Fix signature file being gzipped

.github/ISSUE_TEMPLATE/bug-issue-report.md

@@ -2,7 +2,7 @@
 name: Bug/Issue report
 about: Create a report to help us improve
 title: ''
-labels: ['triage-needed']
+labels: ['triage']
 assignees: ''
 
 ---

.github/workflows/test-infrastructure-files.yml

@@ -162,13 +162,6 @@ jobs:
           test $count -eq 4
         working-directory: infrastructure_files/artifacts
 
-      - name: test geolocation databases
-        working-directory: infrastructure_files/artifacts
-        run: |
-          sleep 30
-          docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City.mmdb
-          docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames.db
-
   test-getting-started-script:
     runs-on: ubuntu-latest
     steps:

.golangci.yaml

@@ -63,14 +63,6 @@ linters-settings:
     enable:
       - nilness
 
-  revive:
-    rules:
-      - name: exported
-        severity: warning
-        disabled: false
-        arguments:
-          - "checkPrivateReceivers"
-          - "sayRepetitiveInsteadOfStutters"
   tenv:
     # The option `all` will run against whole test files (`_test.go`) regardless of method/function signatures.
     # Otherwise, only methods that take `*testing.T`, `*testing.B`, and `testing.TB` as arguments are checked.
@@ -101,7 +93,6 @@ linters:
     - nilerr # finds the code that returns nil even if it checks that the error is not nil
     - nilnil # checks that there is no simultaneous return of nil error and an invalid value
     - predeclared # predeclared finds code that shadows one of Go's predeclared identifiers
-    - revive # Fast, configurable, extensible, flexible, and beautiful linter for Go. Drop-in replacement of golint.
     - sqlclosecheck # checks that sql.Rows and sql.Stmt are closed
     - thelper # thelper detects Go test helpers without t.Helper() call and checks the consistency of test helpers.
     - wastedassign # wastedassign finds wasted assignment statements

README.md

@@ -1,6 +1,6 @@
 <p align="center">
- <strong>:hatching_chick: New Release! Device Posture Checks.</strong>
-  <a href="https://docs.netbird.io/how-to/manage-posture-checks">
+ <strong>:hatching_chick: New Release! Self-hosting in under 5 min.</strong>
+  <a href="https://github.com/netbirdio/netbird#quickstart-with-self-hosted-netbird">
        Learn more
      </a>   
 </p>
@@ -42,22 +42,25 @@
 
 **Secure.** NetBird enables secure remote access by applying granular access policies, while allowing you to manage them intuitively from a single place. Works universally on any infrastructure.
 
-### Open-Source Network Security in a Single Platform
+### Secure peer-to-peer VPN with SSO and MFA in minutes
 
-![download (2)](https://github.com/netbirdio/netbird/assets/700848/16210ac2-7265-44c1-8d4e-8fae85534dac)
+https://user-images.githubusercontent.com/700848/197345890-2e2cded5-7b7a-436f-a444-94e80dd24f46.mov
 
 ### Key features
 
-| Connectivity                                                                                                                 | Management                                                                                               | Security                                                                                                                              | Automation                                                                                                                               | Platforms                                                                               |
-|------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
-| <ul><li> - \[x] Kernel WireGuard </ul></li>                                                                                  | <ul><li> - \[x] [Admin Web UI](https://github.com/netbirdio/dashboard) </ul></li>                        | <ul><li> - \[x] [SSO & MFA support](https://docs.netbird.io/how-to/installation#running-net-bird-with-sso-login) </ul></li>           | <ul><li> - \[x] [Public API](https://docs.netbird.io/api) </ul></li>                                                                     | <ul><li> - \[x] Linux </ul></li>                                                        |
-| <ul><li> - \[x] Peer-to-peer connections </ul></li>                                                                          | <ul><li> - \[x] Auto peer discovery and configuration </ul></li>                                         | <ul><li> - \[x] [Access control - groups & rules](https://docs.netbird.io/how-to/manage-network-access) </ul></li>                    | <ul><li> - \[x] [Setup keys for bulk network provisioning](https://docs.netbird.io/how-to/register-machines-using-setup-keys) </ul></li> | <ul><li> - \[x] Mac </ul></li>                                                          |
-| <ul><li> - \[x] Connection relay fallback </ul></li>                                                                         | <ul><li> - \[x] [IdP integrations](https://docs.netbird.io/selfhosted/identity-providers) </ul></li>     | <ul><li> - \[x] [Activity logging](https://docs.netbird.io/how-to/monitor-system-and-network-activity) </ul></li>                     | <ul><li> - \[x] [Self-hosting quickstart script](https://docs.netbird.io/selfhosted/selfhosted-quickstart) </ul></li>                    | <ul><li> - \[x] Windows </ul></li>                                                      |
-| <ul><li> - \[x] [Routes to external networks](https://docs.netbird.io/how-to/routing-traffic-to-private-networks) </ul></li> | <ul><li> - \[x] [Private DNS](https://docs.netbird.io/how-to/manage-dns-in-your-network) </ul></li>      | <ul><li> - \[x] [Device posture checks](https://docs.netbird.io/how-to/manage-posture-checks) </ul></li>                              | <ul><li> - \[x] IdP groups sync with JWT </ul></li>                                                                                      | <ul><li> - \[x] Android </ul></li>                                                      |
-| <ul><li> - \[x] NAT traversal with BPF </ul></li>                                                                            | <ul><li> - \[x] [Multiuser support](https://docs.netbird.io/how-to/add-users-to-your-network) </ul></li> | <ul><li> -  \[x] Peer-to-peer encryption </ul></li>                                                                                   |                                                                                                                                          | <ul><li> - \[x] iOS </ul></li>                                                          |
-|                                                                                                                              |                                                                                                          | <ul><li> - \[x] [Quantum-resistance with Rosenpass](https://netbird.io/knowledge-hub/the-first-quantum-resistant-mesh-vpn) </ul></li> |                                                                                                                                          | <ul><li> - \[x] OpenWRT </ul></li>                                                      |
-|                                                                                                                              |                                                                                                          | <ui><li> - \[x] [Periodic re-authentication](https://docs.netbird.io/how-to/enforce-periodic-user-authentication)</ul></li>           |                                                                                                                                          | <ul><li> - \[x] [Serverless](https://docs.netbird.io/how-to/netbird-on-faas) </ul></li> |
-|                                                                                                                              |                                                                                                          |                                                                                                                                       |                                                                                                                                          | <ul><li> - \[x] Docker </ul></li>                                                       |
+| Connectivity                             	                                                                                      | Management                                 	                             | Automation                                    	                            | Platforms    	                        |
+|---------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------------|---------------------------------------|
+| <ul><li> - \[x] Kernel WireGuard </ul></li>                   	                                                                 | <ul><li> - \[x] [Admin Web UI](https://github.com/netbirdio/dashboard) </ul></li>                           	      | <ul><li> - \[x] [Public API](https://docs.netbird.io/api) </ul></li>                                	     | <ul><li> - \[x] Linux </ul></li>    	 |
+| <ul><li> - \[x] Peer-to-peer connections </ul></li>             	                                                               | <ul><li> - \[x] Auto peer discovery and configuration </ul></li>  	      | <ul><li> - \[x] [Setup keys for bulk network provisioning](https://docs.netbird.io/how-to/register-machines-using-setup-keys) </ul></li>  	     | <ul><li> - \[x] Mac </ul></li>      	 |
+| <ul><li> - \[x] Peer-to-peer encryption </ul></li>              	                                                               | <ul><li> - \[x] [IdP integrations](https://docs.netbird.io/selfhosted/identity-providers) </ul></li>                       	      | <ul><li> - \[x] [Self-hosting quickstart script](https://docs.netbird.io/selfhosted/selfhosted-quickstart) </ul></li>              	 | <ul><li> - \[x] Windows </ul></li>  	 |
+| <ul><li> - \[x] Connection relay fallback </ul></li>            	                                                               | <ul><li> - \[x] [SSO & MFA support](https://docs.netbird.io/how-to/installation#running-net-bird-with-sso-login) </ul></li>                      	      | <ul><li> - \[x] IdP groups sync with JWT </ul></li> 	                      | <ul><li> - \[x] Android </ul></li>  	 |
+| <ul><li> - \[x] [Routes to external networks](https://docs.netbird.io/how-to/routing-traffic-to-private-networks) </ul></li>  	 | <ul><li> - \[x] [Access control - groups & rules](https://docs.netbird.io/how-to/manage-network-access) </ul></li>      	        | 	                                                                          | <ul><li> - \[x] iOS </ul></li>      	 |
+| <ul><li> - \[x] NAT traversal with BPF </ul></li>                                                                               | <ul><li> - \[x] [Private DNS](https://docs.netbird.io/how-to/manage-dns-in-your-network) </ul></li>                            	      | 	                                                                          | <ul><li> - \[x] Docker </ul></li>   	 |
+| <ul><li> - \[x] Post-quantum-secure connection through [Rosenpass](https://rosenpass.eu) </ul></li>                             | <ul><li> - \[x] [Multiuser support](https://docs.netbird.io/how-to/add-users-to-your-network) </ul></li>                      	      | 	                                                                          | <ul><li> - \[x] OpenWRT </ul></li>  	 |
+| 	                                                                                                                               | <ul><li> - \[x] [Activity logging](https://docs.netbird.io/how-to/monitor-system-and-network-activity) </ul></li>                       	      | 	                                                                          | 	                                     |
+| 	                                                                                                                               | <ul><li> - \[x] SSH access management </ul></li>                       	 | 	                                                                          | 	                                     |
+
+
 ### Quickstart with NetBird Cloud
 
 - Download and install NetBird at [https://app.netbird.io/install](https://app.netbird.io/install)
@@ -106,8 +109,8 @@ export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbird
 See a complete [architecture overview](https://docs.netbird.io/about-netbird/how-netbird-works#architecture) for details.
 
 ### Community projects
+-  [NetBird on OpenWRT](https://github.com/messense/openwrt-netbird)
 -  [NetBird installer script](https://github.com/physk/netbird-installer)
--  [NetBird ansible collection by Dominion Solutions](https://galaxy.ansible.com/ui/repo/published/dominion_solutions/netbird/)
 
 **Note**: The `main` branch may be in an *unstable or even broken state* during development.
 For stable versions, see [releases](https://github.com/netbirdio/netbird/releases).

client/internal/auth/oauth.go

@@ -26,7 +26,7 @@ type HTTPClient interface {
 }
 
 // AuthFlowInfo holds information for the OAuth 2.0  authorization flow
-type AuthFlowInfo struct { //nolint:revive
+type AuthFlowInfo struct {
 	DeviceCode              string `json:"device_code"`
 	UserCode                string `json:"user_code"`
 	VerificationURI         string `json:"verification_uri"`

client/internal/dns/file_linux.go

@@ -8,7 +8,6 @@ import (
 	"net/netip"
 	"os"
 	"strings"
-	"time"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -24,16 +23,10 @@ const (
 	fileMaxNumberOfSearchDomains = 6
 )
 
-const (
-	dnsFailoverTimeout  = 4 * time.Second
-	dnsFailoverAttempts = 1
-)
-
 type fileConfigurator struct {
 	repair *repair
 
-	originalPerms  os.FileMode
-	nbNameserverIP string
+	originalPerms os.FileMode
 }
 
 func newFileConfigurator() (hostManager, error) {
@@ -71,7 +64,7 @@ func (f *fileConfigurator) applyDNSConfig(config HostDNSConfig) error {
 	}
 
 	nbSearchDomains := searchDomains(config)
-	f.nbNameserverIP = config.ServerIP
+	nbNameserverIP := config.ServerIP
 
 	resolvConf, err := parseBackupResolvConf()
 	if err != nil {
@@ -80,11 +73,11 @@ func (f *fileConfigurator) applyDNSConfig(config HostDNSConfig) error {
 
 	f.repair.stopWatchFileChanges()
 
-	err = f.updateConfig(nbSearchDomains, f.nbNameserverIP, resolvConf)
+	err = f.updateConfig(nbSearchDomains, nbNameserverIP, resolvConf)
 	if err != nil {
 		return err
 	}
-	f.repair.watchFileChanges(nbSearchDomains, f.nbNameserverIP)
+	f.repair.watchFileChanges(nbSearchDomains, nbNameserverIP)
 	return nil
 }
 
@@ -92,11 +85,10 @@ func (f *fileConfigurator) updateConfig(nbSearchDomains []string, nbNameserverIP
 	searchDomainList := mergeSearchDomains(nbSearchDomains, cfg.searchDomains)
 	nameServers := generateNsList(nbNameserverIP, cfg)
 
-	options := prepareOptionsWithTimeout(cfg.others, int(dnsFailoverTimeout.Seconds()), dnsFailoverAttempts)
 	buf := prepareResolvConfContent(
 		searchDomainList,
 		nameServers,
-		options)
+		cfg.others)
 
 	log.Debugf("creating managed file %s", defaultResolvConfPath)
 	err := os.WriteFile(defaultResolvConfPath, buf.Bytes(), f.originalPerms)
@@ -139,12 +131,7 @@ func (f *fileConfigurator) backup() error {
 }
 
 func (f *fileConfigurator) restore() error {
-	err := removeFirstNbNameserver(fileDefaultResolvConfBackupLocation, f.nbNameserverIP)
-	if err != nil {
-		log.Errorf("Failed to remove netbird nameserver from %s on backup restore: %s", fileDefaultResolvConfBackupLocation, err)
-	}
-
-	err = copyFile(fileDefaultResolvConfBackupLocation, defaultResolvConfPath)
+	err := copyFile(fileDefaultResolvConfBackupLocation, defaultResolvConfPath)
 	if err != nil {
 		return fmt.Errorf("restoring %s from %s: %w", defaultResolvConfPath, fileDefaultResolvConfBackupLocation, err)
 	}
@@ -170,7 +157,7 @@ func (f *fileConfigurator) restoreUncleanShutdownDNS(storedDNSAddress *netip.Add
 	currentDNSAddress, err := netip.ParseAddr(resolvConf.nameServers[0])
 	// not a valid first nameserver -> restore
 	if err != nil {
-		log.Errorf("restoring unclean shutdown: parse dns address %s failed: %s", resolvConf.nameServers[0], err)
+		log.Errorf("restoring unclean shutdown: parse dns address %s failed: %s", resolvConf.nameServers[1], err)
 		return restoreResolvConfFile()
 	}
 

client/internal/dns/file_parser_linux.go

@@ -5,7 +5,6 @@ package dns
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -15,9 +14,6 @@ const (
 	defaultResolvConfPath = "/etc/resolv.conf"
 )
 
-var timeoutRegex = regexp.MustCompile(`timeout:\d+`)
-var attemptsRegex = regexp.MustCompile(`attempts:\d+`)
-
 type resolvConf struct {
 	nameServers   []string
 	searchDomains []string
@@ -107,62 +103,3 @@ func parseResolvConfFile(resolvConfFile string) (*resolvConf, error) {
 	}
 	return rconf, nil
 }
-
-// prepareOptionsWithTimeout appends timeout to existing options if it doesn't exist,
-// otherwise it adds a new option with timeout and attempts.
-func prepareOptionsWithTimeout(input []string, timeout int, attempts int) []string {
-	configs := make([]string, len(input))
-	copy(configs, input)
-
-	for i, config := range configs {
-		if strings.HasPrefix(config, "options") {
-			config = strings.ReplaceAll(config, "rotate", "")
-			config = strings.Join(strings.Fields(config), " ")
-
-			if strings.Contains(config, "timeout:") {
-				config = timeoutRegex.ReplaceAllString(config, fmt.Sprintf("timeout:%d", timeout))
-			} else {
-				config = strings.Replace(config, "options ", fmt.Sprintf("options timeout:%d ", timeout), 1)
-			}
-
-			if strings.Contains(config, "attempts:") {
-				config = attemptsRegex.ReplaceAllString(config, fmt.Sprintf("attempts:%d", attempts))
-			} else {
-				config = strings.Replace(config, "options ", fmt.Sprintf("options attempts:%d ", attempts), 1)
-			}
-
-			configs[i] = config
-			return configs
-		}
-	}
-
-	return append(configs, fmt.Sprintf("options timeout:%d attempts:%d", timeout, attempts))
-}
-
-// removeFirstNbNameserver removes the given nameserver from the given file if it is in the first position
-// and writes the file back to the original location
-func removeFirstNbNameserver(filename, nameserverIP string) error {
-	resolvConf, err := parseResolvConfFile(filename)
-	if err != nil {
-		return fmt.Errorf("parse backup resolv.conf: %w", err)
-	}
-	content, err := os.ReadFile(filename)
-	if err != nil {
-		return fmt.Errorf("read %s: %w", filename, err)
-	}
-
-	if len(resolvConf.nameServers) > 1 && resolvConf.nameServers[0] == nameserverIP {
-		newContent := strings.Replace(string(content), fmt.Sprintf("nameserver %s\n", nameserverIP), "", 1)
-
-		stat, err := os.Stat(filename)
-		if err != nil {
-			return fmt.Errorf("stat %s: %w", filename, err)
-		}
-		if err := os.WriteFile(filename, []byte(newContent), stat.Mode()); err != nil {
-			return fmt.Errorf("write %s: %w", filename, err)
-		}
-
-	}
-
-	return nil
-}

client/internal/dns/file_parser_linux_test.go

@@ -6,8 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func Test_parseResolvConf(t *testing.T) {
@@ -174,131 +172,3 @@ nameserver 192.168.0.1
 		t.Errorf("unexpected resolv.conf content: %v", cfg)
 	}
 }
-
-func TestPrepareOptionsWithTimeout(t *testing.T) {
-	tests := []struct {
-		name     string
-		others   []string
-		timeout  int
-		attempts int
-		expected []string
-	}{
-		{
-			name:     "Append new options with timeout and attempts",
-			others:   []string{"some config"},
-			timeout:  2,
-			attempts: 2,
-			expected: []string{"some config", "options timeout:2 attempts:2"},
-		},
-		{
-			name:     "Modify existing options to exclude rotate and include timeout and attempts",
-			others:   []string{"some config", "options rotate someother"},
-			timeout:  3,
-			attempts: 2,
-			expected: []string{"some config", "options attempts:2 timeout:3 someother"},
-		},
-		{
-			name:     "Existing options with timeout and attempts are updated",
-			others:   []string{"some config", "options timeout:4 attempts:3"},
-			timeout:  5,
-			attempts: 4,
-			expected: []string{"some config", "options timeout:5 attempts:4"},
-		},
-		{
-			name:     "Modify existing options, add missing attempts before timeout",
-			others:   []string{"some config", "options timeout:4"},
-			timeout:  4,
-			attempts: 3,
-			expected: []string{"some config", "options attempts:3 timeout:4"},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := prepareOptionsWithTimeout(tc.others, tc.timeout, tc.attempts)
-			assert.Equal(t, tc.expected, result)
-		})
-	}
-}
-
-func TestRemoveFirstNbNameserver(t *testing.T) {
-	testCases := []struct {
-		name       string
-		content    string
-		ipToRemove string
-		expected   string
-	}{
-		{
-			name: "Unrelated nameservers with comments and options",
-			content: `# This is a comment
-options rotate
-nameserver 1.1.1.1
-# Another comment
-nameserver 8.8.4.4
-search example.com`,
-			ipToRemove: "9.9.9.9",
-			expected: `# This is a comment
-options rotate
-nameserver 1.1.1.1
-# Another comment
-nameserver 8.8.4.4
-search example.com`,
-		},
-		{
-			name: "First nameserver matches",
-			content: `search example.com
-nameserver 9.9.9.9
-# oof, a comment
-nameserver 8.8.4.4
-options attempts:5`,
-			ipToRemove: "9.9.9.9",
-			expected: `search example.com
-# oof, a comment
-nameserver 8.8.4.4
-options attempts:5`,
-		},
-		{
-			name: "Target IP not the first nameserver",
-			// nolint:dupword
-			content: `# Comment about the first nameserver
-nameserver 8.8.4.4
-# Comment before our target
-nameserver 9.9.9.9
-options timeout:2`,
-			ipToRemove: "9.9.9.9",
-			// nolint:dupword
-			expected: `# Comment about the first nameserver
-nameserver 8.8.4.4
-# Comment before our target
-nameserver 9.9.9.9
-options timeout:2`,
-		},
-		{
-			name: "Only nameserver matches",
-			content: `options debug
-nameserver 9.9.9.9
-search localdomain`,
-			ipToRemove: "9.9.9.9",
-			expected: `options debug
-nameserver 9.9.9.9
-search localdomain`,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			tempDir := t.TempDir()
-			tempFile := filepath.Join(tempDir, "resolv.conf")
-			err := os.WriteFile(tempFile, []byte(tc.content), 0644)
-			assert.NoError(t, err)
-
-			err = removeFirstNbNameserver(tempFile, tc.ipToRemove)
-			assert.NoError(t, err)
-
-			content, err := os.ReadFile(tempFile)
-			assert.NoError(t, err)
-
-			assert.Equal(t, tc.expected, string(content), "The resulting content should match the expected output.")
-		})
-	}
-}

client/internal/dns/host_linux.go

@@ -65,7 +65,7 @@ func newHostManager(wgInterface string) (hostManager, error) {
 		return nil, err
 	}
 
