add first structure

cmd/management.go

@@ -0,0 +1,52 @@
+package cmd
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/spf13/cobra"
+
+	"management/internal/server"
+	"management/pkg/logging"
+)
+
+var log = logging.LoggerForThisPackage()
+
+// mgmtCmd starts the management server
+var mgmtCmd = &cobra.Command{
+	Use:   "management",
+	Short: "start NetBird Management Server",
+	PreRunE: func(cmd *cobra.Command, args []string) error {
+		err := logging.Init("logging.yaml")
+		if err != nil {
+			log.Fatalf("Failed to init logging: %v", err)
+		}
+
+		srv := server.NewServer()
+
+		go func() {
+			log.Info("Starting server on :8080")
+			if err := srv.Start(); err != nil {
+				log.Fatalf("Server error: %v", err)
+			}
+		}()
+
+		stopChan := make(chan os.Signal, 1)
+		signal.Notify(stopChan, os.Interrupt, syscall.SIGTERM)
+		<-stopChan
+
+		log.Info("Shutting down server...")
+		if err := srv.Stop(); err != nil {
+			log.Errorf("Error stopping server: %v", err)
+		}
+		log.Info("Server stopped gracefully.")
+
+		return nil
+	},
+}
+
+func init() {
+	// Attach serveCmd to the rootCmd
+	rootCmd.AddCommand(mgmtCmd)
+}

cmd/root.go

@@ -0,0 +1,16 @@
+package cmd
+
+import "github.com/spf13/cobra"
+
+var rootCmd = &cobra.Command{
+	Use:          "netbird-mgmt",
+	Short:        "",
+	Long:         "",
+	Version:      "",
+	SilenceUsage: true,
+}
+
+// Execute is the entry point for all commands.
+func Execute() error {
+	return rootCmd.Execute()
+}

go.mod

@@ -0,0 +1,47 @@
+module management
+
+go 1.23.0
+
+toolchain go1.23.8
+
+require (
+	github.com/caarlos0/env/v11 v11.3.1
+	github.com/gorilla/mux v1.8.1
+	github.com/netbirdio/netbird v0.41.0
+	github.com/petermattis/goid v0.0.0-20250319124200-ccd6737f222a
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.9.1
+	github.com/spf13/viper v1.20.1
+	github.com/stretchr/testify v1.10.0
+	gorm.io/driver/postgres v1.5.11
+	gorm.io/driver/sqlite v1.5.7
+	gorm.io/gorm v1.25.12
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fsnotify/fsnotify v1.8.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgx/v5 v5.5.5 // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.12.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

internal/controllers/ephemeral_peers/controller.go

@@ -0,0 +1,226 @@
+package server
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	nbAccount "github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+const (
+	ephemeralLifeTime = 10 * time.Minute
+)
+
+var (
+	timeNow = time.Now
+)
+
+type ephemeralPeer struct {
+	id        string
+	accountID string
+	deadline  time.Time
+	next      *ephemeralPeer
+}
+
+// todo: consider to remove peer from ephemeral list when the peer has been deleted via API. If we do not do it
+// in worst case we will get invalid error message in this manager.
+
+// Controller keep a list of ephemeral peers. After ephemeralLifeTime inactivity the peer will be deleted
+// automatically. Inactivity means the peer disconnected from the Management server.
+type Controller struct {
+	store store.Store
+
+	headPeer  *ephemeralPeer
+	tailPeer  *ephemeralPeer
+	peersLock sync.Mutex
+	timer     *time.Timer
+}
+
+// NewEphemeralManager instantiate new Controller
+func NewEphemeralManager(peersManager) *Controller {
+	return &Controller{
+		store: store,
+	}
+}
+
+// LoadInitialPeers load from the database the ephemeral type of peers and schedule a cleanup procedure to the head
+// of the linked list (to the most deprecated peer). At the end of cleanup it schedules the next cleanup to the new
+// head.
+func (e *Controller) LoadInitialPeers(ctx context.Context) {
+	e.peersLock.Lock()
+	defer e.peersLock.Unlock()
+
+	e.loadEphemeralPeers(ctx)
+	if e.headPeer != nil {
+		e.timer = time.AfterFunc(ephemeralLifeTime, func() {
+			e.cleanup(ctx)
+		})
+	}
+}
+
+// Stop timer
+func (e *Controller) Stop() {
+	e.peersLock.Lock()
+	defer e.peersLock.Unlock()
+
+	if e.timer != nil {
+		e.timer.Stop()
+	}
+}
+
+// OnPeerConnected remove the peer from the linked list of ephemeral peers. Because it has been called when the peer
+// is active the manager will not delete it while it is active.
+func (e *Controller) OnPeerConnected(ctx context.Context, peer *nbpeer.Peer) {
+	if !peer.Ephemeral {
+		return
+	}
+
+	log.WithContext(ctx).Tracef("remove peer from ephemeral list: %s", peer.ID)
+
+	e.peersLock.Lock()
+	defer e.peersLock.Unlock()
+
+	e.removePeer(peer.ID)
+
+	// stop the unnecessary timer
+	if e.headPeer == nil && e.timer != nil {
+		e.timer.Stop()
+		e.timer = nil
+	}
+}
+
+// OnPeerDisconnected add the peer to the linked list of ephemeral peers. Because of the peer
+// is inactive it will be deleted after the ephemeralLifeTime period.
+func (e *Controller) OnPeerDisconnected(ctx context.Context, peer *nbpeer.Peer) {
+	if !peer.Ephemeral {
+		return
+	}
+
+	log.WithContext(ctx).Tracef("add peer to ephemeral list: %s", peer.ID)
+
+	e.peersLock.Lock()
+	defer e.peersLock.Unlock()
+
+	if e.isPeerOnList(peer.ID) {
+		return
+	}
+
+	e.addPeer(peer.AccountID, peer.ID, newDeadLine())
+	if e.timer == nil {
+		e.timer = time.AfterFunc(e.headPeer.deadline.Sub(timeNow()), func() {
+			e.cleanup(ctx)
+		})
+	}
+}
+
+func (e *Controller) loadEphemeralPeers(ctx context.Context) {
+	peers, err := e.store.GetAllEphemeralPeers(ctx, store.LockingStrengthShare)
+	if err != nil {
+		log.WithContext(ctx).Debugf("failed to load ephemeral peers: %s", err)
+		return
+	}
+
+	t := newDeadLine()
+	for _, p := range peers {
+		e.addPeer(p.AccountID, p.ID, t)
+	}
+
+	log.WithContext(ctx).Debugf("loaded ephemeral peer(s): %d", len(peers))
+}
+
+func (e *Controller) cleanup(ctx context.Context) {
+	log.Tracef("on ephemeral cleanup")
+	deletePeers := make(map[string]*ephemeralPeer)
+
+	e.peersLock.Lock()
+	now := timeNow()
+	for p := e.headPeer; p != nil; p = p.next {
+		if now.Before(p.deadline) {
+			break
+		}
+
+		deletePeers[p.id] = p
+		e.headPeer = p.next
+		if p.next == nil {
+			e.tailPeer = nil
+		}
+	}
+
+	if e.headPeer != nil {
+		e.timer = time.AfterFunc(e.headPeer.deadline.Sub(timeNow()), func() {
+			e.cleanup(ctx)
+		})
+	} else {
+		e.timer = nil
+	}
+
+	e.peersLock.Unlock()
+
+	for id, p := range deletePeers {
+		log.WithContext(ctx).Debugf("delete ephemeral peer: %s", id)
+		err := e.accountManager.DeletePeer(ctx, p.accountID, id, activity.SystemInitiator)
+		if err != nil {
+			log.WithContext(ctx).Errorf("failed to delete ephemeral peer: %s", err)
+		}
+	}
+}
+
+func (e *Controller) addPeer(accountID string, peerID string, deadline time.Time) {
+	ep := &ephemeralPeer{
+		id:        peerID,
+		accountID: accountID,
+		deadline:  deadline,
+	}
+
+	if e.headPeer == nil {
+		e.headPeer = ep
+	}
+	if e.tailPeer != nil {
+		e.tailPeer.next = ep
+	}
+	e.tailPeer = ep
+}
+
+func (e *Controller) removePeer(id string) {
+	if e.headPeer == nil {
+		return
+	}
+
+	if e.headPeer.id == id {
+		e.headPeer = e.headPeer.next
+		if e.tailPeer.id == id {
+			e.tailPeer = nil
+		}
+		return
+	}
+
+	for p := e.headPeer; p.next != nil; p = p.next {
+		if p.next.id == id {
+			// if we remove the last element from the chain then set the last-1 as tail
+			if e.tailPeer.id == id {
+				e.tailPeer = p
+			}
+			p.next = p.next.next
+			return
+		}
+	}
+}
+
+func (e *Controller) isPeerOnList(id string) bool {
+	for p := e.headPeer; p != nil; p = p.next {
+		if p.id == id {
+			return true
+		}
+	}
+	return false
+}
+
+func newDeadLine() time.Time {
+	return timeNow().Add(ephemeralLifeTime)
+}

