fix whitelist hyrdration closes #2190

.gitignore

@@ -50,5 +50,4 @@ dynamic/
 *.mmdb
 scratch/
 tsconfig.json
-hydrateSaas.ts
-CLAUDE.md
+hydrateSaas.ts

Dockerfile

@@ -1,20 +1,10 @@
 FROM node:24-alpine AS builder
 
-# OCI Image Labels - Build Args for dynamic values
-ARG VERSION="dev"
-ARG REVISION=""
-ARG CREATED=""
-ARG LICENSE="AGPL-3.0"
-
 WORKDIR /app
 
 ARG BUILD=oss
 ARG DATABASE=sqlite
 
-# Derive title and description based on BUILD type
-ARG IMAGE_TITLE="Pangolin"
-ARG IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere"
-
 RUN apk add --no-cache curl tzdata python3 make g++
 
 # COPY package.json package-lock.json ./
@@ -79,17 +69,4 @@ RUN chmod +x /usr/local/bin/pangctl ./dist/cli.mjs
 COPY server/db/names.json ./dist/names.json
 COPY public ./public
 
-# OCI Image Labels
-# https://github.com/opencontainers/image-spec/blob/main/annotations.md
-LABEL org.opencontainers.image.source="https://github.com/fosrl/pangolin" \
-      org.opencontainers.image.url="https://github.com/fosrl/pangolin" \
-      org.opencontainers.image.documentation="https://docs.pangolin.net" \
-      org.opencontainers.image.vendor="Fossorial" \
-      org.opencontainers.image.licenses="${LICENSE}" \
-      org.opencontainers.image.title="${IMAGE_TITLE}" \
-      org.opencontainers.image.description="${IMAGE_DESCRIPTION}" \
-      org.opencontainers.image.version="${VERSION}" \
-      org.opencontainers.image.revision="${REVISION}" \
-      org.opencontainers.image.created="${CREATED}"
-
 CMD ["npm", "run", "start"]

Makefile

@@ -3,25 +3,6 @@
 major_tag := $(shell echo $(tag) | cut -d. -f1)
 minor_tag := $(shell echo $(tag) | cut -d. -f1,2)
 
-# OCI label variables
-CREATED := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
-REVISION := $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
-
-# Common OCI build args for OSS builds
-OCI_ARGS_OSS = --build-arg VERSION=$(tag) \
-	--build-arg REVISION=$(REVISION) \
-	--build-arg CREATED=$(CREATED) \
-	--build-arg IMAGE_TITLE="Pangolin" \
-	--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere"
-
-# Common OCI build args for Enterprise builds
-OCI_ARGS_EE = --build-arg VERSION=$(tag) \
-	--build-arg REVISION=$(REVISION) \
-	--build-arg CREATED=$(CREATED) \
-	--build-arg LICENSE="Fossorial Commercial" \
-	--build-arg IMAGE_TITLE="Pangolin EE" \
-	--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere"
-
 .PHONY: build-release build-sqlite build-postgresql build-ee-sqlite build-ee-postgresql
 
 build-release: build-sqlite build-postgresql build-ee-sqlite build-ee-postgresql
@@ -34,7 +15,6 @@ build-sqlite:
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		$(OCI_ARGS_OSS) \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:latest \
 		--tag fosrl/pangolin:$(major_tag) \
@@ -50,7 +30,6 @@ build-postgresql:
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		$(OCI_ARGS_OSS) \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:postgresql-latest \
 		--tag fosrl/pangolin:postgresql-$(major_tag) \
@@ -66,7 +45,6 @@ build-ee-sqlite:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		$(OCI_ARGS_EE) \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:ee-latest \
 		--tag fosrl/pangolin:ee-$(major_tag) \
@@ -82,7 +60,6 @@ build-ee-postgresql:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		$(OCI_ARGS_EE) \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:ee-postgresql-latest \
 		--tag fosrl/pangolin:ee-postgresql-$(major_tag) \
@@ -109,16 +86,9 @@ build-release-arm:
 	fi
 	@MAJOR_TAG=$$(echo $(tag) | cut -d. -f1); \
 	MINOR_TAG=$$(echo $(tag) | cut -d. -f1,2); \
-	CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:latest-arm64 \
 		--tag fosrl/pangolin:$$MAJOR_TAG-arm64 \
@@ -128,11 +98,6 @@ build-release-arm:
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:postgresql-latest-arm64 \
 		--tag fosrl/pangolin:postgresql-$$MAJOR_TAG-arm64 \
@@ -142,12 +107,6 @@ build-release-arm:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:ee-latest-arm64 \
 		--tag fosrl/pangolin:ee-$$MAJOR_TAG-arm64 \
@@ -157,12 +116,6 @@ build-release-arm:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:ee-postgresql-latest-arm64 \
 		--tag fosrl/pangolin:ee-postgresql-$$MAJOR_TAG-arm64 \
@@ -177,16 +130,9 @@ build-release-amd:
 	fi
 	@MAJOR_TAG=$$(echo $(tag) | cut -d. -f1); \
 	MINOR_TAG=$$(echo $(tag) | cut -d. -f1,2); \
-	CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:latest-amd64 \
 		--tag fosrl/pangolin:$$MAJOR_TAG-amd64 \
@@ -196,11 +142,6 @@ build-release-amd:
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:postgresql-latest-amd64 \
 		--tag fosrl/pangolin:postgresql-$$MAJOR_TAG-amd64 \
@@ -210,12 +151,6 @@ build-release-amd:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:ee-latest-amd64 \
 		--tag fosrl/pangolin:ee-$$MAJOR_TAG-amd64 \
@@ -225,12 +160,6 @@ build-release-amd:
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:ee-postgresql-latest-amd64 \
 		--tag fosrl/pangolin:ee-postgresql-$$MAJOR_TAG-amd64 \
@@ -284,51 +213,27 @@ build-rc:
 		echo "Error: tag is required. Usage: make build-release tag=<tag>"; \
 		exit 1; \
 	fi
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:$(tag) \
-		--push . && \
+		--push .
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:postgresql-$(tag) \
-		--push . && \
+		--push .
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:ee-$(tag) \
-		--push . && \
+		--push .
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64,linux/amd64 \
 		--tag fosrl/pangolin:ee-postgresql-$(tag) \
 		--push .
@@ -338,51 +243,27 @@ build-rc-arm:
 		echo "Error: tag is required. Usage: make build-rc-arm tag=<tag>"; \
 		exit 1; \
 	fi
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:$(tag)-arm64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:postgresql-$(tag)-arm64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:ee-$(tag)-arm64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/arm64 \
 		--tag fosrl/pangolin:ee-postgresql-$(tag)-arm64 \
 		--push .
@@ -392,51 +273,27 @@ build-rc-amd:
 		echo "Error: tag is required. Usage: make build-rc-amd tag=<tag>"; \
 		exit 1; \
 	fi
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:$(tag)-amd64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=oss \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:postgresql-$(tag)-amd64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:ee-$(tag)-amd64 \
 		--push . && \
 	docker buildx build \
 		--build-arg BUILD=enterprise \
 		--build-arg DATABASE=pg \
-		--build-arg VERSION=$(tag) \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg LICENSE="Fossorial Commercial" \
-		--build-arg IMAGE_TITLE="Pangolin EE" \
-		--build-arg IMAGE_DESCRIPTION="Pangolin Enterprise Edition - Identity-aware VPN and proxy for remote access to anything, anywhere" \
 		--platform linux/amd64 \
 		--tag fosrl/pangolin:ee-postgresql-$(tag)-amd64 \
 		--push .
@@ -469,52 +326,16 @@ create-manifests-rc:
 	echo "All RC multi-arch manifests created successfully!"
 
 build-arm:
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
-	docker buildx build \
-		--build-arg VERSION=dev \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
-		--platform linux/arm64 \
-		-t fosrl/pangolin:latest .
+	docker buildx build --platform linux/arm64 -t fosrl/pangolin:latest .
 
 build-x86:
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
-	docker buildx build \
-		--build-arg VERSION=dev \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
-		--platform linux/amd64 \
-		-t fosrl/pangolin:latest .
+	docker buildx build --platform linux/amd64 -t fosrl/pangolin:latest .
 
 dev-build-sqlite:
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
-	docker build \
-		--build-arg DATABASE=sqlite \
-		--build-arg VERSION=dev \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
-		-t fosrl/pangolin:latest .
+	docker build --build-arg DATABASE=sqlite -t fosrl/pangolin:latest .
 
 dev-build-pg:
-	@CREATED=$$(date -u +"%Y-%m-%dT%H:%M:%SZ"); \
-	REVISION=$$(git rev-parse HEAD 2>/dev/null || echo "unknown"); \
-	docker build \
-		--build-arg DATABASE=pg \
-		--build-arg VERSION=dev \
-		--build-arg REVISION=$$REVISION \
-		--build-arg CREATED=$$CREATED \
-		--build-arg IMAGE_TITLE="Pangolin" \
-		--build-arg IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere" \
-		-t fosrl/pangolin:postgresql-latest .
+	docker build --build-arg DATABASE=pg -t fosrl/pangolin:postgresql-latest .
 
 test:
 	docker run -it -p 3000:3000 -p 3001:3001 -p 3002:3002 -v ./config:/app/config fosrl/pangolin:latest

config/traefik/dynamic_config.yml

@@ -1,9 +1,5 @@
 http:
   middlewares:
-    badger:
-      plugin:
-        badger:
-          disableForwardAuth: true
     redirect-to-https:
       redirectScheme:
         scheme: https
@@ -17,7 +13,6 @@ http:
         - web
       middlewares:
         - redirect-to-https
-        - badger
 
     # Next.js router (handles everything except API and WebSocket paths)
     next-router:
@@ -26,8 +21,6 @@ http:
       priority: 10
       entryPoints:
         - websecure
-      middlewares:
-        - badger
       tls:
         certResolver: letsencrypt
 
@@ -38,8 +31,6 @@ http:
       priority: 100
       entryPoints:
         - websecure
-      middlewares:
-        - badger
       tls:
         certResolver: letsencrypt
 

