Reword the P2P to relay switch comment

.github/workflows/golang-test-linux.yml

@@ -730,11 +730,6 @@ jobs:
       - name: Install modules
         run: go mod tidy
 
-      - name: Run Mage
-        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0
-        with:
-          install-only: true
-
       - name: check git status
         run: git --no-pager diff --exit-code
 
@@ -743,7 +738,9 @@ jobs:
           CGO_ENABLED=1 GOARCH=${{ matrix.arch }} \
           NETBIRD_STORE_ENGINE=${{ matrix.store }} \
           CI=true \
-          mage integrationtest:all -gotestflags="-coverprofile=coverage.txt"
+          go test -tags=integration -coverprofile=coverage.txt \
+          -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' \
+          -timeout 20m ./management/server/http/...
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'

client/cmd/testutil_test.go

@@ -124,7 +124,7 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config)
 
 	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {

client/embed/embed_test.go

@@ -146,7 +146,7 @@ func startManagement(t *testing.T, signalAddr string) string {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(context.Background(), testStore)
-	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(testStore, peersManager), cfg, nil)
+	networkMapController := controller.NewController(context.Background(), testStore, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(testStore, peersManager), cfg)
 	accountManager, err := mgmt.BuildManager(context.Background(), cfg, testStore, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
 	require.NoError(t, err)
 

client/iface/wgproxy/bind/proxy.go

@@ -53,15 +53,15 @@ func NewProxyBind(bind Bind, mtu uint16) *ProxyBind {
 	return p
 }
 
-// AddTurnConn adds a new connection to the bind.
+// AddRelayedConn adds a new connection to the bind.
 // endpoint is the NetBird address of the remote peer. The SetEndpoint return with the address what will be used in the
 // WireGuard configuration.
 //
 // Parameters:
 //   - ctx: Context is used for proxyToLocal to avoid unnecessary error messages
 //   - nbAddr: The NetBird UDP address of the remote peer, it required to generate fake address
-//   - remoteConn: The established TURN connection to the remote peer
-func (p *ProxyBind) AddTurnConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
+//   - remoteConn: The established relayed connection to the remote peer
+func (p *ProxyBind) AddRelayedConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
 	fakeNetIP, err := fakeAddress(nbAddr)
 	if err != nil {
 		return err

client/iface/wgproxy/ebpf/proxy.go

@@ -30,9 +30,9 @@ type WGEBPFProxy struct {
 	proxyPort         int
 	mtu               uint16
 
-	ebpfManager   ebpfMgr.Manager
-	turnConnStore map[uint16]net.Conn
-	turnConnMutex sync.Mutex
+	ebpfManager      ebpfMgr.Manager
+	relayedConnStore map[uint16]net.Conn
+	relayedConnMutex sync.Mutex
 
 	lastUsedPort uint16
 	rawConnIPv4  net.PacketConn
@@ -50,7 +50,7 @@ func NewWGEBPFProxy(wgPort int, mtu uint16) *WGEBPFProxy {
 		localWGListenPort: wgPort,
 		mtu:               mtu,
 		ebpfManager:       ebpf.GetEbpfManagerInstance(),
-		turnConnStore:     make(map[uint16]net.Conn),
+		relayedConnStore:  make(map[uint16]net.Conn),
 	}
 	return wgProxy
 }
@@ -110,14 +110,14 @@ func (p *WGEBPFProxy) Listen() error {
 	return nil
 }
 
-// AddTurnConn add new turn connection for the proxy
-func (p *WGEBPFProxy) AddTurnConn(turnConn net.Conn) (*net.UDPAddr, error) {
-	wgEndpointPort, err := p.storeTurnConn(turnConn)
+// AddRelayedConn add new relayed connection for the proxy
+func (p *WGEBPFProxy) AddRelayedConn(relayedConn net.Conn) (*net.UDPAddr, error) {
+	wgEndpointPort, err := p.storeRelayedConn(relayedConn)
 	if err != nil {
 		return nil, err
 	}
 
-	log.Infof("turn conn added to wg proxy store: %s, endpoint port: :%d", turnConn.RemoteAddr(), wgEndpointPort)
+	log.Infof("relayed conn added to wg proxy store: %s, endpoint port: :%d", relayedConn.RemoteAddr(), wgEndpointPort)
 
 	wgEndpoint := &net.UDPAddr{
 		IP:   net.ParseIP(loopbackAddr),
@@ -186,48 +186,48 @@ func (p *WGEBPFProxy) readAndForwardPacket(buf []byte) error {
 		return fmt.Errorf("failed to read UDP packet from WG: %w", err)
 	}
 
-	p.turnConnMutex.Lock()
-	conn, ok := p.turnConnStore[uint16(addr.Port)]
-	p.turnConnMutex.Unlock()
+	p.relayedConnMutex.Lock()
+	conn, ok := p.relayedConnStore[uint16(addr.Port)]
+	p.relayedConnMutex.Unlock()
 	if !ok {
 		if p.ctx.Err() == nil {
-			log.Debugf("turn conn not found by port because conn already has been closed: %d", addr.Port)
+			log.Debugf("relayed conn not found by port because conn already has been closed: %d", addr.Port)
 		}
 		return nil
 	}
 
 	if _, err := conn.Write(buf[:n]); err != nil {
-		return fmt.Errorf("failed to forward local WG packet (%d) to remote turn conn: %w", addr.Port, err)
+		return fmt.Errorf("forward local WG packet (%d) to remote relayed conn: %w", addr.Port, err)
 	}
 	return nil
 }
 
-func (p *WGEBPFProxy) storeTurnConn(turnConn net.Conn) (uint16, error) {
-	p.turnConnMutex.Lock()
-	defer p.turnConnMutex.Unlock()
+func (p *WGEBPFProxy) storeRelayedConn(relayedConn net.Conn) (uint16, error) {
+	p.relayedConnMutex.Lock()
+	defer p.relayedConnMutex.Unlock()
 
 	np, err := p.nextFreePort()
 	if err != nil {
 		return np, err
 	}
-	p.turnConnStore[np] = turnConn
+	p.relayedConnStore[np] = relayedConn
 	return np, nil
 }
 
-func (p *WGEBPFProxy) removeTurnConn(turnConnID uint16) {
-	p.turnConnMutex.Lock()
-	defer p.turnConnMutex.Unlock()
+func (p *WGEBPFProxy) removeRelayedConn(relayedConnID uint16) {
+	p.relayedConnMutex.Lock()
+	defer p.relayedConnMutex.Unlock()
 
-	_, ok := p.turnConnStore[turnConnID]
+	_, ok := p.relayedConnStore[relayedConnID]
 	if ok {
-		log.Debugf("remove turn conn from store by port: %d", turnConnID)
+		log.Debugf("remove relayed conn from store by port: %d", relayedConnID)
 	}
-	delete(p.turnConnStore, turnConnID)
+	delete(p.relayedConnStore, relayedConnID)
 }
 
 func (p *WGEBPFProxy) nextFreePort() (uint16, error) {
-	if len(p.turnConnStore) == 65535 {
-		return 0, fmt.Errorf("reached maximum turn connection numbers")
+	if len(p.relayedConnStore) == 65535 {
+		return 0, fmt.Errorf("reached maximum relayed connection numbers")
 	}
 generatePort:
 	if p.lastUsedPort == 65535 {
@@ -236,7 +236,7 @@ generatePort:
 		p.lastUsedPort++
 	}
 
-	if _, ok := p.turnConnStore[p.lastUsedPort]; ok {
+	if _, ok := p.relayedConnStore[p.lastUsedPort]; ok {
 		goto generatePort
 	}
 	return p.lastUsedPort, nil

client/iface/wgproxy/ebpf/proxy_test.go

@@ -9,32 +9,32 @@ import (
 func TestWGEBPFProxy_connStore(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
-	p, _ := wgProxy.storeTurnConn(nil)
+	p, _ := wgProxy.storeRelayedConn(nil)
 	if p != 1 {
 		t.Errorf("invalid initial port: %d", wgProxy.lastUsedPort)
 	}
 
 	numOfConns := 10
 	for i := 0; i < numOfConns; i++ {
-		p, _ = wgProxy.storeTurnConn(nil)
+		p, _ = wgProxy.storeRelayedConn(nil)
 	}
 	if p != uint16(numOfConns)+1 {
 		t.Errorf("invalid last used port: %d, expected: %d", p, numOfConns+1)
 	}
-	if len(wgProxy.turnConnStore) != numOfConns+1 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), numOfConns+1)
+	if len(wgProxy.relayedConnStore) != numOfConns+1 {
+		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.relayedConnStore), numOfConns+1)
 	}
 }
 
 func TestWGEBPFProxy_portCalculation_overflow(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
-	_, _ = wgProxy.storeTurnConn(nil)
+	_, _ = wgProxy.storeRelayedConn(nil)
 	wgProxy.lastUsedPort = 65535
-	p, _ := wgProxy.storeTurnConn(nil)
+	p, _ := wgProxy.storeRelayedConn(nil)
 
-	if len(wgProxy.turnConnStore) != 2 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), 2)
+	if len(wgProxy.relayedConnStore) != 2 {
+		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.relayedConnStore), 2)
 	}
 
 	if p != 2 {
@@ -46,11 +46,11 @@ func TestWGEBPFProxy_portCalculation_maxConn(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
 	for i := 0; i < 65535; i++ {
-		_, _ = wgProxy.storeTurnConn(nil)
+		_, _ = wgProxy.storeRelayedConn(nil)
 	}
 
-	_, err := wgProxy.storeTurnConn(nil)
+	_, err := wgProxy.storeRelayedConn(nil)
 	if err == nil {
-		t.Errorf("invalid turn conn store calculation")
+		t.Errorf("invalid relayed conn store calculation")
 	}
 }

client/iface/wgproxy/ebpf/wrapper.go

@@ -121,10 +121,10 @@ func NewProxyWrapper(proxy *WGEBPFProxy) *ProxyWrapper {
 	}
 }
 
-func (p *ProxyWrapper) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
-	addr, err := p.wgeBPFProxy.AddTurnConn(remoteConn)
+func (p *ProxyWrapper) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+	addr, err := p.wgeBPFProxy.AddRelayedConn(remoteConn)
 	if err != nil {
-		return fmt.Errorf("add turn conn: %w", err)
+		return fmt.Errorf("add relayed conn: %w", err)
 	}
 
 	headers, err := NewPacketHeaders(p.wgeBPFProxy.localWGListenPort, addr)
@@ -252,7 +252,7 @@ func (p *ProxyWrapper) CloseConn() error {
 }
 
 func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
-	defer p.wgeBPFProxy.removeTurnConn(uint16(p.wgRelayedEndpointAddr.Port))
+	defer p.wgeBPFProxy.removeRelayedConn(uint16(p.wgRelayedEndpointAddr.Port))
 
 	buf := make([]byte, p.wgeBPFProxy.mtu+bufsize.WGBufferOverhead)
 	for {
@@ -273,7 +273,7 @@ func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
 			if ctx.Err() != nil {
 				return
 			}
-			log.Errorf("failed to write out turn pkg to local conn: %v", err)
+			log.Errorf("failed to write out relayed pkg to local conn: %v", err)
 		}
 	}
 }
@@ -286,7 +286,7 @@ func (p *ProxyWrapper) readFromRemote(ctx context.Context, buf []byte) (int, err
 		}
 		p.closeListener.Notify()
 		if !errors.Is(err, io.EOF) {
-			log.Errorf("failed to read from turn conn (endpoint: :%d): %s", p.wgRelayedEndpointAddr.Port, err)
+			log.Errorf("failed to read from relayed conn (endpoint: :%d): %s", p.wgRelayedEndpointAddr.Port, err)
 		}
 		return 0, err
 	}

client/iface/wgproxy/proxy.go

@@ -7,7 +7,7 @@ import (
 
 // Proxy is a transfer layer between the relayed connection and the WireGuard
 type Proxy interface {
-	AddTurnConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
+	AddRelayedConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
 	EndpointAddr() *net.UDPAddr // EndpointAddr returns the address of the WireGuard peer endpoint
 	Work()                      // Work start or resume the proxy
 	Pause()                     // Pause to forward the packages from remote connection to WireGuard. The opposite way still works.

client/iface/wgproxy/proxy_test.go

@@ -95,7 +95,7 @@ func TestProxyCloseByRemoteConn(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			addr, _ := net.ResolveUDPAddr("udp", "100.108.135.221:51892")
 			relayedConn := newMockConn()
-			err := tt.proxy.AddTurnConn(ctx, addr, relayedConn)
+			err := tt.proxy.AddRelayedConn(ctx, addr, relayedConn)
 			if err != nil {
 				t.Errorf("error: %v", err)
 			}
@@ -157,7 +157,7 @@ func redirectTraffic(t *testing.T, proxy Proxy, wgPort int, endPointAddr *net.UD
 		_ = relayedServer.Close()
 	}()
 
-	if err := proxy.AddTurnConn(context.Background(), endPointAddr, relayedConn); err != nil {
+	if err := proxy.AddRelayedConn(context.Background(), endPointAddr, relayedConn); err != nil {
 		t.Errorf("error: %v", err)
 	}
 	defer func() {

client/iface/wgproxy/redirect_test.go

@@ -119,9 +119,9 @@ func testRedirectAs(t *testing.T, proxy Proxy, wgPort int, nbAddr, p2pEndpoint *
 	}
 	defer relayConn.Close()
 
-	// Add TURN connection to proxy
-	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add TURN connection: %v", err)
+	// Add relayed connection to proxy
+	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add relayed connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {
@@ -304,8 +304,8 @@ func TestRedirectAs_Multiple_Switches(t *testing.T) {
 		Port: 38746,
 	}
 
-	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add TURN connection: %v", err)
+	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add relayed connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {

client/iface/wgproxy/udp/proxy.go

@@ -51,12 +51,12 @@ func NewWGUDPProxy(wgPort int, mtu uint16) *WGUDPProxy {
 	return p
 }
 
-// AddTurnConn
+// AddRelayedConn dials the local WireGuard port and stores the relayed connection.
 // The provided Context must be non-nil. If the context expires before
 // the connection is complete, an error is returned. Once successfully
 // connected, any expiration of the context will not affect the
 // connection.
-func (p *WGUDPProxy) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+func (p *WGUDPProxy) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
 	dialer := net.Dialer{}
 	localConn, err := dialer.DialContext(ctx, "udp", fmt.Sprintf(":%d", p.localWGListenPort))
 	if err != nil {

client/internal/dns/host_windows.go

@@ -35,6 +35,8 @@ var (
 // exported so a diagnostic reader reports the same locations that are written.
 const (
 	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
+	// Older versions used different layouts under the same prefix: a single
+	// unsuffixed key, then one key per domain, now one key per batch of domains.
 	NRPTKeyPrefix = "NetBird-Match"
 
 	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
@@ -89,7 +91,6 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
-	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -322,14 +323,9 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	}
 
 	if len(matchDomains) != 0 {
-		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
-		// Update count even on error to ensure cleanup covers partially created rules
-		r.nrptEntryCount = count
-		if err != nil {
+		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
-	} else {
-		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -345,9 +341,8 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid:           r.guid,
-		GPO:            r.gpo,
-		NRPTEntryCount: r.nrptEntryCount,
+		Guid: r.guid,
+		GPO:  r.gpo,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -362,7 +357,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -379,19 +374,17 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
-		// Increment immediately so the caller's cleanup path knows about this rule
-		ruleIndex++
-
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
+				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
+		ruleIndex++
 	}
 
 	if r.gpo {
@@ -401,7 +394,7 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return ruleIndex, nil
+	return nil
 }
 
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
@@ -534,28 +527,28 @@ func (r *registryConfigurator) restoreHostDNS() error {
 	return nil
 }
 
+// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
+// from the local and the GPO policy store. The rules are found by enumerating
+// the registry, the only authoritative record of what was written. Cleanup must
+// not depend on a rule count: the in-memory one is scoped to a single
+// registryConfigurator and the persisted one is deleted on every clean
+// disconnect, and a rule left behind keeps resolving names over an interface
+// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	// Try to remove the base entries (for backward compatibility)
-	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
-	}
-
-	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
-	}
-
-	for i := 0; i < r.nrptEntryCount; i++ {
-		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
-		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
-
-		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
+	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
+		names, err := listNRPTRuleKeys(root)
+		if err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
+			continue
 		}
 
-		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
+		for _, name := range names {
+			path := root + `\` + name
+			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
+			}
 		}
 	}
 
@@ -570,6 +563,39 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
+// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
+// root. An absent root holds nothing to clean up, which is the normal state of
+// the GPO store on a machine without DNS Client policy.
+func listNRPTRuleKeys(root string) ([]string, error) {
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
+	switch {
+	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
+		// the GPO store is absent on a machine without DNS client policy
+		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
+		return nil, nil
+	case err != nil:
+		// any other failure has to reach the caller: reporting no rules would
+		// report a successful cleanup while leaving the rules in place
+		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
+	}
+	defer closer(k)
+
+	names, err := k.ReadSubKeyNames(-1)
+	if err != nil {
+		return nil, fmt.Errorf("read subkey names: %w", err)
+	}
+
+	var ruleKeys []string
+	for _, name := range names {
+		// registry key names are case insensitive
+		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
+			ruleKeys = append(ruleKeys, name)
+		}
+	}
+
+	return ruleKeys, nil
+}
+
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
 	if err != nil {

client/internal/dns/host_windows_test.go

@@ -25,7 +25,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +56,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +81,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -106,9 +106,65 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
+// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
+// are removed by a configurator that has no record of how many there are: an
+// unclean exit loses the in-memory count and a clean disconnect deletes the
+// persisted one, so cleanup cannot depend on either.
+func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+
+	// 75 domains produce two indexed rules, as the current layout does
+	domains := make([]string, 75)
+	for i := range domains {
+		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
+	}
+
+	previousRun := &registryConfigurator{}
+	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
+
+	// the unsuffixed key an older version would have written
+	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
+
+	// a policy owned by someone else, which cleanup must not touch
+	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
+	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create foreign policy key")
+	foreignKey.Close()
+	defer func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
+	}()
+
+	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
+
+	// a configurator that never applied a DNS config, as one built after a
+	// restart or from a shutdown state without a count is
+	freshRun := &registryConfigurator{}
+	require.NoError(t, freshRun.removeDNSMatchPolicies())
+
+	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
+
+	exists, err := registryKeyExists(foreignPath)
+	require.NoError(t, err)
+	assert.True(t, exists, "Should not remove a policy that is not ours")
+}
+
+func countNRPTRuleKeys(t *testing.T) int {
+	t.Helper()
+
+	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
+	require.NoError(t, err, "Should list NRPT rule keys")
+	return len(names)
+}
+
 func cleanupRegistryKeys(*testing.T) {
-	// Clean up more entries to account for batching tests with many domains
-	cfg := &registryConfigurator{nrptEntryCount: 20}
+	cfg := &registryConfigurator{}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -125,7 +181,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	interfacePath := InterfaceConfigPath + `\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -193,7 +249,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
+			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist

client/internal/dns/unclean_shutdown_windows.go

@@ -5,9 +5,8 @@ import (
 )
 
 type ShutdownState struct {
-	Guid           string
-	GPO            bool
-	NRPTEntryCount int
+	Guid string
+	GPO  bool
 }
 
 func (s *ShutdownState) Name() string {
@@ -16,9 +15,8 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid:           s.Guid,
-		gpo:            s.GPO,
-		nrptEntryCount: s.NRPTEntryCount,
+		guid: s.Guid,
+		gpo:  s.GPO,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {

client/internal/ebpf/ebpf/manager_linux.go

@@ -2,17 +2,21 @@ package ebpf
 
 import (
 	_ "embed"
+	"fmt"
 	"net"
 	"sync"
 
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/rlimit"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
+	xdpProgName = "nb_xdp_prog"
+
 	mapKeyFeatures uint32 = 0
 
 	featureFlagWGProxy      = 0b00000001
@@ -68,21 +72,50 @@ func (tf *GeneralManager) loadXdp() error {
 		return err
 	}
 
-	// load pre-compiled programs into the kernel.
-	err = loadBpfObjects(&tf.bpfObjs, nil)
+	// lo has no native XDP, so the program runs in generic mode. Unless it
+	// declares multi-buffer support the kernel must linearize every non-linear
+	// skb before running it. Loopback packets are up to 64 KB, so that is a
+	// contiguous GFP_ATOMIC allocation per packet, and when it fails the packet
+	// is dropped before the program runs, stalling local TCP connections.
+	// Multi-buffer XDP in generic mode requires kernel 6.3, so fall back to a
+	// plain attach when the kernel rejects it.
+	err = tf.attachXdp(iFace.Index, true)
+	if err == nil {
+		return nil
+	}
+	log.Debugf("failed to attach multi-buffer xdp program, retrying without it: %s", err)
+
+	return tf.attachXdp(iFace.Index, false)
+}
+
+func (tf *GeneralManager) attachXdp(iFaceIndex int, multiBuffer bool) error {
+	spec, err := loadBpf()
 	if err != nil {
-		return err
+		return fmt.Errorf("load bpf spec: %w", err)
+	}
+
+	if multiBuffer {
+		prog, ok := spec.Programs[xdpProgName]
+		if !ok {
+			return fmt.Errorf("program %s not found in bpf spec", xdpProgName)
+		}
+		prog.Flags |= unix.BPF_F_XDP_HAS_FRAGS
+	}
+
+	if err := spec.LoadAndAssign(&tf.bpfObjs, nil); err != nil {
+		return fmt.Errorf("load bpf objects: %w", err)
 	}
 
 	tf.link, err = link.AttachXDP(link.XDPOptions{
 		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFace.Index,
+		Interface: iFaceIndex,
 	})
-
 	if err != nil {
-		_ = tf.bpfObjs.Close()
+		if closeErr := tf.bpfObjs.Close(); closeErr != nil {
+			log.Debugf("failed to close bpf objects after xdp attach error: %s", closeErr)
+		}
 		tf.link = nil
-		return err
+		return fmt.Errorf("attach xdp: %w", err)
 	}
 	return nil
 }

client/internal/engine_privileged_test.go

@@ -519,7 +519,7 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
-	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
+	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
 	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, "", err

client/internal/peer/conn.go

@@ -440,7 +440,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		conn.dumpState.NewLocalProxy()
 		wgProxy, err = conn.newProxy(iceConnInfo.RemoteConn)
 		if err != nil {
-			conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
+			conn.Log.Errorf("failed to add relayed net.Conn to local proxy: %v", err)
 			return
 		}
 		ep = wgProxy.EndpointAddr()
@@ -878,9 +878,8 @@ func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
 	}
 
 	wgProxy := conn.config.WgConfig.WgInterface.GetProxy()
-	if err := wgProxy.AddTurnConn(conn.ctx, udpAddr, remoteConn); err != nil {
-		conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
-		return nil, err
+	if err := wgProxy.AddRelayedConn(conn.ctx, udpAddr, remoteConn); err != nil {
+		return nil, fmt.Errorf("add relayed conn to proxy: %w", err)
 	}
 	return wgProxy, nil
 }

client/internal/peer/worker_ice.go

@@ -255,8 +255,8 @@ func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent
 		return
 	}
 