internal/controllers/ephemeral_peers/controller_test.go

@@ -0,0 +1,149 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	nbAccount "github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+type MockStore struct {
+	store.Store
+	account *types.Account
+}
+
+func (s *MockStore) GetAllEphemeralPeers(_ context.Context, _ store.LockingStrength) ([]*nbpeer.Peer, error) {
+	var peers []*nbpeer.Peer
+	for _, v := range s.account.Peers {
+		if v.Ephemeral {
+			peers = append(peers, v)
+		}
+	}
+	return peers, nil
+}
+
+type MocAccountManager struct {
+	nbAccount.Manager
+	store *MockStore
+}
+
+func (a MocAccountManager) DeletePeer(_ context.Context, accountID, peerID, userID string) error {
+	delete(a.store.account.Peers, peerID)
+	return nil //nolint:nil
+}
+
+func (a MocAccountManager) GetStore() store.Store {
+	return a.store
+}
+
+func TestNewManager(t *testing.T) {
+	startTime := time.Now()
+	timeNow = func() time.Time {
+		return startTime
+	}
+
+	store := &MockStore{}
+	am := MocAccountManager{
+		store: store,
+	}
+
+	numberOfPeers := 5
+	numberOfEphemeralPeers := 3
+	seedPeers(store, numberOfPeers, numberOfEphemeralPeers)
+
+	mgr := NewEphemeralManager(store, am)
+	mgr.loadEphemeralPeers(context.Background())
+	startTime = startTime.Add(ephemeralLifeTime + 1)
+	mgr.cleanup(context.Background())
+
+	if len(store.account.Peers) != numberOfPeers {
+		t.Errorf("failed to cleanup ephemeral peers, expected: %d, result: %d", numberOfPeers, len(store.account.Peers))
+	}
+}
+
+func TestNewManagerPeerConnected(t *testing.T) {
+	startTime := time.Now()
+	timeNow = func() time.Time {
+		return startTime
+	}
+
+	store := &MockStore{}
+	am := MocAccountManager{
+		store: store,
+	}
+
+	numberOfPeers := 5
+	numberOfEphemeralPeers := 3
+	seedPeers(store, numberOfPeers, numberOfEphemeralPeers)
+
+	mgr := NewEphemeralManager(store, am)
+	mgr.loadEphemeralPeers(context.Background())
+	mgr.OnPeerConnected(context.Background(), store.account.Peers["ephemeral_peer_0"])
+
+	startTime = startTime.Add(ephemeralLifeTime + 1)
+	mgr.cleanup(context.Background())
+
+	expected := numberOfPeers + 1
+	if len(store.account.Peers) != expected {
+		t.Errorf("failed to cleanup ephemeral peers, expected: %d, result: %d", expected, len(store.account.Peers))
+	}
+}
+
+func TestNewManagerPeerDisconnected(t *testing.T) {
+	startTime := time.Now()
+	timeNow = func() time.Time {
+		return startTime
+	}
+
+	store := &MockStore{}
+	am := MocAccountManager{
+		store: store,
+	}
+
+	numberOfPeers := 5
+	numberOfEphemeralPeers := 3
+	seedPeers(store, numberOfPeers, numberOfEphemeralPeers)
+
+	mgr := NewEphemeralManager(store, am)
+	mgr.loadEphemeralPeers(context.Background())
+	for _, v := range store.account.Peers {
+		mgr.OnPeerConnected(context.Background(), v)
+
+	}
+	mgr.OnPeerDisconnected(context.Background(), store.account.Peers["ephemeral_peer_0"])
+
+	startTime = startTime.Add(ephemeralLifeTime + 1)
+	mgr.cleanup(context.Background())
+
+	expected := numberOfPeers + numberOfEphemeralPeers - 1
+	if len(store.account.Peers) != expected {
+		t.Errorf("failed to cleanup ephemeral peers, expected: %d, result: %d", expected, len(store.account.Peers))
+	}
+}
+
+func seedPeers(store *MockStore, numberOfPeers int, numberOfEphemeralPeers int) {
+	store.account = newAccountWithId(context.Background(), "my account", "", "")
+
+	for i := 0; i < numberOfPeers; i++ {
+		peerId := fmt.Sprintf("peer_%d", i)
+		p := &nbpeer.Peer{
+			ID:        peerId,
+			Ephemeral: false,
+		}
+		store.account.Peers[p.ID] = p
+	}
+
+	for i := 0; i < numberOfEphemeralPeers; i++ {
+		peerId := fmt.Sprintf("ephemeral_peer_%d", i)
+		p := &nbpeer.Peer{
+			ID:        peerId,
+			Ephemeral: true,
+		}
+		store.account.Peers[p.ID] = p
+	}
+}

internal/modules/users/api.go

@@ -0,0 +1,84 @@
+package users
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/http/util"
+
+	"management/internal/shared/db"
+	"management/internal/shared/errors"
+	"management/internal/shared/permissions"
+	"management/internal/shared/permissions/modules"
+	"management/internal/shared/permissions/operations"
+)
+
+type handler struct {
+	manager            *Manager
+	permissionsManager permissions.Manager
+}
+
+func newHandler(manager *Manager, permissionsManager permissions.Manager) *handler {
+	return &handler{
+		manager:            manager,
+		permissionsManager: permissionsManager,
+	}
+}
+
+func (h *handler) RegisterAPI(router *mux.Router) {
+	router.HandleFunc("/users", h.GetAllUsers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.GetUser).Methods("GET", "OPTIONS")
+}
+
+func (h *handler) GetAllUsers(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	allowed, err := h.permissionsManager.ValidateUserPermissions(r.Context(), userAuth.AccountId, userAuth.UserId, modules.Users, operations.Read)
+	if err != nil {
+		util.WriteError(r.Context(), errors.NewPermissionValidationError(err), w)
+		return
+	}
+	if !allowed {
+		util.WriteError(r.Context(), errors.NewPermissionDeniedError(), w)
+	}
+
+	users, err := h.manager.GetAllUsers(r.Context(), nil, db.LockingStrengthShare, userAuth.AccountId)
+	if err != nil {
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	_ = json.NewEncoder(w).Encode(users)
+}
+
+func (h *handler) GetUser(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	allowed, err := h.permissionsManager.ValidateUserPermissions(r.Context(), userAuth.AccountId, userAuth.UserId, modules.Users, operations.Read)
+	if err != nil {
+		util.WriteError(r.Context(), errors.NewPermissionValidationError(err), w)
+		return
+	}
+	if !allowed {
+		util.WriteError(r.Context(), errors.NewPermissionDeniedError(), w)
+	}
+
+	vars := mux.Vars(r)
+	userId := vars["userId"]
+
+	user, err := h.manager.GetUserByID(r.Context(), nil, db.LockingStrengthShare, userId)
+	if err != nil {
+		http.Error(w, "Not Found", http.StatusNotFound)
+		return
+	}
+	_ = json.NewEncoder(w).Encode(user)
+}

internal/modules/users/config.go

@@ -0,0 +1 @@
+package users

internal/modules/users/manager.go

@@ -0,0 +1,32 @@
+package users
+
+import (
+	"context"
+
+	"management/internal/modules/users/types"
+	"management/internal/shared/db"
+	"management/internal/shared/permissions"
+	"management/pkg/logging"
+)
+
+var log = logging.LoggerForThisPackage()
+
+type Manager struct {
+	repo    Repository
+	handler *handler
+}
+
+func NewManager(store *db.Store, permissionsManager permissions.Manager) *Manager {
+	repo := newRepository(store)
+	m := &Manager{repo: repo}
+	m.handler = newHandler(m, permissionsManager)
+	return m
+}
+
+func (m *Manager) GetAllUsers(ctx context.Context, tx db.Transaction, strength db.LockingStrength, accountID string) ([]types.User, error) {
+	return m.repo.GetAllUsers(tx, strength, accountID)
+}
+
+func (m *Manager) GetUserByID(ctx context.Context, tx db.Transaction, strength db.LockingStrength, id string) (*types.User, error) {
+	return m.repo.GetUserByID(tx, strength, id)
+}

