gravitl/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2026-10-12 02:15:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,894 Commits 1,843 Branches 91 Tags
develop
Commit Graph
109 Commits
Author SHA1 Message Date
Vishal Dalwadi c83ee636e2 Merge pull request #4148 from gravitl/NM-387 
NM-387: Managed SSH
 2026-10-09 14:54:57 +05:30
Vishal Dalwadi cf1acff10b fix(go): resync tenant id on license change; show license error on any error while license validation; 2026-09-21 12:59:49 +05:30
Abhishek Kondur 641f991f9c fix(posture): keep violation cycles consistent and audit new failures 
Skip violation details on GetAllNodes, replace cycles transactionally, and
emit POSTURE_CHECK_FAILED for new CheckIDs (with one-time backfill).
 2026-09-08 12:21:33 +04:00
Vishal Dalwadi 07d7bdc64b feat(go): use per-tenant posture check func; 2026-08-22 17:02:35 +05:30
Vishal Dalwadi 4c08d20c6c NM-341-v6 (#4108) 
* wip(go): remove old hook comment;

* wip(go): expect ctx during license validation;

* wip(go): always create default org and tenant for ce;

* wip(go): add tenant-specific check for license validation error;

* wip(go): cache license validation response in memory;

* wip(go): add todo to handle multiple-tenant for integration pull;

* wip(go): pass ctx during license validation;

* wip(go): add todo for making changes later; run hook separately for each tenant;

* wip(go): return specific errors when license validation response not in cache;

* wip(go): use retryable.httpclient for calling license validation api;

* wip(go): process license validation;

* wip(go): license validation function;

* wip(go): migration on license validation;

* wip(go): org settings not expected;

* wip(go): remove expiry from license validation response;

* wip(go): add limits and limits enforcement to license validation response;

* wip(go): remove expiry usages;

* wip(go): add arg to clear cache;

* wip(go): add arg to clear cache;

* wip(go): skip license validation if cached resp;

* wip(go): allow org_id and tenant_id query params;

* wip(go): upsert tenant membership on sync;

* wip(go): pass ctx to delete network roles;

* wip(go): create tenant membership on org owner creation on ce;

* wip(go): add tenant orchestrator;

* wip(go): use tenant orchestrator;

* wip(go): add default settings for tenant;

* wip(go): make org owner superadmin on all tenants;

* wip(go): simplify SyncOrgAndTenants;

* wip(go): retry license validation only 3 times

* wip(go): store invalid err;

* wip(go): add function to check if limits are to be enforced on a tenant;

* wip(go): pass tenant scope if possible when checking for license validation error;

* wip(go): remove merge errors;

* wip(go): add functions for limit checks;

* wip(go): wire host limit check;

* wip(go): wire ingress limit check;

* wip(go): wire egress limit check;

* wip(go): wire client limit check;

* wip(go): wire network limit check;

* wip(go): wire user limit check;

* wip(go): use correct errors;

* wip(go): skip telemetry for msps;

* wip(go): disable telemetry on msp tenants;

* wip(go): err check;

* wip(go): uncomment log event;

* wip(go): get sso state to get scope for non-headless oauth login;

* wip(go): inline delete pending user;

* wip(go): allow both org and tenant scope for pending users table;

* wip(go): add migration for pending user table during set tenant id and rekey org/tenant id;

* wip(go): update queries to use new scope fields in pending users table;

* wip(go): allow both org and tenant scope for user invites table;

* wip(go): update queries to use new scope fields;

* wip(go): add migration for rekey-ing org/tenant id and setting tenant id;

* wip(go): inline delete user invite;

* wip(go): set scope when creating invite;

* wip(go): get user count with membership is ctx is tenant scoped;

* wip(go): add methods to upsert and delete org memberships;

* wip(go): add global valid tenant and org roles map;

* wip(go): add scope query in user invite get by email;

* wip(go): add support for upsert and delete of org and tenant membership both;

* wip(go): infer scope for user invite apis;

* wip(go): wire ctx in get user invite by email;

* wip(go): allow no scope headers to be passed in infer scope apis;

* wip(go): add validation and checks for org-scoped invite api handlers;

* wip(go): wire ctx to is pending user check;

* wip(go): infer scope for pending user apis;

* wip(go): set default role based on ctx scope;

* wip(go): move mfa to tenant membership table; move account status to membership tables;

* wip(go): migrate account status and mfa settings;

* wip(go): update account status on sync;

* wip(go): use update mfa to update mfa setting;

* wip(go): set new membership settings on user creation;

* wip(go): use membership where required;

* wip(go): wire ctx on key unlink refs;

* wip(go): use r.Context directly without reinitializing db;

* wip(go): wire ctx in acls;

* wip(go): add tenant scoped primary key constructor;

* wip(go): use tenant scoped primary key for acls, dns, extclients and tags;

* wip(go): wire ctx for get groups in network;

* wip(go): wire ctx for get groups;

* wip(go): scope non-uuid group ids by tenant id;

* wip(go): migrate non-uuid group ids to scoped ids;

* wip(go): don't expect scope id in invite validation and signup apis;

* wip(go): wire ctx for get matching user; allow org scope when querying by external idp id;

* wip(go): add mfa to org;

* wip(go): scope preauth token;

* wip(go): add fallback for older auth tokens;

* wip(go): wire ctx for preauth token creation;

* wip(go): migrate mfa settings;

* wip(go): resolve mfa settings for inherited auth;

* wip(go): update mfa for org;

* wip(go): infer scope for totp apis;

* wip(go): use ctx when passed;

* wip(go): infer scope for list user apis;

* wip(go): ensure set primary keys don't cause errors during fetch;

* wip(go): make primary key for integrations uuid and store provider in separate key;

* wip(go): migrate integration ids;

* wip(go): use provider instead of id everywhere;

* wip(go): remove gorm column;

* wip(go): wire ctx for igw egress creation;

* wip(go): wire ctx for igw egress update;

* wip(go): wire ctx for host registration;

* wip(go): wire ctx for host registration;

* wip(go): merge errors;

* wip(go): merge errors;

* wip(go): wire ctx; remove default scope usages;

* wip(go): use get with membership;

* wip(go): org scope license validation;

* wip(go): remove debug log;

* wip(go): remove scoping on list roles;

* wip(go): ignore invite creation if already exists;

* wip(go): add is msp func to check if deployment is msp deployment;

* wip(go): ensure username is email for msp users;

* wip(go): add email validated check on user table;

* wip(go): mark email validated when oauth user;

* wip(go): handle gorm error;

* wip(go): add tenant id to siem grpc schema;

* wip(go): read tenant from scoped ctx;

* wip(go): pass scoped ctx to siem grpc client;

* wip(go): remove unused publisher;

* wip(go): publish all tenant exporter updates on pull;

* wip(go): fix wg usage;

* wip(go): tenant scope the ctx when getting server info;

* wip(go): add tenant id to enrollment key token;

* wip(go): make host register tenant scope;

* wip(go): add default settings;

* wip(go): use correct checks for is msp tenant;

* wip(go): add email validation extension;

* wip(go): add pages for validation check;

* wip(go): use extension for validating user;

* wip(go): add invite type;

* wip(go): create only one validation invite per user email;

* wip(go): add validate email handler;

* wip(go): add email builder;

* wip(go): add user invite type migration logic;

* wip(go): only log email send failures;

* wip(go): add tenant id to flows table;

* wip(go): add func to check if connected to clickhouse;

* wip(go): migrate clickhouse;

* wip(go): add tenant id to mdm and edr state;

* wip(go): add delete methods for tables;

* wip(go): add tenant teardown method;

* wip(go): handle tenant deletion;

* wip(go): clean up flow logs on tenant deletion;

* wip(go): add update org membership role id method;

* wip(go): add transfer org ownership api;

* wip(go): move audit logs retention period to org settings;

* wip(go):get retention period from org settings;

* wip(go): remove old audit logs usage;

* wip(go): migrate audit logs retention period;

* wip(go): unmarshal decodes nums as float64;

* wip(go): run flow logs cleanup for all tenants in one go;

* wip(go): add audit logs retention period and smtp settings to tenant settings table for non-msp tenants;

* wip(go): resolve retention period and smtp settings correctly;

* wip(go): handle retention period and smtp settings updates and fetches correctly;

* wip(go): overlay retention period and smtp settings on server settings;;

* wip(go): upsert overlayed settings;

* wip(go): add azure tenant id to org settings;

* wip(go): tenant scope list roles;

* wip(go): add noop creds;

* wip(go): use first instead of find;

* wip(go): use correct roles when transfering ownership;

* wip(go): delete access tokens only if tenant scoped;

* wip(go): make delete user work for both org and tenant scope;

* wip(go): delete extclients only if tenant scoped;

* wip(go): check if caller is allowed to delete user;

* wip(go): infer scope for update user;

* wip(go): prevent org-owner elevation;

* wip(go): permissions check for update;

* wip(go): delete user access tokens only if tenant scope;

* wip(go): delete extclients only if tenant scope;

* wip(go): move upsert membership in upsert user;

* wip(go): set api host when constructing server config;

* wip(go): fix static errors;

* wip(go): fix test cases;

* wip(go): use correct get ns order;

* wip(go): use correct get pending host order;

* wip(go): use correct get access token order;

* wip(go): use correct get event order;

* wip(go): return error response on emqx user creation error;

* wip(go): store correct value in cache;

* wip(go): return better error response;

* wip(go): return better error response;

* wip(go): use cache when listing egress acls;

* wip(go): wire ctx in UserHasNetworkGroupAccess;

* wip(go): remove double scope wrapping;

* wip(go): add security check for list and get org;

* wip(go): ratelimit discover api;

* wip(go): expect sole org id in get and create org owner;

* wip(go): wrap create org owner in tx;

* wip(go): wire ctx correctly;

* wip(go): wire ctx for posture check functions;

* wip(go): remove resolved todo;

* wip(go): wire ctx for posture check function;

* wip(go): remove scope from netdesk login api;

* wip(go): use orgid correctly;

* wip(go): scope user update checks correctly;

* wip(go): wire ctx for fetch oauth secret;

* wip(go): add tenant_id and org_id query string param to user invite url;

* wip(go): get sole org;

* wip(go): set query string correctly;

* wip(go): wire ctx in update user groups;

* wip(go): allow delete oauth non-idp users;

* wip(go): delete access tokens post update but check before update;

* wip(go): ignore h.Nodes on create host;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): create tenant membership for org user directly;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): get user with membership on callback;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): use write locks;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): prevent create, update, delete of roles;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): ensure role belongs to network we are checking permission for;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): handle error on invite creation correctly;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): handle invite not found on org scoped oauth callback;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): init default groups on tenant creation;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): upset org and tenant on change;