-	w.log.Debugf("turn agent dial")
-	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
+	w.log.Debugf("agent dial")
+	remoteConn, err := w.agentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
 		w.closeAgent(agent, w.agentDialerCancel)
@@ -517,8 +517,8 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 			w.logSuccessfulPaths(agent)
 			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
-			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
-			// notify the conn.onICEStateDisconnected changes to update the current used priority
+			// ice.ConnectionStateClosed happens when we recreate the agent. The P2P to relay switch requires
+			// notifying conn.onICEStateDisconnected so it can update the currently used priority.
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
@@ -532,7 +532,7 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 	}
 }
 
-func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+func (w *WorkerICE) agentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
 	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {

client/server/network.go

@@ -232,3 +232,4 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
+

client/server/server_privileged_test.go

@@ -200,7 +200,7 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	peersUpdateManager := update_channel.NewPeersUpdateManager(metrics)
-	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config, nil)
+	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
 	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
 	if err != nil {
 		return nil, "", err

go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.55.0
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
@@ -72,18 +72,17 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
 	github.com/hashicorp/go-version v1.7.0
-	github.com/jackc/pgx/v5 v5.10.0
+	github.com/jackc/pgx/v5 v5.5.5
 	github.com/libdns/route53 v1.5.0
 	github.com/libp2p/go-nat v0.2.0
 	github.com/libp2p/go-netroute v0.4.0
 	github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81
-	github.com/magefile/mage v1.17.2
 	github.com/mdlayher/socket v0.5.1
 	github.com/mdp/qrterminal/v3 v3.2.1
 	github.com/miekg/dns v1.1.72
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/moby/moby/api v1.54.1
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
@@ -128,9 +127,9 @@ require (
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
+	golang.org/x/mod v0.39.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
@@ -237,8 +236,8 @@ require (
 	github.com/huin/goupnp v1.2.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -314,8 +313,8 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect

go.sum

@@ -341,12 +341,12 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
-github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
-github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
-github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.5.5 h1:amBjrZVmksIdNjxGW/IiIMzxMKZFelXbUoPNb+8sjQw=
+github.com/jackc/pgx/v5 v5.5.5/go.mod h1:ez9gk+OAat140fv9ErkZDYFWmXLfV+++K0uAOiwgm1A=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -415,8 +415,6 @@ github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81 h1:J56rFEfUTFT9j9
 github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81/go.mod h1:RD8ML/YdXctQ7qbcizZkw5mZ6l8Ogrl1dodBzVJduwI=
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae h1:dIZY4ULFcto4tAFlj1FYZl8ztUZ13bdq+PLY+NOfbyI=
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
-github.com/magefile/mage v1.17.2 h1:fyXVu1eadI8Ap1HCCNgEhJ5McIWiYhLR8uol64ZZc40=
-github.com/magefile/mage v1.17.2/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
@@ -484,8 +482,8 @@ github.com/netbirdio/easyjson v0.9.0 h1:6Nw2lghSVuy8RSkAYDhDv1thBVEmfVbKZnV7T7Z6
 github.com/netbirdio/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87 h1:iJeUvSMC0BTpkw7u4JyWcY4/3dl7fEL9DR/TpKf2+1w=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260803100840-78e79ba20f87/go.mod h1:pmsCPx1S0nuZRxCextGpc9AV4hLgGSuTsc4NMuwGeCo=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42 h1:F3zS5fT9xzD1OFLfcdAE+3FfyiwjGukF1hvj0jErgs8=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
@@ -730,13 +728,13 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab h1:Iqyc+2zr7aGyLuEadIm0KRJP0Wwt+fhlXLa51Fxf1+Q=
-golang.org/x/mobile v0.0.0-20251113184115-a159579294ab/go.mod h1:Eq3Nh/5pFSWug2ohiudJ1iyU59SO78QFuh4qTTN++I0=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733 h1:XKMObIaAElmkdO+4SQh1iCfzwciZHJi1OblnX9BED9k=
+golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733/go.mod h1:jMwjxoDSx9jqhNaZqPnr6nnKzb7cs+Dy1Czk7wdX+R8=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -746,8 +744,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -766,8 +764,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -845,8 +843,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -860,8 +858,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

integration_tests/management/network_map_db/account_settings_test.go

@@ -1,58 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetAccountSettings(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into accounts (id, settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
-                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
-                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
-		 values('account-3',null,null,null,null,null,null,null,null,null,null,null)`)
-
-	accountSettings, err := conn(t, ctx).GetAccountSettings(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{
-		PeerLoginExpirationEnabled:      true,
-		PeerLoginExpiration:             86400000000000 * time.Nanosecond,
-		PeerInactivityExpirationEnabled: false,
-		PeerInactivityExpiration:        86400000000000 * time.Nanosecond,
-		DNSDomain:                       "",
-		IPv6EnabledGroups:               []string{"group-one-resource-id"},
-		RoutingPeerDNSResolutionEnabled: false,
-		LazyConnectionEnabled:           false,
-		AutoUpdateVersion:               "disabled",
-		AutoUpdateAlways:                false,
-		MetricsPushEnabled:              false,
-	})
-
-	accountSettings, err = conn(t, ctx).GetAccountSettings(ctx, "account-2")
-	assert.NoError(t, err)
-	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{
-		PeerLoginExpirationEnabled:      true,
-		PeerLoginExpiration:             86400000000000 * time.Nanosecond,
-		PeerInactivityExpirationEnabled: false,
-		PeerInactivityExpiration:        86400000000000 * time.Nanosecond,
-		DNSDomain:                       "",
-		IPv6EnabledGroups:               []string{"group-two-resources-id"},
-		RoutingPeerDNSResolutionEnabled: false,
-		LazyConnectionEnabled:           false,
-		AutoUpdateVersion:               "disabled",
-		AutoUpdateAlways:                false,
-		MetricsPushEnabled:              false,
-	})
-
-	accountSettings, err = conn(t, ctx).GetAccountSettings(ctx, "account-3")
-	assert.NoError(t, err)
-	assert.Equal(t, accountSettings, nmdata.AccountSettingsInfo{})
-}

integration_tests/management/network_map_db/base_data.sql

@@ -1,53 +0,0 @@
-insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
-                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
-                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
-                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
-VALUES('account-1','network-1','{"IP":"100.103.0.0","Mask":"//8AAA=="}','{"IP":"fdde:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',1,'["disabled-group-1","disabled-group-2"]',
-       true, 86400000000000, false,
-       86400000000000, null, '["group-one-resource-id"]', false,
-       false, 'disabled', false, false);
-insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
-                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
-                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
-                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
-VALUES('account-2','network-2','{"IP":"110.0.0.0","Mask":"//8AAA=="}','{"IP":"fddf:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',2,null,
-       true, 86400000000000, false,
-       86400000000000, null, '["group-two-resources-id"]', false,
-       false, 'disabled', false, false);
-insert into groups (id, account_id, name, resources, public_id) VALUES('group-one-resource-id','account-1','group-1-name', '[{"ID":"host-id-1","Type":"host"}]','group-one-resource-id-public');
-insert into groups (id, account_id, name, resources, public_id) VALUES('group-two-resources-id','account-1','group-2-name', '[{"ID":"subnet-id-1","Type":"subnet"}, {"ID":"host-id-2","Type":"host"}]','group-two-resources-id-public');
-insert into groups (id, account_id, name, resources, public_id) VALUES('group-no-resources-id','account-1','group-3-name', null,'group-no-resources-id-public');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-1','group-one-resource-id');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-2','group-two-resources-id');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-1','peer-id-3','group-two-resources-id');
-insert into peers (id, account_id, "key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-1','account-1','key-1','ssh-key-1','peer-1','["extra-peer-1"]','user-id-1',true,true,'2026-08-06 13:25:59.12999','"10.10.10.1"','"fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-1.netbird.services',
-                   '0.76.0','linux','26.4.1','6.8.0-134-generic','[{"NetIP":"fe80::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ac"},{"NetIP":"192.168.16.1/20","Mac":"00:15:5d:24:0c:ac"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
-                   'DE','Berlin','"46.201.148.187"');
-insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-2','account-1','key-2','ssh-key-2','peer-2','["extra-peer-2"]','user-id-2',true,true,'2026-08-06 14:25:59.12999','"10.10.100.1"','"fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-2.netbird.services',
-                   '0.76.1','linux','26.4.2','6.8.0-135-generic','[{"NetIP":"fe81::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ad"},{"NetIP":"192.168.17.1/20","Mac":"00:15:5d:24:0c:ad"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',0,
-                   'DE','Berlin','"46.201.149.187"');
-insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-3','account-1','key-3','ssh-key-3','peer-3','["extra-peer-3"]','user-id-3',true,true,'2026-08-06 12:25:59.12999','"10.10.200.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-3.netbird.services',
-                   '0.76.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:5d:24:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
-                   'DE','Berlin','"46.201.150.187"');
-

integration_tests/management/network_map_db/dns_settings_test.go

@@ -1,25 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetDnsSettings(t *testing.T) {
-	ctx := context.TODO()
-
-	settings, err := conn(t, ctx).GetDnsSettings(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, settings, nmdata.DNSSettings{
-		DisabledManagementGroups: []string{"disabled-group-1", "disabled-group-2"},
-	})
-
-	settings, err = conn(t, ctx).GetDnsSettings(ctx, "account-2")
-	assert.NoError(t, err)
-	assert.Equal(t, settings, nmdata.DNSSettings{})
-}

integration_tests/management/network_map_db/dns_test.go

@@ -1,62 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetAppliedZoneCandidatesViaPgxConnection(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into zones (id, account_id, domain, enable_search_domain, distribution_groups)
-		VALUES('zone-1','account-1','test-1.com',true,'["group-one-resource-id"]')`)
-	execQuery(t, ctx,
-		`insert into zones (id, account_id, domain, enable_search_domain, distribution_groups)
-		VALUES('zone-2','account-1','test-2.com',false,'["group-two-resources-id"]')`)
-	execQuery(t, ctx,
-		`insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-1','account-1','zone-1','test.test-1.com','A',1800,'1.1.1.1')`)
-	execQuery(t, ctx,
-		`insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-2','account-1','zone-1','test2.test-1.com','A',1800,'1.1.1.2')`)
-	execQuery(t, ctx,
-		`insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-3','account-1','zone-1','test3.test-1.com','CNAME',1800,'test4.test-1.com')`)
-	execQuery(t, ctx,
-		`insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-4','account-1','zone-2','test2.test-2.com','CNAME',1800,'test3.test-2.com')`)
-
-	zoneCandidates, err := conn(t, ctx).GetAppliedZoneCandidates(ctx, "account-1")
-	assert.NoError(t, err)
-
-	assert.Contains(t, zoneCandidates, networkmap.AppliedZoneCandidate{
-		DistributionGroups: []string{"group-one-resource-id"},
-		Zone: nmdata.CustomZone{
-			Domain:               "test-1.com",
-			SearchDomainDisabled: false,
-			Records: []nmdata.SimpleRecord{
-				{Name: "test.test-1.com", Type: int(dns.TypeA), Class: "IN", TTL: 1800, RData: "1.1.1.1"},
-				{Name: "test2.test-1.com", Type: int(dns.TypeA), Class: "IN", TTL: 1800, RData: "1.1.1.2"},
-				{Name: "test3.test-1.com", Type: int(dns.TypeCNAME), Class: "IN", TTL: 1800, RData: "test4.test-1.com."},
-			},
-		},
-	})
-	assert.Contains(t, zoneCandidates, networkmap.AppliedZoneCandidate{
-		DistributionGroups: []string{"group-two-resources-id"},
-		Zone: nmdata.CustomZone{
-			Domain:               "test-2.com",
-			SearchDomainDisabled: true,
-			Records: []nmdata.SimpleRecord{
-				{Name: "test2.test-2.com", Type: int(dns.TypeCNAME), Class: "IN", TTL: 1800, RData: "test3.test-2.com."},
-			},
-		},
-	})
-}

integration_tests/management/network_map_db/domain_test.go

@@ -1,39 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetDomains(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into domains (id, account_id, domain, target_cluster)
-		VALUES('domain-1','account-1','test-1.com','target-1.cluster.local')`)
-	execQuery(t, ctx,
-		`insert into domains (id, account_id, domain, target_cluster)
-		VALUES('domain-2','account-1','test-2.com','target-2.cluster.local')`)
-	execQuery(t, ctx,
-		`insert into domains (id, account_id, domain, target_cluster)
-		VALUES('domain-3','account-1',null,null)`)
-
-	domains, err := conn(t, ctx).GetDomains(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Len(t, domains, 2)
-
-	assert.Contains(t, domains, networkmapdb.Domain{
-		Domain:        sql.NullString{String: "test-1.com", Valid: true},
-		TargetCluster: sql.NullString{String: "target-1.cluster.local", Valid: true},
-	})
-	assert.Contains(t, domains, networkmapdb.Domain{
-		Domain:        sql.NullString{String: "test-2.com", Valid: true},
-		TargetCluster: sql.NullString{String: "target-2.cluster.local", Valid: true},
-	})
-}

integration_tests/management/network_map_db/group_test.go

@@ -1,58 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGetGroups(t *testing.T) {
-	ctx := context.TODO()
-
-	groups, resourceToGroupIdx, err := conn(t, ctx).GetGroups(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Contains(t,
-		groups,
-		nmdata.Group{ID: "group-one-resource-id", Name: "group-1-name", PublicID: "group-one-resource-id-public", Resources: []nmdata.Resource{{ID: "host-id-1", Type: "host"}}, Peers: []string{"peer-id-1"}},
-	)
-	assert.NotNil(t, resourceToGroupIdx["host-id-1"]["group-one-resource-id"])
-	assert.Contains(t,
-		groups,
-		nmdata.Group{ID: "group-two-resources-id", Name: "group-2-name", PublicID: "group-two-resources-id-public",
-			Resources: []nmdata.Resource{{ID: "subnet-id-1", Type: "subnet"}, {ID: "host-id-2", Type: "host"}},
-			Peers:     []string{"peer-id-2", "peer-id-3"}},
-	)
-	assert.NotNil(t, resourceToGroupIdx["host-id-2"]["group-two-resources-id"])
-	assert.NotNil(t, resourceToGroupIdx["subnet-id-1"]["group-two-resources-id"])
-	assert.Contains(t,
-		groups,
-		nmdata.Group{ID: "group-no-resources-id", Name: "group-3-name", PublicID: "group-no-resources-id-public"})
-}
-
-// Verify handling of empty fields in groups table
-// Verify that group's PublicID gets populated on retrieval
-// TODO (dmitri) PublicID should not be populated with delta updates,
-// which require stable PublicIDs
-func TestGetGroupsWithoutExpectedFields(t *testing.T) {
-	if engine == string(types.SqliteStoreEngine) {
-		t.Skip()
-	}
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		"insert into accounts (id) VALUES('random-id')")
-
-	execQuery(t, ctx,
-		"insert into groups (id, account_id) VALUES('g2-test-group-id-1','random-id')")
-
-	groups, _, err := conn(t, ctx).GetGroups(ctx, "random-id")
-	assert.NoError(t, err)
-	require.Len(t, groups, 1)
-	assert.NotEmpty(t, groups[0].PublicID)
-}

integration_tests/management/network_map_db/main_test.go

@@ -1,99 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	_ "embed"
-	"os"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-
-	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
-	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
-	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-//go:embed base_data.sql
-var baseData string
-
-var (
-	pgstore     *networkmap_pgsql.PgStore
-	sqlitestore *networkmap_sqlite.SqliteStore
-	engine      string
-)
-
-func TestMain(m *testing.M) {
-	var cleanup func()
-	kind, _ := os.LookupEnv("NETBIRD_STORE_ENGINE")
-	switch kind {
-	case string(types.PostgresStoreEngine):
-		engine = string(types.PostgresStoreEngine)
-		pgstore, cleanup = createPGTestStore(baseData)
-		pgstore.UsingTimeZone(time.UTC)
-	case "", string(types.SqliteStoreEngine):
-		engine = string(types.SqliteStoreEngine)
-		sqlitestore, cleanup = createSqliteTestStore(baseData)
-	default:
-		log.Fatalf("unsupported db '%s' in NETBIRD_STORE_ENGINE env var", kind)
-	}
-
-	code := m.Run()
-
-	cleanup()
-	os.Exit(code)
-}
-
-func conn(t *testing.T, ctx context.Context) networkmapdb.NetworkMapDBStoreConn {
-	t.Helper()
-	switch engine {
-	case string(types.PostgresStoreEngine):
-		c, err := pgstore.Pool.Acquire(ctx)
-		assert.NoError(t, err)
-		return pgstore.UsingConnection(c.Conn())
-	case string(types.SqliteStoreEngine):
-		return sqlitestore.UsingConn()
-	}
-	log.Fatalf("unknown db engine kind %s", engine)
-	return nil
-}
-
-func store(t *testing.T) networkmapdb.NetworkMapDBStore {
-	t.Helper()
-	switch engine {
-	case string(types.PostgresStoreEngine):
-		return pgstore
-	case string(types.SqliteStoreEngine):
-		return sqlitestore
-	}
-	log.Fatalf("unknown db engine kind %s", engine)
-	return nil
-}
-
-func execQuery(t *testing.T, ctx context.Context, q string) {
-	t.Helper()
-	switch engine {
-	case string(types.PostgresStoreEngine):
-		_, err := pgstore.Pool.Exec(ctx, q)
-		assert.NoError(t, err)
-	case string(types.SqliteStoreEngine):
-		_, err := sqlitestore.Db.ExecContext(ctx, q)
-		assert.NoError(t, err)
-	}
-}
-
-// use to parse time in time.RFC3339Nano format
-// returns the time in the UTC time zone
-func mustParseTime(t string) *time.Time {
-	tt, err := time.Parse(time.RFC3339Nano, t)
-	if err != nil {
-		panic(err)
-	}
-
-	utc := tt.UTC()
-	return &utc
-}

integration_tests/management/network_map_db/nameserver_test.go

@@ -1,61 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetNameServerGroups(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled, "primary", account_id)
-		VALUES('nsgroup-1','nsgroup-1-public','nsgroup-1','nsgroup-1','[{"IP":"192.168.31.2","NSType":1,"Port":53}]','["group-one-resource-id"]','["test-1.com"]',TRUE,FALSE,TRUE,'account-1')`)
-	execQuery(t, ctx,
-		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
-		VALUES('nsgroup-2','nsgroup-2-public','nsgroup-2','nsgroup-2','[{"IP":"192.168.32.3","NSType":1,"Port":53}]','["group-one-resource-id","group-no-resources-id"]','["test-1.com","test-2.com"]',TRUE,FALSE,TRUE,'account-1')`)
-	execQuery(t, ctx,
-		`insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
-		VALUES('nsgroup-3','nsgroup-3-public',null,null,null,null,null,TRUE,FALSE,FALSE,'account-1')`)
-
-	nsgroups, err := conn(t, ctx).GetNameServerGroups(ctx, "account-1")
-	assert.NoError(t, err)
-
-	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
-		ID:                   "nsgroup-1",
-		PublicID:             "nsgroup-1-public",
-		Name:                 "nsgroup-1",
-		Description:          "nsgroup-1",
-		NameServers:          []nmdata.NameServer{{IP: netip.MustParseAddr("192.168.31.2"), NSType: 1, Port: 53}},
-		Groups:               []string{"group-one-resource-id"},
-		Domains:              []string{"test-1.com"},
-		Primary:              true,
-		SearchDomainsEnabled: false,
-		Enabled:              true,
-	})
-	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
-		ID:                   "nsgroup-2",
-		PublicID:             "nsgroup-2-public",
-		Name:                 "nsgroup-2",
-		Description:          "nsgroup-2",
-		NameServers:          []nmdata.NameServer{{IP: netip.MustParseAddr("192.168.32.3"), NSType: 1, Port: 53}},
-		Groups:               []string{"group-one-resource-id", "group-no-resources-id"},
-		Domains:              []string{"test-1.com", "test-2.com"},
-		Primary:              true,
-		SearchDomainsEnabled: false,
-		Enabled:              true,
-	})
-	assert.Contains(t, nsgroups, nmdata.NameServerGroup{
-		ID:                   "nsgroup-3",
-		PublicID:             "nsgroup-3-public",
-		Primary:              false,
-		SearchDomainsEnabled: false,
-		Enabled:              true,
-	})
-}

