Handle account level and group level validation in same logic

Apply peer validator cache mechanism

---------

Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
Co-authored-by: Yury Gargay <yury.gargay@gmail.com>
Co-authored-by: Viktor Liu <viktor@netbird.io>
Co-authored-by: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Co-authored-by: pascal-fischer <32096965+pascal-fischer@users.noreply.github.com>
Co-authored-by: Misha Bragin <bangvalo@gmail.com>

README.md

@@ -106,8 +106,8 @@ export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbird
 See a complete [architecture overview](https://docs.netbird.io/about-netbird/how-netbird-works#architecture) for details.
 
 ### Community projects
+-  [NetBird on OpenWRT](https://github.com/messense/openwrt-netbird)
 -  [NetBird installer script](https://github.com/physk/netbird-installer)
--  [NetBird ansible collection by Dominion Solutions](https://galaxy.ansible.com/ui/repo/published/dominion_solutions/netbird/)
 
 **Note**: The `main` branch may be in an *unstable or even broken state* during development.
 For stable versions, see [releases](https://github.com/netbirdio/netbird/releases).

client/cmd/testutil.go

@@ -13,6 +13,7 @@ import (
 
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/management-integrations/integrations"
 	clientProto "github.com/netbirdio/netbird/client/proto"
 	client "github.com/netbirdio/netbird/client/server"
 	mgmtProto "github.com/netbirdio/netbird/management/proto"
@@ -75,10 +76,8 @@ func startManagement(t *testing.T, config *mgmt.Config) (*grpc.Server, net.Liste
 
 	peersUpdateManager := mgmt.NewPeersUpdateManager(nil)
 	eventStore := &activity.InMemoryEventStore{}
-	if err != nil {
-		return nil, nil
-	}
-	accountManager, err := mgmt.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false)
+	iv, _ := integrations.NewIntegratedApproval(eventStore)
+	accountManager, err := mgmt.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false, iv)
 	if err != nil {
 		t.Fatal(err)
 	}

client/internal/engine_test.go

@@ -21,6 +21,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/keepalive"
 
+	"github.com/netbirdio/management-integrations/integrations"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/routemanager"
@@ -70,10 +71,10 @@ func TestEngine_SSH(t *testing.T) {
 	defer cancel()
 
 	engine := NewEngine(ctx, cancel, &signal.MockClient{}, &mgmt.MockClient{}, &EngineConfig{
-		WgIfaceName:  "utun101",
-		WgAddr:       "100.64.0.1/24",
-		WgPrivateKey: key,
-		WgPort:       33100,
+		WgIfaceName:      "utun101",
+		WgAddr:           "100.64.0.1/24",
+		WgPrivateKey:     key,
+		WgPort:           33100,
 		ServerSSHAllowed: true,
 	}, MobileDependency{}, peer.NewRecorder("https://mgm"))
 
@@ -1047,10 +1048,8 @@ func startManagement(dataDir string) (*grpc.Server, string, error) {
 
 	peersUpdateManager := server.NewPeersUpdateManager(nil)
 	eventStore := &activity.InMemoryEventStore{}
-	if err != nil {
-		return nil, "", err
-	}
-	accountManager, err := server.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false)
+	ia, _ := integrations.NewIntegratedApproval(eventStore)
+	accountManager, err := server.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false, ia)
 	if err != nil {
 		return nil, "", err
 	}

client/internal/peer/status.go

@@ -5,9 +5,6 @@ import (
 	"sync"
 	"time"
 
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/iface"
 )
@@ -379,24 +376,6 @@ func (d *Status) GetManagementState() ManagementState {
 	}
 }
 
-// IsLoginRequired determines if a peer's login has expired.
-func (d *Status) IsLoginRequired() bool {
-	d.mux.Lock()
-	defer d.mux.Unlock()
-
-	// if peer is connected to the management then login is not expired
-	if d.managementState {
-		return false
-	}
-
-	s, ok := gstatus.FromError(d.managementError)
-	if ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
-		return true
-
-	}
-	return false
-}
-
 func (d *Status) GetSignalState() SignalState {
 	return SignalState{
 		d.signalAddress,

client/internal/session.go

@@ -1,82 +0,0 @@
-package internal
-
-import (
-	"context"
-	"os/exec"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-type SessionWatcher struct {
-	ctx   context.Context
-	mutex sync.Mutex
-
-	peerStatusRecorder *peer.Status
-	watchTicker        *time.Ticker
-
-	sendNotification bool
-	onExpireListener func()
-}
-
-// NewSessionWatcher creates a new instance of SessionWatcher.
-func NewSessionWatcher(ctx context.Context, peerStatusRecorder *peer.Status) *SessionWatcher {
-	s := &SessionWatcher{
-		ctx:                ctx,
-		peerStatusRecorder: peerStatusRecorder,
-		watchTicker:        time.NewTicker(2 * time.Second),
-	}
-	go s.startWatcher()
-	return s
-}
-
-// SetOnExpireListener sets the callback func to be called when the session expires.
-func (s *SessionWatcher) SetOnExpireListener(onExpire func()) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-	s.onExpireListener = onExpire
-}
-
-// startWatcher continuously checks if the session requires login and
-// calls the onExpireListener if login is required.
-func (s *SessionWatcher) startWatcher() {
-	for {
-		select {
-		case <-s.ctx.Done():
-			s.watchTicker.Stop()
-			return
-		case <-s.watchTicker.C:
-			managementState := s.peerStatusRecorder.GetManagementState()
-			if managementState.Connected {
-				s.sendNotification = true
-			}
-
-			isLoginRequired := s.peerStatusRecorder.IsLoginRequired()
-			if isLoginRequired && s.sendNotification && s.onExpireListener != nil {
-				s.mutex.Lock()
-				s.onExpireListener()
-				s.sendNotification = false
-				s.mutex.Unlock()
-			}
-		}
-	}
-}
-
-// CheckUIApp checks whether UI application is running.
-func CheckUIApp() bool {
-	cmd := exec.Command("ps", "-ef")
-	output, err := cmd.Output()
-	if err != nil {
-		return false
-	}
-
-	lines := strings.Split(string(output), "\n")
-	for _, line := range lines {
-		if strings.Contains(line, "netbird-ui") && !strings.Contains(line, "grep") {
-			return true
-		}
-	}
-	return false
-}

client/server/server.go

@@ -3,8 +3,6 @@ package server
 import (
 	"context"
 	"fmt"
-	"os/exec"
-	"runtime"
 	"sync"
 	"time"
 
