateGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateGuardrail(context.Background(), api.PostApiAgentNetworkGuardrailsJSONRequestBody{
-			Name: "No secrets",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateGuardrail(context.Background(), "aingr_test", api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody{
-			Name: "No secrets",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteGuardrail(context.Background(), "aingr_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListBudgetRules_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkBudgetRule{testAgentNetworkBudgetRule})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListBudgetRules(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkBudgetRule, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetBudgetRule(context.Background(), "ainbud_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_CreateBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateBudgetRule(context.Background(), api.PostApiAgentNetworkBudgetRulesJSONRequestBody{
-			Name: "Org monthly ceiling",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateBudgetRule(context.Background(), "ainbud_test", api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody{
-			Name: "Org monthly ceiling",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteBudgetRule(context.Background(), "ainbud_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_GetSettings_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkSettings)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkSettings, *ret)
-	})
-}
-
-// TestAgentNetwork_GetSettings_UnbootstrappedDefaults pins the settings-read
-// contract: an unbootstrapped account answers 200 with the defaults and empty
-// cluster/subdomain/endpoint, which the client passes through untouched.
-func TestAgentNetwork_GetSettings_UnbootstrappedDefaults(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(api.AgentNetworkSettings{
-				EnableLogCollection:    true,
-				AccessLogRetentionDays: ptr(30),
-			})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.NoError(t, err)
-		assert.Empty(t, ret.Endpoint, "empty endpoint is the not-bootstrapped signal")
-		assert.True(t, ret.EnableLogCollection, "defaults must pass through")
-	})
-}
-
-func TestAgentNetwork_GetSettings_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "no", Code: 403})
-			w.WriteHeader(403)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.GetSettings(context.Background())
-		require.Error(t, err)
-		assert.Equal(t, "no", err.Error())
-	})
-}
-
-// TestAgentNetwork_GetSettings_LegacyNullBody pins the compatibility shim for
-// management servers that answered 200 with a JSON null body before the
-// defaults contract: the client translates that shape into an IsNotFound
-// error instead of returning a bogus zero-valued settings object or
-// fabricating defaults the server never stated.
-func TestAgentNetwork_GetSettings_LegacyNullBody(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			_, err := w.Write([]byte("null"))
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.Error(t, err)
-		assert.Nil(t, ret)
-		assert.True(t, rest.IsNotFound(err), "the legacy 200+null shape must surface as IsNotFound")
-	})
-}
-
-func TestAgentNetwork_UpdateSettings_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PutApiAgentNetworkSettingsJSONRequestBody
-			require.NoError(t, json.Unmarshal(reqBytes, &req))
-			require.NotNil(t, req.Cluster, "bootstrap cluster must be on the wire")
-			assert.Equal(t, "eu.proxy.netbird.io", *req.Cluster)
-			assert.True(t, req.EnableLogCollection)
-			retBytes, _ := json.Marshal(testAgentNetworkSettings)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
-			Cluster:             ptr("eu.proxy.netbird.io"),
-			EnableLogCollection: true,
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkSettings, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateSettings_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "cluster is immutable once assigned (current: eu.proxy.netbird.io)", Code: 422})
-			w.WriteHeader(422)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
-			Cluster: ptr("us.proxy.netbird.io"),
-		})
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "immutable")
-	})
-}

shared/management/client/rest/client.go

@@ -147,10 +147,6 @@ type Client struct {
 	// ReverseProxyTokens account-scoped proxy access tokens used to register
 	// self-hosted (bring-your-own-proxy) `netbird proxy` instances.
 	ReverseProxyTokens *ReverseProxyTokensAPI
-
-	// AgentNetwork NetBird Agent Network (AI/LLM gateway) APIs: catalog,
-	// providers, policies, guardrails, budget rules and account settings.
-	AgentNetwork *AgentNetworkAPI
 }
 