-	log.Infof("System DNS manager discovered: %s", osManager)
+	log.Debugf("discovered mode is: %s", osManager)
 	return newHostManagerFromType(wgInterface, osManager)
 }
 

client/internal/dns/resolvconf_linux.go

@@ -53,12 +53,10 @@ func (r *resolvconf) applyDNSConfig(config HostDNSConfig) error {
 	searchDomainList := searchDomains(config)
 	searchDomainList = mergeSearchDomains(searchDomainList, r.originalSearchDomains)
 
-	options := prepareOptionsWithTimeout(r.othersConfigs, int(dnsFailoverTimeout.Seconds()), dnsFailoverAttempts)
-
 	buf := prepareResolvConfContent(
 		searchDomainList,
 		append([]string{config.ServerIP}, r.originalNameServers...),
-		options)
+		r.othersConfigs)
 
 	// create a backup for unclean shutdown detection before the resolv.conf is changed
 	if err := createUncleanShutdownIndicator(defaultResolvConfPath, resolvConfManager, config.ServerIP); err != nil {

client/internal/peer/status.go

@@ -5,9 +5,6 @@ import (
 	"sync"
 	"time"
 
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/iface"
 )
@@ -379,24 +376,6 @@ func (d *Status) GetManagementState() ManagementState {
 	}
 }
 
-// IsLoginRequired determines if a peer's login has expired.
-func (d *Status) IsLoginRequired() bool {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-
-	// if peer is connected to the management then login is not expired
-	if d.managementState {
-		return false
-	}
-
-	s, ok := gstatus.FromError(d.managementError)
-	if ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
-		return true
-
-	}
-	return false
-}
-
 func (d *Status) GetSignalState() SignalState {
 	return SignalState{
 		d.signalAddress,

client/internal/session.go

@@ -1,82 +0,0 @@
-package internal
-
-import (
-	"context"
-	"os/exec"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-type SessionWatcher struct {
-	ctx   context.Context
-	mutex sync.Mutex
-
-	peerStatusRecorder *peer.Status
-	watchTicker        *time.Ticker
-
-	sendNotification bool
-	onExpireListener func()
-}
-
-// NewSessionWatcher creates a new instance of SessionWatcher.
-func NewSessionWatcher(ctx context.Context, peerStatusRecorder *peer.Status) *SessionWatcher {
-	s := &SessionWatcher{
-		ctx:                ctx,
-		peerStatusRecorder: peerStatusRecorder,
-		watchTicker:        time.NewTicker(2 * time.Second),
-	}
-	go s.startWatcher()
-	return s
-}
-
-// SetOnExpireListener sets the callback func to be called when the session expires.
-func (s *SessionWatcher) SetOnExpireListener(onExpire func()) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-	s.onExpireListener = onExpire
-}
-
-// startWatcher continuously checks if the session requires login and
-// calls the onExpireListener if login is required.
-func (s *SessionWatcher) startWatcher() {
-	for {
-		select {
-		case <-s.ctx.Done():
-			s.watchTicker.Stop()
-			return
-		case <-s.watchTicker.C:
-			managementState := s.peerStatusRecorder.GetManagementState()
-			if managementState.Connected {
-				s.sendNotification = true
-			}
-
-			isLoginRequired := s.peerStatusRecorder.IsLoginRequired()
-			if isLoginRequired && s.sendNotification && s.onExpireListener != nil {
-				s.mutex.Lock()
-				s.onExpireListener()
-				s.sendNotification = false
-				s.mutex.Unlock()
-			}
-		}
-	}
-}
-
-// CheckUIApp checks whether UI application is running.
-func CheckUIApp() bool {
-	cmd := exec.Command("ps", "-ef")
-	output, err := cmd.Output()
-	if err != nil {
-		return false
-	}
-
-	lines := strings.Split(string(output), "\n")
-	for _, line := range lines {
-		if strings.Contains(line, "netbird-ui") && !strings.Contains(line, "grep") {
-			return true
-		}
-	}
-	return false
-}

client/server/server.go

@@ -3,15 +3,9 @@ package server
 import (
 	"context"
 	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"strconv"
 	"sync"
 	"time"
 
-	"github.com/cenkalti/backoff/v4"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/system"
 
@@ -27,17 +21,7 @@ import (
 	"github.com/netbirdio/netbird/version"
 )
 
-const (
-	probeThreshold          = time.Second * 5
-	retryInitialIntervalVar = "NB_CONN_RETRY_INTERVAL_TIME"
-	maxRetryIntervalVar     = "NB_CONN_MAX_RETRY_INTERVAL_TIME"
-	maxRetryTimeVar         = "NB_CONN_MAX_RETRY_TIME_TIME"
-	retryMultiplierVar      = "NB_CONN_RETRY_MULTIPLIER"
-	defaultInitialRetryTime = 14 * 24 * time.Hour
-	defaultMaxRetryInterval = 60 * time.Minute
-	defaultMaxRetryTime     = 14 * 24 * time.Hour
-	defaultRetryMultiplier  = 1.7
-)
+const probeThreshold = time.Second * 5
 
 // Server for service control.
 type Server struct {
@@ -55,7 +39,6 @@ type Server struct {
 	proto.UnimplementedDaemonServiceServer
 
 	statusRecorder *peer.Status
-	sessionWatcher *internal.SessionWatcher
 
 	mgmProbe    *internal.Probe
 	signalProbe *internal.Probe
@@ -133,116 +116,17 @@ func (s *Server) Start() error {
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
 
-	if s.sessionWatcher == nil {
-		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
-		s.sessionWatcher.SetOnExpireListener(s.onSessionExpire)
-	}
-
 	if !config.DisableAutoConnect {
-		go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe)
+		go func() {
+			if err := internal.RunClientWithProbes(ctx, config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe); err != nil {
+				log.Errorf("init connections: %v", err)
+			}
+		}()
 	}
 
 	return nil
 }
 
-// connectWithRetryRuns runs the client connection with a backoff strategy where we retry the operation as additional
-// mechanism to keep the client connected even when the connection is lost.
-// we cancel retry if the client receive a stop or down command, or if disable auto connect is configured.
-func (s *Server) connectWithRetryRuns(ctx context.Context, config *internal.Config, statusRecorder *peer.Status,
-	mgmProbe *internal.Probe, signalProbe *internal.Probe, relayProbe *internal.Probe, wgProbe *internal.Probe) {
-	backOff := getConnectWithBackoff(ctx)
-	retryStarted := false
-
-	go func() {
-		t := time.NewTicker(24 * time.Hour)
-		for {
-			select {
-			case <-ctx.Done():
-				t.Stop()
-				return
-			case <-t.C:
-				if retryStarted {
-
-					mgmtState := statusRecorder.GetManagementState()
-					signalState := statusRecorder.GetSignalState()
-					if mgmtState.Connected && signalState.Connected {
-						log.Tracef("resetting status")
-						retryStarted = false
-					} else {
-						log.Tracef("not resetting status: mgmt: %v, signal: %v", mgmtState.Connected, signalState.Connected)
-					}
-				}
-			}
-		}
-	}()
-
-	runOperation := func() error {
-		log.Tracef("running client connection")
-		err := internal.RunClientWithProbes(ctx, config, statusRecorder, mgmProbe, signalProbe, relayProbe, wgProbe)
-		if err != nil {
-			log.Debugf("run client connection exited with error: %v. Will retry in the background", err)
-		}
-
-		if config.DisableAutoConnect {
-			return backoff.Permanent(err)
-		}
-
-		if !retryStarted {
-			retryStarted = true
-			backOff.Reset()
-		}
-
-		log.Tracef("client connection exited")
-		return fmt.Errorf("client connection exited")
-	}
-
-	err := backoff.Retry(runOperation, backOff)
-	if s, ok := gstatus.FromError(err); ok && s.Code() != codes.Canceled {
-		log.Errorf("received an error when trying to connect: %v", err)
-	} else {
-		log.Tracef("retry canceled")
-	}
-}
-
-// getConnectWithBackoff returns a backoff with exponential backoff strategy for connection retries
-func getConnectWithBackoff(ctx context.Context) backoff.BackOff {
-	initialInterval := parseEnvDuration(retryInitialIntervalVar, defaultInitialRetryTime)
-	maxInterval := parseEnvDuration(maxRetryIntervalVar, defaultMaxRetryInterval)
-	maxElapsedTime := parseEnvDuration(maxRetryTimeVar, defaultMaxRetryTime)
-	multiplier := defaultRetryMultiplier
-
-	if envValue := os.Getenv(retryMultiplierVar); envValue != "" {
-		// parse the multiplier from the environment variable string value to float64
-		value, err := strconv.ParseFloat(envValue, 64)
-		if err != nil {
-			log.Warnf("unable to parse environment variable %s: %s. using default: %f", retryMultiplierVar, envValue, multiplier)
-		} else {
-			multiplier = value
-		}
-	}
-
-	return backoff.WithContext(&backoff.ExponentialBackOff{
-		InitialInterval:     initialInterval,
-		RandomizationFactor: 1,
-		Multiplier:          multiplier,
-		MaxInterval:         maxInterval,
-		MaxElapsedTime:      maxElapsedTime, // 14 days
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	}, ctx)
-}
-
-// parseEnvDuration parses the environment variable and returns the duration
-func parseEnvDuration(envVar string, defaultDuration time.Duration) time.Duration {
-	if envValue := os.Getenv(envVar); envValue != "" {
-		if duration, err := time.ParseDuration(envValue); err == nil {
-			return duration
-		}
-		log.Warnf("unable to parse environment variable %s: %s. using default: %s", envVar, envValue, defaultDuration)
-	}
-	return defaultDuration
-}
-
 // loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	var status internal.StatusType
@@ -553,7 +437,12 @@ func (s *Server) Up(callerCtx context.Context, _ *proto.UpRequest) (*proto.UpRes
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
-	go s.connectWithRetryRuns(ctx, s.config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe)
+	go func() {
+		if err := internal.RunClientWithProbes(ctx, s.config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe); err != nil {
+			log.Errorf("run client connection: %v", err)
+			return
+		}
+	}()
 
 	return &proto.UpResponse{}, nil
 }
@@ -653,17 +542,6 @@ func (s *Server) GetConfig(_ context.Context, _ *proto.GetConfigRequest) (*proto
 	}, nil
 }
 
-func (s *Server) onSessionExpire() {
-	if runtime.GOOS != "windows" {
-		isUIActive := internal.CheckUIApp()
-		if !isUIActive {
-			if err := sendTerminalNotification(); err != nil {
-				log.Errorf("send session expire terminal notification: %v", err)
-			}
-		}
-	}
-}
-
 func toProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus := proto.FullStatus{
 		ManagementState: &proto.ManagementState{},
@@ -726,31 +604,3 @@ func toProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 
 	return &pbFullStatus
 }
-
-// sendTerminalNotification sends a terminal notification message
-// to inform the user that the NetBird connection session has expired.
-func sendTerminalNotification() error {
-	message := "NetBird connection session expired\n\nPlease re-authenticate to connect to the network."
-	echoCmd := exec.Command("echo", message)
-	wallCmd := exec.Command("sudo", "wall")
-
-	echoCmdStdout, err := echoCmd.StdoutPipe()
-	if err != nil {
-		return err
-	}
-	wallCmd.Stdin = echoCmdStdout
-
-	if err := echoCmd.Start(); err != nil {
-		return err
-	}
-
-	if err := wallCmd.Start(); err != nil {
-		return err
-	}
-
-	if err := echoCmd.Wait(); err != nil {
-		return err
-	}
-
-	return wallCmd.Wait()
-}

client/server/server_test.go

@@ -1,157 +0,0 @@
-package server
-
-import (
-	"context"
-	"net"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/keepalive"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	mgmtProto "github.com/netbirdio/netbird/management/proto"
-	"github.com/netbirdio/netbird/management/server"
-	"github.com/netbirdio/netbird/management/server/activity"
-	"github.com/netbirdio/netbird/signal/proto"
-	signalServer "github.com/netbirdio/netbird/signal/server"
-)
-
-var (
-	kaep = keepalive.EnforcementPolicy{
-		MinTime:             15 * time.Second,
-		PermitWithoutStream: true,
-	}
-
-	kasp = keepalive.ServerParameters{
-		MaxConnectionIdle:     15 * time.Second,
-		MaxConnectionAgeGrace: 5 * time.Second,
-		Time:                  5 * time.Second,
-		Timeout:               2 * time.Second,
-	}
-)
-
-// TestConnectWithRetryRuns checks that the connectWithRetry function runs and runs the retries according to the times specified via environment variables
-// we will use a management server started via to simulate the server and capture the number of retries
-func TestConnectWithRetryRuns(t *testing.T) {
-	// start the signal server
-	_, signalAddr, err := startSignal()
-	if err != nil {
-		t.Fatalf("failed to start signal server: %v", err)
-	}
-
-	counter := 0
-	// start the management server
-	_, mgmtAddr, err := startManagement(t, signalAddr, &counter)
-	if err != nil {
-		t.Fatalf("failed to start management server: %v", err)
-	}
-
-	ctx := internal.CtxInitState(context.Background())
-
-	ctx, cancel := context.WithDeadline(ctx, time.Now().Add(30*time.Second))
-	defer cancel()
-	// create new server
-	s := New(ctx, t.TempDir()+"/config.json", "debug")
-	s.latestConfigInput.ManagementURL = "http://" + mgmtAddr
-	config, err := internal.UpdateOrCreateConfig(s.latestConfigInput)
-	if err != nil {
-		t.Fatalf("failed to create config: %v", err)
-	}
-	s.config = config
-
-	s.statusRecorder = peer.NewRecorder(config.ManagementURL.String())
-	t.Setenv(retryInitialIntervalVar, "1s")
-	t.Setenv(maxRetryIntervalVar, "2s")
-	t.Setenv(maxRetryTimeVar, "5s")
-	t.Setenv(retryMultiplierVar, "1")
-
-	s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe)
-	if counter < 3 {
-		t.Fatalf("expected counter > 2, got %d", counter)
-	}
-}
-
-type mockServer struct {
-	mgmtProto.ManagementServiceServer
-	counter *int
-}
-
-func (m *mockServer) Login(ctx context.Context, req *mgmtProto.EncryptedMessage) (*mgmtProto.EncryptedMessage, error) {
-	*m.counter++
-	return m.ManagementServiceServer.Login(ctx, req)
-}
-
-func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Server, string, error) {
-	t.Helper()
-	dataDir := t.TempDir()
-
-	config := &server.Config{
-		Stuns:      []*server.Host{},
-		TURNConfig: &server.TURNConfig{},
-		Signal: &server.Host{
-			Proto: "http",
-			URI:   signalAddr,
-		},
-		Datadir:    dataDir,
-		HttpConfig: nil,
-	}
-
-	lis, err := net.Listen("tcp", "localhost:0")
-	if err != nil {
-		return nil, "", err
-	}
-	s := grpc.NewServer(grpc.KeepaliveEnforcementPolicy(kaep), grpc.KeepaliveParams(kasp))
-	store, err := server.NewStoreFromJson(config.Datadir, nil)
-	if err != nil {
-		return nil, "", err
-	}
-
-	peersUpdateManager := server.NewPeersUpdateManager(nil)
-	eventStore := &activity.InMemoryEventStore{}
-	if err != nil {
-		return nil, "", err
-	}
-	accountManager, err := server.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false)
-	if err != nil {
-		return nil, "", err
-	}
-	turnManager := server.NewTimeBasedAuthSecretsManager(peersUpdateManager, config.TURNConfig)
-	mgmtServer, err := server.NewServer(config, accountManager, peersUpdateManager, turnManager, nil, nil)
-	if err != nil {
-		return nil, "", err
-	}
-	mock := &mockServer{
-		ManagementServiceServer: mgmtServer,
-		counter:                 counter,
-	}
-	mgmtProto.RegisterManagementServiceServer(s, mock)
-	go func() {
-		if err = s.Serve(lis); err != nil {
-			log.Fatalf("failed to serve: %v", err)
-		}
-	}()
-
-	return s, lis.Addr().String(), nil
-}
-
-func startSignal() (*grpc.Server, string, error) {
-	s := grpc.NewServer(grpc.KeepaliveEnforcementPolicy(kaep), grpc.KeepaliveParams(kasp))
-
-	lis, err := net.Listen("tcp", "localhost:0")
-	if err != nil {
-		log.Fatalf("failed to listen: %v", err)
-	}
-
-	proto.RegisterSignalExchangeServer(s, signalServer.NewServer())
-
-	go func() {
-		if err = s.Serve(lis); err != nil {
-			log.Fatalf("failed to serve: %v", err)
-		}
-	}()
-
-	return s, lis.Addr().String(), nil
-}

client/system/info_windows.go

@@ -165,10 +165,6 @@ func sysProductName() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	// `ComputerSystemProduct` could be empty on some virtualized systems
-	if len(dst) < 1 {
-		return "unknown", nil
-	}
 	return dst[0].Name, nil
 }
 

client/ui/client_ui.go

@@ -61,7 +61,7 @@ func main() {
 
 	flag.Parse()
 
-	a := app.NewWithID("NetBird")
+	a := app.New()
 	a.SetIcon(fyne.NewStaticResource("netbird", iconDisconnectedPNG))
 
 	client := newServiceClient(daemonAddr, a, showSettings)
@@ -130,10 +130,9 @@ type serviceClient struct {
 	mQuit          *systray.MenuItem
 
 	// application with main windows.
-	app              fyne.App
-	wSettings        fyne.Window
-	showSettings     bool
-	sendNotification bool
+	app          fyne.App
+	wSettings    fyne.Window
+	showSettings bool
 
 	// input elements for settings form
 	iMngURL       *widget.Entry
@@ -159,10 +158,9 @@ type serviceClient struct {
 // This constructor also builds the UI elements for the settings window.
 func newServiceClient(addr string, a fyne.App, showSettings bool) *serviceClient {
 	s := &serviceClient{
-		ctx:              context.Background(),
-		addr:             addr,
-		app:              a,
-		sendNotification: false,
+		ctx:  context.Background(),
+		addr: addr,
+		app:  a,
 
 		showSettings: showSettings,
 		update:       version.NewUpdate(),
@@ -379,15 +377,9 @@ func (s *serviceClient) updateStatus() error {
 		s.updateIndicationLock.Lock()
 		defer s.updateIndicationLock.Unlock()
 
-		// notify the user when the session has expired
-		if status.Status == string(internal.StatusNeedsLogin) {
-			s.onSessionExpire()
-		}
-
 		var systrayIconState bool
 		if status.Status == string(internal.StatusConnected) && !s.mUp.Disabled() {
 			s.connected = true
-			s.sendNotification = true
 			if s.isUpdateIconActive {
 				systray.SetIcon(s.icUpdateConnected)
 			} else {
@@ -638,23 +630,6 @@ func (s *serviceClient) onUpdateAvailable() {
 	}
 }
 
-// onSessionExpire sends a notification to the user when the session expires.
-func (s *serviceClient) onSessionExpire() {
-	if s.sendNotification {
-		title := "Connection session expired"
-		if runtime.GOOS == "darwin" {
-			title = "NetBird connection session expired"
-		}
-		s.app.SendNotification(
-			fyne.NewNotification(
-				title,
-				"Please re-authenticate to connect to the network",
-			),
-		)
-		s.sendNotification = false
-	}
-}
-
 func openURL(url string) error {
 	var err error
 	switch runtime.GOOS {

iface/netstack/tun.go

@@ -8,7 +8,7 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 )
 
-type NetStackTun struct { //nolint:revive
+type NetStackTun struct {
 	address       string
 	mtu           int
 	listenAddress string

infrastructure_files/download-geolite2.sh

@@ -30,6 +30,9 @@ download_geolite_mmdb() {
 
   # Verify the signature
   echo "Verifying signature..."
+
+  mv "$SIGNATURE_FILE" "$SIGNATURE_FILE".gz
+  gunzip "$SIGNATURE_FILE".gz
   if sha256sum -c --status "$SIGNATURE_FILE"; then
       echo "Signature is valid."
   else
@@ -71,6 +74,8 @@ download_geolite_csv_and_create_sqlite_db() {
 
   # Verify the signature
   echo "Verifying signature..."
+  mv "$SIGNATURE_FILE" "$SIGNATURE_FILE".gz
+  gunzip "$SIGNATURE_FILE".gz
   if sha256sum -c --status "$SIGNATURE_FILE"; then
       echo "Signature is valid."
   else

infrastructure_files/management.json.tmpl

@@ -26,13 +26,6 @@
         "Username": "",
         "Password": null
     },
-    "ReverseProxy": {
-        "TrustedHTTPProxies": [],
-        "TrustedHTTPProxiesCount": 0,
-        "TrustedPeers": [
-             "0.0.0.0/0"
-        ]
-    },
     "Datadir": "",
     "DataStoreEncryptionKey": "$NETBIRD_DATASTORE_ENC_KEY",
     "StoreConfig": {

infrastructure_files/nginx.tmpl.conf

@@ -46,7 +46,6 @@ server {
     proxy_set_header        X-Scheme $scheme;
     proxy_set_header        X-Forwarded-Proto https;
     proxy_set_header        X-Forwarded-Host $host;
-    grpc_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
 