@@ -41,7 +39,6 @@ type Server struct {
 	proto.UnimplementedDaemonServiceServer
 
 	statusRecorder *peer.Status
-	sessionWatcher *internal.SessionWatcher
 
 	mgmProbe    *internal.Probe
 	signalProbe *internal.Probe
@@ -119,11 +116,6 @@ func (s *Server) Start() error {
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
 
-	if s.sessionWatcher == nil {
-		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
-		s.sessionWatcher.SetOnExpireListener(s.onSessionExpire)
-	}
-
 	if !config.DisableAutoConnect {
 		go func() {
 			if err := internal.RunClientWithProbes(ctx, config, s.statusRecorder, s.mgmProbe, s.signalProbe, s.relayProbe, s.wgProbe); err != nil {
@@ -550,17 +542,6 @@ func (s *Server) GetConfig(_ context.Context, _ *proto.GetConfigRequest) (*proto
 	}, nil
 }
 
-func (s *Server) onSessionExpire() {
-	if runtime.GOOS != "windows" {
-		isUIActive := internal.CheckUIApp()
-		if !isUIActive {
-			if err := sendTerminalNotification(); err != nil {
-				log.Errorf("send session expire terminal notification: %v", err)
-			}
-		}
-	}
-}
-
 func toProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus := proto.FullStatus{
 		ManagementState: &proto.ManagementState{},
@@ -623,31 +604,3 @@ func toProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 
 	return &pbFullStatus
 }
-
-// sendTerminalNotification sends a terminal notification message
-// to inform the user that the NetBird connection session has expired.
-func sendTerminalNotification() error {
-	message := "NetBird connection session expired\n\nPlease re-authenticate to connect to the network."
-	echoCmd := exec.Command("echo", message)
-	wallCmd := exec.Command("sudo", "wall")
-
-	echoCmdStdout, err := echoCmd.StdoutPipe()
-	if err != nil {
-		return err
-	}
-	wallCmd.Stdin = echoCmdStdout
-
-	if err := echoCmd.Start(); err != nil {
-		return err
-	}
-
-	if err := wallCmd.Start(); err != nil {
-		return err
-	}
-
-	if err := echoCmd.Wait(); err != nil {
-		return err
-	}
-
-	return wallCmd.Wait()
-}

client/system/info_windows.go

@@ -165,10 +165,6 @@ func sysProductName() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	// `ComputerSystemProduct` could be empty on some virtualized systems
-	if len(dst) < 1 {
-		return "unknown", nil
-	}
 	return dst[0].Name, nil
 }
 

go.mod

@@ -46,6 +46,7 @@ require (
 	github.com/golang/mock v1.6.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/gopacket v1.1.19
+	github.com/google/martian/v3 v3.0.0
 	github.com/google/nftables v0.0.0-20220808154552-2eca00135732
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
@@ -57,8 +58,8 @@ require (
 	github.com/miekg/dns v1.1.43
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/nadoo/ipset v0.5.0
-	github.com/netbirdio/management-integrations/additions v0.0.0-20240212121739-8ea8c89a4552
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20240212121739-8ea8c89a4552
+	github.com/netbirdio/management-integrations/additions v0.0.0-20240226151841-2e4fe2407450
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20240305130559-469a80446ac7
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/oschwald/maxminddb-golang v1.12.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible

go.sum

@@ -255,6 +255,7 @@ github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0 h1:pMen7vLs8nvgEYhywH3KDWJIJTeEr2ULsVWHWYHQyBs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/nftables v0.0.0-20220808154552-2eca00135732 h1:csc7dT82JiSLvq4aMyQMIQDL7986NH6Wxf/QrvOj55A=
 github.com/google/nftables v0.0.0-20220808154552-2eca00135732/go.mod h1:b97ulCCFipUC+kSin+zygkvUVpx0vyIAwxXFdY3PlNc=
@@ -376,10 +377,10 @@ github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRW
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nadoo/ipset v0.5.0 h1:5GJUAuZ7ITQQQGne5J96AmFjRtI8Avlbk6CabzYWVUc=
 github.com/nadoo/ipset v0.5.0/go.mod h1:rYF5DQLRGGoQ8ZSWeK+6eX5amAuPqwFkWjhQlEITGJQ=
-github.com/netbirdio/management-integrations/additions v0.0.0-20240212121739-8ea8c89a4552 h1:yzcQKizAK9YufCHMMCIsr467Dw/OU/4xyHbWizGb1E4=
-github.com/netbirdio/management-integrations/additions v0.0.0-20240212121739-8ea8c89a4552/go.mod h1:31FhBNvQ+riHEIu6LSTmqr8IeuSIsGfQffqV4LFmbwA=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20240212121739-8ea8c89a4552 h1:OFlzVZtkXCoJsfDKrMigFpuad8ZXTm8epq6x27K0irA=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20240212121739-8ea8c89a4552/go.mod h1:B0nMS3es77gOvPYhc0K91fAzTkQLi/jRq5TffUN3klM=
+github.com/netbirdio/management-integrations/additions v0.0.0-20240226151841-2e4fe2407450 h1:qA4S5YFt6/s0kQ8wKLjq8faLxuBSte1WzjWfmQmyJTU=
+github.com/netbirdio/management-integrations/additions v0.0.0-20240226151841-2e4fe2407450/go.mod h1:31FhBNvQ+riHEIu6LSTmqr8IeuSIsGfQffqV4LFmbwA=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20240305130559-469a80446ac7 h1:YYIQJbRhANmNFClkCmjBa0w33RpTzsF2DpbGAWhul6Y=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20240305130559-469a80446ac7/go.mod h1:B0nMS3es77gOvPYhc0K91fAzTkQLi/jRq5TffUN3klM=
 github.com/netbirdio/service v0.0.0-20230215170314-b923b89432b0 h1:hirFRfx3grVA/9eEyjME5/z3nxdJlN9kfQpvWWPk32g=
 github.com/netbirdio/service v0.0.0-20230215170314-b923b89432b0/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949 h1:xbWM9BU6mwZZLHxEjxIX/V8Hv3HurQt4mReIE4mY4DM=

