From 4be73558d51c1857a230222432e6ba3e7a0d82d8 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Tue, 18 Aug 2026 11:30:44 -0400
Subject: [PATCH] Restrict wildcard domains for inference resources

---
 server/routers/resource/createResource.ts          | 10 ++++++++++
 server/routers/resource/updateResource.ts          | 14 ++++++++++++++
 .../resources/public/[niceId]/general/page.tsx     |  5 ++++-
 .../settings/resources/public/create/page.tsx      |  3 ++-
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/server/routers/resource/createResource.ts b/server/routers/resource/createResource.ts
index 742ecaf6d..1ae6ada24 100644
--- a/server/routers/resource/createResource.ts
+++ b/server/routers/resource/createResource.ts
@@ -415,6 +415,16 @@ async function createHttpResource(
         );
     }
 
+    // Wildcard subdomains are not allowed for inference-mode resources
+    if (effectiveMode === "inference" && subdomain && subdomain.includes("*")) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "Wildcard subdomains are not supported for inference-mode resources."
+            )
+        );
+    }
+
     // Wildcard subdomains are a paid feature
     if (subdomain && subdomain.includes("*")) {
         const isLicensed = await isLicensedOrSubscribed(
diff --git a/server/routers/resource/updateResource.ts b/server/routers/resource/updateResource.ts
index 842cdfa9f..6ecc22ce7 100644
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -531,6 +531,20 @@ async function updateHttpResource(
         }
     }
 
+    // Wildcard subdomains are not allowed for inference-mode resources
+    if (
+        resource.mode === "inference" &&
+        updateData.subdomain &&
+        updateData.subdomain.includes("*")
+    ) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "Wildcard subdomains are not supported for inference-mode resources."
+            )
+        );
+    }
+
     // Wildcard subdomains are a paid feature
     if (updateData.subdomain && updateData.subdomain.includes("*")) {
         if (!isLicensed) {
diff --git a/src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx b/src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx
index 1107762c6..e1f087671 100644
--- a/src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx
+++ b/src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx
@@ -405,7 +405,10 @@ export default function GeneralForm() {
                                             <SettingsFormCell span="full">
                                                 <div id="resource-domain-picker">
                                                     <DomainPicker
-                                                        allowWildcard={true}
+                                                        allowWildcard={
+                                                            resource.mode !==
+                                                            "inference"
+                                                        }
                                                         key={
                                                             resource.resourceId
                                                         }
diff --git a/src/app/[orgId]/settings/resources/public/create/page.tsx b/src/app/[orgId]/settings/resources/public/create/page.tsx
index 552e340d7..9685722c5 100644
--- a/src/app/[orgId]/settings/resources/public/create/page.tsx
+++ b/src/app/[orgId]/settings/resources/public/create/page.tsx
@@ -928,7 +928,8 @@ export default function Page() {
                                                                 <FormItem>
                                                                     <DomainPicker
                                                                         allowWildcard={
-                                                                            true
+                                                                            resourceType !==
+                                                                            "inference"
                                                                         }
                                                                         orgId={
                                                                             orgId as string