messages/en-US.json

@@ -257,8 +257,6 @@
     "accessRolesSearch": "Search roles...",
     "accessRolesAdd": "Add Role",
     "accessRoleDelete": "Delete Role",
-    "accessApprovalsManage": "Manage Approvals",
-    "accessApprovalsDescription": "Manage approval requests in the organization",
     "description": "Description",
     "inviteTitle": "Open Invitations",
     "inviteDescription": "Manage invitations for other users to join the organization",
@@ -452,18 +450,6 @@
     "selectDuration": "Select duration",
     "selectResource": "Select Resource",
     "filterByResource": "Filter By Resource",
-    "selectApprovalState": "Select Approval State",
-    "filterByApprovalState": "Filter By Approval State",
-    "approvalListEmpty": "No approvals",
-    "approvalState": "Approval State",
-    "approve": "Approve",
-    "approved": "Approved",
-    "denied": "Denied",
-    "deniedApproval": "Denied Approval",
-    "all": "All",
-    "deny": "Deny",
-    "viewDetails": "View Details",
-    "requestingNewDeviceApproval": "requested a new device",
     "resetFilters": "Reset Filters",
     "totalBlocked": "Requests Blocked By Pangolin",
     "totalRequests": "Total Requests",
@@ -743,28 +729,16 @@
     "countries": "Countries",
     "accessRoleCreate": "Create Role",
     "accessRoleCreateDescription": "Create a new role to group users and manage their permissions.",
-    "accessRoleEdit": "Edit Role",
-    "accessRoleEditDescription": "Edit role information.",
     "accessRoleCreateSubmit": "Create Role",
     "accessRoleCreated": "Role created",
     "accessRoleCreatedDescription": "The role has been successfully created.",
     "accessRoleErrorCreate": "Failed to create role",
     "accessRoleErrorCreateDescription": "An error occurred while creating the role.",
-    "accessRoleUpdateSubmit": "Update Role",
-    "accessRoleUpdated": "Role updated",
-    "accessRoleUpdatedDescription": "The role has been successfully updated.",
-    "accessApprovalUpdated": "Approval processed",
-    "accessApprovalApprovedDescription": "Set Approval Request decision to approved.",
-    "accessApprovalDeniedDescription": "Set Approval Request decision to denied.",
-    "accessRoleErrorUpdate": "Failed to update role",
-    "accessRoleErrorUpdateDescription": "An error occurred while updating the role.",
-    "accessApprovalErrorUpdate": "Failed to process approval",
-    "accessApprovalErrorUpdateDescription": "An error occurred while processing the approval.",
     "accessRoleErrorNewRequired": "New role is required",
     "accessRoleErrorRemove": "Failed to remove role",
     "accessRoleErrorRemoveDescription": "An error occurred while removing the role.",
     "accessRoleName": "Role Name",
-    "accessRoleQuestionRemove": "You're about to delete the `{name}` role. You cannot undo this action.",
+    "accessRoleQuestionRemove": "You're about to delete the {name} role. You cannot undo this action.",
     "accessRoleRemove": "Remove Role",
     "accessRoleRemoveDescription": "Remove a role from the organization",
     "accessRoleRemoveSubmit": "Remove Role",
@@ -900,7 +874,7 @@
     "inviteAlready": "Looks like you've been invited!",
     "inviteAlreadyDescription": "To accept the invite, you must log in or create an account.",
     "signupQuestion": "Already have an account?",
-    "login": "Log In",
+    "login": "Log in",
     "resourceNotFound": "Resource Not Found",
     "resourceNotFoundDescription": "The resource you're trying to access does not exist.",
     "pincodeRequirementsLength": "PIN must be exactly 6 digits",
@@ -980,13 +954,13 @@
     "passwordExpiryDescription": "This organization requires you to change your password every {maxDays} days.",
     "changePasswordNow": "Change Password Now",
     "pincodeAuth": "Authenticator Code",
-    "pincodeSubmit2": "Submit code",
+    "pincodeSubmit2": "Submit Code",
     "passwordResetSubmit": "Request Reset",
     "passwordResetAlreadyHaveCode": "Enter Code",
     "passwordResetSmtpRequired": "Please contact your administrator",
     "passwordResetSmtpRequiredDescription": "A password reset code is required to reset your password. Please contact your administrator for assistance.",
     "passwordBack": "Back to Password",
-    "loginBack": "Go back to main login page",
+    "loginBack": "Go back to log in",
     "signup": "Sign up",
     "loginStart": "Log in to get started",
     "idpOidcTokenValidating": "Validating OIDC token",
@@ -1144,10 +1118,6 @@
     "actionUpdateIdpOrg": "Update IDP Org",
     "actionCreateClient": "Create Client",
     "actionDeleteClient": "Delete Client",
-    "actionArchiveClient": "Archive Client",
-    "actionUnarchiveClient": "Unarchive Client",
-    "actionBlockClient": "Block Client",
-    "actionUnblockClient": "Unblock Client",
     "actionUpdateClient": "Update Client",
     "actionListClients": "List Clients",
     "actionGetClient": "Get Client",
@@ -1164,14 +1134,14 @@
     "searchProgress": "Search...",
     "create": "Create",
     "orgs": "Organizations",
-    "loginError": "An unexpected error occurred. Please try again.",
-    "loginRequiredForDevice": "Login is required for your device.",
+    "loginError": "An error occurred while logging in",
+    "loginRequiredForDevice": "Login is required to authenticate your device.",
     "passwordForgot": "Forgot your password?",
     "otpAuth": "Two-Factor Authentication",
     "otpAuthDescription": "Enter the code from your authenticator app or one of your single-use backup codes.",
     "otpAuthSubmit": "Submit Code",
     "idpContinue": "Or continue with",
-    "otpAuthBack": "Back to Password",
+    "otpAuthBack": "Back to Log In",
     "navbar": "Navigation Menu",
     "navbarDescription": "Main navigation menu for the application",
     "navbarDocsLink": "Documentation",
@@ -1219,7 +1189,6 @@
     "sidebarOverview": "Overview",
     "sidebarHome": "Home",
     "sidebarSites": "Sites",
-    "sidebarApprovals": "Approval Requests",
     "sidebarResources": "Resources",
     "sidebarProxyResources": "Public",
     "sidebarClientResources": "Private",
@@ -1236,7 +1205,7 @@
     "sidebarIdentityProviders": "Identity Providers",
     "sidebarLicense": "License",
     "sidebarClients": "Clients",
-    "sidebarUserDevices": "User Devices",
+    "sidebarUserDevices": "Users",
     "sidebarMachineClients": "Machines",
     "sidebarDomains": "Domains",
     "sidebarGeneral": "Manage",
@@ -1335,7 +1304,6 @@
     "refreshError": "Failed to refresh data",
     "verified": "Verified",
     "pending": "Pending",
-    "pendingApproval": "Pending Approval",
     "sidebarBilling": "Billing",
     "billing": "Billing",
     "orgBillingDescription": "Manage billing information and subscriptions",
@@ -1452,7 +1420,7 @@
     "securityKeyRemoveSuccess": "Security key removed successfully",
     "securityKeyRemoveError": "Failed to remove security key",
     "securityKeyLoadError": "Failed to load security keys",
-    "securityKeyLogin": "Use Security Key",
+    "securityKeyLogin": "Continue with security key",
     "securityKeyAuthError": "Failed to authenticate with security key",
     "securityKeyRecommendation": "Register a backup security key on another device to ensure you always have access to your account.",
     "registering": "Registering...",
@@ -1579,8 +1547,6 @@
     "IntervalSeconds": "Healthy Interval",
     "timeoutSeconds": "Timeout (sec)",
     "timeIsInSeconds": "Time is in seconds",
-    "requireDeviceApproval": "Require Device Approvals",
-    "requireDeviceApprovalDescription": "Users with this role need their devices approved by an admin before they can access resources",
     "retryAttempts": "Retry Attempts",
     "expectedResponseCodes": "Expected Response Codes",
     "expectedResponseCodesDescription": "HTTP status code that indicates healthy status. If left blank, 200-300 is considered healthy.",
@@ -2266,8 +2232,6 @@
     "deviceCodeInvalidFormat": "Code must be 9 characters (e.g., A1AJ-N5JD)",
     "deviceCodeInvalidOrExpired": "Invalid or expired code",
     "deviceCodeVerifyFailed": "Failed to verify device code",
-    "deviceCodeValidating": "Validating device code...",
-    "deviceCodeVerifying": "Verifying device authorization...",
     "signedInAs": "Signed in as",
     "deviceCodeEnterPrompt": "Enter the code displayed on the device",
     "continue": "Continue",
@@ -2342,7 +2306,6 @@
     "identifier": "Identifier",
     "deviceLoginUseDifferentAccount": "Not you? Use a different account.",
     "deviceLoginDeviceRequestingAccessToAccount": "A device is requesting access to this account.",
-    "loginSelectAuthenticationMethod": "Select an authentication method to continue.",
     "noData": "No Data",
     "machineClients": "Machine Clients",
     "install": "Install",
@@ -2431,56 +2394,5 @@
     "maintenanceScreenTitle": "Service Temporarily Unavailable",
     "maintenanceScreenMessage": "We are currently experiencing technical difficulties. Please check back soon.",
     "maintenanceScreenEstimatedCompletion": "Estimated Completion:",
-    "createInternalResourceDialogDestinationRequired": "Destination is required",
-    "available": "Available",
-    "archived": "Archived",
-    "noArchivedDevices": "No archived devices found",
-    "deviceArchived": "Device archived",
-    "deviceArchivedDescription": "The device has been successfully archived.",
-    "errorArchivingDevice": "Error archiving device",
-    "failedToArchiveDevice": "Failed to archive device",
-    "deviceQuestionArchive": "Are you sure you want to archive this device?",
-    "deviceMessageArchive": "The device will be archived and removed from your active devices list.",
-    "deviceArchiveConfirm": "Archive Device",
-    "archiveDevice": "Archive Device",
-    "archive": "Archive",
-    "deviceUnarchived": "Device unarchived",
-    "deviceUnarchivedDescription": "The device has been successfully unarchived.",
-    "errorUnarchivingDevice": "Error unarchiving device",
-    "failedToUnarchiveDevice": "Failed to unarchive device",
-    "unarchive": "Unarchive",
-    "archiveClient": "Archive Client",
-    "archiveClientQuestion": "Are you sure you want to archive this client?",
-    "archiveClientMessage": "The client will be archived and removed from your active clients list.",
-    "archiveClientConfirm": "Archive Client",
-    "blockClient": "Block Client",
-    "blockClientQuestion": "Are you sure you want to block this client?",
-    "blockClientMessage": "The device will be forced to disconnect if currently connected. You can unblock the device later.",
-    "blockClientConfirm": "Block Client",
-    "active": "Active",
-    "usernameOrEmail": "Username or Email",
-    "selectYourOrganization": "Select your organization",
-    "signInTo": "Log in in to",
-    "signInWithPassword": "Continue with Password",
-    "noAuthMethodsAvailable": "No authentication methods available for this organization.",
-    "enterPassword": "Enter your password",
-    "enterMfaCode": "Enter the code from your authenticator app",
-    "securityKeyRequired": "Please use your security key to sign in.",
-    "needToUseAnotherAccount": "Need to use a different account?",
-    "loginLegalDisclaimer": "By clicking the buttons below, you acknowledge you have read, understand, and agree to the <termsOfService>Terms of Service</termsOfService> and <privacyPolicy>Privacy Policy</privacyPolicy>.",
-    "termsOfService": "Terms of Service",
-    "privacyPolicy": "Privacy Policy",
-    "userNotFoundWithUsername": "No user found with that username.",
-    "verify": "Verify",
-    "signIn": "Sign In",
-    "forgotPassword": "Forgot password?",
-    "orgSignInTip": "If you've logged in before, you can enter your username or email above to authenticate with your organization's identity provider instead. It's easier!",
-    "continueAnyway": "Continue anyway",
-    "dontShowAgain": "Don't show again",
-    "orgSignInNotice": "Did you know?",
-    "signupOrgNotice": "Trying to sign in?",
-    "signupOrgTip": "Are you trying to sign in through your organization's identity provider?",
-    "signupOrgLink": "Sign in or sign up with your organization instead",
-    "verifyEmailLogInWithDifferentAccount": "Use a Different Account",
-    "logIn": "Log In"
+    "createInternalResourceDialogDestinationRequired": "Destination is required"
 }

package.json

@@ -3,7 +3,7 @@
     "version": "0.0.0",
     "private": true,
     "type": "module",
-    "description": "Identity-aware VPN and proxy for remote access to anything, anywhere and Dashboard UI",
+    "description": "Tunneled Reverse Proxy Management Server with Identity and Access Control and Dashboard UI",
     "homepage": "https://github.com/fosrl/pangolin",
     "repository": {
         "type": "git",

server/auth/actions.ts

@@ -78,10 +78,6 @@ export enum ActionsEnum {
     updateSiteResource = "updateSiteResource",
     createClient = "createClient",
     deleteClient = "deleteClient",
-    archiveClient = "archiveClient",
-    unarchiveClient = "unarchiveClient",
-    blockClient = "blockClient",
-    unblockClient = "unblockClient",
     updateClient = "updateClient",
     listClients = "listClients",
     getClient = "getClient",
@@ -129,9 +125,7 @@ export enum ActionsEnum {
     getBlueprint = "getBlueprint",
     applyBlueprint = "applyBlueprint",
     viewLogs = "viewLogs",
-    exportLogs = "exportLogs",
-    listApprovals = "listApprovals",
-    updateApprovals = "updateApprovals"
+    exportLogs = "exportLogs"
 }
 
 export async function checkUserActionPermission(

server/db/ios_models.json

@@ -1,150 +0,0 @@
-{
-  "iPad1,1": "iPad",
-  "iPad2,1": "iPad 2",
-  "iPad2,2": "iPad 2",
-  "iPad2,3": "iPad 2",
-  "iPad2,4": "iPad 2",
-  "iPad3,1": "iPad 3rd Gen",
-  "iPad3,3": "iPad 3rd Gen",
-  "iPad3,2": "iPad 3rd Gen",
-  "iPad3,4": "iPad 4th Gen",
-  "iPad3,5": "iPad 4th Gen",
-  "iPad3,6": "iPad 4th Gen",
-  "iPad6,11": "iPad 9.7 5th Gen",
-  "iPad6,12": "iPad 9.7 5th Gen",
-  "iPad7,5": "iPad 9.7 6th Gen",
-  "iPad7,6": "iPad 9.7 6th Gen",
-  "iPad7,11": "iPad 10.2 7th Gen",
-  "iPad7,12": "iPad 10.2 7th Gen",
-  "iPad11,6": "iPad 10.2 8th Gen",
-  "iPad11,7": "iPad 10.2 8th Gen",
-  "iPad12,1": "iPad 10.2 9th Gen",
-  "iPad12,2": "iPad 10.2 9th Gen",
-  "iPad13,18": "iPad 10.9 10th Gen",
-  "iPad13,19": "iPad 10.9 10th Gen",
-  "iPad4,1": "iPad Air",
-  "iPad4,2": "iPad Air",
-  "iPad4,3": "iPad Air",
-  "iPad5,3": "iPad Air 2",
-  "iPad5,4": "iPad Air 2",
-  "iPad11,3": "iPad Air 3rd Gen",
-  "iPad11,4": "iPad Air 3rd Gen",
-  "iPad13,1": "iPad Air 4th Gen",
-  "iPad13,2": "iPad Air 4th Gen",
-  "iPad13,16": "iPad Air 5th Gen",
-  "iPad13,17": "iPad Air 5th Gen",
-  "iPad14,8": "iPad Air M2 11",
-  "iPad14,9": "iPad Air M2 11",
-  "iPad14,10": "iPad Air M2 13",
-  "iPad14,11": "iPad Air M2 13",
-  "iPad2,5": "iPad mini",
-  "iPad2,6": "iPad mini",
-  "iPad2,7": "iPad mini",
-  "iPad4,4": "iPad mini 2",
-  "iPad4,5": "iPad mini 2",
-  "iPad4,6": "iPad mini 2",
-  "iPad4,7": "iPad mini 3",
-  "iPad4,8": "iPad mini 3",
-  "iPad4,9": "iPad mini 3",
-  "iPad5,1": "iPad mini 4",
-  "iPad5,2": "iPad mini 4",
-  "iPad11,1": "iPad mini 5th Gen",
-  "iPad11,2": "iPad mini 5th Gen",
-  "iPad14,1": "iPad mini 6th Gen",
-  "iPad14,2": "iPad mini 6th Gen",
-  "iPad6,7": "iPad Pro 12.9",
-  "iPad6,8": "iPad Pro 12.9",
-  "iPad6,3": "iPad Pro 9.7",
-  "iPad6,4": "iPad Pro 9.7",
-  "iPad7,3": "iPad Pro 10.5",
-  "iPad7,4": "iPad Pro 10.5",
-  "iPad7,1": "iPad Pro 12.9",
-  "iPad7,2": "iPad Pro 12.9",
-  "iPad8,1": "iPad Pro 11",
-  "iPad8,2": "iPad Pro 11",
-  "iPad8,3": "iPad Pro 11",
-  "iPad8,4": "iPad Pro 11",
-  "iPad8,5": "iPad Pro 12.9",
-  "iPad8,6": "iPad Pro 12.9",
-  "iPad8,7": "iPad Pro 12.9",
-  "iPad8,8": "iPad Pro 12.9",
-  "iPad8,9": "iPad Pro 11",
-  "iPad8,10": "iPad Pro 11",
-  "iPad8,11": "iPad Pro 12.9",
-  "iPad8,12": "iPad Pro 12.9",
-  "iPad13,4": "iPad Pro 11",
-  "iPad13,5": "iPad Pro 11",
-  "iPad13,6": "iPad Pro 11",
-  "iPad13,7": "iPad Pro 11",
-  "iPad13,8": "iPad Pro 12.9",
-  "iPad13,9": "iPad Pro 12.9",
-  "iPad13,10": "iPad Pro 12.9",
-  "iPad13,11": "iPad Pro 12.9",
-  "iPad14,3": "iPad Pro 11",
-  "iPad14,4": "iPad Pro 11",
-  "iPad14,5": "iPad Pro 12.9",
-  "iPad14,6": "iPad Pro 12.9",
-  "iPad16,3": "iPad Pro M4 11",
-  "iPad16,4": "iPad Pro M4 11",
-  "iPad16,5": "iPad Pro M4 13",
-  "iPad16,6": "iPad Pro M4 13",
-  "iPhone1,1": "iPhone",
-  "iPhone1,2": "iPhone 3G",
-  "iPhone2,1": "iPhone 3GS",
-  "iPhone3,1": "iPhone 4",
-  "iPhone3,2": "iPhone 4",
-  "iPhone3,3": "iPhone 4",
-  "iPhone4,1": "iPhone 4S",
-  "iPhone5,1": "iPhone 5",
-  "iPhone5,2": "iPhone 5",
-  "iPhone5,3": "iPhone 5c",
-  "iPhone5,4": "iPhone 5c",
-  "iPhone6,1": "iPhone 5s",
-  "iPhone6,2": "iPhone 5s",
-  "iPhone7,2": "iPhone 6",
-  "iPhone7,1": "iPhone 6 Plus",
-  "iPhone8,1": "iPhone 6s",
-  "iPhone8,2": "iPhone 6s Plus",
-  "iPhone8,4": "iPhone SE",
-  "iPhone9,1": "iPhone 7",
-  "iPhone9,3": "iPhone 7",
-  "iPhone9,2": "iPhone 7 Plus",
-  "iPhone9,4": "iPhone 7 Plus",
-  "iPhone10,1": "iPhone 8",
-  "iPhone10,4": "iPhone 8",
-  "iPhone10,2": "iPhone 8 Plus",
-  "iPhone10,5": "iPhone 8 Plus",
-  "iPhone10,3": "iPhone X",
-  "iPhone10,6": "iPhone X",
-  "iPhone11,2": "iPhone Xs",
-  "iPhone11,6": "iPhone Xs Max",
-  "iPhone11,8": "iPhone XR",
-  "iPhone12,1": "iPhone 11",
-  "iPhone12,3": "iPhone 11 Pro",
-  "iPhone12,5": "iPhone 11 Pro Max",
-  "iPhone12,8": "iPhone SE",
-  "iPhone13,1": "iPhone 12 mini",
-  "iPhone13,2": "iPhone 12",
-  "iPhone13,3": "iPhone 12 Pro",
-  "iPhone13,4": "iPhone 12 Pro Max",
-  "iPhone14,4": "iPhone 13 mini",
-  "iPhone14,5": "iPhone 13",
-  "iPhone14,2": "iPhone 13 Pro",
-  "iPhone14,3": "iPhone 13 Pro Max",
-  "iPhone14,6": "iPhone SE",
-  "iPhone14,7": "iPhone 14",
-  "iPhone14,8": "iPhone 14 Plus",
-  "iPhone15,2": "iPhone 14 Pro",
-  "iPhone15,3": "iPhone 14 Pro Max",
-  "iPhone15,4": "iPhone 15",
-  "iPhone15,5": "iPhone 15 Plus",
-  "iPhone16,1": "iPhone 15 Pro",
-  "iPhone16,2": "iPhone 15 Pro Max",
-  "iPod1,1": "iPod touch Original",
-  "iPod2,1": "iPod touch 2nd",
-  "iPod3,1": "iPod touch 3rd Gen",
-  "iPod4,1": "iPod touch 4th",
-  "iPod5,1": "iPod touch 5th",
-  "iPod7,1": "iPod touch 6th Gen",
-  "iPod9,1": "iPod touch 7th Gen"
-}