management/client/client_test.go

@@ -15,6 +15,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
+	"github.com/netbirdio/management-integrations/integrations"
 	"github.com/netbirdio/netbird/encryption"
 	mgmtProto "github.com/netbirdio/netbird/management/proto"
 	mgmt "github.com/netbirdio/netbird/management/server"
@@ -60,7 +61,8 @@ func startManagement(t *testing.T) (*grpc.Server, net.Listener) {
 
 	peersUpdateManager := mgmt.NewPeersUpdateManager(nil)
 	eventStore := &activity.InMemoryEventStore{}
-	accountManager, err := mgmt.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false)
+	ia, _ := integrations.NewIntegratedApproval(eventStore)
+	accountManager, err := mgmt.BuildManager(store, peersUpdateManager, nil, "", "", eventStore, nil, false, ia)
 	if err != nil {
 		t.Fatal(err)
 	}

management/cmd/management.go

@@ -172,8 +172,12 @@ var (
 				log.Infof("geo location service has been initialized from %s", config.Datadir)
 			}
 
+			integratedPeerApproval, err := integrations.NewIntegratedApproval(eventStore)
+			if err != nil {
+				return fmt.Errorf("failed to initialize integrated peer approval: %v", err)
+			}
 			accountManager, err := server.BuildManager(store, peersUpdateManager, idpManager, mgmtSingleAccModeDomain,
-				dnsDomain, eventStore, geo, userDeleteFromIDPEnabled)
+				dnsDomain, eventStore, geo, userDeleteFromIDPEnabled, integratedPeerApproval)
 			if err != nil {
 				return fmt.Errorf("failed to build default manager: %v", err)
 			}
@@ -323,6 +327,7 @@ var (
 			SetupCloseHandler()
 
 			<-stopCh
+			integratedPeerApproval.Stop()
 			if geo != nil {
 				_ = geo.Stop()
 			}

management/server/account.go

@@ -22,13 +22,13 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/management-integrations/additions"
-
 	"github.com/netbirdio/netbird/base62"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
+	"github.com/netbirdio/netbird/management/server/integrated_approval"
 	"github.com/netbirdio/netbird/management/server/jwtclaims"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
@@ -72,6 +72,7 @@ type AccountManager interface {
 	CheckUserAccessByJWTGroups(claims jwtclaims.AuthorizationClaims) error
 	GetAccountFromPAT(pat string) (*Account, *User, *PersonalAccessToken, error)
 	DeleteAccount(accountID, userID string) error
+	GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error)
 	MarkPATUsed(tokenID string) error
 	GetUser(claims jwtclaims.AuthorizationClaims) (*User, error)
 	ListUsers(accountID string) ([]*User, error)
@@ -126,6 +127,9 @@ type AccountManager interface {
 	DeletePostureChecks(accountID, postureChecksID, userID string) error
 	ListPostureChecks(accountID, userID string) ([]*posture.Checks, error)
 	GetIdpManager() idp.Manager
+	UpdateIntegratedApprovalGroups(accountID string, userID string, groups []string) error
+	IsRequiresApproval(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) bool
+	GroupValidation(accountId string, groups []string) (bool, error)
 }
 
 type DefaultAccountManager struct {
@@ -154,6 +158,8 @@ type DefaultAccountManager struct {
 
 	// userDeleteFromIDPEnabled allows to delete user from IDP when user is deleted from account
 	userDeleteFromIDPEnabled bool
+
+	integratedPeerValidator integrated_approval.IntegratedApproval
 }
 
 // Settings represents Account settings structure that can be modified via API and Dashboard
@@ -232,6 +238,14 @@ type Account struct {
 	RulesG []Rule           `json:"-" gorm:"-"`
 }
 
+// AccountUsageStats represents the current usage statistics for an account
+type AccountUsageStats struct {
+	ActiveUsers int64 `json:"active_users"`
+	TotalUsers  int64 `json:"total_users"`
+	ActivePeers int64 `json:"active_peers"`
+	TotalPeers  int64 `json:"total_peers"`
+}
+
 type UserInfo struct {
 	ID                   string               `json:"id"`
 	Email                string               `json:"email"`
@@ -380,12 +394,14 @@ func (a *Account) GetPeerNetworkMap(peerID, dnsDomain string) *NetworkMap {
 			Network: a.Network.Copy(),
 		}
 	}
+
 	validatedPeers := additions.ValidatePeers([]*nbpeer.Peer{peer})
 	if len(validatedPeers) == 0 {
 		return &NetworkMap{
 			Network: a.Network.Copy(),
 		}
 	}
+
 	aclPeers, firewallRules := a.getPeerConnectionResources(peerID)
 	// exclude expired peers
 	var peersToConnect []*nbpeer.Peer
@@ -455,11 +471,6 @@ func (a *Account) GetNextPeerExpiration() (time.Duration, bool) {
 		}
 		_, duration := peer.LoginExpired(a.Settings.PeerLoginExpiration)
 		if nextExpiry == nil || duration < *nextExpiry {
-			// if expiration is below 1s return 1s duration
-			// this avoids issues with ticker that can't be set to < 0
-			if duration < time.Second {
-				return time.Second, true
-			}
 			nextExpiry = &duration
 		}
 	}
@@ -569,6 +580,20 @@ func (a *Account) FindSetupKey(setupKey string) (*SetupKey, error) {
 	return key, nil
 }
 
+// GetPeerGroupsList return with the list of groups ID.
+func (a *Account) GetPeerGroupsList(peerID string) []string {
+	var grps []string
+	for groupID, group := range a.Groups {
+		for _, id := range group.Peers {
+			if id == peerID {
+				grps = append(grps, groupID)
+				break
+			}
+		}
+	}
+	return grps
+}
+
 func (a *Account) getUserGroups(userID string) ([]string, error) {
 	user, err := a.FindUser(userID)
 	if err != nil {
@@ -823,6 +848,7 @@ func (a *Account) UserGroupsRemoveFromPeers(userID string, groups ...string) {
 func BuildManager(store Store, peersUpdateManager *PeersUpdateManager, idpManager idp.Manager,
 	singleAccountModeDomain string, dnsDomain string, eventStore activity.Store, geo *geolocation.Geolocation,
 	userDeleteFromIDPEnabled bool,
+	integratedPeerValidator integrated_approval.IntegratedApproval,
 ) (*DefaultAccountManager, error) {
 	am := &DefaultAccountManager{
 		Store:                    store,
@@ -836,6 +862,7 @@ func BuildManager(store Store, peersUpdateManager *PeersUpdateManager, idpManage
 		eventStore:               eventStore,
 		peerLoginExpiry:          NewDefaultScheduler(),
 		userDeleteFromIDPEnabled: userDeleteFromIDPEnabled,
+		integratedPeerValidator:  integratedPeerValidator,
 	}
 	allAccounts := store.GetAllAccounts()
 	// enable single account mode only if configured by user and number of existing accounts is not grater than 1
@@ -1117,6 +1144,17 @@ func (am *DefaultAccountManager) DeleteAccount(accountID, userID string) error {
 	return nil
 }
 
