diff --git a/messages/en-US.json b/messages/en-US.json index b614bfd38..5dbbc09f7 100644 --- a/messages/en-US.json +++ b/messages/en-US.json @@ -1466,8 +1466,11 @@ "actionSetResourcePincode": "Set Resource Pincode", "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist", "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist", + "actionListResourcePolicies": "List Resource Policies", + "actionCreateResourcePolicy": "Create Resource Policy", "actionGetResourcePolicy": "Get Resource Policy", "actionUpdateResourcePolicy": "Update Resource Policy", + "actionDeleteResourcePolicy": "Delete Resource Policy", "actionSetResourcePolicyUsers": "Set Resource Policy Users", "actionSetResourcePolicyRoles": "Set Resource Policy Roles", "actionSetResourcePolicyPassword": "Set Resource Policy Password", diff --git a/server/db/pg/schema/privateSchema.ts b/server/db/pg/schema/privateSchema.ts index cbe8a4039..e41498264 100644 --- a/server/db/pg/schema/privateSchema.ts +++ b/server/db/pg/schema/privateSchema.ts @@ -95,7 +95,8 @@ export const subscriptions = pgTable("subscriptions", { billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }), expiresAt: bigint("expiresAt", { mode: "number" }), trial: boolean("trial").default(false), - type: varchar("type", { length: 50 }) // tier1, tier2, tier3, or license + type: varchar("type", { length: 50 }), // tier1, tier2, tier3, or license + override: boolean("override").default(false) }); export const subscriptionItems = pgTable("subscriptionItems", { diff --git a/server/db/sqlite/schema/privateSchema.ts b/server/db/sqlite/schema/privateSchema.ts index b75836e29..f8d2f5f09 100644 --- a/server/db/sqlite/schema/privateSchema.ts +++ b/server/db/sqlite/schema/privateSchema.ts @@ -89,7 +89,8 @@ export const subscriptions = sqliteTable("subscriptions", { expiresAt: integer("expiresAt"), trial: integer("trial", { mode: "boolean" }).default(false), billingCycleAnchor: integer("billingCycleAnchor"), - type: text("type") // tier1, tier2, tier3, or license + type: text("type"), // tier1, tier2, tier3, or license + override: integer("override", { mode: "boolean" }).default(false) }); export const subscriptionItems = sqliteTable("subscriptionItems", { diff --git a/server/private/routers/billing/hooks/handleSubscriptionDeleted.ts b/server/private/routers/billing/hooks/handleSubscriptionDeleted.ts index 962cdd424..dd44f4101 100644 --- a/server/private/routers/billing/hooks/handleSubscriptionDeleted.ts +++ b/server/private/routers/billing/hooks/handleSubscriptionDeleted.ts @@ -53,6 +53,15 @@ export async function handleSubscriptionDeleted( return; } + // If the subscription has been manually overridden, we lock it down + // so Stripe can no longer change (or delete) its status locally. + if (existingSubscription.override === true) { + logger.info( + `Subscription ${subscription.id} is locked (override=true). Ignoring deletion event from Stripe.` + ); + return; + } + await db .delete(subscriptions) .where(eq(subscriptions.subscriptionId, subscription.id)); diff --git a/server/private/routers/billing/hooks/handleSubscriptionUpdated.ts b/server/private/routers/billing/hooks/handleSubscriptionUpdated.ts index e1ec7a7b9..13df7910f 100644 --- a/server/private/routers/billing/hooks/handleSubscriptionUpdated.ts +++ b/server/private/routers/billing/hooks/handleSubscriptionUpdated.ts @@ -68,13 +68,27 @@ export async function handleSubscriptionUpdated( const type = getSubType(fullSubscription); const previousType = existingSubscription.type as SubscriptionType | null; + // If the subscription has been manually overridden, we lock the + // status down so Stripe webhooks can no longer change it. + const isLocked = existingSubscription.override === true; + if (isLocked) { + logger.info( + `Subscription ${subscription.id} is locked (override=true). Ignoring status change from Stripe (would have been ${subscription.status}).