* wip(go): use GetPlatformRole method to get platform role;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): created default network roles on tenant creation;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): use GetAnyRole when unsure; remove unused funcs;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): initialize network roles on startup;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): use GetNetworkRole method to get network role;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): migrate ids of all network roles;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): check both scoped and unscoped on delete;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): check both scoped and unscoped on update;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): scope id on network role upsert;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): add methods to fetch platform and network roles;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): scope network role id on create;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): add methods to scope and unscope role ids;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): remove uuid check;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): list scoped network roles;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): remove unuse update method;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): use correct id on get and delete;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): allow all_networks role in permission access;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): scope ctx from state cache;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): remove create, delete and update roles from netmaker cli;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): create network admin and user with ctx;

Signed-off-by: VishalDalwadi <[email protected]>

* wip(go): allow updating names and metadata;

Signed-off-by: VishalDalwadi <[email protected]>

---------

Signed-off-by: VishalDalwadi <[email protected]>
 2026-08-17 17:49:04 +05:30
Vishal Dalwadi f81fe29d4d NM-341-v6 (#4107) 
* wip(go): wire ctx in extclient apis;

* wip(go): wire ctx in extclient apis;

* wip(go): remove org id check from global scoped get tenant api;

* wip(go): add scope slug to discover response;

* wip(go): wire ctx in get users;

* wip(go): set tenant id in posture check violations;

* wip(go): upsert membership instead of user;

* wip(go): pass correct len;

* wip(go): optimize (single loop);

* wip(go): unify todos;

* wip(go): add todo;

* wip(go): wire context for network get;

* wip(go): wire context;

* wip(go): wire context;

* wip(go): wire ctx when getting tenant superadmin;

* wip(go): add network creator to network admin group;

* wip(go): check for user membership on sync;

* wip(go): add methods with strict membership check;

* wip(go): remove unwanted feature flags;

* wip(go): report per-tenant usage during license validation;

* wip(go): move email setting from tenant to org;

* wip(go): pass org scope to email init;

* wip(go): remove old tenant email settings usages; use org settings to get email settings

* wip(go): use get email settings from org settings;

* wip(go): remove email settings migration;

* wip(go): migrate email settings from server to org settings;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): add membership alias to filter;

* wip(go): skip clearing local license validation response cache;

* wip(go): extend license validation response for multi-tenancy;

* wip(go): add functions to get sole tenant and org;

* wip(go): use tenant-specific feature flags;

* wip(go): add tenant status type;

* wip(go): remove old hook comment;

* wip(go): expect ctx during license validation;

* wip(go): always create default org and tenant for ce;

* wip(go): add tenant-specific check for license validation error;

* wip(go): cache license validation response in memory;

* wip(go): add todo to handle multiple-tenant for integration pull;

* wip(go): pass ctx during license validation;

* wip(go): add todo for making changes later; run hook separately for each tenant;

* wip(go): return specific errors when license validation response not in cache;

* wip(go): use retryable.httpclient for calling license validation api;

* wip(go): process license validation;

* wip(go): license validation function;

* wip(go): migration on license validation;

* wip(go): org settings not expected;

* wip(go): remove expiry from license validation response;

* wip(go): add limits and limits enforcement to license validation response;

* wip(go): remove expiry usages;

* wip(go): add arg to clear cache;

* wip(go): add arg to clear cache;

* wip(go): skip license validation if cached resp;

* wip(go): allow org_id and tenant_id query params;

* wip(go): upsert tenant membership on sync;

* wip(go): pass ctx to delete network roles;

* wip(go): create tenant membership on org owner creation on ce;

* wip(go): add tenant orchestrator;

* wip(go): use tenant orchestrator;

* wip(go): add default settings for tenant;

* wip(go): make org owner superadmin on all tenants;

* wip(go): simplify SyncOrgAndTenants;

* wip(go): retry license validation only 3 times

* wip(go): store invalid err;

* wip(go): add function to check if limits are to be enforced on a tenant;

* wip(go): pass tenant scope if possible when checking for license validation error;

* wip(go): remove merge errors;

* wip(go): add functions for limit checks;

* wip(go): wire host limit check;

* wip(go): wire ingress limit check;

* wip(go): wire egress limit check;

* wip(go): wire client limit check;

* wip(go): wire network limit check;

* wip(go): wire user limit check;

* wip(go): use correct errors;

* wip(go): skip telemetry for msps;

* wip(go): disable telemetry on msp tenants;

* wip(go): err check;

* wip(go): uncomment log event;

* wip(go): get sso state to get scope for non-headless oauth login;

* wip(go): inline delete pending user;

* wip(go): allow both org and tenant scope for pending users table;

* wip(go): add migration for pending user table during set tenant id and rekey org/tenant id;

* wip(go): update queries to use new scope fields in pending users table;

* wip(go): allow both org and tenant scope for user invites table;

* wip(go): update queries to use new scope fields;

* wip(go): add migration for rekey-ing org/tenant id and setting tenant id;

* wip(go): inline delete user invite;

* wip(go): set scope when creating invite;

* wip(go): get user count with membership is ctx is tenant scoped;

* wip(go): add methods to upsert and delete org memberships;

* wip(go): add global valid tenant and org roles map;

* wip(go): add scope query in user invite get by email;

* wip(go): add support for upsert and delete of org and tenant membership both;

* wip(go): infer scope for user invite apis;

* wip(go): wire ctx in get user invite by email;

* wip(go): allow no scope headers to be passed in infer scope apis;

* wip(go): add validation and checks for org-scoped invite api handlers;

* wip(go): wire ctx to is pending user check;

* wip(go): infer scope for pending user apis;

* wip(go): set default role based on ctx scope;

* wip(go): move mfa to tenant membership table; move account status to membership tables;

* wip(go): migrate account status and mfa settings;

* wip(go): update account status on sync;

* wip(go): use update mfa to update mfa setting;

* wip(go): set new membership settings on user creation;

* wip(go): use membership where required;

* wip(go): wire ctx on key unlink refs;

* wip(go): use r.Context directly without reinitializing db;

* wip(go): wire ctx in acls;

* wip(go): add tenant scoped primary key constructor;

* wip(go): use tenant scoped primary key for acls, dns, extclients and tags;

* wip(go): wire ctx for get groups in network;

* wip(go): wire ctx for get groups;

* wip(go): scope non-uuid group ids by tenant id;

* wip(go): migrate non-uuid group ids to scoped ids;

* wip(go): don't expect scope id in invite validation and signup apis;

* wip(go): wire ctx for get matching user; allow org scope when querying by external idp id;

* wip(go): add mfa to org;

* wip(go): scope preauth token;

* wip(go): add fallback for older auth tokens;

* wip(go): wire ctx for preauth token creation;

* wip(go): migrate mfa settings;

* wip(go): resolve mfa settings for inherited auth;

* wip(go): update mfa for org;

* wip(go): infer scope for totp apis;

* wip(go): use ctx when passed;

* wip(go): infer scope for list user apis;

* wip(go): ensure set primary keys don't cause errors during fetch;

* wip(go): make primary key for integrations uuid and store provider in separate key;

* wip(go): migrate integration ids;

* wip(go): use provider instead of id everywhere;

* wip(go): remove gorm column;

* wip(go): wire ctx for igw egress creation;

* wip(go): wire ctx for igw egress update;

* wip(go): wire ctx for host registration;

* wip(go): wire ctx for host registration;

* wip(go): merge errors;

* wip(go): merge errors;

* wip(go): wire ctx; remove default scope usages;

* wip(go): use get with membership;

* wip(go): org scope license validation;

* wip(go): remove debug log;

* wip(go): remove scoping on list roles;

* wip(go): ignore invite creation if already exists;

* wip(go): add is msp func to check if deployment is msp deployment;

* wip(go): ensure username is email for msp users;

* wip(go): add email validated check on user table;

* wip(go): mark email validated when oauth user;

* wip(go): handle gorm error;

* wip(go): add tenant id to siem grpc schema;

* wip(go): read tenant from scoped ctx;

* wip(go): pass scoped ctx to siem grpc client;

* wip(go): remove unused publisher;

* wip(go): publish all tenant exporter updates on pull;

* wip(go): fix wg usage;

* wip(go): tenant scope the ctx when getting server info;

* wip(go): add tenant id to enrollment key token;

* wip(go): make host register tenant scope;

* wip(go): add default settings;

* wip(go): use correct checks for is msp tenant;

* wip(go): add email validation extension;

* wip(go): add pages for validation check;

* wip(go): use extension for validating user;

* wip(go): add invite type;

* wip(go): create only one validation invite per user email;

* wip(go): add validate email handler;

* wip(go): add email builder;

* wip(go): add user invite type migration logic;

* wip(go): only log email send failures;

* wip(go): add tenant id to flows table;

* wip(go): add func to check if connected to clickhouse;

* wip(go): migrate clickhouse;

* wip(go): add tenant id to mdm and edr state;

* wip(go): add delete methods for tables;

* wip(go): add tenant teardown method;

* wip(go): handle tenant deletion;

* wip(go): clean up flow logs on tenant deletion;

* wip(go): add update org membership role id method;

* wip(go): add transfer org ownership api;

* wip(go): move audit logs retention period to org settings;

* wip(go):get retention period from org settings;

* wip(go): remove old audit logs usage;

* wip(go): migrate audit logs retention period;

* wip(go): unmarshal decodes nums as float64;

* wip(go): run flow logs cleanup for all tenants in one go;

* wip(go): add audit logs retention period and smtp settings to tenant settings table for non-msp tenants;

* wip(go): resolve retention period and smtp settings correctly;

* wip(go): handle retention period and smtp settings updates and fetches correctly;

* wip(go): overlay retention period and smtp settings on server settings;;

* wip(go): upsert overlayed settings;

* wip(go): add azure tenant id to org settings;

* wip(go): tenant scope list roles;

* wip(go): add noop creds;

* wip(go): use first instead of find;

* wip(go): use correct roles when transfering ownership;

* wip(go): delete access tokens only if tenant scoped;

* wip(go): make delete user work for both org and tenant scope;

* wip(go): delete extclients only if tenant scoped;

* wip(go): check if caller is allowed to delete user;

* wip(go): infer scope for update user;

* wip(go): prevent org-owner elevation;

* wip(go): permissions check for update;

* wip(go): delete user access tokens only if tenant scope;

* wip(go): delete extclients only if tenant scope;

* wip(go): move upsert membership in upsert user;

* wip(go): set api host when constructing server config;

* wip(go): fix static errors;

* wip(go): fix test cases;

* wip(go): use correct get ns order;

* wip(go): use correct get pending host order;

* wip(go): use correct get access token order;