+// GetUsage returns the usage stats for the given account.
+// This cannot be used to calculate usage stats for a period in the past as it relies on peers' last seen time.
+func (am *DefaultAccountManager) GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	usageStats, err := am.Store.CalculateUsageStats(ctx, accountID, start, end)
+	if err != nil {
+		return nil, fmt.Errorf("failed to calculate usage stats: %w", err)
+	}
+
+	return usageStats, nil
+}
+
 // GetAccountByUserOrAccountID looks for an account by user or accountID, if no account is provided and
 // userID doesn't have an account associated with it, one account is created
 // domain is used to create a new account if no account is found

management/server/account/account.go

@@ -3,11 +3,17 @@ package account
 type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool
+
+	// IntegratedApprovalGroups list of group IDs to be used with integrated approval configurations
+	IntegratedApprovalGroups []string `gorm:"serializer:json"`
 }
 
 // Copy copies the ExtraSettings struct
 func (e *ExtraSettings) Copy() *ExtraSettings {
+	var cpGroup []string
+
 	return &ExtraSettings{
-		PeerApprovalEnabled: e.PeerApprovalEnabled,
+		PeerApprovalEnabled:      e.PeerApprovalEnabled,
+		IntegratedApprovalGroups: append(cpGroup, e.IntegratedApprovalGroups...),
 	}
 }

management/server/account_test.go

@@ -12,20 +12,34 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/activity"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
-	"github.com/netbirdio/netbird/route"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/jwtclaims"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/posture"
+	"github.com/netbirdio/netbird/route"
 )
 
+type MocIntegratedApproval struct {
+}
+
+func (MocIntegratedApproval) PreparePeer(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) *nbpeer.Peer {
+	return peer
+}
+
+func (MocIntegratedApproval) IsRequiresApproval(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) bool {
+	return false
+}
+
+func (MocIntegratedApproval) Stop() {
+
+}
+
 func verifyCanAddPeerToAccount(t *testing.T, manager AccountManager, account *Account, userID string) {
 	t.Helper()
 	peer := &nbpeer.Peer{
@@ -2223,7 +2237,7 @@ func createManager(t *testing.T) (*DefaultAccountManager, error) {
 		return nil, err
 	}
 	eventStore := &activity.InMemoryEventStore{}
-	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "netbird.cloud", eventStore, nil, false)
+	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "netbird.cloud", eventStore, nil, false, MocIntegratedApproval{})
 }
 
 func createStore(t *testing.T) (Store, error) {

management/server/dns_test.go

@@ -193,7 +193,7 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 		return nil, err
 	}
 	eventStore := &activity.InMemoryEventStore{}
-	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "netbird.test", eventStore, nil, false)
+	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "netbird.test", eventStore, nil, false, MocIntegratedApproval{})
 }
 
 func createDNSStore(t *testing.T) (Store, error) {

management/server/file_store.go

@@ -1,6 +1,8 @@
 package server
 
 import (
+	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -662,3 +664,40 @@ func (s *FileStore) Close() error {
 func (s *FileStore) GetStoreEngine() StoreEngine {
 	return FileStoreEngine
 }
+
+// CalculateUsageStats returns the usage stats for an account
+// start and end are inclusive.
+func (s *FileStore) CalculateUsageStats(_ context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	account, exists := s.Accounts[accountID]
+	if !exists {
+		return nil, fmt.Errorf("account not found")
+	}
+
+	stats := &AccountUsageStats{
+		TotalUsers: 0,
+		TotalPeers: int64(len(account.Peers)),
+	}
+
+	for _, user := range account.Users {
+		if !user.IsServiceUser {
+			stats.TotalUsers++
+		}
+	}
+
+	activeUsers := make(map[string]bool)
+	for _, peer := range account.Peers {
+		lastSeen := peer.Status.LastSeen
+		if lastSeen.Compare(start) >= 0 && lastSeen.Compare(end) <= 0 {
+			if _, exists := account.Users[peer.UserID]; exists && !activeUsers[peer.UserID] {
+				activeUsers[peer.UserID] = true
+				stats.ActiveUsers++
+			}
+			stats.ActivePeers++
+		}
+	}
+
+	return stats, nil
+}

management/server/file_store_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"crypto/sha256"
 	"net"
 	"path/filepath"
@@ -657,3 +658,32 @@ func newStore(t *testing.T) *FileStore {
 
 	return store
 }
+
+func TestFileStore_CalculateUsageStats(t *testing.T) {
+	storeDir := t.TempDir()
+
+	err := util.CopyFileContents("testdata/store_stats.json", filepath.Join(storeDir, "store.json"))
+	require.NoError(t, err)
+
+	store, err := NewFileStore(storeDir, nil)
+	require.NoError(t, err)
+
+	startDate := time.Date(2024, time.February, 1, 0, 0, 0, 0, time.UTC)
+	endDate := startDate.AddDate(0, 1, 0).Add(-time.Nanosecond)
+
+	stats1, err := store.CalculateUsageStats(context.TODO(), "account-1", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(2), stats1.ActiveUsers)
+	assert.Equal(t, int64(4), stats1.TotalUsers)
+	assert.Equal(t, int64(3), stats1.ActivePeers)
+	assert.Equal(t, int64(7), stats1.TotalPeers)
+
+	stats2, err := store.CalculateUsageStats(context.TODO(), "account-2", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(1), stats2.ActiveUsers)
+	assert.Equal(t, int64(2), stats2.TotalUsers)
+	assert.Equal(t, int64(1), stats2.ActivePeers)
+	assert.Equal(t, int64(2), stats2.TotalPeers)
+}

management/server/group.go

@@ -274,6 +274,15 @@ func (am *DefaultAccountManager) DeleteGroup(accountId, userId, groupID string)
 		}
 	}
 
