diff --git a/templates/default/pages/peers.njk b/templates/default/pages/peers.njk
index 21889299..2b457ad2 100644
--- a/templates/default/pages/peers.njk
+++ b/templates/default/pages/peers.njk
@@ -108,10 +108,12 @@
diff --git a/templates/pro/pages/peers.njk b/templates/pro/pages/peers.njk
index 781382d8..491bf0f6 100644
--- a/templates/pro/pages/peers.njk
+++ b/templates/pro/pages/peers.njk
@@ -108,10 +108,12 @@
-
+
+
+
diff --git a/templates/pro/partials/modals/peer-add.njk b/templates/pro/partials/modals/peer-add.njk
index 418a1e7b..d3710228 100644
--- a/templates/pro/partials/modals/peer-add.njk
+++ b/templates/pro/partials/modals/peer-add.njk
@@ -19,6 +19,10 @@
+
+
+
+
diff --git a/templates/pro/partials/modals/peer-edit.njk b/templates/pro/partials/modals/peer-edit.njk
index 16d3e85f..80935297 100644
--- a/templates/pro/partials/modals/peer-edit.njk
+++ b/templates/pro/partials/modals/peer-edit.njk
@@ -20,6 +20,10 @@
+
+
+
+
diff --git a/tests/peer_owner_api.test.js b/tests/peer_owner_api.test.js
new file mode 100644
index 00000000..28497115
--- /dev/null
+++ b/tests/peer_owner_api.test.js
@@ -0,0 +1,30 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+let getDb;
+beforeEach(async () => { await setup(); getDb = require('../src/db/connection').getDb; });
+afterEach(teardown);
+function seedUser(n){ return getDb().prepare("INSERT INTO users (username,password_hash,role) VALUES (?,?,'admin')").run(n,'x').lastInsertRowid; }
+
+test('POST with user_id persists owner (201, body.peer.user_id)', async () => {
+ const uid = seedUser('alice'); const agent = getAgent(); const csrf = getCsrf();
+ const r = await agent.post('/api/v1/peers').set('X-CSRF-Token', csrf).send({ name: 'devD', user_id: uid }).expect(201);
+ assert.equal(r.body.peer.user_id, uid);
+});
+test('PUT sets user_id and GET reflects owner_name', async () => {
+ const uid = seedUser('bob'); const agent = getAgent(); const csrf = getCsrf();
+ const c = await agent.post('/api/v1/peers').set('X-CSRF-Token', csrf).send({ name: 'devE' }).expect(201);
+ const pid = c.body.peer.id;
+ await agent.put('/api/v1/peers/' + pid).set('X-CSRF-Token', csrf).send({ user_id: uid }).expect(200);
+ const list = await agent.get('/api/v1/peers').expect(200);
+ const row = list.body.peers.find(p => p.id === pid);
+ assert.equal(row.user_id, uid); assert.equal(row.owner_name, 'bob');
+});
+test('PUT rejects a non-existent user_id (400)', async () => {
+ const agent = getAgent(); const csrf = getCsrf();
+ const c = await agent.post('/api/v1/peers').set('X-CSRF-Token', csrf).send({ name: 'devF' }).expect(201);
+ await agent.put('/api/v1/peers/' + c.body.peer.id).set('X-CSRF-Token', csrf).send({ user_id: 999999 }).expect(400);
+});
diff --git a/tests/peer_owner_bulk.test.js b/tests/peer_owner_bulk.test.js
new file mode 100644
index 00000000..9a85e0a8
--- /dev/null
+++ b/tests/peer_owner_bulk.test.js
@@ -0,0 +1,36 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const supertest = require('supertest');
+const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+let peers, getDb, app;
+beforeEach(async () => { await setup(); peers = require('../src/services/peers'); getDb = require('../src/db/connection').getDb; app = require('../src/app').createApp(); });
+afterEach(teardown);
+async function mk(n){ return (await peers.create({ name: n })).id; }
+function seedUser(n){ return getDb().prepare("INSERT INTO users (username,password_hash,role) VALUES (?,?,'admin')").run(n,'x').lastInsertRowid; }
+
+test('batch-owner sets owner for many (hits bulk handler: body.affected)', async () => {
+ const uid = seedUser('bob'); const a = await mk('p1'); const b = await mk('p2');
+ const agent = getAgent(); const csrf = getCsrf();
+ const r = await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: [a, b], user_id: uid }).expect(200);
+ assert.equal(r.body.ok, true); assert.equal(r.body.affected, 2);
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(a).user_id, uid);
+});
+test('batch-owner user_id null clears ownership', async () => {
+ const uid = seedUser('carol'); const a = await mk('p3'); const agent = getAgent(); const csrf = getCsrf();
+ await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: [a], user_id: uid }).expect(200);
+ await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: [a], user_id: null }).expect(200);
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(a).user_id, null);
+});
+test('batch-owner rejects empty/too-large peer_ids and bad user_id (400)', async () => {
+ const agent = getAgent(); const csrf = getCsrf();
+ await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: [], user_id: null }).expect(400);