* wip(go): use correct get event order;

* wip(go): return error response on emqx user creation error;

* wip(go): store correct value in cache;

* wip(go): return better error response;

* wip(go): return better error response;

* wip(go): use cache when listing egress acls;

* wip(go): wire ctx in UserHasNetworkGroupAccess;

* wip(go): remove double scope wrapping;

* wip(go): add security check for list and get org;

* wip(go): ratelimit discover api;

* wip(go): expect sole org id in get and create org owner;

* wip(go): wrap create org owner in tx;

* wip(go): wire ctx correctly;

* wip(go): wire ctx for posture check functions;

* wip(go): remove resolved todo;

* wip(go): wire ctx for posture check function;

* wip(go): remove scope from netdesk login api;

* wip(go): use orgid correctly;

* wip(go): scope user update checks correctly;

* wip(go): wire ctx for fetch oauth secret;

* wip(go): add tenant_id and org_id query string param to user invite url;

* wip(go): get sole org;

* wip(go): set query string correctly;

* wip(go): wire ctx in update user groups;

* wip(go): allow delete oauth non-idp users;

* wip(go): delete access tokens post update but check before update;
 2026-08-10 18:59:40 +05:30
Vishal Dalwadi 132aee0bb3 NM-341-v6: AMB Multi-tenancy Management (#4101) 
* wip(go): return auth token with user on create org owner;

* wip(go): prevent use of default tenant slug ;

* wip(go): upsert settings for tenant in ctx;

* wip(go): use passed ctx when updating user; remove password validation from ValidateUser (already validated in UpdateUser);

* wip(go): qualify all tenant id usages with table name;

* wip(go): use passed ctx

* wip(go): return old enrollment key type on create;

* wip(go): prevent null networks return;

* wip(go): wire ctx in dns/nameserver functions; wire ctx in host registration functions;

* wip(go): wire ctx in node functions;

* wip(go): wire ctx in node functions;

* wip(go): wire ctx in extclient functions;

* wip(go): remove not needed field;

* wip(go): use passed ctx;

* wip(go): use unique index instead of primary key;

* wip(go): wire ctx in extclient apis;

* wip(go): wire ctx in extclient apis;

* wip(go): remove org id check from global scoped get tenant api;

* wip(go): add scope slug to discover response;

* wip(go): wire ctx in get users;

* wip(go): set tenant id in posture check violations;

* wip(go): upsert membership instead of user;

* wip(go): pass correct len;

* wip(go): optimize (single loop);

* wip(go): unify todos;

* wip(go): add todo;

* wip(go): wire context for network get;

* wip(go): wire context;

* wip(go): wire context;

* wip(go): wire ctx when getting tenant superadmin;

* wip(go): add network creator to network admin group;

* wip(go): check for user membership on sync;

* wip(go): add methods with strict membership check;

* wip(go): remove unwanted feature flags;

* wip(go): report per-tenant usage during license validation;

* wip(go): move email setting from tenant to org;

* wip(go): pass org scope to email init;

* wip(go): remove old tenant email settings usages; use org settings to get email settings

* wip(go): use get email settings from org settings;

* wip(go): remove email settings migration;

* wip(go): migrate email settings from server to org settings;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): add membership alias to filter;

* wip(go): skip clearing local license validation response cache;

* wip(go): extend license validation response for multi-tenancy;

* wip(go): add functions to get sole tenant and org;

* wip(go): use tenant-specific feature flags;

* wip(go): add tenant status type;

* wip(go): remove old hook comment;

* wip(go): expect ctx during license validation;

* wip(go): always create default org and tenant for ce;

* wip(go): add tenant-specific check for license validation error;

* wip(go): cache license validation response in memory;

* wip(go): add todo to handle multiple-tenant for integration pull;

* wip(go): pass ctx during license validation;

* wip(go): add todo for making changes later; run hook separately for each tenant;

* wip(go): return specific errors when license validation response not in cache;

* wip(go): use retryable.httpclient for calling license validation api;

* wip(go): process license validation;

* wip(go): license validation function;

* wip(go): migration on license validation;

* wip(go): org settings not expected;

* wip(go): remove expiry from license validation response;

* wip(go): add limits and limits enforcement to license validation response;

* wip(go): remove expiry usages;

* wip(go): add arg to clear cache;

* wip(go): add arg to clear cache;

* wip(go): skip license validation if cached resp;

* wip(go): allow org_id and tenant_id query params;

* wip(go): upsert tenant membership on sync;

* wip(go): pass ctx to delete network roles;

* wip(go): create tenant membership on org owner creation on ce;

* wip(go): add tenant orchestrator;

* wip(go): use tenant orchestrator;

* wip(go): add default settings for tenant;

* wip(go): make org owner superadmin on all tenants;

* wip(go): simplify SyncOrgAndTenants;

* wip(go): retry license validation only 3 times

* wip(go): store invalid err;

* wip(go): add function to check if limits are to be enforced on a tenant;

* wip(go): pass tenant scope if possible when checking for license validation error;

* wip(go): remove merge errors;

* wip(go): add functions for limit checks;

* wip(go): wire host limit check;

* wip(go): wire ingress limit check;

* wip(go): wire egress limit check;

* wip(go): wire client limit check;

* wip(go): wire network limit check;

* wip(go): wire user limit check;

* wip(go): use correct errors;

* wip(go): skip telemetry for msps;

* wip(go): disable telemetry on msp tenants;

* wip(go): err check;

* wip(go): uncomment log event;

* wip(go): get sso state to get scope for non-headless oauth login;

* wip(go): inline delete pending user;

* wip(go): allow both org and tenant scope for pending users table;

* wip(go): add migration for pending user table during set tenant id and rekey org/tenant id;

* wip(go): update queries to use new scope fields in pending users table;

* wip(go): allow both org and tenant scope for user invites table;

* wip(go): update queries to use new scope fields;

* wip(go): add migration for rekey-ing org/tenant id and setting tenant id;

* wip(go): inline delete user invite;

* wip(go): set scope when creating invite;

* wip(go): get user count with membership is ctx is tenant scoped;

* wip(go): add methods to upsert and delete org memberships;

* wip(go): add global valid tenant and org roles map;

* wip(go): add scope query in user invite get by email;

* wip(go): add support for upsert and delete of org and tenant membership both;

* wip(go): infer scope for user invite apis;

* wip(go): wire ctx in get user invite by email;

* wip(go): allow no scope headers to be passed in infer scope apis;

* wip(go): add validation and checks for org-scoped invite api handlers;

* wip(go): wire ctx to is pending user check;

* wip(go): infer scope for pending user apis;

* wip(go): set default role based on ctx scope;

* wip(go): move mfa to tenant membership table; move account status to membership tables;

* wip(go): migrate account status and mfa settings;

* wip(go): update account status on sync;

* wip(go): use update mfa to update mfa setting;

* wip(go): set new membership settings on user creation;

* wip(go): use membership where required;

* wip(go): wire ctx on key unlink refs;

* wip(go): use r.Context directly without reinitializing db;

* wip(go): wire ctx in acls;

* wip(go): add tenant scoped primary key constructor;

* wip(go): use tenant scoped primary key for acls, dns, extclients and tags;

* wip(go): wire ctx for get groups in network;

* wip(go): wire ctx for get groups;

* wip(go): scope non-uuid group ids by tenant id;

* wip(go): migrate non-uuid group ids to scoped ids;

* wip(go): don't expect scope id in invite validation and signup apis;

* wip(go): wire ctx for get matching user; allow org scope when querying by external idp id;

* wip(go): add mfa to org;

* wip(go): scope preauth token;

* wip(go): add fallback for older auth tokens;

* wip(go): wire ctx for preauth token creation;

* wip(go): migrate mfa settings;

* wip(go): resolve mfa settings for inherited auth;

* wip(go): update mfa for org;

* wip(go): infer scope for totp apis;

* wip(go): use ctx when passed;

* wip(go): infer scope for list user apis;

* wip(go): ensure set primary keys don't cause errors during fetch;

* wip(go): make primary key for integrations uuid and store provider in separate key;

* wip(go): migrate integration ids;

* wip(go): use provider instead of id everywhere;

* wip(go): remove gorm column;

* wip(go): wire ctx for igw egress creation;

* wip(go): wire ctx for igw egress update;

* wip(go): wire ctx for host registration;

* wip(go): wire ctx for host registration;

* wip(go): merge errors;

* wip(go): merge errors;

* wip(go): wire ctx; remove default scope usages;

* wip(go): use get with membership;

* wip(go): org scope license validation;

* wip(go): remove debug log;

* wip(go): remove scoping on list roles;

* wip(go): ignore invite creation if already exists;

* wip(go): add is msp func to check if deployment is msp deployment;

* wip(go): ensure username is email for msp users;

* wip(go): add email validated check on user table;

* wip(go): mark email validated when oauth user;

* wip(go): handle gorm error;

* wip(go): add tenant id to siem grpc schema;

* wip(go): read tenant from scoped ctx;

* wip(go): pass scoped ctx to siem grpc client;

* wip(go): remove unused publisher;

* wip(go): publish all tenant exporter updates on pull;

* wip(go): fix wg usage;

* wip(go): tenant scope the ctx when getting server info;

* wip(go): add tenant id to enrollment key token;

* wip(go): make host register tenant scope;

* wip(go): add default settings;

* wip(go): use correct checks for is msp tenant;

* wip(go): add email validation extension;

* wip(go): add pages for validation check;

* wip(go): use extension for validating user;

* wip(go): add invite type;

* wip(go): create only one validation invite per user email;

* wip(go): add validate email handler;

* wip(go): add email builder;

* wip(go): add user invite type migration logic;

* wip(go): only log email send failures;

* wip(go): add tenant id to flows table;

* wip(go): add func to check if connected to clickhouse;

* wip(go): migrate clickhouse;

* wip(go): add tenant id to mdm and edr state;

* wip(go): add delete methods for tables;

* wip(go): add tenant teardown method;

* wip(go): handle tenant deletion;

* wip(go): clean up flow logs on tenant deletion;

* wip(go): add update org membership role id method;

* wip(go): add transfer org ownership api;

* wip(go): move audit logs retention period to org settings;

* wip(go):get retention period from org settings;

* wip(go): remove old audit logs usage;

* wip(go): migrate audit logs retention period;

* wip(go): unmarshal decodes nums as float64;

* wip(go): run flow logs cleanup for all tenants in one go;

* wip(go): add audit logs retention period and smtp settings to tenant settings table for non-msp tenants;

* wip(go): resolve retention period and smtp settings correctly;

* wip(go): handle retention period and smtp settings updates and fetches correctly;

* wip(go): overlay retention period and smtp settings on server settings;;