+	// check integrated peer approval
+	if account.Settings.Extra != nil {
+		for _, integratedPeerApprovalGroups := range account.Settings.Extra.IntegratedApprovalGroups {
+			if groupID == integratedPeerApprovalGroups {
+				return &GroupLinkError{"integrated approval", g.Name}
+			}
+		}
+	}
+
 	delete(account.Groups, groupID)
 
 	account.Network.IncSerial()

management/server/http/handler.go

@@ -9,7 +9,6 @@ import (
 	"github.com/rs/cors"
 
 	"github.com/netbirdio/management-integrations/integrations"
-
 	s "github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/http/middleware"

management/server/http/peers_handler.go

@@ -63,8 +63,8 @@ func (h *PeersHandler) getPeer(account *server.Account, peerID, userID string, w
 
 	netMap := account.GetPeerNetworkMap(peerID, h.accountManager.GetDNSDomain())
 	accessiblePeers := toAccessiblePeers(netMap, dnsDomain)
-
-	util.WriteJSONObject(w, toSinglePeerResponse(peerToReturn, groupsInfo, dnsDomain, accessiblePeers))
+	isRequiresApproval := h.accountManager.IsRequiresApproval(account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	util.WriteJSONObject(w, toSinglePeerResponse(peerToReturn, groupsInfo, dnsDomain, accessiblePeers, isRequiresApproval))
 }
 
 func (h *PeersHandler) updatePeer(account *server.Account, user *server.User, peerID string, w http.ResponseWriter, r *http.Request) {
@@ -94,7 +94,8 @@ func (h *PeersHandler) updatePeer(account *server.Account, user *server.User, pe
 	netMap := account.GetPeerNetworkMap(peerID, h.accountManager.GetDNSDomain())
 	accessiblePeers := toAccessiblePeers(netMap, dnsDomain)
 
-	util.WriteJSONObject(w, toSinglePeerResponse(peer, groupMinimumInfo, dnsDomain, accessiblePeers))
+	// todo return with valid peer approval status
+	util.WriteJSONObject(w, toSinglePeerResponse(peer, groupMinimumInfo, dnsDomain, accessiblePeers, false))
 }
 
 func (h *PeersHandler) deletePeer(accountID, userID string, peerID string, w http.ResponseWriter) {
@@ -166,6 +167,7 @@ func (h *PeersHandler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 
 			accessiblePeerNumbers := h.accessiblePeersNumber(account, peer.ID)
 
+			// todo extend with peer approval status
 			respBody = append(respBody, toPeerListItemResponse(peerToReturn, groupMinimumInfo, dnsDomain, accessiblePeerNumbers))
 		}
 		util.WriteJSONObject(w, respBody)
@@ -230,7 +232,7 @@ func toGroupsInfo(groups map[string]*server.Group, peerID string) []api.GroupMin
 	return groupsInfo
 }
 
-func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, accessiblePeer []api.AccessiblePeer) *api.Peer {
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, accessiblePeer []api.AccessiblePeer, approval bool) *api.Peer {
 	osVersion := peer.Meta.OSVersion
 	if osVersion == "" {
 		osVersion = peer.Meta.Core
@@ -257,7 +259,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 		LastLogin:              peer.LastLogin,
 		LoginExpired:           peer.Status.LoginExpired,
 		AccessiblePeers:        accessiblePeer,
-		ApprovalRequired:       &peer.Status.RequiresApproval,
+		ApprovalRequired:       &approval,
 		CountryCode:            peer.Location.CountryCode,
 		CityName:               peer.Location.CityName,
 	}

management/server/integrated_approval.go

@@ -0,0 +1,81 @@
+package server
+
+import (
+	"errors"
+
+	"github.com/google/martian/v3/log"
+
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+// UpdateIntegratedApprovalGroups updates the integrated approval groups for a specified account.
+// It retrieves the account associated with the provided userID, then updates the integrated approval groups
+// with the provided list of group ids. The updated account is then saved.
+//
+// Parameters:
+//   - accountID: The ID of the account for which integrated approval groups are to be updated.
+//   - userID: The ID of the user whose account is being updated.
+//   - groups: A slice of strings representing the ids of integrated approval groups to be updated.
+//
+// Returns:
+//   - error: An error if any occurred during the process, otherwise returns nil
+func (am *DefaultAccountManager) UpdateIntegratedApprovalGroups(accountID string, userID string, groups []string) error {
+	ok, err := am.GroupValidation(accountID, groups)
+	if err != nil {
+		log.Debugf("error validating groups: %s", err.Error())
+		return err
+	}
+
+	if !ok {
+		log.Debugf("invalid groups")
+		return errors.New("invalid groups")
+	}
+
+	unlock := am.Store.AcquireAccountLock(accountID)
+	defer unlock()
+
+	a, err := am.Store.GetAccountByUser(userID)
+	if err != nil {
+		return err
+	}
+
+	var extra *account.ExtraSettings
+
+	if a.Settings.Extra != nil {
+		extra = a.Settings.Extra
+	} else {
+		extra = &account.ExtraSettings{}
+		a.Settings.Extra = extra
+	}
+	extra.IntegratedApprovalGroups = groups
+	return am.Store.SaveAccount(a)
+}
+
+func (am *DefaultAccountManager) IsPeerRequiresApproval(accountID string, peer *nbpeer.Peer) bool {
+	return am.integratedPeerValidator.IsRequiresApproval(accountID, peer, nil, nil)
+}
+
+func (am *DefaultAccountManager) GroupValidation(accountId string, groups []string) (bool, error) {
+	if len(groups) == 0 {
+		return true, nil
+	}
+	accountsGroups, err := am.ListGroups(accountId)
+	if err != nil {
+		return false, err
+	}
+	for _, group := range groups {
+		var found bool
+		for _, accountGroup := range accountsGroups {
+			if accountGroup.ID == group {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}

management/server/integrated_approval/interface.go

@@ -0,0 +1,13 @@
+package integrated_approval
+
+import (
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+// IntegratedApproval interface exists to avoid the circle dependencies
+type IntegratedApproval interface {
+	PreparePeer(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) *nbpeer.Peer
+	IsRequiresApproval(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) bool
+	Stop()
+}

management/server/management_proto_test.go

@@ -9,8 +9,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/netbirdio/netbird/management/server/activity"
-
 	"github.com/stretchr/testify/require"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
@@ -19,6 +17,7 @@ import (
 