integration_tests/management/network_map_db/network_map_data.sql

@@ -1,98 +0,0 @@
-insert into accounts (id, network_identifier, network_net, network_net_v6, network_dns, network_serial,dns_settings_disabled_management_groups,
-                      settings_peer_login_expiration_enabled, settings_peer_login_expiration, settings_peer_inactivity_expiration_enabled,
-                      settings_peer_inactivity_expiration, settings_dns_domain, settings_ipv6_enabled_groups, settings_routing_peer_dns_resolution_enabled,
-                      settings_lazy_connection_enabled, settings_auto_update_version, settings_auto_update_always, settings_metrics_push_enabled)
-VALUES('account-33','network-331','{"IP":"100.103.0.0","Mask":"//8AAA=="}','{"IP":"fdde:e995:fd38:a465::","Mask":"//////////8AAAAAAAAAAA=="}','',1,'["disabled-group-1","disabled-group-2"]',
-       true, 86400000000000, false,
-       86400000000000, null, '["33-group-one-resource-id"]', false,
-       false, 'disabled', false, false);
-insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-one-resource-id','account-33','group-1-name', '[{"ID":"host-id-1","Type":"host"}]','group-one-resource-id-public');
-insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-two-resources-id','account-33','group-2-name', '[{"ID":"subnet-id-1","Type":"subnet"}, {"ID":"host-id-2","Type":"host"}]','33-group-two-resources-id-public');
-insert into groups (id, account_id, name, resources, public_id) VALUES('33-group-no-resources-id','account-33','group-3-name', null,'33-group-no-resources-id-public');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-331','33-group-one-resource-id');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-332','33-group-two-resources-id');
-insert into group_peers (account_id, peer_id, group_id) VALUES('account-33','peer-id-333','33-group-two-resources-id');
-insert into peers (id, account_id, "key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-331','account-33','key-331','ssh-key-1','peer-1','["extra-peer-1"]','user-id-1',true,true,'2026-08-06 13:25:59.12999','"10.10.10.1"','"fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-1.netbird.services',
-                   '0.76.0','linux','26.4.1','6.8.0-134-generic','[{"NetIP":"fe80::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ac"},{"NetIP":"192.168.16.1/20","Mac":"00:15:5d:24:0c:ac"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
-                   'DE','Berlin','"46.201.148.187"');
-insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-332','account-33','key-332','ssh-key-2','peer-2','["extra-peer-2"]','user-id-2',true,true,'2026-08-06 14:25:59.12999','"10.10.100.1"','"fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-2.netbird.services',
-                   '0.76.1','linux','26.4.2','6.8.0-135-generic','[{"NetIP":"fe81::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ad"},{"NetIP":"192.168.17.1/20","Mac":"00:15:5d:24:0c:ad"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',0,
-                   'DE','Berlin','"46.201.149.187"');
-insert into peers (id,account_id,"key", ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6,
-	            peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster,
-	            meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files,
-                   meta_capabilities, meta_flags, meta_sync_message_version,
-	            location_country_code, location_city_name, location_connection_ip)
-            values('peer-id-333','account-33','key-333','ssh-key-3','peer-3','["extra-peer-3"]','user-id-3',true,true,'2026-08-06 12:25:59.12999','"10.10.200.1"','"fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"',
-                   false,true,true,'cluster-3.netbird.services',
-                   '0.76.2','linux','26.4.3','6.8.0-136-generic','[{"NetIP":"fe82::8b4c:973f:a76b:3771/64","Mac":"00:15:5d:24:0c:ae"},{"NetIP":"192.168.18.1/20","Mac":"00:15:5d:24:0c:ae"}]','[{"Path":"/usr/bin/netbird","Exist":false,"ProcessIsRunning":false}]',
-                   '[1,2]','{"RosenpassEnabled":false,"RosenpassPermissive":false,"ServerSSHAllowed":true,"DisableClientRoutes":false,"DisableServerRoutes":false,"DisableDNS":false,"DisableFirewall":false,"BlockLANAccess":false,"BlockInbound":false,"DisableIPv6":false,"LazyConnectionEnabled":false}',1,
-                   'DE','Berlin','"46.201.150.187"');
-
-insert into zones (id, account_id, domain, enable_search_domain, distribution_groups)
-		VALUES('zone-331','account-33','test-331.com',true,'["33-group-one-resource-id"]');
-insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-331','account-33','zone-331','test.test-331.com','A',1800,'1.1.1.1');
-insert into records (id, account_id, zone_id, name, type, ttl, content)
-		VALUES('record-332','account-33','zone-331','test2.test-331.com','A',1800,'1.1.1.2');
-
-insert into domains (id, account_id, domain, target_cluster)
-		VALUES('domain-331','account-33','test-331.com','target-1.cluster.local');
-
-insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled, "primary", account_id)
-		VALUES('nsgroup-331','nsgroup-1-public','nsgroup-1','nsgroup-1','[{"IP":"192.168.31.2","NSType":1,"Port":53}]','["33-group-one-resource-id"]','["test-1.com"]',TRUE,FALSE,TRUE,'account-33');
-insert into name_server_groups (id, public_id, name, description, name_servers, groups, domains, enabled, search_domains_enabled,"primary",account_id)
-		VALUES('nsgroup-332','nsgroup-2-public','nsgroup-2','nsgroup-2','[{"IP":"192.168.32.3","NSType":1,"Port":53}]','["33-group-one-resource-id","33-group-no-resources-id"]','["test-1.com","test-2.com"]',TRUE,FALSE,TRUE,'account-33');
-
-insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
-		VALUES('net-resource-331','account-33','network-331','net-resource-public-1','network-resource-1','network-resource-1','subnet','','"10.0.0.0/16"',TRUE);
-insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
-		VALUES('net-resource-332','account-33','network-332','net-resource-public-2','network-resource-2','network-resource-2','domain','test.com','',TRUE);
-
-insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
-		VALUES('test-nr-id-331','account-33','public-id-1','peer-id-331','network-id-1',TRUE,999,TRUE,'["33-group-one-resource-id"]');
-insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
-		VALUES('test-nr-id-332','account-33','public-id-2','','network-id-2',TRUE,333,TRUE,'["33-group-two-resources-id","33-group-no-resources-id"]');
-
-insert into networks (id, account_id, public_id) VALUES('network-331','account-33','network-1-public');
-insert into networks (id, account_id, public_id) VALUES('network-332','account-33','network-2-public');
-
-insert into policies (id, public_id, account_id, enabled, source_posture_checks)
-		 values('policy-331','policy-1-public','account-33',true,'["posture-checks-1","posture-checks-2"]');
-insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
-		                           source_resource, destination_resource, ports, port_ranges,
-								   authorized_groups, authorized_user)
-		 values('policy-331-rule-1','policy-331',true,'accept','tcp',true,'["33-group-one-resource-id","33-group-two-resources-id"]','["33-group-one-resource-id","33-group-two-resources-id"]',
-		        '{"ID":"host-id-1","Type":"host"}','{"ID":"domain-331","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
-				'{"33-group-one-resource-id":["user-1", "user-2"]}','user-3');
-
-insert into posture_checks (id, account_id, public_id, checks)
-		VALUES('posturecheck-331','account-33','posturecheck-1-public',
-		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
-		  "OSVersionCheck":{"Darwin":{"MinVersion":"12.0"}},
-		  "GeoLocationCheck":{"Locations":[{"CountryCode":"FI","CityName":""}],"Action":"allow"},
-		  "PeerNetworkRangeCheck":{"Action":"deny","Ranges":["192.168.0.1/24"]}}');
-
-insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
-	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
-	                         groups, access_control_groups, skip_auto_apply)
-		VALUES('route-331','account-33','route-1-public','"172.0.0.0/16"','["test-1.com"]',true,'route-331-net-id','route-1',
-		        'peer-id-331','["33-group-one-resource-id"]',1,true,9999,true,
-				'["33-group-one-resource-id"]','["33-group-one-resource-id"]',false);
-
-insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
-		 values('service-331','account-33',true,true,'["33-group-one-resource-id"]','test-1.com','test-332.com');

integration_tests/management/network_map_db/network_map_data_golden.json

@@ -1,516 +0,0 @@
-{
-  "Peers": {
-    "peer-id-331": {
-      "ID": "peer-id-331",
-      "Key": "key-331",
-      "SSHKey": "ssh-key-1",
-      "DNSLabel": "peer-1",
-      "UserID": "user-id-1",
-      "SSHEnabled": true,
-      "LoginExpirationEnabled": true,
-      "LastLogin": "2026-08-06T13:25:59.12999Z",
-      "IP": "10.10.10.1",
-      "IPv6": "fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940",
-      "RequiresApproval": false,
-      "ExtraDNSLabels": [
-        "extra-peer-1"
-      ],
-      "Meta": {
-        "WtVersion": "0.76.0",
-        "GoOS": "linux",
-        "OSVersion": "26.4.1",
-        "KernelVersion": "6.8.0-134-generic",
-        "NetworkAddresses": [
-          {
-            "NetIP": "fe80::8b4c:973f:a76b:3771/64"
-          },
-          {
-            "NetIP": "192.168.16.1/20"
-          }
-        ],
-        "Files": [
-          {
-            "Path": "/usr/bin/netbird",
-            "ProcessIsRunning": false
-          }
-        ],
-        "Capabilities": [
-          1,
-          2
-        ],
-        "Flags": {
-          "ServerSSHAllowed": true,
-          "DisableIPv6": false
-        },
-        "SyncMessageVersion": 1
-      },
-      "ProxyMeta": {
-        "Embedded": true
-      },
-      "Location": {
-        "CountryCode": "DE",
-        "CityName": "Berlin",
-        "ConnectionIP": "46.201.148.187"
-      }
-    },
-    "peer-id-332": {
-      "ID": "peer-id-332",
-      "Key": "key-332",
-      "SSHKey": "ssh-key-2",
-      "DNSLabel": "peer-2",
-      "UserID": "user-id-2",
-      "SSHEnabled": true,
-      "LoginExpirationEnabled": true,
-      "LastLogin": "2026-08-06T14:25:59.12999Z",
-      "IP": "10.10.100.1",
-      "IPv6": "fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940",
-      "RequiresApproval": false,
-      "ExtraDNSLabels": [
-        "extra-peer-2"
-      ],
-      "Meta": {
-        "WtVersion": "0.76.1",
-        "GoOS": "linux",
-        "OSVersion": "26.4.2",
-        "KernelVersion": "6.8.0-135-generic",
-        "NetworkAddresses": [
-          {
-            "NetIP": "fe81::8b4c:973f:a76b:3771/64"
-          },
-          {
-            "NetIP": "192.168.17.1/20"
-          }
-        ],
-        "Files": [
-          {
-            "Path": "/usr/bin/netbird",
-            "ProcessIsRunning": false
-          }
-        ],
-        "Capabilities": [
-          1,
-          2
-        ],
-        "Flags": {
-          "ServerSSHAllowed": true,
-          "DisableIPv6": false
-        },
-        "SyncMessageVersion": 0
-      },
-      "ProxyMeta": {
-        "Embedded": true
-      },
-      "Location": {
-        "CountryCode": "DE",
-        "CityName": "Berlin",
-        "ConnectionIP": "46.201.149.187"
-      }
-    },
-    "peer-id-333": {
-      "ID": "peer-id-333",
-      "Key": "key-333",
-      "SSHKey": "ssh-key-3",
-      "DNSLabel": "peer-3",
-      "UserID": "user-id-3",
-      "SSHEnabled": true,
-      "LoginExpirationEnabled": true,
-      "LastLogin": "2026-08-06T12:25:59.12999Z",
-      "IP": "10.10.200.1",
-      "IPv6": "fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940",
-      "RequiresApproval": false,
-      "ExtraDNSLabels": [
-        "extra-peer-3"
-      ],
-      "Meta": {
-        "WtVersion": "0.76.2",
-        "GoOS": "linux",
-        "OSVersion": "26.4.3",
-        "KernelVersion": "6.8.0-136-generic",
-        "NetworkAddresses": [
-          {
-            "NetIP": "fe82::8b4c:973f:a76b:3771/64"
-          },
-          {
-            "NetIP": "192.168.18.1/20"
-          }
-        ],
-        "Files": [
-          {
-            "Path": "/usr/bin/netbird",
-            "ProcessIsRunning": false
-          }
-        ],
-        "Capabilities": [
-          1,
-          2
-        ],
-        "Flags": {
-          "ServerSSHAllowed": true,
-          "DisableIPv6": false
-        },
-        "SyncMessageVersion": 1
-      },
-      "ProxyMeta": {
-        "Embedded": true
-      },
-      "Location": {
-        "CountryCode": "DE",
-        "CityName": "Berlin",
-        "ConnectionIP": "46.201.150.187"
-      }
-    }
-  },
-  "Groups": {
-    "33-group-no-resources-id": {
-      "ID": "33-group-no-resources-id",
-      "Name": "group-3-name",
-      "PublicID": "33-group-no-resources-id-public",
-      "Peers": null,
-      "Resources": null
-    },
-    "33-group-one-resource-id": {
-      "ID": "33-group-one-resource-id",
-      "Name": "group-1-name",
-      "PublicID": "group-one-resource-id-public",
-      "Peers": [
-        "peer-id-331"
-      ],
-      "Resources": [
-        {
-          "ID": "host-id-1",
-          "Type": "host"
-        }
-      ]
-    },
-    "33-group-two-resources-id": {
-      "ID": "33-group-two-resources-id",
-      "Name": "group-2-name",
-      "PublicID": "33-group-two-resources-id-public",
-      "Peers": [
-        "peer-id-332",
-        "peer-id-333"
-      ],
-      "Resources": [
-        {
-          "ID": "subnet-id-1",
-          "Type": "subnet"
-        },
-        {
-          "ID": "host-id-2",
-          "Type": "host"
-        }
-      ]
-    }
-  },
-  "Policies": [
-    {
-      "ID": "policy-331",
-      "PublicID": "policy-1-public",
-      "Enabled": true,
-      "SourcePostureChecks": [
-        "posture-checks-1",
-        "posture-checks-2"
-      ],
-      "Rules": [
-        {
-          "ID": "policy-331",
-          "PolicyID": "policy-331",
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Bidirectional": true,
-          "Sources": [
-            "33-group-one-resource-id",
-            "33-group-two-resources-id"
-          ],
-          "Destinations": [
-            "33-group-one-resource-id",
-            "33-group-two-resources-id"
-          ],
-          "SourceResource": {
-            "ID": "host-id-1",
-            "Type": "host"
-          },
-          "DestinationResource": {
-            "ID": "domain-331",
-            "Type": "domain"
-          },
-          "Ports": [
-            "8080",
-            "8443"
-          ],
-          "PortRanges": [
-            {
-              "Start": 8080,
-              "End": 8090
-            }
-          ],
-          "AuthorizedGroups": {
-            "33-group-one-resource-id": [
-              "user-1",
-              "user-2"
-            ]
-          },
-          "AuthorizedUser": "user-3"
-        }
-      ]
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "route-331",
-      "AccountID": "account-33",
-      "PublicID": "route-1-public",
-      "Network": "172.0.0.0/16",
-      "Domains": [
-        "test-1.com"
-      ],
-      "KeepRoute": true,
-      "NetID": "route-331-net-id",
-      "Description": "route-1",
-      "Peer": "peer-id-331",
-      "PeerID": "peer-id-331",
-      "PeerGroups": [
-        "33-group-one-resource-id"
-      ],
-      "NetworkType": 1,
-      "Masquerade": true,
-      "Metric": 9999,
-      "Enabled": true,
-      "Groups": [
-        "33-group-one-resource-id"
-      ],
-      "AccessControlGroups": [
-        "33-group-one-resource-id"
-      ],
-      "SkipAutoApply": false
-    }
-  ],
-  "NameServerGroups": [
-    {
-      "ID": "nsgroup-331",
-      "PublicID": "nsgroup-1-public",
-      "Name": "nsgroup-1",
-      "Description": "nsgroup-1",
-      "NameServers": [
-        {
-          "IP": "192.168.31.2",
-          "NSType": 1,
-          "Port": 53
-        }
-      ],
-      "Groups": [
-        "33-group-one-resource-id"
-      ],
-      "Primary": true,
-      "Domains": [
-        "test-1.com"
-      ],
-      "Enabled": true,
-      "SearchDomainsEnabled": false
-    },
-    {
-      "ID": "nsgroup-332",
-      "PublicID": "nsgroup-2-public",
-      "Name": "nsgroup-2",
-      "Description": "nsgroup-2",
-      "NameServers": [
-        {
-          "IP": "192.168.32.3",
-          "NSType": 1,
-          "Port": 53
-        }
-      ],
-      "Groups": [
-        "33-group-one-resource-id",
-        "33-group-no-resources-id"
-      ],
-      "Primary": true,
-      "Domains": [
-        "test-1.com",
-        "test-2.com"
-      ],
-      "Enabled": true,
-      "SearchDomainsEnabled": false
-    }
-  ],
-  "NetworkResources": [
-    {
-      "ID": "net-resource-331",
-      "NetworkID": "network-331",
-      "AccountID": "account-33",
-      "PublicID": "net-resource-public-1",
-      "Name": "network-resource-1",
-      "Description": "network-resource-1",
-      "Type": "subnet",
-      "Address": "",
-      "Domain": "",
-      "Prefix": "10.0.0.0/16",
-      "Enabled": true
-    },
-    {
-      "ID": "net-resource-332",
-      "NetworkID": "network-332",
-      "AccountID": "account-33",
-      "PublicID": "net-resource-public-2",
-      "Name": "network-resource-2",
-      "Description": "network-resource-2",
-      "Type": "domain",
-      "Address": "",
-      "Domain": "test.com",
-      "Prefix": "",
-      "Enabled": true
-    }
-  ],
-  "Network": {
-    "Identifier": "network-331",
-    "Net": {
-      "IP": "100.103.0.0",
-      "Mask": "//8AAA=="
-    },
-    "NetV6": {
-      "IP": "fdde:e995:fd38:a465::",
-      "Mask": "//////////8AAAAAAAAAAA=="
-    },
-    "Dns": "",
-    "Serial": 1
-  },
-  "DNSSettings": {
-    "DisabledManagementGroups": [
-      "disabled-group-1",
-      "disabled-group-2"
-    ]
-  },
-  "AccountSettings": {
-    "PeerLoginExpirationEnabled": true,
-    "PeerLoginExpiration": 86400000000000,
-    "PeerInactivityExpirationEnabled": false,
-    "PeerInactivityExpiration": 86400000000000,
-    "DNSDomain": "",
-    "IPv6EnabledGroups": [
-      "33-group-one-resource-id"
-    ],
-    "RoutingPeerDNSResolutionEnabled": false,
-    "LazyConnectionEnabled": false,
-    "AutoUpdateVersion": "disabled",
-    "AutoUpdateAlways": false,
-    "MetricsPushEnabled": false
-  },
-  "PostureChecks": {
-    "posturecheck-331": {
-      "ID": "posturecheck-331",
-      "Checks": {
-        "NBVersionCheck": {
-          "MinVersion": "0.25.0"
-        },
-        "OSVersionCheck": {
-          "Android": null,
-          "Darwin": {
-            "MinVersion": "12.0"
-          },
-          "Ios": null,
-          "Linux": null,
-          "Windows": null
-        },
-        "GeoLocationCheck": {
-          "Locations": [
-            {
-              "CountryCode": "FI",
-              "CityName": ""
-            }
-          ],
-          "Action": "allow"
-        },
-        "PeerNetworkRangeCheck": {
-          "Action": "deny",
-          "Ranges": [
-            "192.168.0.1/24"
-          ]
-        },
-        "ProcessCheck": null
-      }
-    }
-  },
-  "PostureValidation": null,
-  "AllowedUserIDs": {},
-  "NetworkXIDToPublicID": {
-    "network-331": "network-1-public",
-    "network-332": "network-2-public"
-  },
-  "PostureCheckXIDToPublicID": {
-    "posturecheck-331": "posturecheck-1-public"
-  },
-  "ValidatedPeers": {
-    "peer-id-1": {},
-    "peer-id-2": {},
-    "peer-id-3": {}
-  },
-  "ResourcePolicies": {},
-  "Routers": {
-    "network-id-1": {
-      "peer-id-331": {
-        "PublicID": "public-id-1",
-        "PeerGroups": [
-          "33-group-one-resource-id"
-        ],
-        "Masquerade": true,
-        "Metric": 999,
-        "Enabled": true
-      }
-    },
-    "network-id-2": {
-      "peer-id-332": {
-        "PublicID": "public-id-2",
-        "PeerGroups": [
-          "33-group-two-resources-id",
-          "33-group-no-resources-id"
-        ],
-        "Masquerade": true,
-        "Metric": 333,
-        "Enabled": true
-      },
-      "peer-id-333": {
-        "PublicID": "public-id-2",
-        "PeerGroups": [
-          "33-group-two-resources-id",
-          "33-group-no-resources-id"
-        ],
-        "Masquerade": true,
-        "Metric": 333,
-        "Enabled": true
-      }
-    }
-  },
-  "GroupIDToUserIDs": {},
-  "DNSDomain": "",
-  "ProxyTargetedDomainResourceIDs": {},
-  "AppliedZoneCandidates": [
-    {
-      "DistributionGroups": [
-        "33-group-one-resource-id"
-      ],
-      "Zone": {
-        "Domain": "test-331.com",
-        "Records": [
-          {
-            "Name": "test.test-331.com",
-            "Type": 1,
-            "Class": "IN",
-            "TTL": 1800,
-            "RData": "1.1.1.1"
-          },
-          {
-            "Name": "test2.test-331.com",
-            "Type": 1,
-            "Class": "IN",
-            "TTL": 1800,
-            "RData": "1.1.1.2"
-          }
-        ],
-        "SearchDomainDisabled": false,
-        "NonAuthoritative": false
-      }
-    }
-  ],
-  "PrivateServiceCandidates": null
-}

integration_tests/management/network_map_db/network_map_data_test.go

@@ -1,73 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	_ "embed"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
-	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/settings"
-	"github.com/netbirdio/netbird/management/server/types"
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-)
-
-//go:embed network_map_data.sql
-var nmapData string
-
-//go:embed network_map_data_golden.json
-var goldenNMap string
-
-const EnvUpdateGoldenData = "NMAP_UPDATE_GOLDEN_DATA"
-
-func TestGetNetworkMapData(t *testing.T) {
-	ctx := context.TODO()
-	ctrl := gomock.NewController(t)
-
-	extraSettingsManager := settings.NewMockManager(ctrl)
-	extraSettingsManager.EXPECT().GetExtraSettings(gomock.Any(), gomock.Any()).Return(&types.ExtraSettings{}, nil)
-
-	peerValidators := integrated_validator.NewMockIntegratedValidator(ctrl)
-	peerValidators.EXPECT().GetValidatedPeers(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
-		map[string]struct{}{
-			"peer-id-1": {},
-			"peer-id-2": {},
-			"peer-id-3": {},
-		}, nil)
-
-	storeImpl := networkmapdb.NetworkMapDBStoreImpl{
-		Store:                   store(t),
-		ExtraSettingsManager:    extraSettingsManager,
-		IntegratedPeerValidator: peerValidators,
-	}
-
-	for _, query := range strings.Split(nmapData, ";") {
-		if err := store(t).Exec(ctx, query); err != nil {
-			log.Fatalf("error initializing nmap test: %s", err.Error())
-		}
-	}
-
-	nmap, err := storeImpl.GetNetworkMapData(ctx, "account-33")
-	assert.NoError(t, err)
-
-	serializedNMap, err := json.MarshalIndent(nmap, "", "  ")
-	assert.NoError(t, err)
-
-	if _, ok := os.LookupEnv(EnvUpdateGoldenData); ok {
-		_, filename, _, _ := runtime.Caller(0)
-		tosavepath := filepath.Join(filepath.Dir(filename), "network_map_data_golden.json")
-		err = os.WriteFile(tosavepath, serializedNMap, 0644)
-		assert.NoError(t, err)
-		goldenNMap = string(serializedNMap)
-	}
-	assert.Equal(t, goldenNMap, string(serializedNMap))
-}