* wip(go): upsert overlayed settings;

* wip(go): add azure tenant id to org settings;

* wip(go): tenant scope list roles;

* wip(go): add noop creds;

* wip(go): use first instead of find;

* wip(go): use correct roles when transfering ownership;

* wip(go): delete access tokens only if tenant scoped;

* wip(go): make delete user work for both org and tenant scope;

* wip(go): delete extclients only if tenant scoped;

* wip(go): check if caller is allowed to delete user;

* wip(go): infer scope for update user;

* wip(go): prevent org-owner elevation;

* wip(go): permissions check for update;

* wip(go): delete user access tokens only if tenant scope;

* wip(go): delete extclients only if tenant scope;

* wip(go): move upsert membership in upsert user;

* wip(go): set api host when constructing server config;

* wip(go): fix static errors;

* wip(go): fix test cases;

* wip(go): use correct get ns order;

* wip(go): use correct get pending host order;

* wip(go): use correct get access token order;

* wip(go): use correct get event order;

* wip(go): return error response on emqx user creation error;

* wip(go): store correct value in cache;

* wip(go): return better error response;

* wip(go): return better error response;

* wip(go): use cache when listing egress acls;

* wip(go): wire ctx in UserHasNetworkGroupAccess;

* wip(go): remove double scope wrapping;

* wip(go): add security check for list and get org;

* wip(go): ratelimit discover api;

* wip(go): expect sole org id in get and create org owner;

* wip(go): wrap create org owner in tx;
 2026-08-05 21:25:02 +08:00
abhishek9686 10d8789c17 NM-356: resolve pr comments 2026-07-28 00:16:43 +08:00
abhishek9686 204f0c8f18 NM-366: resolve merge conflicts 2026-07-15 11:05:29 +08:00
Abhishek Kondur 5cdc812e95 Merge pull request #4088 from gravitl/master 
Master
 2026-07-15 00:47:12 +08:00
abhishek9686 87d21e91da v1.6.0: enforce jit for all users unless group scoped 2026-07-14 12:10:56 +08:00
abhishek9686 f5a4338844 NM-356: resolve merge conflicts 2026-07-08 13:13:12 +05:30
Vishal DalwadiandAbhishek Kondur f9bbbd7efa NM-341: Schema Migration for Serverconf, Generated and Enrollment Keys Table (#4065) 
* feat(go): remove enrollment key cache;

* feat(go): add internal schema;

* feat(go): use the new internal table to fetch serverconf records;

* feat(go): move internal key constants to schema/internal.go;

* feat(go): add server conf table migration;

* feat(go): use the new internal table for generated records;

* feat(go): add generated table migration;

* feat(go): use the new internal table for serveruuid records;

* feat(go): add server uuid table migration;

* chore(go): remove empty file;

* feat(go): store license validation cached response in the new internal table;

* chore(go): move table name constants;

* feat(go): use migration job name v1.7.0;

* wip(go): add schema definition for enrollment keys;

* wip(go): use schema.EnrollmentKey in orchestrator pkg;

* wip(go): use schema.EnrollmentKey in host registration and pending host approval;

* wip(go): use schema.EnrollmentKey in gateway/node cleanup;

* wip(go): use schema.EnrollmentKey in network cleanup;

* wip(go): use schema.EnrollmentKey in creating default network enrollment key;

* wip(go): use schema.EnrollmentKey in enrollment key logic/controller;

* wip(go): add schema migration for enrollment keys;

* fix(go): remove ref to non-existent constant;

* fix(go): use correct package+type for orchestrator test;

* feat(go): add internal table to list models function;

* fix(go): use int for enrollment key type;

* fix(go): remove tags from networks;

* fix(go): ensure same response for get enrollment keys as before;

* fix(go): enrollment key migration;

* wip(go): remove sqlite, rqlite, postgres and utils from database package;

* wip(go): remove unused database pkg method DeleteAllRecords;

* wip(go): remove db connection management code and accompanying consts from database/ pkg;

* wip(go): add schema definitions for org, tenant and org settings tables;

* wip(go): add tenant id to add tables in schema/ pkg; add tenant-level unique constraints for network, user invite and pending users;

* wip(go): remove usages of host actions table;

* wip(go): create default org and tenant on migration;

* wip(go): manage kv tables with gorm;

* wip(go): bring network id out of value for acls, dns, extclients, metrics and tags tables;

* wip(go): store user settings in user table;

* wip(go): add server settings migration logic;

* wip(go): replace database/ pkg functions with methods from the schema/ pkg;

* wip(go): add schema definitions for tenant settings; replace database/ pkg functions with methods from the schema/ pkg;

* wip(go): add index on tenant id;

* wip(go): remove tenant id column from user role table;

* wip(go): set tenant_id to default tenant's id on all records in all tables on migration;

* wip(go): extract out network_id on acls, dns, extclients, metrics and tags tables on migration;

* wip(go): add scope pkg with middleware to extract scope from headers or set default scope;

* wip(go): scope (most) apis to tenant;

* wip(go): remove users and user roles table from set tenant id migration function;

* wip(go): handle test case errors;

* wip(go): cache default tenant and org ids;

* feat(go): add utils to get server settings during migration;

* feat(go): check nil before conversion;

* feat(go): use correct arg order;

* wip(go): pass db context;

* wip(go): correct api handler router tag;

* wip(go): add schema definitions for org and tenant membership tables;

* wip(go): use middleware from middleware/ package;

* wip(go): add org role constants;

* wip(go): read user tenant role and groups from tenant membership table;

* wip(go): add migration logic for memberships;

* wip(go): undo inadvertent paste;

* wip(go): add migration logic for migrating user's role and groups to tenant membership table and setting org owner;

* wip(go): use tenant membership table to set user role and groups;

* wip(go): test cases;

* feat(go): check for nil;

* feat(go): move auth type, password and external idp id to tenant membership table;

* wip(go): use middleware from middleware/ package;

* wip(go): add schema definitions for org and tenant membership tables;

* wip(go): add temp default function to use default tenant scoped contexts everywhere;

* wip(go): use scope.Default to set tenant id before db ops;

* wip(go): create default org and tenant for tests as well;

* wip(go): move Default to logic to remove import cycle;

* wip(go): scope auth request to default context;

* wip(go): migration fixes;

* wip(go): use correct column; migrate membership on user migrate;

* fix(go): add smtp tls verify skip setting;

* fix(go): add smtp tls verify skip setting;

---------

Co-authored-by: Abhishek Kondur <[email protected]>
 2026-07-06 23:00:21 +05:30
abhishek9686 cba2ed29e2 NM-356: Add user-facing device APIs for Desktop/netclient full-mesh workflows. 
Introduce /api/v1/device/* endpoints (network list, join, leave, sync, JIT request)
with host ownership via OwnerUsername, role-based join authorization for non-admin users,
and Pro hooks for JIT enrichment and host disconnect on grant expiry.
 2026-06-30 08:26:01 +05:30
Abhishek Kondur aa941a94c4 Merge pull request #4075 from gravitl/master 
Master
 2026-06-29 10:27:47 +05:30
abhishek9686 f7f496adc4 NM-362: add wazuh integration 2026-06-26 21:10:41 +05:30
abhishek9686 49276392bc NM-362: fix crowdstrike status check 2026-06-25 10:35:56 +05:30
VishalDalwadi 7d121066e5 fix(go): allow network admins access to list and view extclient configs; 2026-06-23 08:47:25 +05:30
abhishek9686 005ce4832b NM-362: add EDR integration support 2026-06-18 23:01:30 +05:30
abhishek9686 0cb9a5d574 NM-304: resolve pr issues 2026-06-18 11:17:57 +05:30
abhishek9686 7fb9fe3e85 NM-304: add iru mdm 2026-06-18 00:10:00 +05:30
abhishek9686 c00cf184c9 NM-304: fix intune mdm checks 2026-06-17 23:16:41 +05:30
abhishek9686 57f4076ac0 NM-304: resolve merge conflicts 2026-06-12 08:32:58 +05:30
Abhishek KondurVishalDalwadiVishal Dalwadi
 		79ccbfbc93 NM-344: streamline user group mgmt (#4044) 
* feat(go): allow setting enrollment key as default on update;

* feat(go): clear default enrollment keys on update;

* feat(go): remove datadog client dependency;

* feat(go): remove ipaddr dependency;

* feat(go): remove okta sdk dependency;

* chore(go): make schema filename plural;

* fix(go): prevent resetting node expiration time on update;

* fix(go): set expiration datetime only if non-zero;

* fix(go): upsert violations only on violation check;

* fix(go): copy status on conversion;

* fix(go): check posture check violations on node create;

* feat(go): separate out last evaluation cycle id and last evaluated at;

* feat(go): add reserved set to store ips that are pending commit; avoid double allocation;

* fix(go): copy auto relayed peers on conversion;

* fix(go): remove posture checks on delete ingress gateway and update node;

* fix(go): use column update functions to update status and violations;

* fix(go): add type to dns entry model;

* fix(go): drop groups on role change;

* fix(go): drop groups on role upgrade to admin/superadmin;

* fix(go): run posture checks on host update;

* fix(go): read from correct variable;

* fix(go): remove groups membership changes on role change;

* NM-344: allow superadmin to self update groups, add/remove grps from admins

* NM-344: enforce network grps permissions to admins

* NM-344: fix ip pool race condition

* NM-344: handle Ip pool in HA mode

* NM-344: for auditor role remove groups

* NM-344: add onboarding status api

* NM-344: don't drop grps on updates

* NM-344: preserve idp grps on updates

---------

Co-authored-by: VishalDalwadi <[email protected]>
Co-authored-by: Vishal Dalwadi <[email protected]>
 2026-06-06 11:23:37 +05:30
abhishek9686 1621daa829 NM-304: add jumpcloud to mdm providers, check device policy status for complaince check 2026-06-04 20:25:12 +05:30
abhishek9686 36c4f27dd1 NM-304: resolve merge conflicts 2026-06-03 08:28:16 +05:30
Vishal DalwadiandAbhishek Kondur 316df944e0 NM-294: SIEM Integration (#4021) 
* feat(go): add apis for siem integration;

* feat(go): remove unnecessary comments;

* feat(go): add siem clients and use them for sending test events;

* feat(go): add grpc and protobuf definitions for auditlogs and siem;

* feat(go): move flow client to netmaker;

* feat(go): remove struct name prefix;

* feat(go): set table name;

* chore(go): alphabetical ordering;

* chore(go): use quotes directly;

* feat(go): add validation for integration type on get;

* feat(go): add check for update in upsert integration handler;

* feat(go): move envelope to export function;

* feat(go): start default client's batch loop on usage;

* feat(go): mask secrets in get integration api;

* feat(go): check for valid sites in validate;

* feat(go): validate workspace_id;

* feat(go): redact integration secrets on upsert as well;

* feat(go): flip tls verification;

* feat(go): validate elastic index;

---------

Co-authored-by: Abhishek Kondur <[email protected]>
 2026-06-01 13:40:57 +05:30
abhishek9686 20060c1000 Merge branch 'develop' of https://github.com/gravitl/netmaker into NM-304 2026-05-31 08:41:24 +05:30
Vishal Dalwaditenki-reviewer[bot]abhishek9686
 		add6a49362 NM-293: Nodes Schema Migration (#4013) 
* feat(go): add schema for pending users table;

1. Schema Definition for Pending Users table.
2. Use the newer table everywhere.
3. Migration stubs for v1.5.2.
4. Migration code for Pending Users table;

* feat(go): add schema for user invites table;

1. Schema Definition for User Invites table.
2. Use the newer table everywhere.
3. Migration code for User Invites table;

* feat(go): add schema definitions for nodes, gateways and posture check violations table;

* feat(go): remove legacy node usages;

* fix(go): address code review comments;

1. remove column names in primary key for PostureCheckViolation struct.
2. use correct column name for network_id.
3. handle rollback error.