 	"github.com/netbirdio/netbird/encryption"
 	mgmtProto "github.com/netbirdio/netbird/management/proto"
+	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -413,7 +412,7 @@ func startManagement(t *testing.T, config *Config) (*grpc.Server, string, error)
 	peersUpdateManager := NewPeersUpdateManager(nil)
 	eventStore := &activity.InMemoryEventStore{}
 	accountManager, err := BuildManager(store, peersUpdateManager, nil, "", "",
-		eventStore, nil, false)
+		eventStore, nil, false, MocIntegratedApproval{})
 	if err != nil {
 		return nil, "", err
 	}

management/server/management_test.go

@@ -2,6 +2,8 @@ package server_test
 
 import (
 	"context"
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"math/rand"
 	"net"
 	"os"
@@ -10,24 +12,19 @@ import (
 	sync2 "sync"
 	"time"
 
-	"github.com/netbirdio/netbird/management/server/activity"
-
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/management/server"
-
 	pb "github.com/golang/protobuf/proto" //nolint
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/encryption"
-
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/keepalive"
 
+	"github.com/netbirdio/netbird/encryption"
 	mgmtProto "github.com/netbirdio/netbird/management/proto"
+	"github.com/netbirdio/netbird/management/server"
+	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -448,6 +445,21 @@ var _ = Describe("Management service", func() {
 	})
 })
 
+type MocIntegratedApproval struct {
+}
+
+func (MocIntegratedApproval) PreparePeer(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) *nbpeer.Peer {
+	return peer
+}
+
+func (MocIntegratedApproval) IsRequiresApproval(accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *account.ExtraSettings) bool {
+	return false
+}
+
+func (MocIntegratedApproval) Stop() {
+
+}
+
 func loginPeerWithValidSetupKey(serverPubKey wgtypes.Key, key wgtypes.Key, client mgmtProto.ManagementServiceClient) *mgmtProto.LoginResponse {
 	defer GinkgoRecover()
 
@@ -504,7 +516,7 @@ func startServer(config *server.Config) (*grpc.Server, net.Listener) {
 	peersUpdateManager := server.NewPeersUpdateManager(nil)
 	eventStore := &activity.InMemoryEventStore{}
 	accountManager, err := server.BuildManager(store, peersUpdateManager, nil, "", "",
-		eventStore, nil, false)
+		eventStore, nil, false, MocIntegratedApproval{})
 	if err != nil {
 		log.Fatalf("failed creating a manager: %v", err)
 	}

management/server/mock_server/account_mock.go

@@ -1,6 +1,7 @@
 package mock_server
 
 import (
+	"context"
 	"net"
 	"time"
 
@@ -92,7 +93,10 @@ type MockAccountManager struct {
 	SavePostureChecksFunc           func(accountID, userID string, postureChecks *posture.Checks) error
 	DeletePostureChecksFunc         func(accountID, postureChecksID, userID string) error
 	ListPostureChecksFunc           func(accountID, userID string) ([]*posture.Checks, error)
+	GetUsageFunc                    func(ctx context.Context, accountID string, start, end time.Time) (*server.AccountUsageStats, error)
 	GetIdpManagerFunc               func() idp.Manager
+	UpdateIntegratedApprovalGroupsFunc func(accountID string, userID string, groups []string) error
+	GroupValidationFunc                func(accountId string, groups []string) (bool, error)
 }
 
 // GetUsersFromAccount mock implementation of GetUsersFromAccount from server.AccountManager interface
@@ -705,6 +709,14 @@ func (am *MockAccountManager) ListPostureChecks(accountID, userID string) ([]*po
 	return nil, status.Errorf(codes.Unimplemented, "method ListPostureChecks is not implemented")
 }
 
+// GetUsage mocks GetUsage of the AccountManager interface
+func (am *MockAccountManager) GetUsage(ctx context.Context, accountID string, start time.Time, end time.Time) (*server.AccountUsageStats, error) {
+	if am.GetUsageFunc != nil {
+		return am.GetUsageFunc(ctx, accountID, start, end)
+	}
+	return nil, status.Errorf(codes.Unimplemented, "method GetUsage is not implemented")
+}
+
 // GetIdpManager mocks GetIdpManager of the AccountManager interface
 func (am *MockAccountManager) GetIdpManager() idp.Manager {
 	if am.GetIdpManagerFunc != nil {
@@ -712,3 +724,19 @@ func (am *MockAccountManager) GetIdpManager() idp.Manager {
 	}
 	return nil
 }
+
+// UpdateIntegratedApprovalGroups mocks UpdateIntegratedApprovalGroups of the AccountManager interface
+func (am *MockAccountManager) UpdateIntegratedApprovalGroups(accountID string, userID string, groups []string) error {
+	if am.UpdateIntegratedApprovalGroupsFunc != nil {
+		return am.UpdateIntegratedApprovalGroupsFunc(accountID, userID, groups)
+	}
+	return status.Errorf(codes.Unimplemented, "method UpdateIntegratedApprovalGroups is not implemented")
+}
+
+// GroupValidation mocks GroupValidation of the AccountManager interface
+func (am *MockAccountManager) GroupValidation(accountId string, groups []string) (bool, error) {
+	if am.GroupValidationFunc != nil {
+		return am.GroupValidationFunc(accountId, groups)
+	}
+	return false, status.Errorf(codes.Unimplemented, "method GroupValidation is not implemented")
+}

management/server/nameserver_test.go

@@ -759,7 +759,7 @@ func createNSManager(t *testing.T) (*DefaultAccountManager, error) {
 		return nil, err
 	}
 	eventStore := &activity.InMemoryEventStore{}
-	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "", eventStore, nil, false)
+	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "", eventStore, nil, false, MocIntegratedApproval{})
 }
 
 func createNSStore(t *testing.T) (Store, error) {

management/server/peer.go

@@ -7,16 +7,13 @@ import (
 	"time"
 