internal/modules/users/pats/types/personal_access_token.go

@@ -0,0 +1,112 @@
+package types
+
+import (
+	"crypto/sha256"
+	b64 "encoding/base64"
+	"fmt"
+	"hash/crc32"
+	"time"
+
+	b "github.com/hashicorp/go-secure-stdlib/base62"
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/base62"
+)
+
+const (
+	// PATPrefix is the globally used, 4 char prefix for personal access tokens
+	PATPrefix = "nbp_"
+	// PATSecretLength number of characters used for the secret inside the token
+	PATSecretLength = 30
+	// PATChecksumLength number of characters used for the encoded checksum of the secret inside the token
+	PATChecksumLength = 6
+	// PATLength total number of characters used for the token
+	PATLength = 40
+)
+
+// PersonalAccessToken holds all information about a PAT including a hashed version of it for verification
+type PersonalAccessToken struct {
+	ID string `gorm:"primaryKey"`
+	// User is a reference to Account that this object belongs
+	UserID         string `gorm:"index"`
+	Name           string
+	HashedToken    string
+	ExpirationDate *time.Time
+	// scope could be added in future
+	CreatedBy string
+	CreatedAt time.Time
+	LastUsed  *time.Time
+}
+
+func (t *PersonalAccessToken) Copy() *PersonalAccessToken {
+	return &PersonalAccessToken{
+		ID:             t.ID,
+		Name:           t.Name,
+		HashedToken:    t.HashedToken,
+		ExpirationDate: t.ExpirationDate,
+		CreatedBy:      t.CreatedBy,
+		CreatedAt:      t.CreatedAt,
+		LastUsed:       t.LastUsed,
+	}
+}
+
+// GetExpirationDate returns the expiration time of the token.
+func (t *PersonalAccessToken) GetExpirationDate() time.Time {
+	if t.ExpirationDate != nil {
+		return *t.ExpirationDate
+	}
+	return time.Time{}
+}
+
+// GetLastUsed returns the last time the token was used.
+func (t *PersonalAccessToken) GetLastUsed() time.Time {
+	if t.LastUsed != nil {
+		return *t.LastUsed
+	}
+	return time.Time{}
+}
+
+// PersonalAccessTokenGenerated holds the new PersonalAccessToken and the plain text version of it
+type PersonalAccessTokenGenerated struct {
+	PlainToken string
+	PersonalAccessToken
+}
+
+// CreateNewPAT will generate a new PersonalAccessToken that can be assigned to a User.
+// Additionally, it will return the token in plain text once, to give to the user and only save a hashed version
+func CreateNewPAT(name string, expirationInDays int, targetID, createdBy string) (*PersonalAccessTokenGenerated, error) {
+	hashedToken, plainToken, err := generateNewToken()
+	if err != nil {
+		return nil, err
+	}
+	currentTime := time.Now()
+	expirationDate := currentTime.AddDate(0, 0, expirationInDays)
+	return &PersonalAccessTokenGenerated{
+		PersonalAccessToken: PersonalAccessToken{
+			ID:             xid.New().String(),
+			UserID:         targetID,
+			Name:           name,
+			HashedToken:    hashedToken,
+			ExpirationDate: &expirationDate,
+			CreatedBy:      createdBy,
+			CreatedAt:      currentTime,
+		},
+		PlainToken: plainToken,
+	}, nil
+
+}
+
+func generateNewToken() (string, string, error) {
+	secret, err := b.Random(PATSecretLength)
+	if err != nil {
+		return "", "", err
+	}
+
+	checksum := crc32.ChecksumIEEE([]byte(secret))
+	encodedChecksum := base62.Encode(checksum)
+	paddedChecksum := fmt.Sprintf("%06s", encodedChecksum)
+	plainToken := PATPrefix + secret + paddedChecksum
+	hashedToken := sha256.Sum256([]byte(plainToken))
+	encodedHashedToken := b64.StdEncoding.EncodeToString(hashedToken[:])
+	return encodedHashedToken, plainToken, nil
+}

internal/modules/users/repository.go

@@ -0,0 +1,51 @@
+package users
+
+import (
+	"management/internal/modules/users/types"
+	"management/internal/shared/db"
+)
+
+type Repository interface {
+	RunInTx(fn func(tx db.Transaction) error) error
+	GetAllUsers(tx db.Transaction, strength db.LockingStrength, accountID string) ([]types.User, error)
+	GetUserByID(tx db.Transaction, strength db.LockingStrength, id string) (*types.User, error)
+	CreateUser(tx db.Transaction, u *types.User) error
+}
+
+type repository struct {
+	store *db.Store
+}
+
+func newRepository(s *db.Store) Repository {
+	err := s.AutoMigrate(types.User{})
+	if err != nil {
+		log.Fatalf("Failed to auto migrate: %v", err)
+	}
+	return &repository{store: s}
+}
+
+func (r *repository) RunInTx(fn func(tx db.Transaction) error) error {
+	return r.store.RunInTx(fn)
+}
+
+func (r *repository) GetAllUsers(tx db.Transaction, strength db.LockingStrength, accountID string) ([]types.User, error) {
+	var users []types.User
+	err := r.store.GetMany(tx, strength, &users, "account_id = ?", accountID)
+	if err != nil {
+		return nil, err
+	}
+	return users, nil
+}
+
+func (r *repository) GetUserByID(tx db.Transaction, strength db.LockingStrength, id string) (*types.User, error) {
+	var user types.User
+	err := r.store.GetOne(tx, strength, &user, "id = ?", id)
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+func (r *repository) CreateUser(tx db.Transaction, u *types.User) error {
+	return r.store.Create(tx, u)
+}

internal/modules/users/types/user.go

@@ -0,0 +1,241 @@
+package types
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/netbirdio/netbird/management/server/idp"
+	"github.com/netbirdio/netbird/management/server/integration_reference"
+
+	"management/internal/modules/users/pats/types"
+)
+
+const (
+	UserRoleOwner        UserRole = "owner"
+	UserRoleAdmin        UserRole = "admin"
+	UserRoleUser         UserRole = "user"
+	UserRoleUnknown      UserRole = "unknown"
+	UserRoleBillingAdmin UserRole = "billing_admin"
+
+	UserStatusActive   UserStatus = "active"
+	UserStatusDisabled UserStatus = "disabled"
+	UserStatusInvited  UserStatus = "invited"
+
+	UserIssuedAPI         = "api"
+	UserIssuedIntegration = "integration"
+)
+
+// StrRoleToUserRole returns UserRole for a given strRole or UserRoleUnknown if the specified role is unknown
+func StrRoleToUserRole(strRole string) UserRole {
+	switch strings.ToLower(strRole) {
+	case "owner":
+		return UserRoleOwner
+	case "admin":
+		return UserRoleAdmin
+	case "user":
+		return UserRoleUser
+	case "billing_admin":
+		return UserRoleBillingAdmin
+	default:
+		return UserRoleUnknown
+	}
+}
+
+// UserStatus is the status of a User
+type UserStatus string
+
+// UserRole is the role of a User
+type UserRole string
+
+type UserInfo struct {
+	ID                   string                                     `json:"id"`
+	Email                string                                     `json:"email"`
+	Name                 string                                     `json:"name"`
+	Role                 string                                     `json:"role"`
+	AutoGroups           []string                                   `json:"auto_groups"`
+	Status               string                                     `json:"-"`
+	IsServiceUser        bool                                       `json:"is_service_user"`
+	IsBlocked            bool                                       `json:"is_blocked"`
+	NonDeletable         bool                                       `json:"non_deletable"`
+	LastLogin            time.Time                                  `json:"last_login"`
+	Issued               string                                     `json:"issued"`
+	IntegrationReference integration_reference.IntegrationReference `json:"-"`
+	Permissions          UserPermissions                            `json:"permissions"`
+}
+
+type UserPermissions struct {
+	DashboardView string `json:"dashboard_view"`
+}
+
+// User represents a user of the system
+type User struct {
+	Id string `gorm:"primaryKey"`
+	// AccountID is a reference to Account that this object belongs
+	AccountID     string `json:"-" gorm:"index"`
+	Role          UserRole
+	IsServiceUser bool
+	// NonDeletable indicates whether the service user can be deleted
+	NonDeletable bool
+	// ServiceUserName is only set if IsServiceUser is true
+	ServiceUserName string
+	// AutoGroups is a list of Group IDs to auto-assign to peers registered by this user
+	AutoGroups []string                              `gorm:"serializer:json"`
+	PATs       map[string]*types.PersonalAccessToken `gorm:"-"`
+	PATsG      []types.PersonalAccessToken           `json:"-" gorm:"foreignKey:UserID;references:id;constraint:OnDelete:CASCADE;"`
+	// Blocked indicates whether the user is blocked. Blocked users can't use the system.
+	Blocked bool
+	// LastLogin is the last time the user logged in to IdP
+	LastLogin *time.Time
+	// CreatedAt records the time the user was created
+	CreatedAt time.Time
+
+	// Issued of the user
+	Issued string `gorm:"default:api"`
+
+	IntegrationReference integration_reference.IntegrationReference `gorm:"embedded;embeddedPrefix:integration_ref_"`
+}
+
+// IsBlocked returns true if the user is blocked, false otherwise
+func (u *User) IsBlocked() bool {
+	return u.Blocked
+}
+
+func (u *User) LastDashboardLoginChanged(lastLogin time.Time) bool {
+	return lastLogin.After(u.GetLastLogin()) && !u.GetLastLogin().IsZero()
+}
+
+// GetLastLogin returns the last login time of the user.
+func (u *User) GetLastLogin() time.Time {
+	if u.LastLogin != nil {
+		return *u.LastLogin
+	}
+	return time.Time{}
+}
+
+// HasAdminPower returns true if the user has admin or owner roles, false otherwise
+func (u *User) HasAdminPower() bool {
+	return u.Role == UserRoleAdmin || u.Role == UserRoleOwner
+}
+
+// IsAdminOrServiceUser checks if the user has admin power or is a service user.
+func (u *User) IsAdminOrServiceUser() bool {
+	return u.HasAdminPower() || u.IsServiceUser
+}
+
+// IsRegularUser checks if the user is a regular user.
+func (u *User) IsRegularUser() bool {
+	return !u.HasAdminPower() && !u.IsServiceUser
+}
+
+// ToUserInfo converts a User object to a UserInfo object.
+func (u *User) ToUserInfo(userData *idp.UserData, settings *Settings) (*UserInfo, error) {
+	autoGroups := u.AutoGroups
+	if autoGroups == nil {
+		autoGroups = []string{}
+	}
+
+	dashboardViewPermissions := "full"
+	if !u.HasAdminPower() {
+		dashboardViewPermissions = "limited"
+		if settings.RegularUsersViewBlocked {
+			dashboardViewPermissions = "blocked"
+		}
+	}
+
+	if userData == nil {
+		return &UserInfo{
+			ID:            u.Id,
+			Email:         "",
+			Name:          u.ServiceUserName,
+			Role:          string(u.Role),
+			AutoGroups:    u.AutoGroups,
+			Status:        string(UserStatusActive),
+			IsServiceUser: u.IsServiceUser,
+			IsBlocked:     u.Blocked,
+			LastLogin:     u.GetLastLogin(),
+			Issued:        u.Issued,
+			Permissions: UserPermissions{
+				DashboardView: dashboardViewPermissions,
+			},
+		}, nil
+	}
+	if userData.ID != u.Id {
+		return nil, fmt.Errorf("wrong UserData provided for user %s", u.Id)
+	}
+
+	userStatus := UserStatusActive
+	if userData.AppMetadata.WTPendingInvite != nil && *userData.AppMetadata.WTPendingInvite {
+		userStatus = UserStatusInvited
+	}
+
+	return &UserInfo{
+		ID:            u.Id,
+		Email:         userData.Email,
+		Name:          userData.Name,
+		Role:          string(u.Role),
+		AutoGroups:    autoGroups,
+		Status:        string(userStatus),
+		IsServiceUser: u.IsServiceUser,
+		IsBlocked:     u.Blocked,
+		LastLogin:     u.GetLastLogin(),
+		Issued:        u.Issued,
+		Permissions: UserPermissions{
+			DashboardView: dashboardViewPermissions,
+		},
+	}, nil
+}
+
+// Copy the user
+func (u *User) Copy() *User {
+	autoGroups := make([]string, len(u.AutoGroups))
+	copy(autoGroups, u.AutoGroups)
+	pats := make(map[string]*types.PersonalAccessToken, len(u.PATs))
+	for k, v := range u.PATs {
+		pats[k] = v.Copy()
+	}
+	return &User{
+		Id:                   u.Id,
+		AccountID:            u.AccountID,
+		Role:                 u.Role,
+		AutoGroups:           autoGroups,
+		IsServiceUser:        u.IsServiceUser,
+		NonDeletable:         u.NonDeletable,
+		ServiceUserName:      u.ServiceUserName,
+		PATs:                 pats,
+		Blocked:              u.Blocked,
+		LastLogin:            u.LastLogin,
+		CreatedAt:            u.CreatedAt,
+		Issued:               u.Issued,
+		IntegrationReference: u.IntegrationReference,
+	}
+}
+
+// NewUser creates a new user
+func NewUser(id string, role UserRole, isServiceUser bool, nonDeletable bool, serviceUserName string, autoGroups []string, issued string) *User {
+	return &User{
+		Id:              id,
+		Role:            role,
+		IsServiceUser:   isServiceUser,
+		NonDeletable:    nonDeletable,
+		ServiceUserName: serviceUserName,
+		AutoGroups:      autoGroups,
+		Issued:          issued,
+		CreatedAt:       time.Now().UTC(),
+	}
+}
+
+// NewRegularUser creates a new user with role UserRoleUser
+func NewRegularUser(id string) *User {
+	return NewUser(id, UserRoleUser, false, false, "", []string{}, UserIssuedAPI)
+}
+
+// NewAdminUser creates a new user with role UserRoleAdmin
+func NewAdminUser(id string) *User {
+	return NewUser(id, UserRoleAdmin, false, false, "", []string{}, UserIssuedAPI)
+}
+
+// NewOwnerUser creates a new user with role UserRoleOwner
+func NewOwnerUser(id string) *User {
+	return NewUser(id, UserRoleOwner, false, false, "", []string{}, UserIssuedAPI)
+}