server/db/mac_models.json

@@ -1,201 +0,0 @@
-{
-  "PowerMac4,4": "eMac",
-  "PowerMac6,4": "eMac",
-  "PowerBook2,1": "iBook",
-  "PowerBook2,2": "iBook",
-  "PowerBook4,1": "iBook",
-  "PowerBook4,2": "iBook",
-  "PowerBook4,3": "iBook",
-  "PowerBook6,3": "iBook",
-  "PowerBook6,5": "iBook",
-  "PowerBook6,7": "iBook",
-  "iMac,1": "iMac",
-  "PowerMac2,1": "iMac",
-  "PowerMac2,2": "iMac",
-  "PowerMac4,1": "iMac",
-  "PowerMac4,2": "iMac",
-  "PowerMac4,5": "iMac",
-  "PowerMac6,1": "iMac",
-  "PowerMac6,3*": "iMac",
-  "PowerMac6,3": "iMac",
-  "PowerMac8,1": "iMac",
-  "PowerMac8,2": "iMac",
-  "PowerMac12,1": "iMac",
-  "iMac4,1": "iMac",
-  "iMac4,2": "iMac",
-  "iMac5,2": "iMac",
-  "iMac5,1": "iMac",
-  "iMac6,1": "iMac",
-  "iMac7,1": "iMac",
-  "iMac8,1": "iMac",
-  "iMac9,1": "iMac",
-  "iMac10,1": "iMac",
-  "iMac11,1": "iMac",
-  "iMac11,2": "iMac",
-  "iMac11,3": "iMac",
-  "iMac12,1": "iMac",
-  "iMac12,2": "iMac",
-  "iMac13,1": "iMac",
-  "iMac13,2": "iMac",
-  "iMac14,1": "iMac",
-  "iMac14,3": "iMac",
-  "iMac14,2": "iMac",
-  "iMac14,4": "iMac",
-  "iMac15,1": "iMac",
-  "iMac16,1": "iMac",
-  "iMac16,2": "iMac",
-  "iMac17,1": "iMac",
-  "iMac18,1": "iMac",
-  "iMac18,2": "iMac",
-  "iMac18,3": "iMac",
-  "iMac19,2": "iMac",
-  "iMac19,1": "iMac",
-  "iMac20,1": "iMac",
-  "iMac20,2": "iMac",
-  "iMac21,2": "iMac",
-  "iMac21,1": "iMac",
-  "iMacPro1,1": "iMac Pro",
-  "PowerMac10,1": "Mac mini",
-  "PowerMac10,2": "Mac mini",
-  "Macmini1,1": "Mac mini",
-  "Macmini2,1": "Mac mini",
-  "Macmini3,1": "Mac mini",
-  "Macmini4,1": "Mac mini",
-  "Macmini5,1": "Mac mini",
-  "Macmini5,2": "Mac mini",
-  "Macmini5,3": "Mac mini",
-  "Macmini6,1": "Mac mini",
-  "Macmini6,2": "Mac mini",
-  "Macmini7,1": "Mac mini",
-  "Macmini8,1": "Mac mini",
-  "ADP3,2": "Mac mini",
-  "Macmini9,1": "Mac mini",
-  "Mac14,3": "Mac mini",
-  "Mac14,12": "Mac mini",
-  "MacPro1,1*": "Mac Pro",
-  "MacPro2,1": "Mac Pro",
-  "MacPro3,1": "Mac Pro",
-  "MacPro4,1": "Mac Pro",
-  "MacPro5,1": "Mac Pro",
-  "MacPro6,1": "Mac Pro",
-  "MacPro7,1": "Mac Pro",
-  "N/A*": "Power Macintosh",
-  "PowerMac1,1": "Power Macintosh",
-  "PowerMac3,1": "Power Macintosh",
-  "PowerMac3,3": "Power Macintosh",
-  "PowerMac3,4": "Power Macintosh",
-  "PowerMac3,5": "Power Macintosh",
-  "PowerMac3,6": "Power Macintosh",
-  "Mac13,1": "Mac Studio",
-  "Mac13,2": "Mac Studio",
-  "MacBook1,1": "MacBook",
-  "MacBook2,1": "MacBook",
-  "MacBook3,1": "MacBook",
-  "MacBook4,1": "MacBook",
-  "MacBook5,1": "MacBook",
-  "MacBook5,2": "MacBook",
-  "MacBook6,1": "MacBook",
-  "MacBook7,1": "MacBook",
-  "MacBook8,1": "MacBook",
-  "MacBook9,1": "MacBook",
-  "MacBook10,1": "MacBook",
-  "MacBookAir1,1": "MacBook Air",
-  "MacBookAir2,1": "MacBook Air",
-  "MacBookAir3,1": "MacBook Air",
-  "MacBookAir3,2": "MacBook Air",
-  "MacBookAir4,1": "MacBook Air",
-  "MacBookAir4,2": "MacBook Air",
-  "MacBookAir5,1": "MacBook Air",
-  "MacBookAir5,2": "MacBook Air",
-  "MacBookAir6,1": "MacBook Air",
-  "MacBookAir6,2": "MacBook Air",
-  "MacBookAir7,1": "MacBook Air",
-  "MacBookAir7,2": "MacBook Air",
-  "MacBookAir8,1": "MacBook Air",
-  "MacBookAir8,2": "MacBook Air",
-  "MacBookAir9,1": "MacBook Air",
-  "MacBookAir10,1": "MacBook Air",
-  "Mac14,2": "MacBook Air",
-  "MacBookPro1,1": "MacBook Pro",
-  "MacBookPro1,2": "MacBook Pro",
-  "MacBookPro2,2": "MacBook Pro",
-  "MacBookPro2,1": "MacBook Pro",
-  "MacBookPro3,1": "MacBook Pro",
-  "MacBookPro4,1": "MacBook Pro",
-  "MacBookPro5,1": "MacBook Pro",
-  "MacBookPro5,2": "MacBook Pro",
-  "MacBookPro5,5": "MacBook Pro",
-  "MacBookPro5,4": "MacBook Pro",
-  "MacBookPro5,3": "MacBook Pro",
-  "MacBookPro7,1": "MacBook Pro",
-  "MacBookPro6,2": "MacBook Pro",
-  "MacBookPro6,1": "MacBook Pro",
-  "MacBookPro8,1": "MacBook Pro",
-  "MacBookPro8,2": "MacBook Pro",
-  "MacBookPro8,3": "MacBook Pro",
-  "MacBookPro9,2": "MacBook Pro",
-  "MacBookPro9,1": "MacBook Pro",
-  "MacBookPro10,1": "MacBook Pro",
-  "MacBookPro10,2": "MacBook Pro",
-  "MacBookPro11,1": "MacBook Pro",
-  "MacBookPro11,2": "MacBook Pro",
-  "MacBookPro11,3": "MacBook Pro",
-  "MacBookPro12,1": "MacBook Pro",
-  "MacBookPro11,4": "MacBook Pro",
-  "MacBookPro11,5": "MacBook Pro",
-  "MacBookPro13,1": "MacBook Pro",
-  "MacBookPro13,2": "MacBook Pro",
-  "MacBookPro13,3": "MacBook Pro",
-  "MacBookPro14,1": "MacBook Pro",
-  "MacBookPro14,2": "MacBook Pro",
-  "MacBookPro14,3": "MacBook Pro",
-  "MacBookPro15,2": "MacBook Pro",
-  "MacBookPro15,1": "MacBook Pro",
-  "MacBookPro15,3": "MacBook Pro",
-  "MacBookPro15,4": "MacBook Pro",
-  "MacBookPro16,1": "MacBook Pro",
-  "MacBookPro16,3": "MacBook Pro",
-  "MacBookPro16,2": "MacBook Pro",
-  "MacBookPro16,4": "MacBook Pro",
-  "MacBookPro17,1": "MacBook Pro",
-  "MacBookPro18,3": "MacBook Pro",
-  "MacBookPro18,4": "MacBook Pro",
-  "MacBookPro18,1": "MacBook Pro",
-  "MacBookPro18,2": "MacBook Pro",
-  "Mac14,7": "MacBook Pro",
-  "Mac14,9": "MacBook Pro",
-  "Mac14,5": "MacBook Pro",
-  "Mac14,10": "MacBook Pro",
-  "Mac14,6": "MacBook Pro",
-  "PowerMac1,2": "Power Macintosh",
-  "PowerMac5,1": "Power Macintosh",
-  "PowerMac7,2": "Power Macintosh",
-  "PowerMac7,3": "Power Macintosh",
-  "PowerMac9,1": "Power Macintosh",
-  "PowerMac11,2": "Power Macintosh",
-  "PowerBook1,1": "PowerBook",
-  "PowerBook3,1": "PowerBook",
-  "PowerBook3,2": "PowerBook",
-  "PowerBook3,3": "PowerBook",
-  "PowerBook3,4": "PowerBook",
-  "PowerBook3,5": "PowerBook",
-  "PowerBook6,1": "PowerBook",
-  "PowerBook5,1": "PowerBook",
-  "PowerBook6,2": "PowerBook",
-  "PowerBook5,2": "PowerBook",
-  "PowerBook5,3": "PowerBook",
-  "PowerBook6,4": "PowerBook",
-  "PowerBook5,4": "PowerBook",
-  "PowerBook5,5": "PowerBook",
-  "PowerBook6,8": "PowerBook",
-  "PowerBook5,6": "PowerBook",
-  "PowerBook5,7": "PowerBook",
-  "PowerBook5,8": "PowerBook",
-  "PowerBook5,9": "PowerBook",
-  "RackMac1,1": "Xserve",
-  "RackMac1,2": "Xserve",
-  "RackMac3,1": "Xserve",
-  "Xserve1,1": "Xserve",
-  "Xserve2,1": "Xserve",
-  "Xserve3,1": "Xserve"
-}

server/db/names.ts

@@ -16,24 +16,6 @@ if (!dev) {
 }
 export const names = JSON.parse(readFileSync(file, "utf-8"));
 