integration_tests/management/network_map_db/network_resource_test.go

@@ -1,65 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetNetworkResources(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
-		VALUES('net-resource-1','account-1','network-1','net-resource-public-1','network-resource-1','network-resource-1','subnet','','"10.0.0.0/16"',TRUE)`)
-	execQuery(t, ctx,
-		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
-		VALUES('net-resource-2','account-1','network-2','net-resource-public-2','network-resource-2','network-resource-2','domain','test.com','',TRUE)`)
-	execQuery(t, ctx,
-		`insert into network_resources (id, account_id, network_id, public_id, name, description, type, domain, prefix, enabled)
-		VALUES('net-resource-3','account-1','network-3','net-resource-public-3','network-resource-3','network-resource-3','host','','"10.0.0.1/32"',TRUE)`)
-
-	resources, err := conn(t, ctx).GetNetworkResources(ctx, "account-1")
-	assert.NoError(t, err)
-
-	assert.Contains(t, resources, nmdata.NetworkResource{
-		ID:          "net-resource-1",
-		AccountID:   "account-1",
-		NetworkID:   "network-1",
-		PublicID:    "net-resource-public-1",
-		Name:        "network-resource-1",
-		Description: "network-resource-1",
-		Type:        "subnet",
-		Domain:      "",
-		Prefix:      netip.MustParsePrefix("10.0.0.0/16"),
-		Enabled:     true,
-	})
-	assert.Contains(t, resources, nmdata.NetworkResource{
-		ID:          "net-resource-2",
-		AccountID:   "account-1",
-		NetworkID:   "network-2",
-		PublicID:    "net-resource-public-2",
-		Name:        "network-resource-2",
-		Description: "network-resource-2",
-		Type:        "domain",
-		Domain:      "test.com",
-		Enabled:     true,
-	})
-	assert.Contains(t, resources, nmdata.NetworkResource{
-		ID:          "net-resource-3",
-		AccountID:   "account-1",
-		NetworkID:   "network-3",
-		PublicID:    "net-resource-public-3",
-		Name:        "network-resource-3",
-		Description: "network-resource-3",
-		Type:        "host",
-		Domain:      "",
-		Prefix:      netip.MustParsePrefix("10.0.0.1/32"),
-		Enabled:     true,
-	})
-}

integration_tests/management/network_map_db/network_router_test.go

@@ -1,33 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetNetworkRouters(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
-		VALUES('test-nr-id-1','account-1','public-id-1','peer-id-1','network-id-1',TRUE,999,TRUE,'["group-one-resource-id"]')`)
-	execQuery(t, ctx,
-		`insert into network_routers (id, account_id, public_id, peer, network_id, masquerade, metric, enabled, peer_groups)
-		VALUES('test-nr-id-2','account-1','public-id-2','','network-id-2',TRUE,333,TRUE,'["group-two-resources-id","group-no-resources-id"]')`)
-
-	routers, err := conn(t, ctx).GetNetworkRouters(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.NotEmpty(t, routers)
-
-	assert.Equal(t, routers["network-id-1"],
-		map[string]*nmdata.NetworkRouter{"peer-id-1": {PublicID: "public-id-1", Masquerade: true, Metric: 999, Enabled: true, PeerGroups: []string{"group-one-resource-id"}}})
-	assert.Equal(t, routers["network-id-2"],
-		map[string]*nmdata.NetworkRouter{
-			"peer-id-2": {PublicID: "public-id-2", Masquerade: true, Metric: 333, Enabled: true, PeerGroups: []string{"group-two-resources-id", "group-no-resources-id"}},
-			"peer-id-3": {PublicID: "public-id-2", Masquerade: true, Metric: 333, Enabled: true, PeerGroups: []string{"group-two-resources-id", "group-no-resources-id"}}})
-}

integration_tests/management/network_map_db/network_test.go

@@ -1,56 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"encoding/json"
-	"net"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetNetwork(t *testing.T) {
-	ctx := context.TODO()
-
-	network, err := conn(t, ctx).GetNetwork(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, network, nmdata.Network{
-		Identifier: "network-1",
-		Net:        mustParseCIDR("100.103.0.0/16"),
-		NetV6:      mustParseCIDR("fdde:e995:fd38:a465::/64"),
-		Serial:     1,
-	})
-
-	network, err = conn(t, ctx).GetNetwork(ctx, "account-2")
-	assert.NoError(t, err)
-	assert.Equal(t, network, nmdata.Network{
-		Identifier: "network-2",
-		Net:        mustParseCIDR("110.0.0.0/16"),
-		NetV6:      mustParseCIDR("fddf:e995:fd38:a465::/64"),
-		Serial:     2,
-	})
-}
-
-func mustParseCIDR(s string) net.IPNet {
-	var toret net.IPNet
-
-	_, net, err := net.ParseCIDR(s)
-	if err != nil {
-		panic(err)
-	}
-
-	jn, err := json.Marshal(net)
-	if err != nil {
-		panic(err)
-	}
-
-	err = json.Unmarshal(jn, &toret)
-	if err != nil {
-		panic(err)
-	}
-
-	return toret
-}

integration_tests/management/network_map_db/networks_test.go

@@ -1,26 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetNetworks(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into networks (id, account_id, public_id) VALUES('network-1','account-1','network-1-public')`)
-	execQuery(t, ctx,
-		`insert into networks (id, account_id, public_id) VALUES('network-2','account-1','network-2-public')`)
-
-	networksIdx, err := conn(t, ctx).GetNetworkXIDToPublicIdMap(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, networksIdx, map[string]string{
-		"network-1": "network-1-public",
-		"network-2": "network-2-public",
-	})
-}

integration_tests/management/network_map_db/peer_test.go

@@ -1,163 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetPeers(t *testing.T) {
-	ctx := context.TODO()
-
-	peers, clusterToPeersIdx, err := conn(t, ctx).GetPeers(ctx, "account-1")
-	assert.NoError(t, err)
-
-	// shouldn't be returned in the index, as it's not connected
-	execQuery(t, ctx,
-		`insert into peers (id,account_id,"key",ssh_key,proxy_meta_embedded,peer_status_connected)
-		 values('peer-4','account-1','key-4','ssh-key-4',true,false)`)
-	// shouldn't be returned in the index as it doesn't have cluster set
-	execQuery(t, ctx,
-		`insert into peers (id,account_id,"key",ssh_key,proxy_meta_embedded,peer_status_connected)
-		 values('peer-5','account-1','key-5','ssh-key-5',false,true)`)
-
-	peer1 := nmdata.Peer{
-		ID:                     "peer-id-1",
-		Key:                    "key-1",
-		SSHKey:                 "ssh-key-1",
-		DNSLabel:               "peer-1",
-		ExtraDNSLabels:         []string{"extra-peer-1"},
-		UserID:                 "user-id-1",
-		SSHEnabled:             true,
-		LoginExpirationEnabled: true,
-		LastLogin:              mustParseTime("2026-08-06T13:25:59.12999+00:00"),
-		IP:                     netip.MustParseAddr("10.10.10.1"),
-		IPv6:                   netip.MustParseAddr("fdf4:ba80:6aa5:89f1:44d7:8701:8699:4940"),
-		RequiresApproval:       false,
-		Meta: nmdata.PeerSystemMeta{
-			WtVersion:     "0.76.0",
-			GoOS:          "linux",
-			OSVersion:     "26.4.1",
-			KernelVersion: "6.8.0-134-generic",
-			NetworkAddresses: []nmdata.NetworkAddress{
-				{NetIP: netip.MustParsePrefix("fe80::8b4c:973f:a76b:3771/64")},
-				{NetIP: netip.MustParsePrefix("192.168.16.1/20")},
-			},
-			Files: []nmdata.File{
-				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
-			},
-			Capabilities: []int32{1, 2},
-			Flags: nmdata.Flags{
-				ServerSSHAllowed: true,
-				DisableIPv6:      false,
-			},
-			SyncMessageVersion: 1,
-		},
-		ProxyMeta: nmdata.ProxyMeta{
-			Embedded: true,
-		},
-		Location: nmdata.PeerLocation{
-			CountryCode:  "DE",
-			CityName:     "Berlin",
-			ConnectionIP: net.ParseIP("46.201.148.187"),
-		},
-	}
-	peer2 := nmdata.Peer{
-		ID:                     "peer-id-2",
-		Key:                    "key-2",
-		SSHKey:                 "ssh-key-2",
-		DNSLabel:               "peer-2",
-		ExtraDNSLabels:         []string{"extra-peer-2"},
-		UserID:                 "user-id-2",
-		SSHEnabled:             true,
-		LoginExpirationEnabled: true,
-		LastLogin:              mustParseTime("2026-08-06T14:25:59.12999+00:00"),
-		IP:                     netip.MustParseAddr("10.10.100.1"),
-		IPv6:                   netip.MustParseAddr("fdf5:ba80:6aa5:89f1:44d7:8701:8699:4940"),
-		RequiresApproval:       false,
-		Meta: nmdata.PeerSystemMeta{
-			WtVersion:     "0.76.1",
-			GoOS:          "linux",
-			OSVersion:     "26.4.2",
-			KernelVersion: "6.8.0-135-generic",
-			NetworkAddresses: []nmdata.NetworkAddress{
-				{NetIP: netip.MustParsePrefix("fe81::8b4c:973f:a76b:3771/64")},
-				{NetIP: netip.MustParsePrefix("192.168.17.1/20")},
-			},
-			Files: []nmdata.File{
-				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
-			},
-			Capabilities: []int32{1, 2},
-			Flags: nmdata.Flags{
-				ServerSSHAllowed: true,
-				DisableIPv6:      false,
-			},
-			SyncMessageVersion: 0,
-		},
-		ProxyMeta: nmdata.ProxyMeta{
-			Embedded: true,
-		},
-		Location: nmdata.PeerLocation{
-			CountryCode:  "DE",
-			CityName:     "Berlin",
-			ConnectionIP: net.ParseIP("46.201.149.187"),
-		},
-	}
-	peer3 := nmdata.Peer{
-		ID:                     "peer-id-3",
-		Key:                    "key-3",
-		SSHKey:                 "ssh-key-3",
-		DNSLabel:               "peer-3",
-		ExtraDNSLabels:         []string{"extra-peer-3"},
-		UserID:                 "user-id-3",
-		SSHEnabled:             true,
-		LoginExpirationEnabled: true,
-		LastLogin:              mustParseTime("2026-08-06T12:25:59.12999+00:00"),
-		IP:                     netip.MustParseAddr("10.10.200.1"),
-		IPv6:                   netip.MustParseAddr("fdf6:ba80:6aa5:89f1:44d7:8701:8699:4940"),
-		RequiresApproval:       false,
-		Meta: nmdata.PeerSystemMeta{
-			WtVersion:     "0.76.2",
-			GoOS:          "linux",
-			OSVersion:     "26.4.3",
-			KernelVersion: "6.8.0-136-generic",
-			NetworkAddresses: []nmdata.NetworkAddress{
-				{NetIP: netip.MustParsePrefix("fe82::8b4c:973f:a76b:3771/64")},
-				{NetIP: netip.MustParsePrefix("192.168.18.1/20")},
-			},
-			Files: []nmdata.File{
-				{Path: "/usr/bin/netbird", ProcessIsRunning: false},
-			},
-			Capabilities: []int32{1, 2},
-			Flags: nmdata.Flags{
-				ServerSSHAllowed: true,
-				DisableIPv6:      false,
-			},
-			SyncMessageVersion: 1,
-		},
-		ProxyMeta: nmdata.ProxyMeta{
-			Embedded: true,
-		},
-		Location: nmdata.PeerLocation{
-			CountryCode:  "DE",
-			CityName:     "Berlin",
-			ConnectionIP: net.ParseIP("46.201.150.187"),
-		},
-	}
-
-	assert.Contains(t, peers, peer1)
-	assert.Contains(t, peers, peer2)
-	assert.Contains(t, peers, peer3)
-
-	assert.Equal(t, clusterToPeersIdx, map[string][]*nmdata.Peer{
-		"cluster-1.netbird.services": {&peer1},
-		"cluster-2.netbird.services": {&peer2},
-		"cluster-3.netbird.services": {&peer3},
-	})
-}

integration_tests/management/network_map_db/pg_test_store.go

@@ -1,121 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-	"strings"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/google/uuid"
-	networkmap_pgsql "github.com/netbirdio/netbird/management/internals/network_map_db/pgsql"
-	gormstore "github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/testutil"
-	"gorm.io/driver/postgres"
-	"gorm.io/gorm"
-)
-
-func createPGTestStore(baseData string) (*networkmap_pgsql.PgStore, func()) {
-	_, tmpdsn, err := testutil.CreatePostgresTestContainer()
-	if err != nil {
-		log.Fatalf("error starting postres container %v", err)
-	}
-
-	var db *gorm.DB
-	for i := range 5 {
-		db, err = gorm.Open(postgres.Open(tmpdsn), &gorm.Config{})
-
-		if err == nil {
-			break
-		}
-
-		if i < 5 {
-			waitTime := time.Duration(100*(i+1)) * time.Millisecond
-			time.Sleep(waitTime)
-			continue
-		}
-
-		log.Fatalf("error connecting to postres db %v", err)
-	}
-
-	var cleanup func()
-	dsn, cleanup, err := createRandomDB(tmpdsn, db)
-	sqlDB, _ := db.DB()
-	if sqlDB != nil {
-		sqlDB.Close()
-	}
-	if err != nil {
-		log.Fatalf("error creating postres db %v", err)
-	}
-
-	_, err = gormstore.NewPostgresqlStoreForTests(context.TODO(), dsn, nil, false)
-	if err != nil {
-		log.Fatalf("error running migrations %v", err)
-	}
-
-	ctx := context.TODO()
-	pgstore, err := networkmap_pgsql.NewPostgresqlStore(ctx, dsn)
-	if err != nil {
-		log.Fatal("error creating postgres store %w", err)
-	}
-
-	for _, query := range strings.Split(baseData, ";") {
-		if _, err := pgstore.Pool.Exec(ctx, query); err != nil {
-			log.Fatalf("error initializing db: %s", err.Error())
-		}
-	}
-
-	return pgstore, cleanup
-}
-
-func createRandomDB(dsn string, db *gorm.DB) (string, func(), error) {
-	dbName := fmt.Sprintf("test_db_%s", strings.ReplaceAll(uuid.New().String(), "-", "_"))
-
-	if err := db.Exec(fmt.Sprintf("CREATE DATABASE %s", dbName)).Error; err != nil {
-		return "", nil, fmt.Errorf("failed to create database: %v", err)
-	}
-
-	originalDSN := dsn
-
-	cleanup := func() {
-		var dropDB *gorm.DB
-		var err error
-
-		dropDB, err = gorm.Open(postgres.Open(originalDSN), &gorm.Config{
-			SkipDefaultTransaction: true,
-			PrepareStmt:            false,
-		})
-		if err != nil {
-			log.Errorf("failed to connect for dropping database %s: %v", dbName, err)
-			return
-		}
-		defer func() {
-			if sqlDB, _ := dropDB.DB(); sqlDB != nil {
-				sqlDB.Close()
-			}
-		}()
-
-		if sqlDB, _ := dropDB.DB(); sqlDB != nil {
-			sqlDB.SetMaxOpenConns(1)
-			sqlDB.SetMaxIdleConns(0)
-			sqlDB.SetConnMaxLifetime(time.Second)
-		}
-
-		err = dropDB.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s WITH (FORCE)", dbName)).Error
-
-		if err != nil {
-			log.Errorf("failed to drop database %s: %v", dbName, err)
-		}
-	}
-
-	return replaceDBName(dsn, dbName), cleanup, nil
-}
-
-func replaceDBName(dsn, newDBName string) string {
-	re := regexp.MustCompile(`(?P<pre>[:/@])(?P<dbname>[^/?]+)(?P<post>\?|$)`)
-	return re.ReplaceAllString(dsn, `${pre}`+newDBName+`${post}`)
-}

integration_tests/management/network_map_db/policy_test.go

@@ -1,146 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetPolicies(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
-		 values('policy-1','policy-1-public','account-1',true,'["posture-checks-1","posture-checks-2"]')`)
-	execQuery(t, ctx,
-		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
-		                           source_resource, destination_resource, ports, port_ranges,
-								   authorized_groups, authorized_user)
-		 values('policy-1-rule-1','policy-1',true,'accept','tcp',true,'["group-one-resource-id","group-two-resources-id"]','["group-one-resource-id","group-two-resources-id"]',
-		        '{"ID":"host-id-1","Type":"host"}','{"ID":"domain-1","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
-				'{"group-one-resource-id":["user-1", "user-2"]}','user-3')`)
-	execQuery(t, ctx,
-		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
-		 values('policy-2','policy-2-public','account-1',true,'["posture-checks-3","posture-checks-4"]')`)
-	execQuery(t, ctx,
-		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
-		                           source_resource, destination_resource, ports, port_ranges,
-								   authorized_groups, authorized_user)
-		 values('policy-2-rule-1','policy-2',true,'accept','tcp',true,'["group-one-resource-id"]','["group-two-resources-id"]',
-		        '{"ID":"host-id-3","Type":"host"}','{"ID":"domain-3","Type":"domain"}','["8080","8443"]', '[{"Start":8080,"End":8090}]',
-				'{"group-one-resource-id":["user-6", "user-7"]}','user-8')`)
-	// policy with a rule with null fields
-	execQuery(t, ctx,
-		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
-		 values('policy-3','policy-3-public','account-1',true,null)`)
-	execQuery(t, ctx,
-		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
-		                           source_resource, destination_resource, ports, port_ranges,
-								   authorized_groups, authorized_user)
-		 values('policy-3-rule-1','policy-3',true,null,null,null,null,null,null,null,null,null,null,null)`)
-	// policy with a disabled rule, destination resource and groups should not be in indexes
-	execQuery(t, ctx,
-		`insert into policies (id, public_id, account_id, enabled, source_posture_checks)
-		 values('policy-4','policy-4-public','account-1',true,null)`)
-	execQuery(t, ctx,
-		`insert into policy_rules (id, policy_id, enabled, action, protocol, bidirectional, sources, destinations,
-		                           source_resource, destination_resource, ports, port_ranges,
-								   authorized_groups, authorized_user)
-		 values('policy-4-rule-1','policy-4',false,null,null,null,null,'["group-two-resources-id"]',
-		        null,'{"ID":"domain-3","Type":"domain"}',null,null,null,null)`)
-
-	policies, policyToDestinationResourceIdx, policyToDestinationGroupIdx, err := conn(t, ctx).GetPolicies(ctx, "account-1")
-	assert.NoError(t, err)
-
-	assert.Contains(t, policies, nmdata.Policy{
-		ID:                  "policy-1",
-		PublicID:            "policy-1-public",
-		Enabled:             true,
-		SourcePostureChecks: []string{"posture-checks-1", "posture-checks-2"},
-		Rules: []*nmdata.PolicyRule{
-			{
-				ID:                  "policy-1",
-				PolicyID:            "policy-1",
-				Enabled:             true,
-				Action:              "accept",
-				Protocol:            "tcp",
-				Bidirectional:       true,
-				Sources:             []string{"group-one-resource-id", "group-two-resources-id"},
-				Destinations:        []string{"group-one-resource-id", "group-two-resources-id"},
-				SourceResource:      nmdata.Resource{ID: "host-id-1", Type: "host"},
-				DestinationResource: nmdata.Resource{ID: "domain-1", Type: "domain"},
-				Ports:               []string{"8080", "8443"},
-				PortRanges:          []nmdata.RulePortRange{{Start: 8080, End: 8090}},
-				AuthorizedGroups:    map[string][]string{"group-one-resource-id": {"user-1", "user-2"}},
-				AuthorizedUser:      "user-3",
-			},
-		},
-	})
-
-	assert.Contains(t, policies, nmdata.Policy{
-		ID:                  "policy-2",
-		PublicID:            "policy-2-public",
-		Enabled:             true,
-		SourcePostureChecks: []string{"posture-checks-3", "posture-checks-4"},
-		Rules: []*nmdata.PolicyRule{
-			{
-				ID:                  "policy-2",
-				PolicyID:            "policy-2",
-				Enabled:             true,
-				Action:              "accept",
-				Protocol:            "tcp",
-				Bidirectional:       true,
-				Sources:             []string{"group-one-resource-id"},
-				Destinations:        []string{"group-two-resources-id"},
-				SourceResource:      nmdata.Resource{ID: "host-id-3", Type: "host"},
-				DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"},
-				Ports:               []string{"8080", "8443"},
-				PortRanges:          []nmdata.RulePortRange{{Start: 8080, End: 8090}},
-				AuthorizedGroups:    map[string][]string{"group-one-resource-id": {"user-6", "user-7"}},
-				AuthorizedUser:      "user-8",
-			},
-		},
-	})
-
-	assert.Contains(t, policies, nmdata.Policy{
-		ID:                  "policy-3",
-		PublicID:            "policy-3-public",
-		Enabled:             true,
-		SourcePostureChecks: nil,
-		Rules: []*nmdata.PolicyRule{
-			{
-				ID:       "policy-3",
-				PolicyID: "policy-3",
-				Enabled:  true,
-			},
-		},
-	})
-	assert.Contains(t, policies, nmdata.Policy{
-		ID:                  "policy-4",
-		PublicID:            "policy-4-public",
-		Enabled:             true,
-		SourcePostureChecks: nil,
-		Rules: []*nmdata.PolicyRule{
-			{
-				ID:                  "policy-4",
-				PolicyID:            "policy-4",
-				Enabled:             false,
-				Destinations:        []string{"group-two-resources-id"},
-				DestinationResource: nmdata.Resource{ID: "domain-3", Type: "domain"},
-			},
-		},
-	})
-
-	assert.Equal(t, policyToDestinationGroupIdx, map[string]map[string]any{
-		"policy-1": {"group-one-resource-id": struct{}{}, "group-two-resources-id": struct{}{}},
-		"policy-2": {"group-two-resources-id": struct{}{}},
-	})
-	assert.Equal(t, policyToDestinationResourceIdx, map[string]map[string]any{
-		"policy-1": {"domain-1": struct{}{}},
-		"policy-2": {"domain-3": struct{}{}},
-	})
-}