     # Proxy dashboard
     location / {

management/client/client_test.go

@@ -363,11 +363,10 @@ func Test_SystemMetaDataFromClient(t *testing.T) {
 		WiretrusteeVersion: info.WiretrusteeVersion,
 		KernelVersion:      info.KernelVersion,
 
-		NetworkAddresses: protoNetAddr,
-		SysSerialNumber:  info.SystemSerialNumber,
-		SysProductName:   info.SystemProductName,
-		SysManufacturer:  info.SystemManufacturer,
-		Environment:      &mgmtProto.Environment{Cloud: info.Environment.Cloud, Platform: info.Environment.Platform},
+		NetworkAddresses:   protoNetAddr,
+		SysSerialNumber:    info.SystemSerialNumber,
+		SysProductName:     info.SystemProductName,
+		SysManufacturer:    info.SystemManufacturer,
 	}
 
 	assert.Equal(t, ValidKey, actualValidKey)
@@ -408,9 +407,7 @@ func isEqual(a, b *mgmtProto.PeerSystemMeta) bool {
 		a.GetUiVersion() == b.GetUiVersion() &&
 		a.GetSysSerialNumber() == b.GetSysSerialNumber() &&
 		a.GetSysProductName() == b.GetSysProductName() &&
-		a.GetSysManufacturer() == b.GetSysManufacturer() &&
-		a.GetEnvironment().Cloud == b.GetEnvironment().Cloud &&
-		a.GetEnvironment().Platform == b.GetEnvironment().Platform
+		a.GetSysManufacturer() == b.GetSysManufacturer()
 }
 
 func Test_GetDeviceAuthorizationFlow(t *testing.T) {

management/client/grpc.go

@@ -26,8 +26,6 @@ import (
 	"github.com/netbirdio/netbird/management/proto"
 )
 
-const ConnectTimeout = 10 * time.Second
-
 // ConnStateNotifier is a wrapper interface of the status recorders
 type ConnStateNotifier interface {
 	MarkManagementDisconnected(error)
@@ -51,7 +49,7 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 		transportOption = grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{}))
 	}
 
-	mgmCtx, cancel := context.WithTimeout(ctx, ConnectTimeout)
+	mgmCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 	conn, err := grpc.DialContext(
 		mgmCtx,
@@ -320,7 +318,7 @@ func (c *GrpcClient) login(serverKey wgtypes.Key, req *proto.LoginRequest) (*pro
 		log.Errorf("failed to encrypt message: %s", err)
 		return nil, err
 	}
-	mgmCtx, cancel := context.WithTimeout(c.ctx, ConnectTimeout)
+	mgmCtx, cancel := context.WithTimeout(c.ctx, 5*time.Second)
 	defer cancel()
 	resp, err := c.realClient.Login(mgmCtx, &proto.EncryptedMessage{
 		WgPubKey: c.key.PublicKey().String(),
@@ -476,9 +474,5 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 		SysSerialNumber:    info.SystemSerialNumber,
 		SysManufacturer:    info.SystemManufacturer,
 		SysProductName:     info.SystemProductName,
-		Environment: &proto.Environment{
-			Cloud:    info.Environment.Cloud,
-			Platform: info.Environment.Platform,
-		},
 	}
 }

management/cmd/management.go

@@ -43,7 +43,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/metrics"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/util"
-	"github.com/netbirdio/netbird/version"
 )
 
 // ManagementLegacyPort is the port that was used before by the Management gRPC server.
@@ -316,7 +315,6 @@ var (
 				}
 			}
 
-			log.Infof("management server version %s", version.NetbirdVersion())
 			log.Infof("running HTTP server and gRPC server on the same port: %s", listener.Addr().String())
 			serveGRPCWithHTTP(listener, rootHandler, tlsEnabled)
 

management/proto/management.proto

@@ -92,14 +92,6 @@ message PeerKeys {
   bytes wgPubKey = 2;
 }
 
-// Environment is part of the PeerSystemMeta and describes the environment the agent is running in.
-message Environment {
-  // cloud is the cloud provider the agent is running in if applicable.
-  string cloud = 1;
-  // platform is the platform the agent is running on if applicable.
-  string platform = 2;
-}
-
 // PeerSystemMeta is machine meta data like OS and version.
 message PeerSystemMeta {
   string hostname = 1;
@@ -116,7 +108,6 @@ message PeerSystemMeta {
   string sysSerialNumber = 12;
   string sysProductName = 13;
   string sysManufacturer = 14;
-  Environment environment = 15;
 }
 
 message LoginResponse {

management/refactor/api/grpc/grpcserver.go

@@ -1,641 +0,0 @@
-package server
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
-	"strings"
-	"time"
-
-	pb "github.com/golang/protobuf/proto" // nolint
-	"github.com/golang/protobuf/ptypes/timestamp"
-	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/realip"
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/encryption"
-	"github.com/netbirdio/netbird/management/proto"
-	"github.com/netbirdio/netbird/management/server/jwtclaims"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	internalStatus "github.com/netbirdio/netbird/management/server/status"
-	"github.com/netbirdio/netbird/management/server/telemetry"
-)
-
-// GRPCServer an instance of a Management gRPC API server
-type GRPCServer struct {
-	accountManager AccountManager
-	wgKey          wgtypes.Key
-	proto.UnimplementedManagementServiceServer
-	peersUpdateManager     *PeersUpdateManager
-	config                 *Config
-	turnCredentialsManager TURNCredentialsManager
-	jwtValidator           *jwtclaims.JWTValidator
-	jwtClaimsExtractor     *jwtclaims.ClaimsExtractor
-	appMetrics             telemetry.AppMetrics
-	ephemeralManager       *EphemeralManager
-}
-
-// NewServer creates a new Management server
-func NewServer(config *Config, accountManager AccountManager, peersUpdateManager *PeersUpdateManager, turnCredentialsManager TURNCredentialsManager, appMetrics telemetry.AppMetrics, ephemeralManager *EphemeralManager) (*GRPCServer, error) {
-	key, err := wgtypes.GeneratePrivateKey()
-	if err != nil {
-		return nil, err
-	}
-
-	var jwtValidator *jwtclaims.JWTValidator
-
-	if config.HttpConfig != nil && config.HttpConfig.AuthIssuer != "" && config.HttpConfig.AuthAudience != "" && validateURL(config.HttpConfig.AuthKeysLocation) {
-		jwtValidator, err = jwtclaims.NewJWTValidator(
-			config.HttpConfig.AuthIssuer,
-			config.GetAuthAudiences(),
-			config.HttpConfig.AuthKeysLocation,
-			config.HttpConfig.IdpSignKeyRefreshEnabled,
-		)
-		if err != nil {
-			return nil, status.Errorf(codes.Internal, "unable to create new jwt middleware, err: %v", err)
-		}
-	} else {
-		log.Debug("unable to use http config to create new jwt middleware")
-	}
-
-	if appMetrics != nil {
-		// update gauge based on number of connected peers which is equal to open gRPC streams
-		err = appMetrics.GRPCMetrics().RegisterConnectedStreams(func() int64 {
-			return int64(len(peersUpdateManager.peerChannels))
-		})
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	var audience, userIDClaim string
-	if config.HttpConfig != nil {
-		audience = config.HttpConfig.AuthAudience
-		userIDClaim = config.HttpConfig.AuthUserIDClaim
-	}
-	jwtClaimsExtractor := jwtclaims.NewClaimsExtractor(
-		jwtclaims.WithAudience(audience),
-		jwtclaims.WithUserIDClaim(userIDClaim),
-	)
-
-	return &GRPCServer{
-		wgKey: key,
-		// peerKey -> event channel
-		peersUpdateManager:     peersUpdateManager,
-		accountManager:         accountManager,
-		config:                 config,
-		turnCredentialsManager: turnCredentialsManager,
-		jwtValidator:           jwtValidator,
-		jwtClaimsExtractor:     jwtClaimsExtractor,
-		appMetrics:             appMetrics,
-		ephemeralManager:       ephemeralManager,
-	}, nil
-}
-
-func (s *GRPCServer) GetServerKey(ctx context.Context, req *proto.Empty) (*proto.ServerKeyResponse, error) {
-	// todo introduce something more meaningful with the key expiration/rotation
-	if s.appMetrics != nil {
-		s.appMetrics.GRPCMetrics().CountGetKeyRequest()
-	}
-	now := time.Now().Add(24 * time.Hour)
-	secs := int64(now.Second())
-	nanos := int32(now.Nanosecond())
-	expiresAt := &timestamp.Timestamp{Seconds: secs, Nanos: nanos}
-
-	return &proto.ServerKeyResponse{
-		Key:       s.wgKey.PublicKey().String(),
-		ExpiresAt: expiresAt,
-	}, nil
-}
-
-func getRealIP(ctx context.Context) net.IP {
-	if addr, ok := realip.FromContext(ctx); ok {
-		return net.IP(addr.AsSlice())
-	}
-	return nil
-}
-
-// Sync validates the existence of a connecting peer, sends an initial state (all available for the connecting peers) and
-// notifies the connected peer of any updates (e.g. new peers under the same account)
-func (s *GRPCServer) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_SyncServer) error {
-	reqStart := time.Now()
-	if s.appMetrics != nil {
-		s.appMetrics.GRPCMetrics().CountSyncRequest()
-	}
-	realIP := getRealIP(srv.Context())
-	log.Debugf("Sync request from peer [%s] [%s]", req.WgPubKey, realIP.String())
-
-	syncReq := &proto.SyncRequest{}
-	peerKey, err := s.parseRequest(req, syncReq)
-	if err != nil {
-		return err
-	}
-
-	peer, netMap, err := s.accountManager.SyncPeer(PeerSync{WireGuardPubKey: peerKey.String()})
-	if err != nil {
-		return mapError(err)
-	}
-
-	err = s.sendInitialSync(peerKey, peer, netMap, srv)
-	if err != nil {
-		log.Debugf("error while sending initial sync for %s: %v", peerKey.String(), err)
-		return err
-	}
-
-	updates := s.peersUpdateManager.CreateChannel(peer.ID)
-
-	s.ephemeralManager.OnPeerConnected(peer)
-
-	err = s.accountManager.MarkPeerConnected(peerKey.String(), true, realIP)
-	if err != nil {
-		log.Warnf("failed marking peer as connected %s %v", peerKey, err)
-	}
-
-	if s.config.TURNConfig.TimeBasedCredentials {
-		s.turnCredentialsManager.SetupRefresh(peer.ID)
-	}
-
-	if s.appMetrics != nil {
-		s.appMetrics.GRPCMetrics().CountSyncRequestDuration(time.Since(reqStart))
-	}
-
-	// keep a connection to the peer and send updates when available
-	for {
-		select {
-		// condition when there are some updates
-		case update, open := <-updates:
-
-			if s.appMetrics != nil {
-				s.appMetrics.GRPCMetrics().UpdateChannelQueueLength(len(updates) + 1)
-			}
-
-			if !open {
-				log.Debugf("updates channel for peer %s was closed", peerKey.String())
-				s.cancelPeerRoutines(peer)
-				return nil
-			}
-			log.Debugf("received an update for peer %s", peerKey.String())
-
-			encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, update.Update)
-			if err != nil {
-				s.cancelPeerRoutines(peer)
-				return status.Errorf(codes.Internal, "failed processing update message")
-			}
-
-			err = srv.SendMsg(&proto.EncryptedMessage{
-				WgPubKey: s.wgKey.PublicKey().String(),
-				Body:     encryptedResp,
-			})
-			if err != nil {
-				s.cancelPeerRoutines(peer)
-				return status.Errorf(codes.Internal, "failed sending update message")
-			}
-			log.Debugf("sent an update to peer %s", peerKey.String())
-		// condition when client <-> server connection has been terminated
-		case <-srv.Context().Done():
-			// happens when connection drops, e.g. client disconnects
-			log.Debugf("stream of peer %s has been closed", peerKey.String())
-			s.cancelPeerRoutines(peer)
-			return srv.Context().Err()
-		}
-	}
-}
-
-func (s *GRPCServer) cancelPeerRoutines(peer *nbpeer.Peer) {
-	s.peersUpdateManager.CloseChannel(peer.ID)
-	s.turnCredentialsManager.CancelRefresh(peer.ID)
-	_ = s.accountManager.MarkPeerConnected(peer.Key, false, nil)
-	s.ephemeralManager.OnPeerDisconnected(peer)
-}
-
-func (s *GRPCServer) validateToken(jwtToken string) (string, error) {
-	if s.jwtValidator == nil {
-		return "", status.Error(codes.Internal, "no jwt validator set")
-	}
-
-	token, err := s.jwtValidator.ValidateAndParse(jwtToken)
-	if err != nil {
-		return "", status.Errorf(codes.InvalidArgument, "invalid jwt token, err: %v", err)
-	}
-	claims := s.jwtClaimsExtractor.FromToken(token)
-	// we need to call this method because if user is new, we will automatically add it to existing or create a new account
-	_, _, err = s.accountManager.GetAccountFromToken(claims)
-	if err != nil {
-		return "", status.Errorf(codes.Internal, "unable to fetch account with claims, err: %v", err)
-	}
-
-	if err := s.accountManager.CheckUserAccessByJWTGroups(claims); err != nil {
-		return "", status.Errorf(codes.PermissionDenied, err.Error())
-	}
-
-	return claims.UserId, nil
-}
-
-// maps internal internalStatus.Error to gRPC status.Error
-func mapError(err error) error {
-	if e, ok := internalStatus.FromError(err); ok {
-		switch e.Type() {
-		case internalStatus.PermissionDenied:
-			return status.Errorf(codes.PermissionDenied, e.Message)
-		case internalStatus.Unauthorized:
-			return status.Errorf(codes.PermissionDenied, e.Message)
-		case internalStatus.Unauthenticated:
-			return status.Errorf(codes.PermissionDenied, e.Message)
-		case internalStatus.PreconditionFailed:
-			return status.Errorf(codes.FailedPrecondition, e.Message)
-		case internalStatus.NotFound:
-			return status.Errorf(codes.NotFound, e.Message)
-		default:
-		}
-	}
-	log.Errorf("got an unhandled error: %s", err)
-	return status.Errorf(codes.Internal, "failed handling request")
-}
-
-func extractPeerMeta(loginReq *proto.LoginRequest) nbpeer.PeerSystemMeta {
-	osVersion := loginReq.GetMeta().GetOSVersion()
-	if osVersion == "" {
-		osVersion = loginReq.GetMeta().GetCore()
-	}
-
-	networkAddresses := make([]nbpeer.NetworkAddress, 0, len(loginReq.GetMeta().GetNetworkAddresses()))
-	for _, addr := range loginReq.GetMeta().GetNetworkAddresses() {
-		netAddr, err := netip.ParsePrefix(addr.GetNetIP())
-		if err != nil {
-			log.Warnf("failed to parse netip address, %s: %v", addr.GetNetIP(), err)
-			continue
-		}
-		networkAddresses = append(networkAddresses, nbpeer.NetworkAddress{
-			NetIP: netAddr,
-			Mac:   addr.GetMac(),
-		})
-	}
-
-	return nbpeer.PeerSystemMeta{
-		Hostname:           loginReq.GetMeta().GetHostname(),
-		GoOS:               loginReq.GetMeta().GetGoOS(),
-		Kernel:             loginReq.GetMeta().GetKernel(),
-		Platform:           loginReq.GetMeta().GetPlatform(),
-		OS:                 loginReq.GetMeta().GetOS(),
-		OSVersion:          osVersion,
-		WtVersion:          loginReq.GetMeta().GetWiretrusteeVersion(),
-		UIVersion:          loginReq.GetMeta().GetUiVersion(),
-		KernelVersion:      loginReq.GetMeta().GetKernelVersion(),
-		NetworkAddresses:   networkAddresses,
-		SystemSerialNumber: loginReq.GetMeta().GetSysSerialNumber(),
-		SystemProductName:  loginReq.GetMeta().GetSysProductName(),
-		SystemManufacturer: loginReq.GetMeta().GetSysManufacturer(),
-		Environment: nbpeer.Environment{
-			Cloud:    loginReq.GetMeta().GetEnvironment().GetCloud(),
-			Platform: loginReq.GetMeta().GetEnvironment().GetPlatform(),
-		},
-	}
-}
-
-func (s *GRPCServer) parseRequest(req *proto.EncryptedMessage, parsed pb.Message) (wgtypes.Key, error) {
-	peerKey, err := wgtypes.ParseKey(req.GetWgPubKey())
-	if err != nil {
-		log.Warnf("error while parsing peer's WireGuard public key %s.", req.WgPubKey)
-		return wgtypes.Key{}, status.Errorf(codes.InvalidArgument, "provided wgPubKey %s is invalid", req.WgPubKey)
-	}
-
-	err = encryption.DecryptMessage(peerKey, s.wgKey, req.Body, parsed)
-	if err != nil {
-		return wgtypes.Key{}, status.Errorf(codes.InvalidArgument, "invalid request message")
-	}
-
-	return peerKey, nil
-}
-
-// Login endpoint first checks whether peer is registered under any account
-// In case it is, the login is successful
-// In case it isn't, the endpoint checks whether setup key is provided within the request and tries to register a peer.
-// In case of the successful registration login is also successful
-func (s *GRPCServer) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
-	reqStart := time.Now()
-	defer func() {
-		if s.appMetrics != nil {
-			s.appMetrics.GRPCMetrics().CountLoginRequestDuration(time.Since(reqStart))
-		}
-	}()
-	if s.appMetrics != nil {
-		s.appMetrics.GRPCMetrics().CountLoginRequest()
-	}
-	realIP := getRealIP(ctx)
-	log.Debugf("Login request from peer [%s] [%s]", req.WgPubKey, realIP.String())
-
-	loginReq := &proto.LoginRequest{}
-	peerKey, err := s.parseRequest(req, loginReq)
-	if err != nil {
-		return nil, err
-	}
-
-	if loginReq.GetMeta() == nil {
-		msg := status.Errorf(codes.FailedPrecondition,
-			"peer system meta has to be provided to log in. Peer %s, remote addr %s", peerKey.String(), realIP)
-		log.Warn(msg)
-		return nil, msg
-	}
-
-	userID := ""
-	// JWT token is not always provided, it is fine for userID to be empty cuz it might be that peer is already registered,
-	// or it uses a setup key to register.
-	if loginReq.GetJwtToken() != "" {
-		userID, err = s.validateToken(loginReq.GetJwtToken())
-		if err != nil {
-			log.Warnf("failed validating JWT token sent from peer %s", peerKey)
-			return nil, err
-		}
-	}
-	var sshKey []byte
-	if loginReq.GetPeerKeys() != nil {
-		sshKey = loginReq.GetPeerKeys().GetSshPubKey()
-	}
-
-	peer, netMap, err := s.accountManager.LoginPeer(PeerLogin{
-		WireGuardPubKey: peerKey.String(),
-		SSHKey:          string(sshKey),
-		Meta:            extractPeerMeta(loginReq),
-		UserID:          userID,
-		SetupKey:        loginReq.GetSetupKey(),
-	})
-
-	if err != nil {
-		log.Warnf("failed logging in peer %s", peerKey)
-		return nil, mapError(err)
-	}
-
-	// if the login request contains setup key then it is a registration request
-	if loginReq.GetSetupKey() != "" {
-		s.ephemeralManager.OnPeerDisconnected(peer)
-	}
-
-	// if peer has reached this point then it has logged in
-	loginResp := &proto.LoginResponse{
-		WiretrusteeConfig: toWiretrusteeConfig(s.config, nil),
-		PeerConfig:        toPeerConfig(peer, netMap.Network, s.accountManager.GetDNSDomain()),
-	}
-	encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, loginResp)
-	if err != nil {
-		log.Warnf("failed encrypting peer %s message", peer.ID)
-		return nil, status.Errorf(codes.Internal, "failed logging in peer")
-	}
-
-	return &proto.EncryptedMessage{
-		WgPubKey: s.wgKey.PublicKey().String(),
-		Body:     encryptedResp,
-	}, nil
-}
-
-func ToResponseProto(configProto Protocol) proto.HostConfig_Protocol {
-	switch configProto {
-	case UDP:
-		return proto.HostConfig_UDP
-	case DTLS:
-		return proto.HostConfig_DTLS
-	case HTTP:
-		return proto.HostConfig_HTTP
-	case HTTPS:
-		return proto.HostConfig_HTTPS
-	case TCP:
-		return proto.HostConfig_TCP
-	default:
-		panic(fmt.Errorf("unexpected config protocol type %v", configProto))
-	}
-}
-
-func toWiretrusteeConfig(config *Config, turnCredentials *TURNCredentials) *proto.WiretrusteeConfig {
-	if config == nil {
-		return nil
-	}
-	var stuns []*proto.HostConfig
-	for _, stun := range config.Stuns {
-		stuns = append(stuns, &proto.HostConfig{
-			Uri:      stun.URI,
-			Protocol: ToResponseProto(stun.Proto),
-		})
-	}
-	var turns []*proto.ProtectedHostConfig
-	for _, turn := range config.TURNConfig.Turns {
-		var username string
-		var password string
-		if turnCredentials != nil {
-			username = turnCredentials.Username
-			password = turnCredentials.Password
-		} else {
-			username = turn.Username
-			password = turn.Password
-		}
-		turns = append(turns, &proto.ProtectedHostConfig{
-			HostConfig: &proto.HostConfig{
-				Uri:      turn.URI,
-				Protocol: ToResponseProto(turn.Proto),
-			},
-			User:     username,
-			Password: password,
-		})
-	}
-
-	return &proto.WiretrusteeConfig{
-		Stuns: stuns,
-		Turns: turns,
-		Signal: &proto.HostConfig{
-			Uri:      config.Signal.URI,
-			Protocol: ToResponseProto(config.Signal.Proto),
-		},
-	}
-}
-
-func toPeerConfig(peer *nbpeer.Peer, network *Network, dnsName string) *proto.PeerConfig {
-	netmask, _ := network.Net.Mask.Size()
-	fqdn := peer.FQDN(dnsName)
-	return &proto.PeerConfig{
-		Address:   fmt.Sprintf("%s/%d", peer.IP.String(), netmask), // take it from the network
-		SshConfig: &proto.SSHConfig{SshEnabled: peer.SSHEnabled},
-		Fqdn:      fqdn,
-	}
-}
-
-func toRemotePeerConfig(peers []*nbpeer.Peer, dnsName string) []*proto.RemotePeerConfig {
-	remotePeers := []*proto.RemotePeerConfig{}
-	for _, rPeer := range peers {
-		fqdn := rPeer.FQDN(dnsName)
-		remotePeers = append(remotePeers, &proto.RemotePeerConfig{
-			WgPubKey:   rPeer.Key,
-			AllowedIps: []string{fmt.Sprintf(AllowedIPsFormat, rPeer.IP)},
-			SshConfig:  &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
-			Fqdn:       fqdn,
-		})
-	}
-	return remotePeers
-}
-
-func toSyncResponse(config *Config, peer *nbpeer.Peer, turnCredentials *TURNCredentials, networkMap *NetworkMap, dnsName string) *proto.SyncResponse {
-	wtConfig := toWiretrusteeConfig(config, turnCredentials)
-
-	pConfig := toPeerConfig(peer, networkMap.Network, dnsName)
-
-	remotePeers := toRemotePeerConfig(networkMap.Peers, dnsName)
-
-	routesUpdate := toProtocolRoutes(networkMap.Routes)
-
-	dnsUpdate := toProtocolDNSConfig(networkMap.DNSConfig)
-
-	offlinePeers := toRemotePeerConfig(networkMap.OfflinePeers, dnsName)
-
-	firewallRules := toProtocolFirewallRules(networkMap.FirewallRules)
-
-	return &proto.SyncResponse{
-		WiretrusteeConfig:  wtConfig,
-		PeerConfig:         pConfig,
-		RemotePeers:        remotePeers,
-		RemotePeersIsEmpty: len(remotePeers) == 0,
-		NetworkMap: &proto.NetworkMap{
-			Serial:               networkMap.Network.CurrentSerial(),
-			PeerConfig:           pConfig,
-			RemotePeers:          remotePeers,
-			OfflinePeers:         offlinePeers,
-			RemotePeersIsEmpty:   len(remotePeers) == 0,
-			Routes:               routesUpdate,
-			DNSConfig:            dnsUpdate,
-			FirewallRules:        firewallRules,
-			FirewallRulesIsEmpty: len(firewallRules) == 0,
-		},
-	}
-}
-
-// IsHealthy indicates whether the service is healthy
-func (s *GRPCServer) IsHealthy(ctx context.Context, req *proto.Empty) (*proto.Empty, error) {
-	return &proto.Empty{}, nil
-}
-
-// sendInitialSync sends initial proto.SyncResponse to the peer requesting synchronization
-func (s *GRPCServer) sendInitialSync(peerKey wgtypes.Key, peer *nbpeer.Peer, networkMap *NetworkMap, srv proto.ManagementService_SyncServer) error {
-	// make secret time based TURN credentials optional
-	var turnCredentials *TURNCredentials
-	if s.config.TURNConfig.TimeBasedCredentials {
-		creds := s.turnCredentialsManager.GenerateCredentials()
-		turnCredentials = &creds
-	} else {
-		turnCredentials = nil
-	}
-	plainResp := toSyncResponse(s.config, peer, turnCredentials, networkMap, s.accountManager.GetDNSDomain())
-
-	encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, plainResp)
-	if err != nil {
-		return status.Errorf(codes.Internal, "error handling request")
-	}
-
-	err = srv.Send(&proto.EncryptedMessage{
-		WgPubKey: s.wgKey.PublicKey().String(),
-		Body:     encryptedResp,
-	})
-
-	if err != nil {
-		log.Errorf("failed sending SyncResponse %v", err)
-		return status.Errorf(codes.Internal, "error handling request")
-	}
-
-	return nil
-}
-
-// GetDeviceAuthorizationFlow returns a device authorization flow information
-// This is used for initiating an Oauth 2 device authorization grant flow
-// which will be used by our clients to Login
-func (s *GRPCServer) GetDeviceAuthorizationFlow(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
-	peerKey, err := wgtypes.ParseKey(req.GetWgPubKey())
-	if err != nil {
-		errMSG := fmt.Sprintf("error while parsing peer's Wireguard public key %s on GetDeviceAuthorizationFlow request.", req.WgPubKey)
-		log.Warn(errMSG)
-		return nil, status.Error(codes.InvalidArgument, errMSG)
-	}
-
-	err = encryption.DecryptMessage(peerKey, s.wgKey, req.Body, &proto.DeviceAuthorizationFlowRequest{})
-	if err != nil {
-		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
-		log.Warn(errMSG)
-		return nil, status.Error(codes.InvalidArgument, errMSG)
-	}
-
-	if s.config.DeviceAuthorizationFlow == nil || s.config.DeviceAuthorizationFlow.Provider == string(NONE) {
-		return nil, status.Error(codes.NotFound, "no device authorization flow information available")
-	}
-
-	provider, ok := proto.DeviceAuthorizationFlowProvider_value[strings.ToUpper(s.config.DeviceAuthorizationFlow.Provider)]
-	if !ok {
-		return nil, status.Errorf(codes.InvalidArgument, "no provider found in the protocol for %s", s.config.DeviceAuthorizationFlow.Provider)
-	}
-
-	flowInfoResp := &proto.DeviceAuthorizationFlow{
-		Provider: proto.DeviceAuthorizationFlowProvider(provider),
-		ProviderConfig: &proto.ProviderConfig{
-			ClientID:           s.config.DeviceAuthorizationFlow.ProviderConfig.ClientID,
-			ClientSecret:       s.config.DeviceAuthorizationFlow.ProviderConfig.ClientSecret,
-			Domain:             s.config.DeviceAuthorizationFlow.ProviderConfig.Domain,
-			Audience:           s.config.DeviceAuthorizationFlow.ProviderConfig.Audience,
-			DeviceAuthEndpoint: s.config.DeviceAuthorizationFlow.ProviderConfig.DeviceAuthEndpoint,
-			TokenEndpoint:      s.config.DeviceAuthorizationFlow.ProviderConfig.TokenEndpoint,
-			Scope:              s.config.DeviceAuthorizationFlow.ProviderConfig.Scope,
-			UseIDToken:         s.config.DeviceAuthorizationFlow.ProviderConfig.UseIDToken,
-		},
-	}
-
-	encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, flowInfoResp)
-	if err != nil {
-		return nil, status.Error(codes.Internal, "failed to encrypt no device authorization flow information")
-	}
-
-	return &proto.EncryptedMessage{
-		WgPubKey: s.wgKey.PublicKey().String(),
-		Body:     encryptedResp,
-	}, nil
-}
-
-// GetPKCEAuthorizationFlow returns a pkce authorization flow information
-// This is used for initiating an Oauth 2 pkce authorization grant flow
-// which will be used by our clients to Login
-func (s *GRPCServer) GetPKCEAuthorizationFlow(_ context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
-	peerKey, err := wgtypes.ParseKey(req.GetWgPubKey())
-	if err != nil {
-		errMSG := fmt.Sprintf("error while parsing peer's Wireguard public key %s on GetPKCEAuthorizationFlow request.", req.WgPubKey)
-		log.Warn(errMSG)
-		return nil, status.Error(codes.InvalidArgument, errMSG)
-	}
-
-	err = encryption.DecryptMessage(peerKey, s.wgKey, req.Body, &proto.PKCEAuthorizationFlowRequest{})
-	if err != nil {
-		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
-		log.Warn(errMSG)
-		return nil, status.Error(codes.InvalidArgument, errMSG)
-	}
-
-	if s.config.PKCEAuthorizationFlow == nil {
-		return nil, status.Error(codes.NotFound, "no pkce authorization flow information available")
-	}
-
-	flowInfoResp := &proto.PKCEAuthorizationFlow{
-		ProviderConfig: &proto.ProviderConfig{
-			Audience:              s.config.PKCEAuthorizationFlow.ProviderConfig.Audience,
-			ClientID:              s.config.PKCEAuthorizationFlow.ProviderConfig.ClientID,
-			ClientSecret:          s.config.PKCEAuthorizationFlow.ProviderConfig.ClientSecret,
-			TokenEndpoint:         s.config.PKCEAuthorizationFlow.ProviderConfig.TokenEndpoint,
-			AuthorizationEndpoint: s.config.PKCEAuthorizationFlow.ProviderConfig.AuthorizationEndpoint,
-			Scope:                 s.config.PKCEAuthorizationFlow.ProviderConfig.Scope,
-			RedirectURLs:          s.config.PKCEAuthorizationFlow.ProviderConfig.RedirectURLs,
-			UseIDToken:            s.config.PKCEAuthorizationFlow.ProviderConfig.UseIDToken,
-		},
-	}
-
-	encryptedResp, err := encryption.EncryptMessage(peerKey, s.wgKey, flowInfoResp)
-	if err != nil {
-		return nil, status.Error(codes.Internal, "failed to encrypt no pkce authorization flow information")
-	}
-
-	return &proto.EncryptedMessage{
-		WgPubKey: s.wgKey.PublicKey().String(),
-		Body:     encryptedResp,
-	}, nil
-}