 	"github.com/rs/xid"
+	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/management-integrations/additions"
-
+	"github.com/netbirdio/netbird/management/proto"
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/status"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/management/proto"
 )
 
 // PeerSync used as a data object between the gRPC API and AccountManager on Sync request.
@@ -299,6 +296,7 @@ func (am *DefaultAccountManager) GetNetworkMap(peerID string) (*NetworkMap, erro
 	if peer == nil {
 		return nil, status.Errorf(status.NotFound, "peer with ID %s not found", peerID)
 	}
+
 	return account.GetPeerNetworkMap(peer.ID, am.dnsDomain), nil
 }
 
@@ -430,10 +428,6 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		Ephemeral:              ephemeral,
 	}
 
-	if account.Settings.Extra != nil {
-		newPeer = additions.PreparePeer(newPeer, account.Settings.Extra)
-	}
-
 	// add peer to 'All' group
 	group, err := account.GetGroupAll()
 	if err != nil {
@@ -462,6 +456,8 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *nbpeer.P
 		}
 	}
 
+	newPeer = am.integratedPeerValidator.PreparePeer(account.Id, newPeer, account.GetPeerGroupsList(newPeer.ID), account.Settings.Extra)
+
 	if addedByUser {
 		user, err := account.FindUser(userID)
 		if err != nil {
@@ -524,6 +520,16 @@ func (am *DefaultAccountManager) SyncPeer(sync PeerSync) (*nbpeer.Peer, *Network
 	if peerLoginExpired(peer, account) {
 		return nil, nil, status.Errorf(status.PermissionDenied, "peer login has expired, please log in once more")
 	}
+
+	requiresApproval := am.integratedPeerValidator.IsRequiresApproval(account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	if peer.Status.RequiresApproval != requiresApproval {
+		peer.Status.RequiresApproval = requiresApproval
+		err = am.Store.SaveAccount(account)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
 	return peer, account.GetPeerNetworkMap(peer.ID, am.dnsDomain), nil
 }
 
@@ -590,6 +596,11 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 		am.StoreEvent(login.UserID, peer.ID, account.Id, activity.UserLoggedInPeer, peer.EventMeta(am.GetDNSDomain()))
 	}
 
+	isRequiresApproval := am.integratedPeerValidator.IsRequiresApproval(account.Id, peer, account.GetPeerGroupsList(peer.ID), account.Settings.Extra)
+	if peer.Status.RequiresApproval != isRequiresApproval {
+		shouldStoreAccount = true
+	}
+
 	peer, updated := updatePeerMeta(peer, login.Meta, account)
 	if updated {
 		shouldStoreAccount = true
@@ -610,6 +621,7 @@ func (am *DefaultAccountManager) LoginPeer(login PeerLogin) (*nbpeer.Peer, *Netw
 	if updateRemotePeers {
 		am.updateAccountPeers(account)
 	}
+
 	return peer, account.GetPeerNetworkMap(peer.ID, am.dnsDomain), nil
 }
 

management/server/policy.go

@@ -5,9 +5,10 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/netbirdio/management-integrations/additions"
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/management-integrations/additions"
+
 	"github.com/netbirdio/netbird/management/proto"
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"

management/server/route_test.go

@@ -1014,7 +1014,7 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, error) {
 		return nil, err
 	}
 	eventStore := &activity.InMemoryEventStore{}
-	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "", eventStore, nil, false)
+	return BuildManager(store, NewPeersUpdateManager(nil), nil, "", "", eventStore, nil, false, MocIntegratedApproval{})
 }
 
 func createRouterStore(t *testing.T) (Store, error) {

management/server/scheduler.go

@@ -85,11 +85,6 @@ func (wm *DefaultScheduler) Schedule(in time.Duration, ID string, job func() (ne
 		return
 	}
 
-	if in < time.Second {
-		log.Warnf("job for %s was scheduled to run in %s which is under 1s. Adjusting that.", ID, in.String())
-		in = time.Second
-	}
-
 	ticker := time.NewTicker(in)
 
 	wm.jobs[ID] = cancel
@@ -117,10 +112,6 @@ func (wm *DefaultScheduler) Schedule(in time.Duration, ID string, job func() (ne
 				}
 				// we need this comparison to avoid resetting the ticker with the same duration and missing the current elapsesed time
 				if runIn != in {
-					if runIn < time.Second {
-						log.Warnf("job for %s was rescheduled to run in %s which is under 1s. Adjusting that.", ID, runIn.String())
-						runIn = time.Second
-					}
 					ticker.Reset(runIn)
 				}
 			case <-cancel:

management/server/sqlite_store.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"fmt"
 	"path/filepath"
 	"runtime"
@@ -497,3 +498,48 @@ func (s *SqliteStore) Close() error {
 func (s *SqliteStore) GetStoreEngine() StoreEngine {
 	return SqliteStoreEngine
 }
+
+// CalculateUsageStats returns the usage stats for an account
+// start and end are inclusive.
+func (s *SqliteStore) CalculateUsageStats(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error) {
+	stats := &AccountUsageStats{}
+
+	err := s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		err := tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ? AND peer_status_last_seen BETWEEN ? AND ?", accountID, start, end).
+			Distinct("user_id").
+			Count(&stats.ActiveUsers).Error
+		if err != nil {
+			return fmt.Errorf("get active users: %w", err)
+		}
+
+		err = tx.Model(&User{}).
+			Where("account_id = ? AND is_service_user = ?", accountID, false).
+			Count(&stats.TotalUsers).Error
+		if err != nil {
+			return fmt.Errorf("get total users: %w", err)
+		}
+
+		err = tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ? AND peer_status_last_seen BETWEEN ? AND ?", accountID, start, end).
+			Count(&stats.ActivePeers).Error
+		if err != nil {
+			return fmt.Errorf("get active peers: %w", err)
+		}
+
+		err = tx.Model(&nbpeer.Peer{}).
+			Where("account_id = ?", accountID).
+			Count(&stats.TotalPeers).Error
+		if err != nil {
+			return fmt.Errorf("get total peers: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("transaction: %w", err)
+	}
+
+	return stats, nil
+}

management/server/sqlite_store_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"path/filepath"
@@ -346,3 +347,29 @@ func newAccount(store Store, id int) error {
 