-// Load iOS and Mac model mappings
-let iosModelsFile: string;
-let macModelsFile: string;
-if (!dev) {
-    iosModelsFile = join(__DIRNAME, "ios_models.json");
-    macModelsFile = join(__DIRNAME, "mac_models.json");
-} else {
-    iosModelsFile = join("server/db/ios_models.json");
-    macModelsFile = join("server/db/mac_models.json");
-}
-
-const iosModels: Record<string, string> = JSON.parse(
-    readFileSync(iosModelsFile, "utf-8")
-);
-const macModels: Record<string, string> = JSON.parse(
-    readFileSync(macModelsFile, "utf-8")
-);
-
 export async function getUniqueClientName(orgId: string): Promise<string> {
     let loops = 0;
     while (true) {
@@ -177,29 +159,3 @@ export function generateName(): string {
     // clean out any non-alphanumeric characters except for dashes
     return name.replace(/[^a-z0-9-]/g, "");
 }
-
-export function getMacDeviceName(macIdentifier?: string | null): string | null {
-    if (macIdentifier && macModels[macIdentifier]) {
-        return macModels[macIdentifier];
-    }
-    return null;
-}
-
-export function getIosDeviceName(iosIdentifier?: string | null): string | null {
-    if (iosIdentifier && iosModels[iosIdentifier]) {
-        return iosModels[iosIdentifier];
-    }
-    return null;
-}
-
-export function getUserDeviceName(
-    model: string | null,
-    fallBack: string | null
-): string {
-    return (
-        getMacDeviceName(model) ||
-        getIosDeviceName(model) ||
-        fallBack ||
-        "Unknown Device"
-    );
-}

server/db/pg/schema/privateSchema.ts

@@ -10,15 +10,7 @@ import {
     index
 } from "drizzle-orm/pg-core";
 import { InferSelectModel } from "drizzle-orm";
-import {
-    domains,
-    orgs,
-    targets,
-    users,
-    exitNodes,
-    sessions,
-    clients
-} from "./schema";
+import { domains, orgs, targets, users, exitNodes, sessions } from "./schema";
 
 export const certificates = pgTable("certificates", {
     certId: serial("certId").primaryKey(),
@@ -297,33 +289,6 @@ export const accessAuditLog = pgTable(
     ]
 );
 
-export const approvals = pgTable("approvals", {
-    approvalId: serial("approvalId").primaryKey(),
-    timestamp: integer("timestamp").notNull(), // this is EPOCH time in seconds
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    clientId: integer("clientId").references(() => clients.clientId, {
-        onDelete: "cascade"
-    }), // clients reference user devices (in this case)
-    userId: varchar("userId")
-        .references(() => users.userId, {
-            // optionally tied to a user and in this case delete when the user deletes
-            onDelete: "cascade"
-        })
-        .notNull(),
-    decision: varchar("decision")
-        .$type<"approved" | "denied" | "pending">()
-        .default("pending")
-        .notNull(),
-    type: varchar("type")
-        .$type<"user_device" /*| 'proxy' // for later */>()
-        .notNull()
-});
-
-export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
 export type Certificate = InferSelectModel<typeof certificates>;

server/db/pg/schema/schema.ts

@@ -365,8 +365,7 @@ export const roles = pgTable("roles", {
         .notNull(),
     isAdmin: boolean("isAdmin"),
     name: varchar("name").notNull(),
-    description: varchar("description"),
-    requireDeviceApproval: boolean("requireDeviceApproval").default(false)
+    description: varchar("description")
 });
 
 export const roleActions = pgTable("roleActions", {
@@ -592,8 +591,7 @@ export const idp = pgTable("idp", {
     type: varchar("type").notNull(),
     defaultRoleMapping: varchar("defaultRoleMapping"),
     defaultOrgMapping: varchar("defaultOrgMapping"),
-    autoProvision: boolean("autoProvision").notNull().default(false),
-    tags: text("tags")
+    autoProvision: boolean("autoProvision").notNull().default(false)
 });
 
 export const idpOidcConfig = pgTable("idpOidcConfig", {
@@ -690,12 +688,7 @@ export const clients = pgTable("clients", {
     online: boolean("online").notNull().default(false),
     // endpoint: varchar("endpoint"),
     lastHolePunch: integer("lastHolePunch"),
-    maxConnections: integer("maxConnections"),
-    archived: boolean("archived").notNull().default(false),
-    blocked: boolean("blocked").notNull().default(false),
-    approvalState: varchar("approvalState").$type<
-        "pending" | "approved" | "denied"
-    >()
+    maxConnections: integer("maxConnections")
 });
 
 export const clientSitesAssociationsCache = pgTable(
@@ -719,49 +712,6 @@ export const clientSiteResourcesAssociationsCache = pgTable(
     }
 );
 
-export const clientPostureSnapshots = pgTable("clientPostureSnapshots", {
-    snapshotId: serial("snapshotId").primaryKey(),
-
-    clientId: integer("clientId").references(() => clients.clientId, {
-        onDelete: "cascade"
-    }),
-
-    // Platform-agnostic checks
-
-    biometricsEnabled: boolean("biometricsEnabled").notNull().default(false),
-    diskEncrypted: boolean("diskEncrypted").notNull().default(false),
-    firewallEnabled: boolean("firewallEnabled").notNull().default(false),
-    autoUpdatesEnabled: boolean("autoUpdatesEnabled").notNull().default(false),
-    tpmAvailable: boolean("tpmAvailable").notNull().default(false),
-
-    // Windows-specific posture check information
-
-    windowsDefenderEnabled: boolean("windowsDefenderEnabled")
-        .notNull()
-        .default(false),
-
-    // macOS-specific posture check information
-
-    macosSipEnabled: boolean("macosSipEnabled").notNull().default(false),
-    macosGatekeeperEnabled: boolean("macosGatekeeperEnabled")
-        .notNull()
-        .default(false),
-    macosFirewallStealthMode: boolean("macosFirewallStealthMode")
-        .notNull()
-        .default(false),
-
-    // Linux-specific posture check information
-
-    linuxAppArmorEnabled: boolean("linuxAppArmorEnabled")
-        .notNull()
-        .default(false),
-    linuxSELinuxEnabled: boolean("linuxSELinuxEnabled")
-        .notNull()
-        .default(false),
-
-    collectedAt: integer("collectedAt").notNull()
-});
-
 export const olms = pgTable("olms", {
     olmId: varchar("id").primaryKey(),
     secretHash: varchar("secretHash").notNull(),
@@ -776,29 +726,7 @@ export const olms = pgTable("olms", {
     userId: text("userId").references(() => users.userId, {
         // optionally tied to a user and in this case delete when the user deletes
         onDelete: "cascade"
-    }),
-    archived: boolean("archived").notNull().default(false)
-});
-
-export const fingerprints = pgTable("fingerprints", {
-    fingerprintId: serial("id").primaryKey(),
-
-    olmId: text("olmId")
-        .references(() => olms.olmId, { onDelete: "cascade" })
-        .notNull(),
-
-    firstSeen: integer("firstSeen").notNull(),
-    lastSeen: integer("lastSeen").notNull(),
-
-    username: text("username"),
-    hostname: text("hostname"),
-    platform: text("platform"), // macos | windows | linux | ios | android | unknown
-    osVersion: text("osVersion"),
-    kernelVersion: text("kernelVersion"),
-    arch: text("arch"),
-    deviceModel: text("deviceModel"),
-    serialNumber: text("serialNumber"),
-    platformFingerprint: varchar("platformFingerprint")
+    })
 });
 
 export const olmSessions = pgTable("clientSession", {

server/db/queries/verifySessionQueries.ts

@@ -1,4 +1,4 @@
-import { db, loginPage, LoginPage, loginPageOrg, Org, orgs, roles } from "@server/db";
+import { db, loginPage, LoginPage, loginPageOrg, Org, orgs } from "@server/db";
 import {
     Resource,
     ResourcePassword,
@@ -108,17 +108,9 @@ export async function getUserSessionWithUser(
  */
 export async function getUserOrgRole(userId: string, orgId: string) {
     const userOrgRole = await db
-        .select({
-            userId: userOrgs.userId,
-            orgId: userOrgs.orgId,
-            roleId: userOrgs.roleId,
-            isOwner: userOrgs.isOwner,
-            autoProvisioned: userOrgs.autoProvisioned,
-            roleName: roles.name
-        })
+        .select()
         .from(userOrgs)
         .where(and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId)))
-        .leftJoin(roles, eq(userOrgs.roleId, roles.roleId))
         .limit(1);
 
     return userOrgRole.length > 0 ? userOrgRole[0] : null;

server/db/sqlite/schema/privateSchema.ts

@@ -6,7 +6,7 @@ import {
     sqliteTable,
     text
 } from "drizzle-orm/sqlite-core";
-import { clients, domains, exitNodes, orgs, sessions, users } from "./schema";
+import { domains, exitNodes, orgs, sessions, users } from "./schema";
 
 export const certificates = sqliteTable("certificates", {
     certId: integer("certId").primaryKey({ autoIncrement: true }),
@@ -289,31 +289,6 @@ export const accessAuditLog = sqliteTable(
     ]
 );
 
-export const approvals = sqliteTable("approvals", {
-    approvalId: integer("approvalId").primaryKey({ autoIncrement: true }),
-    timestamp: integer("timestamp").notNull(), // this is EPOCH time in seconds
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    clientId: integer("clientId").references(() => clients.clientId, {
-        onDelete: "cascade"
-    }), // olms reference user devices clients
-    userId: text("userId").references(() => users.userId, {
-        // optionally tied to a user and in this case delete when the user deletes
-        onDelete: "cascade"
-    }),
-    decision: text("decision")
-        .$type<"approved" | "denied" | "pending">()
-        .default("pending")
-        .notNull(),
-    type: text("type")
-        .$type<"user_device" /*| 'proxy' // for later */>()
-        .notNull()
-});
-
-export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
 export type Certificate = InferSelectModel<typeof certificates>;

server/db/sqlite/schema/schema.ts

@@ -255,9 +255,7 @@ export const siteResources = sqliteTable("siteResources", {
     aliasAddress: text("aliasAddress"),
     tcpPortRangeString: text("tcpPortRangeString").notNull().default("*"),
     udpPortRangeString: text("udpPortRangeString").notNull().default("*"),
-    disableIcmp: integer("disableIcmp", { mode: "boolean" })
-        .notNull()
-        .default(false)
+    disableIcmp: integer("disableIcmp", { mode: "boolean" }).notNull().default(false)
 });
 
 export const clientSiteResources = sqliteTable("clientSiteResources", {
@@ -385,12 +383,7 @@ export const clients = sqliteTable("clients", {
     type: text("type").notNull(), // "olm"
     online: integer("online", { mode: "boolean" }).notNull().default(false),
     // endpoint: text("endpoint"),
-    lastHolePunch: integer("lastHolePunch"),
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false),
-    blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
-    approvalState: text("approvalState").$type<
-        "pending" | "approved" | "denied"
-    >()
+    lastHolePunch: integer("lastHolePunch")
 });
 
 export const clientSitesAssociationsCache = sqliteTable(
@@ -416,69 +409,6 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
     }
 );
 
-export const clientPostureSnapshots = sqliteTable("clientPostureSnapshots", {
-    snapshotId: integer("snapshotId").primaryKey({ autoIncrement: true }),
-
-    clientId: integer("clientId").references(() => clients.clientId, {
-        onDelete: "cascade"
-    }),
-
-    // Platform-agnostic checks
-
-    biometricsEnabled: integer("biometricsEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    diskEncrypted: integer("diskEncrypted", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    firewallEnabled: integer("firewallEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    autoUpdatesEnabled: integer("autoUpdatesEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    tpmAvailable: integer("tpmAvailable", { mode: "boolean" })
-        .notNull()
-        .default(false),
-
-    // Windows-specific posture check information
-
-    windowsDefenderEnabled: integer("windowsDefenderEnabled", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-
-    // macOS-specific posture check information
-
-    macosSipEnabled: integer("macosSipEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    macosGatekeeperEnabled: integer("macosGatekeeperEnabled", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-    macosFirewallStealthMode: integer("macosFirewallStealthMode", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-
-    // Linux-specific posture check information
-
-    linuxAppArmorEnabled: integer("linuxAppArmorEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    linuxSELinuxEnabled: integer("linuxSELinuxEnabled", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-
-    collectedAt: integer("collectedAt").notNull()
-});
-
 export const olms = sqliteTable("olms", {
     olmId: text("id").primaryKey(),
     secretHash: text("secretHash").notNull(),
@@ -493,29 +423,7 @@ export const olms = sqliteTable("olms", {
     userId: text("userId").references(() => users.userId, {
         // optionally tied to a user and in this case delete when the user deletes
         onDelete: "cascade"
-    }),
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-});
-
-export const fingerprints = sqliteTable("fingerprints", {
-    fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
-
-    olmId: text("olmId")
-        .references(() => olms.olmId, { onDelete: "cascade" })
-        .notNull(),
-
-    firstSeen: integer("firstSeen").notNull(),
-    lastSeen: integer("lastSeen").notNull(),
-
-    username: text("username"),
-    hostname: text("hostname"),
-    platform: text("platform"), // macos | windows | linux | ios | android | unknown
-    osVersion: text("osVersion"),
-    kernelVersion: text("kernelVersion"),
-    arch: text("arch"),
-    deviceModel: text("deviceModel"),
-    serialNumber: text("serialNumber"),
-    platformFingerprint: text("platformFingerprint")
+    })
 });
 
 export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
@@ -607,10 +515,7 @@ export const roles = sqliteTable("roles", {
         .notNull(),
     isAdmin: integer("isAdmin", { mode: "boolean" }),
     name: text("name").notNull(),
-    description: text("description"),
-    requireDeviceApproval: integer("requireDeviceApproval", {
-        mode: "boolean"
-    }).default(false)
+    description: text("description")
 });
 
 export const roleActions = sqliteTable("roleActions", {
@@ -869,8 +774,7 @@ export const idp = sqliteTable("idp", {
         mode: "boolean"
     })
         .notNull()
-        .default(false),
-    tags: text("tags")
+        .default(false)
 });
 