+ await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: Array.from({length:501},(_,i)=>i+1), user_id: null }).expect(400);
+ await agent.post('/api/v1/peers/batch-owner').set('X-CSRF-Token', csrf).send({ peer_ids: [1], user_id: 999999 }).expect(400);
+});
+test('batch-owner without auth/CSRF is rejected (401/403)', async () => {
+ const res = await supertest(app).post('/api/v1/peers/batch-owner').send({ peer_ids: [1], user_id: null });
+ assert.ok([401, 403].includes(res.status), `expected 401/403, got ${res.status}`);
+});
diff --git a/tests/peer_owner_bulk_ui.test.js b/tests/peer_owner_bulk_ui.test.js
new file mode 100644
index 00000000..d24d1d28
--- /dev/null
+++ b/tests/peer_owner_bulk_ui.test.js
@@ -0,0 +1,18 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs'); const path = require('node:path');
+test('bulk owner control in batch bar (3 themes)', () => {
+ for (const theme of ['aurora', 'default', 'pro']) {
+ const html = fs.readFileSync(path.join(__dirname, '..', 'templates', theme, 'pages', 'peers.njk'), 'utf8');
+ ['peer-bulk-owner', 'peer-bulk-owner-apply'].forEach(id => assert.ok(html.includes(id), `${theme}: ${id}`));
+ }
+});
+test('peers.js wires bulk owner to batch-owner using batchSelected', () => {
+ const js = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'peers.js'), 'utf8');
+ assert.ok(/peer-bulk-owner/.test(js));
+ assert.ok(/batch-owner/.test(js));
+ assert.ok(/batchSelected/.test(js));
+});
diff --git a/tests/peer_owner_migration.test.js b/tests/peer_owner_migration.test.js
new file mode 100644
index 00000000..2af99ccb
--- /dev/null
+++ b/tests/peer_owner_migration.test.js
@@ -0,0 +1,16 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown } = require('./helpers/setup');
+let getDb;
+beforeEach(async () => { await setup(); getDb = require('../src/db/connection').getDb; });
+afterEach(teardown);
+test('peers has a nullable user_id column', () => {
+ const col = getDb().prepare("PRAGMA table_info(peers)").all().find(c => c.name === 'user_id');
+ assert.ok(col, 'user_id column missing'); assert.equal(col.notnull, 0);
+});
+test('idx_peers_user_id exists', () => {
+ assert.ok(getDb().prepare("SELECT 1 FROM sqlite_master WHERE type='index' AND name='idx_peers_user_id'").get());
+});
diff --git a/tests/peer_owner_no_leak.test.js b/tests/peer_owner_no_leak.test.js
new file mode 100644
index 00000000..ab2061f4
--- /dev/null
+++ b/tests/peer_owner_no_leak.test.js
@@ -0,0 +1,80 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const supertest = require('supertest');
+const { setup, teardown } = require('./helpers/setup');
+
+// Home-vhost Host header (matches default GC_DNS_DOMAIN = 'gc.internal').
+// portalIdentity only establishes identity when Host === effectivePortalHost().host.
+const HOME_HOST = 'home.gc.internal';
+
+let app, getDb;
+beforeEach(async () => {
+ await setup();
+ getDb = require('../src/db/connection').getDb;
+ app = require('../src/app').createApp();
+});
+afterEach(teardown);
+
+test('portal /device whitelists fields and never emits user_id/owner_name (behavioral)', async () => {
+ // Insert a peer so the handler returns data rather than the `unidentified` envelope.
+ // Identity is established via loopback (supertest behavior, like Caddy), the
+ // X-GC-Portal-Peer-IP header (reserved; read by portalIdentity to set req.portalPeerId),
+ // and the home Host vhost (matches effectivePortalHost().host for mgmt-vhost anti-forgery).
+ // This test FAILS if the peer is not identified (data would be null).
+ getDb().prepare(
+ `INSERT INTO peers (name, public_key, allowed_ips, enabled, peer_type)
+ VALUES ('devP','pk-no-leak-test','10.8.0.99/32',1,'regular')`
+ ).run();
+
+ const res = await supertest(app)
+ .get('/api/v1/portal/device')
+ .set('X-GC-Portal-Peer-IP', '10.8.0.99')
+ .set('Host', HOME_HOST)
+ .expect(200);
+
+ assert.equal(res.body.ok, true);
+ assert.ok(res.body.data !== null, 'peer should be identified and data must be returned (not unidentified)');
+ assert.ok(!('user_id' in res.body.data), 'portal /device must not expose user_id');
+ assert.ok(!('owner_name' in res.body.data), 'portal /device must not expose owner_name');
+});
+
+test('client-facing + portal route sources never reference user_id/owner_name', () => {
+ const clientDir = path.join(__dirname, '..', 'src/routes/api/client');
+ const clientFiles = fs.existsSync(clientDir)
+ ? fs.readdirSync(clientDir)
+ .filter(f => f.endsWith('.js'))
+ .map(f => path.join(clientDir, f))
+ : [];
+ const portalFile = path.join(__dirname, '..', 'src/routes/api/portal.js');
+ const candidates = [
+ ...clientFiles,
+ ...(fs.existsSync(portalFile) ? [portalFile] : []),
+ ];
+
+ // Guard: a scan matching zero files is silent-green and worthless.