` + ); + } + const effectiveStatus = isLocked + ? existingSubscription.status + : subscription.status; + await db .update(subscriptions) .set({ - status: subscription.status, - canceledAt: subscription.canceled_at - ? subscription.canceled_at - : null, + status: effectiveStatus, + canceledAt: isLocked + ? existingSubscription.canceledAt + : subscription.canceled_at + ? subscription.canceled_at + : null, updatedAt: Math.floor(Date.now() / 1000), billingCycleAnchor: subscription.billing_cycle_anchor, type: type @@ -275,23 +289,23 @@ export async function handleSubscriptionUpdated( // we only need to handle the limit lifecycle for saas subscriptions not for the licenses await handleSubscriptionLifesycle( customer.orgId, - subscription.status, + effectiveStatus, type ); // Handle feature lifecycle when subscription is canceled or becomes unpaid if ( - subscription.status === "canceled" || - subscription.status === "unpaid" || - subscription.status === "incomplete_expired" + effectiveStatus === "canceled" || + effectiveStatus === "unpaid" || + effectiveStatus === "incomplete_expired" ) { logger.info( - `Subscription ${subscription.id} for org ${customer.orgId} is ${subscription.status}, disabling paid features` + `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features` ); await handleTierChange(customer.orgId, null, previousType ?? undefined); } } else if (type === "license") { - if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") { + if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") { try { // WARNING: // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId diff --git a/server/routers/integration.ts b/server/routers/integration.ts index 24c9955da..4489fa778 100644 --- a/server/routers/integration.ts +++ b/server/routers/integration.ts @@ -859,8 +859,8 @@ authenticated.post( verifyApiKeyResourcePolicyAccess, verifyApiKeyRoleAccess, verifyLimits, - verifyUserHasAction(ActionsEnum.setResourcePolicyUsers), - verifyUserHasAction(ActionsEnum.setResourcePolicyRoles), + verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers), + verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles), logActionAudit(ActionsEnum.setResourcePolicyUsers), logActionAudit(ActionsEnum.setResourcePolicyRoles), policy.setResourcePolicyAccessControl @@ -875,8 +875,8 @@ authenticated.put( verifyApiKeyResourcePolicyAccess, verifyApiKeyRoleAccess, verifyLimits, - verifyUserHasAction(ActionsEnum.setResourcePolicyUsers), - verifyUserHasAction(ActionsEnum.setResourcePolicyRoles), + verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers), + verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles), logActionAudit(ActionsEnum.setResourcePolicyUsers), logActionAudit(ActionsEnum.setResourcePolicyRoles), policy.setResourcePolicyAccessControl diff --git a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx index e0d03f771..42ccc4242 100644 --- a/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx +++ b/src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx @@ -181,7 +181,7 @@ export default function NetworkingPage() { {t("remoteExitNodeNetworkingDescription")} parseInt(r.id, 10)); @@ -170,15 +163,6 @@ export default function AccessControlsPage() { const values = form.getValues(); - if (values.roles.length === 0) { - toast({ - variant: "destructive", - title: t("accessRoleRequired"), - description: t("accessRoleSelectPlease") - }); - return; - } - const willHaveAdminRole = values.roles.some((r) => r.isAdmin === true); const isRemovingOwnAdmin = diff --git a/src/components/DomainPicker.tsx b/src/components/DomainPicker.tsx index e06c3e57d..bf25fcfce 100644 --- a/src/components/DomainPicker.tsx +++ b/src/components/DomainPicker.tsx @@ -53,7 +53,7 @@ import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert"; import { usePaidStatus } from "@/hooks/usePaidStatus"; import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix"; import { toUnicode } from "punycode"; -import { useCallback, useEffect, useMemo, useState } from "react"; +import { useCallback, useEffect, useMemo, useRef, useState } from "react"; import { useUserContext } from "@app/hooks/useUserContext"; type AvailableOption = { @@ -166,8 +166,19 @@ export default function DomainPicker({ const [selectedProvidedDomain, setSelectedProvidedDomain] = useState(null); + // Only run the initial base-domain selection once the domains have + // loaded. This must not re-run on later `defaultDomainId`/`defaultSubdomain` + // changes, because selecting a provided (namespace) domain calls + // onDomainChange(null), which the parent form echoes back as + // defaultDomainId/defaultSubdomain becoming undefined — re-running this + // effect on that change would immediately snap the selector back to the + // organization domain, making provided domains unselectable whenever one + // was already set. + const didSelectInitialDomainRef = useRef(false); + useEffect(() => { - if (!loadingDomains) { + if (!loadingDomains && !didSelectInitialDomainRef.current) { + didSelectInitialDomainRef.current = true; let domainOptionToSelect: DomainOption | null = null; if (organizationDomains.length > 0) { // Select the first organization domain or the one provided from props diff --git a/src/components/OrgInfoCard.tsx b/src/components/OrgInfoCard.tsx index 796855609..392a5f17c 100644 --- a/src/components/OrgInfoCard.tsx +++ b/src/components/OrgInfoCard.tsx @@ -8,6 +8,7 @@ import { InfoSections, InfoSectionTitle } from "@app/components/InfoSection"; +import CopyToClipboard from "@app/components/CopyToClipboard"; import { useTranslations } from "next-intl"; type OrgInfoCardProps = {}; @@ -26,7 +27,9 @@ export default function OrgInfoCard({}: OrgInfoCardProps) { {t("orgId")} - {org.org.orgId} + + + {t("subnet")} diff --git a/src/components/OrgRolesTagField.tsx b/src/components/OrgRolesTagField.tsx index eef1e0570..32d96794a 100644 --- a/src/components/OrgRolesTagField.tsx +++ b/src/components/OrgRolesTagField.tsx @@ -9,17 +9,15 @@ import { FormMessage } from "@app/components/ui/form"; -import { toast } from "@app/hooks/useToast"; import { useTranslations } from "next-intl"; -import { useRef } from "react"; import type { FieldValues, Path, UseFormReturn } from "react-hook-form"; import { RolesSelector, type SelectedRole } from "./roles-selector"; type OrgRolesTagFieldProps = { form: Pick< UseFormReturn, - "control" | "getValues" | "setValue" + "control" | "getValues" | "setValue" | "clearErrors" >; orgId: string; /** Field in the form that holds Tag[] (role tags). Default: `"roles"`. */ @@ -42,46 +40,6 @@ export default function OrgRolesTagField({ disabled }: OrgRolesTagFieldProps) { const t = useTranslations(); - const isPopoverOpenRef = useRef(false); - const lastValidRolesRef = useRef( - (form.getValues(name) as SelectedRole[]) ?? [] - ); - - function validateRolesSelection() { - const current = form.getValues(name) as SelectedRole[]; - - if (current.length === 0 && lastValidRolesRef.current.length > 0) { - form.setValue(name, lastValidRolesRef.current as never, { - shouldDirty: true - }); - toast({ - variant: "destructive", - title: t("accessRoleRequired"), - description: t("accessRoleSelectPlease") - }); - return false; - } - - if (current.length > 0) { - lastValidRolesRef.current = current; - } - - return true; - } - - function handlePopoverOpenChange(open: boolean) { - isPopoverOpenRef.current = open; - - if (open) { - const current = form.getValues(name) as SelectedRole[]; - if (current.length > 0) { - lastValidRolesRef.current = current; - } - return; - } - - validateRolesSelection(); - } function setRoleTags(nextValue: SelectedRole[]) { const prev = form.getValues(name) as SelectedRole[]; @@ -99,15 +57,14 @@ export default function OrgRolesTagField({ form.setValue(name, [prev[prev.length - 1]] as never, { shouldDirty: true }); + form.clearErrors(name); return; } form.setValue(name, next as never, { shouldDirty: true }); - if (next.length > 0 && !isPopoverOpenRef.current) { - lastValidRolesRef.current = next; - } else if (!isPopoverOpenRef.current) { - validateRolesSelection(); + if (next.length > 0) { + form.clearErrors(name); } } @@ -117,9 +74,6 @@ export default function OrgRolesTagField({ name={name} render={({ field }) => { const selectedRoles = (field.value ?? []) as SelectedRole[]; - if (!isPopoverOpenRef.current && selectedRoles.length > 0) { - lastValidRolesRef.current = selectedRoles; - } return ( @@ -129,7 +83,6 @@ export default function OrgRolesTagField({ orgId={orgId} selectedRoles={selectedRoles} onSelectRoles={setRoleTags} - onPopoverOpenChange={handlePopoverOpenChange} disabled={disabled} /> diff --git a/src/components/PermissionsSelectBox.tsx b/src/components/PermissionsSelectBox.tsx index ef78d4c71..a45e06f57 100644 --- a/src/components/PermissionsSelectBox.tsx +++ b/src/components/PermissionsSelectBox.tsx @@ -115,8 +115,11 @@ function getActionsCategories(root: boolean) { }, "Resource Policy": { + [t("actionListResourcePolicies")]: "listResourcePolicies", + [t("actionCreateResourcePolicy")]: "createResourcePolicy", [t("actionGetResourcePolicy")]: "getResourcePolicy", [t("actionUpdateResourcePolicy")]: "updateResourcePolicy", + [t("actionDeleteResourcePolicy")]: "deleteResourcePolicy", [t("actionSetResourcePolicyUsers")]: "setResourcePolicyUsers", [t("actionSetResourcePolicyRoles")]: "setResourcePolicyRoles", [t("actionSetResourcePolicyPassword")]: "setResourcePolicyPassword",