 // Identity Provider OAuth Configuration

server/lib/calculateUserClientsForOrgs.ts

@@ -1,24 +1,21 @@
-import { listExitNodes } from "#dynamic/lib/exitNodes";
-import { build } from "@server/build";
 import {
-    approvals,
     clients,
     db,
     olms,
     orgs,
     roleClients,
     roles,
-    Transaction,
     userClients,
-    userOrgs
+    userOrgs,
+    Transaction
 } from "@server/db";
-import { getUniqueClientName } from "@server/db/names";
+import { eq, and, notInArray } from "drizzle-orm";
+import { listExitNodes } from "#dynamic/lib/exitNodes";
 import { getNextAvailableClientSubnet } from "@server/lib/ip";
-import { isLicensedOrSubscribed } from "@server/lib/isLicencedOrSubscribed";
 import logger from "@server/logger";
-import { sendTerminateClient } from "@server/routers/client/terminate";
-import { and, eq, notInArray, type InferInsertModel } from "drizzle-orm";
 import { rebuildClientAssociationsFromClient } from "./rebuildClientAssociations";
+import { sendTerminateClient } from "@server/routers/client/terminate";
+import { getUniqueClientName } from "@server/db/names";
 
 export async function calculateUserClientsForOrgs(
     userId: string,
@@ -41,15 +38,13 @@ export async function calculateUserClientsForOrgs(
         const allUserOrgs = await transaction
             .select()
             .from(userOrgs)
-            .innerJoin(roles, eq(roles.roleId, userOrgs.roleId))
             .where(eq(userOrgs.userId, userId));
 
-        const userOrgIds = allUserOrgs.map(({ userOrgs: uo }) => uo.orgId);
+        const userOrgIds = allUserOrgs.map((uo) => uo.orgId);
 
         // For each OLM, ensure there's a client in each org the user is in
         for (const olm of userOlms) {
-            for (const userRoleOrg of allUserOrgs) {
-                const { userOrgs: userOrg, roles: role } = userRoleOrg;
+            for (const userOrg of allUserOrgs) {
                 const orgId = userOrg.orgId;
 
                 const [org] = await transaction
@@ -187,46 +182,21 @@ export async function calculateUserClientsForOrgs(
 
                 const niceId = await getUniqueClientName(orgId);
 
-                const isOrgLicensed = await isLicensedOrSubscribed(
-                    userOrg.orgId
-                );
-                const requireApproval =
-                    build !== "oss" &&
-                    isOrgLicensed &&
-                    role.requireDeviceApproval;
-
-                const newClientData: InferInsertModel<typeof clients> = {
-                    userId,
-                    orgId: userOrg.orgId,
-                    exitNodeId: randomExitNode.exitNodeId,
-                    name: olm.name || "User Client",
-                    subnet: updatedSubnet,
-                    olmId: olm.olmId,
-                    type: "olm",
-                    niceId,
-                    approvalState: requireApproval ? "pending" : null
-                };
-
                 // Create the client
                 const [newClient] = await transaction
                     .insert(clients)
-                    .values(newClientData)
+                    .values({
+                        userId,
+                        orgId: userOrg.orgId,
+                        exitNodeId: randomExitNode.exitNodeId,
+                        name: olm.name || "User Client",
+                        subnet: updatedSubnet,
+                        olmId: olm.olmId,
+                        type: "olm",
+                        niceId
+                    })
                     .returning();
 
-                // create approval request
-                if (requireApproval) {
-                    await transaction
-                        .insert(approvals)
-                        .values({
-                            timestamp: Math.floor(new Date().getTime() / 1000),
-                            orgId: userOrg.orgId,
-                            clientId: newClient.clientId,
-                            userId,
-                            type: "user_device"
-                        })
-                        .returning();
-                }
-
                 await rebuildClientAssociationsFromClient(
                     newClient,
                     transaction

server/middlewares/integration/index.ts

@@ -13,4 +13,3 @@ export * from "./verifyApiKeyIsRoot";
 export * from "./verifyApiKeyApiKeyAccess";
 export * from "./verifyApiKeyClientAccess";
 export * from "./verifyApiKeySiteResourceAccess";
-export * from "./verifyApiKeyIdpAccess";

server/middlewares/integration/verifyApiKeyIdpAccess.ts

@@ -1,88 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { idp, idpOrg, apiKeyOrg } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-
-export async function verifyApiKeyIdpAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const apiKey = req.apiKey;
-        const idpId = req.params.idpId || req.body.idpId || req.query.idpId;
-        const orgId = req.params.orgId;
-
-        if (!apiKey) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
-            );
-        }
-
-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
-        if (!idpId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid IDP ID")
-            );
-        }
-
-        if (apiKey.isRoot) {
-            // Root keys can access any IDP in any org
-            return next();
-        }
-
-        const [idpRes] = await db
-            .select()
-            .from(idp)
-            .innerJoin(idpOrg, eq(idp.idpId, idpOrg.idpId))
-            .where(and(eq(idp.idpId, idpId), eq(idpOrg.orgId, orgId)))
-            .limit(1);
-
-        if (!idpRes || !idpRes.idp || !idpRes.idpOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `IdP with ID ${idpId} not found for organization ${orgId}`
-                )
-            );
-        }
-
-        if (!req.apiKeyOrg) {
-            const apiKeyOrgRes = await db
-                .select()
-                .from(apiKeyOrg)
-                .where(
-                    and(
-                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
-                        eq(apiKeyOrg.orgId, idpRes.idpOrg.orgId)
-                    )
-                );
-            req.apiKeyOrg = apiKeyOrgRes[0];
-        }
-
-        if (!req.apiKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Key does not have access to this organization"
-                )
-            );
-        }
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying IDP access"
-            )
-        );
-    }
-}

server/private/lib/config.ts

@@ -139,10 +139,6 @@ export class PrivateConfig {
             process.env.USE_PANGOLIN_DNS =
                 this.rawPrivateConfig.flags.use_pangolin_dns.toString();
         }
-        if (this.rawPrivateConfig.flags.use_org_only_idp) {
-            process.env.USE_ORG_ONLY_IDP =
-                this.rawPrivateConfig.flags.use_org_only_idp.toString();
-        }
     }
 
     public getRawPrivateConfig() {

server/private/lib/readConfigFile.ts

@@ -83,8 +83,7 @@ export const privateConfigSchema = z.object({
     flags: z
         .object({
             enable_redis: z.boolean().optional().default(false),
-            use_pangolin_dns: z.boolean().optional().default(false),
-            use_org_only_idp: z.boolean().optional().default(false)
+            use_pangolin_dns: z.boolean().optional().default(false)
         })
         .optional()
         .prefault({}),

server/private/routers/approvals/index.ts

@@ -1,15 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./listApprovals";
-export * from "./processPendingApproval";

server/private/routers/approvals/listApprovals.ts

@@ -1,188 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-import type { Request, Response, NextFunction } from "express";
-import { build } from "@server/build";
-import { getOrgTierData } from "@server/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import { approvals, clients, db, users, type Approval } from "@server/db";
-import { eq, isNull, sql, not, and, desc } from "drizzle-orm";
-import response from "@server/lib/response";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const querySchema = z.strictObject({
-    limit: z
-        .string()
-        .optional()
-        .default("1000")
-        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    offset: z
-        .string()
-        .optional()
-        .default("0")
-        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    approvalState: z
-        .enum(["pending", "approved", "denied", "all"])
-        .optional()
-        .default("all")
-        .catch("all")
-});
-
-async function queryApprovals(
-    orgId: string,
-    limit: number,
-    offset: number,
-    approvalState: z.infer<typeof querySchema>["approvalState"]
-) {
-    let state: Array<Approval["decision"]> = [];
-    switch (approvalState) {
-        case "pending":
-            state = ["pending"];
-            break;
-        case "approved":
-            state = ["approved"];
-            break;
-        case "denied":
-            state = ["denied"];
-            break;
-        default:
-            state = ["approved", "denied", "pending"];
-    }
-
-    const res = await db
-        .select({
-            approvalId: approvals.approvalId,
-            orgId: approvals.orgId,
-            clientId: approvals.clientId,
-            decision: approvals.decision,
-            type: approvals.type,
-            user: {
-                name: users.name,
-                userId: users.userId,
-                username: users.username
-            }
-        })
-        .from(approvals)
-        .innerJoin(users, and(eq(approvals.userId, users.userId)))
-        .leftJoin(
-            clients,
-            and(
-                eq(approvals.clientId, clients.clientId),
-                not(isNull(clients.userId)) // only user devices
-            )
-        )
-        .where(
-            and(
-                eq(approvals.orgId, orgId),
-                sql`${approvals.decision} in ${state}`
-            )
-        )
-        .orderBy(
-            sql`CASE ${approvals.decision} WHEN 'pending' THEN 0 ELSE 1 END`,
-            desc(approvals.timestamp)
-        )
-        .limit(limit)
-        .offset(offset);
-    return res;
-}
-
-export type ListApprovalsResponse = {
-    approvals: NonNullable<Awaited<ReturnType<typeof queryApprovals>>>;
-    pagination: { total: number; limit: number; offset: number };
-};
-
-export async function listApprovals(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedQuery = querySchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-        const { limit, offset, approvalState } = parsedQuery.data;
-
-        const { orgId } = parsedParams.data;
-
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
-        const approvalsList = await queryApprovals(
-            orgId.toString(),
-            limit,
-            offset,
-            approvalState
-        );
-
-        const [{ count }] = await db
-            .select({ count: sql<number>`count(*)` })
-            .from(approvals);
-
-        return response<ListApprovalsResponse>(res, {
-            data: {
-                approvals: approvalsList,
-                pagination: {
-                    total: count,
-                    limit,
-                    offset
-                }
-            },
-            success: true,
-            error: false,
-            message: "Approvals retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/approvals/processPendingApproval.ts

@@ -1,142 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-import { build } from "@server/build";
-import { approvals, clients, db, orgs, type Approval } from "@server/db";
-import { getOrgTierData } from "@server/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import response from "@server/lib/response";
-import { and, eq, type InferInsertModel } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string(),
-    approvalId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const bodySchema = z.strictObject({
-    decision: z.enum(["approved", "denied"])
-});
-
-export type ProcessApprovalResponse = Approval;
-
-export async function processPendingApproval(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = bodySchema.safeParse(req.body);
-
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { orgId, approvalId } = parsedParams.data;
-
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
-        const updateData = parsedBody.data;
-
-        const approval = await db
-            .select()
-            .from(approvals)
-            .where(
-                and(
-                    eq(approvals.approvalId, approvalId),
-                    eq(approvals.decision, "pending")
-                )
-            )
-            .innerJoin(orgs, eq(approvals.orgId, approvals.orgId))
-            .limit(1);
-
-        if (approval.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Pending Approval with ID ${approvalId} not found`
-                )
-            );
-        }
-
-        const [updatedApproval] = await db
-            .update(approvals)
-            .set(updateData)
-            .where(eq(approvals.approvalId, approvalId))
-            .returning();
-
-        // Update user device approval state too
-        if (
-            updatedApproval.type === "user_device" &&
-            updatedApproval.clientId
-        ) {
-            const updateDataBody: Partial<InferInsertModel<typeof clients>> = {
-                approvalState: updateData.decision
-            };
-
-            if (updateData.decision === "denied") {
-                updateDataBody.blocked = true;
-            }
-
-            await db
-                .update(clients)
-                .set(updateDataBody)
-                .where(eq(clients.clientId, updatedApproval.clientId));
-        }
-
-        return response(res, {
-            data: updatedApproval,
-            success: true,
-            error: false,
-            message: "Approval updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/external.ts

@@ -24,7 +24,6 @@ import * as generateLicense from "./generatedLicense";
 import * as logs from "#private/routers/auditLogs";
 import * as misc from "#private/routers/misc";
 import * as reKey from "#private/routers/re-key";
-import * as approval from "#private/routers/approvals";
 
 import {
     verifyOrgAccess,
@@ -312,24 +311,6 @@ authenticated.get(
     loginPage.getLoginPage
 );
 
-authenticated.get(
-    "/org/:orgId/approvals",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listApprovals),
-    logActionAudit(ActionsEnum.listApprovals),
-    approval.listApprovals
-);
-
-authenticated.put(
-    "/org/:orgId/approvals/:approvalId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.updateApprovals),
-    logActionAudit(ActionsEnum.updateApprovals),
-    approval.processPendingApproval
-);
-
 authenticated.get(
     "/org/:orgId/login-page-branding",
     verifyValidLicense,

server/private/routers/integration.ts

@@ -18,8 +18,7 @@ import * as logs from "#private/routers/auditLogs";
 import {
     verifyApiKeyHasAction,
     verifyApiKeyIsRoot,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyIdpAccess
+    verifyApiKeyOrgAccess
 } from "@server/middlewares";
 import {
     verifyValidSubscription,
@@ -32,8 +31,6 @@ import {
     authenticated as a
 } from "@server/routers/integration";
 import { logActionAudit } from "#private/middlewares";
-import config from "#private/lib/config";
-import { build } from "@server/build";
 
 export const unauthenticated = ua;
 export const authenticated = a;
@@ -91,49 +88,3 @@ authenticated.get(
     logActionAudit(ActionsEnum.exportLogs),
     logs.exportAccessAuditLogs
 );
-
-authenticated.put(
-    "/org/:orgId/idp/oidc",
-    verifyValidLicense,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.createIdp),
-    logActionAudit(ActionsEnum.createIdp),
-    orgIdp.createOrgOidcIdp
-);
-
-authenticated.post(
-    "/org/:orgId/idp/:idpId/oidc",
-    verifyValidLicense,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyIdpAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateIdp),
-    logActionAudit(ActionsEnum.updateIdp),
-    orgIdp.updateOrgOidcIdp
-);
-
-authenticated.delete(
-    "/org/:orgId/idp/:idpId",
-    verifyValidLicense,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyIdpAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteIdp),
-    logActionAudit(ActionsEnum.deleteIdp),
-    orgIdp.deleteOrgIdp
-);
-
-authenticated.get(
-    "/org/:orgId/idp/:idpId",
-    verifyValidLicense,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyIdpAccess,
-    verifyApiKeyHasAction(ActionsEnum.getIdp),
-    orgIdp.getOrgIdp
-);
-
-authenticated.get(
-    "/org/:orgId/idp",
-    verifyValidLicense,
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listIdps),
-    orgIdp.listOrgIdps
-);

server/private/routers/loginPage/getLoginPageBranding.ts

@@ -29,9 +29,11 @@ import { getOrgTierData } from "#private/lib/billing";
 import { TierId } from "@server/lib/billing/tiers";
 import { build } from "@server/build";
 