integration_tests/management/network_map_db/posture_test.go

@@ -1,61 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetPostureChecks(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into posture_checks (id, account_id, public_id, checks)
-		VALUES('posturecheck-1','account-1','posturecheck-1-public',
-		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
-		  "OSVersionCheck":{"Darwin":{"MinVersion":"12.0"}},
-		  "GeoLocationCheck":{"Locations":[{"CountryCode":"FI","CityName":""}],"Action":"allow"},
-		  "PeerNetworkRangeCheck":{"Action":"deny","Ranges":["192.168.0.1/24"]}}')`)
-
-	execQuery(t, ctx,
-		`insert into posture_checks (id, account_id, public_id, checks)
-		VALUES('posturecheck-2','account-1','posturecheck-2-public',
-		'{"NBVersionCheck":{"MinVersion":"0.25.0"},
-		  "OSVersionCheck":{"Android":{"MinVersion":"0"}},
-		  "GeoLocationCheck":{"Locations":[{"CountryCode":"US","CityName":"Harker Heights"}],"Action":"allow"},
-		  "PeerNetworkRangeCheck":{"Action":"allow","Ranges":["0.0.0.0/0"]}}')`)
-	execQuery(t, ctx,
-		`insert into posture_checks (id, account_id, public_id, checks)
-		VALUES('posturecheck-3','account-1','posturecheck-3-public', null)`)
-
-	postureChecks, idToPublicIDIdx, err := conn(t, ctx).GetPostureChecks(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, idToPublicIDIdx, map[string]string{
-		"posturecheck-1": "posturecheck-1-public",
-		"posturecheck-2": "posturecheck-2-public",
-		"posturecheck-3": "posturecheck-3-public",
-	})
-	assert.Contains(t, postureChecks, nmdata.PostureChecks{
-		ID: "posturecheck-1",
-		Checks: nmdata.ChecksDefinition{
-			NBVersionCheck:        &nmdata.NBVersionCheck{MinVersion: "0.25.0"},
-			OSVersionCheck:        &nmdata.OSVersionCheck{Darwin: &nmdata.MinVersionCheck{MinVersion: "12.0"}},
-			GeoLocationCheck:      &nmdata.GeoLocationCheck{Locations: []nmdata.GeoLocation{{CountryCode: "FI"}}, Action: "allow"},
-			PeerNetworkRangeCheck: &nmdata.PeerNetworkRangeCheck{Action: "deny", Ranges: []netip.Prefix{netip.MustParsePrefix("192.168.0.1/24")}},
-		}})
-	assert.Contains(t, postureChecks, nmdata.PostureChecks{
-		ID: "posturecheck-2",
-		Checks: nmdata.ChecksDefinition{
-			NBVersionCheck:        &nmdata.NBVersionCheck{MinVersion: "0.25.0"},
-			OSVersionCheck:        &nmdata.OSVersionCheck{Android: &nmdata.MinVersionCheck{MinVersion: "0"}},
-			GeoLocationCheck:      &nmdata.GeoLocationCheck{Locations: []nmdata.GeoLocation{{CountryCode: "US", CityName: "Harker Heights"}}, Action: "allow"},
-			PeerNetworkRangeCheck: &nmdata.PeerNetworkRangeCheck{Action: "allow", Ranges: []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")}},
-		}})
-	assert.Contains(t, postureChecks, nmdata.PostureChecks{
-		ID: "posturecheck-3"})
-}

integration_tests/management/network_map_db/route_test.go

@@ -1,87 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetRoutes(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
-	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
-	                         groups, access_control_groups, skip_auto_apply)
-		VALUES('route-1','account-1','route-1-public','"172.0.0.0/16"','["test-1.com"]',true,'route-1-net-id','route-1',
-		        'peer-id-1','["group-one-resource-id"]',1,true,9999,true,
-				'["group-one-resource-id"]','["group-one-resource-id"]',false)`)
-	execQuery(t, ctx,
-		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
-	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
-	                         groups, access_control_groups, skip_auto_apply)
-		VALUES('route-2','account-1','route-2-public','"172.10.0.0/16"','["test-1.com","test-2.com"]',true,'route-2-net-id','route-2',
-		        'peer-id-2','["group-two-resources-id"]',1,true,9999,true,
-				'["group-two-resources-id"]','["group-two-resources-id"]',false)`)
-	execQuery(t, ctx,
-		`insert into routes (id, account_id, public_id, network, domains, keep_route, net_id, description,
-	                         peer, peer_groups, network_type, masquerade, metric, enabled, 
-	                         groups, access_control_groups, skip_auto_apply)
-		VALUES('route-3','account-1','route-3-public',null,null,null,null,'route-3',
-		        null,null,null,null,null,null,null,null,null)`)
-
-	routes, err := conn(t, ctx).GetRoutes(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Contains(t, routes, nmdata.Route{
-		ID:                  "route-1",
-		AccountID:           "account-1",
-		PublicID:            "route-1-public",
-		Network:             netip.MustParsePrefix("172.0.0.0/16"),
-		Domains:             domain.List{"test-1.com"},
-		KeepRoute:           true,
-		NetID:               "route-1-net-id",
-		Description:         "route-1",
-		Peer:                "peer-id-1",
-		PeerID:              "peer-id-1",
-		PeerGroups:          []string{"group-one-resource-id"},
-		NetworkType:         1,
-		Masquerade:          true,
-		Metric:              9999,
-		Enabled:             true,
-		Groups:              []string{"group-one-resource-id"},
-		AccessControlGroups: []string{"group-one-resource-id"},
-		SkipAutoApply:       false,
-	})
-	assert.Contains(t, routes, nmdata.Route{
-		ID:                  "route-2",
-		AccountID:           "account-1",
-		PublicID:            "route-2-public",
-		Network:             netip.MustParsePrefix("172.10.0.0/16"),
-		Domains:             domain.List{"test-1.com", "test-2.com"},
-		KeepRoute:           true,
-		NetID:               "route-2-net-id",
-		Description:         "route-2",
-		Peer:                "peer-id-2",
-		PeerID:              "peer-id-2",
-		PeerGroups:          []string{"group-two-resources-id"},
-		NetworkType:         1,
-		Masquerade:          true,
-		Metric:              9999,
-		Enabled:             true,
-		Groups:              []string{"group-two-resources-id"},
-		AccessControlGroups: []string{"group-two-resources-id"},
-		SkipAutoApply:       false,
-	})
-	assert.Contains(t, routes, nmdata.Route{
-		ID:          "route-3",
-		AccountID:   "account-1",
-		PublicID:    "route-3-public",
-		Description: "route-3",
-	})
-}

integration_tests/management/network_map_db/service_test.go

@@ -1,109 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
-)
-
-func TestGetPrivateServices(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
-		 values('service-1','account-1',true,true,'["group-one-resource-id"]','test-1.com','test-2.com')`)
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
-		 values('service-2','account-1',true,true,'["group-one-resource-id","group-two-resources-id"]','test-3.com','test-4.com')`)
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, private, access_groups, proxy_cluster, domain)
-		 values('service-3','account-1',null,null,null,null,null)`)
-
-	services, err := conn(t, ctx).GetPrivateServices(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Contains(t, services, networkmapdb.Service{
-		Enabled:      sql.NullBool{Bool: true, Valid: true},
-		Private:      sql.NullBool{Bool: true, Valid: true},
-		AccessGroups: []string{"group-one-resource-id"},
-		ProxyCluster: sql.NullString{String: "test-1.com", Valid: true},
-		Domain:       sql.NullString{String: "test-2.com", Valid: true},
-	})
-	assert.Contains(t, services, networkmapdb.Service{
-		Enabled:      sql.NullBool{Bool: true, Valid: true},
-		Private:      sql.NullBool{Bool: true, Valid: true},
-		AccessGroups: []string{"group-one-resource-id", "group-two-resources-id"},
-		ProxyCluster: sql.NullString{String: "test-3.com", Valid: true},
-		Domain:       sql.NullString{String: "test-4.com", Valid: true},
-	})
-	assert.Contains(t, services, networkmapdb.Service{
-		Enabled:      sql.NullBool{Bool: false, Valid: false},
-		Private:      sql.NullBool{Bool: false, Valid: false},
-		AccessGroups: []string{},
-		ProxyCluster: sql.NullString{String: "", Valid: false},
-		Domain:       sql.NullString{String: "", Valid: false},
-	})
-}
-
-func TestGetProxyTargetedDomainResourceIDs(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, terminated)
-		 values('service-4','account-1',true,false)`)
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-1','account-1','service-4',true,'domain')`)
-	// id shouldn't be returned as the taget_type is not "domain"
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-2','account-1','service-4',true,'cluster')`)
-	// id shouldn't be included as the target is disabled
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-3','account-1','service-4',false,'domain')`)
-	// id shouldn't be included as the service is disabled
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, terminated)
-		 values('service-5','account-1',false,false)`)
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-4','account-1','service-5',false,'domain')`)
-	// id shouldn't be included as the service is terminated (explicitly)
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, terminated)
-		 values('service-6','account-1',true,true)`)
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-5','account-1','service-6',true,'domain')`)
-	// id shouldn't be included as the service is terminated (implicitly)
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, terminated)
-		 values('service-7','account-1',true,null)`)
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-6','account-1','service-7',true,'domain')`)
-	execQuery(t, ctx,
-		`insert into services (id, account_id, enabled, terminated)
-		 values('service-8','account-1',true,false)`)
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values('target-7','account-1','service-8',true,'domain')`)
-	// id shouldn't be returned as the taget_id is null
-	execQuery(t, ctx,
-		`insert into targets (target_id, account_id, service_id, enabled, target_type)
-		 values(null,'account-1','service-4',true,'cluster')`)
-
-	servtargetedDomains, err := conn(t, ctx).GetProxyTargetedDomainResourceIDs(ctx, "account-1")
-	assert.NoError(t, err)
-	assert.Equal(t, servtargetedDomains, map[string]struct{}{
-		"target-1": {},
-		"target-6": {},
-		"target-7": {},
-	})
-}

integration_tests/management/network_map_db/sqlite_test_store.go

@@ -1,48 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"fmt"
-	"runtime"
-	"strings"
-
-	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
-	gormstore "github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	log "github.com/sirupsen/logrus"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-)
-
-func createSqliteTestStore(baseData string) (*networkmap_sqlite.SqliteStore, func()) {
-	storeSqliteFileName := ":memory:"
-	storeStr := fmt.Sprintf("%s?cache=shared", storeSqliteFileName)
-	if runtime.GOOS == "windows" {
-		// Vo avoid `The process cannot access the file because it is being used by another process` on Windows
-		storeStr = storeSqliteFileName
-	}
-
-	db, err := gorm.Open(sqlite.Open(storeStr), &gorm.Config{})
-	if err != nil {
-		log.Fatalf("error initializing db: %s", err.Error())
-	}
-	_, err = gormstore.NewSqlStore(context.TODO(), db, types.SqliteStoreEngine, nil, false)
-	if err != nil {
-		log.Fatalf("error initializing db: %s", err.Error())
-	}
-
-	sqldb, err := db.DB()
-	if err != nil {
-		log.Fatalf("error initializing db: %s", err.Error())
-
-	}
-	for _, query := range strings.Split(baseData, ";") {
-		if _, err := sqldb.Exec(query); err != nil {
-			log.Fatalf("error initializing db: %s", err.Error())
-		}
-	}
-
-	return &networkmap_sqlite.SqliteStore{Db: sqldb}, func() {}
-}

integration_tests/management/network_map_db/user_test.go

@@ -1,57 +0,0 @@
-//go:build integration
-
-package networkmap_pgsql
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetAllowedUsers(t *testing.T) {
-	ctx := context.TODO()
-
-	execQuery(t, ctx,
-		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
-		VALUES('user-1','user-1','account-1','["group-one-resource-id"]',false,false)`)
-	execQuery(t, ctx,
-		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
-		VALUES('user-2','user-2','account-1','["group-one-resource-id","group-two-resources-id"]',false,false)`)
-	execQuery(t, ctx,
-		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
-		VALUES('user-3','user-3','account-1','["group-two-resources-id"]',false,false)`)
-	// shouldn't be included as it's blocked
-	execQuery(t, ctx,
-		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
-		VALUES('user-4','user-4','account-1','["group-two-resources-id"]',true,false)`)
-	// shouldn't be included as it's a service_user
-	execQuery(t, ctx,
-		`insert into users (id, name, account_id, auto_groups, blocked, is_service_user)
-		VALUES('user-5','user-5','account-1','["group-two-resources-id"]',false,true)`)
-	execQuery(t, ctx,
-		`insert into groups (id, name, account_id)
-		VALUES('all-group-1','All','account-1')`)
-	execQuery(t, ctx,
-		`insert into groups (id, name, account_id)
-		VALUES('all-group-2','All','account-1')`)
-	execQuery(t, ctx,
-		`insert into groups (id, name, account_id)
-		VALUES('all-group-3','All','account-1')`)
-
-	userIdx, groupIdToUserIds, err := conn(t, ctx).GetAllowedUsers(ctx, "account-1")
-	assert.NoError(t, err)
-
-	assert.Equal(t, userIdx, map[string]struct{}{
-		"user-1": {},
-		"user-2": {},
-		"user-3": {},
-	})
-	assert.Equal(t, groupIdToUserIds, map[string][]string{
-		"group-one-resource-id":  {"user-1", "user-2"},
-		"group-two-resources-id": {"user-2", "user-3"},
-		"all-group-1":            {"user-1", "user-2", "user-3"},
-		"all-group-2":            {"user-1", "user-2", "user-3"},
-		"all-group-3":            {"user-1", "user-2", "user-3"},
-	})
-}

magefiles/magefile.go

@@ -1,10 +0,0 @@
-//mage:multiline
-
-// Set the general description you want to have displayed with mage -l here.
-package main
-
-// mg contains helpful utility functions, like Deps
-
-// Default target to run when none is specified
-// If not set, running mage will list available targets
-//var Default = Integrationtest.All

magefiles/test.go

@@ -1,74 +0,0 @@
-package main
-
-import (
-	"errors"
-	"strings"
-
-	"github.com/magefile/mage/mg"
-	"github.com/magefile/mage/sh"
-)
-
-var defaultcli = []string{"test", "-tags=integration", "-timeout=20m"}
-
-type Integrationtest mg.Namespace
-
-func (i Integrationtest) All(gotestflags *string) error {
-	var errs []error
-	if err := i.Api(gotestflags); err != nil {
-		errs = append(errs, err)
-	}
-	if err := i.NmapDb(gotestflags); err != nil {
-		errs = append(errs, err)
-	}
-	if len(errs) > 0 {
-		return errors.Join(errs...)
-	}
-	return nil
-}
-
-func (Integrationtest) NmapDb(gotestflags *string) error {
-	cli := defaultcli
-	if gotestflags != nil {
-		cli = append(cli, strings.Split(*gotestflags, " ")...)
-	}
-	cli = append(cli, "./integration_tests/management/network_map_db/...")
-
-	return sh.RunV("go", cli...)
-}
-
-func (Integrationtest) NmapDbPostgres(gotestflags *string) error {
-	cli := defaultcli
-	if gotestflags != nil {
-		cli = append(cli, strings.Split(*gotestflags, " ")...)
-	}
-	cli = append(cli, "./integration_tests/management/network_map_db/...")
-
-	return sh.RunWithV(map[string]string{"NETBIRD_STORE_ENGINE": "postgres"}, "go", cli...)
-}
-
-func (Integrationtest) NmapDbSqlite(gotestflags *string) error {
-	cli := defaultcli
-	if gotestflags != nil {
-		cli = append(cli, strings.Split(*gotestflags, " ")...)
-	}
-	cli = append(cli, "./integration_tests/management/network_map_db/...")
-	return sh.RunWithV(map[string]string{"NETBIRD_STORE_ENGINE": "sqlite"}, "go", cli...)
-}
-
-func (Integrationtest) RegenerateNmapGoldenData(gotestflags *string) error {
-	cli := defaultcli
-	if gotestflags != nil {
-		cli = append(cli, strings.Split(*gotestflags, " ")...)
-	}
-	cli = append(cli, "./integration_tests/management/network_map_db/...")
-	return sh.RunWithV(map[string]string{"NMAP_UPDATE_GOLDEN_DATA": "true", "NETBIRD_STORE_ENGINE": "sqlite"}, "go", cli...)
-}
-
-func (Integrationtest) Api(gotestflags *string) error {
-	cli := defaultcli
-	if gotestflags != nil {
-		cli = append(cli, strings.Split(*gotestflags, " ")...)
-	}
-	cli = append(cli, "./management/server/http/...")
-	return sh.RunV("go", cli...)
-}

management/internals/controllers/network_map/controller/controller.go

@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	"github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral"
-	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/account"
@@ -31,8 +30,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
 	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 	"github.com/netbirdio/netbird/util"
@@ -64,8 +61,6 @@ type Controller struct {
 	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
 
 	perAccountServerSupportedSyncMessageVersions map[string]sharedgrpc.SyncMessageVersion
-
-	nmdataStore *networkmapdb.NetworkMapDBStoreImpl
 }
 
 type bufferUpdate struct {
@@ -83,7 +78,7 @@ type bufferAffectedUpdate struct {
 
 var _ network_map.Controller = (*Controller)(nil)
 
-func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
+func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config) *Controller {
 	nMetrics, err := newMetrics(metrics.UpdateChannelMetrics())
 	if err != nil {
 		log.Fatal(fmt.Errorf("error creating metrics: %w", err))
@@ -104,7 +99,6 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		EphemeralPeersManager:                        ephemeralPeersManager,
 		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
 		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
-		nmdataStore:                                  nmdataStore,
 	}
 }
 
@@ -153,11 +147,6 @@ func (c *Controller) CountStreams() int {
 
 func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error {
 	log.WithContext(ctx).Tracef("updating peers for account %s from %s", accountID, util.GetCallerName())
-
-	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
-		return c.sendUpdateAccountPeersFromData(ctx, accountID, reason, nmData)
-	}
-
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get account: %v", err)
@@ -178,7 +167,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 		return nil
 	}
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validate peers: %v", err)
 	}
@@ -266,7 +255,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
 				// the client merges it into Calculate()'s output the same
 				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -287,7 +276,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			}
 
 			start = time.Now()
-			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -305,261 +294,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	return nil
 }
 