* feat(go): check ip uniqueness using db query;

* feat(go): remove nodes and network nodes cache; remove unused functions and consts;

* feat(go): delete unused function GetExtClientHAConf;

* feat(go): optimize DoesHostExistInTheNetworkAlready;

* feat(go): remove legacy node and migration;

* feat(go): implement network orchestrator;

1. Implements IP Allocation for Nodes and Extclients;

* feat(go): implement gateway orchestrator and extensions;

1. Implements CreateGateway;
2. Pro and CE Gateway Extensions to ConfigureAutoRelay;

* feat(go): implement node orchestrator and extensions;

1. Implements CreateNode;
2. Pro and CE Node Extensions to ConfigureAutoAssignGateway;

* feat(go): implement orchestrator repository and extensions factory;

* feat(go): add repository initialization with correct factory;

* feat(go): remove persistent keep alive and mtu from gateway;

* feat(go): add auto relayed peers to node;

* feat(go): rename relay gateway to relaying node; use null string instead of string pointer;

* fix(go): merge errors;

* feat(go): add update node last checkin function;

* feat(go): wire orchestrator create node;

1. Enrollment Key Join.
2. API: Add Host to Network.
3. API: Approve Pending Host.
4. API: Update Host (Make Host Default).
5. API: Create Network (Add Default Hosts to Network).

* feat(go): inline create extclient;

Remove cyclic dependency between logic and orchestrator;

* feat(go): remove old create node functions;

* feat(go): optimize bulk update node connected status;

* feat(go): mark pending delete directly; move constants;

* feat(go): remove unused validations;

* feat(go): remove allocated ip map cache;

* feat(go): use host persistent keep alive and mtu for extclient config;

* feat(go): remove (almost) all failover "unused" code;

* feat(go): guard address allocation with mtx;

* feat(go): validate node ip uniqueness with network orchestrator;

* feat(go): convert schema node to models node for host update;

* feat(go): remove nodes cache initialization;

* feat(go): use mark for deletion for node soft delete and delete for hard delete; add preload options for node get;

* feat(go): removed unused code;

1. No calls for GetRelays and commented GetRelayedNodes.
2. GetNodeEgressInfo populates egress details for node but they aren't validated here.

* feat(go): convert duration to seconds;

* feat(go): remove gateway schema, extensions and orchestrator; move gateway management to nodes extension and orchestrator;

* feat(go): remove self-referential foreign key;

* feat(go): add converters for schema node; use net tables for getting a node and listing all nodes;

* feat(go): remove unused code;

* feat(go): use models.Node for delete channel;

* feat(go): optimize node telemetry gen;

* feat(go): pass schema.Node to check zombies;

* feat(go): add model.Node to schema.Node conversion;

* feat(go): upsert violations on node upsert;

* feat(go): remove all SetDNS usage;

* feat(go): use fetchAll instead of database.FetchRecords;

* feat(go): add nodes migration;

* feat(go): remove unused node methods;

* refactor(go): improve field names;

* feat(go): remove unused network methods;

* feat(go): move type NodeStatus and status constants to scheme package;

* feat(go): add list network nodes paginated api;

* feat(go): add filters to list nodes paginated api;

* feat(go): improve logs; manage tx outside of schema pkg;

* feat(go): ensure address empty for nil ips;

* feat(go): add json tags;

* feat(go): add json tags;

* feat(go): use string ptr instead of NullString;

* feat(go): use api host in list response;

* feat(go): optimize list posture check violations api;

* feat(go): list only current violations;

* feat(go): scope table field on join;

* NM-293: fix static checks

* NM-293: fix static checks

* NM-293: fix static checks

* Update orchestrator/network.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-293: fix invalid gorm struct tags

* NM-293: Only set RelayingNodeID when the node is actually relayed.

* NM-293: use RelayedByNodeID for clarity

* feat(go): add pkg for json expressions; add node methods to do json operations in db;

* feat(go): make options common for all orchestrators; use orchestrator create gateway in api;

* feat(go): add delete all methods; add set internet gateway in db;

* feat(go): set is ingress gateway to is gateway;

* feat(go): restore igws handlers;

* feat(go): use network name in tag;

* feat(go): add skip mq host and node update options;

* feat(go): add node orchestrator test suite;

* feat(go): set network addr range on conversion;

* feat(go): upsert node instead of update node;

* feat(go): remove old todos;

* feat(go): use only is_gw to determine whether gateway;

* feat(go): add create node with default host test case;

* feat(go): add create node with enrollment key test case;

* feat(go): add pro node orchestrator test suite;

* feat(go): update node and client status on update metrics;

* feat(go): add node status filters;

* feat(go): update node status on bulk update as well;

* feat(go): prevent reset of host password on upsert;

* feat(go): disable platform/service user device join;

* feat(go): disable platform/service user device join;

* feat(go): add search across fields for list network nodes api;

* feat(go): add field for additional gateway endpoints;

* feat(go): configure tags only if they belong to the node network;

* feat(go): optimize tag assignments and unassignments;

* feat(go): add posture check violations check before create node;

Check not added for default host on network create;

* feat(go): copy key before editing key networks to prevent changes in the cache;

* feat(go): construct another network slice instead of in-place delete;

* feat(go): error only when no networks left to join;

* feat(go): move set defaults to schema migration;

* feat(go): load server settings in cache before migration;

* feat(go): migrate gateway nameserver and egress along with nodes;

* feat(go): disable netclient auto update if disabled globally;

* refactor(go): move network nameserver migration to separate function;

* feat(go): calculate node status on migrate (skipping metrics check);

Previously, we weren't setting the node status in db, just recalculating on the fly. With this version, we expect the node status to be in the db and recalculated when metrics are pushed from netclient. So we have to recalculate the node status to initialize the status value.

* feat(go): update only if nodeIDs is non-empty;

WithFilter adds the where clause only if atleast one value is passed. To prevent updating status of all nodes, add a check for nodeIDs.

* fix(go): remove tag;

Execute assign tag only when at least one node has to be tagged;

* feat(go): add egress nat mode migration;

* fix(go): use correct network id;

* fix(go): make is_auto_relay string;

* fix(go): create tag before use to pass test;

* fix(go): move delete to testutils package;

* fix(go): assign tag only when one or more node ids;

* feat(go): set is_auto_relay to no for CE;

* feat(go): add check for host in network before calling create node;

TODO: move this check to node orchestrator ValidateCreateNode method;

* fix(go): allow ipv4 nameserver in ipv6 network and vice versa on migrate;

* fix(go): update acls before ensuring default acls exist;

* feat(go): set status online on create;

* feat(go): add nodes migration cleanup;

* feat(go): allow json keys with ".";

* feat(go): set node network range from network record;

* feat(go): publish node update on node status update;

* feat(go): set status when netclient requests connect/disconnect;

* feat(go): set status when netclient requests connect/disconnect;

* fix(go): remove unnecessary use of sprintf;

* fix(go): add inetclients to relayed clients and not the other way around;

* feat(go): disable auto assign gateway when node is igw client;

---------

Co-authored-by: abhishek9686 <[email protected]>
Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
 2026-05-20 15:56:15 +05:30
Abhishek Kondurtenki-reviewer[bot]VishalDalwadi
 		3beb1add16 NM-300: Clean up stale metrics on node deletion and disconnect (#3956) 
* Clean up stale metrics on node deletion and disconnect

When a node is deleted or disconnected, peer nodes retained stale
metrics (showing the node as connected with outdated latency values).
This adds cleanup logic to:
- Remove the deleted node's entry from all peers' connectivity maps
- Mark the node as disconnected (Connected=false, Latency=999) in
  peers' metrics when a node goes offline
- Run periodic peer metrics cleanup in MetricsMonitor as a safety net
  for nodes that drop off without a graceful disconnect

* NM-300: add metrics collection triggers

* NM-300: comment out reconnect metrics trigger

* Apply suggestion from @tenki-reviewer[bot]

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-300: update metrics func name

* NM-300: set disconnected metrics from cli

* feat(go): set status when netclient requests connect/disconnect;

* NM-300: fix metrics disconnected trigger

* NM-300: rm duplicate user grp update hooks

---------

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
Co-authored-by: VishalDalwadi <[email protected]>
 2026-05-19 07:32:48 +05:30
abhishek9686 265a3f70fe NM-304: add MDM posture integration 2026-05-18 16:22:45 +05:30
Vishal Dalwaditenki-reviewer[bot]abhishek9686
 		fdcf11e0db NM-293: Nodes Schema Migration (#3982) 
* feat(go): add schema for pending users table;

1. Schema Definition for Pending Users table.
2. Use the newer table everywhere.
3. Migration stubs for v1.5.2.
4. Migration code for Pending Users table;

* feat(go): add schema for user invites table;

1. Schema Definition for User Invites table.
2. Use the newer table everywhere.
3. Migration code for User Invites table;

* feat(go): add schema definitions for nodes, gateways and posture check violations table;

* feat(go): remove legacy node usages;

* fix(go): address code review comments;

1. remove column names in primary key for PostureCheckViolation struct.
2. use correct column name for network_id.
3. handle rollback error.