internal/server/server.go

@@ -0,0 +1,58 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"management/internal/modules/users"
+	"management/internal/shared/api"
+	"management/internal/shared/db"
+	"management/internal/shared/permissions"
+	"management/pkg/logging"
+)
+
+// Server holds the HTTP server instance.
+// Add any additional fields you need, such as database connections, config, etc.
+type Server struct {
+	httpServer *http.Server
+}
+
+var log = logging.LoggerForThisPackage()
+
+// NewServer initializes and configures a new Server instance
+func NewServer() *Server {
+	ctx := context.Background()
+
+	dbConn, err := db.NewDatabaseConn(ctx)
+	if err != nil {
+		log.Fatalf("error while creating database connection: %s", err)
+	}
+
+	store := db.NewStore(ctx, dbConn)
+
+	router := api.NewRouter()
+
+	permissionsManager := permissions.NewManager(store)
+	userManager := users.NewManager(store, permissions.NewManager(store))
+
+	return &Server{
+		httpServer: &http.Server{
+			Addr:    ":8080", // or from a config file
+			Handler: router,
+		},
+	}
+}
+
+// Start begins listening for HTTP requests on the configured address
+func (s *Server) Start() error {
+	return s.httpServer.ListenAndServe()
+}
+
+// Stop attempts a graceful shutdown, waiting up to 5 seconds for active connections to finish
+func (s *Server) Stop() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	return s.httpServer.Shutdown(ctx)
+}