-// sendUpdateAccountPeersFromData is the account-free variant of
-// sendUpdateAccountPeers: everything is computed from the network-map DB
-// store's twin data; only extra settings and validated peers are resolved at
-// runtime. Proxy network maps and policy injection, private-service zones,
-// group-to-user SSH mappings and forced routing-peer DNS resolution have no
-// DB-backed source yet and are omitted.
-func (c *Controller) sendUpdateAccountPeersFromData(ctx context.Context, accountID string, reason types.UpdateReason, nmData *networkmap.NetworkMapData) error {
-	peersToUpdate := c.connectedPeersFromData(nmData, nil)
-	if len(peersToUpdate) == 0 {
-		return nil
-	}
-	return c.sendUpdatesFromData(ctx, accountID, nmData, peersToUpdate, &reason)
-}
-
-// sendUpdateForAffectedPeersFromData is the account-free variant of
-// sendUpdateForAffectedPeers.
-func (c *Controller) sendUpdateForAffectedPeersFromData(ctx context.Context, accountID string, peerIDs []string, nmData *networkmap.NetworkMapData) error {
-	if len(peerIDs) == 0 {
-		log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: no affected peers")
-		return nil
-	}
-
-	peersToUpdate := c.connectedPeersFromData(nmData, peerIDs)
-	if len(peersToUpdate) == 0 {
-		log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: no peers to update (affected peers not found in data or no channels)")
-		return nil
-	}
-
-	log.WithContext(ctx).Tracef("sendUpdateForAffectedPeersFromData: sending network map to %d connected peers", len(peersToUpdate))
-
-	return c.sendUpdatesFromData(ctx, accountID, nmData, peersToUpdate, nil)
-}
-
-// connectedPeersFromData returns the peers with an open update channel. An
-// empty affected list means all peers; a non-empty list restricts the result
-// to those peer IDs.
-func (c *Controller) connectedPeersFromData(nmData *networkmap.NetworkMapData, affected []string) []*nmdata.Peer {
-	if len(affected) == 0 {
-		result := make([]*nmdata.Peer, 0, len(nmData.Peers))
-		for _, peer := range nmData.Peers {
-			if c.peersUpdateManager.HasChannel(peer.ID) {
-				result = append(result, peer)
-			}
-		}
-		return result
-	}
-
-	result := make([]*nmdata.Peer, 0, len(affected))
-	for _, peerID := range affected {
-		peer := nmData.Peers[peerID]
-		if peer == nil {
-			continue
-		}
-		if c.peersUpdateManager.HasChannel(peerID) {
-			result = append(result, peer)
-		}
-	}
-	return result
-}
-
-func (c *Controller) sendUpdatesFromData(ctx context.Context, accountID string, nmData *networkmap.NetworkMapData, peersToUpdate []*nmdata.Peer, reason *types.UpdateReason) error {
-	globalStart := time.Now()
-
-	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, accountID)
-	if err != nil {
-		return fmt.Errorf("failed to get flow enabled status: %v", err)
-	}
-
-	nmData.PrecomputePostureValidation()
-
-	dnsCache := &cache.DNSConfigCache{}
-	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
-	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
-
-	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
-
-	var wg sync.WaitGroup
-	semaphore := make(chan struct{}, 10)
-
-	for _, peer := range peersToUpdate {
-		if reason != nil && c.accountManagerMetrics != nil {
-			c.accountManagerMetrics.CountNmapTriggered(string(reason.Resource), string(reason.Operation))
-		}
-
-		wg.Add(1)
-		semaphore <- struct{}{}
-		go func(p *nmdata.Peer) {
-			defer wg.Done()
-			defer func() { <-semaphore }()
-
-			start := time.Now()
-
-			postureChecks := peerPostureChecksFromData(nmData, p.ID)
-
-			c.metrics.CountCalcPostureChecksDuration(time.Since(start))
-			start = time.Now()
-
-			peerGroups := maps.Keys(nmData.GetPeerGroups(p.ID))
-			var update *proto.SyncResponse
-
-			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
-				c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
-				sharedgrpc.SyncMessageVersionFromConfig(&p.Meta.SyncMessageVersion))
-
-			log.WithContext(ctx).
-				WithFields(log.Fields{
-					"sync_message_version":        commonSyncMessageVersion,
-					"server_sync_message_version": c.perAccountOrGlobalSupportedSyncMessageVersions(accountID),
-					"peer_sync_message_version":   sharedgrpc.SyncMessageVersionFromConfig(&p.Meta.SyncMessageVersion),
-				}).Debug("common highest sync message version")
-
-			if commonSyncMessageVersion == sharedgrpc.ComponentNetworkMap {
-				components := nmData.GetPeerNetworkMapComponents(p.ID, peersCustomZone)
-
-				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
-
-				start = time.Now()
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, nil, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
-				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
-
-				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
-					Update:      update,
-					MessageType: network_map.MessageTypeNetworkMap,
-				})
-
-				return
-			}
-
-			nmap := NetworkMapFromData(ctx, nmData, p.ID, peersCustomZone)
-
-			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
-
-			start = time.Now()
-			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort)
-			c.metrics.CountToSyncResponseDuration(time.Since(start))
-
-			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
-				Update:      update,
-				MessageType: network_map.MessageTypeNetworkMap,
-			})
-		}(peer)
-	}
-
-	wg.Wait()
-	if c.accountManagerMetrics != nil {
-		c.accountManagerMetrics.CountUpdateAccountPeersDuration(time.Since(globalStart))
-	}
-
-	return nil
-}
-
-func (c *Controller) getNetworkMapData(ctx context.Context, accountID string) *networkmap.NetworkMapData {
-	if c.nmdataStore == nil {
-		return nil
-	}
-
-	nmData, err := c.nmdataStore.GetNetworkMapData(ctx, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get network map data for account %s, falling back to account-based computation: %v", accountID, err)
-		return nil
-	}
-
-	return nmData
-}
-
-func (c *Controller) getDNSDomainFromData(settings *nmdata.AccountSettingsInfo) string {
-	if settings == nil || settings.DNSDomain == "" {
-		return c.dnsDomain
-	}
-	return settings.DNSDomain
-}
-
-func IPv6AllowedPeersFromData(nmData *networkmap.NetworkMapData) map[string]struct{} {
-	result := make(map[string]struct{})
-	if nmData.AccountSettings != nil {
-		for _, groupID := range nmData.AccountSettings.IPv6EnabledGroups {
-			group := nmData.Groups[groupID]
-			if group == nil {
-				continue
-			}
-			for _, peerID := range group.Peers {
-				result[peerID] = struct{}{}
-			}
-		}
-	}
-	for id, p := range nmData.Peers {
-		if p != nil && p.ProxyMeta.Embedded {
-			result[id] = struct{}{}
-		}
-	}
-	return result
-}
-
-func NetworkMapFromData(ctx context.Context, nmData *networkmap.NetworkMapData, peerID string, peersCustomZone nmdata.CustomZone) *types.NetworkMap {
-	components := nmData.GetPeerNetworkMapComponents(peerID, peersCustomZone)
-	if components.IsEmpty() {
-		return &types.NetworkMap{Network: components.Network}
-	}
-	return types.CalculateNetworkMapFromComponents(ctx, components)
-}
-
-// peerPostureChecksFromData mirrors getPeerPostureChecks on the twin store. The
-// sync response only encodes process-check file paths, so only ProcessCheck is
-// converted back to the server posture type.
-func peerPostureChecksFromData(nmData *networkmap.NetworkMapData, peerID string) []*posture.Checks {
-	if len(nmData.PostureChecks) == 0 {
-		return nil
-	}
-
-	peerPostureChecks := make(map[string]*posture.Checks)
-	for _, policy := range nmData.Policies {
-		if policy == nil || !policy.Enabled || len(policy.SourcePostureChecks) == 0 {
-			continue
-		}
-		if !isPeerInPolicySourceGroupsFromData(nmData, peerID, policy) {
-			continue
-		}
-		for _, checkID := range policy.SourcePostureChecks {
-			twin := nmData.PostureChecks[checkID]
-			if twin == nil {
-				continue
-			}
-			peerPostureChecks[checkID] = postureChecksFromTwin(twin)
-		}
-	}
-
-	return maps.Values(peerPostureChecks)
-}
-
-func isPeerInPolicySourceGroupsFromData(nmData *networkmap.NetworkMapData, peerID string, policy *nmdata.Policy) bool {
-	for _, rule := range policy.Rules {
-		if rule == nil || !rule.Enabled {
-			continue
-		}
-		for _, groupID := range rule.Sources {
-			if group := nmData.Groups[groupID]; group != nil && slices.Contains(group.Peers, peerID) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-func postureChecksFromTwin(twin *nmdata.PostureChecks) *posture.Checks {
-	checks := &posture.Checks{ID: twin.ID}
-	if twin.Checks.ProcessCheck != nil {
-		processes := make([]posture.Process, 0, len(twin.Checks.ProcessCheck.Processes))
-		for _, p := range twin.Checks.ProcessCheck.Processes {
-			processes = append(processes, posture.Process{LinuxPath: p.LinuxPath, MacPath: p.MacPath, WindowsPath: p.WindowsPath})
-		}
-		checks.Checks.ProcessCheck = &posture.ProcessCheck{Processes: processes}
-	}
-	return checks
-}
-
 func (c *Controller) perAccountOrGlobalSupportedSyncMessageVersions(accountId string) sharedgrpc.SyncMessageVersion {
 	if perAccount, ok := c.perAccountServerSupportedSyncMessageVersions[accountId]; ok {
 		return perAccount
@@ -592,10 +326,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 		return nil
 	}
 
-	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
-		return c.sendUpdateForAffectedPeersFromData(ctx, accountID, peerIDs, nmData)
-	}
-
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get account: %v", err)
@@ -611,7 +341,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 
 	log.WithContext(ctx).Tracef("sendUpdateForAffectedPeers: sending network map to %d connected peers", len(peersToUpdate))
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validate peers: %v", err)
 	}
@@ -698,7 +428,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
 				// the client merges it into Calculate()'s output the same
 				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -719,7 +449,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			}
 
 			start = time.Now()
-			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort)
+			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSetting, maps.Keys(peerGroups), dnsFwdPort)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
 
 			c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -776,7 +506,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("peer %s doesn't exists in account %s", peerId, accountId)
 	}
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return fmt.Errorf("failed to get validated peers: %v", err)
 	}
@@ -836,7 +566,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
 		// the client merges it into Calculate()'s output the same
 		// way the legacy server did via NetworkMap.Merge.
-		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 			Update:      update,
@@ -853,7 +583,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		nmap.Merge(proxyNetworkMap)
 	}
 
-	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort)
+	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, peer, nil, nil, nmap, dnsDomain, postureChecks, dnsCache, account.Settings, extraSettings, maps.Keys(peerGroups), dnsFwdPort)
 
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 		Update:      update,
@@ -913,11 +643,7 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 		if err != nil {
 			return nil, nil, nil, nil, 0, err
 		}
-		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, nil, 0, nil
-	}
-
-	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
-		return c.getValidatedPeerWithComponentsFromData(ctx, accountID, peer, nmData)
+		return peer, &types.NetworkMapComponents{Network: network.Copy()}, nil, nil, 0, nil
 	}
 
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
@@ -927,7 +653,7 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 
 	c.injectAllProxyPolicies(ctx, account)
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, nil, nil, nil, 0, err
 	}
@@ -964,21 +690,6 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 	return peer, components, proxyNetworkMaps[peer.ID], postureChecks, dnsFwdPort, nil
 }
 
-// getValidatedPeerWithComponentsFromData is the account-free variant of
-// GetValidatedPeerWithComponents. The proxy network map fragment is omitted
-// like on the other nmdata paths.
-func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*posture.Checks, int64, error) {
-	postureChecks := peerPostureChecksFromData(nmData, peer.ID)
-
-	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
-	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
-
-	components := nmData.GetPeerNetworkMapComponents(peer.ID, peersCustomZone)
-	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
-
-	return peer, components, nil, postureChecks, dnsFwdPort, nil
-}
-
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
 func (c *Controller) BufferUpdateAffectedPeers(ctx context.Context, accountID string, peerIDs []string, reason types.UpdateReason) error {
 	if len(peerIDs) == 0 {
@@ -1085,15 +796,11 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 		}
 
 		emptyMap := &types.NetworkMap{
-			Network: types.TwinNetwork(network),
+			Network: network.Copy(),
 		}
 		return emptyMap, nil, 0, nil
 	}
 
-	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
-		return c.getValidatedPeerWithMapFromData(ctx, accountID, peerID, nmData)
-	}
-
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		return nil, nil, 0, err
@@ -1101,7 +808,7 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 
 	c.injectAllProxyPolicies(ctx, account)
 
-	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, nil, 0, err
 	}
@@ -1141,21 +848,6 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 	return networkMap, postureChecks, dnsFwdPort, nil
 }
 
-// getValidatedPeerWithMapFromData is the account-free variant of
-// GetValidatedPeerWithMap. The proxy network map fragment is omitted like on
-// the other nmdata paths.
-func (c *Controller) getValidatedPeerWithMapFromData(ctx context.Context, accountID string, peerID string, nmData *networkmap.NetworkMapData) (*types.NetworkMap, []*posture.Checks, int64, error) {
-	postureChecks := peerPostureChecksFromData(nmData, peerID)
-
-	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
-	peersCustomZone := networkmap.PeersCustomZone(ctx, accountID, dnsDomain, nmData.Peers, IPv6AllowedPeersFromData(nmData))
-
-	networkMap := NetworkMapFromData(ctx, nmData, peerID, peersCustomZone)
-	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
-
-	return networkMap, postureChecks, dnsFwdPort, nil
-}
-
 // GetDNSDomain returns the configured dnsDomain
 func (c *Controller) GetDNSDomain(settings *types.Settings) string {
 	if settings == nil {
@@ -1218,36 +910,20 @@ func (c *Controller) StartWarmup(ctx context.Context) {
 // computeForwarderPort checks if all peers in the account have updated to a specific version or newer.
 // If all peers have the required version, it returns the new well-known port (22054), otherwise returns 0.
 func computeForwarderPort(peers []*nbpeer.Peer, requiredVersion string) int64 {
-	versions := make([]string, 0, len(peers))
-	for _, peer := range peers {
-		versions = append(versions, peer.Meta.WtVersion)
-	}
-	return computeForwarderPortFromVersions(versions, requiredVersion)
-}
-
-func ComputeForwarderPortFromData(peers map[string]*nmdata.Peer, requiredVersion string) int64 {
-	versions := make([]string, 0, len(peers))
-	for _, peer := range peers {
-		versions = append(versions, peer.Meta.WtVersion)
-	}
-	return computeForwarderPortFromVersions(versions, requiredVersion)
-}
-
-func computeForwarderPortFromVersions(wtVersions []string, requiredVersion string) int64 {
-	if len(wtVersions) == 0 {
+	if len(peers) == 0 {
 		return int64(network_map.OldForwarderPort)
 	}
 
 	reqVer := semver.Canonical(requiredVersion)
 
 	// Check if all peers have the required version or newer
-	for _, wtVersion := range wtVersions {
+	for _, peer := range peers {
 
 		// Development version is always supported
-		if version.IsDevelopmentVersion(wtVersion) {
+		if version.IsDevelopmentVersion(peer.Meta.WtVersion) {
 			continue
 		}
-		peerVersion := semver.Canonical("v" + wtVersion)
+		peerVersion := semver.Canonical("v" + peer.Meta.WtVersion)
 		if peerVersion == "" {
 			// If any peer doesn't have version info, return 0
 			return int64(network_map.OldForwarderPort)
@@ -1381,7 +1057,7 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 		groups[groupID] = group.Peers
 	}
 
-	validatedPeers, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
+	validatedPeers, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, err
 	}

management/internals/controllers/network_map/nmaptest/canonicalize.go

@@ -1,380 +0,0 @@
-package nmaptest
-
-import (
-	"bytes"
-	"cmp"
-	"fmt"
-	"slices"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// normalizeIDSpace replaces policy and route identifiers with positional
-// placeholders so a comparison can reach everything else.
-//
-// This exists only because the envelope round-trip currently substitutes each
-// internal xid with the object's public id, which is a tracked defect and not a
-// licence to differ: those identifiers reach the server again inside flow
-// events, which resolve them by internal id, so the substitution silently
-// breaks flow attribution for component-format peers. TestIDSpaceMatches
-// asserts the equality that must eventually hold; this erasure keeps the other
-// 40-odd cases reporting on semantics meanwhile. When the id space is unified,
-// delete this and the calls to it — every case should still pass.
-//
-// Cardinality and cross-references survive the erasure: two rules under one
-// policy still share a token and a route firewall rule still points at its
-// route, so a path that drops a policy, merges two policies, or misattributes a
-// rule to the wrong route still fails.
-func normalizeIDSpace(nm *proto.NetworkMap) {
-	if nm == nil {
-		return
-	}
-	policies := newTokenizer("policy")
-	routes := newTokenizer("route")
-
-	for _, i := range orderBy(nm.Routes, routeKeyWithoutID) {
-		nm.Routes[i].ID = routes.get(nm.Routes[i].ID)
-	}
-	for _, i := range orderBy(nm.FirewallRules, firewallKeyWithoutPolicy) {
-		r := nm.FirewallRules[i]
-		if len(r.PolicyID) > 0 {
-			r.PolicyID = []byte(policies.get(string(r.PolicyID)))
-		}
-	}
-	for _, i := range orderBy(nm.RoutesFirewallRules, routeFirewallKeyWithoutIDs) {
-		r := nm.RoutesFirewallRules[i]
-		if len(r.PolicyID) > 0 {
-			r.PolicyID = []byte(policies.get(string(r.PolicyID)))
-		}
-		r.RouteID = routes.get(r.RouteID)
-	}
-}
-
-// tokenizer maps identifiers to positional placeholders in order of first use.
-type tokenizer struct {
-	prefix string
-	seen   map[string]string
-}
-
-func newTokenizer(prefix string) *tokenizer {
-	return &tokenizer{prefix: prefix, seen: make(map[string]string)}
-}
-
-func (t *tokenizer) get(id string) string {
-	if id == "" {
-		return ""
-	}
-	if tok, ok := t.seen[id]; ok {
-		return tok
-	}
-	tok := fmt.Sprintf("%s#%d", t.prefix, len(t.seen))
-	t.seen[id] = tok
-	return tok
-}
-
-// orderBy returns indices sorted by key, so placeholder numbering does not
-// depend on the identifiers being erased.
-func orderBy[T any](items []T, key func(T) string) []int {
-	idx := make([]int, len(items))
-	for i := range idx {
-		idx[i] = i
-	}
-	sort.SliceStable(idx, func(a, b int) bool { return key(items[idx[a]]) < key(items[idx[b]]) })
-	return idx
-}
-
-func routeKeyWithoutID(r *proto.Route) string {
-	if r == nil {
-		return ""
-	}
-	return fmt.Sprintf("%s|%s|%s|%d|%d|%t|%t|%v",
-		r.Network, r.NetID, r.Peer, r.Metric, r.NetworkType, r.Masquerade, r.KeepRoute, r.Domains)
-}
-
-func firewallKeyWithoutPolicy(r *proto.FirewallRule) string {
-	if r == nil {
-		return ""
-	}
-	return fmt.Sprintf("%s|%d|%d|%d|%s|%s|%v",
-		r.PeerIP, r.Direction, r.Action, r.Protocol, r.Port, portInfoKey(r.PortInfo), r.SourcePrefixes) //nolint:staticcheck
-}
-
-func routeFirewallKeyWithoutIDs(r *proto.RouteFirewallRule) string {
-	if r == nil {
-		return ""
-	}
-	return fmt.Sprintf("%s|%d|%d|%s|%v|%v|%t|%d",
-		r.Destination, r.Protocol, r.Action, portInfoKey(r.PortInfo), r.Domains, r.SourceRanges, r.IsDynamic, r.CustomProtocol)
-}
-
-// canonicalize sorts every repeated field of the NetworkMap by a stable key.
-// The producing paths iterate Go maps while building these slices, so order
-// can differ between runs even when the content is identical; comparing
-// without this reports noise.
-func canonicalize(nm *proto.NetworkMap) {
-	if nm == nil {
-		return
-	}
-	slices.SortFunc(nm.RemotePeers, cmpRemotePeer)
-	slices.SortFunc(nm.OfflinePeers, cmpRemotePeer)
-	slices.SortFunc(nm.Routes, cmpRoute)
-	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
-	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
-
-	for _, r := range nm.FirewallRules {
-		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
-	}
-	for _, r := range nm.RoutesFirewallRules {
-		slices.Sort(r.SourceRanges)
-	}
-	canonicalizeDNSConfig(nm.DNSConfig)
-	canonicalizeSSHAuth(nm.SshAuth)
-}
-
-func canonicalizeDNSConfig(d *proto.DNSConfig) {
-	if d == nil {
-		return
-	}
-	for _, g := range d.NameServerGroups {
-		if g == nil {
-			continue
-		}
-		slices.Sort(g.Domains)
-		slices.SortFunc(g.NameServers, func(a, b *proto.NameServer) int {
-			if a == nil || b == nil {
-				return boolCmp(a == nil, b == nil)
-			}
-			if c := cmp.Compare(a.IP, b.IP); c != 0 {
-				return c
-			}
-			if c := cmp.Compare(a.Port, b.Port); c != 0 {
-				return c
-			}
-			return cmp.Compare(a.NSType, b.NSType)
-		})
-	}
-	slices.SortFunc(d.NameServerGroups, func(a, b *proto.NameServerGroup) int {
-		return cmp.Compare(nsgKey(a), nsgKey(b))
-	})
-	for _, z := range d.CustomZones {
-		if z == nil {
-			continue
-		}
-		slices.SortFunc(z.Records, cmpSimpleRecord)
-	}
-	slices.SortFunc(d.CustomZones, func(a, b *proto.CustomZone) int {
-		if a == nil || b == nil {
-			return boolCmp(a == nil, b == nil)
-		}
-		return cmp.Compare(a.Domain, b.Domain)
-	})
-}
-
-// canonicalizeSSHAuth sorts AuthorizedUsers and re-keys MachineUsers.Indexes
-// against the new ordering, preserving which machine user maps to which hashes.
-func canonicalizeSSHAuth(s *proto.SSHAuth) {
-	if s == nil || len(s.AuthorizedUsers) == 0 {
-		return
-	}
-	type hashed struct {
-		bytes []byte
-		old   uint32
-	}
-	entries := make([]hashed, len(s.AuthorizedUsers))
-	for i, b := range s.AuthorizedUsers {
-		entries[i] = hashed{bytes: b, old: uint32(i)}
-	}
-	slices.SortFunc(entries, func(a, b hashed) int { return bytes.Compare(a.bytes, b.bytes) })
-
-	remap := make(map[uint32]uint32, len(entries))
-	sorted := make([][]byte, len(entries))
-	for newIdx, e := range entries {
-		remap[e.old] = uint32(newIdx)
-		sorted[newIdx] = e.bytes
-	}
-	s.AuthorizedUsers = sorted
-
-	for _, mu := range s.MachineUsers {
-		if mu == nil {
-			continue
-		}
-		for i, oldIdx := range mu.Indexes {
-			if newIdx, ok := remap[oldIdx]; ok {
-				mu.Indexes[i] = newIdx
-			}
-		}
-		slices.Sort(mu.Indexes)
-	}
-}
-
-func boolCmp(a, b bool) int {
-	if a == b {
-		return 0
-	}
-	if a {
-		return 1
-	}
-	return -1
-}
-
-func nsgKey(g *proto.NameServerGroup) string {
-	if g == nil {
-		return ""
-	}
-	var parts []string
-	for _, ns := range g.NameServers {
-		if ns == nil {
-			continue
-		}
-		parts = append(parts, ns.IP+":"+strconv.FormatInt(ns.Port, 10)+":"+strconv.FormatInt(ns.NSType, 10))
-	}
-	slices.Sort(parts)
-	key := strings.Join(parts, ",")
-	domains := append([]string(nil), g.Domains...)
-	slices.Sort(domains)
-	key += "|" + strings.Join(domains, "|")
-	if g.Primary {
-		key += "|P"
-	}
-	if g.SearchDomainsEnabled {
-		key += "|S"
-	}
-	return key
-}
-
-func cmpSimpleRecord(a, b *proto.SimpleRecord) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(a.Name, b.Name); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Type, b.Type); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Class, b.Class); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.RData, b.RData); c != 0 {
-		return c
-	}
-	return cmp.Compare(a.TTL, b.TTL)
-}
-
-func cmpRemotePeer(a, b *proto.RemotePeerConfig) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	return cmp.Compare(a.WgPubKey, b.WgPubKey)
-}
-
-func cmpRoute(a, b *proto.Route) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(a.ID, b.ID); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.NetID, b.NetID); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Network, b.Network); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Peer, b.Peer); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Metric, b.Metric); c != 0 {
-		return c
-	}
-	return slices.Compare(a.Domains, b.Domains)
-}
-
-func cmpFirewallRule(a, b *proto.FirewallRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.PeerIP, b.PeerIP); c != 0 { //nolint:staticcheck
-		return c
-	}
-	if c := cmp.Compare(int32(a.Direction), int32(b.Direction)); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Port, b.Port); c != 0 {
-		return c
-	}
-	return cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo))
-}
-
-func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := bytes.Compare(a.PolicyID, b.PolicyID); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.RouteID, b.RouteID); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.Destination, b.Destination); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(portInfoKey(a.PortInfo), portInfoKey(b.PortInfo)); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(int32(a.Action), int32(b.Action)); c != 0 {
-		return c
-	}
-	if c := slices.Compare(a.Domains, b.Domains); c != 0 {
-		return c
-	}
-	if c := slices.Compare(a.SourceRanges, b.SourceRanges); c != 0 {
-		return c
-	}
-	if c := cmp.Compare(a.CustomProtocol, b.CustomProtocol); c != 0 {
-		return c
-	}
-	return boolCmp(a.IsDynamic, b.IsDynamic)
-}
-
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
-func portInfoKey(pi *proto.PortInfo) string {
-	if pi == nil {
-		return ""
-	}
-	switch sel := pi.PortSelection.(type) {
-	case *proto.PortInfo_Port:
-		return "P" + strconv.FormatUint(uint64(sel.Port), 10)
-	case *proto.PortInfo_Range_:
-		if sel.Range == nil {
-			return "R"
-		}
-		return "R" + strconv.FormatUint(uint64(sel.Range.Start), 10) + "-" + strconv.FormatUint(uint64(sel.Range.End), 10)
-	}
-	return ""
-}