* feat(go): check ip uniqueness using db query;

* feat(go): remove nodes and network nodes cache; remove unused functions and consts;

* feat(go): delete unused function GetExtClientHAConf;

* feat(go): optimize DoesHostExistInTheNetworkAlready;

* feat(go): remove legacy node and migration;

* feat(go): implement network orchestrator;

1. Implements IP Allocation for Nodes and Extclients;

* feat(go): implement gateway orchestrator and extensions;

1. Implements CreateGateway;
2. Pro and CE Gateway Extensions to ConfigureAutoRelay;

* feat(go): implement node orchestrator and extensions;

1. Implements CreateNode;
2. Pro and CE Node Extensions to ConfigureAutoAssignGateway;

* feat(go): implement orchestrator repository and extensions factory;

* feat(go): add repository initialization with correct factory;

* feat(go): remove persistent keep alive and mtu from gateway;

* feat(go): add auto relayed peers to node;

* feat(go): rename relay gateway to relaying node; use null string instead of string pointer;

* fix(go): merge errors;

* feat(go): add update node last checkin function;

* feat(go): wire orchestrator create node;

1. Enrollment Key Join.
2. API: Add Host to Network.
3. API: Approve Pending Host.
4. API: Update Host (Make Host Default).
5. API: Create Network (Add Default Hosts to Network).

* feat(go): inline create extclient;

Remove cyclic dependency between logic and orchestrator;

* feat(go): remove old create node functions;

* feat(go): optimize bulk update node connected status;

* feat(go): mark pending delete directly; move constants;

* feat(go): remove unused validations;

* feat(go): remove allocated ip map cache;

* feat(go): use host persistent keep alive and mtu for extclient config;

* feat(go): remove (almost) all failover "unused" code;

* feat(go): guard address allocation with mtx;

* feat(go): validate node ip uniqueness with network orchestrator;

* feat(go): convert schema node to models node for host update;

* feat(go): remove nodes cache initialization;

* feat(go): use mark for deletion for node soft delete and delete for hard delete; add preload options for node get;

* feat(go): removed unused code;

1. No calls for GetRelays and commented GetRelayedNodes.
2. GetNodeEgressInfo populates egress details for node but they aren't validated here.

* feat(go): convert duration to seconds;

* feat(go): remove gateway schema, extensions and orchestrator; move gateway management to nodes extension and orchestrator;

* feat(go): remove self-referential foreign key;

* feat(go): add converters for schema node; use net tables for getting a node and listing all nodes;

* feat(go): remove unused code;

* feat(go): use models.Node for delete channel;

* feat(go): optimize node telemetry gen;

* feat(go): pass schema.Node to check zombies;

* feat(go): add model.Node to schema.Node conversion;

* feat(go): upsert violations on node upsert;

* feat(go): remove all SetDNS usage;

* feat(go): use fetchAll instead of database.FetchRecords;

* feat(go): add nodes migration;

* feat(go): remove unused node methods;

* refactor(go): improve field names;

* feat(go): remove unused network methods;

* feat(go): move type NodeStatus and status constants to scheme package;

* feat(go): add list network nodes paginated api;

* feat(go): add filters to list nodes paginated api;

* feat(go): improve logs; manage tx outside of schema pkg;

* feat(go): ensure address empty for nil ips;

* feat(go): add json tags;

* feat(go): add json tags;

* feat(go): use string ptr instead of NullString;

* feat(go): use api host in list response;

* feat(go): optimize list posture check violations api;

* feat(go): list only current violations;

* feat(go): scope table field on join;

* NM-293: fix static checks

* NM-293: fix static checks

* NM-293: fix static checks

* Update orchestrator/network.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-293: fix invalid gorm struct tags

* NM-293: Only set RelayingNodeID when the node is actually relayed.

* NM-293: use RelayedByNodeID for clarity

* feat(go): add pkg for json expressions; add node methods to do json operations in db;

* feat(go): make options common for all orchestrators; use orchestrator create gateway in api;

* feat(go): add delete all methods; add set internet gateway in db;

* feat(go): set is ingress gateway to is gateway;

* feat(go): restore igws handlers;

* feat(go): use network name in tag;

* feat(go): add skip mq host and node update options;

* feat(go): add node orchestrator test suite;

* feat(go): set network addr range on conversion;

* feat(go): upsert node instead of update node;

* feat(go): remove old todos;

* feat(go): use only is_gw to determine whether gateway;

* feat(go): add create node with default host test case;

* feat(go): add create node with enrollment key test case;

* feat(go): add pro node orchestrator test suite;

* feat(go): update node and client status on update metrics;

* feat(go): add node status filters;

* feat(go): update node status on bulk update as well;

* feat(go): prevent reset of host password on upsert;

* feat(go): disable platform/service user device join;

* feat(go): disable platform/service user device join;

* feat(go): add search across fields for list network nodes api;

* feat(go): add field for additional gateway endpoints;

* feat(go): configure tags only if they belong to the node network;

* feat(go): optimize tag assignments and unassignments;

* feat(go): add posture check violations check before create node;

Check not added for default host on network create;

* feat(go): copy key before editing key networks to prevent changes in the cache;

* feat(go): construct another network slice instead of in-place delete;

* feat(go): error only when no networks left to join;

* feat(go): move set defaults to schema migration;

* feat(go): load server settings in cache before migration;

* feat(go): migrate gateway nameserver and egress along with nodes;

* feat(go): disable netclient auto update if disabled globally;

* refactor(go): move network nameserver migration to separate function;

* feat(go): calculate node status on migrate (skipping metrics check);

Previously, we weren't setting the node status in db, just recalculating on the fly. With this version, we expect the node status to be in the db and recalculated when metrics are pushed from netclient. So we have to recalculate the node status to initialize the status value.

* feat(go): update only if nodeIDs is non-empty;

WithFilter adds the where clause only if atleast one value is passed. To prevent updating status of all nodes, add a check for nodeIDs.

* fix(go): remove tag;

Execute assign tag only when at least one node has to be tagged;

* feat(go): add egress nat mode migration;

* fix(go): use correct network id;

* fix(go): make is_auto_relay string;

* fix(go): create tag before use to pass test;

* fix(go): move delete to testutils package;

---------

Co-authored-by: abhishek9686 <[email protected]>
Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
 2026-05-15 20:35:53 +05:30
VishalDalwadi acf2e215bd feat(go): add api to trigger license validation; move license functions and types into separate package; 2026-04-27 18:24:50 +05:30
Abhishek Kondur 94430e7df4 Revert "NM-321: Trigger License Validation API" 2026-04-27 15:59:24 +05:30
VishalDalwadi 1cd697bcca feat(go): add api to trigger license validation; move license functions and types into separate package; 2026-04-24 08:55:51 +05:30
Abhishek KondurVishalDalwadiVishal Dalwadi
 		12cc967ba1 Fixes/v1.5.1 (#3938) 
* fix(go): set persistent keep alive when registering host using sso;

* fix(go): run posture check violations on delete;

* fix(go): upsert node on approving pending host;

* fix(go): resolve concurrency issues during group delete cleanup;

* fix(go): update doc links;

* fix(go): add created and updated fields to host;

* fix(go): skip delete and update superadmin on sync users;

* fix(go): use conn directly for now;

* fix(go): remove acl for idp groups;

* fix(go): quote fields;

* fix(go): use filters with count;

* feat(go): add a search query;

* fix(go): cleanup acls;

* fix(go): review fixes;

* fix(go): remove additional loop;

* fix(go): fix

* v1.5.1: separate out idp sync and reset signals for HA

* v1.5.1: add grps with name for logging

* v1.5.1: clear posture check violations when all checks are deleted

* v1.5.1: set static when default host

* v1.5.1: fix db status check

* rm set max conns

* v1.5.1: reset auto assigned gw when disconnected

* fix(go): skip global network admin and user groups when splitting;

* v1.5.1: fix update node call from client

* fix(go): separate out migration from normal usage;

* fix(go): skip default groups;

* fix(go): create policies for existing groups on network create;

* fix(go): skip fatal log on clickhouse conn;

* fix(go): add posture check cleanup;

---------

Co-authored-by: VishalDalwadi <[email protected]>
Co-authored-by: Vishal Dalwadi <[email protected]>
 2026-03-28 01:08:59 +05:30
Abhishek Kondurandtenki-reviewer[bot] c3c3ed1fb8 NM-254: add bulk delete apis, rm old acl code (#3937) 
* NM-254: add bulk delete apis for users, hosts, nodes and optimise postgres connection settings

* NM-254: rm debug logs

* NM-254: add bulk delete apis, remove old acl code

* NM-254: rm unused flag

* NM-254: fix bulk delete bugs, add security and performance improvements

- Fix host delete notifying peers before confirming deletion from DB
- Fix self-delete vulnerability in bulk user delete
- Fix DissasociateNodeFromHost failing when host.Nodes is empty
- Fix AssociateNodeToHost/DissasociateNodeFromHost stale read race
- Hoist GetAllExtClients outside loop in bulk user delete/status
- Move initializeUUID outside master-pod guard for HA correctness

* NM-254: return 202 Accepted for async bulk APIs, fix relay allowedIPs and host association error handling

- Change all bulk endpoints (hosts, nodes, users, ext clients) from
  200 OK to 202 Accepted to correctly signal async processing
- Add ReturnAcceptedResponse helper in logic/errors.go
- Fix GetAllowedIpsForRelayed returning empty allowedIPs slice,
  restoring relay connectivity
- Make AssociateNodeToHost and DissasociateNodeFromHost return an
  error when the host DB re-fetch fails instead of silently using
  stale data
- Add bulk-apis.md documenting all five bulk endpoints

* NM-254: rm coredns container

* NM-254: add bulk apis for node,extclient status, add activity logs to bulk apis

* NM-254: add bulk api for connection toggle

* NM-254: add network check

* Update controllers/hosts.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-254: optimise bulk extclient deletion

---------

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
 2026-03-26 10:15:07 +05:30
Abhishek KondurVishalDalwadiVishal Dalwaditenki-reviewer[bot]
 		292af315dd NM-271: Scalability Improvements (#3921) 
* feat(go): add user schema;

* feat(go): migrate to user schema;

* feat(go): add audit fields;

* feat(go): remove unused fields from the network model;

* feat(go): add network schema;

* feat(go): migrate to network schema;

* refactor(go): add comment to clarify migration logic;

* fix(go): test failures;

* fix(go): test failures;

* feat(go): change membership table to store memberships at all scopes;

* feat(go): add schema for access grants;

* feat(go): remove nameservers from new networks table; ensure db passed for schema functions;

* feat(go): set max conns for sqlite to 1;

* fix(go): issues updating user account status;

* NM-236: streamline operations in HA mode

* NM-236: only master pod should subscribe to updates from clients

* refactor(go): remove converters and access grants;

* refactor(go): add json tags in schema models;

* refactor(go): rename file to migrate_v1_6_0.go;

* refactor(go): add user groups and user roles tables; use schema tables;

* refactor(go): inline get and list from schema package;

* refactor(go): inline get network and list users from schema package;

