From 5cbb767e5f9e5653844931354a62a3eb967980a9 Mon Sep 17 00:00:00 2001
From: Fred KISSIE <fredkiss3@gmail.com>
Date: Wed, 29 Jul 2026 19:11:03 +0100
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20Set=20default=20certificates=20for?=
 =?UTF-8?q?=20private=20resources?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../settings/resources/private/page.tsx       | 39 +++++++++++++++++++
 src/components/PrivateResourcesTable.tsx      | 11 +++++-
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/src/app/[orgId]/settings/resources/private/page.tsx b/src/app/[orgId]/settings/resources/private/page.tsx
index 348340aa9..cbd9ec7ef 100644
--- a/src/app/[orgId]/settings/resources/private/page.tsx
+++ b/src/app/[orgId]/settings/resources/private/page.tsx
@@ -6,6 +6,8 @@ import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { getCachedOrg } from "@app/lib/api/getCachedOrg";
 import OrgProvider from "@app/providers/OrgProvider";
+import { build } from "@server/build";
+import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import type { ListAllSiteResourcesByOrgResponse } from "@server/routers/siteResource";
 import type { AxiosResponse } from "axios";
 import type { Metadata } from "next";
@@ -99,6 +101,42 @@ export default async function ClientResourcesPage(
             };
         }
     );
+
+    // Prefetched in one batched call so the table doesn't fire a separate
+    // certificate request per visible row once it mounts on the client.
+    const certDomains = Array.from(
+        new Set(
+            internalResourceRows
+                .filter(
+                    (r) =>
+                        r.mode === "http" &&
+                        !r.alias &&
+                        r.ssl &&
+                        r.domainId &&
+                        r.fullDomain
+                )
+                .map((r) => r.fullDomain as string)
+        )
+    );
+
+    let initialCertificates: GetBatchedCertificateResponse | undefined;
+    if (build !== "oss" && certDomains.length > 0) {
+        try {
+            const certSearchParams = new URLSearchParams(
+                certDomains.map((domain) => ["domains", domain])
+            );
+            const certRes = await internal.get<
+                AxiosResponse<GetBatchedCertificateResponse>
+            >(
+                `/org/${params.orgId}/batched-certificates?${certSearchParams.toString()}`,
+                await authCookieHeader()
+            );
+            initialCertificates = certRes.data.data;
+        } catch {
+            // leave undefined so each row falls back to fetching its own
+        }
+    }
+
     return (
         <>
             <SettingsSectionTitle
@@ -117,6 +155,7 @@ export default async function ClientResourcesPage(
                         pageIndex: pagination.page - 1,
                         pageSize: pagination.pageSize
                     }}
+                    initialCertificates={initialCertificates}
                 />
             </OrgProvider>
         </>
diff --git a/src/components/PrivateResourcesTable.tsx b/src/components/PrivateResourcesTable.tsx
index 6c2999624..5ee23f424 100644
--- a/src/components/PrivateResourcesTable.tsx
+++ b/src/components/PrivateResourcesTable.tsx
@@ -37,6 +37,7 @@ import { getPrivateResourceSettingsHref } from "@app/lib/launcherResourceAdminHr
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import { UpdateSiteResourceResponse } from "@server/routers/siteResource";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";
@@ -136,13 +137,16 @@ type ClientResourcesTableProps = {
     orgId: string;
     pagination: PaginationState;
     rowCount: number;
+    /** Certificates prefetched on the server, keyed by full domain. */
+    initialCertificates?: GetBatchedCertificateResponse;
 };
 
 export default function PrivateResourcesTable({
     internalResources,
     orgId,
     pagination,
-    rowCount
+    rowCount,
+    initialCertificates
 }: ClientResourcesTableProps) {
     const router = useRouter();
     const {
@@ -432,6 +436,9 @@ export default function PrivateResourcesTable({
                                         orgId={resourceRow.orgId}
                                         domainId={domainId}
                                         fullDomain={fullDomain}
+                                        initialCertValue={
+                                            initialCertificates?.[fullDomain]
+                                        }
                                     />
                                 ) : null}
                                 <div className="">
@@ -585,7 +592,7 @@ export default function PrivateResourcesTable({
         ];
 
         return cols;
-    }, [orgId, t, searchParams]);
+    }, [orgId, t, searchParams, initialCertificates]);
 
     function handleFilterChange(
         column: string,