management/internals/controllers/network_map/nmaptest/fixture.go

@@ -1,218 +0,0 @@
-package nmaptest
-
-import (
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-)
-
-// LoadNetworkMapData reads a fixture holding the NetworkMapData the store
-// would return for one account. Unknown fields are rejected so fixture typos
-// fail loudly instead of silently testing a default.
-func LoadNetworkMapData(path string) (*networkmap.NetworkMapData, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("open fixture: %w", err)
-	}
-	defer f.Close()
-
-	dec := json.NewDecoder(f)
-	dec.DisallowUnknownFields()
-	var nmData networkmap.NetworkMapData
-	if err := dec.Decode(&nmData); err != nil {
-		return nil, fmt.Errorf("decode fixture %s: %w", path, err)
-	}
-	return &nmData, nil
-}
-
-var defaultNetworkNet = func() net.IPNet {
-	_, ipnet, err := net.ParseCIDR("100.64.0.0/10")
-	if err != nil {
-		panic(err)
-	}
-	return *ipnet
-}()
-
-// applyFixtureDefaults fills the boilerplate a fixture may omit. Map-keyed
-// objects inherit their key as ID, peers get a deterministic WG-shaped key
-// and their ID as DNS label, PublicIDs default to the internal ID (the
-// envelope encoder puts public IDs on the wire and silently degrades on
-// empty ones), and a nil ValidatedPeers validates every peer — production
-// fills it through the integrated validator, not the store.
-func applyFixtureDefaults(nmData *networkmap.NetworkMapData) {
-	if nmData.Network == nil {
-		nmData.Network = &nmdata.Network{}
-	}
-	if nmData.Network.Identifier == "" {
-		nmData.Network.Identifier = "network"
-	}
-	if nmData.Network.Net.IP == nil {
-		nmData.Network.Net = defaultNetworkNet
-	}
-	if nmData.AccountSettings == nil {
-		nmData.AccountSettings = &nmdata.AccountSettingsInfo{}
-	}
-	if nmData.DNSSettings == nil {
-		nmData.DNSSettings = &nmdata.DNSSettings{}
-	}
-
-	for id, p := range nmData.Peers {
-		if p == nil {
-			continue
-		}
-		if p.ID == "" {
-			p.ID = id
-		}
-		if p.Key == "" {
-			p.Key = derivedWgKey(p.ID)
-		}
-		if p.DNSLabel == "" {
-			p.DNSLabel = p.ID
-		}
-	}
-
-	for id, g := range nmData.Groups {
-		if g == nil {
-			continue
-		}
-		if g.ID == "" {
-			g.ID = id
-		}
-		if g.Name == "" {
-			g.Name = g.ID
-		}
-		if g.PublicID == "" {
-			g.PublicID = g.ID
-		}
-	}
-
-	for _, policy := range nmData.Policies {
-		defaultPolicyIDs(policy)
-	}
-	resolveResourcePolicyRefs(nmData)
-
-	for _, r := range nmData.Routes {
-		if r != nil && r.PublicID == "" {
-			r.PublicID = r.ID
-		}
-	}
-	for _, nsg := range nmData.NameServerGroups {
-		if nsg != nil && nsg.PublicID == "" {
-			nsg.PublicID = nsg.ID
-		}
-	}
-	for _, res := range nmData.NetworkResources {
-		if res == nil {
-			continue
-		}
-		if res.PublicID == "" {
-			res.PublicID = res.ID
-		}
-		defaultXIDMapping(&nmData.NetworkXIDToPublicID, res.NetworkID)
-	}
-	for networkID, routers := range nmData.Routers {
-		defaultXIDMapping(&nmData.NetworkXIDToPublicID, networkID)
-		for _, router := range routers {
-			if router != nil && router.PublicID == "" {
-				router.PublicID = networkID
-			}
-		}
-	}
-
-	for id, pc := range nmData.PostureChecks {
-		if pc == nil {
-			continue
-		}
-		if pc.ID == "" {
-			pc.ID = id
-		}
-		defaultXIDMapping(&nmData.PostureCheckXIDToPublicID, pc.ID)
-	}
-
-	if nmData.ValidatedPeers == nil {
-		nmData.ValidatedPeers = make(map[string]struct{}, len(nmData.Peers))
-		for id := range nmData.Peers {
-			nmData.ValidatedPeers[id] = struct{}{}
-		}
-	}
-}
-
-// resolveResourcePolicyRefs lets a fixture name an account policy by ID in
-// ResourcePolicies — {"ID": "pol-x"} with no rules — instead of repeating it.
-// The real store puts the same policy pointer in both places, which is what
-// resolving the reference reproduces.
-func resolveResourcePolicyRefs(nmData *networkmap.NetworkMapData) {
-	byID := make(map[string]*nmdata.Policy, len(nmData.Policies))
-	for _, policy := range nmData.Policies {
-		if policy != nil && policy.ID != "" {
-			byID[policy.ID] = policy
-		}
-	}
-
-	for _, policies := range nmData.ResourcePolicies {
-		for i, policy := range policies {
-			if policy == nil {
-				continue
-			}
-			if len(policy.Rules) == 0 {
-				if full, ok := byID[policy.ID]; ok {
-					policies[i] = full
-					continue
-				}
-			}
-			defaultPolicyIDs(policy)
-		}
-	}
-}
-
-func defaultPolicyIDs(policy *nmdata.Policy) {
-	if policy == nil {
-		return
-	}
-	if policy.PublicID == "" {
-		policy.PublicID = policy.ID
-	}
-	for i, rule := range policy.Rules {
-		if rule == nil {
-			continue
-		}
-		if rule.PolicyID == "" {
-			rule.PolicyID = policy.ID
-		}
-		if rule.ID == "" {
-			// Production gives a rule its policy's id (management/server/policy.go:205,
-			// "when policy can contain multiple rules, need refactor"), so a
-			// single-rule policy — the only shape the product can create today —
-			// must be modelled that way or the wire ids come out unrealistic.
-			rule.ID = policy.ID
-			if len(policy.Rules) > 1 {
-				rule.ID = fmt.Sprintf("%s-rule-%d", policy.ID, i)
-			}
-		}
-	}
-}
-
-func defaultXIDMapping(m *map[string]string, id string) {
-	if id == "" {
-		return
-	}
-	if *m == nil {
-		*m = make(map[string]string)
-	}
-	if _, ok := (*m)[id]; !ok {
-		(*m)[id] = id
-	}
-}
-
-// derivedWgKey returns a deterministic base64 key of 32 bytes, valid for the
-// envelope decoder's WG-key identity.
-func derivedWgKey(peerID string) string {
-	sum := sha256.Sum256([]byte(peerID))
-	return base64.StdEncoding.EncodeToString(sum[:])
-}

management/internals/controllers/network_map/nmaptest/golden_test.go

@@ -1,12 +0,0 @@
-package nmaptest_test
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map/nmaptest"
-)
-
-func TestNetworkMapGolden(t *testing.T) {
-	nmaptest.RunGoldenDir(t, filepath.Join("testdata", "cases"))
-}

management/internals/controllers/network_map/nmaptest/runner.go

@@ -1,311 +0,0 @@
-// Package nmaptest measures network map generation on the dedicated store
-// path against committed expectations. A case stands in for the store load
-// with a NetworkMapData fixture — the value NetworkMapDBStoreImpl returns for
-// one account — then runs the production per-peer pipeline the controller
-// uses, PeersCustomZone → GetPeerNetworkMapComponents → proto conversion, in
-// both wire shapes: the legacy full map (grpc.ToSyncResponse) and the
-// component envelope expanded client-side (grpc.ToComponentSyncResponse →
-// networkmap.EnvelopeToNetworkMap).
-//
-// The expectation files are the point of the framework. They state what the
-// output should be, so a failing case means the code disagrees with the
-// expectation and the answer is normally to fix the code; an expectation
-// changes only through a deliberate reviewed edit. Nothing in this package
-// writes to testdata — there is no flag that records current behaviour into an
-// expectation, because that is how a defect becomes the baseline. Cases whose
-// expectation encodes correct behaviour the code does not yet deliver stay red
-// on purpose.
-//
-// A case lives in testdata/cases/<name>/ as case.json (manifest: description,
-// peers, optional accountID, dnsDomain, modes), nmdata.json (the fixture the
-// mocked store returns, using Go field names; zero values may be omitted and
-// applyFixtureDefaults fills the boilerplate) and golden/<peerID>.json.
-//
-// There is ONE expectation per peer, shared by every mode. The modes are not
-// different computations: CalculateNetworkMapFromComponents is
-// components.Calculate, and both sides assemble the proto with the same
-// encode helpers, so the only variable is what the envelope round-trip did to
-// the components in transit. Any difference between modes is therefore a
-// round-trip fidelity defect, and a shared expectation is what exposes it.
-// Results are canonicalized before comparison, since repeated proto fields
-// come from map iteration.
-package nmaptest
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/exp/maps"
-	"google.golang.org/protobuf/encoding/protojson"
-	"google.golang.org/protobuf/testing/protocmp"
-
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
-	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// Mode selects the wire shape a case is verified through. Both end in a
-// *proto.NetworkMap, the one comparison surface shared by every path.
-type Mode string
-
-const (
-	// ModeFull is the legacy wire shape: the server runs Calculate and sends
-	// the expanded map (grpc.ToSyncResponse).
-	ModeFull Mode = "full"
-	// ModeEnvelope is the component wire shape: the server encodes components
-	// into a NetworkMapEnvelope (grpc.ToComponentSyncResponse) and the map is
-	// expanded the way the client engine does (networkmap.EnvelopeToNetworkMap).
-	ModeEnvelope Mode = "envelope"
-
-	defaultAccountID = "account"
-	defaultDNSDomain = "netbird.test"
-)
-
-var defaultModes = []Mode{ModeFull, ModeEnvelope}
-
-// Case is one nmap-generation scenario: store data for a single account, the
-// peers whose network maps are computed, and the directory holding one expected
-// *proto.NetworkMap per peer — shared by every mode.
-type Case struct {
-	Name      string
-	AccountID string
-	DNSDomain string
-	Peers     []string
-	Modes     []Mode
-	Data      *networkmap.NetworkMapData
-	GoldenDir string
-}
-
-type manifest struct {
-	Description string
-	AccountID   string
-	DNSDomain   string
-	Peers       []string
-	Modes       []Mode
-}
-
-// RunGoldenDir discovers and runs every fixture case under dir. A case is a
-// directory containing case.json (manifest), nmdata.json (store fixture) and
-// golden/<peerID>.json (expected proto.NetworkMap, protojson).
-func RunGoldenDir(t *testing.T, dir string) {
-	t.Helper()
-
-	entries, err := os.ReadDir(dir)
-	require.NoError(t, err, "read cases dir")
-
-	ran := 0
-	for _, entry := range entries {
-		if !entry.IsDir() || strings.HasPrefix(entry.Name(), ".") {
-			continue
-		}
-		caseDir := filepath.Join(dir, entry.Name())
-		c, err := loadCase(caseDir)
-		require.NoError(t, err, "load case %s", entry.Name())
-		ran++
-		t.Run(entry.Name(), func(t *testing.T) {
-			RunCase(t, c)
-		})
-	}
-	require.NotZero(t, ran, "no cases found under %s", dir)
-}
-
-func loadCase(caseDir string) (Case, error) {
-	raw, err := os.ReadFile(filepath.Join(caseDir, "case.json"))
-	if err != nil {
-		return Case{}, fmt.Errorf("read manifest: %w", err)
-	}
-	dec := json.NewDecoder(bytes.NewReader(raw))
-	dec.DisallowUnknownFields()
-	var m manifest
-	if err := dec.Decode(&m); err != nil {
-		return Case{}, fmt.Errorf("decode manifest: %w", err)
-	}
-
-	data, err := LoadNetworkMapData(filepath.Join(caseDir, "nmdata.json"))
-	if err != nil {
-		return Case{}, err
-	}
-
-	return Case{
-		Name:      filepath.Base(caseDir),
-		AccountID: m.AccountID,
-		DNSDomain: m.DNSDomain,
-		Peers:     m.Peers,
-		Modes:     m.Modes,
-		Data:      data,
-		GoldenDir: filepath.Join(caseDir, "golden"),
-	}, nil
-}
-
-// RunCase computes each target peer's network map through every enabled mode
-// and compares the canonicalized result against the peer's expectation file.
-// It mirrors the controller's store path: fill fixture defaults, precompute
-// posture validation once, then run the per-peer pipeline.
-func RunCase(t *testing.T, c Case) {
-	t.Helper()
-
-	require.NotNil(t, c.Data, "case %s: Data is required", c.Name)
-	require.NotEmpty(t, c.Peers, "case %s: Peers is required", c.Name)
-	require.NotEmpty(t, c.GoldenDir, "case %s: GoldenDir is required", c.Name)
-	if c.AccountID == "" {
-		c.AccountID = defaultAccountID
-	}
-	if c.DNSDomain == "" {
-		c.DNSDomain = defaultDNSDomain
-	}
-	if len(c.Modes) == 0 {
-		c.Modes = defaultModes
-	}
-
-	ctx := context.Background()
-	nmData := c.Data
-	applyFixtureDefaults(nmData)
-	nmData.PrecomputePostureValidation()
-
-	dnsDomain := c.DNSDomain
-	if nmData.AccountSettings.DNSDomain != "" {
-		dnsDomain = nmData.AccountSettings.DNSDomain
-	}
-
-	zone := networkmap.PeersCustomZone(ctx, c.AccountID, dnsDomain, nmData.Peers, controller.IPv6AllowedPeersFromData(nmData))
-	dnsFwdPort := controller.ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
-
-	for _, mode := range c.Modes {
-		if mode == ModeEnvelope {
-			requireEnvelopeSafeKeys(t, nmData, c.Name)
-			break
-		}
-	}
-
-	for _, peerID := range c.Peers {
-		peer := nmData.Peers[peerID]
-		require.NotNil(t, peer, "case %s: target peer %q not in fixture", c.Name, peerID)
-
-		for _, mode := range c.Modes {
-			t.Run(peerID+"/"+string(mode), func(t *testing.T) {
-				got := computeMode(t, ctx, mode, nmData, peerID, zone, dnsDomain, dnsFwdPort)
-				canonicalize(got)
-				compareGolden(t, filepath.Join(c.GoldenDir, peerID+".json"), got, mode)
-			})
-		}
-	}
-}
-
-// computeMode produces the peer's proto.NetworkMap the way the controller does
-// for that wire shape.
-func computeMode(t *testing.T, ctx context.Context, mode Mode, nmData *networkmap.NetworkMapData,
-	peerID string, zone nmdata.CustomZone, dnsDomain string, dnsFwdPort int64) *proto.NetworkMap {
-	t.Helper()
-
-	peer := nmData.Peers[peerID]
-	require.NotNil(t, peer, "target peer %q not in fixture", peerID)
-
-	switch mode {
-	case ModeFull:
-		nmap := controller.NetworkMapFromData(ctx, nmData, peerID, zone)
-		return mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, peer, nil, nil, nmap, dnsDomain, nil,
-			&cache.DNSConfigCache{}, nmData.AccountSettings, nil, nil, dnsFwdPort).NetworkMap
-	case ModeEnvelope:
-		components := nmData.GetPeerNetworkMapComponents(peerID, zone)
-		peerGroups := maps.Keys(nmData.GetPeerGroups(peerID))
-		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components, nil,
-			dnsDomain, nil, nmData.AccountSettings, nil, peerGroups, dnsFwdPort)
-		res, err := networkmap.EnvelopeToNetworkMap(ctx, resp.NetworkMapEnvelope, peer.Key, dnsDomain)
-		require.NoError(t, err, "expand envelope")
-		return res.NetworkMap
-	default:
-		t.Fatalf("unknown mode %q", mode)
-		return nil
-	}
-}
-
-// requireEnvelopeSafeKeys fails fast on peer keys the envelope decoder would
-// silently drop: it re-keys peers by base64 of the raw 32-byte WG public key.
-func requireEnvelopeSafeKeys(t *testing.T, nmData *networkmap.NetworkMapData, caseName string) {
-	t.Helper()
-	for id, p := range nmData.Peers {
-		if p == nil {
-			continue
-		}
-		raw, err := base64.StdEncoding.DecodeString(p.Key)
-		if err != nil || len(raw) != 32 {
-			t.Fatalf("case %s: peer %q Key must be base64 of 32 bytes for mode %q (the envelope decoder drops it otherwise); use a real WireGuard public key or restrict the case to mode %q",
-				caseName, id, ModeEnvelope, ModeFull)
-		}
-	}
-}
-
-// compareGolden measures got against the committed expectation file. One
-// expectation serves every mode, because the modes run the same computation and
-// must therefore agree. The expectation is the authority: a mismatch means the
-// code does not produce what this case says it should, so it is reported as a
-// failure and not quietly absorbed.
-//
-// The full mode is compared verbatim, identifiers included, so the expectation
-// pins real ids and stays readable. Other modes have identifiers erased on both
-// sides first, because the envelope currently rewrites them — a tracked defect
-// that TestIDSpaceMatches asserts against on its own, so it does not have to
-// drown out every other case here.
-// Nothing here writes to testdata. Expectation files are authored by hand and
-// only ever change through a reviewed edit, so there is no mode in which a run
-// can create or replace one. When a file is missing the computed map is printed
-// for the author to read and, if it is genuinely correct, save deliberately.
-func compareGolden(t *testing.T, path string, got *proto.NetworkMap, mode Mode) {
-	t.Helper()
-
-	if mode != ModeFull {
-		normalizeIDSpace(got)
-		canonicalize(got)
-	}
-
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		rendered, mErr := renderNetworkMap(got)
-		require.NoError(t, mErr)
-		t.Fatalf("no expectation file %s: %v\nThis case has nothing to measure against — write the "+
-			"proto.NetworkMap this peer should receive. Mode %s currently produces:\n%s\nRead it before "+
-			"saving any of it: if the code is wrong, so is this.", path, err, mode, rendered)
-	}
-	want := &proto.NetworkMap{}
-	require.NoError(t, protojson.Unmarshal(raw, want), "parse expectation %s", path)
-	canonicalize(want)
-	if mode != ModeFull {
-		normalizeIDSpace(want)
-		canonicalize(want)
-	}
-
-	if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
-		t.Errorf("mode %s does not produce what %s expects (-want +got):\n%s\n"+
-			"Both modes run the same computation on the same components, so they must produce the same map. "+
-			"The expectation file is the committed statement of correct output — fix the code, or change the "+
-			"expectation deliberately if the intended behaviour really moved.", mode, path, diff)
-	}
-}
-
-// renderNetworkMap renders stable protojson: protojson output whitespace is
-// deliberately unstable, so it is reformatted through json.Indent.
-func renderNetworkMap(nm *proto.NetworkMap) ([]byte, error) {
-	raw, err := protojson.Marshal(nm)
-	if err != nil {
-		return nil, err
-	}
-	var buf bytes.Buffer
-	if err := json.Indent(&buf, raw, "", "  "); err != nil {
-		return nil, err
-	}
-	buf.WriteByte('\n')
-	return buf.Bytes(), nil
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/case.json

@@ -1,7 +0,0 @@
-{
-  "description": "Two groups joined by one allow-all policy; peer-c has SSH enabled so the legacy-SSH path fills SshAuth from AllowedUserIDs.",
-  "peers": [
-    "peer-a",
-    "peer-c"
-  ]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-a.json

@@ -1,65 +0,0 @@
-{
-  "Serial": "5",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "4deEImv8zGvsyBmmfC2G0eQkbyMzyGuz/YK7pcYETwM=",
-      "allowedIps": [
-        "100.64.0.3/32"
-      ],
-      "sshConfig": {
-        "sshPubKey": "c3NoLXBlZXItYw=="
-      },
-      "fqdn": "peer-c.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-c.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.3"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.3",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    },
-    {
-      "PeerIP": "100.64.0.3",
-      "Direction": "OUT",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/golden/peer-c.json

@@ -1,102 +0,0 @@
-{
-  "Serial": "5",
-  "peerConfig": {
-    "address": "100.64.0.3/10",
-    "sshConfig": {
-      "sshEnabled": true
-    },
-    "fqdn": "peer-c.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
-      "allowedIps": [
-        "100.64.0.2/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-b.netbird.test",
-      "agentVersion": "0.60.0"
-    },
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-b.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.2"
-          },
-          {
-            "Name": "peer-c.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.3"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.1",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    },
-    {
-      "PeerIP": "100.64.0.1",
-      "Direction": "OUT",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    },
-    {
-      "PeerIP": "100.64.0.2",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    },
-    {
-      "PeerIP": "100.64.0.2",
-      "Direction": "OUT",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLWFsbA=="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub",
-    "AuthorizedUsers": [
-      "u9dHvAXZJKiXITuwP9jD/A=="
-    ],
-    "machineUsers": {
-      "*": {
-        "indexes": [
-          0
-        ]
-      }
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/basic-policy/nmdata.json

@@ -1,31 +0,0 @@
-{
-  "Network": {"Serial": 5},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-c": {"IP": "100.64.0.3", "SSHEnabled": true, "SSHKey": "ssh-peer-c", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
-    "grp-ops": {"Peers": ["peer-c"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-all",
-      "PublicID": "pol-all-pub",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "all",
-          "Bidirectional": true,
-          "Sources": ["grp-dev"],
-          "Destinations": ["grp-ops"]
-        }
-      ]
-    }
-  ],
-  "AllowedUserIDs": {"user-ops": {}}
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/case.json