* fix(go): staticcheck issues;

* fix(go): remove test not in use; fix test case;

* fix(go): validate network;

* fix(go): resolve static checks;

* fix(go): new models errors;

* fix(go): test errors;

* fix(go): handle no records;

* fix(go): add validations for user object;

* fix(go): set correct extclient status;

* fix(go): test error;

* feat(go): make schema the base package;

* feat(go): add host schema;

* feat(go): use schema host everywhere;

* feat(go): inline get host, list hosts and delete host;

* feat(go): use non-ptr value;

* feat(go): use save to upsert all fields;

* feat(go): use save to upsert all fields;

* feat(go): save turn endpoint as string;

* feat(go): check for gorm error record not found;

* fix(go): test failures;

* fix(go): update all network fields;

* fix(go): update all network fields;

* feat(go): add paginated list networks api;

* feat(go): add paginated list users api;

* feat(go): add paginated list hosts api;

* feat(go): add pagination to list groups api;

* fix(go): comment;

* fix(go): implement marshal and unmarshal text for custom types;

* fix(go): implement marshal and unmarshal json for custom types;

* fix(go): just use the old model for unmarshalling;

* fix(go): implement marshal and unmarshal json for custom types;

* NM-271:Import swap: compress/gzip replaced with github.com/klauspost/compress/gzip (2-4x faster, wire-compatible output). Added sync import.
Two sync.Pool variables (gzipWriterPool, bufferPool): reuse gzip.Writer and bytes.Buffer across calls instead of allocating fresh ones per publish.
compressPayload rewritten: pulls writer + buffer from pools, resets them, compresses at gzip.BestSpeed (level 1), copies the result out of the pooled buffer, and returns both objects to the pools.

* feat(go): remove paginated list networks api;

* feat(go): use custom paginated response object;

* NM-271: Improve server scalability under high host count

- Replace stdlib compress/gzip with klauspost/compress at BestSpeed and
  pool gzip writers and buffers via sync.Pool to eliminate compression
  as the dominant CPU hotspot.

- Debounce peer update broadcasts with a 500ms resettable window capped
  at 3s max-wait, coalescing rapid-fire PublishPeerUpdate calls into a
  single broadcast cycle.

- Cache HostPeerInfo (batch-refreshed by debounce worker) and
  HostPeerUpdate (stored as side-effect of each publish) so the pull API
  and peer_info API serve from pre-computed maps instead of triggering
  expensive per-host computations under thundering herd conditions.

- Warm both caches synchronously at startup before the first publish
  cycle so early pull requests are served instantly.

- Bound concurrent MQTT publishes to 5 via semaphore to prevent
  broker TCP buffer overflows that caused broken pipe disconnects.

- Remove manual Disconnect+SetupMQTT from ConnectionLostHandler and
  rely on the paho client's built-in AutoReconnect; add a 5s retry
  wait in publish() to ride out brief reconnection windows.

* NM-271: Reduce server CPU contention under high concurrent load

- Cache ServerSettings with atomic.Value to eliminate repeated DB reads
  on every pull request (was 32+ goroutines blocked on read lock)
- Batch UpdateNodeCheckin writes in memory, flush every 30s to reduce
  per-checkin write lock contention (was 88+ goroutines blocked)
- Enable SQLite WAL mode + busy_timeout and remove global dbMutex;
  let SQLite handle concurrency natively (reads no longer block writes)
- Move ResetFailedOverPeer/ResetAutoRelayedPeer to async in pull()
  handler since results don't affect the cached response
- Skip no-op UpsertNode writes in failover/relay reset functions
  (early return when node has no failover/relay state)
- Remove CheckHostPorts from hostUpdateFallback hot path
- Switch to pure-Go SQLite driver (glebarez/sqlite), set CGO_ENABLED=0

* fix(go): ensure default values for page and per_page are used when not passed;

* fix(go): rename v1.6.0 to v1.5.1;

* fix(go): check for gorm.ErrRecordNotFound instead of database.IsEmptyRecord;

* fix(go): use host id, not pending host id;

* NM-271: Revert pure-Go SQLite and FIPS disable to verify impact

Revert to CGO-based mattn/go-sqlite3 driver and re-enable FIPS to
isolate whether these changes are still needed now that the global
dbMutex has been removed and WAL mode is enabled. Keep WAL mode
pragma with mattn-compatible DSN format.

* feat(go): add filters to paginated apis;

* feat(go): add filters to paginated apis;

* feat(go): remove check for max username length;

* feat(go): add filters to count as well;

* feat(go): use library to check email address validity;

* feat(go): ignore pagination if params not passed;

* fix(go): pagination issues;

* fix(go): check exists before using;

* fix(go): remove debug log;

* NM-271: rm debug logs

* NM-271: check if caching is enabled

* NM-271: add server sync mq topic for HA mode

* NM-271: fix build

* NM-271: push metrics in batch to exproter over api

* NM-271: use basic auth for exporter metrics api

* fix(go): use gorm err record not found;

* NM-271: Add monitoring stack on demand

* NM-271: -m arg for install script should only add monitoring stack

* fix(go): use gorm err record not found;

* NM-271: update docker compose file for prometheus

* NM-271: update docker compose file for prometheus

* fix(go): use user principal name when creating pending user;

* fix(go): use schema package for consts;

* NM-236: rm duplicate network hook

* NM-271: add server topic to reset idp hooks on master node

* fix(go): prevent disabling superadmin user;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): swap is admin and is superadmin;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): remove dead code block;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2928837937

* fix(go): incorrect message when trying to disable self;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2928837934

* NM-271: fix stale peers on reset_failovered pull and add HTTP timeout to metrics exporter

Run the failover/relay reset synchronously in the pull handler so the
response reflects post-reset topology instead of serving stale cached
peers. Add a 30s timeout to the metrics exporter HTTP client to prevent
PushAllMetricsToExporter from blocking the Keepalive loop.

* NM-271: fix gzip pool corruption, MQTT topic mismatch, stale settings cache, and reduce redundant DB fetches

- Only return gzip.Writer to pool after successful Close to prevent
  silently malformed MQTT payloads from a previously errored writer.
- Fix serversync subscription to exact topic match since syncType is
  now in the message payload, not the topic path.
- Prevent zero-value ServerSettings from being cached indefinitely
  when the DB record is missing or unmarshal fails on startup.
- Return fetched hosts/nodes from RefreshHostPeerInfoCache so
  warmPeerCaches reuses them instead of querying the DB twice.
- Compute fresh HostPeerUpdate on reset_failovered pull instead of
  serving stale cache, and store result back for subsequent requests.

* NM-271: fix gzip writer pool leak, log checkin flush errors, and fix master pod ordinal parsing

- Reset gzip.Writer to io.Discard before returning to pool so errored
  writers are never leaked or silently reused with corrupt state.
- Track and log failed DB inserts in FlushNodeCheckins so operators
  have visibility when check-in timestamps are lost.
- Parse StatefulSet pod ordinal as integer instead of using HasSuffix
  to prevent netmaker-10 from being misidentified as master pod.

* NM-271: simplify masterpod logic

* fix(go): use correct header;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): return after error response;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): use correct order of params;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2929593036

* fix(go): set default values for page and page size; use v2 instead of /list;

* NM-271: use host name

* Update mq/serversync.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-271: fix duplicate serversynce case

* NM-271: streamline gw updates

* Update logic/auth.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* Update schema/user_roles.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): syntax error;

* fix(go): set default values when page and per_page are not passed or 0;

* fix(go): use uuid.parse instead of uuid.must parse;

* fix(go): review errors;

* fix(go): review errors;

* Update controllers/user.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* Update controllers/user.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-163: fix errors:

* Update db/types/options.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): persist return user in event;

* Update db/types/options.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-271: signal pull on ip changes

* NM-163: duplicate lines of code

* NM-163: fix(go): fix missing return and filter parsing in user controller

- Add missing return after error response in updateUserAccountStatus
  to prevent double-response and spurious ext-client side-effects
- Use switch statements in listUsers to skip unrecognized
  account_status and mfa_status filter values

* NM-271: signal pull req on node ip change

* fix(go): check for both min and max page size;

* NM-271: refresh node object before update

* fix(go): enclose transfer superadmin in transaction;

* fix(go): review errors;

* fix(go): remove free tier checks;

* fix(go): review fixes;

* NM-271: streamline ip pool ops

* NM-271: fix tests, set max idle conns

* NM-271: fix(go): fix data races in settings cache and peer update worker

- Use pointer type in atomic.Value for serverSettingsCache to avoid
  replacing the variable non-atomically in InvalidateServerSettingsCache
- Swap peerUpdateReplace flag before draining the channel to prevent
  a concurrent replacePeers=true from being consumed by the wrong cycle

---------

Co-authored-by: VishalDalwadi <[email protected]>
Co-authored-by: Vishal Dalwadi <[email protected]>
Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
 2026-03-18 00:24:54 +05:30
Abhishek KondurVishalDalwadiVishal Dalwaditenki-reviewer[bot]
 		edda2868fc NM-163: Users, Groups, Roles, Networks and Hosts Table Migration (#3910) 
* feat(go): add user schema;

* feat(go): migrate to user schema;

* feat(go): add audit fields;

* feat(go): remove unused fields from the network model;

* feat(go): add network schema;

* feat(go): migrate to network schema;

* refactor(go): add comment to clarify migration logic;

* fix(go): test failures;

* fix(go): test failures;

* feat(go): change membership table to store memberships at all scopes;

* feat(go): add schema for access grants;

* feat(go): remove nameservers from new networks table; ensure db passed for schema functions;

* feat(go): set max conns for sqlite to 1;

* fix(go): issues updating user account status;

* refactor(go): remove converters and access grants;

* refactor(go): add json tags in schema models;

* refactor(go): rename file to migrate_v1_6_0.go;

* refactor(go): add user groups and user roles tables; use schema tables;

* refactor(go): inline get and list from schema package;

* refactor(go): inline get network and list users from schema package;

* fix(go): staticcheck issues;

* fix(go): remove test not in use; fix test case;

* fix(go): validate network;

* fix(go): resolve static checks;

* fix(go): new models errors;

* fix(go): test errors;

* fix(go): handle no records;

* fix(go): add validations for user object;

* fix(go): set correct extclient status;

* fix(go): test error;

* feat(go): make schema the base package;

* feat(go): add host schema;

* feat(go): use schema host everywhere;

* feat(go): inline get host, list hosts and delete host;

* feat(go): use non-ptr value;

* feat(go): use save to upsert all fields;

* feat(go): use save to upsert all fields;

* feat(go): save turn endpoint as string;

* feat(go): check for gorm error record not found;

* fix(go): test failures;

* fix(go): update all network fields;