management/refactor/mesh/controller.go

@@ -1,157 +0,0 @@
-package mesh
-
-import (
-	"github.com/netbirdio/management-integrations/integrations"
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/refactor/peers"
-	"github.com/netbirdio/netbird/management/refactor/policies"
-	"github.com/netbirdio/netbird/management/refactor/settings"
-	"github.com/netbirdio/netbird/management/refactor/store"
-	"github.com/netbirdio/netbird/management/refactor/users"
-	"github.com/netbirdio/netbird/management/server/activity"
-	"github.com/netbirdio/netbird/management/server/status"
-)
-
-type Controller interface {
-	LoginPeer()
-	SyncPeer()
-}
-
-type DefaultController struct {
-	store           store.Store
-	peersManager    peers.Manager
-	userManager     users.Manager
-	policiesManager policies.Manager
-	settingsManager settings.Manager
-}
-
-func NewDefaultController() *DefaultController {
-	storeStore, _ := store.NewDefaultStore(store.SqliteStoreEngine, "", nil)
-	settingsManager := settings.NewDefaultManager(storeStore)
-	peersManager := peers.NewDefaultManager(storeStore, settingsManager)
-	usersManager := users.NewDefaultManager(storeStore, peersManager)
-	policiesManager := policies.NewDefaultManager(storeStore, peersManager)
-
-	peersManager, settingsManager, usersManager, policiesManager, storeStore = integrations.InjectCloud(peersManager, policiesManager, settingsManager, usersManager, storeStore)
-
-	return &DefaultController{
-		store:           storeStore,
-		peersManager:    peersManager,
-		userManager:     usersManager,
-		policiesManager: policiesManager,
-		settingsManager: settingsManager,
-	}
-}
-
-func (c *DefaultController) LoginPeer(login peers.PeerLogin) {
-
-	peer, err := c.peersManager.GetPeerByPubKey(login.WireGuardPubKey)
-	if err != nil {
-		return nil, nil, status.Errorf(status.Unauthenticated, "peer is not registered")
-	}
-
-	if peer.AddedWithSSOLogin() {
-		user, err := c.userManager.GetUser(peer.GetUserID())
-		if err != nil {
-			return nil, nil, err
-		}
-		if user.IsBlocked() {
-			return nil, nil, status.Errorf(status.PermissionDenied, "user is blocked")
-		}
-	}
-
-	account, err := pm.accountManager.GetAccount(peer.GetAccountID())
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// this flag prevents unnecessary calls to the persistent store.
-	shouldStorePeer := false
-	updateRemotePeers := false
-	if peerLoginExpired(peer, account) {
-		err = checkAuth(login.UserID, peer)
-		if err != nil {
-			return nil, nil, err
-		}
-		// If peer was expired before and if it reached this point, it is re-authenticated.
-		// UserID is present, meaning that JWT validation passed successfully in the API layer.
-		peer.UpdateLastLogin()
-		updateRemotePeers = true
-		shouldStorePeer = true
-
-		pm.eventsManager.StoreEvent(login.UserID, peer.ID, account.Id, activity.UserLoggedInPeer, peer.EventMeta(pm.accountManager.GetDNSDomain()))
-	}
-
-	if peer.UpdateMetaIfNew(login.Meta) {
-		shouldStorePeer = true
-	}
-
-	if peer.CheckAndUpdatePeerSSHKey(login.SSHKey) {
-		shouldStorePeer = true
-	}
-
-	if shouldStorePeer {
-		err := pm.repository.updatePeer(peer)
-		if err != nil {
-			return nil, nil, err
-		}
-	}
-
-	if updateRemotePeers {
-		am.updateAccountPeers(account)
-	}
-	return peer, account.GetPeerNetworkMap(peer.ID, pm.accountManager.GetDNSDomain()), nil
-}
-
-func (c *DefaultController) SyncPeer() {
-
-}
-
-func (c *DefaultController) GetPeerNetworkMap(peerID, dnsDomain string) *NetworkMap {
-	peer, err := c.peersManager.GetNetworkPeerByID(peerID)
-	if err != nil {
-		return &NetworkMap{
-			Network: a.Network.Copy(),
-		}
-	}
-
-	aclPeers, firewallRules := c.policiesManager.GetAccessiblePeersAndFirewallRules(peerID)
-	// exclude expired peers
-	var peersToConnect []peers.Peer
-	var expiredPeers []peers.Peer
-	accSettings, _ := c.settingsManager.GetSettings(peer.GetAccountID())
-	for _, p := range aclPeers {
-		expired, _ := p.LoginExpired(accSettings.GetPeerLoginExpiration())
-		if accSettings.GetPeerLoginExpirationEnabled() && expired {
-			expiredPeers = append(expiredPeers, p)
-			continue
-		}
-		peersToConnect = append(peersToConnect, p)
-	}
-
-	routesUpdate := a.getRoutesToSync(peerID, peersToConnect)
-
-	dnsManagementStatus := a.getPeerDNSManagementStatus(peerID)
-	dnsUpdate := nbdns.Config{
-		ServiceEnable: dnsManagementStatus,
-	}
-
-	if dnsManagementStatus {
-		var zones []nbdns.CustomZone
-		peersCustomZone := getPeersCustomZone(a, dnsDomain)
-		if peersCustomZone.Domain != "" {
-			zones = append(zones, peersCustomZone)
-		}
-		dnsUpdate.CustomZones = zones
-		dnsUpdate.NameServerGroups = getPeerNSGroups(a, peerID)
-	}
-
-	return &NetworkMap{
-		Peers:         peersToConnect,
-		Network:       a.Network.Copy(),
-		Routes:        routesUpdate,
-		DNSConfig:     dnsUpdate,
-		OfflinePeers:  expiredPeers,
-		FirewallRules: firewallRules,
-	}
-}

management/refactor/mesh/network.go

@@ -1,15 +0,0 @@
-package mesh
-
-import (
-	nbdns "github.com/netbirdio/netbird/dns"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-)
-
-type NetworkMap struct {
-	Peers         []*nbpeer.Peer
-	Network       *Network
-	Routes        []*route.Route
-	DNSConfig     nbdns.Config
-	OfflinePeers  []*nbpeer.Peer
-	FirewallRules []*FirewallRule
-}

management/refactor/peers/manager.go

@@ -1,50 +0,0 @@
-package peers
-
-import (
-	"github.com/netbirdio/netbird/management/refactor/settings"
-)
-
-type Manager interface {
-	GetPeerByPubKey(pubKey string) (Peer, error)
-	GetPeerByID(id string) (Peer, error)
-	GetNetworkPeerByID(id string) (Peer, error)
-	GetNetworkPeersInAccount(id string) ([]Peer, error)
-}
-
-type DefaultManager struct {
-	repository      Repository
-	settingsManager settings.Manager
-}
-
-func NewDefaultManager(repository Repository, settingsManager settings.Manager) *DefaultManager {
-	return &DefaultManager{
-		repository:      repository,
-		settingsManager: settingsManager,
-	}
-}
-
-func (dm *DefaultManager) GetNetworkPeerByID(id string) (Peer, error) {
-	return dm.repository.FindPeerByID(id)
-}
-
-func (dm *DefaultManager) GetNetworkPeersInAccount(id string) ([]Peer, error) {
-	defaultPeers, err := dm.repository.FindAllPeersInAccount(id)
-	if err != nil {
-		return nil, err
-	}
-
-	peers := make([]Peer, len(defaultPeers))
-	for _, dp := range defaultPeers {
-		peers = append(peers, dp)
-	}
-
-	return peers, nil
-}
-
-func (dm *DefaultManager) GetPeerByPubKey(pubKey string) (Peer, error) {
-	return dm.repository.FindPeerByPubKey(pubKey)
-}
-
-func (dm *DefaultManager) GetPeerByID(id string) (Peer, error) {
-	return dm.repository.FindPeerByID(id)
-}

management/refactor/peers/peer.go

@@ -1,244 +0,0 @@
-package peers
-
-import (
-	"fmt"
-	"net"
-	"time"
-)
-
-type Peer interface {
-	GetID() string
-	SetID(string)
-	GetAccountID() string
-	SetAccountID(string)
-	GetKey() string
-	SetKey(string)
-	GetSetupKey() string
-	SetSetupKey(string)
-	GetIP() net.IP
-	SetIP(net.IP)
-	GetName() string
-	SetName(string)
-	GetDNSLabel() string
-	SetDNSLabel(string)
-	GetUserID() string
-	SetUserID(string)
-	GetSSHKey() string
-	SetSSHKey(string)
-	GetSSHEnabled() bool
-	SetSSHEnabled(bool)
-	AddedWithSSOLogin() bool
-	UpdateMetaIfNew(meta PeerSystemMeta) bool
-	MarkLoginExpired(expired bool)
-	FQDN(dnsDomain string) string
-	EventMeta(dnsDomain string) map[string]any
-	LoginExpired(expiresIn time.Duration) (bool, time.Duration)
-}
-
-// Peer represents a machine connected to the network.
-// The Peer is a WireGuard peer identified by a public key
-type DefaultPeer struct {
-	// ID is an internal ID of the peer
-	ID string `gorm:"primaryKey"`
-	// AccountID is a reference to Account that this object belongs
-	AccountID string `json:"-" gorm:"index;uniqueIndex:idx_peers_account_id_ip"`
-	// WireGuard public key
-	Key string `gorm:"index"`
-	// A setup key this peer was registered with
-	SetupKey string
-	// IP address of the Peer
-	IP net.IP `gorm:"uniqueIndex:idx_peers_account_id_ip"`
-	// Name is peer's name (machine name)
-	Name string
-	// DNSLabel is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's
-	// domain to the peer label. e.g. peer-dns-label.netbird.cloud
-	DNSLabel string
-	// The user ID that registered the peer
-	UserID string
-	// SSHKey is a public SSH key of the peer
-	SSHKey string
-	// SSHEnabled indicates whether SSH server is enabled on the peer
-	SSHEnabled bool
-	// LoginExpirationEnabled indicates whether peer's login expiration is enabled and once expired the peer has to re-login.
-	// Works with LastLogin
-	LoginExpirationEnabled bool
-	// LastLogin the time when peer performed last login operation
-	LastLogin time.Time
-	// Indicate ephemeral peer attribute
-	Ephemeral bool
-}
-
-// PeerLogin used as a data object between the gRPC API and AccountManager on Login request.
-type PeerLogin struct {
-	// WireGuardPubKey is a peers WireGuard public key
-	WireGuardPubKey string
-	// SSHKey is a peer's ssh key. Can be empty (e.g., old version do not provide it, or this feature is disabled)
-	SSHKey string
-	// Meta is the system information passed by peer, must be always present.
-	Meta PeerSystemMeta
-	// UserID indicates that JWT was used to log in, and it was valid. Can be empty when SetupKey is used or auth is not required.
-	UserID string
-	// AccountID indicates that JWT was used to log in, and it was valid. Can be empty when SetupKey is used or auth is not required.
-	AccountID string
-	// SetupKey references to a server.SetupKey to log in. Can be empty when UserID is used or auth is not required.
-	SetupKey string
-}
-
-// AddedWithSSOLogin indicates whether this peer has been added with an SSO login by a user.
-func (p *DefaultPeer) AddedWithSSOLogin() bool {
-	return p.UserID != ""
-}
-
-// UpdateMetaIfNew updates peer's system metadata if new information is provided
-// returns true if meta was updated, false otherwise
-func (p *DefaultPeer) UpdateMetaIfNew(meta PeerSystemMeta) bool {
-	// Avoid overwriting UIVersion if the update was triggered sole by the CLI client
-	if meta.UIVersion == "" {
-		meta.UIVersion = p.Meta.UIVersion
-	}
-
-	if p.Meta.isEqual(meta) {
-		return false
-	}
-	p.Meta = meta
-	return true
-}
-
-// MarkLoginExpired marks peer's status expired or not
-func (p *DefaultPeer) MarkLoginExpired(expired bool) {
-	newStatus := p.Status.Copy()
-	newStatus.LoginExpired = expired
-	if expired {
-		newStatus.Connected = false
-	}
-	p.Status = newStatus
-}
-
-// LoginExpired indicates whether the peer's login has expired or not.
-// If Peer.LastLogin plus the expiresIn duration has happened already; then login has expired.
-// Return true if a login has expired, false otherwise, and time left to expiration (negative when expired).
-// Login expiration can be disabled/enabled on a Peer level via Peer.LoginExpirationEnabled property.
-// Login expiration can also be disabled/enabled globally on the Account level via Settings.PeerLoginExpirationEnabled.
-// Only peers added by interactive SSO login can be expired.
-func (p *DefaultPeer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
-	if !p.AddedWithSSOLogin() || !p.LoginExpirationEnabled {
-		return false, 0
-	}
-	expiresAt := p.LastLogin.Add(expiresIn)
-	now := time.Now()
-	timeLeft := expiresAt.Sub(now)
-	return timeLeft <= 0, timeLeft
-}
-
-// FQDN returns peers FQDN combined of the peer's DNS label and the system's DNS domain
-func (p *DefaultPeer) FQDN(dnsDomain string) string {
-	if dnsDomain == "" {
-		return ""
-	}
-	return fmt.Sprintf("%s.%s", p.DNSLabel, dnsDomain)
-}
-
-// EventMeta returns activity event meta related to the peer
-func (p *DefaultPeer) EventMeta(dnsDomain string) map[string]any {
-	return map[string]any{"name": p.Name, "fqdn": p.FQDN(dnsDomain), "ip": p.IP, "created_at": p.CreatedAt}
-}
-
-func (p *DefaultPeer) GetID() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetID(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetAccountID() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetAccountID(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetKey() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetKey(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetSetupKey() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetSetupKey(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetIP() net.IP {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetIP(ip net.IP) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetName() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetName(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetDNSLabel() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetDNSLabel(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetUserID() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetUserID(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetSSHKey() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetSSHKey(s string) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) GetSSHEnabled() bool {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (p *DefaultPeer) SetSSHEnabled(b bool) {
-	// TODO implement me
-	panic("implement me")
-}