internal/shared/activity/codes.go

@@ -0,0 +1,288 @@
+package activity
+
+import "maps"
+
+// Activity that triggered an Event
+type Activity int
+
+// Code is an activity string representation
+type Code struct {
+	Message string
+	Code    string
+}
+
+// Existing consts must not be changed, as this will break the compatibility with the existing data
+const (
+	// PeerAddedByUser indicates that a user added a new peer to the system
+	PeerAddedByUser Activity = 0
+	// PeerAddedWithSetupKey indicates that a new peer joined the system using a setup key
+	PeerAddedWithSetupKey Activity = 1
+	// UserJoined indicates that a new user joined the account
+	UserJoined Activity = 2
+	// UserInvited indicates that a new user was invited to join the account
+	UserInvited Activity = 3
+	// AccountCreated indicates that a new account has been created
+	AccountCreated Activity = 4
+	// PeerRemovedByUser indicates that a user removed a peer from the system
+	PeerRemovedByUser Activity = 5
+	// RuleAdded indicates that a user added a new rule
+	RuleAdded Activity = 6
+	// RuleUpdated indicates that a user updated a rule
+	RuleUpdated Activity = 7
+	// RuleRemoved indicates that a user removed a rule
+	RuleRemoved Activity = 8
+	// PolicyAdded indicates that a user added a new policy
+	PolicyAdded Activity = 9
+	// PolicyUpdated indicates that a user updated a policy
+	PolicyUpdated Activity = 10
+	// PolicyRemoved indicates that a user removed a policy
+	PolicyRemoved Activity = 11
+	// SetupKeyCreated indicates that a user created a new setup key
+	SetupKeyCreated Activity = 12
+	// SetupKeyUpdated indicates that a user updated a setup key
+	SetupKeyUpdated Activity = 13
+	// SetupKeyRevoked indicates that a user revoked a setup key
+	SetupKeyRevoked Activity = 14
+	// SetupKeyOverused indicates that setup key usage exhausted
+	SetupKeyOverused Activity = 15
+	// GroupCreated indicates that a user created a group
+	GroupCreated Activity = 16
+	// GroupUpdated indicates that a user updated a group
+	GroupUpdated Activity = 17
+	// GroupAddedToPeer indicates that a user added group to a peer
+	GroupAddedToPeer Activity = 18
+	// GroupRemovedFromPeer indicates that a user removed peer group
+	GroupRemovedFromPeer Activity = 19
+	// GroupAddedToUser indicates that a user added group to a user
+	GroupAddedToUser Activity = 20
+	// GroupRemovedFromUser indicates that a user removed a group from a user
+	GroupRemovedFromUser Activity = 21
+	// UserRoleUpdated indicates that a user changed the role of a user
+	UserRoleUpdated Activity = 22
+	// GroupAddedToSetupKey indicates that a user added group to a setup key
+	GroupAddedToSetupKey Activity = 23
+	// GroupRemovedFromSetupKey indicates that a user removed a group from a setup key
+	GroupRemovedFromSetupKey Activity = 24
+	// GroupAddedToDisabledManagementGroups indicates that a user added a group to the DNS setting Disabled management groups
+	GroupAddedToDisabledManagementGroups Activity = 25
+	// GroupRemovedFromDisabledManagementGroups indicates that a user removed a group from the DNS setting Disabled management groups
+	GroupRemovedFromDisabledManagementGroups Activity = 26
+	// RouteCreated indicates that a user created a route
+	RouteCreated Activity = 27
+	// RouteRemoved indicates that a user deleted a route
+	RouteRemoved Activity = 28
+	// RouteUpdated indicates that a user updated a route
+	RouteUpdated Activity = 29
+	// PeerSSHEnabled indicates that a user enabled SSH server on a peer
+	PeerSSHEnabled Activity = 30
+	// PeerSSHDisabled indicates that a user disabled SSH server on a peer
+	PeerSSHDisabled Activity = 31
+	// PeerRenamed indicates that a user renamed a peer
+	PeerRenamed Activity = 32
+	// PeerLoginExpirationEnabled indicates that a user enabled login expiration of a peer
+	PeerLoginExpirationEnabled Activity = 33
+	// PeerLoginExpirationDisabled indicates that a user disabled login expiration of a peer
+	PeerLoginExpirationDisabled Activity = 34
+	// NameserverGroupCreated indicates that a user created a nameservers group
+	NameserverGroupCreated Activity = 35
+	// NameserverGroupDeleted indicates that a user deleted a nameservers group
+	NameserverGroupDeleted Activity = 36
+	// NameserverGroupUpdated indicates that a user updated a nameservers group
+	NameserverGroupUpdated Activity = 37
+	// AccountPeerLoginExpirationEnabled indicates that a user enabled peer login expiration for the account
+	AccountPeerLoginExpirationEnabled Activity = 38
+	// AccountPeerLoginExpirationDisabled indicates that a user disabled peer login expiration for the account
+	AccountPeerLoginExpirationDisabled Activity = 39
+	// AccountPeerLoginExpirationDurationUpdated indicates that a user updated peer login expiration duration for the account
+	AccountPeerLoginExpirationDurationUpdated Activity = 40
+	// PersonalAccessTokenCreated indicates that a user created a personal access token
+	PersonalAccessTokenCreated Activity = 41
+	// PersonalAccessTokenDeleted indicates that a user deleted a personal access token
+	PersonalAccessTokenDeleted Activity = 42
+	// ServiceUserCreated indicates that a user created a service user
+	ServiceUserCreated Activity = 43
+	// ServiceUserDeleted indicates that a user deleted a service user
+	ServiceUserDeleted Activity = 44
+	// UserBlocked indicates that a user blocked another user
+	UserBlocked Activity = 45
+	// UserUnblocked indicates that a user unblocked another user
+	UserUnblocked Activity = 46
+	// UserDeleted indicates that a user deleted another user
+	UserDeleted Activity = 47
+	// GroupDeleted indicates that a user deleted group
+	GroupDeleted Activity = 48
+	// UserLoggedInPeer indicates that user logged in their peer with an interactive SSO login
+	UserLoggedInPeer Activity = 49
+	// PeerLoginExpired indicates that the user peer login has been expired and peer disconnected
+	PeerLoginExpired Activity = 50
+	// DashboardLogin indicates that the user logged in to the dashboard
+	DashboardLogin Activity = 51
+	// IntegrationCreated indicates that the user created an integration
+	IntegrationCreated Activity = 52
+	// IntegrationUpdated indicates that the user updated an integration
+	IntegrationUpdated Activity = 53
+	// IntegrationDeleted indicates that the user deleted an integration
+	IntegrationDeleted Activity = 54
+	// AccountPeerApprovalEnabled indicates that the user enabled peer approval for the account
+	AccountPeerApprovalEnabled Activity = 55
+	// AccountPeerApprovalDisabled indicates that the user disabled peer approval for the account
+	AccountPeerApprovalDisabled Activity = 56
+	// PeerApproved indicates that the peer has been approved
+	PeerApproved Activity = 57
+	// PeerApprovalRevoked indicates that the peer approval has been revoked
+	PeerApprovalRevoked Activity = 58
+	// TransferredOwnerRole indicates that the user transferred the owner role of the account
+	TransferredOwnerRole Activity = 59
+	// PostureCheckCreated indicates that the user created a posture check
+	PostureCheckCreated Activity = 60
+	// PostureCheckUpdated indicates that the user updated a posture check
+	PostureCheckUpdated Activity = 61
+	// PostureCheckDeleted indicates that the user deleted a posture check
+	PostureCheckDeleted Activity = 62
+
+	PeerInactivityExpirationEnabled  Activity = 63
+	PeerInactivityExpirationDisabled Activity = 64
+
+	AccountPeerInactivityExpirationEnabled         Activity = 65
+	AccountPeerInactivityExpirationDisabled        Activity = 66
+	AccountPeerInactivityExpirationDurationUpdated Activity = 67
+
+	SetupKeyDeleted Activity = 68
+
+	UserGroupPropagationEnabled  Activity = 69
+	UserGroupPropagationDisabled Activity = 70
+
+	AccountRoutingPeerDNSResolutionEnabled  Activity = 71
+	AccountRoutingPeerDNSResolutionDisabled Activity = 72
+
+	NetworkCreated Activity = 73
+	NetworkUpdated Activity = 74
+	NetworkDeleted Activity = 75
+
+	NetworkResourceCreated Activity = 76
+	NetworkResourceUpdated Activity = 77
+	NetworkResourceDeleted Activity = 78
+
+	NetworkRouterCreated Activity = 79
+	NetworkRouterUpdated Activity = 80
+	NetworkRouterDeleted Activity = 81
+
+	ResourceAddedToGroup     Activity = 82
+	ResourceRemovedFromGroup Activity = 83
+)
+
+var activityMap = map[Activity]Code{
+	PeerAddedByUser:                          {"Peer added", "peer.user.add"},
+	PeerAddedWithSetupKey:                    {"Peer added", "peer.setupkey.add"},
+	UserJoined:                               {"User joined", "user.join"},
+	UserInvited:                              {"User invited", "user.invite"},
+	AccountCreated:                           {"Account created", "account.create"},
+	PeerRemovedByUser:                        {"Peer deleted", "user.peer.delete"},
+	RuleAdded:                                {"Rule added", "rule.add"},
+	RuleUpdated:                              {"Rule updated", "rule.update"},
+	RuleRemoved:                              {"Rule deleted", "rule.delete"},
+	PolicyAdded:                              {"Policy added", "policy.add"},
+	PolicyUpdated:                            {"Policy updated", "policy.update"},
+	PolicyRemoved:                            {"Policy deleted", "policy.delete"},
+	SetupKeyCreated:                          {"Setup key created", "setupkey.add"},
+	SetupKeyUpdated:                          {"Setup key updated", "setupkey.update"},
+	SetupKeyRevoked:                          {"Setup key revoked", "setupkey.revoke"},
+	SetupKeyOverused:                         {"Setup key overused", "setupkey.overuse"},
+	GroupCreated:                             {"Group created", "group.add"},
+	GroupUpdated:                             {"Group updated", "group.update"},
+	GroupAddedToPeer:                         {"Group added to peer", "peer.group.add"},
+	GroupRemovedFromPeer:                     {"Group removed from peer", "peer.group.delete"},
+	GroupAddedToUser:                         {"Group added to user", "user.group.add"},
+	GroupRemovedFromUser:                     {"Group removed from user", "user.group.delete"},
+	UserRoleUpdated:                          {"User role updated", "user.role.update"},
+	GroupAddedToSetupKey:                     {"Group added to setup key", "setupkey.group.add"},
+	GroupRemovedFromSetupKey:                 {"Group removed from user setup key", "setupkey.group.delete"},
+	GroupAddedToDisabledManagementGroups:     {"Group added to disabled management DNS setting", "dns.setting.disabled.management.group.add"},
+	GroupRemovedFromDisabledManagementGroups: {"Group removed from disabled management DNS setting", "dns.setting.disabled.management.group.delete"},
+	RouteCreated:                             {"Route created", "route.add"},
+	RouteRemoved:                             {"Route deleted", "route.delete"},
+	RouteUpdated:                             {"Route updated", "route.update"},
+	PeerSSHEnabled:                           {"Peer SSH server enabled", "peer.ssh.enable"},
+	PeerSSHDisabled:                          {"Peer SSH server disabled", "peer.ssh.disable"},
+	PeerRenamed:                              {"Peer renamed", "peer.rename"},
+	PeerLoginExpirationEnabled:               {"Peer login expiration enabled", "peer.login.expiration.enable"},
+	PeerLoginExpirationDisabled:              {"Peer login expiration disabled", "peer.login.expiration.disable"},
+	NameserverGroupCreated:                   {"Nameserver group created", "nameserver.group.add"},
+	NameserverGroupDeleted:                   {"Nameserver group deleted", "nameserver.group.delete"},
+	NameserverGroupUpdated:                   {"Nameserver group updated", "nameserver.group.update"},
+	AccountPeerLoginExpirationDurationUpdated: {"Account peer login expiration duration updated", "account.setting.peer.login.expiration.update"},
+	AccountPeerLoginExpirationEnabled:         {"Account peer login expiration enabled", "account.setting.peer.login.expiration.enable"},
+	AccountPeerLoginExpirationDisabled:        {"Account peer login expiration disabled", "account.setting.peer.login.expiration.disable"},
+	PersonalAccessTokenCreated:                {"Personal access token created", "personal.access.token.create"},
+	PersonalAccessTokenDeleted:                {"Personal access token deleted", "personal.access.token.delete"},
+	ServiceUserCreated:                        {"Service user created", "service.user.create"},
+	ServiceUserDeleted:                        {"Service user deleted", "service.user.delete"},
+	UserBlocked:                               {"User blocked", "user.block"},
+	UserUnblocked:                             {"User unblocked", "user.unblock"},
+	UserDeleted:                               {"User deleted", "user.delete"},
+	GroupDeleted:                              {"Group deleted", "group.delete"},
+	UserLoggedInPeer:                          {"User logged in peer", "user.peer.login"},
+	PeerLoginExpired:                          {"Peer login expired", "peer.login.expire"},
+	DashboardLogin:                            {"Dashboard login", "dashboard.login"},
+	IntegrationCreated:                        {"Integration created", "integration.create"},
+	IntegrationUpdated:                        {"Integration updated", "integration.update"},
+	IntegrationDeleted:                        {"Integration deleted", "integration.delete"},
+	AccountPeerApprovalEnabled:                {"Account peer approval enabled", "account.setting.peer.approval.enable"},
+	AccountPeerApprovalDisabled:               {"Account peer approval disabled", "account.setting.peer.approval.disable"},
+	PeerApproved:                              {"Peer approved", "peer.approve"},
+	PeerApprovalRevoked:                       {"Peer approval revoked", "peer.approval.revoke"},
+	TransferredOwnerRole:                      {"Transferred owner role", "transferred.owner.role"},
+	PostureCheckCreated:                       {"Posture check created", "posture.check.create"},
+	PostureCheckUpdated:                       {"Posture check updated", "posture.check.update"},
+	PostureCheckDeleted:                       {"Posture check deleted", "posture.check.delete"},
+
+	PeerInactivityExpirationEnabled:  {"Peer inactivity expiration enabled", "peer.inactivity.expiration.enable"},
+	PeerInactivityExpirationDisabled: {"Peer inactivity expiration disabled", "peer.inactivity.expiration.disable"},
+
+	AccountPeerInactivityExpirationEnabled:         {"Account peer inactivity expiration enabled", "account.peer.inactivity.expiration.enable"},
+	AccountPeerInactivityExpirationDisabled:        {"Account peer inactivity expiration disabled", "account.peer.inactivity.expiration.disable"},
+	AccountPeerInactivityExpirationDurationUpdated: {"Account peer inactivity expiration duration updated", "account.peer.inactivity.expiration.update"},
+	SetupKeyDeleted: {"Setup key deleted", "setupkey.delete"},
+
+	UserGroupPropagationEnabled:  {"User group propagation enabled", "account.setting.group.propagation.enable"},
+	UserGroupPropagationDisabled: {"User group propagation disabled", "account.setting.group.propagation.disable"},
+
+	AccountRoutingPeerDNSResolutionEnabled:  {"Account routing peer DNS resolution enabled", "account.setting.routing.peer.dns.resolution.enable"},
+	AccountRoutingPeerDNSResolutionDisabled: {"Account routing peer DNS resolution disabled", "account.setting.routing.peer.dns.resolution.disable"},
+
+	NetworkCreated: {"Network created", "network.create"},
+	NetworkUpdated: {"Network updated", "network.update"},
+	NetworkDeleted: {"Network deleted", "network.delete"},
+
+	NetworkResourceCreated: {"Network resource created", "network.resource.create"},
+	NetworkResourceUpdated: {"Network resource updated", "network.resource.update"},
+	NetworkResourceDeleted: {"Network resource deleted", "network.resource.delete"},
+
+	NetworkRouterCreated: {"Network router created", "network.router.create"},
+	NetworkRouterUpdated: {"Network router updated", "network.router.update"},
+	NetworkRouterDeleted: {"Network router deleted", "network.router.delete"},
+
+	ResourceAddedToGroup:     {"Resource added to group", "resource.group.add"},
+	ResourceRemovedFromGroup: {"Resource removed from group", "resource.group.delete"},
+}
+
+// StringCode returns a string code of the activity
+func (a Activity) StringCode() string {
+	if code, ok := activityMap[a]; ok {
+		return code.Code
+	}
+	return "UNKNOWN_ACTIVITY"
+}
+
+// Message returns a string representation of an activity
+func (a Activity) Message() string {
+	if code, ok := activityMap[a]; ok {
+		return code.Message
+	}
+	return "UNKNOWN_ACTIVITY"
+}
+
+// RegisterActivityMap adds new codes to the activity map
+func RegisterActivityMap(codes map[Activity]Code) {
+	maps.Copy(activityMap, codes)
+}