-const paramsSchema = z.strictObject({
-    orgId: z.string()
-});
+const paramsSchema = z
+    .object({
+        orgId: z.string()
+    })
+    .strict();
 
 export async function getLoginPageBranding(
     req: Request,

server/private/routers/loginPage/upsertLoginPageBranding.ts

@@ -28,7 +28,6 @@ import { eq, InferInsertModel } from "drizzle-orm";
 import { getOrgTierData } from "#private/lib/billing";
 import { TierId } from "@server/lib/billing/tiers";
 import { build } from "@server/build";
-import config from "@server/private/lib/config";
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -95,10 +94,8 @@ export async function upsertLoginPageBranding(
             typeof loginPageBranding
         >;
 
-        if (
-            build !== "saas" &&
-            !config.getRawPrivateConfig().flags.use_org_only_idp
-        ) {
+        if (build !== "saas") {
+            // org branding settings are only considered in the saas build
             const { orgTitle, orgSubtitle, ...rest } = updateData;
             updateData = rest;
         }

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -43,27 +43,25 @@ const bodySchema = z.strictObject({
     scopes: z.string().nonempty(),
     autoProvision: z.boolean().optional(),
     variant: z.enum(["oidc", "google", "azure"]).optional().default("oidc"),
-    roleMapping: z.string().optional(),
-    tags: z.string().optional()
+    roleMapping: z.string().optional()
 });
 
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/idp/oidc",
-    description: "Create an OIDC IdP for a specific organization.",
-    tags: [OpenAPITags.Idp, OpenAPITags.Org],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
+// registry.registerPath({
+//     method: "put",
+//     path: "/idp/oidc",
+//     description: "Create an OIDC IdP.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         body: {
+//             content: {
+//                 "application/json": {
+//                     schema: bodySchema
+//                 }
+//             }
+//         }
+//     },
+//     responses: {}
+// });
 
 export async function createOrgOidcIdp(
     req: Request,
@@ -105,8 +103,7 @@ export async function createOrgOidcIdp(
             name,
             autoProvision,
             variant,
-            roleMapping,
-            tags
+            roleMapping
         } = parsedBody.data;
 
         if (build === "saas") {
@@ -134,8 +131,7 @@ export async function createOrgOidcIdp(
                 .values({
                     name,
                     autoProvision,
-                    type: "oidc",
-                    tags
+                    type: "oidc"
                 })
                 .returning();
 

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -32,9 +32,9 @@ const paramsSchema = z
 
 registry.registerPath({
     method: "delete",
-    path: "/org/{orgId}/idp/{idpId}",
-    description: "Delete IDP for a specific organization.",
-    tags: [OpenAPITags.Idp, OpenAPITags.Org],
+    path: "/idp/{idpId}",
+    description: "Delete IDP.",
+    tags: [OpenAPITags.Idp],
     request: {
         params: paramsSchema
     },

server/private/routers/orgIdp/getOrgIdp.ts

@@ -48,16 +48,16 @@ async function query(idpId: number, orgId: string) {
     return res;
 }
 
-registry.registerPath({
-    method: "get",
-    path: "/org/:orgId/idp/:idpId",
-    description: "Get an IDP by its IDP ID for a specific organization.",
-    tags: [OpenAPITags.Idp, OpenAPITags.Org],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
+// registry.registerPath({
+//     method: "get",
+//     path: "/idp/{idpId}",
+//     description: "Get an IDP by its IDP ID.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         params: paramsSchema
+//     },
+//     responses: {}
+// });
 
 export async function getOrgIdp(
     req: Request,

server/private/routers/orgIdp/listOrgIdps.ts

@@ -50,8 +50,7 @@ async function query(orgId: string, limit: number, offset: number) {
             orgId: idpOrg.orgId,
             name: idp.name,
             type: idp.type,
-            variant: idpOidcConfig.variant,
-            tags: idp.tags
+            variant: idpOidcConfig.variant
         })
         .from(idpOrg)
         .where(eq(idpOrg.orgId, orgId))
@@ -63,17 +62,16 @@ async function query(orgId: string, limit: number, offset: number) {
     return res;
 }
 
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/idp",
-    description: "List all IDP for a specific organization.",
-    tags: [OpenAPITags.Idp, OpenAPITags.Org],
-    request: {
-        query: querySchema,
-        params: paramsSchema
-    },
-    responses: {}
-});
+// registry.registerPath({
+//     method: "get",
+//     path: "/idp",
+//     description: "List all IDP in the system.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         query: querySchema
+//     },
+//     responses: {}
+// });
 
 export async function listOrgIdps(
     req: Request,

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -46,31 +46,30 @@ const bodySchema = z.strictObject({
     namePath: z.string().optional(),
     scopes: z.string().optional(),
     autoProvision: z.boolean().optional(),
-    roleMapping: z.string().optional(),
-    tags: z.string().optional()
+    roleMapping: z.string().optional()
 });
 
 export type UpdateOrgIdpResponse = {
     idpId: number;
 };
 
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/idp/{idpId}/oidc",
-    description: "Update an OIDC IdP for a specific organization.",
-    tags: [OpenAPITags.Idp, OpenAPITags.Org],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
+// registry.registerPath({
+//     method: "post",
+//     path: "/idp/{idpId}/oidc",
+//     description: "Update an OIDC IdP.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         params: paramsSchema,
+//         body: {
+//             content: {
+//                 "application/json": {
+//                     schema: bodySchema
+//                 }
+//             }
+//         }
+//     },
+//     responses: {}
+// });
 
 export async function updateOrgOidcIdp(
     req: Request,
@@ -110,8 +109,7 @@ export async function updateOrgOidcIdp(
             namePath,
             name,
             autoProvision,
-            roleMapping,
-            tags
+            roleMapping
         } = parsedBody.data;
 
         if (build === "saas") {
@@ -169,8 +167,7 @@ export async function updateOrgOidcIdp(
         await db.transaction(async (trx) => {
             const idpData = {
                 name,
-                autoProvision,
-                tags
+                autoProvision
             };
 
             // only update if at least one key is not undefined

server/routers/auth/index.ts

@@ -17,4 +17,3 @@ export * from "./securityKey";
 export * from "./startDeviceWebAuth";
 export * from "./verifyDeviceWebAuth";
 export * from "./pollDeviceWebAuth";
-export * from "./lookupUser";

server/routers/auth/lookupUser.ts

@@ -1,224 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import {
-    users,
-    userOrgs,
-    orgs,
-    idpOrg,
-    idp,
-    idpOidcConfig
-} from "@server/db";
-import { eq, or, sql, and, isNotNull, inArray } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { UserType } from "@server/types/UserTypes";
-
-const lookupBodySchema = z.strictObject({
-    identifier: z.string().min(1).toLowerCase()
-});
-
-export type LookupUserResponse = {
-    found: boolean;
-    identifier: string;
-    accounts: Array<{
-        userId: string;
-        email: string | null;
-        username: string;
-        hasInternalAuth: boolean;
-        orgs: Array<{
-            orgId: string;
-            orgName: string;
-            idps: Array<{
-                idpId: number;
-                name: string;
-                variant: string | null;
-            }>;
-            hasInternalAuth: boolean;
-        }>;
-    }>;
-};
-
-// registry.registerPath({
-//     method: "post",
-//     path: "/auth/lookup-user",
-//     description: "Lookup user accounts by username or email and return available authentication methods.",
-//     tags: [OpenAPITags.Auth],
-//     request: {
-//         body: lookupBodySchema
-//     },
-//     responses: {}
-// });
-
-export async function lookupUser(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedBody = lookupBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { identifier } = parsedBody.data;
-
-        // Query users matching identifier (case-insensitive)
-        // Match by username OR email
-        const matchingUsers = await db
-            .select({
-                userId: users.userId,
-                email: users.email,
-                username: users.username,
-                type: users.type,
-                passwordHash: users.passwordHash,
-                idpId: users.idpId
-            })
-            .from(users)
-            .where(
-                or(
-                    sql`LOWER(${users.username}) = ${identifier}`,
-                    sql`LOWER(${users.email}) = ${identifier}`
-                )
-            );
-
-        if (!matchingUsers || matchingUsers.length === 0) {
-            return response<LookupUserResponse>(res, {
-                data: {
-                    found: false,
-                    identifier,
-                    accounts: []
-                },
-                success: true,
-                error: false,
-                message: "No accounts found",
-                status: HttpCode.OK
-            });
-        }
-
-        // Get unique user IDs
-        const userIds = [...new Set(matchingUsers.map((u) => u.userId))];
-
-        // Get all org memberships for these users
-        const orgMemberships = await db
-            .select({
-                userId: userOrgs.userId,
-                orgId: userOrgs.orgId,
-                orgName: orgs.name
-            })
-            .from(userOrgs)
-            .innerJoin(orgs, eq(orgs.orgId, userOrgs.orgId))
-            .where(inArray(userOrgs.userId, userIds));
-
-        // Get unique org IDs
-        const orgIds = [...new Set(orgMemberships.map((m) => m.orgId))];
-
-        // Get all IdPs for these orgs
-        const orgIdps =
-            orgIds.length > 0
-                ? await db
-                      .select({
-                          orgId: idpOrg.orgId,
-                          idpId: idp.idpId,
-                          idpName: idp.name,
-                          variant: idpOidcConfig.variant
-                      })
-                      .from(idpOrg)
-                      .innerJoin(idp, eq(idp.idpId, idpOrg.idpId))
-                      .innerJoin(
-                          idpOidcConfig,
-                          eq(idpOidcConfig.idpId, idp.idpId)
-                      )
-                      .where(inArray(idpOrg.orgId, orgIds))
-                : [];
-
-        // Build response structure
-        const accounts: LookupUserResponse["accounts"] = [];
-
-        for (const user of matchingUsers) {
-            const hasInternalAuth =
-                user.type === UserType.Internal && user.passwordHash !== null;
-
-            // Get orgs for this user
-            const userOrgMemberships = orgMemberships.filter(
-                (m) => m.userId === user.userId
-            );
-
-            // Deduplicate orgs (user might have multiple memberships in same org)
-            const uniqueOrgs = new Map<string, typeof userOrgMemberships[0]>();
-            for (const membership of userOrgMemberships) {
-                if (!uniqueOrgs.has(membership.orgId)) {
-                    uniqueOrgs.set(membership.orgId, membership);
-                }
-            }
-
-            const orgsData = Array.from(uniqueOrgs.values()).map((membership) => {
-                // Get IdPs for this org where the user (with the exact identifier) is authenticated via that IdP
-                // Only show IdPs where the user's idpId matches
-                // Internal users don't have an idpId, so they won't see any IdPs
-                const orgIdpsList = orgIdps
-                    .filter((idp) => {
-                        if (idp.orgId !== membership.orgId) {
-                            return false;
-                        }
-                        // Only show IdPs where the user (with exact identifier) is authenticated via that IdP
-                        // This means user.idpId must match idp.idpId
-                        if (user.idpId !== null && user.idpId === idp.idpId) {
-                            return true;
-                        }
-                        return false;
-                    })
-                    .map((idp) => ({
-                        idpId: idp.idpId,
-                        name: idp.idpName,
-                        variant: idp.variant
-                    }));
-
-                // Check if user has internal auth for this org
-                // User has internal auth if they have an internal account type
-                const orgHasInternalAuth = hasInternalAuth;
-
-                return {
-                    orgId: membership.orgId,
-                    orgName: membership.orgName,
-                    idps: orgIdpsList,
-                    hasInternalAuth: orgHasInternalAuth
-                };
-            });
-
-            accounts.push({
-                userId: user.userId,
-                email: user.email,
-                username: user.username,
-                hasInternalAuth,
-                orgs: orgsData
-            });
-        }
-
-        return response<LookupUserResponse>(res, {
-            data: {
-                found: true,
-                identifier,
-                accounts
-            },
-            success: true,
-            error: false,
-            message: "User lookup completed",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/auth/verifyDeviceWebAuth.ts

@@ -10,7 +10,6 @@ import { eq, and, gt } from "drizzle-orm";
 import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { unauthorized } from "@server/auth/unauthorizedResponse";
-import { getIosDeviceName, getMacDeviceName } from "@server/db/names";
 
 const bodySchema = z
     .object({
@@ -121,11 +120,6 @@ export async function verifyDeviceWebAuth(
             );
         }
 
-        const deviceName =
-            getMacDeviceName(deviceCode.deviceName) ||
-            getIosDeviceName(deviceCode.deviceName) ||
-            deviceCode.deviceName;
-
         // If verify is false, just return metadata without verifying
         if (!verify) {
             return response<VerifyDeviceWebAuthResponse>(res, {
@@ -135,7 +129,7 @@ export async function verifyDeviceWebAuth(
                     metadata: {
                         ip: deviceCode.ip,
                         city: deviceCode.city,
-                        deviceName: deviceName,
+                        deviceName: deviceCode.deviceName,
                         applicationName: deviceCode.applicationName,
                         createdAt: deviceCode.createdAt
                     }

server/routers/badger/logRequestAudit.ts

@@ -49,43 +49,27 @@ const auditLogBuffer: Array<{
 
 const BATCH_SIZE = 100; // Write to DB every 100 logs
 const BATCH_INTERVAL_MS = 5000; // Or every 5 seconds, whichever comes first
-const MAX_BUFFER_SIZE = 10000; // Prevent unbounded memory growth
 let flushTimer: NodeJS.Timeout | null = null;
-let isFlushInProgress = false;
 