management/refactor/peers/repository.go

@@ -1,8 +0,0 @@
-package peers
-
-type Repository interface {
-	FindPeerByPubKey(pubKey string) (Peer, error)
-	FindPeerByID(id string) (Peer, error)
-	FindAllPeersInAccount(id string) ([]Peer, error)
-	UpdatePeer(peer Peer) error
-}

management/refactor/policies/manager.go

@@ -1,30 +0,0 @@
-package policies
-
-import "github.com/netbirdio/netbird/management/refactor/peers"
-
-type Manager interface {
-	GetAccessiblePeersAndFirewallRules(peerID string) (peers []peers.Peer, firewallRules []*FirewallRule)
-}
-
-type DefaultManager struct {
-	repository  repository
-	peerManager peers.Manager
-}
-
-func NewDefaultManager(repository repository, peerManager peers.Manager) *DefaultManager {
-	return &DefaultManager{
-		repository:  repository,
-		peerManager: peerManager,
-	}
-}
-
-func (dm *DefaultManager) GetAccessiblePeersAndFirewallRules(peerID string) (peers []peers.Peer, firewallRules []*FirewallRule) {
-	peer, err := dm.peerManager.GetPeerByID(peerID)
-	if err != nil {
-		return nil, nil
-	}
-
-	peers, err = dm.peerManager.GetNetworkPeersInAccount(peer.GetAccountID())
-
-	return peers, nil
-}

management/refactor/policies/policy.go

@@ -1,7 +0,0 @@
-package policies
-
-type Policy interface {
-}
-
-type DefaultPolicy struct {
-}

management/refactor/policies/repository.go

@@ -1,4 +0,0 @@
-package policies
-
-type Repository interface {
-}

management/refactor/settings/manager.go

@@ -1,19 +0,0 @@
-package settings
-
-type Manager interface {
-	GetSettings(accountID string) (Settings, error)
-}
-
-type DefaultManager struct {
-	repository repository
-}
-
-func NewDefaultManager(repository repository) *DefaultManager {
-	return &DefaultManager{
-		repository: repository,
-	}
-}
-
-func (dm *DefaultManager) GetSettings(accountID string) (Settings, error) {
-	return dm.repository.FindSettings(accountID)
-}

management/refactor/settings/repository.go

@@ -1,5 +0,0 @@
-package settings
-
-type Repository interface {
-	FindSettings(accountID string) (Settings, error)
-}

management/refactor/settings/settings.go

@@ -1,34 +0,0 @@
-package settings
-
-import "time"
-
-type Settings interface {
-	GetLicense() string
-	GetPeerLoginExpiration() time.Duration
-	SetPeerLoginExpiration(duration time.Duration)
-	GetPeerLoginExpirationEnabled() bool
-	SetPeerLoginExpirationEnabled(bool)
-}
-
-type DefaultSettings struct {
-}
-
-func (s *DefaultSettings) GetLicense() string {
-	return "selfhosted"
-}
-
-func (s *DefaultSettings) GetPeerLoginExpiration() time.Duration {
-	return 0
-}
-
-func (s *DefaultSettings) SetPeerLoginExpiration(duration time.Duration) {
-
-}
-
-func (s *DefaultSettings) GetPeerLoginExpirationEnabled() bool {
-	return false
-}
-
-func (s *DefaultSettings) SetPeerLoginExpirationEnabled(bool) {
-
-}

management/refactor/store/postgres_store.go

@@ -1,51 +0,0 @@
-package store
-
-import (
-	"github.com/netbirdio/netbird/management/refactor/peers"
-	"github.com/netbirdio/netbird/management/refactor/settings"
-)
-
-const (
-	PostgresStoreEngine StoreEngine = "postgres"
-)
-
-type DefaultPostgresStore struct {
-}
-
-func (s *DefaultPostgresStore) FindSettings(accountID string) (settings.Settings, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultPostgresStore) FindPeerByPubKey(pubKey string) (peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultPostgresStore) FindPeerByID(id string) (peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultPostgresStore) FindAllPeersInAccount(id string) ([]peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultPostgresStore) UpdatePeer(peer peers.Peer) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultPostgresStore) GetLicense() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-func NewDefaultPostgresStore() *DefaultPostgresStore {
-	return &DefaultPostgresStore{}
-}
-
-func (s *DefaultPostgresStore) GetEngine() StoreEngine {
-	return PostgresStoreEngine
-}

management/refactor/store/sqlite_store.go

@@ -1,166 +0,0 @@
-package store
-
-import (
-	"path/filepath"
-	"runtime"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-	"gorm.io/gorm/logger"
-
-	"github.com/netbirdio/netbird/management/refactor/peers"
-	"github.com/netbirdio/netbird/management/refactor/settings"
-	"github.com/netbirdio/netbird/management/server/telemetry"
-)
-
-const (
-	SqliteStoreEngine StoreEngine = "sqlite"
-)
-
-// SqliteStore represents an account storage backed by a Sqlite DB persisted to disk
-type DefaultSqliteStore struct {
-	db                *gorm.DB
-	storeFile         string
-	accountLocks      sync.Map
-	globalAccountLock sync.Mutex
-	metrics           telemetry.AppMetrics
-	installationPK    int
-}
-
-func (s *DefaultSqliteStore) FindSettings(accountID string) (settings.Settings, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultSqliteStore) FindPeerByPubKey(pubKey string) (peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultSqliteStore) FindPeerByID(id string) (peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultSqliteStore) FindAllPeersInAccount(id string) ([]peers.Peer, error) {
-	// TODO implement me
-	panic("implement me")
-}
-
-func (s *DefaultSqliteStore) UpdatePeer(peer peers.Peer) error {
-	// TODO implement me
-	panic("implement me")
-}
-
-type installation struct {
-	ID                  uint `gorm:"primaryKey"`
-	InstallationIDValue string
-}
-
-// NewSqliteStore restores a store from the file located in the datadir
-func NewDefaultSqliteStore(dataDir string, metrics telemetry.AppMetrics) (*DefaultSqliteStore, error) {
-	storeStr := "store.db?cache=shared"
-	if runtime.GOOS == "windows" {
-		// Vo avoid `The process cannot access the file because it is being used by another process` on Windows
-		storeStr = "store.db"
-	}
-
-	file := filepath.Join(dataDir, storeStr)
-	db, err := gorm.Open(sqlite.Open(file), &gorm.Config{
-		Logger:      logger.Default.LogMode(logger.Silent),
-		PrepareStmt: true,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	sql, err := db.DB()
-	if err != nil {
-		return nil, err
-	}
-	conns := runtime.NumCPU()
-	sql.SetMaxOpenConns(conns) // TODO: make it configurable
-
-	// err = db.AutoMigrate(
-	// 	&SetupKey{}, &Peer{}, &User{}, &PersonalAccessToken{}, &Group{}, &Rule{},
-	// 	&Account{}, &Policy{}, &PolicyRule{}, &route.Route{}, &nbdns.NameServerGroup{},
-	// 	&installation{},
-	// )
-	// if err != nil {
-	// 	return nil, err
-	// }
-
-	return &DefaultSqliteStore{db: db, storeFile: file, metrics: metrics, installationPK: 1}, nil
-}
-
-func (s *DefaultSqliteStore) GetLicense() string {
-	// TODO implement me
-	panic("implement me")
-}
-
-// AcquireGlobalLock acquires global lock across all the accounts and returns a function that releases the lock
-func (s *DefaultSqliteStore) AcquireGlobalLock() (unlock func()) {
-	log.Debugf("acquiring global lock")
-	start := time.Now()
-	s.globalAccountLock.Lock()
-
-	unlock = func() {
-		s.globalAccountLock.Unlock()
-		log.Debugf("released global lock in %v", time.Since(start))
-	}
-
-	took := time.Since(start)
-	log.Debugf("took %v to acquire global lock", took)
-	if s.metrics != nil {
-		s.metrics.StoreMetrics().CountGlobalLockAcquisitionDuration(took)
-	}
-
-	return unlock
-}
-
-func (s *DefaultSqliteStore) AcquireAccountLock(accountID string) (unlock func()) {
-	log.Debugf("acquiring lock for account %s", accountID)
-
-	start := time.Now()
-	value, _ := s.accountLocks.LoadOrStore(accountID, &sync.Mutex{})
-	mtx := value.(*sync.Mutex)
-	mtx.Lock()
-
-	unlock = func() {
-		mtx.Unlock()
-		log.Debugf("released lock for account %s in %v", accountID, time.Since(start))
-	}
-
-	return unlock
-}
-
-func (s *DefaultSqliteStore) SaveInstallationID(ID string) error {
-	installation := installation{InstallationIDValue: ID}
-	installation.ID = uint(s.installationPK)
-
-	return s.db.Clauses(clause.OnConflict{UpdateAll: true}).Create(&installation).Error
-}
-
-func (s *DefaultSqliteStore) GetInstallationID() string {
-	var installation installation
-
-	if result := s.db.First(&installation, "id = ?", s.installationPK); result.Error != nil {
-		return ""
-	}
-
-	return installation.InstallationIDValue
-}
-
-// Close is noop in Sqlite
-func (s *DefaultSqliteStore) Close() error {
-	return nil
-}
-
-// GetStoreEngine returns SqliteStoreEngine
-func (s *DefaultSqliteStore) GetStoreEngine() StoreEngine {
-	return SqliteStoreEngine
-}

management/refactor/store/store.go

@@ -1,66 +0,0 @@
-package store
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/management/refactor/peers"
-	"github.com/netbirdio/netbird/management/refactor/settings"
-	"github.com/netbirdio/netbird/management/server/telemetry"
-)
-
-type Store interface {
-	GetLicense() string
-	FindPeerByPubKey(pubKey string) (peers.Peer, error)
-	FindPeerByID(id string) (peers.Peer, error)
-	FindAllPeersInAccount(id string) ([]peers.Peer, error)
-	UpdatePeer(peer peers.Peer) error
-	FindSettings(accountID string) (settings.Settings, error)
-}
-
-type DefaultStore interface {
-	GetLicense() string
-	FindPeerByPubKey(pubKey string) (peers.Peer, error)
-	FindPeerByID(id string) (peers.Peer, error)
-	FindAllPeersInAccount(id string) ([]peers.Peer, error)
-	UpdatePeer(peer peers.Peer) error
-	FindSettings(accountID string) (settings.Settings, error)
-}
-
-type StoreEngine string
-
-func getStoreEngineFromEnv() StoreEngine {
-	// NETBIRD_STORE_ENGINE supposed to be used in tests. Otherwise rely on the config file.
-	kind, ok := os.LookupEnv("NETBIRD_STORE_ENGINE")
-	if !ok {
-		return SqliteStoreEngine
-	}
-
-	value := StoreEngine(strings.ToLower(kind))
-
-	if value == PostgresStoreEngine || value == SqliteStoreEngine {
-		return value
-	}
-
-	return SqliteStoreEngine
-}
-
-func NewDefaultStore(kind StoreEngine, dataDir string, metrics telemetry.AppMetrics) (DefaultStore, error) {
-	if kind == "" {
-		// fallback to env. Normally this only should be used from tests
-		kind = getStoreEngineFromEnv()
-	}
-	switch kind {
-	case PostgresStoreEngine:
-		log.Info("using JSON file store engine")
-		return NewDefaultPostgresStore(), nil
-	case SqliteStoreEngine:
-		log.Info("using SQLite store engine")
-		return NewDefaultSqliteStore(dataDir, metrics)
-	default:
-		return nil, fmt.Errorf("unsupported kind of store %s", kind)
-	}
-}

management/refactor/users/manager.go

@@ -1,24 +0,0 @@
-package users
-
-import "github.com/netbirdio/netbird/management/refactor/peers"
-
-type Manager interface {
-	GetUser(id string) (User, error)
-}
-
-type DefaultManager struct {
-	repository  repository
-	peerManager peers.Manager
-}
-
-func NewDefaultManager(repository repository, peerManager peers.Manager) *DefaultManager {
-	return &DefaultManager{
-		repository:  repository,
-		peerManager: peerManager,
-	}
-}
-
-func (d DefaultManager) GetUser(id string) (User, error) {
-	// TODO implement me
-	panic("implement me")
-}

management/refactor/users/repository.go

@@ -1,4 +0,0 @@
-package users
-
-type Repository interface {
-}

management/refactor/users/user.go

@@ -1,35 +0,0 @@
-package users
-
-import "time"
-
-// UserRole is the role of a User
-type UserRole string
-
-type User interface {
-	IsBlocked() bool
-}
-
-// User represents a user of the system
-type DefaultUser struct {
-	Id string `gorm:"primaryKey"`
-	// AccountID is a reference to Account that this object belongs
-	AccountID     string `json:"-" gorm:"index"`
-	Role          UserRole
-	IsServiceUser bool
-	// NonDeletable indicates whether the service user can be deleted
-	NonDeletable bool
-	// ServiceUserName is only set if IsServiceUser is true
-	ServiceUserName string
-	// AutoGroups is a list of Group IDs to auto-assign to peers registered by this user
-	AutoGroups []string `gorm:"serializer:json"`
-	// Blocked indicates whether the user is blocked. Blocked users can't use the system.
-	Blocked bool
-	// LastLogin is the last time the user logged in to IdP
-	LastLogin time.Time
-	// Issued of the user
-	Issued string `gorm:"default:api"`
-}
-
-func (u *DefaultUser) IsBlocked() bool {
-	return u.Blocked
-}

management/server/account.go

@@ -72,6 +72,7 @@ type AccountManager interface {
 	CheckUserAccessByJWTGroups(claims jwtclaims.AuthorizationClaims) error
 	GetAccountFromPAT(pat string) (*Account, *User, *PersonalAccessToken, error)
 	DeleteAccount(accountID, userID string) error
+	GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error)
 	MarkPATUsed(tokenID string) error
 	GetUser(claims jwtclaims.AuthorizationClaims) (*User, error)
 	ListUsers(accountID string) ([]*User, error)
@@ -125,7 +126,6 @@ type AccountManager interface {
 	SavePostureChecks(accountID, userID string, postureChecks *posture.Checks) error
 	DeletePostureChecks(accountID, postureChecksID, userID string) error
 	ListPostureChecks(accountID, userID string) ([]*posture.Checks, error)
-	GetIdpManager() idp.Manager
 }
 
 type DefaultAccountManager struct {
@@ -205,7 +205,6 @@ type Account struct {
 
 	// User.Id it was created by
 	CreatedBy              string
-	CreatedAt              time.Time
 	Domain                 string `gorm:"index"`
 	DomainCategory         string
 	IsDomainPrimaryAccount bool
@@ -232,6 +231,14 @@ type Account struct {
 	RulesG []Rule           `json:"-" gorm:"-"`
 }
 
+// AccountUsageStats represents the current usage statistics for an account
+type AccountUsageStats struct {
+	ActiveUsers int64 `json:"active_users"`
+	TotalUsers  int64 `json:"total_users"`
+	ActivePeers int64 `json:"active_peers"`
+	TotalPeers  int64 `json:"total_peers"`
+}
+
 type UserInfo struct {
 	ID                   string               `json:"id"`
 	Email                string               `json:"email"`
@@ -455,11 +462,6 @@ func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 		}
 		_, duration := peer.LoginExpired(a.Settings.PeerLoginExpiration)
 		if nextExpiry == nil || duration < *nextExpiry {
-			// if expiration is below 1s return 1s duration
-			// this avoids issues with ticker that can't be set to < 0
-			if duration < time.Second {
-				return time.Second, true
-			}
 			nextExpiry = &duration
 		}
 	}
@@ -681,7 +683,6 @@ func (a *Account) Copy() *Account {
 	return &Account{
 		Id:                     a.Id,
 		CreatedBy:              a.CreatedBy,
-		CreatedAt:              a.CreatedAt,
 		Domain:                 a.Domain,
 		DomainCategory:         a.DomainCategory,
 		IsDomainPrimaryAccount: a.IsDomainPrimaryAccount,
@@ -899,10 +900,6 @@ func (am *DefaultAccountManager) GetExternalCacheManager() ExternalCacheManager
 	return am.externalCacheManager
 }
 
-func (am *DefaultAccountManager) GetIdpManager() idp.Manager {
-	return am.idpManager
-}
-
 // UpdateAccountSettings updates Account settings.
 // Only users with role UserRoleAdmin can update the account.
 // User that performs the update has to belong to the account.
@@ -920,7 +917,12 @@ func (am *DefaultAccountManager) UpdateAccountSettings(accountID, userID string,
 	unlock := am.Store.AcquireAccountLock(accountID)
 	defer unlock()
 
-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccountByUser(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	err = additions.ValidateExtraSettings(newSettings.Extra, account.Settings.Extra, account.Peers, userID, accountID, am.eventStore)
 	if err != nil {
 		return nil, err
 	}
@@ -934,11 +936,6 @@ func (am *DefaultAccountManager) UpdateAccountSettings(accountID, userID string,
 		return nil, status.Errorf(status.PermissionDenied, "user is not allowed to update account")
 	}
 
-	err = additions.ValidateExtraSettings(newSettings.Extra, account.Settings.Extra, account.Peers, userID, accountID, am.eventStore)
-	if err != nil {
-		return nil, err
-	}
-
 	oldSettings := account.Settings
 	if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
 		event := activity.AccountPeerLoginExpirationEnabled
@@ -1117,6 +1114,17 @@ func (am *DefaultAccountManager) DeleteAccount(accountID, userID string) error {
 	return nil
 }
 
+// GetUsage returns the usage stats for the given account.
+// This cannot be used to calculate usage stats for a period in the past as it relies on peers' last seen time.
+func (am *DefaultAccountManager) GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	usageStats, err := am.Store.CalculateUsageStats(ctx, accountID, start, end)
+	if err != nil {
+		return nil, fmt.Errorf("failed to calculate usage stats: %w", err)
+	}
+
+	return usageStats, nil
+}
+
 // GetAccountByUserOrAccountID looks for an account by user or accountID, if no account is provided and
 // userID doesn't have an account associated with it, one account is created
 // domain is used to create a new account if no account is found
@@ -1862,7 +1870,6 @@ func newAccountWithId(accountID, userID, domain string) *Account {
 
 	acc := &Account{
 		Id:               accountID,
-		CreatedAt:        time.Now().UTC(),
 		SetupKeys:        setupKeys,
 		Network:          network,
 		Peers:            peers,

management/server/account_test.go

@@ -94,10 +94,6 @@ func verifyNewAccountHasDefaultFields(t *testing.T, account *Account, createdBy
 		t.Errorf("expecting newly created account to be created by user %s, got %s", createdBy, account.CreatedBy)
 	}
 