+ // At minimum portal.js + at least one client/*.js file must be present.
+ assert.ok(
+ candidates.length >= 2,
+ `source scan matched only ${candidates.length} file(s) — expected at least 2 (portal.js + ≥1 client route)`
+ );
+
+ for (const f of candidates) {
+ const src = fs.readFileSync(f, 'utf8');
+ // Must not contain any reference to the owner-mapping columns.
+ assert.ok(
+ !/\buser_id\b|\bowner_name\b/.test(src),
+ `${path.basename(f)} must not reference owner mapping (user_id / owner_name)`
+ );
+ // Must not return a raw peer object: res.json(peer) or res.json({ ...peer ... }).
+ assert.ok(
+ !/res\.json\(\s*peer\s*\)/.test(src) && !/res\.json\(\s*\{[^}]*\.\.\.\s*\w*peer\w*/.test(src),
+ `${path.basename(f)} must not return a raw peer object`
+ );
+ }
+});
diff --git a/tests/peer_owner_service.test.js b/tests/peer_owner_service.test.js
new file mode 100644
index 00000000..f25d1f3d
--- /dev/null
+++ b/tests/peer_owner_service.test.js
@@ -0,0 +1,29 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown } = require('./helpers/setup');
+let peers, getDb;
+beforeEach(async () => { await setup(); peers = require('../src/services/peers'); getDb = require('../src/db/connection').getDb; });
+afterEach(teardown);
+function seedUser(n){ return getDb().prepare("INSERT INTO users (username,password_hash,role) VALUES (?,?,'admin')").run(n,'x').lastInsertRowid; }
+
+test('create persists userId, returns it, and getById reflects it', async () => {
+ const uid = seedUser('o1');
+ const p = await peers.create({ name: 'devA', userId: uid });
+ assert.equal(p.user_id, uid, 'create() return must include user_id');
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(p.id).user_id, uid);
+});
+test('create without userId stores null (backward compatible)', async () => {
+ const p = await peers.create({ name: 'legacy' });
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(p.id).user_id, null);
+});
+test('update sets/clears userId; undefined leaves unchanged', async () => {
+ const uid = seedUser('o2');
+ const p = await peers.create({ name: 'devB', userId: uid });
+ await peers.update(p.id, { name: 'devB' });
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(p.id).user_id, uid);
+ await peers.update(p.id, { userId: null });
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(p.id).user_id, null);
+});
diff --git a/tests/peer_owner_ui.test.js b/tests/peer_owner_ui.test.js
new file mode 100644
index 00000000..41d61f3d
--- /dev/null
+++ b/tests/peer_owner_ui.test.js
@@ -0,0 +1,18 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs'); const path = require('node:path');
+test('owner selects exist in add+edit peer partials (3 themes)', () => {
+ for (const theme of ['aurora', 'default', 'pro']) {
+ const add = fs.readFileSync(path.join(__dirname, '..', 'templates', theme, 'partials', 'modals', 'peer-add.njk'), 'utf8');
+ const edit = fs.readFileSync(path.join(__dirname, '..', 'templates', theme, 'partials', 'modals', 'peer-edit.njk'), 'utf8');
+ assert.ok(add.includes('add-peer-owner'), `${theme} add`);
+ assert.ok(edit.includes('edit-peer-owner'), `${theme} edit`);
+ }
+});
+test('peers.js loads users and sends user_id', () => {
+ const js = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'peers.js'), 'utf8');
+ assert.ok(/add-peer-owner|edit-peer-owner/.test(js));
+ assert.ok(/\/api\/v1\/users/.test(js));
+ assert.ok(/user_id/.test(js));
+});
diff --git a/tests/peer_owner_user_delete.test.js b/tests/peer_owner_user_delete.test.js
new file mode 100644
index 00000000..5f719219
--- /dev/null
+++ b/tests/peer_owner_user_delete.test.js
@@ -0,0 +1,17 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown } = require('./helpers/setup');
+let peers, users, getDb;
+beforeEach(async () => { await setup(); peers = require('../src/services/peers'); users = require('../src/services/users'); getDb = require('../src/db/connection').getDb; });
+afterEach(teardown);
+// safe: setup() already seeds 1 admin, so removing this 2nd admin passes the last-admin guard.
+test('removing a user clears user_id on their peers; peer survives', async () => {
+ const uid = getDb().prepare("INSERT INTO users (username,password_hash,role) VALUES ('owner','x','admin')").run().lastInsertRowid;
+ const p = await peers.create({ name: 'devC', userId: uid });
+ users.remove(uid);
+ assert.equal(getDb().prepare('SELECT user_id FROM peers WHERE id=?').get(p.id).user_id, null);
+ assert.ok(getDb().prepare('SELECT 1 FROM peers WHERE id=?').get(p.id));
+});