* fix(go): update all network fields;

* feat(go): add paginated list networks api;

* feat(go): add paginated list users api;

* feat(go): add paginated list hosts api;

* feat(go): add pagination to list groups api;

* fix(go): comment;

* fix(go): implement marshal and unmarshal text for custom types;

* fix(go): implement marshal and unmarshal json for custom types;

* fix(go): just use the old model for unmarshalling;

* fix(go): implement marshal and unmarshal json for custom types;

* feat(go): remove paginated list networks api;

* feat(go): use custom paginated response object;

* fix(go): ensure default values for page and per_page are used when not passed;

* fix(go): rename v1.6.0 to v1.5.1;

* fix(go): check for gorm.ErrRecordNotFound instead of database.IsEmptyRecord;

* fix(go): use host id, not pending host id;

* feat(go): add filters to paginated apis;

* feat(go): add filters to paginated apis;

* feat(go): remove check for max username length;

* feat(go): add filters to count as well;

* feat(go): use library to check email address validity;

* feat(go): ignore pagination if params not passed;

* fix(go): pagination issues;

* fix(go): check exists before using;

* fix(go): remove debug log;

* fix(go): use gorm err record not found;

* fix(go): use gorm err record not found;

* fix(go): use user principal name when creating pending user;

* fix(go): use schema package for consts;

* fix(go): prevent disabling superadmin user;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): swap is admin and is superadmin;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): remove dead code block;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2928837937

* fix(go): incorrect message when trying to disable self;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2928837934

* fix(go): use correct header;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): return after error response;

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): use correct order of params;

https://github.com/gravitl/netmaker/pull/3910#discussion_r2929593036

* fix(go): set default values for page and page size; use v2 instead of /list;

* Update logic/auth.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* Update schema/user_roles.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): syntax error;

* fix(go): set default values when page and per_page are not passed or 0;

* fix(go): use uuid.parse instead of uuid.must parse;

* fix(go): review errors;

* fix(go): review errors;

* Update controllers/user.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* Update controllers/user.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-163: fix errors:

* Update db/types/options.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* fix(go): persist return user in event;

* Update db/types/options.go

Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>

* NM-163: duplicate lines of code

* NM-163: fix(go): fix missing return and filter parsing in user controller

- Add missing return after error response in updateUserAccountStatus
  to prevent double-response and spurious ext-client side-effects
- Use switch statements in listUsers to skip unrecognized
  account_status and mfa_status filter values

* fix(go): check for both min and max page size;

* fix(go): enclose transfer superadmin in transaction;

* fix(go): review errors;

* fix(go): remove free tier checks;

* fix(go): review fixes;

---------

Co-authored-by: VishalDalwadi <[email protected]>
Co-authored-by: Vishal Dalwadi <[email protected]>
Co-authored-by: tenki-reviewer[bot] <262613592+tenki-reviewer[bot]@users.noreply.github.com>
 2026-03-17 19:36:52 +05:30
abhishek9686 b7ab4d23d7 v1.5.0: add revoked by to email template 2026-02-18 14:59:21 +04:00
abhishek9686 82d3cf133c v1.4.0: resolve merge conflicts 2026-02-04 13:10:32 +04:00
Vishal Dalwadi f723fc5202 NM-214: Expect GeoInfo to come from Netclient (#3833) 
* feat(go): expect geoinfo from netclient;

* feat(go): add geoinfo util;
 2026-02-02 14:14:49 +04:00
Abhishek Kondur c2423bf20b NM-213: JIT Network Access (#3830) 
* NM-213: JIT access

* NM-213: handle expiry duration in epoch

* NM-213: avoid jit checks for admins

* NM-213: add jit expiry field to extclient

* NM-213: format jit emails

* NM-213: format jit email templates

* NM-213: update jit expiry on existing clients

* NM-213: update jit expiry on existing clients
 2026-01-31 11:45:16 +04:00
Abhishek Kondur a51649a1df NM-205: Overlapping egress ranges (#3820) 
* NM-205: init virtual NAT for egress ranges

* NM-205: add virtual NAT to egress peer update model

* NM-205: add virtual nat to allowed ips if present

* NM-205: fix create api, update nat fields

* NM-205: fix virtual nat range assignment

* NM-210: use virtual ranges for allowed ips for egress ips

* NM-205: allows update of nat settings

* NM-205: fix migration of egress virtual ranges

* NM-205: fix update operations

* NM-205: if domain range is set,overiride nat setting to direct

* NM-205: validate NAT pool fields on net update, add nat mode egress metric range struct

* NM-205: fix nat egress range

* NM-205: add virtual egress ranges to extclient allowed Ips

* NM-205: add overlapping egress ranges

* NM-205: match egress cidr for virtual nat if less than prefix length

* NM-205: match egress cidr for virtual nat if less than prefix length

* NM-205: force update overlapping egress feature flag

* NM-205: disable virtual nat for ipv6

* NM-205: simplify egress update ops

* NM-205: fix tests

* NM-205: NAT pool update with prefix length validation

* NM-205: send virtual egress ranges for non egress nodes

* NM-205: assign virtual NAT on creation
 2026-01-29 14:36:52 +04:00
Vishal Dalwadi d8515f2ea9 feat(go): expect deployment mode on license validation; return deployment mode when reporting tenant status; (#3809) 2026-01-26 15:10:31 +04:00
Vishal Dalwadi a4981ffd26 NM-168: Network Flow Logs (#3754) 
* feat(go): define flow events;

* feat(go): improve structure;

* feat(go): improve structure;

* feat(go): remove old flow definitions;

* feat(sql): add clickhouse init scripts;

* feat(sql): add protobuf spec;

* fix(sql): store ip as string;

* feat(go): move proto def to grpc dir;

* feat(go): use node instead of host as type; optimize protobuf defs;

* feat(go): add clickhouse db support; add endpoint to query flows;

* fix(go): fix clickhouse config;

* fix(go): use error response structure to report error;

* feat(go): pass flow logging status to netclient;

* feat(go): add peer ip identity map to host peer info;

* feat(go): remove prefix from participant obj fields;

* feat(go): add flow logs enabled field to host;

* feat(go): add filtering to get flow api;

* feat(go): fix record struct;

* feat(go): add exporter url to server config;

* feat(go): add exporter url to server config;

* feat(go): enable flow logs by default;

* feat(go): update nm-quick.sh;

* feat(go): update nm-quick.sh;

* feat(go): update nm-quick.sh;

* feat(go): update nm-quick.sh;

* feat(go): add db initialization logic;

* feat(go): filter by network id;

* fix(go): connection issue;

* fix(go): connection issue;

* fix(go): golang builder version;

* feat(go): add server settings for flow logs;

* feat(go): initialize clickhouse in pro; check for retention;

* feat(go): add exporter feature flags;

* feat(go): add grpc behind caddy;

* feat(go): expose ports correctly;

* fix(go): grpc caddyfile config;

* fix(go): publish exporter feature flags on license validation;

* fix(go): set server name for netmaker exporter;

* fix(go): set server name for netmaker exporter;

* fix(go): check for nil cancel func;

* fix(go): add flow logs field to api host;

* fix(go): add flow logs field to api host;

* fix(go): remove port from grpc setting;

* chore(go): tabs;

* feat(go): introduce egress range participant type;.

* feat(go): rename egress range to egress route for uniform language;

* feat(go): rename egress range to egress route for uniform language;

* feat: add peer addr identity map to host peer update;

* feat: add address identity map to host peer update;

* feat: add address identity map to host peer update;

* feat: set correct from and to args;

* feat: add support for filtering by node;

* feat: use corresponding base image;

* feat: update dockerfile base image version;

* fix: disable flow logs for all host when global settings are changed;
 2025-12-12 14:12:00 +04:00
Abhishek Kondur 4177348f12 NM-166: add user groups to posture checks (#3766) 
* NM-166: add device posture checks apis and logic

* NM-166: add severity level to posture check and api to fetch all available attributes

* NM-166: register posture check schema

* add periodic posture check evaluation of nodes

* NM-166: add os family and kernel version to host model for linux

* add posture check violations on host registration, api to fetch node violations

* NM-166: trigger posture checks on posture checks updates

* NM-166: add version clean func

* NM-166: add allowed values for posture check attributes to api

* NM-166: format violation messages

* NM-166: fix static check

* NM-166: fix static check

* NM-166: add OS info to update extclient api

* NM-166: add sysinfo funcs

* set if only new values are not empty

* format client location

* fix posture violation for static nodes

* skip non user nodes from posture checks

* NM-166: check posture checks by tags

* NM-166: set host location before posture check

* validate posture checks by OR condition

* run posture check violation on node update

* NM-166: allow join on unviolated networks

* NM-166: update response message when posture checks are violated

* NM-166: fix static check

* NM-166: add mutex for posture check runs

* NM-166: add OS family fields to api host model

* NM-166: run posture eval for gateway ops

* NM-166: add user groups to posture checks

* NM-166: add default all user grp

* NM-166: fix posture check eval for users

* NM-166: handle user nodes in the posture checks

* NM-166: fix posture check for new config

* NM-166: skip auto update check on users and show violation on disbaled static nodes

* NM-166: add min verison check for attr

* NM-166: fix static check

* NM-166: add default admin groups
 2025-12-11 12:19:30 +04:00
Abhishek Kondur eed32cd2d6 Merge pull request #3735 from gravitl/NM-166 
NM-166: Device Posture Checks
 2025-12-05 10:33:11 +04:00
Vishal Dalwadi fc20b38851 Merge pull request #3718 from gravitl/fix/v1.2.0 
Fixes v1.2.0
 2025-11-06 13:55:52 +04:00
Abhishek K 74fef9fbc6 NM-122: Auto Relay, auto assignment of Gw (#3697) 
* add auto realy handlers and logic funcs

* add pro func connectors

* Add auto relayed peer ips on peer update, set auto relay on gw creation

* add network id to signal, add autorelay nodes to peerudpate

* add autorelay peer update logic

* add nodes to peer update

* revert node model change

* reset auto relayed peers on the relay node on reset, add auto relay nodes to pull

* add logic api to update auto relay node

* add autoassigngw field to node, add logic to swith relay node in relayme udpate api

* add gw nodes to pull

* intilaise gw map

* HA relay functionality

* add autoassign gw option to enrollment key

* publish intant action to auto assign gw

* fix static checks

* unset relay if auto assign removed

* add host node model to auto relay info

* add host node model to auto relay info

* only use hostNode model for gws info

* handle autoassigned gw peer in the update

* handle autoassigned gw peer in the update

* handle peer updates for autoassigned gw peer

* unset auto assigned peer if relayed or failedovered
 2025-10-28 09:53:31 +04:00