-	if account.CreatedAt.IsZero() {
-		t.Errorf("expecting newly created account to have a non-zero creation time")
-	}
-
 	if account.Domain != domain {
 		t.Errorf("expecting newly created account to have domain %s, got %s", domain, account.Domain)
 	}
@@ -1477,7 +1473,6 @@ func TestAccount_Copy(t *testing.T) {
 	account := &Account{
 		Id:                     "account1",
 		CreatedBy:              "tester",
-		CreatedAt:              time.Now().UTC(),
 		Domain:                 "test.com",
 		DomainCategory:         "public",
 		IsDomainPrimaryAccount: true,

management/server/activity/event.go

@@ -9,7 +9,7 @@ const (
 )
 
 // ActivityDescriber is an interface that describes an activity
-type ActivityDescriber interface { //nolint:revive
+type ActivityDescriber interface {
 	StringCode() string
 	Message() string
 }

management/server/file_store.go

@@ -1,6 +1,8 @@
 package server
 
 import (
+	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -662,3 +664,40 @@ func (s *FileStore) Close() error {
 func (s *FileStore) GetStoreEngine() StoreEngine {
 	return FileStoreEngine
 }
+
+// CalculateUsageStats returns the usage stats for an account
+// start and end are inclusive.
+func (s *FileStore) CalculateUsageStats(_ context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	account, exists := s.Accounts[accountID]
+	if !exists {
+		return nil, fmt.Errorf("account not found")
+	}
+
+	stats := &AccountUsageStats{
+		TotalUsers: 0,
+		TotalPeers: int64(len(account.Peers)),
+	}
+
+	for _, user := range account.Users {
+		if !user.IsServiceUser {
+			stats.TotalUsers++
+		}
+	}
+
+	activeUsers := make(map[string]bool)
+	for _, peer := range account.Peers {
+		lastSeen := peer.Status.LastSeen
+		if lastSeen.Compare(start) >= 0 && lastSeen.Compare(end) <= 0 {
+			if _, exists := account.Users[peer.UserID]; exists && !activeUsers[peer.UserID] {
+				activeUsers[peer.UserID] = true
+				stats.ActiveUsers++
+			}
+			stats.ActivePeers++
+		}
+	}
+
+	return stats, nil
+}

management/server/file_store_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"crypto/sha256"
 	"net"
 	"path/filepath"
@@ -657,3 +658,32 @@ func newStore(t *testing.T) *FileStore {
 
 	return store
 }
+
+func TestFileStore_CalculateUsageStats(t *testing.T) {
+	storeDir := t.TempDir()
+
+	err := util.CopyFileContents("testdata/store_stats.json", filepath.Join(storeDir, "store.json"))
+	require.NoError(t, err)
+
+	store, err := NewFileStore(storeDir, nil)
+	require.NoError(t, err)
+
+	startDate := time.Date(2024, time.February, 1, 0, 0, 0, 0, time.UTC)
+	endDate := startDate.AddDate(0, 1, 0).Add(-time.Nanosecond)
+
+	stats1, err := store.CalculateUsageStats(context.TODO(), "account-1", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(2), stats1.ActiveUsers)
+	assert.Equal(t, int64(4), stats1.TotalUsers)
+	assert.Equal(t, int64(3), stats1.ActivePeers)
+	assert.Equal(t, int64(7), stats1.TotalPeers)
+
+	stats2, err := store.CalculateUsageStats(context.TODO(), "account-2", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(1), stats2.ActiveUsers)
+	assert.Equal(t, int64(2), stats2.TotalUsers)
+	assert.Equal(t, int64(1), stats2.ActivePeers)
+	assert.Equal(t, int64(2), stats2.TotalPeers)
+}

management/server/geolocation/database.go

@@ -3,7 +3,6 @@ package geolocation
 import (
 	"encoding/csv"
 	"fmt"
-	"io"
 	"net/url"
 	"os"
 	"path"
@@ -36,7 +35,7 @@ func loadGeolocationDatabases(dataDir string) error {
 				if err := decompressTarGzFile(src, dst); err != nil {
 					return err
 				}
-				return copyFile(path.Join(dst, MMDBFileName), path.Join(dataDir, MMDBFileName))
+				return os.Rename(path.Join(dst, MMDBFileName), path.Join(dataDir, MMDBFileName))
 			}
 			if err := loadDatabase(
 				geoLiteCitySha256TarURL,
@@ -186,25 +185,3 @@ func getDatabaseFileName(urlStr string) string {
 	fileName := fmt.Sprintf("%s.%s", path.Base(u.Path), ext)
 	return fileName
 }
-
-// copyFile performs a file copy operation from the source file to the destination.
-func copyFile(src string, dst string) error {
-	srcFile, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer srcFile.Close()
-
-	dstFile, err := os.Create(dst)
-	if err != nil {
-		return err
-	}
-	defer dstFile.Close()
-
-	_, err = io.Copy(dstFile, srcFile)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

management/server/grpcserver.go

@@ -288,10 +288,6 @@ func extractPeerMeta(loginReq *proto.LoginRequest) nbpeer.PeerSystemMeta {
 		SystemSerialNumber: loginReq.GetMeta().GetSysSerialNumber(),
 		SystemProductName:  loginReq.GetMeta().GetSysProductName(),
 		SystemManufacturer: loginReq.GetMeta().GetSysManufacturer(),
-		Environment: nbpeer.Environment{
-			Cloud:    loginReq.GetMeta().GetEnvironment().GetCloud(),
-			Platform: loginReq.GetMeta().GetEnvironment().GetPlatform(),
-		},
 	}
 }
 

management/server/http/api/openapi.yml

@@ -121,7 +121,7 @@ components:
           description: Last time this user performed a login to the dashboard
           type: string
           format: date-time
-          example: "2023-05-05T09:00:35.477782Z"
+          example: 2023-05-05T09:00:35.477782Z
         auto_groups:
           description: Group IDs to auto-assign to peers registered by this user
           type: array
@@ -259,7 +259,7 @@ components:
               description: Last time peer connected to Netbird's management service
               type: string
               format: date-time
-              example: "2023-05-05T10:05:26.420578Z"
+              example: 2023-05-05T10:05:26.420578Z
             os:
               description: Peer's operating system and version
               type: string
@@ -313,7 +313,7 @@ components:
               description: Last time this peer performed log in (authentication). E.g., user authenticated.
               type: string
               format: date-time
-              example: "2023-05-05T09:00:35.477782Z"
+              example: 2023-05-05T09:00:35.477782Z
             approval_required:
               description: (Cloud only) Indicates whether peer needs approval
               type: boolean
@@ -405,7 +405,7 @@ components:
           description: Setup Key expiration date
           type: string
           format: date-time
-          example: "2023-06-01T14:47:22.291057Z"
+          example: 2023-06-01T14:47:22.291057Z
         type:
           description: Setup key type, one-off for single time usage and reusable
           type: string
@@ -426,7 +426,7 @@ components:
           description: Setup key last usage date
           type: string
           format: date-time
-          example: "2023-05-05T09:00:35.477782Z"
+          example: 2023-05-05T09:00:35.477782Z
         state:
           description: Setup key status, "valid", "overused","expired" or "revoked"
           type: string
@@ -441,7 +441,7 @@ components:
           description: Setup key last update date
           type: string
           format: date-time
-          example: "2023-05-05T09:00:35.477782Z"
+          example: 2023-05-05T09:00:35.477782Z
         usage_limit:
           description: A number of times this key can be used. The value of 0 indicates the unlimited usage.
           type: integer
@@ -522,7 +522,7 @@ components:
           description: Date the token expires
           type: string
           format: date-time
-          example: "2023-05-05T14:38:28.977616Z"
+          example: 2023-05-05T14:38:28.977616Z
         created_by:
           description: User ID of the user who created the token
           type: string
@@ -531,12 +531,12 @@ components:
           description: Date the token was created
           type: string
           format: date-time
-          example: "2023-05-02T14:48:20.465209Z"
+          example: 2023-05-02T14:48:20.465209Z
         last_used:
           description: Date the token was last used
           type: string
           format: date-time
-          example: "2023-05-04T12:45:25.9723616Z"
+          example: 2023-05-04T12:45:25.9723616Z
       required:
         - id
         - name
@@ -862,8 +862,8 @@ components:
           $ref: '#/components/schemas/OSVersionCheck'
         geo_location_check:
           $ref: '#/components/schemas/GeoLocationCheck'
-        peer_network_range_check:
-          $ref: '#/components/schemas/PeerNetworkRangeCheck'
+        private_network_check:
+          $ref: '#/components/schemas/PrivateNetworkCheck'
     NBVersionCheck:
       description: Posture check for the version of NetBird
       type: object
@@ -934,16 +934,16 @@ components:
       required:
         - locations
         - action
-    PeerNetworkRangeCheck:
-      description: Posture check for allow or deny access based on peer local network addresses
+    PrivateNetworkCheck:
+      description: Posture check for allow or deny private network
       type: object
       properties:
         ranges:
-          description: List of peer network ranges in CIDR notation
+          description: List of private network ranges in CIDR notation
           type: array
           items:
             type: string
-            example: ["192.168.1.0/24", "10.0.0.0/8", "2001:db8:1234:1a00::/56"]
+            example: ["192.168.1.0/24", "10.0.0.0/8"]
         action:
           description: Action to take upon policy match
           type: string
@@ -979,7 +979,7 @@ components:
           type: string
           example: "Germany"
         country_code:
-          $ref: '#/components/schemas/CountryCode'
+            $ref: '#/components/schemas/CountryCode'
       required:
         - country_name
         - country_code
@@ -1197,7 +1197,7 @@ components:
           description: The date and time when the event occurred
           type: string
           format: date-time
-          example: "2023-05-05T10:04:37.473542Z"
+          example: 2023-05-05T10:04:37.473542Z
         activity:
           description: The activity that occurred during the event
           type: string

management/server/http/api/types.gen.go

@@ -74,12 +74,6 @@ const (
 	NameserverNsTypeUdp NameserverNsType = "udp"
 )
 
-// Defines values for PeerNetworkRangeCheckAction.
-const (
-	PeerNetworkRangeCheckActionAllow PeerNetworkRangeCheckAction = "allow"
-	PeerNetworkRangeCheckActionDeny  PeerNetworkRangeCheckAction = "deny"
-)
-
 // Defines values for PolicyRuleAction.
 const (
 	PolicyRuleActionAccept PolicyRuleAction = "accept"
@@ -122,6 +116,12 @@ const (
 	PolicyRuleUpdateProtocolUdp  PolicyRuleUpdateProtocol = "udp"
 )
 
+// Defines values for PrivateNetworkCheckAction.
+const (
+	PrivateNetworkCheckActionAllow PrivateNetworkCheckAction = "allow"
+	PrivateNetworkCheckActionDeny  PrivateNetworkCheckAction = "deny"
+)
+
 // Defines values for UserStatus.
 const (
 	UserStatusActive  UserStatus = "active"
@@ -199,8 +199,8 @@ type Checks struct {
 	// OsVersionCheck Posture check for the version of operating system
 	OsVersionCheck *OSVersionCheck `json:"os_version_check,omitempty"`
 
-	// PeerNetworkRangeCheck Posture check for allow or deny access based on peer local network addresses
-	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:"peer_network_range_check,omitempty"`
+	// PrivateNetworkCheck Posture check for allow or deny private network
+	PrivateNetworkCheck *PrivateNetworkCheck `json:"private_network_check,omitempty"`
 }
 
 // City Describe city geographical location information
@@ -656,18 +656,6 @@ type PeerMinimum struct {
 	Name string `json:"name"`
 }
 
-// PeerNetworkRangeCheck Posture check for allow or deny access based on peer local network addresses
-type PeerNetworkRangeCheck struct {
-	// Action Action to take upon policy match
-	Action PeerNetworkRangeCheckAction `json:"action"`
-
-	// Ranges List of peer network ranges in CIDR notation
-	Ranges []string `json:"ranges"`
-}
-
-// PeerNetworkRangeCheckAction Action to take upon policy match
-type PeerNetworkRangeCheckAction string
-
 // PeerRequest defines model for PeerRequest.
 type PeerRequest struct {
 	// ApprovalRequired (Cloud only) Indicates whether peer needs approval
@@ -910,6 +898,18 @@ type PostureCheckUpdate struct {
 	Name string `json:"name"`
 }
 
+// PrivateNetworkCheck Posture check for allow or deny private network
+type PrivateNetworkCheck struct {
+	// Action Action to take upon policy match
+	Action PrivateNetworkCheckAction `json:"action"`
+
+	// Ranges List of private network ranges in CIDR notation
+	Ranges []string `json:"ranges"`
+}
+
+// PrivateNetworkCheckAction Action to take upon policy match
+type PrivateNetworkCheckAction string
+
 // Route defines model for Route.
 type Route struct {
 	// Description Route description

management/server/http/posture_checks_handler.go

@@ -213,8 +213,8 @@ func (p *PostureChecksHandler) savePostureChecks(
 		postureChecks.Checks.GeoLocationCheck = toPostureGeoLocationCheck(geoLocationCheck)
 	}
 
-	if peerNetworkRangeCheck := req.Checks.PeerNetworkRangeCheck; peerNetworkRangeCheck != nil {
-		postureChecks.Checks.PeerNetworkRangeCheck, err = toPeerNetworkRangeCheck(peerNetworkRangeCheck)
+	if privateNetworkCheck := req.Checks.PrivateNetworkCheck; privateNetworkCheck != nil {
+		postureChecks.Checks.PrivateNetworkCheck, err = toPrivateNetworkCheck(privateNetworkCheck)
 		if err != nil {
 			util.WriteError(status.Errorf(status.InvalidArgument, "invalid network prefix"), w)
 			return
@@ -235,7 +235,7 @@ func validatePostureChecksUpdate(req api.PostureCheckUpdate) error {
 	}
 
 	if req.Checks == nil || (req.Checks.NbVersionCheck == nil && req.Checks.OsVersionCheck == nil &&
-		req.Checks.GeoLocationCheck == nil && req.Checks.PeerNetworkRangeCheck == nil) {
+		req.Checks.GeoLocationCheck == nil && req.Checks.PrivateNetworkCheck == nil) {
 		return status.Errorf(status.InvalidArgument, "posture checks shouldn't be empty")
 	}
 
@@ -278,17 +278,17 @@ func validatePostureChecksUpdate(req api.PostureCheckUpdate) error {
 		}
 	}
 
-	if peerNetworkRangeCheck := req.Checks.PeerNetworkRangeCheck; peerNetworkRangeCheck != nil {
-		if peerNetworkRangeCheck.Action == "" {
-			return status.Errorf(status.InvalidArgument, "action for peer network range check shouldn't be empty")
+	if privateNetworkCheck := req.Checks.PrivateNetworkCheck; privateNetworkCheck != nil {
+		if privateNetworkCheck.Action == "" {
+			return status.Errorf(status.InvalidArgument, "action for private network check shouldn't be empty")
 		}
 
-		allowedActions := []api.PeerNetworkRangeCheckAction{api.PeerNetworkRangeCheckActionAllow, api.PeerNetworkRangeCheckActionDeny}
-		if !slices.Contains(allowedActions, peerNetworkRangeCheck.Action) {
-			return status.Errorf(status.InvalidArgument, "action for peer network range check is not valid value")
+		allowedActions := []api.PrivateNetworkCheckAction{api.PrivateNetworkCheckActionAllow, api.PrivateNetworkCheckActionDeny}
+		if !slices.Contains(allowedActions, privateNetworkCheck.Action) {
+			return status.Errorf(status.InvalidArgument, "action for private network check is not valid value")
 		}
-		if len(peerNetworkRangeCheck.Ranges) == 0 {
-			return status.Errorf(status.InvalidArgument, "network ranges for peer network range check shouldn't be empty")
+		if len(privateNetworkCheck.Ranges) == 0 {
+			return status.Errorf(status.InvalidArgument, "network ranges for private network check shouldn't be empty")
 		}
 	}
 
@@ -318,8 +318,8 @@ func toPostureChecksResponse(postureChecks *posture.Checks) *api.PostureCheck {
 		checks.GeoLocationCheck = toGeoLocationCheckResponse(postureChecks.Checks.GeoLocationCheck)
 	}
 
-	if postureChecks.Checks.PeerNetworkRangeCheck != nil {
-		checks.PeerNetworkRangeCheck = toPeerNetworkRangeCheckResponse(postureChecks.Checks.PeerNetworkRangeCheck)
+	if postureChecks.Checks.PrivateNetworkCheck != nil {
+		checks.PrivateNetworkCheck = toPrivateNetworkCheckResponse(postureChecks.Checks.PrivateNetworkCheck)
 	}
 
 	return &api.PostureCheck{
@@ -369,19 +369,19 @@ func toPostureGeoLocationCheck(apiGeoLocationCheck *api.GeoLocationCheck) *postu
 	}
 }
 
-func toPeerNetworkRangeCheckResponse(check *posture.PeerNetworkRangeCheck) *api.PeerNetworkRangeCheck {
+func toPrivateNetworkCheckResponse(check *posture.PrivateNetworkCheck) *api.PrivateNetworkCheck {
 	netPrefixes := make([]string, 0, len(check.Ranges))
 	for _, netPrefix := range check.Ranges {
 		netPrefixes = append(netPrefixes, netPrefix.String())
 	}
 
-	return &api.PeerNetworkRangeCheck{
+	return &api.PrivateNetworkCheck{
 		Ranges: netPrefixes,
-		Action: api.PeerNetworkRangeCheckAction(check.Action),
+		Action: api.PrivateNetworkCheckAction(check.Action),
 	}
 }
 
-func toPeerNetworkRangeCheck(check *api.PeerNetworkRangeCheck) (*posture.PeerNetworkRangeCheck, error) {
+func toPrivateNetworkCheck(check *api.PrivateNetworkCheck) (*posture.PrivateNetworkCheck, error) {
 	prefixes := make([]netip.Prefix, 0)
 	for _, prefix := range check.Ranges {
 		parsedPrefix, err := netip.ParsePrefix(prefix)
@@ -391,7 +391,7 @@ func toPeerNetworkRangeCheck(check *api.PeerNetworkRangeCheck) (*posture.PeerNet
 		prefixes = append(prefixes, parsedPrefix)
 	}
 
-	return &posture.PeerNetworkRangeCheck{
+	return &posture.PrivateNetworkCheck{
 		Ranges: prefixes,
 		Action: string(check.Action),
 	}, nil

management/server/http/posture_checks_handler_test.go

@@ -131,7 +131,7 @@ func TestGetPostureCheck(t *testing.T) {
 		ID:   "privateNetworkPostureCheck",
 		Name: "privateNetwork",
 		Checks: posture.ChecksDefinition{
-			PeerNetworkRangeCheck: &posture.PeerNetworkRangeCheck{
+			PrivateNetworkCheck: &posture.PrivateNetworkCheck{
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
 				},
@@ -375,7 +375,7 @@ func TestPostureCheckUpdate(t *testing.T) {
 			},
 		},
 		{
-			name:        "Create Posture Checks Peer Network Range",
+			name:        "Create Posture Checks Private Network",
 			requestType: http.MethodPost,
 			requestPath: "/api/posture-checks",
 			requestBody: bytes.NewBuffer(
@@ -383,7 +383,7 @@ func TestPostureCheckUpdate(t *testing.T) {
 					"name": "default",
 					"description": "default",
 					"checks": {
-						"peer_network_range_check": {
+						"private_network_check": {
 							"action": "allow",
 							"ranges": [
 								"10.0.0.0/8"
@@ -398,11 +398,11 @@ func TestPostureCheckUpdate(t *testing.T) {
 				Name:        "default",
 				Description: str("default"),
 				Checks: api.Checks{
-					PeerNetworkRangeCheck: &api.PeerNetworkRangeCheck{
+					PrivateNetworkCheck: &api.PrivateNetworkCheck{
 						Ranges: []string{
 							"10.0.0.0/8",
 						},
-						Action: api.PeerNetworkRangeCheckActionAllow,
+						Action: api.PrivateNetworkCheckActionAllow,
 					},
 				},
 			},
@@ -715,14 +715,14 @@ func TestPostureCheckUpdate(t *testing.T) {
 			expectedBody:   false,
 		},
 		{
-			name:        "Update Posture Checks Peer Network Range",
+			name:        "Update Posture Checks Private Network",
 			requestType: http.MethodPut,
-			requestPath: "/api/posture-checks/peerNetworkRangePostureCheck",
+			requestPath: "/api/posture-checks/privateNetworkPostureCheck",
 			requestBody: bytes.NewBuffer(
 				[]byte(`{
 					"name": "default",
 					"checks": {
-						"peer_network_range_check": {
+						"private_network_check": {
 							"action": "deny",
 							"ranges": [
 								"192.168.1.0/24"
@@ -737,11 +737,11 @@ func TestPostureCheckUpdate(t *testing.T) {
 				Name:        "default",
 				Description: str(""),
 				Checks: api.Checks{
-					PeerNetworkRangeCheck: &api.PeerNetworkRangeCheck{
+					PrivateNetworkCheck: &api.PrivateNetworkCheck{
 						Ranges: []string{
 							"192.168.1.0/24",
 						},
-						Action: api.PeerNetworkRangeCheckActionDeny,
+						Action: api.PrivateNetworkCheckActionDeny,
 					},
 				},
 			},
@@ -784,10 +784,10 @@ func TestPostureCheckUpdate(t *testing.T) {
 			},
 		},
 		&posture.Checks{
-			ID:   "peerNetworkRangePostureCheck",
-			Name: "peerNetworkRange",
+			ID:   "privateNetworkPostureCheck",
+			Name: "privateNetwork",
 			Checks: posture.ChecksDefinition{
-				PeerNetworkRangeCheck: &posture.PeerNetworkRangeCheck{
+				PrivateNetworkCheck: &posture.PrivateNetworkCheck{
 					Ranges: []netip.Prefix{
 						netip.MustParsePrefix("192.168.0.0/24"),
 					},
@@ -891,50 +891,29 @@ func TestPostureCheck_validatePostureChecksUpdate(t *testing.T) {
 	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{OsVersionCheck: &osVersionCheck}})
 	assert.NoError(t, err)
 