 	return store.SaveAccount(account)
 }
+
+func TestSqliteStore_CalculateUsageStats(t *testing.T) {
+	store := newSqliteStoreFromFile(t, "testdata/store_stats.json")
+	t.Cleanup(func() {
+		require.NoError(t, store.Close())
+	})
+
+	startDate := time.Date(2024, time.February, 1, 0, 0, 0, 0, time.UTC)
+	endDate := startDate.AddDate(0, 1, 0).Add(-time.Nanosecond)
+
+	stats1, err := store.CalculateUsageStats(context.TODO(), "account-1", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(2), stats1.ActiveUsers)
+	assert.Equal(t, int64(4), stats1.TotalUsers)
+	assert.Equal(t, int64(3), stats1.ActivePeers)
+	assert.Equal(t, int64(7), stats1.TotalPeers)
+
+	stats2, err := store.CalculateUsageStats(context.TODO(), "account-2", startDate, endDate)
+	require.NoError(t, err)
+
+	assert.Equal(t, int64(1), stats2.ActiveUsers)
+	assert.Equal(t, int64(2), stats2.TotalUsers)
+	assert.Equal(t, int64(1), stats2.ActivePeers)
+	assert.Equal(t, int64(2), stats2.TotalPeers)
+}

management/server/store.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -41,6 +42,7 @@ type Store interface {
 	// GetStoreEngine should return StoreEngine of the current store implementation.
 	// This is also a method of metrics.DataSource interface.
 	GetStoreEngine() StoreEngine
+	CalculateUsageStats(ctx context.Context, accountID string, start time.Time, end time.Time) (*AccountUsageStats, error)
 }
 
 type StoreEngine string

management/server/testdata/store_stats.json

@@ -0,0 +1,161 @@
+{
+  "Accounts": {
+    "account-1": {
+      "Id": "account-1",
+      "Domain": "example.com",
+      "Network": {
+        "Id": "af1c8024-ha40-4ce2-9418-34653101fc3c",
+        "Net": {
+          "IP": "100.64.0.0",
+          "Mask": "//8AAA=="
+        },
+        "Dns": null
+      },
+      "Users": {
+        "user-1-account-1": {
+          "Id": "user-1-account-1"
+        },
+        "user-2-account-1": {
+          "Id": "user-2-account-1"
+        },
+        "user-3-account-1": {
+          "Id": "user-3-account-1"
+        },
+        "user-4-account-1": {
+          "Id": "user-4-account-1"
+        },
+        "user-5-account-1": {
+          "Id": "user-5-account-1",
+          "IsServiceUser": true
+        }
+      },
+      "Peers": {
+        "peer-1-account-1": {
+          "ID": "peer-1-account-1",
+          "UserID": "user-1-account-1",
+          "Status": {
+            "LastSeen": "2024-01-01T00:00:00Z"
+          },
+          "Name": "Peer One",
+          "Meta": {
+            "Hostname": "peer1-host"
+          }
+        },
+        "peer-2-account-1": {
+          "ID": "peer-2-account-1",
+          "UserID": "user-2-account-1",
+          "Status": {
+            "LastSeen": "2024-02-29T23:59:59Z"
+          },
+          "Name": "Peer Two",
+          "Meta": {
+            "Hostname": "peer2-host"
+          }
+        },
+        "peer-3-account-1": {
+          "ID": "peer-3-account-1",
+          "UserID": "user-2-account-1",
+          "Status": {
+            "LastSeen": "2024-02-01T12:00:00Z"
+          },
+          "Name": "Peer Three",
+          "Meta": {
+            "Hostname": "peer3-host"
+          }
+        },
+        "peer-4-account-1": {
+          "ID": "peer-4-account-1",
+          "UserID": "user-3-account-1",
+          "Status": {
+            "LastSeen": "2024-02-08T12:00:00Z"
+          },
+          "Name": "Peer Four",
+          "Meta": {
+            "Hostname": "peer4-host"
+          }
+        },
+        "peer-5-account-1": {
+          "ID": "peer-5-account-1",
+          "UserID": "user-3-account-1",
+          "Status": {
+            "LastSeen": "2023-06-01T12:00:00Z"
+          },
+          "Name": "Peer Five",
+          "Meta": {
+            "Hostname": "peer5-host"
+          }
+        },
+        "peer-6-account-1": {
+          "ID": "peer-6-account-1",
+          "UserID": "user-4-account-1",
+          "Status": {
+            "LastSeen": "2024-01-31T23:59:59Z"
+          },
+          "Name": "Peer Six",
+          "Meta": {
+            "Hostname": "peer6-host"
+          }
+        },
+        "peer-7-account-1": {
+          "ID": "peer-7-account-1",
+          "UserID": "user-4-account-1",
+          "Status": {
+            "LastSeen": "2024-03-01T00:00:00Z"
+          },
+          "Name": "Peer Seven",
+          "Meta": {
+            "Hostname": "peer7-host"
+          }
+        }
+      }
+    },
+    "account-2": {
+      "Id": "account-2",
+      "Domain": "example.org",
+      "Network": {
+        "Id": "af1c8024-ha40-4ce2-9418-34653101fc3c",
+        "Net": {
+          "IP": "100.64.0.0",
+          "Mask": "//8AAA=="
+        },
+        "Dns": null
+      },
+      "Users": {
+        "user-1-account-2": {
+          "Id": "user-1-account-2"
+        },
+        "user-2-account-2": {
+          "Id": "user-1-account-2"
+        },
+        "user-3-account-2": {
+          "Id": "user-3-account-2",
+          "IsServiceUser": true
+        }
+      },
+      "Peers": {
+        "peer-1-account-2": {
+          "ID": "peer-1-account-2",
+          "UserID": "user-1-account-2",
+          "Status": {
+            "LastSeen": "2023-08-30T12:00:00Z"
+          },
+          "Name": "Peer One",
+          "Meta": {
+            "Hostname": "peer1-host"
+          }
+        },
+        "peer-2-account-2": {
+          "ID": "peer-2-account-2",
+          "UserID": "user-1-account-2",
+          "Status": {
+            "LastSeen": "2024-02-08T12:00:00Z"
+          },
+          "Name": "Peer Two",
+          "Meta": {
+            "Hostname": "peer2-host"
+          }
+        }
+      }
+    }
+  }
+}