 // New initialize new Client instance using PAT token
@@ -213,7 +209,6 @@ func (c *Client) initialize() {
 	c.ReverseProxyClusters = &ReverseProxyClustersAPI{c}
 	c.ReverseProxyDomains = &ReverseProxyDomainsAPI{c}
 	c.ReverseProxyTokens = &ReverseProxyTokensAPI{c}
-	c.AgentNetwork = &AgentNetworkAPI{c}
 }
 
 // NewRequest creates and executes new management API request

shared/management/http/api/openapi.yml

@@ -5149,12 +5149,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5186,8 +5186,6 @@ components:
         - name
         - upstream_url
         - models
-        - identity_header_user_id
-        - identity_header_groups
         - enabled
         - skip_tls_verification
         - metadata_disabled
@@ -5224,7 +5222,7 @@ components:
         extra_values:
           type: object
           description: |
-            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
+            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
           additionalProperties:
             type: string
           example:
@@ -5232,12 +5230,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
+            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
+            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5245,11 +5243,11 @@ components:
           example: true
         skip_tls_verification:
           type: boolean
-          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
+          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
           example: false
         metadata_disabled:
           type: boolean
-          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
+          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
           example: false
       required:
         - provider_id
@@ -6193,19 +6191,19 @@ components:
         - cache_cost_usd
     AgentNetworkSettings:
       type: object
-      description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are assigned at bootstrap and immutable thereafter. Before bootstrap the account reads as the default values with empty cluster, subdomain and endpoint.
+      description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
       properties:
         cluster:
           type: string
-          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint. Empty until the account is bootstrapped.
+          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
           example: "eu.proxy.netbird.io"
         subdomain:
           type: string
-          description: Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint. Empty until the account is bootstrapped.
+          description: Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
           example: "violet"
         endpoint:
           type: string
-          description: Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`. Empty until the account is bootstrapped.
+          description: Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
           example: "violet.eu.proxy.netbird.io"
         enable_log_collection:
           type: boolean
@@ -6226,13 +6224,13 @@ components:
         created_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was created. Absent until the account is bootstrapped.
+          description: Timestamp when the settings row was created.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
         updated_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
+          description: Timestamp when the settings row was last updated.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
       required:
@@ -6242,14 +6240,12 @@ components:
         - enable_log_collection
         - enable_prompt_collection
         - redact_pii
+        - created_at
+        - updated_at
     AgentNetworkSettingsRequest:
       type: object
-      description: Account-level Agent Network settings update. The request replaces every mutable field. `cluster` additionally bootstraps the per-account settings row when the account does not have one yet; the subdomain is always server-assigned.
+      description: Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
       properties:
-        cluster:
-          type: string
-          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint. When the account has no settings row yet, providing it bootstraps the row (assigning the subdomain that forms the agent endpoint). The cluster is immutable once assigned — later updates must omit it or send the assigned value; any other value is rejected.
-          example: "eu.proxy.netbird.io"
         enable_log_collection:
           type: boolean
           description: Whether per-request access-log entries are collected for this account's agent-network traffic.
@@ -13694,7 +13690,7 @@ paths:
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings
-      description: Returns the per-account Agent Network gateway settings (cluster, subdomain, endpoint). Before the account is bootstrapped — on first provider create (`bootstrap_cluster`) or via PUT with `cluster` — the response carries the default values with empty cluster, subdomain and endpoint.
+      description: Returns the per-account Agent Network gateway settings (cluster, subdomain, endpoint). Returns 404 when no provider has been created yet — settings are lazily bootstrapped on first provider create.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13710,11 +13706,13 @@ paths:
           "$ref": "#/components/responses/requires_authentication"
         '403':
           "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
     put:
       summary: Update Agent Network settings
-      description: Updates the account-level Agent Network settings; the request replaces every mutable field (collection toggles and retention). When the account has no settings row yet, providing `cluster` bootstraps it (assigning the subdomain that forms the agent endpoint); without `cluster` the request returns 404. Sending a `cluster` different from the assigned one is rejected (the cluster is immutable once assigned). The subdomain is always server-assigned and immutable.
+      description: Updates the mutable account-level Agent Network settings (collection toggles). Cluster and subdomain are immutable and ignored if sent. Returns 404 when settings have not been bootstrapped (no provider created yet).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13740,8 +13738,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '404':
           "$ref": "#/components/responses/not_found"
-        '422':
-          "$ref": "#/components/responses/validation_failed"
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/agent-network/budget-rules:

shared/management/http/api/types.gen.go

@@ -2275,11 +2275,11 @@ type AgentNetworkProvider struct {
 	// Id Provider ID
 	Id string `json:"id"`
 
-	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
-	IdentityHeaderGroups string `json:"identity_header_groups"`
+	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
 
-	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
-	IdentityHeaderUserId string `json:"identity_header_user_id"`
+	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
 	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
 	MetadataDisabled bool `json:"metadata_disabled"`
@@ -2335,16 +2335,16 @@ type AgentNetworkProviderRequest struct {
 	// Enabled Whether the provider is enabled. Defaults to true on create.
 	Enabled *bool `json:"enabled,omitempty"`
 
-	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
+	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
 	ExtraValues *map[string]string `json:"extra_values,omitempty"`
 
-	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
+	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
 	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
 
-	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
+	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
-	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
+	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
 	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
 
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
@@ -2356,22 +2356,22 @@ type AgentNetworkProviderRequest struct {
 	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
 	ProviderId string `json:"provider_id"`
 
-	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
+	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
 	SkipTlsVerification *bool `json:"skip_tls_verification,omitempty"`
 
 	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
 	UpstreamUrl string `json:"upstream_url"`
 }
 
-// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; cluster and subdomain are assigned at bootstrap and immutable thereafter. Before bootstrap the account reads as the default values with empty cluster, subdomain and endpoint.
+// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
 type AgentNetworkSettings struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Usage records are retained independently.
 	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
 
-	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint. Empty until the account is bootstrapped.
+	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
 	Cluster string `json:"cluster"`
 
-	// CreatedAt Timestamp when the settings row was created. Absent until the account is bootstrapped.
+	// CreatedAt Timestamp when the settings row was created.
 	CreatedAt *time.Time `json:"created_at,omitempty"`
 
 	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
@@ -2380,27 +2380,24 @@ type AgentNetworkSettings struct {
 	// EnablePromptCollection Master switch for request/response prompt capture. Capture runs only when this is on AND a policy guardrail also enables it.
 	EnablePromptCollection bool `json:"enable_prompt_collection"`
 
-	// Endpoint Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`. Empty until the account is bootstrapped.
+	// Endpoint Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
 	Endpoint string `json:"endpoint"`
 
 	// RedactPii Whether captured prompts have PII redacted. Effective redaction is the OR of this and any policy guardrail's redact setting.
 	RedactPii bool `json:"redact_pii"`
 
-	// Subdomain Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint. Empty until the account is bootstrapped.
+	// Subdomain Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
 	Subdomain string `json:"subdomain"`
 
-	// UpdatedAt Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
+	// UpdatedAt Timestamp when the settings row was last updated.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
 }
 
-// AgentNetworkSettingsRequest Account-level Agent Network settings update. The request replaces every mutable field. `cluster` additionally bootstraps the per-account settings row when the account does not have one yet; the subdomain is always server-assigned.
+// AgentNetworkSettingsRequest Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
 type AgentNetworkSettingsRequest struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
 	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
 
-	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint. When the account has no settings row yet, providing it bootstraps the row (assigning the subdomain that forms the agent endpoint). The cluster is immutable once assigned — later updates must omit it or send the assigned value; any other value is rejected.
-	Cluster *string `json:"cluster,omitempty"`
-
 	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
 	EnableLogCollection bool `json:"enable_log_collection"`