internal/shared/activity/config.go

@@ -0,0 +1,5 @@
+package activity
+
+type config struct {
+	Enabled bool `env:"NB_EVENT_ACTIVITY_LOG_ENABLED" envDefault:"true"`
+}

internal/shared/activity/event.go

@@ -0,0 +1,59 @@
+package activity
+
+import (
+	"time"
+)
+
+const (
+	SystemInitiator = "sys"
+)
+
+// ActivityDescriber is an interface that describes an activity
+type ActivityDescriber interface { //nolint:revive
+	StringCode() string
+	Message() string
+}
+
+// Event represents a network/system activity event.
+type Event struct {
+	// Timestamp of the event
+	Timestamp time.Time
+	// Activity that was performed during the event
+	Activity ActivityDescriber
+	// ID of the event (can be empty, meaning that it wasn't yet generated)
+	ID uint64
+	// InitiatorID is the ID of an object that initiated the event (e.g., a user)
+	InitiatorID string
+	// InitiatorName is the name of an object that initiated the event.
+	InitiatorName string
+	// InitiatorEmail is the email address of an object that initiated the event.
+	InitiatorEmail string
+	// TargetID is the ID of an object that was effected by the event (e.g., a peer)
+	TargetID string
+	// AccountID is the ID of an account where the event happened
+	AccountID string
+
+	// Meta of the event, e.g. deleted peer information like name, IP, etc
+	Meta map[string]any
+}
+
+// Copy the event
+func (e *Event) Copy() *Event {
+
+	meta := make(map[string]any, len(e.Meta))
+	for key, value := range e.Meta {
+		meta[key] = value
+	}
+
+	return &Event{
+		Timestamp:      e.Timestamp,
+		Activity:       e.Activity,
+		ID:             e.ID,
+		InitiatorID:    e.InitiatorID,
+		InitiatorName:  e.InitiatorName,
+		InitiatorEmail: e.InitiatorEmail,
+		TargetID:       e.TargetID,
+		AccountID:      e.AccountID,
+		Meta:           meta,
+	}
+}

internal/shared/activity/manager.go

@@ -0,0 +1,48 @@
+package activity
+
+import (
+	"context"
+	"time"
+
+	"management/pkg/configuration"
+	"management/pkg/logging"
+)
+
+var log = logging.LoggerForThisPackage()
+
+type Manager struct {
+	cfg *config
+	// eventStore is the event store
+	eventStore Store
+}
+
+// NewManager creates a new activity manager
+func NewManager(eventStore Store) *Manager {
+	cfg, err := configuration.Parse[config]()
+	if err != nil {
+		log.Fatalf("failed to parse activity config: %v", err)
+	}
+	return &Manager{
+		cfg:        cfg,
+		eventStore: eventStore,
+	}
+}
+
+func (m *Manager) StoreEvent(ctx context.Context, initiatorID, targetID, accountID string, activityID ActivityDescriber, meta map[string]any) {
+	if m.cfg.Enabled {
+		go func() {
+			_, err := m.eventStore.Save(ctx, &Event{
+				Timestamp:   time.Now().UTC(),
+				Activity:    activityID,
+				InitiatorID: initiatorID,
+				TargetID:    targetID,
+				AccountID:   accountID,
+				Meta:        meta,
+			})
+			if err != nil {
+				// todo add metric
+				log.WithContext(ctx).Errorf("received an error while storing an activity event, error: %s", err)
+			}
+		}()
+	}
+}

internal/shared/activity/sqlite/crypt.go

@@ -0,0 +1,136 @@
+package sqlite
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+)
+
+var iv = []byte{10, 22, 13, 79, 05, 8, 52, 91, 87, 98, 88, 98, 35, 25, 13, 05}
+
+type FieldEncrypt struct {
+	block cipher.Block
+	gcm   cipher.AEAD
+}
+
+func GenerateKey() (string, error) {
+	key := make([]byte, 32)
+	_, err := rand.Read(key)
+	if err != nil {
+		return "", err
+	}
+	readableKey := base64.StdEncoding.EncodeToString(key)
+	return readableKey, nil
+}
+
+func NewFieldEncrypt(key string) (*FieldEncrypt, error) {
+	binKey, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		return nil, err
+	}
+
+	block, err := aes.NewCipher(binKey)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	ec := &FieldEncrypt{
+		block: block,
+		gcm:   gcm,
+	}
+
+	return ec, nil
+}
+
+func (ec *FieldEncrypt) LegacyEncrypt(payload string) string {
+	plainText := pkcs5Padding([]byte(payload))
+	cipherText := make([]byte, len(plainText))
+	cbc := cipher.NewCBCEncrypter(ec.block, iv)
+	cbc.CryptBlocks(cipherText, plainText)
+	return base64.StdEncoding.EncodeToString(cipherText)
+}
+
+// Encrypt encrypts plaintext using AES-GCM
+func (ec *FieldEncrypt) Encrypt(payload string) (string, error) {
+	plaintext := []byte(payload)
+	nonceSize := ec.gcm.NonceSize()
+
+	nonce := make([]byte, nonceSize, len(plaintext)+nonceSize+ec.gcm.Overhead())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", err
+	}
+
+	ciphertext := ec.gcm.Seal(nonce, nonce, plaintext, nil)
+
+	return base64.StdEncoding.EncodeToString(ciphertext), nil
+}
+
+func (ec *FieldEncrypt) LegacyDecrypt(data string) (string, error) {
+	cipherText, err := base64.StdEncoding.DecodeString(data)
+	if err != nil {
+		return "", err
+	}
+	cbc := cipher.NewCBCDecrypter(ec.block, iv)
+	cbc.CryptBlocks(cipherText, cipherText)
+	payload, err := pkcs5UnPadding(cipherText)
+	if err != nil {
+		return "", err
+	}
+
+	return string(payload), nil
+}
+
+// Decrypt decrypts ciphertext using AES-GCM
+func (ec *FieldEncrypt) Decrypt(data string) (string, error) {
+	cipherText, err := base64.StdEncoding.DecodeString(data)
+	if err != nil {
+		return "", err
+	}
+
+	nonceSize := ec.gcm.NonceSize()
+	if len(cipherText) < nonceSize {
+		return "", errors.New("cipher text too short")
+	}
+
+	nonce, cipherText := cipherText[:nonceSize], cipherText[nonceSize:]
+	plainText, err := ec.gcm.Open(nil, nonce, cipherText, nil)
+	if err != nil {
+		return "", err
+	}
+
+	return string(plainText), nil
+}
+
+func pkcs5Padding(ciphertext []byte) []byte {
+	padding := aes.BlockSize - len(ciphertext)%aes.BlockSize
+	padText := bytes.Repeat([]byte{byte(padding)}, padding)
+	return append(ciphertext, padText...)
+}
+func pkcs5UnPadding(src []byte) ([]byte, error) {
+	srcLen := len(src)
+	if srcLen == 0 {
+		return nil, errors.New("input data is empty")
+	}
+
+	paddingLen := int(src[srcLen-1])
+	if paddingLen == 0 || paddingLen > aes.BlockSize || paddingLen > srcLen {
+		return nil, errors.New("invalid padding size")
+	}
+
+	// Verify that all padding bytes are the same
+	for i := 0; i < paddingLen; i++ {
+		if src[srcLen-1-i] != byte(paddingLen) {
+			return nil, errors.New("invalid padding")
+		}
+	}
+
+	return src[:srcLen-paddingLen], nil
+}