 /**
  * Flush buffered logs to database
  */
 async function flushAuditLogs() {
-    if (auditLogBuffer.length === 0 || isFlushInProgress) {
+    if (auditLogBuffer.length === 0) {
         return;
     }
 
-    isFlushInProgress = true;
-
     // Take all current logs and clear buffer
     const logsToWrite = auditLogBuffer.splice(0, auditLogBuffer.length);
 
     try {
-        // Batch insert logs in groups of 25 to avoid overwhelming the database
-        const BATCH_DB_SIZE = 25;
-        for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
-            const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
-            await db.insert(requestAuditLog).values(batch);
-        }
+        // Batch insert all logs at once
+        await db.insert(requestAuditLog).values(logsToWrite);
         logger.debug(`Flushed ${logsToWrite.length} audit logs to database`);
     } catch (error) {
         logger.error("Error flushing audit logs:", error);
         // On error, we lose these logs - consider a fallback strategy if needed
         // (e.g., write to file, or put back in buffer with retry limit)
-    } finally {
-        isFlushInProgress = false;
-        // If buffer filled up while we were flushing, flush again
-        if (auditLogBuffer.length >= BATCH_SIZE) {
-            flushAuditLogs().catch((err) =>
-                logger.error("Error in follow-up flush:", err)
-            );
-        }
     }
 }
 
@@ -111,10 +95,6 @@ export async function shutdownAuditLogger() {
         clearTimeout(flushTimer);
         flushTimer = null;
     }
-    // Force flush even if one is in progress by waiting and retrying
-    while (isFlushInProgress) {
-        await new Promise((resolve) => setTimeout(resolve, 100));
-    }
     await flushAuditLogs();
 }
 
@@ -232,14 +212,6 @@ export async function logRequestAudit(
             ? stripPortFromHost(body.requestIp)
             : undefined;
 
-        // Prevent unbounded buffer growth - drop oldest entries if buffer is too large
-        if (auditLogBuffer.length >= MAX_BUFFER_SIZE) {
-            const dropped = auditLogBuffer.splice(0, BATCH_SIZE);
-            logger.warn(
-                `Audit log buffer exceeded max size (${MAX_BUFFER_SIZE}), dropped ${dropped.length} oldest entries`
-            );
-        }
-
         // Add to buffer instead of writing directly to DB
         auditLogBuffer.push({
             timestamp,

server/routers/badger/verifySession.ts

@@ -942,7 +942,7 @@ async function isUserAllowedToAccessResource(
             username: user.username,
             email: user.email,
             name: user.name,
-            role: userOrgRole.roleName
+            role: user.role
         };
     }
 
@@ -956,7 +956,7 @@ async function isUserAllowedToAccessResource(
             username: user.username,
             email: user.email,
             name: user.name,
-            role: userOrgRole.roleName
+            role: user.role
         };
     }
 
@@ -1035,25 +1035,14 @@ export function isPathAllowed(pattern: string, path: string): boolean {
     logger.debug(`Normalized pattern parts: [${patternParts.join(", ")}]`);
     logger.debug(`Normalized path parts: [${pathParts.join(", ")}]`);
 
-    // Maximum recursion depth to prevent stack overflow and memory issues
-    const MAX_RECURSION_DEPTH = 100;
-
     // Recursive function to try different wildcard matches
-    function matchSegments(patternIndex: number, pathIndex: number, depth: number = 0): boolean {
-        // Check recursion depth limit
-        if (depth > MAX_RECURSION_DEPTH) {
-            logger.warn(
-                `Path matching exceeded maximum recursion depth (${MAX_RECURSION_DEPTH}) for pattern "${pattern}" and path "${path}"`
-            );
-            return false;
-        }
-
-        const indent = "  ".repeat(depth); // Indent based on recursion depth
+    function matchSegments(patternIndex: number, pathIndex: number): boolean {
+        const indent = "  ".repeat(pathIndex); // Indent based on recursion depth
         const currentPatternPart = patternParts[patternIndex];
         const currentPathPart = pathParts[pathIndex];
 
         logger.debug(
-            `${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"}) [depth=${depth}]`
+            `${indent}Checking patternIndex=${patternIndex} (${currentPatternPart || "END"}) vs pathIndex=${pathIndex} (${currentPathPart || "END"})`
         );
 
         // If we've consumed all pattern parts, we should have consumed all path parts
@@ -1086,7 +1075,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
             logger.debug(
                 `${indent}Trying to skip wildcard (consume 0 segments)`
             );
-            if (matchSegments(patternIndex + 1, pathIndex, depth + 1)) {
+            if (matchSegments(patternIndex + 1, pathIndex)) {
                 logger.debug(
                     `${indent}Successfully matched by skipping wildcard`
                 );
@@ -1097,7 +1086,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
             logger.debug(
                 `${indent}Trying to consume segment "${currentPathPart}" for wildcard`
             );
-            if (matchSegments(patternIndex, pathIndex + 1, depth + 1)) {
+            if (matchSegments(patternIndex, pathIndex + 1)) {
                 logger.debug(
                     `${indent}Successfully matched by consuming segment for wildcard`
                 );
@@ -1125,7 +1114,7 @@ export function isPathAllowed(pattern: string, path: string): boolean {
                 logger.debug(
                     `${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"`
                 );
-                return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+                return matchSegments(patternIndex + 1, pathIndex + 1);
             }
 
             logger.debug(
@@ -1146,10 +1135,10 @@ export function isPathAllowed(pattern: string, path: string): boolean {
             `${indent}Segments match: "${currentPatternPart}" = "${currentPathPart}"`
         );
         // Move to next segments in both pattern and path
-        return matchSegments(patternIndex + 1, pathIndex + 1, depth + 1);
+        return matchSegments(patternIndex + 1, pathIndex + 1);
     }
 
-    const result = matchSegments(0, 0, 0);
+    const result = matchSegments(0, 0);
     logger.debug(`Final result: ${result}`);
     return result;
 }

server/routers/client/archiveClient.ts

@@ -1,105 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-import { sendTerminateClient } from "./terminate";
-
-const archiveClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/archive",
-    description: "Archive a client by its client ID.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: archiveClientSchema
-    },
-    responses: {}
-});
-
-export async function archiveClient(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = archiveClientSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        // Check if client exists
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        if (client.archived) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `Client with ID ${clientId} is already archived`
-                )
-            );
-        }
-
-        await db.transaction(async (trx) => {
-            // Archive the client
-            await trx
-                .update(clients)
-                .set({ archived: true })
-                .where(eq(clients.clientId, clientId));
-
-            // Rebuild associations to clean up related data
-            await rebuildClientAssociationsFromClient(client, trx);
-
-            // Send terminate signal if there's an associated OLM
-            if (client.olmId) {
-                await sendTerminateClient(client.clientId, client.olmId);
-            }
-        });
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client archived successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to archive client"
-            )
-        );
-    }
-}

server/routers/client/blockClient.ts

@@ -1,101 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { sendTerminateClient } from "./terminate";
-
-const blockClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/block",
-    description: "Block a client by its client ID.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: blockClientSchema
-    },
-    responses: {}
-});
-
-export async function blockClient(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = blockClientSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        // Check if client exists
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        if (client.blocked) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `Client with ID ${clientId} is already blocked`
-                )
-            );
-        }
-
-        await db.transaction(async (trx) => {
-            // Block the client
-            await trx
-                .update(clients)
-                .set({ blocked: true, approvalState: "denied" })
-                .where(eq(clients.clientId, clientId));
-
-            // Send terminate signal if there's an associated OLM and it's connected
-            if (client.olmId && client.online) {
-                await sendTerminateClient(client.clientId, client.olmId);
-            }
-        });
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client blocked successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to block client"
-            )
-        );
-    }
-}

server/routers/client/deleteClient.ts

@@ -60,12 +60,11 @@ export async function deleteClient(
             );
         }
 
-        // Only allow deletion of machine clients (clients without userId)
         if (client.userId) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    `Cannot delete a user client. User clients must be archived instead.`
+                    `Cannot delete a user client with this endpoint`
                 )
             );
         }

server/routers/client/getClient.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db, olms } from "@server/db";
-import { clients, fingerprints } from "@server/db";
+import { clients } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -10,7 +10,6 @@ import logger from "@server/logger";
 import stoi from "@server/lib/stoi";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-import { getUserDeviceName } from "@server/db/names";
 
 const getClientSchema = z.strictObject({
     clientId: z
@@ -30,7 +29,6 @@ async function query(clientId?: number, niceId?: string, orgId?: string) {
             .from(clients)
             .where(eq(clients.clientId, clientId))
             .leftJoin(olms, eq(clients.clientId, olms.clientId))
-            .leftJoin(fingerprints, eq(olms.olmId, fingerprints.olmId))
             .limit(1);
         return res;
     } else if (niceId && orgId) {
@@ -39,7 +37,6 @@ async function query(clientId?: number, niceId?: string, orgId?: string) {
             .from(clients)
             .where(and(eq(clients.niceId, niceId), eq(clients.orgId, orgId)))
             .leftJoin(olms, eq(clients.clientId, olms.clientId))
-            .leftJoin(fingerprints, eq(olms.olmId, fingerprints.olmId))
             .limit(1);
         return res;
     }
@@ -108,16 +105,8 @@ export async function getClient(
             );
         }
 
-        // Replace name with device name if OLM exists
-        let clientName = client.clients.name;
-        if (client.olms) {
-            const model = client.fingerprints?.deviceModel || null;
-            clientName = getUserDeviceName(model, client.clients.name);
-        }
-
         const data: GetClientResponse = {
             ...client.clients,
-            name: clientName,
             olmId: client.olms ? client.olms.olmId : null
         };
 

server/routers/client/index.ts

@@ -1,10 +1,6 @@
 export * from "./pickClientDefaults";
 export * from "./createClient";
 export * from "./deleteClient";
-export * from "./archiveClient";
-export * from "./unarchiveClient";
-export * from "./blockClient";
-export * from "./unblockClient";
 export * from "./listClients";
 export * from "./updateClient";
 export * from "./getClient";

server/routers/client/listClients.ts

@@ -5,8 +5,7 @@ import {
     roleClients,
     sites,
     userClients,
-    clientSitesAssociationsCache,
-    fingerprints
+    clientSitesAssociationsCache
 } from "@server/db";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
@@ -28,7 +27,6 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import NodeCache from "node-cache";
 import semver from "semver";
-import { getUserDeviceName } from "@server/db/names";
 
 const olmVersionCache = new NodeCache({ stdTTL: 3600 });
 
@@ -138,18 +136,12 @@ function queryClients(
             username: users.username,
             userEmail: users.email,
             niceId: clients.niceId,
-            agent: olms.agent,
-            approvalState: clients.approvalState,
-            olmArchived: olms.archived,
-            archived: clients.archived,
-            blocked: clients.blocked,
-            deviceModel: fingerprints.deviceModel
+            agent: olms.agent
         })
         .from(clients)
         .leftJoin(orgs, eq(clients.orgId, orgs.orgId))
         .leftJoin(olms, eq(clients.clientId, olms.clientId))
         .leftJoin(users, eq(clients.userId, users.userId))
-        .leftJoin(fingerprints, eq(olms.olmId, fingerprints.olmId))
         .where(and(...conditions));
 }
 
@@ -168,22 +160,21 @@ async function getSiteAssociations(clientIds: number[]) {
         .where(inArray(clientSitesAssociationsCache.clientId, clientIds));
 }
 
-type ClientWithSites = Omit<
-    Awaited<ReturnType<typeof queryClients>>[0],
-    "deviceModel"
-> & {
-    sites: Array<{
-        siteId: number;
-        siteName: string | null;
-        siteNiceId: string | null;
-    }>;
+type OlmWithUpdateAvailable = Awaited<ReturnType<typeof queryClients>>[0] & {
     olmUpdateAvailable?: boolean;
 };
 
-type OlmWithUpdateAvailable = ClientWithSites;
-
 export type ListClientsResponse = {
-    clients: Array<ClientWithSites>;
+    clients: Array<
+        Awaited<ReturnType<typeof queryClients>>[0] & {
+            sites: Array<{
+                siteId: number;
+                siteName: string | null;
+                siteNiceId: string | null;
+            }>;
+            olmUpdateAvailable?: boolean;
+        }
+    >;
     pagination: { total: number; limit: number; offset: number };
 };
 
@@ -313,17 +304,11 @@ export async function listClients(
             >
         );
 
-        // Merge clients with their site associations and replace name with device name
-        const clientsWithSites = clientsList.map((client) => {
-            const model = client.deviceModel || null;
-            const newName = getUserDeviceName(model, client.name);
-            const { deviceModel, ...clientWithoutDeviceModel } = client;
-            return {
-                ...clientWithoutDeviceModel,
-                name: newName,
-                sites: sitesByClient[client.clientId] || []
-            };
-        });
+        // Merge clients with their site associations
+        const clientsWithSites = clientsList.map((client) => ({
+            ...client,
+            sites: sitesByClient[client.clientId] || []
+        }));
 
         const latestOlVersionPromise = getLatestOlmVersion();
 