-	// valid peer network range check
-	peerNetworkRangeCheck := api.PeerNetworkRangeCheck{
-		Action: api.PeerNetworkRangeCheckActionAllow,
+	// valid private network check
+	privateNetworkCheck := api.PrivateNetworkCheck{
+		Action: api.PrivateNetworkCheckActionAllow,
 		Ranges: []string{
 			"192.168.1.0/24", "10.0.0.0/8",
 		},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.NoError(t, err)
 
-	// invalid peer network range check
-	peerNetworkRangeCheck = api.PeerNetworkRangeCheck{
-		Action: api.PeerNetworkRangeCheckActionDeny,
+	// invalid private network check
+	privateNetworkCheck = api.PrivateNetworkCheck{
+		Action: api.PrivateNetworkCheckActionDeny,
 		Ranges: []string{},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.Error(t, err)
 
-	// invalid peer network range check
-	peerNetworkRangeCheck = api.PeerNetworkRangeCheck{
+	// invalid private network check
+	privateNetworkCheck = api.PrivateNetworkCheck{
 		Action: "unknownAction",
 		Ranges: []string{},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.Error(t, err)
 }

management/server/idp/auth0.go

@@ -114,22 +114,6 @@ type auth0Profile struct {
 	LastLogin     string `json:"last_login"`
 }
 
-// Connections represents a single Auth0 connection
-// https://auth0.com/docs/api/management/v2/connections/get-connections
-type Connection struct {
-	Id                 string            `json:"id"`
-	Name               string            `json:"name"`
-	DisplayName        string            `json:"display_name"`
-	IsDomainConnection bool              `json:"is_domain_connection"`
-	Realms             []string          `json:"realms"`
-	Metadata           map[string]string `json:"metadata"`
-	Options            ConnectionOptions `json:"options"`
-}
-
-type ConnectionOptions struct {
-	DomainAliases []string `json:"domain_aliases"`
-}
-
 // NewAuth0Manager creates a new instance of the Auth0Manager
 func NewAuth0Manager(config Auth0ClientConfig, appMetrics telemetry.AppMetrics) (*Auth0Manager, error) {
 	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
@@ -597,13 +581,13 @@ func (am *Auth0Manager) GetAllAccounts() (map[string][]*UserData, error) {
 
 	body, err := io.ReadAll(jobResp.Body)
 	if err != nil {
-		log.Debugf("Couldn't read export job response; %v", err)
+		log.Debugf("Coudln't read export job response; %v", err)
 		return nil, err
 	}
 
 	err = am.helper.Unmarshal(body, &exportJobResp)
 	if err != nil {
-		log.Debugf("Couldn't unmarshal export job response; %v", err)
+		log.Debugf("Coudln't unmarshal export job response; %v", err)
 		return nil, err
 	}
 
@@ -651,7 +635,7 @@ func (am *Auth0Manager) GetUserByEmail(email string) ([]*UserData, error) {
 
 	err = am.helper.Unmarshal(body, &userResp)
 	if err != nil {
-		log.Debugf("Couldn't unmarshal export job response; %v", err)
+		log.Debugf("Coudln't unmarshal export job response; %v", err)
 		return nil, err
 	}
 
@@ -700,13 +684,13 @@ func (am *Auth0Manager) CreateUser(email, name, accountID, invitedByEmail string
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
-		log.Debugf("Couldn't read export job response; %v", err)
+		log.Debugf("Coudln't read export job response; %v", err)
 		return nil, err
 	}
 
 	err = am.helper.Unmarshal(body, &createResp)
 	if err != nil {
-		log.Debugf("Couldn't unmarshal export job response; %v", err)
+		log.Debugf("Coudln't unmarshal export job response; %v", err)
 		return nil, err
 	}
 
@@ -793,56 +777,6 @@ func (am *Auth0Manager) DeleteUser(userID string) error {
 	return nil
 }
 
-// GetAllConnections returns detailed list of all connections filtered by given params.
-// Note this method is not part of the IDP Manager interface as this is Auth0 specific.
-func (am *Auth0Manager) GetAllConnections(strategy []string) ([]Connection, error) {
-	var connections []Connection
-
-	q := make(url.Values)
-	q.Set("strategy", strings.Join(strategy, ","))
-
-	req, err := am.createRequest(http.MethodGet, "/api/v2/connections?"+q.Encode(), nil)
-	if err != nil {
-		return connections, err
-	}
-
-	resp, err := am.httpClient.Do(req)
-	if err != nil {
-		log.Debugf("execute get connections request: %v", err)
-		if am.appMetrics != nil {
-			am.appMetrics.IDPMetrics().CountRequestError()
-		}
-		return connections, err
-	}
-
-	defer func() {
-		err = resp.Body.Close()
-		if err != nil {
-			log.Errorf("close get connections request body: %v", err)
-		}
-	}()
-	if resp.StatusCode != 200 {
-		if am.appMetrics != nil {
-			am.appMetrics.IDPMetrics().CountRequestStatusError()
-		}
-		return connections, fmt.Errorf("unable to get connections, statusCode %d", resp.StatusCode)
-	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		log.Debugf("Couldn't read get connections response; %v", err)
-		return connections, err
-	}
-
-	err = am.helper.Unmarshal(body, &connections)
-	if err != nil {
-		log.Debugf("Couldn't unmarshal get connection response; %v", err)
-		return connections, err
-	}
-
-	return connections, err
-}
-
 // checkExportJobStatus checks the status of the job created at CreateExportUsersJob.
 // If the status is "completed", then return the downloadLink
 func (am *Auth0Manager) checkExportJobStatus(jobID string) (bool, string, error) {

management/server/mock_server/account_mock.go

@@ -1,6 +1,7 @@
 package mock_server
 
 import (
+	"context"
 	"net"
 	"time"
 
@@ -10,7 +11,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
-	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/jwtclaims"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
@@ -92,7 +92,7 @@ type MockAccountManager struct {
 	SavePostureChecksFunc           func(accountID, userID string, postureChecks *posture.Checks) error
 	DeletePostureChecksFunc         func(accountID, postureChecksID, userID string) error
 	ListPostureChecksFunc           func(accountID, userID string) ([]*posture.Checks, error)
-	GetIdpManagerFunc               func() idp.Manager
+	GetUsageFunc                    func(ctx context.Context, accountID string, start, end time.Time) (*server.AccountUsageStats, error)
 }
 
 // GetUsersFromAccount mock implementation of GetUsersFromAccount from server.AccountManager interface
@@ -705,10 +705,10 @@ func (am *MockAccountManager) ListPostureChecks(accountID, userID string) ([]*po
 	return nil, status.Errorf(codes.Unimplemented, "method ListPostureChecks is not implemented")
 }
 
-// GetIdpManager mocks GetIdpManager of the AccountManager interface
-func (am *MockAccountManager) GetIdpManager() idp.Manager {
-	if am.GetIdpManagerFunc != nil {
-		return am.GetIdpManagerFunc()
+// GetUsage mocks GetCurrentUsage of the AccountManager interface
+func (am *MockAccountManager) GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*server.AccountUsageStats, error) {
+	if am.GetUsageFunc != nil {
+		return am.GetUsageFunc(ctx, accountID, start, end)
 	}
-	return nil
+	return nil, status.Errorf(codes.Unimplemented, "method GetUsage is not implemented")
 }

management/server/peer.go

@@ -410,8 +410,6 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		return nil, nil, err
 	}
 
-	registrationTime := time.Now().UTC()
-
 	newPeer := &nbpeer.Peer{
 		ID:                     xid.New().String(),
 		Key:                    peer.Key,
@@ -421,11 +419,10 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		Name:                   peer.Meta.Hostname,
 		DNSLabel:               newLabel,
 		UserID:                 userID,
-		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: registrationTime},
+		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now().UTC()},
 		SSHEnabled:             false,
 		SSHKey:                 peer.SSHKey,
-		LastLogin:              registrationTime,
-		CreatedAt:              registrationTime,
+		LastLogin:              time.Now().UTC(),
 		LoginExpirationEnabled: addedByUser,
 		Ephemeral:              ephemeral,
 	}

management/server/peer/peer.go

@@ -40,15 +40,13 @@ type Peer struct {
 	LoginExpirationEnabled bool
 	// LastLogin the time when peer performed last login operation
 	LastLogin time.Time
-	// CreatedAt records the time the peer was created
-	CreatedAt time.Time
 	// Indicate ephemeral peer attribute
 	Ephemeral bool
 	// Geo location based on connection IP
 	Location Location `gorm:"embedded;embeddedPrefix:location_"`
 }
 
-type PeerStatus struct { //nolint:revive
+type PeerStatus struct {
 	// LastSeen is the last time peer was connected to the management service
 	LastSeen time.Time
 	// Connected indicates whether peer is connected to the management service or not
@@ -73,14 +71,8 @@ type NetworkAddress struct {
 	Mac   string
 }
 
-// Environment is a system environment information
-type Environment struct {
-	Cloud    string
-	Platform string
-}
-
 // PeerSystemMeta is a metadata of a Peer machine system
-type PeerSystemMeta struct { //nolint:revive
+type PeerSystemMeta struct {
 	Hostname           string
 	GoOS               string
 	Kernel             string
@@ -95,7 +87,6 @@ type PeerSystemMeta struct { //nolint:revive
 	SystemSerialNumber string
 	SystemProductName  string
 	SystemManufacturer string
-	Environment        Environment `gorm:"serializer:json"`
 }
 
 func (p PeerSystemMeta) isEqual(other PeerSystemMeta) bool {
@@ -128,9 +119,7 @@ func (p PeerSystemMeta) isEqual(other PeerSystemMeta) bool {
 		p.UIVersion == other.UIVersion &&
 		p.SystemSerialNumber == other.SystemSerialNumber &&
 		p.SystemProductName == other.SystemProductName &&
-		p.SystemManufacturer == other.SystemManufacturer &&
-		p.Environment.Cloud == other.Environment.Cloud &&
-		p.Environment.Platform == other.Environment.Platform
+		p.SystemManufacturer == other.SystemManufacturer
 }
 
 // AddedWithSSOLogin indicates whether this peer has been added with an SSO login by a user.
@@ -159,7 +148,6 @@ func (p *Peer) Copy() *Peer {
 		SSHEnabled:             p.SSHEnabled,
 		LoginExpirationEnabled: p.LoginExpirationEnabled,
 		LastLogin:              p.LastLogin,
-		CreatedAt:              p.CreatedAt,
 		Ephemeral:              p.Ephemeral,
 		Location:               p.Location,
 	}
@@ -216,7 +204,7 @@ func (p *Peer) FQDN(dnsDomain string) string {
 
 // EventMeta returns activity event meta related to the peer
 func (p *Peer) EventMeta(dnsDomain string) map[string]any {
-	return map[string]any{"name": p.Name, "fqdn": p.FQDN(dnsDomain), "ip": p.IP, "created_at": p.CreatedAt}
+	return map[string]any{"name": p.Name, "fqdn": p.FQDN(dnsDomain), "ip": p.IP}
 }
 
 // Copy PeerStatus

management/server/posture/checks.go

@@ -10,10 +10,10 @@ import (
 )
 
 const (
-	NBVersionCheckName        = "NBVersionCheck"
-	OSVersionCheckName        = "OSVersionCheck"
-	GeoLocationCheckName      = "GeoLocationCheck"
-	PeerNetworkRangeCheckName = "PeerNetworkRangeCheck"
+	NBVersionCheckName      = "NBVersionCheck"
+	OSVersionCheckName      = "OSVersionCheck"
+	GeoLocationCheckName    = "GeoLocationCheck"
+	PrivateNetworkCheckName = "PrivateNetworkCheck"
 
 	CheckActionAllow string = "allow"
 	CheckActionDeny  string = "deny"
@@ -44,10 +44,10 @@ type Checks struct {
 
 // ChecksDefinition contains definition of actual check
 type ChecksDefinition struct {
-	NBVersionCheck        *NBVersionCheck        `json:",omitempty"`
-	OSVersionCheck        *OSVersionCheck        `json:",omitempty"`
-	GeoLocationCheck      *GeoLocationCheck      `json:",omitempty"`
-	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:",omitempty"`
+	NBVersionCheck      *NBVersionCheck      `json:",omitempty"`
+	OSVersionCheck      *OSVersionCheck      `json:",omitempty"`
+	GeoLocationCheck    *GeoLocationCheck    `json:",omitempty"`
+	PrivateNetworkCheck *PrivateNetworkCheck `json:",omitempty"`
 }
 
 // Copy returns a copy of a checks definition.
@@ -85,13 +85,13 @@ func (cd ChecksDefinition) Copy() ChecksDefinition {
 		}
 		copy(cdCopy.GeoLocationCheck.Locations, geoCheck.Locations)
 	}
-	if cd.PeerNetworkRangeCheck != nil {
-		peerNetRangeCheck := cd.PeerNetworkRangeCheck
-		cdCopy.PeerNetworkRangeCheck = &PeerNetworkRangeCheck{
-			Action: peerNetRangeCheck.Action,
-			Ranges: make([]netip.Prefix, len(peerNetRangeCheck.Ranges)),
+	if cd.PrivateNetworkCheck != nil {
+		privateNetCheck := cd.PrivateNetworkCheck
+		cdCopy.PrivateNetworkCheck = &PrivateNetworkCheck{
+			Action: privateNetCheck.Action,
+			Ranges: make([]netip.Prefix, len(privateNetCheck.Ranges)),
 		}
-		copy(cdCopy.PeerNetworkRangeCheck.Ranges, peerNetRangeCheck.Ranges)
+		copy(cdCopy.PrivateNetworkCheck.Ranges, privateNetCheck.Ranges)
 	}
 	return cdCopy
 }
@@ -130,8 +130,8 @@ func (pc *Checks) GetChecks() []Check {
 	if pc.Checks.GeoLocationCheck != nil {
 		checks = append(checks, pc.Checks.GeoLocationCheck)
 	}
-	if pc.Checks.PeerNetworkRangeCheck != nil {
-		checks = append(checks, pc.Checks.PeerNetworkRangeCheck)
+	if pc.Checks.PrivateNetworkCheck != nil {
+		checks = append(checks, pc.Checks.PrivateNetworkCheck)
 	}
 	return checks
 }

management/server/posture/checks_test.go

@@ -254,7 +254,7 @@ func TestChecks_Copy(t *testing.T) {
 				},
 				Action: CheckActionAllow,
 			},
-			PeerNetworkRangeCheck: &PeerNetworkRangeCheck{
+			PrivateNetworkCheck: &PrivateNetworkCheck{
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
 					netip.MustParsePrefix("10.0.0.0/8"),

management/server/posture/network.go

@@ -8,16 +8,16 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
-type PeerNetworkRangeCheck struct {
+type PrivateNetworkCheck struct {
 	Action string
 	Ranges []netip.Prefix `gorm:"serializer:json"`
 }
 
-var _ Check = (*PeerNetworkRangeCheck)(nil)
+var _ Check = (*PrivateNetworkCheck)(nil)
 
-func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
+func (p *PrivateNetworkCheck) Check(peer nbpeer.Peer) (bool, error) {
 	if len(peer.Meta.NetworkAddresses) == 0 {
-		return false, fmt.Errorf("peer's does not contain peer network range addresses")
+		return false, fmt.Errorf("peer's does not contain private network addresses")
 	}
 
 	maskedPrefixes := make([]netip.Prefix, 0, len(p.Ranges))
@@ -34,7 +34,7 @@ func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
 			case CheckActionAllow:
 				return true, nil
 			default:
-				return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+				return false, fmt.Errorf("invalid private network check action: %s", p.Action)
 			}
 		}
 	}
@@ -46,9 +46,9 @@ func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
 		return false, nil
 	}
 
-	return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+	return false, fmt.Errorf("invalid private network check action: %s", p.Action)
 }
 
-func (p *PeerNetworkRangeCheck) Name() string {
-	return PeerNetworkRangeCheckName
+func (p *PrivateNetworkCheck) Name() string {
+	return PrivateNetworkCheckName
 }

management/server/posture/network_test.go

@@ -9,17 +9,17 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
-func TestPeerNetworkRangeCheck_Check(t *testing.T) {
+func TestPrivateNetworkCheck_Check(t *testing.T) {
 	tests := []struct {
 		name    string
-		check   PeerNetworkRangeCheck
+		check   PrivateNetworkCheck
 		peer    nbpeer.Peer
 		wantErr bool
 		isValid bool
 	}{
 		{
-			name: "Peer networks range matches the allowed range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks matches the allowed range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -42,8 +42,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: true,
 		},
 		{
-			name: "Peer networks range doesn't matches the allowed range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks doesn't matches the allowed range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -63,8 +63,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer with no network range in the allow range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer with no privates network in the allow range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/16"),
@@ -76,8 +76,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer networks range matches the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks matches the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -100,8 +100,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer networks range doesn't matches the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks doesn't matches the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -121,8 +121,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: true,
 		},
 		{
-			name: "Peer with no networks range in the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer with no private networks in the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/16"),

management/server/scheduler.go

@@ -1,10 +1,9 @@
 package server
 
 import (
+	log "github.com/sirupsen/logrus"
 	"sync"
 	"time"
-
-	log "github.com/sirupsen/logrus"
 )
 
 // Scheduler is an interface which implementations can schedule and cancel jobs
@@ -56,8 +55,14 @@ func (wm *DefaultScheduler) cancel(ID string) bool {
 	cancel, ok := wm.jobs[ID]
 	if ok {
 		delete(wm.jobs, ID)
-		close(cancel)
-		log.Debugf("cancelled scheduled job %s", ID)
+		select {
+		case cancel <- struct{}{}:
+			log.Debugf("cancelled scheduled job %s", ID)
+		default:
+			log.Warnf("couldn't cancel job %s because there was no routine listening on the cancel event", ID)
+			return false
+		}
+
 	}
 	return ok
 }
@@ -85,41 +90,25 @@ func (wm *DefaultScheduler) Schedule(in time.Duration, ID string, job func() (ne
 		return
 	}
 
-	ticker := time.NewTicker(in)
-
 	wm.jobs[ID] = cancel
 	log.Debugf("scheduled a job %s to run in %s. There are %d total jobs scheduled.", ID, in.String(), len(wm.jobs))
 	go func() {
-		for {
-			select {
-			case <-ticker.C:
-				select {
-				case <-cancel:
-					log.Debugf("scheduled job %s was canceled, stop timer", ID)
-					ticker.Stop()
-					return
-				default:
-					log.Debugf("time to do a scheduled job %s", ID)
-				}
-				runIn, reschedule := job()
-				if !reschedule {
-					wm.mu.Lock()
-					defer wm.mu.Unlock()
-					delete(wm.jobs, ID)
-					log.Debugf("job %s is not scheduled to run again", ID)
-					ticker.Stop()
-					return
-				}
-				// we need this comparison to avoid resetting the ticker with the same duration and missing the current elapsesed time
-				if runIn != in {
-					ticker.Reset(runIn)
-				}
-			case <-cancel:
-				log.Debugf("job %s was canceled, stopping timer", ID)
-				ticker.Stop()
-				return
+		select {
+		case <-time.After(in):
+			log.Debugf("time to do a scheduled job %s", ID)
+			runIn, reschedule := job()
+			wm.mu.Lock()
+			defer wm.mu.Unlock()
+			delete(wm.jobs, ID)
+			if reschedule {
+				go wm.Schedule(runIn, ID, job)
 			}
+		case <-cancel:
+			log.Debugf("stopped scheduled job %s ", ID)
+			wm.mu.Lock()
+			defer wm.mu.Unlock()
+			delete(wm.jobs, ID)
+			return
 		}
-
 	}()
 }

management/server/scheduler_test.go

@@ -2,12 +2,11 @@ package server
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/assert"
 	"math/rand"
 	"sync"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func TestScheduler_Performance(t *testing.T) {
@@ -37,24 +36,15 @@ func TestScheduler_Cancel(t *testing.T) {
 	jobID1 := "test-scheduler-job-1"
 	jobID2 := "test-scheduler-job-2"
 	scheduler := NewDefaultScheduler()
-	tChan := make(chan struct{})
-	p := []string{jobID1, jobID2}
-	scheduler.Schedule(2*time.Millisecond, jobID1, func() (nextRunIn time.Duration, reschedule bool) {
-		tt := p[0]
-		<-tChan
-		t.Logf("job %s", tt)
-		return 2 * time.Millisecond, true
+	scheduler.Schedule(2*time.Second, jobID1, func() (nextRunIn time.Duration, reschedule bool) {
+		return 0, false
 	})
-	scheduler.Schedule(2*time.Millisecond, jobID2, func() (nextRunIn time.Duration, reschedule bool) {
-		return 2 * time.Millisecond, true
+	scheduler.Schedule(2*time.Second, jobID2, func() (nextRunIn time.Duration, reschedule bool) {
+		return 0, false
 	})
 