internal/shared/activity/sqlite/crypt_test.go

@@ -0,0 +1,310 @@
+package sqlite
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestGenerateKey(t *testing.T) {
+	testData := "exampl@netbird.io"
+	key, err := GenerateKey()
+	if err != nil {
+		t.Fatalf("failed to generate key: %s", err)
+	}
+	ee, err := NewFieldEncrypt(key)
+	if err != nil {
+		t.Fatalf("failed to init email encryption: %s", err)
+	}
+
+	encrypted, err := ee.Encrypt(testData)
+	if err != nil {
+		t.Fatalf("failed to encrypt data: %s", err)
+	}
+
+	if encrypted == "" {
+		t.Fatalf("invalid encrypted text")
+	}
+
+	decrypted, err := ee.Decrypt(encrypted)
+	if err != nil {
+		t.Fatalf("failed to decrypt data: %s", err)
+	}
+
+	if decrypted != testData {
+		t.Fatalf("decrypted data is not match with test data: %s, %s", testData, decrypted)
+	}
+}
+
+func TestGenerateKeyLegacy(t *testing.T) {
+	testData := "exampl@netbird.io"
+	key, err := GenerateKey()
+	if err != nil {
+		t.Fatalf("failed to generate key: %s", err)
+	}
+	ee, err := NewFieldEncrypt(key)
+	if err != nil {
+		t.Fatalf("failed to init email encryption: %s", err)
+	}
+
+	encrypted := ee.LegacyEncrypt(testData)
+	if encrypted == "" {
+		t.Fatalf("invalid encrypted text")
+	}
+
+	decrypted, err := ee.LegacyDecrypt(encrypted)
+	if err != nil {
+		t.Fatalf("failed to decrypt data: %s", err)
+	}
+
+	if decrypted != testData {
+		t.Fatalf("decrypted data is not match with test data: %s, %s", testData, decrypted)
+	}
+}
+
+func TestCorruptKey(t *testing.T) {
+	testData := "exampl@netbird.io"
+	key, err := GenerateKey()
+	if err != nil {
+		t.Fatalf("failed to generate key: %s", err)
+	}
+	ee, err := NewFieldEncrypt(key)
+	if err != nil {
+		t.Fatalf("failed to init email encryption: %s", err)
+	}
+
+	encrypted, err := ee.Encrypt(testData)
+	if err != nil {
+		t.Fatalf("failed to encrypt data: %s", err)
+	}
+
+	if encrypted == "" {
+		t.Fatalf("invalid encrypted text")
+	}
+
+	newKey, err := GenerateKey()
+	if err != nil {
+		t.Fatalf("failed to generate key: %s", err)
+	}
+
+	ee, err = NewFieldEncrypt(newKey)
+	if err != nil {
+		t.Fatalf("failed to init email encryption: %s", err)
+	}
+
+	res, _ := ee.Decrypt(encrypted)
+	if res == testData {
+		t.Fatalf("incorrect decryption, the result is: %s", res)
+	}
+}
+
+func TestEncryptDecrypt(t *testing.T) {
+	// Generate a key for encryption/decryption
+	key, err := GenerateKey()
+	if err != nil {
+		t.Fatalf("Failed to generate key: %v", err)
+	}
+
+	// Initialize the FieldEncrypt with the generated key
+	ec, err := NewFieldEncrypt(key)
+	if err != nil {
+		t.Fatalf("Failed to create FieldEncrypt: %v", err)
+	}
+
+	// Test cases
+	testCases := []struct {
+		name  string
+		input string
+	}{
+		{
+			name:  "Empty String",
+			input: "",
+		},
+		{
+			name:  "Short String",
+			input: "Hello",
+		},
+		{
+			name:  "String with Spaces",
+			input: "Hello, World!",
+		},
+		{
+			name:  "Long String",
+			input: "The quick brown fox jumps over the lazy dog.",
+		},
+		{
+			name:  "Unicode Characters",
+			input: "こんにちは世界",
+		},
+		{
+			name:  "Special Characters",
+			input: "!@#$%^&*()_+-=[]{}|;':\",./<>?",
+		},
+		{
+			name:  "Numeric String",
+			input: "1234567890",
+		},
+		{
+			name:  "Repeated Characters",
+			input: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		},
+		{
+			name:  "Multi-block String",
+			input: "This is a longer string that will span multiple blocks in the encryption algorithm.",
+		},
+		{
+			name:  "Non-ASCII and ASCII Mix",
+			input: "Hello 世界 123",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name+" - Legacy", func(t *testing.T) {
+			// Legacy Encryption
+			encryptedLegacy := ec.LegacyEncrypt(tc.input)
+			if encryptedLegacy == "" {
+				t.Errorf("LegacyEncrypt returned empty string for input '%s'", tc.input)
+			}
+
+			// Legacy Decryption
+			decryptedLegacy, err := ec.LegacyDecrypt(encryptedLegacy)
+			if err != nil {
+				t.Errorf("LegacyDecrypt failed for input '%s': %v", tc.input, err)
+			}
+
+			// Verify that the decrypted value matches the original input
+			if decryptedLegacy != tc.input {
+				t.Errorf("LegacyDecrypt output '%s' does not match original input '%s'", decryptedLegacy, tc.input)
+			}
+		})
+
+		t.Run(tc.name+" - New", func(t *testing.T) {
+			// New Encryption
+			encryptedNew, err := ec.Encrypt(tc.input)
+			if err != nil {
+				t.Errorf("Encrypt failed for input '%s': %v", tc.input, err)
+			}
+			if encryptedNew == "" {
+				t.Errorf("Encrypt returned empty string for input '%s'", tc.input)
+			}
+
+			// New Decryption
+			decryptedNew, err := ec.Decrypt(encryptedNew)
+			if err != nil {
+				t.Errorf("Decrypt failed for input '%s': %v", tc.input, err)
+			}
+
+			// Verify that the decrypted value matches the original input
+			if decryptedNew != tc.input {
+				t.Errorf("Decrypt output '%s' does not match original input '%s'", decryptedNew, tc.input)
+			}
+		})
+	}
+}
+
+func TestPKCS5UnPadding(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       []byte
+		expected    []byte
+		expectError bool
+	}{
+		{
+			name:     "Valid Padding",
+			input:    append([]byte("Hello, World!"), bytes.Repeat([]byte{4}, 4)...),
+			expected: []byte("Hello, World!"),
+		},
+		{
+			name:        "Empty Input",
+			input:       []byte{},
+			expectError: true,
+		},
+		{
+			name:        "Padding Length Zero",
+			input:       append([]byte("Hello, World!"), bytes.Repeat([]byte{0}, 4)...),
+			expectError: true,
+		},
+		{
+			name:        "Padding Length Exceeds Block Size",
+			input:       append([]byte("Hello, World!"), bytes.Repeat([]byte{17}, 17)...),
+			expectError: true,
+		},
+		{
+			name:        "Padding Length Exceeds Input Length",
+			input:       []byte{5, 5, 5},
+			expectError: true,
+		},
+		{
+			name:        "Invalid Padding Bytes",
+			input:       append([]byte("Hello, World!"), []byte{2, 3, 4, 5}...),
+			expectError: true,
+		},
+		{
+			name:     "Valid Single Byte Padding",
+			input:    append([]byte("Hello, World!"), byte(1)),
+			expected: []byte("Hello, World!"),
+		},
+		{
+			name:        "Invalid Mixed Padding Bytes",
+			input:       append([]byte("Hello, World!"), []byte{3, 3, 2}...),
+			expectError: true,
+		},
+		{
+			name:     "Valid Full Block Padding",
+			input:    append([]byte("Hello, World!"), bytes.Repeat([]byte{16}, 16)...),
+			expected: []byte("Hello, World!"),
+		},
+		{
+			name:        "Non-Padding Byte at End",
+			input:       append([]byte("Hello, World!"), []byte{4, 4, 4, 5}...),
+			expectError: true,
+		},
+		{
+			name:     "Valid Padding with Different Text Length",
+			input:    append([]byte("Test"), bytes.Repeat([]byte{12}, 12)...),
+			expected: []byte("Test"),
+		},
+		{
+			name:     "Padding Length Equal to Input Length",
+			input:    bytes.Repeat([]byte{8}, 8),
+			expected: []byte{},
+		},
+		{
+			name:        "Invalid Padding Length Zero (Again)",
+			input:       append([]byte("Test"), byte(0)),
+			expectError: true,
+		},
+		{
+			name:        "Padding Length Greater Than Input",
+			input:       []byte{10},
+			expectError: true,
+		},
+		{
+			name:     "Input Length Not Multiple of Block Size",
+			input:    append([]byte("Invalid Length"), byte(1)),
+			expected: []byte("Invalid Length"),
+		},
+		{
+			name:     "Valid Padding with Non-ASCII Characters",
+			input:    append([]byte("こんにちは"), bytes.Repeat([]byte{2}, 2)...),
+			expected: []byte("こんにちは"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := pkcs5UnPadding(tt.input)
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("Expected error but got nil")
+				}
+			} else {
+				if err != nil {
+					t.Errorf("Did not expect error but got: %v", err)
+				}
+				if !bytes.Equal(result, tt.expected) {
+					t.Errorf("Expected output %v, got %v", tt.expected, result)
+				}
+			}
+		})
+	}
+}