@@ -1,7 +0,0 @@
-{
-  "description": "Nameserver group and applied custom zone distributed to grp-dev; peer-a (with an extra DNS label) receives them, peer-c outside the group receives neither.",
-  "peers": [
-    "peer-a",
-    "peer-c"
-  ]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-a.json

@@ -1,93 +0,0 @@
-{
-  "Serial": "8",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
-      "allowedIps": [
-        "100.64.0.2/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-b.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "NameServerGroups": [
-      {
-        "NameServers": [
-          {
-            "IP": "8.8.8.8",
-            "Port": "53"
-          }
-        ],
-        "Primary": true
-      }
-    ],
-    "CustomZones": [
-      {
-        "Domain": "corp.internal.",
-        "Records": [
-          {
-            "Name": "db.corp.internal.",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "10.10.0.5"
-          }
-        ]
-      },
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-b.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.2"
-          },
-          {
-            "Name": "www.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.2",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLW1lc2g="
-    },
-    {
-      "PeerIP": "100.64.0.2",
-      "Direction": "OUT",
-      "Protocol": "ALL",
-      "PolicyID": "cG9sLW1lc2g="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/golden/peer-c.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "8",
-  "peerConfig": {
-    "address": "100.64.0.3/10",
-    "sshConfig": {},
-    "fqdn": "peer-c.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-c.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.3"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/dns-config/nmdata.json

@@ -1,51 +0,0 @@
-{
-  "Network": {"Serial": 8},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "ExtraDNSLabels": ["www"], "Meta": {"WtVersion": "0.60.0"}},
-    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a", "peer-b"]},
-    "grp-ops": {"Peers": ["peer-c"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-mesh",
-      "PublicID": "pol-mesh-pub",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "all",
-          "Bidirectional": true,
-          "Sources": ["grp-dev"],
-          "Destinations": ["grp-dev"]
-        }
-      ]
-    }
-  ],
-  "NameServerGroups": [
-    {
-      "ID": "nsg-1",
-      "Name": "dns-primary",
-      "NameServers": [{"IP": "8.8.8.8", "Port": 53}],
-      "Groups": ["grp-dev"],
-      "Primary": true,
-      "Enabled": true
-    }
-  ],
-  "AppliedZoneCandidates": [
-    {
-      "DistributionGroups": ["grp-dev"],
-      "Zone": {
-        "Domain": "corp.internal.",
-        "Records": [
-          {"Name": "db.corp.internal.", "Type": 1, "Class": "IN", "TTL": 300, "RData": "10.10.0.5"}
-        ]
-      }
-    }
-  ]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "Domain network resource: the route carries the domain list and the 192.0.2.0/32 placeholder network with NetworkType 3 (dynamic), and peer-r's route firewall rules must be marked dynamic and repeat the domain. Two ports on the policy must produce one rule per port. A domain resource contributes no DNS custom zone of its own — resolution happens through the routing peer's forwarder.",
-  "peers": ["peer-a", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-a.json

@@ -1,59 +0,0 @@
-{
-  "Serial": "22",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "allowedIps": [
-        "100.64.0.9/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-domain:peer-r",
-      "Network": "192.0.2.0/32",
-      "NetworkType": "3",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "app-domain",
-      "Domains": [
-        "app.internal"
-      ],
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/golden/peer-r.json

@@ -1,92 +0,0 @@
-{
-  "Serial": "22",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-domain:peer-r",
-      "Network": "192.0.2.0/32",
-      "NetworkType": "3",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "app-domain",
-      "Domains": [
-        "app.internal"
-      ],
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRules": [
-    {
-      "sourceRanges": [
-        "100.64.0.1/32"
-      ],
-      "destination": "192.0.2.0/32",
-      "protocol": "TCP",
-      "portInfo": {
-        "port": 443
-      },
-      "isDynamic": true,
-      "domains": [
-        "app.internal"
-      ],
-      "PolicyID": "cG9sLWFwcA==",
-      "RouteID": "res-domain:peer-r"
-    },
-    {
-      "sourceRanges": [
-        "100.64.0.1/32"
-      ],
-      "destination": "192.0.2.0/32",
-      "protocol": "TCP",
-      "portInfo": {
-        "port": 80
-      },
-      "isDynamic": true,
-      "domains": [
-        "app.internal"
-      ],
-      "PolicyID": "cG9sLWFwcA==",
-      "RouteID": "res-domain:peer-r"
-    }
-  ],
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-domain-resource/nmdata.json

@@ -1,43 +0,0 @@
-{
-  "Network": {"Serial": 22},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-app",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["80", "443"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-domain", "Type": "domain"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-domain": [{"ID": "pol-app"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-domain",
-      "NetworkID": "net-1",
-      "Name": "app-domain",
-      "Type": "domain",
-      "Domain": "app.internal",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "Host network resource (single /32) behind one directly-assigned router. peer-a is in the resource policy's source group and must receive one route to 10.10.0.7/32 via peer-r with KeepRoute set and NetID taken from the resource name; peer-r as the router must receive the same route plus a route firewall rule whose SourceRanges are the policy's source peers. A client never gets route firewall rules.",
-  "peers": ["peer-a", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-a.json

@@ -1,56 +0,0 @@
-{
-  "Serial": "20",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "allowedIps": [
-        "100.64.0.9/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-host:peer-r",
-      "Network": "10.10.0.7/32",
-      "NetworkType": "1",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "web-host",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/golden/peer-r.json

@@ -1,69 +0,0 @@
-{
-  "Serial": "20",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-host:peer-r",
-      "Network": "10.10.0.7/32",
-      "NetworkType": "1",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "web-host",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRules": [
-    {
-      "sourceRanges": [
-        "100.64.0.1/32"
-      ],
-      "destination": "10.10.0.7/32",
-      "protocol": "TCP",
-      "portInfo": {
-        "port": 443
-      },
-      "PolicyID": "cG9sLXdlYg==",
-      "RouteID": "res-host:peer-r"
-    }
-  ],
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-host-resource/nmdata.json

@@ -1,43 +0,0 @@
-{
-  "Network": {"Serial": 20},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-web",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["443"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-host", "Type": "host"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-host": [{"ID": "pol-web"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-host",
-      "NetworkID": "net-1",
-      "Name": "web-host",
-      "Type": "host",
-      "Prefix": "10.10.0.7/32",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "A disabled resource with a valid policy and router must leave no trace: no routes and no route firewall rules for either the client or the router. Disabling a resource is the switch that revokes access without deleting the policy.",
-  "peers": ["peer-a", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-a.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "25",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/golden/peer-r.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "25",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-disabled/nmdata.json

@@ -1,42 +0,0 @@
-{
-  "Network": {"Serial": 25},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-off-resource",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["443"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-disabled", "Type": "subnet"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-disabled": [{"ID": "pol-off-resource"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-disabled",
-      "NetworkID": "net-1",
-      "Name": "disabled-subnet",
-      "Type": "subnet",
-      "Prefix": "10.50.0.0/24"
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "An enabled resource with a healthy router but no policy granting access to it must produce nothing anywhere: no route for the client and none for the router either, since access to a resource is only ever created by a policy. The router also gets no route firewall rules despite being a routing peer for the network.",
-  "peers": ["peer-a", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-a.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "24",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/golden/peer-r.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "24",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-no-policy/nmdata.json

@@ -1,26 +0,0 @@
-{
-  "Network": {"Serial": 24},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "NetworkResources": [
-    {
-      "ID": "res-orphan",
-      "NetworkID": "net-1",
-      "Name": "orphan-subnet",
-      "Type": "subnet",
-      "Prefix": "10.40.0.0/24",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "A DISABLED policy granting access to a network resource must grant nothing: no route to 10.90.0.0/24 for peer-a and none for the router either, exactly as if the policy were absent. THE FULL EXPECTATION CURRENTLY FAILS, and should: resource-policy selection never checks policy.Enabled (networkmapcompute.go and networkmap_components.go both test only nil/len(Rules)/Rules[0]), so the legacy path still hands out the route — access survives disabling the policy. The envelope path happens to be correct because the encoder drops disabled policies from the wire. Fix the compute path, do not weaken this expectation.",
-  "peers": ["peer-a", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-a.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "39",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/golden/peer-r.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "39",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-resource-policy-disabled/nmdata.json

@@ -1,42 +0,0 @@
-{
-  "Network": {"Serial": 39},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-revoked",
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["5432"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-db": [{"ID": "pol-revoked"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-db",
-      "NetworkID": "net-1",
-      "Name": "db-subnet",
-      "Type": "subnet",
-      "Prefix": "10.90.0.0/24",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "The routing peer for the resource is not in ValidatedPeers — an unapproved peer, which the integrated validator withholds. peer-a must therefore receive no route through it and must not see it as a peer at all: traffic may not be routed through a peer the account has not approved. THE ENVELOPE EXPECTATION CURRENTLY FAILS, and should: component selection puts every routing peer into RouterPeers without checking validation, the encoder indexes them into the envelope's peer table, and the client decoder puts every peer it finds back into its peer map, so the unapproved router reappears client-side with a working route. The full path drops it correctly. Fix the component/encoder path, do not weaken this expectation.",
-  "peers": ["peer-a"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/golden/peer-a.json

@@ -1,34 +0,0 @@
-{
-  "Serial": "40",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-router-unvalidated/nmdata.json

@@ -1,44 +0,0 @@
-{
-  "Network": {"Serial": 40},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "ValidatedPeers": {"peer-a": {}},
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-db",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["5432"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-db", "Type": "subnet"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-db": [{"ID": "pol-db"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-db",
-      "NetworkID": "net-1",
-      "Name": "db-subnet",
-      "Type": "subnet",
-      "Prefix": "10.100.0.0/24",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "Routing peer group: one router record assigned to a peer group, which the store expands into one entry per member peer sharing the router's settings. peer-a must receive one route per routing peer — same NetID and destination, different route ID and peer — which is what gives the client an HA pair to choose between. Each router must receive only its own route, never its sibling's, plus its own route firewall rule.",
-  "peers": ["peer-a", "peer-r1", "peer-r2"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-a.json

@@ -1,75 +0,0 @@
-{
-  "Serial": "23",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
-      "allowedIps": [
-        "100.64.0.11/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r1.netbird.test",
-      "agentVersion": "0.60.0"
-    },
-    {
-      "wgPubKey": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
-      "allowedIps": [
-        "100.64.0.12/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r2.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-ha:peer-r1",
-      "Network": "10.30.0.0/24",
-      "NetworkType": "1",
-      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "ha-subnet",
-      "keepRoute": true
-    },
-    {
-      "ID": "res-ha:peer-r2",
-      "Network": "10.30.0.0/24",
-      "NetworkType": "1",
-      "Peer": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "ha-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r1.json

@@ -1,69 +0,0 @@
-{
-  "Serial": "23",
-  "peerConfig": {
-    "address": "100.64.0.11/10",
-    "sshConfig": {},
-    "fqdn": "peer-r1.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-ha:peer-r1",
-      "Network": "10.30.0.0/24",
-      "NetworkType": "1",
-      "Peer": "Iu6Lj1HqDXfgDh5RppHCRI6RO3lMlZBCndRNrdS7QUI=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "ha-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r1.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.11"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRules": [
-    {
-      "sourceRanges": [
-        "100.64.0.1/32"
-      ],
-      "destination": "10.30.0.0/24",
-      "protocol": "TCP",
-      "portInfo": {
-        "port": 5432
-      },
-      "PolicyID": "cG9sLWhh",
-      "RouteID": "res-ha:peer-r1"
-    }
-  ],
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/golden/peer-r2.json

@@ -1,69 +0,0 @@
-{
-  "Serial": "23",
-  "peerConfig": {
-    "address": "100.64.0.12/10",
-    "sshConfig": {},
-    "fqdn": "peer-r2.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-ha:peer-r2",
-      "Network": "10.30.0.0/24",
-      "NetworkType": "1",
-      "Peer": "YC6sbWtvpB2d6W/XqsNIV9crsrXBoVDdwmhCoszjCps=",
-      "Metric": "9999",
-      "Masquerade": true,
-      "NetID": "ha-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r2.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.12"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRules": [
-    {
-      "sourceRanges": [
-        "100.64.0.1/32"
-      ],
-      "destination": "10.30.0.0/24",
-      "protocol": "TCP",
-      "portInfo": {
-        "port": 5432
-      },
-      "PolicyID": "cG9sLWhh",
-      "RouteID": "res-ha:peer-r2"
-    }
-  ],
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-routing-peer-group-ha/nmdata.json

@@ -1,46 +0,0 @@
-{
-  "Network": {"Serial": 23},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r1": {"IP": "100.64.0.11", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r2": {"IP": "100.64.0.12", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a"]},
-    "grp-routers": {"Peers": ["peer-r1", "peer-r2"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-ha",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["5432"],
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-ha", "Type": "subnet"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-ha": [{"ID": "pol-ha"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-ha",
-      "NetworkID": "net-ha",
-      "Name": "ha-subnet",
-      "Type": "subnet",
-      "Prefix": "10.30.0.0/24",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-ha": {
-      "peer-r1": {"PublicID": "router-ha", "PeerGroups": ["grp-routers"], "Masquerade": true, "Metric": 9999, "Enabled": true},
-      "peer-r2": {"PublicID": "router-ha", "PeerGroups": ["grp-routers"], "Masquerade": true, "Metric": 9999, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "Subnet network resource behind one directly-assigned router, with masquerade off and a non-default metric so both reach the wire verbatim, and an all-protocol policy from a two-peer source group. peer-r's route firewall rule must list both source peers; peer-b confirms a second client in the same group gets its own identical route.",
-  "peers": ["peer-a", "peer-b", "peer-r"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-a.json

@@ -1,55 +0,0 @@
-{
-  "Serial": "21",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "allowedIps": [
-        "100.64.0.9/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-subnet:peer-r",
-      "Network": "10.20.0.0/24",
-      "NetworkType": "1",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "500",
-      "NetID": "office-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-b.json

@@ -1,55 +0,0 @@
-{
-  "Serial": "21",
-  "peerConfig": {
-    "address": "100.64.0.2/10",
-    "sshConfig": {},
-    "fqdn": "peer-b.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "allowedIps": [
-        "100.64.0.9/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-r.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-subnet:peer-r",
-      "Network": "10.20.0.0/24",
-      "NetworkType": "1",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "500",
-      "NetID": "office-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-b.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.2"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/golden/peer-r.json

@@ -1,76 +0,0 @@
-{
-  "Serial": "21",
-  "peerConfig": {
-    "address": "100.64.0.9/10",
-    "sshConfig": {},
-    "fqdn": "peer-r.netbird.test",
-    "RoutingPeerDnsResolutionEnabled": true,
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
-      "allowedIps": [
-        "100.64.0.2/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-b.netbird.test",
-      "agentVersion": "0.60.0"
-    },
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "Routes": [
-    {
-      "ID": "res-subnet:peer-r",
-      "Network": "10.20.0.0/24",
-      "NetworkType": "1",
-      "Peer": "ImPDKs2PJxHA24/N7umWi8lfEf2B0B5W/7dYZUzNS3s=",
-      "Metric": "500",
-      "NetID": "office-subnet",
-      "keepRoute": true
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-r.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.9"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRules": [
-    {
-      "sourceRanges": [
-        "100.64.0.1/32",
-        "100.64.0.2/32"
-      ],
-      "destination": "10.20.0.0/24",
-      "protocol": "ALL",
-      "portInfo": {},
-      "PolicyID": "cG9sLXN1Ym5ldA==",
-      "RouteID": "res-subnet:peer-r"
-    }
-  ],
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/net-subnet-resource/nmdata.json

@@ -1,43 +0,0 @@
-{
-  "Network": {"Serial": 21},
-  "AccountSettings": {"RoutingPeerDNSResolutionEnabled": true},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-r": {"IP": "100.64.0.9", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Groups": {
-    "grp-dev": {"Peers": ["peer-a", "peer-b"]}
-  },
-  "Policies": [
-    {
-      "ID": "pol-subnet",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "all",
-          "Sources": ["grp-dev"],
-          "DestinationResource": {"ID": "res-subnet", "Type": "subnet"}
-        }
-      ]
-    }
-  ],
-  "ResourcePolicies": {"res-subnet": [{"ID": "pol-subnet"}]},
-  "NetworkResources": [
-    {
-      "ID": "res-subnet",
-      "NetworkID": "net-1",
-      "Name": "office-subnet",
-      "Type": "subnet",
-      "Prefix": "10.20.0.0/24",
-      "Enabled": true
-    }
-  ],
-  "Routers": {
-    "net-1": {
-      "peer-r": {"PublicID": "router-direct", "Metric": 500, "Enabled": true}
-    }
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "Direct peer-to-peer policy via Source/DestinationResource of type peer, no groups involved; peer-a and peer-b see each other, bystander peer-c sees nobody.",
-  "peers": ["peer-a", "peer-b", "peer-c"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-a.json

@@ -1,64 +0,0 @@
-{
-  "Serial": "15",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "AvldyrZ12Pf90jzf3AXmhPwg3UcI+jtJHfbpBlupvko=",
-      "allowedIps": [
-        "100.64.0.2/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-b.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-b.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.2"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.2",
-      "Protocol": "TCP",
-      "Port": "443",
-      "PolicyID": "cG9sLWRpcmVjdA=="
-    },
-    {
-      "PeerIP": "100.64.0.2",
-      "Direction": "OUT",
-      "Protocol": "TCP",
-      "Port": "443",
-      "PolicyID": "cG9sLWRpcmVjdA=="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-b.json

@@ -1,64 +0,0 @@
-{
-  "Serial": "15",
-  "peerConfig": {
-    "address": "100.64.0.2/10",
-    "sshConfig": {},
-    "fqdn": "peer-b.netbird.test",
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "vblMc9U8RAI6cVopcKEMTVT6lVC3D9nTTMSwot5d3L4=",
-      "allowedIps": [
-        "100.64.0.1/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-a.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-b.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.2"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.1",
-      "Protocol": "TCP",
-      "Port": "443",
-      "PolicyID": "cG9sLWRpcmVjdA=="
-    },
-    {
-      "PeerIP": "100.64.0.1",
-      "Direction": "OUT",
-      "Protocol": "TCP",
-      "Port": "443",
-      "PolicyID": "cG9sLWRpcmVjdA=="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/golden/peer-c.json

@@ -1,33 +0,0 @@
-{
-  "Serial": "15",
-  "peerConfig": {
-    "address": "100.64.0.3/10",
-    "sshConfig": {},
-    "fqdn": "peer-c.netbird.test",
-    "autoUpdate": {}
-  },
-  "remotePeersIsEmpty": true,
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-c.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.3"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "firewallRulesIsEmpty": true,
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-peer-to-peer/nmdata.json

@@ -1,26 +0,0 @@
-{
-  "Network": {"Serial": 15},
-  "Peers": {
-    "peer-a": {"IP": "100.64.0.1", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-b": {"IP": "100.64.0.2", "Meta": {"WtVersion": "0.60.0"}},
-    "peer-c": {"IP": "100.64.0.3", "Meta": {"WtVersion": "0.60.0"}}
-  },
-  "Policies": [
-    {
-      "ID": "pol-direct",
-      "PublicID": "pol-direct-pub",
-      "Enabled": true,
-      "Rules": [
-        {
-          "Enabled": true,
-          "Action": "accept",
-          "Protocol": "tcp",
-          "Ports": ["443"],
-          "Bidirectional": true,
-          "SourceResource": {"ID": "peer-a", "Type": "peer"},
-          "DestinationResource": {"ID": "peer-b", "Type": "peer"}
-        }
-      ]
-    }
-  ]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/case.json

@@ -1,4 +0,0 @@
-{
-  "description": "One-way udp/514 plus bidirectional tcp port-range 1000-2000 between the same groups; a disabled policy and a policy whose only rule is disabled must leave no trace.",
-  "peers": ["peer-a", "peer-srv"]
-}

management/internals/controllers/network_map/nmaptest/testdata/cases/policy-ports-and-ranges/golden/peer-a.json

@@ -1,81 +0,0 @@
-{
-  "Serial": "14",
-  "peerConfig": {
-    "address": "100.64.0.1/10",
-    "sshConfig": {},
-    "fqdn": "peer-a.netbird.test",
-    "autoUpdate": {}
-  },
-  "remotePeers": [
-    {
-      "wgPubKey": "jEboa3bOv65XRbq8+8JuagiwWz+mM7Fc5MUfBQbOf6Y=",
-      "allowedIps": [
-        "100.64.0.10/32"
-      ],
-      "sshConfig": {},
-      "fqdn": "peer-srv.netbird.test",
-      "agentVersion": "0.60.0"
-    }
-  ],
-  "DNSConfig": {
-    "ServiceEnable": true,
-    "CustomZones": [
-      {
-        "Domain": "netbird.test.",
-        "Records": [
-          {
-            "Name": "peer-a.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.1"
-          },
-          {
-            "Name": "peer-srv.netbird.test",
-            "Type": "1",
-            "Class": "IN",
-            "TTL": "300",
-            "RData": "100.64.0.10"
-          }
-        ]
-      }
-    ],
-    "ForwarderPort": "22054"
-  },
-  "FirewallRules": [
-    {
-      "PeerIP": "100.64.0.10",
-      "Protocol": "TCP",
-      "PortInfo": {
-        "range": {
-          "start": 1000,
-          "end": 2000
-        }
-      },
-      "PolicyID": "cG9sLXJhbmdl"
-    },
-    {
-      "PeerIP": "100.64.0.10",
-      "Direction": "OUT",
-      "Protocol": "TCP",
-      "PortInfo": {
-        "range": {
-          "start": 1000,
-          "end": 2000
-        }
-      },
-      "PolicyID": "cG9sLXJhbmdl"
-    },
-    {
-      "PeerIP": "100.64.0.10",
-      "Direction": "OUT",
-      "Protocol": "UDP",
-      "Port": "514",
-      "PolicyID": "cG9sLXN5c2xvZw=="
-    }
-  ],
-  "routesFirewallRulesIsEmpty": true,
-  "sshAuth": {
-    "UserIDClaim": "sub"
-  }
-}