-	time.Sleep(4 * time.Millisecond)
 	assert.Len(t, scheduler.jobs, 2)
 	scheduler.Cancel([]string{jobID1})
-	close(tChan)
-	p = []string{}
-	time.Sleep(4 * time.Millisecond)
 	assert.Len(t, scheduler.jobs, 1)
 	assert.NotNil(t, scheduler.jobs[jobID2])
 }

management/server/sqlite_store.go

@@ -1,7 +1,7 @@
 package server
 
 import (
-	"errors"
+	"context"
 	"fmt"
 	"path/filepath"
 	"runtime"
@@ -256,11 +256,7 @@ func (s *SqliteStore) SavePeerStatus(accountID, peerID string, peerStatus nbpeer
 
 	result := s.db.First(&peer, "account_id = ? and id = ?", accountID, peerID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.Errorf(status.NotFound, "peer %s not found", peerID)
-		}
-		log.Errorf("error when getting peer from the store: %s", result.Error)
-		return status.Errorf(status.Internal, "issue getting peer from store")
+		return status.Errorf(status.NotFound, "peer %s not found", peerID)
 	}
 
 	peer.Status = &peerStatus
@@ -272,11 +268,7 @@ func (s *SqliteStore) SavePeerLocation(accountID string, peerWithLocation *nbpee
 	var peer nbpeer.Peer
 	result := s.db.First(&peer, "account_id = ? and id = ?", accountID, peerWithLocation.ID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.Errorf(status.NotFound, "peer %s not found", peer.ID)
-		}
-		log.Errorf("error when getting peer from the store: %s", result.Error)
-		return status.Errorf(status.Internal, "issue getting peer from store")
+		return status.Errorf(status.NotFound, "peer %s not found", peer.ID)
 	}
 
 	peer.Location = peerWithLocation.Location
@@ -300,11 +292,7 @@ func (s *SqliteStore) GetAccountByPrivateDomain(domain string) (*Account, error)
 	result := s.db.First(&account, "domain = ? and is_domain_primary_account = ? and domain_category = ?",
 		strings.ToLower(domain), true, PrivateCategory)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: provided domain is not registered or is not private")
-		}
-		log.Errorf("error when getting account from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		return nil, status.Errorf(status.NotFound, "account not found: provided domain is not registered or is not private")
 	}
 
 	// TODO:  rework to not call GetAccount
@@ -315,11 +303,7 @@ func (s *SqliteStore) GetAccountBySetupKey(setupKey string) (*Account, error) {
 	var key SetupKey
 	result := s.db.Select("account_id").First(&key, "key = ?", strings.ToUpper(setupKey))
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting setup key from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting setup key from store")
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	if key.AccountID == "" {
@@ -333,11 +317,7 @@ func (s *SqliteStore) GetTokenIDByHashedToken(hashedToken string) (string, error
 	var token PersonalAccessToken
 	result := s.db.First(&token, "hashed_token = ?", hashedToken)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting token from the store: %s", result.Error)
-		return "", status.Errorf(status.Internal, "issue getting account from store")
+		return "", status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	return token.ID, nil
@@ -347,11 +327,7 @@ func (s *SqliteStore) GetUserByTokenID(tokenID string) (*User, error) {
 	var token PersonalAccessToken
 	result := s.db.First(&token, "id = ?", tokenID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting token from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	if token.UserID == "" {
@@ -395,11 +371,8 @@ func (s *SqliteStore) GetAccount(accountID string) (*Account, error) {
 		Preload(clause.Associations).
 		First(&account, "id = ?", accountID)
 	if result.Error != nil {
-		log.Errorf("error when getting account from the store: %s", result.Error)
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found")
-		}
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		log.Errorf("when getting account from the store: %s", result.Error)
+		return nil, status.Errorf(status.NotFound, "account not found")
 	}
 
 	// we have to manually preload policy rules as it seems that gorm preloading doesn't do it for us
@@ -459,11 +432,7 @@ func (s *SqliteStore) GetAccountByUser(userID string) (*Account, error) {
 	var user User
 	result := s.db.Select("account_id").First(&user, "id = ?", userID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting user from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	if user.AccountID == "" {
@@ -477,11 +446,7 @@ func (s *SqliteStore) GetAccountByPeerID(peerID string) (*Account, error) {
 	var peer nbpeer.Peer
 	result := s.db.Select("account_id").First(&peer, "id = ?", peerID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting peer from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	if peer.AccountID == "" {
@@ -496,11 +461,7 @@ func (s *SqliteStore) GetAccountByPeerPubKey(peerKey string) (*Account, error) {
 
 	result := s.db.Select("account_id").First(&peer, "key = ?", peerKey)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
-		}
-		log.Errorf("error when getting peer from the store: %s", result.Error)
-		return nil, status.Errorf(status.Internal, "issue getting account from store")
+		return nil, status.Errorf(status.NotFound, "account not found: index lookup failed")
 	}
 
 	if peer.AccountID == "" {
@@ -516,11 +477,7 @@ func (s *SqliteStore) SaveUserLastLogin(accountID, userID string, lastLogin time
 
 	result := s.db.First(&user, "account_id = ? and id = ?", accountID, userID)
 	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return status.Errorf(status.NotFound, "user %s not found", userID)
-		}
-		log.Errorf("error when getting user from the store: %s", result.Error)
-		return status.Errorf(status.Internal, "issue getting user from store")
+		return status.Errorf(status.NotFound, "user %s not found", userID)
 	}
 
 	user.LastLogin = lastLogin
@@ -541,3 +498,48 @@ func (s *SqliteStore) Close() error {
 func (s *SqliteStore) GetStoreEngine() StoreEngine {
 	return SqliteStoreEngine
 }
+
+// CalculateUsageStats returns the usage stats for an account
+// start and end are inclusive.
+func (s *SqliteStore) CalculateUsageStats(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	stats := &AccountUsageStats{}
+
+	err := s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		err := tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ? AND peer_status_last_seen BETWEEN ? AND ?", accountID, start, end).
+			Distinct("user_id").
+			Count(&stats.ActiveUsers).Error
+		if err != nil {
+			return fmt.Errorf("get active users: %w", err)
+		}
+
+		err = tx.Model(&User{}).
+			Where("account_id = ? AND is_service_user = ?", accountID, false).
+			Count(&stats.TotalUsers).Error
+		if err != nil {
+			return fmt.Errorf("get total users: %w", err)
+		}
+
+		err = tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ? AND peer_status_last_seen BETWEEN ? AND ?", accountID, start, end).
+			Count(&stats.ActivePeers).Error
+		if err != nil {
+			return fmt.Errorf("get active peers: %w", err)
+		}
+
+		err = tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ?", accountID).
+			Count(&stats.TotalPeers).Error
+		if err != nil {
+			return fmt.Errorf("get total peers: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("transaction: %w", err)
+	}
+
+	return stats, nil
+}

management/server/sqlite_store_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"path/filepath"
@@ -12,8 +13,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/server/status"
-
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/util"
 )
@@ -176,26 +175,6 @@ func TestSqlite_DeleteAccount(t *testing.T) {
 
 }
 
-func TestSqlite_GetAccount(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	store := newSqliteStoreFromFile(t, "testdata/store.json")
-
-	id := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-
-	account, err := store.GetAccount(id)
-	require.NoError(t, err)
-	require.Equal(t, id, account.Id, "account id should match")
-
-	_, err = store.GetAccount("non-existing-account")
-	assert.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
-}
-
 func TestSqlite_SavePeerStatus(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("The SQLite store is not properly supported by Windows yet")
@@ -210,9 +189,6 @@ func TestSqlite_SavePeerStatus(t *testing.T) {
 	newStatus := nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()}
 	err = store.SavePeerStatus(account.Id, "non-existing-peer", newStatus)
 	assert.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 
 	// save new status of existing peer
 	account.Peers["testpeer"] = &nbpeer.Peer{
@@ -279,13 +255,6 @@ func TestSqlite_SavePeerLocation(t *testing.T) {
 
 	actual := account.Peers[peer.ID].Location
 	assert.Equal(t, peer.Location, actual)
-
-	peer.ID = "non-existing-peer"
-	err = store.SavePeerLocation(account.Id, peer)
-	assert.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 }
 
 func TestSqlite_TestGetAccountByPrivateDomain(t *testing.T) {
@@ -303,9 +272,6 @@ func TestSqlite_TestGetAccountByPrivateDomain(t *testing.T) {
 
 	_, err = store.GetAccountByPrivateDomain("missing-domain.com")
 	require.Error(t, err, "should return error on domain lookup")
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 }
 
 func TestSqlite_GetTokenIDByHashedToken(t *testing.T) {
@@ -321,12 +287,6 @@ func TestSqlite_GetTokenIDByHashedToken(t *testing.T) {
 	token, err := store.GetTokenIDByHashedToken(hashed)
 	require.NoError(t, err)
 	require.Equal(t, id, token)
-
-	_, err = store.GetTokenIDByHashedToken("non-existing-hash")
-	require.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 }
 
 func TestSqlite_GetUserByTokenID(t *testing.T) {
@@ -341,12 +301,6 @@ func TestSqlite_GetUserByTokenID(t *testing.T) {
 	user, err := store.GetUserByTokenID(id)
 	require.NoError(t, err)
 	require.Equal(t, id, user.PATs[id].ID)
-
-	_, err = store.GetUserByTokenID("non-existing-id")
-	require.Error(t, err)
-	parsedErr, ok := status.FromError(err)
-	require.True(t, ok)
-	require.Equal(t, status.NotFound, parsedErr.Type(), "should return not found error")
 }
 
 func newSqliteStore(t *testing.T) *SqliteStore {
@@ -393,3 +347,29 @@ func newAccount(store Store, id int) error {
 
 	return store.SaveAccount(account)
 }
+
+func TestSqliteStore_CalculateUsageStats(t *testing.T) {
+	store := newSqliteStoreFromFile(t, "testdata/store_stats.json")
+	t.Cleanup(func() {
+		require.NoError(t, store.Close())
+	})
+
+	startDate := time.Date(2024, time.February, 1, 0, 0, 0, 0, time.UTC)
+	endDate := startDate.AddDate(0, 1, 0).Add(-time.Nanosecond)
+
+	stats1, err := store.CalculateUsageStats(context.TODO(), "account-1", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(2), stats1.ActiveUsers)
+	assert.Equal(t, int64(4), stats1.TotalUsers)
+	assert.Equal(t, int64(3), stats1.ActivePeers)
+	assert.Equal(t, int64(7), stats1.TotalPeers)
+
+	stats2, err := store.CalculateUsageStats(context.TODO(), "account-2", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(1), stats2.ActiveUsers)
+	assert.Equal(t, int64(2), stats2.TotalUsers)
+	assert.Equal(t, int64(1), stats2.ActivePeers)
+	assert.Equal(t, int64(2), stats2.TotalPeers)
+}

management/server/store.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -41,6 +42,7 @@ type Store interface {
 	// GetStoreEngine should return StoreEngine of the current store implementation.
 	// This is also a method of metrics.DataSource interface.
 	GetStoreEngine() StoreEngine
+	CalculateUsageStats(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error)
 }
 
 type StoreEngine string

management/server/testdata/store_stats.json

@@ -0,0 +1,161 @@
+{
+  "Accounts": {
+    "account-1": {
+      "Id": "account-1",
+      "Domain": "example.com",
+      "Network": {
+        "Id": "af1c8024-ha40-4ce2-9418-34653101fc3c",
+        "Net": {
+          "IP": "100.64.0.0",
+          "Mask": "//8AAA=="
+        },
+        "Dns": null
+      },
+      "Users": {
+        "user-1-account-1": {
+          "Id": "user-1-account-1"
+        },
+        "user-2-account-1": {
+          "Id": "user-2-account-1"
+        },
+        "user-3-account-1": {
+          "Id": "user-3-account-1"
+        },
+        "user-4-account-1": {
+          "Id": "user-4-account-1"
+        },
+        "user-5-account-1": {
+          "Id": "user-5-account-1",
+          "IsServiceUser": true
+        }
+      },
+      "Peers": {
+        "peer-1-account-1": {
+          "ID": "peer-1-account-1",
+          "UserID": "user-1-account-1",
+          "Status": {
+            "LastSeen": "2024-01-01T00:00:00Z"
+          },
+          "Name": "Peer One",
+          "Meta": {
+            "Hostname": "peer1-host"
+          }
+        },
+        "peer-2-account-1": {
+          "ID": "peer-2-account-1",
+          "UserID": "user-2-account-1",
+          "Status": {
+            "LastSeen": "2024-02-29T23:59:59Z"
+          },
+          "Name": "Peer Two",
+          "Meta": {
+            "Hostname": "peer2-host"
+          }
+        },
+        "peer-3-account-1": {
+          "ID": "peer-3-account-1",
+          "UserID": "user-2-account-1",
+          "Status": {
+            "LastSeen": "2024-02-01T12:00:00Z"
+          },
+          "Name": "Peer Three",
+          "Meta": {
+            "Hostname": "peer3-host"
+          }
+        },
+        "peer-4-account-1": {
+          "ID": "peer-4-account-1",
+          "UserID": "user-3-account-1",
+          "Status": {
+            "LastSeen": "2024-02-08T12:00:00Z"
+          },
+          "Name": "Peer Four",
+          "Meta": {
+            "Hostname": "peer4-host"
+          }
+        },
+        "peer-5-account-1": {
+          "ID": "peer-5-account-1",
+          "UserID": "user-3-account-1",
+          "Status": {
+            "LastSeen": "2023-06-01T12:00:00Z"
+          },
+          "Name": "Peer Five",
+          "Meta": {
+            "Hostname": "peer5-host"
+          }
+        },
+        "peer-6-account-1": {
+          "ID": "peer-6-account-1",
+          "UserID": "user-4-account-1",
+          "Status": {
+            "LastSeen": "2024-01-31T23:59:59Z"
+          },
+          "Name": "Peer Six",
+          "Meta": {
+            "Hostname": "peer6-host"
+          }
+        },
+        "peer-7-account-1": {
+          "ID": "peer-7-account-1",
+          "UserID": "user-4-account-1",
+          "Status": {
+            "LastSeen": "2024-03-01T00:00:00Z"
+          },
+          "Name": "Peer Seven",
+          "Meta": {
+            "Hostname": "peer7-host"
+          }
+        }
+      }
+    },
+    "account-2": {
+      "Id": "account-2",
+      "Domain": "example.org",
+      "Network": {
+        "Id": "af1c8024-ha40-4ce2-9418-34653101fc3c",
+        "Net": {
+          "IP": "100.64.0.0",
+          "Mask": "//8AAA=="
+        },
+        "Dns": null
+      },
+      "Users": {
+        "user-1-account-2": {
+          "Id": "user-1-account-2"
+        },
+        "user-2-account-2": {
+          "Id": "user-1-account-2"
+        },
+        "user-3-account-2": {
+          "Id": "user-3-account-2",
+          "IsServiceUser": true
+        }
+      },
+      "Peers": {
+        "peer-1-account-2": {
+          "ID": "peer-1-account-2",
+          "UserID": "user-1-account-2",
+          "Status": {
+            "LastSeen": "2023-08-30T12:00:00Z"
+          },
+          "Name": "Peer One",
+          "Meta": {
+            "Hostname": "peer1-host"
+          }
+        },
+        "peer-2-account-2": {
+          "ID": "peer-2-account-2",
+          "UserID": "user-1-account-2",
+          "Status": {
+            "LastSeen": "2024-02-08T12:00:00Z"
+          },
+          "Name": "Peer Two",
+          "Meta": {
+            "Hostname": "peer2-host"
+          }
+        }
+      }
+    }
+  }
+}

management/server/user.go

@@ -85,8 +85,6 @@ type User struct {
 	Blocked bool
 	// LastLogin is the last time the user logged in to IdP
 	LastLogin time.Time
-	// CreatedAt records the time the user was created
-	CreatedAt time.Time
 
 	// Issued of the user
 	Issued string `gorm:"default:api"`
@@ -175,7 +173,6 @@ func (u *User) Copy() *User {
 		PATs:                 pats,
 		Blocked:              u.Blocked,
 		LastLogin:            u.LastLogin,
-		CreatedAt:            u.CreatedAt,
 		Issued:               u.Issued,
 		IntegrationReference: u.IntegrationReference,
 	}
@@ -191,7 +188,6 @@ func NewUser(id string, role UserRole, isServiceUser bool, nonDeletable bool, se
 		ServiceUserName: serviceUserName,
 		AutoGroups:      autoGroups,
 		Issued:          issued,
-		CreatedAt:       time.Now().UTC(),
 	}
 }
 
@@ -342,7 +338,6 @@ func (am *DefaultAccountManager) inviteNewUser(accountID, userID string, invite
 		AutoGroups:           invite.AutoGroups,
 		Issued:               invite.Issued,
 		IntegrationReference: invite.IntegrationReference,
-		CreatedAt:            time.Now().UTC(),
 	}
 	account.Users[idpUser.ID] = newUser
 
@@ -419,7 +414,7 @@ func (am *DefaultAccountManager) ListUsers(accountID string) ([]*User, error) {
 }
 
 func (am *DefaultAccountManager) deleteServiceUser(account *Account, initiatorUserID string, targetUser *User) {
-	meta := map[string]any{"name": targetUser.ServiceUserName, "created_at": targetUser.CreatedAt}
+	meta := map[string]any{"name": targetUser.ServiceUserName}
 	am.StoreEvent(initiatorUserID, targetUser.Id, account.Id, activity.ServiceUserDeleted, meta)
 	delete(account.Users, targetUser.Id)
 }
@@ -499,23 +494,13 @@ func (am *DefaultAccountManager) deleteRegularUser(account *Account, initiatorUs
 		return err
 	}
 
-	u, err := account.FindUser(targetUserID)
-	if err != nil {
-		log.Errorf("failed to find user %s for deletion, this should never happen: %s", targetUserID, err)
-	}
-
-	var tuCreatedAt time.Time
-	if u != nil {
-		tuCreatedAt = u.CreatedAt
-	}
-
 	delete(account.Users, targetUserID)
 	err = am.Store.SaveAccount(account)
 	if err != nil {
 		return err
 	}
 
-	meta := map[string]any{"name": tuName, "email": tuEmail, "created_at": tuCreatedAt}
+	meta := map[string]any{"name": tuName, "email": tuEmail}
 	am.StoreEvent(initiatorUserID, targetUserID, account.Id, activity.UserDeleted, meta)
 
 	am.updateAccountPeers(account)

management/server/user_test.go

@@ -273,8 +273,7 @@ func TestUser_Copy(t *testing.T) {
 			},
 		},
 		Blocked:   false,
-		LastLogin: time.Now().UTC(),
-		CreatedAt: time.Now().UTC(),
+		LastLogin: time.Now(),
 		Issued:    "test",
 		IntegrationReference: IntegrationReference{
 			ID:              0,

signal/client/grpc.go

@@ -21,10 +21,11 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/encryption"
-	"github.com/netbirdio/netbird/management/client"
 	"github.com/netbirdio/netbird/signal/proto"
 )
 
+const defaultSendTimeout = 5 * time.Second
+
 // ConnStateNotifier is a wrapper interface of the status recorder
 type ConnStateNotifier interface {
 	MarkSignalDisconnected(error)
@@ -70,7 +71,7 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 		transportOption = grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{}))
 	}
 
-	sigCtx, cancel := context.WithTimeout(ctx, client.ConnectTimeout)
+	sigCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 	conn, err := grpc.DialContext(
 		sigCtx,
@@ -352,7 +353,7 @@ func (c *GrpcClient) Send(msg *proto.Message) error {
 		return err
 	}
 
-	attemptTimeout := client.ConnectTimeout
+	attemptTimeout := defaultSendTimeout
 
 	for attempt := 0; attempt < 4; attempt++ {
 		if attempt > 1 {

signal/cmd/run.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"golang.org/x/crypto/acme/autocert"
 	"io"
 	"io/fs"
 	"net"
@@ -13,14 +14,10 @@ import (
 	"strings"
 	"time"
 
-	"golang.org/x/crypto/acme/autocert"
-
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/signal/proto"
 	"github.com/netbirdio/netbird/signal/server"
 	"github.com/netbirdio/netbird/util"
-	"github.com/netbirdio/netbird/version"
-
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
@@ -132,7 +129,6 @@ var (
 				log.Infof("running gRPC server: %s", grpcListener.Addr().String())
 			}
 
-			log.Infof("signal server version %s", version.NetbirdVersion())
 			log.Infof("started Signal Service")
 
 			SetupCloseHandler()