internal/shared/activity/sqlite/migration.go

@@ -0,0 +1,157 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+)
+
+func migrate(ctx context.Context, crypt *FieldEncrypt, db *sql.DB) error {
+	if _, err := db.Exec(createTableQuery); err != nil {
+		return err
+	}
+
+	if _, err := db.Exec(creatTableDeletedUsersQuery); err != nil {
+		return err
+	}
+
+	if err := updateDeletedUsersTable(ctx, db); err != nil {
+		return fmt.Errorf("failed to update deleted_users table: %v", err)
+	}
+
+	return migrateLegacyEncryptedUsersToGCM(ctx, crypt, db)
+}
+
+// updateDeletedUsersTable checks and updates the deleted_users table schema to ensure required columns exist.
+func updateDeletedUsersTable(ctx context.Context, db *sql.DB) error {
+	exists, err := checkColumnExists(db, "deleted_users", "name")
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		log.WithContext(ctx).Debug("Adding name column to the deleted_users table")
+
+		_, err = db.Exec(`ALTER TABLE deleted_users ADD COLUMN name TEXT;`)
+		if err != nil {
+			return err
+		}
+
+		log.WithContext(ctx).Debug("Successfully added name column to the deleted_users table")
+	}
+
+	exists, err = checkColumnExists(db, "deleted_users", "enc_algo")
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		log.WithContext(ctx).Debug("Adding enc_algo column to the deleted_users table")
+
+		_, err = db.Exec(`ALTER TABLE deleted_users ADD COLUMN enc_algo TEXT;`)
+		if err != nil {
+			return err
+		}
+
+		log.WithContext(ctx).Debug("Successfully added enc_algo column to the deleted_users table")
+	}
+
+	return nil
+}
+
+// migrateLegacyEncryptedUsersToGCM migrates previously encrypted data using,
+// legacy CBC encryption with a static IV to the new GCM encryption method.
+func migrateLegacyEncryptedUsersToGCM(ctx context.Context, crypt *FieldEncrypt, db *sql.DB) error {
+	log.WithContext(ctx).Debug("Migrating CBC encrypted deleted users to GCM")
+
+	tx, err := db.Begin()
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %v", err)
+	}
+	defer func() {
+		_ = tx.Rollback()
+	}()
+
+	rows, err := tx.Query(fmt.Sprintf(`SELECT id, email, name FROM deleted_users where enc_algo IS NULL OR enc_algo != '%s'`, gcmEncAlgo))
+	if err != nil {
+		return fmt.Errorf("failed to execute select query: %v", err)
+	}
+	defer rows.Close()
+
+	updateStmt, err := tx.Prepare(`UPDATE deleted_users SET email = ?, name = ?, enc_algo = ? WHERE id = ?`)
+	if err != nil {
+		return fmt.Errorf("failed to prepare update statement: %v", err)
+	}
+	defer updateStmt.Close()
+
+	if err = processUserRows(ctx, crypt, rows, updateStmt); err != nil {
+		return err
+	}
+
+	if err = tx.Commit(); err != nil {
+		return fmt.Errorf("failed to commit transaction: %v", err)
+	}
+
+	log.WithContext(ctx).Debug("Successfully migrated CBC encrypted deleted users to GCM")
+	return nil
+}
+
+// processUserRows processes database rows of user data, decrypts legacy encryption fields, and re-encrypts them using GCM.
+func processUserRows(ctx context.Context, crypt *FieldEncrypt, rows *sql.Rows, updateStmt *sql.Stmt) error {
+	for rows.Next() {
+		var (
+			id, decryptedEmail, decryptedName string
+			email, name                       *string
+		)
+
+		err := rows.Scan(&id, &email, &name)
+		if err != nil {
+			return err
+		}
+
+		if email != nil {
+			decryptedEmail, err = crypt.LegacyDecrypt(*email)
+			if err != nil {
+				log.WithContext(ctx).Warnf("skipping migrating deleted user %s: %v",
+					id,
+					fmt.Errorf("failed to decrypt email: %w", err),
+				)
+				continue
+			}
+		}
+
+		if name != nil {
+			decryptedName, err = crypt.LegacyDecrypt(*name)
+			if err != nil {
+				log.WithContext(ctx).Warnf("skipping migrating deleted user %s: %v",
+					id,
+					fmt.Errorf("failed to decrypt name: %w", err),
+				)
+				continue
+			}
+		}
+
+		encryptedEmail, err := crypt.Encrypt(decryptedEmail)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt email: %w", err)
+		}
+
+		encryptedName, err := crypt.Encrypt(decryptedName)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt name: %w", err)
+		}
+
+		_, err = updateStmt.Exec(encryptedEmail, encryptedName, gcmEncAlgo, id)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err := rows.Err(); err != nil {
+		return err
+	}
+
+	return nil
+}

internal/shared/activity/sqlite/migration_test.go

@@ -0,0 +1,84 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"path/filepath"
+	"testing"
+	"time"
+
+	_ "github.com/mattn/go-sqlite3"
+	"github.com/netbirdio/netbird/management/server/activity"
+
+	"github.com/stretchr/testify/require"
+)
+
+func setupDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+
+	dbFile := filepath.Join(t.TempDir(), eventSinkDB)
+	db, err := sql.Open("sqlite3", dbFile)
+	require.NoError(t, err, "Failed to open database")
+
+	t.Cleanup(func() {
+		_ = db.Close()
+	})
+
+	_, err = db.Exec(createTableQuery)
+	require.NoError(t, err, "Failed to create events table")
+
+	_, err = db.Exec(`CREATE TABLE deleted_users (id TEXT NOT NULL, email TEXT NOT NULL, name TEXT);`)
+	require.NoError(t, err, "Failed to create deleted_users table")
+
+	return db
+}
+
+func TestMigrate(t *testing.T) {
+	db := setupDatabase(t)
+
+	key, err := GenerateKey()
+	require.NoError(t, err, "Failed to generate key")
+
+	crypt, err := NewFieldEncrypt(key)
+	require.NoError(t, err, "Failed to initialize FieldEncrypt")
+
+	legacyEmail := crypt.LegacyEncrypt("testaccount@test.com")
+	legacyName := crypt.LegacyEncrypt("Test Account")
+
+	_, err = db.Exec(`INSERT INTO events(activity, timestamp, initiator_id, target_id, account_id, meta) VALUES(?, ?, ?, ?, ?, ?)`,
+		activity.UserDeleted, time.Now(), "initiatorID", "targetID", "accountID", "")
+	require.NoError(t, err, "Failed to insert event")
+
+	_, err = db.Exec(`INSERT INTO deleted_users(id, email, name) VALUES(?, ?, ?)`, "targetID", legacyEmail, legacyName)
+	require.NoError(t, err, "Failed to insert legacy encrypted data")
+
+	colExists, err := checkColumnExists(db, "deleted_users", "enc_algo")
+	require.NoError(t, err, "Failed to check if enc_algo column exists")
+	require.False(t, colExists, "enc_algo column should not exist before migration")
+
+	err = migrate(context.Background(), crypt, db)
+	require.NoError(t, err, "Migration failed")
+
+	colExists, err = checkColumnExists(db, "deleted_users", "enc_algo")
+	require.NoError(t, err, "Failed to check if enc_algo column exists after migration")
+	require.True(t, colExists, "enc_algo column should exist after migration")
+
+	var encAlgo string
+	err = db.QueryRow(`SELECT enc_algo FROM deleted_users LIMIT 1`, "").Scan(&encAlgo)
+	require.NoError(t, err, "Failed to select updated data")
+	require.Equal(t, gcmEncAlgo, encAlgo, "enc_algo should be set to 'GCM' after migration")
+
+	store, err := createStore(crypt, db)
+	require.NoError(t, err, "Failed to create store")
+
+	events, err := store.Get(context.Background(), "accountID", 0, 1, false)
+	require.NoError(t, err, "Failed to get events")
+
+	require.Len(t, events, 1, "Should have one event")
+	require.Equal(t, activity.UserDeleted, events[0].Activity, "activity should match")
+	require.Equal(t, "initiatorID", events[0].InitiatorID, "initiator id should match")
+	require.Equal(t, "targetID", events[0].TargetID, "target id should match")
+	require.Equal(t, "accountID", events[0].AccountID, "account id should match")
+	require.Equal(t, "testaccount@test.com", events[0].Meta["email"], "email should match")
+	require.Equal(t, "Test Account", events[0].Meta["username"], "username should match")
+}