@@ -362,7 +347,7 @@ export async function listClients(
 
         return response<ListClientsResponse>(res, {
             data: {
-                clients: olmsWithUpdates,
+                clients: clientsWithSites,
                 pagination: {
                     total: totalCount,
                     limit,

server/routers/client/unarchiveClient.ts

@@ -1,93 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const unarchiveClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/unarchive",
-    description: "Unarchive a client by its client ID.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: unarchiveClientSchema
-    },
-    responses: {}
-});
-
-export async function unarchiveClient(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = unarchiveClientSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        // Check if client exists
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        if (!client.archived) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `Client with ID ${clientId} is not archived`
-                )
-            );
-        }
-
-        // Unarchive the client
-        await db
-            .update(clients)
-            .set({ archived: false })
-            .where(eq(clients.clientId, clientId));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client unarchived successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to unarchive client"
-            )
-        );
-    }
-}

server/routers/client/unblockClient.ts

@@ -1,93 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const unblockClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/unblock",
-    description: "Unblock a client by its client ID.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: unblockClientSchema
-    },
-    responses: {}
-});
-
-export async function unblockClient(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = unblockClientSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        // Check if client exists
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        if (!client.blocked) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `Client with ID ${clientId} is not blocked`
-                )
-            );
-        }
-
-        // Unblock the client
-        await db
-            .update(clients)
-            .set({ blocked: false, approvalState: null })
-            .where(eq(clients.clientId, clientId));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client unblocked successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to unblock client"
-            )
-        );
-    }
-}

server/routers/external.ts

@@ -174,38 +174,6 @@ authenticated.delete(
     client.deleteClient
 );
 
-authenticated.post(
-    "/client/:clientId/archive",
-    verifyClientAccess,
-    verifyUserHasAction(ActionsEnum.archiveClient),
-    logActionAudit(ActionsEnum.archiveClient),
-    client.archiveClient
-);
-
-authenticated.post(
-    "/client/:clientId/unarchive",
-    verifyClientAccess,
-    verifyUserHasAction(ActionsEnum.unarchiveClient),
-    logActionAudit(ActionsEnum.unarchiveClient),
-    client.unarchiveClient
-);
-
-authenticated.post(
-    "/client/:clientId/block",
-    verifyClientAccess,
-    verifyUserHasAction(ActionsEnum.blockClient),
-    logActionAudit(ActionsEnum.blockClient),
-    client.blockClient
-);
-
-authenticated.post(
-    "/client/:clientId/unblock",
-    verifyClientAccess,
-    verifyUserHasAction(ActionsEnum.unblockClient),
-    logActionAudit(ActionsEnum.unblockClient),
-    client.unblockClient
-);
-
 authenticated.post(
     "/client/:clientId",
     verifyClientAccess, // this will check if the user has access to the client
@@ -586,14 +554,6 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.listRoles),
     role.listRoles
 );
-
-authenticated.post(
-    "/org/:orgId/role/:roleId",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.updateRole),
-    logActionAudit(ActionsEnum.updateRole),
-    role.updateRole
-);
 // authenticated.get(
 //     "/role/:roleId",
 //     verifyRoleAccess,
@@ -848,18 +808,11 @@ authenticated.put("/user/:userId/olm", verifyIsLoggedInUser, olm.createUserOlm);
 
 authenticated.get("/user/:userId/olms", verifyIsLoggedInUser, olm.listUserOlms);
 
-authenticated.post(
-    "/user/:userId/olm/:olmId/archive",
+authenticated.delete(
+    "/user/:userId/olm/:olmId",
     verifyIsLoggedInUser,
     verifyOlmAccess,
-    olm.archiveUserOlm
-);
-
-authenticated.post(
-    "/user/:userId/olm/:olmId/unarchive",
-    verifyIsLoggedInUser,
-    verifyOlmAccess,
-    olm.unarchiveUserOlm
+    olm.deleteUserOlm
 );
 
 authenticated.get(
@@ -869,12 +822,6 @@ authenticated.get(
     olm.getUserOlm
 );
 
-authenticated.post(
-    "/user/:userId/olm/recover",
-    verifyIsLoggedInUser,
-    olm.recoverOlmWithFingerprint
-);
-
 authenticated.put(
     "/idp/oidc",
     verifyUserIsServerAdmin,
@@ -1121,21 +1068,6 @@ authRouter.post(
     auth.login
 );
 authRouter.post("/logout", auth.logout);
-authRouter.post(
-    "/lookup-user",
-    rateLimit({
-        windowMs: 15 * 60 * 1000,
-        max: 15,
-        keyGenerator: (req) =>
-            `lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
-        handler: (req, res, next) => {
-            const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
-            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
-        },
-        store: createStore()
-    }),
-    auth.lookupUser
-);
 authRouter.post(
     "/newt/get-token",
     rateLimit({

server/routers/idp/createOidcIdp.ts

@@ -24,8 +24,7 @@ const bodySchema = z.strictObject({
     emailPath: z.string().optional(),
     namePath: z.string().optional(),
     scopes: z.string().nonempty(),
-    autoProvision: z.boolean().optional(),
-    tags: z.string().optional()
+    autoProvision: z.boolean().optional()
 });
 
 export type CreateIdpResponse = {
@@ -76,8 +75,7 @@ export async function createOidcIdp(
             emailPath,
             namePath,
             name,
-            autoProvision,
-            tags
+            autoProvision
         } = parsedBody.data;
 
         const key = config.getRawConfig().server.secret!;
@@ -92,8 +90,7 @@ export async function createOidcIdp(
                 .values({
                     name,
                     autoProvision,
-                    type: "oidc",
-                    tags
+                    type: "oidc"
                 })
                 .returning();
 

server/routers/idp/listIdps.ts

@@ -33,8 +33,7 @@ async function query(limit: number, offset: number) {
             type: idp.type,
             variant: idpOidcConfig.variant,
             orgCount: sql<number>`count(${idpOrg.orgId})`,
-            autoProvision: idp.autoProvision,
-            tags: idp.tags
+            autoProvision: idp.autoProvision
         })
         .from(idp)
         .leftJoin(idpOrg, sql`${idp.idpId} = ${idpOrg.idpId}`)

server/routers/idp/updateOidcIdp.ts

@@ -30,8 +30,7 @@ const bodySchema = z.strictObject({
     scopes: z.string().optional(),
     autoProvision: z.boolean().optional(),
     defaultRoleMapping: z.string().optional(),
-    defaultOrgMapping: z.string().optional(),
-    tags: z.string().optional()
+    defaultOrgMapping: z.string().optional()
 });
 
 export type UpdateIdpResponse = {
@@ -95,8 +94,7 @@ export async function updateOidcIdp(
             name,
             autoProvision,
             defaultRoleMapping,
-            defaultOrgMapping,
-            tags
+            defaultOrgMapping
         } = parsedBody.data;
 
         // Check if IDP exists and is of type OIDC
@@ -129,8 +127,7 @@ export async function updateOidcIdp(
                 name,
                 autoProvision,
                 defaultRoleMapping,
-                defaultOrgMapping,
-                tags
+                defaultOrgMapping
             };
 
             // only update if at least one key is not undefined

server/routers/integration.ts

@@ -467,14 +467,6 @@ authenticated.put(
     role.createRole
 );
 
-authenticated.post(
-    "/org/:orgId/role/:roleId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateRole),
-    logActionAudit(ActionsEnum.updateRole),
-    role.updateRole
-);
-
 authenticated.get(
     "/org/:orgId/roles",
     verifyApiKeyOrgAccess,
@@ -759,10 +751,9 @@ authenticated.post(
 );
 
 authenticated.get(
-    "/idp", // no guards on this because anyone can list idps for login purposes
-    // we do the same for the external api
-    // verifyApiKeyIsRoot,
-    // verifyApiKeyHasAction(ActionsEnum.listIdps),
+    "/idp",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listIdps),
     idp.listIdps
 );
 
@@ -851,38 +842,6 @@ authenticated.delete(
     client.deleteClient
 );
 
-authenticated.post(
-    "/client/:clientId/archive",
-    verifyApiKeyClientAccess,
-    verifyApiKeyHasAction(ActionsEnum.archiveClient),
-    logActionAudit(ActionsEnum.archiveClient),
-    client.archiveClient
-);
-
-authenticated.post(
-    "/client/:clientId/unarchive",
-    verifyApiKeyClientAccess,
-    verifyApiKeyHasAction(ActionsEnum.unarchiveClient),
-    logActionAudit(ActionsEnum.unarchiveClient),
-    client.unarchiveClient
-);
-
-authenticated.post(
-    "/client/:clientId/block",
-    verifyApiKeyClientAccess,
-    verifyApiKeyHasAction(ActionsEnum.blockClient),
-    logActionAudit(ActionsEnum.blockClient),
-    client.blockClient
-);
-
-authenticated.post(
-    "/client/:clientId/unblock",
-    verifyApiKeyClientAccess,
-    verifyApiKeyHasAction(ActionsEnum.unblockClient),
-    logActionAudit(ActionsEnum.unblockClient),
-    client.unblockClient
-);
-
 authenticated.post(
     "/client/:clientId",
     verifyApiKeyClientAccess,

server/routers/olm/archiveUserOlm.ts

@@ -1,81 +0,0 @@
-import { NextFunction, Request, Response } from "express";
-import { db } from "@server/db";
-import { olms, clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import response from "@server/lib/response";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import logger from "@server/logger";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-import { sendTerminateClient } from "../client/terminate";
-
-const paramsSchema = z
-    .object({
-        userId: z.string(),
-        olmId: z.string()
-    })
-    .strict();
-
-export async function archiveUserOlm(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { olmId } = parsedParams.data;
-
-        // Archive the OLM and disconnect associated clients in a transaction
-        await db.transaction(async (trx) => {
-            // Find all clients associated with this OLM
-            const associatedClients = await trx
-                .select()
-                .from(clients)
-                .where(eq(clients.olmId, olmId));
-
-            // Disconnect clients from the OLM (set olmId to null)
-            for (const client of associatedClients) {
-                await trx
-                    .update(clients)
-                    .set({ olmId: null })
-                    .where(eq(clients.clientId, client.clientId));
-
-                await rebuildClientAssociationsFromClient(client, trx);
-                await sendTerminateClient(client.clientId, olmId);
-            }
-
-            // Archive the OLM (set archived to true)
-            await trx
-                .update(olms)
-                .set({ archived: true })
-                .where(eq(olms.olmId, olmId));
-        });
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Device archived successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to archive device"
-            )
-        );
-    }
-}

server/routers/olm/getUserOlm.ts

@@ -1,6 +1,6 @@
 import { NextFunction, Request, Response } from "express";
 import { db } from "@server/db";
-import { olms, clients, fingerprints } from "@server/db";
+import { olms } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -9,7 +9,6 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
-import { getUserDeviceName } from "@server/db/names";
 
 const paramsSchema = z
     .object({
@@ -18,10 +17,6 @@ const paramsSchema = z
     })
     .strict();
 
-const querySchema = z.object({
-    orgId: z.string().optional()
-});
-
 // registry.registerPath({
 //     method: "get",
 //     path: "/user/{userId}/olm/{olmId}",
@@ -49,64 +44,15 @@ export async function getUserOlm(
             );
         }
 
-        const parsedQuery = querySchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
         const { olmId, userId } = parsedParams.data;
-        const { orgId } = parsedQuery.data;
 
-        const [result] = await db
+        const [olm] = await db
             .select()
             .from(olms)
-            .where(and(eq(olms.userId, userId), eq(olms.olmId, olmId)))
-            .leftJoin(fingerprints, eq(olms.olmId, fingerprints.olmId))
-            .limit(1);
-
-        if (!result || !result.olms) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "Olm not found"
-                )
-            );
-        }
-
-        const olm = result.olms;
-
-        // If orgId is provided and olm has a clientId, fetch the client to check blocked status
-        let blocked: boolean | undefined;
-        if (orgId && olm.clientId) {
-            const [client] = await db
-                .select({ blocked: clients.blocked })
-                .from(clients)
-                .where(
-                    and(
-                        eq(clients.clientId, olm.clientId),
-                        eq(clients.orgId, orgId)
-                    )
-                )
-                .limit(1);
-
-            blocked = client?.blocked ?? false;
-        }
-
-        // Replace name with device name
-        const model = result.fingerprints?.deviceModel || null;
-        const newName = getUserDeviceName(model, olm.name);
-
-        const responseData = blocked !== undefined 
-            ? { ...olm, name: newName, blocked }
-            : { ...olm, name: newName };
+            .where(and(eq(olms.userId, userId), eq(olms.olmId, olmId)));
 
         return response(res, {
-            data: responseData,
+            data: olm,
             success: true,
             error: false,
             message: "Successfully retrieved olm",

server/routers/olm/handleOlmPingMessage.ts

@@ -1,7 +1,7 @@
-import { clientPostureSnapshots, db, fingerprints } from "@server/db";
+import { db } from "@server/db";
 import { disconnectClient } from "#dynamic/routers/ws";
 import { MessageHandler } from "@server/routers/ws";
-import { clients, olms, Olm } from "@server/db";
+import { clients, Olm } from "@server/db";
 import { eq, lt, isNull, and, or } from "drizzle-orm";
 import logger from "@server/logger";
 import { validateSessionToken } from "@server/auth/sessions/app";
@@ -101,159 +101,79 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
     const { message, client: c, sendToClient } = context;
     const olm = c as Olm;
 
-    const { userToken, fingerprint, postures } = message.data;
+    const { userToken } = message.data;
 
     if (!olm) {
         logger.warn("Olm not found");
         return;
     }
 
+    if (olm.userId) {
+        // we need to check a user token to make sure its still valid
+        const { session: userSession, user } =
+            await validateSessionToken(userToken);
+        if (!userSession || !user) {
+            logger.warn("Invalid user session for olm ping");
+            return; // by returning here we just ignore the ping and the setInterval will force it to disconnect
+        }
+        if (user.userId !== olm.userId) {
+            logger.warn("User ID mismatch for olm ping");
+            return;
+        }
+
+        // get the client
+        const [client] = await db
+            .select()
+            .from(clients)
+            .where(
+                and(
+                    eq(clients.olmId, olm.olmId),
+                    eq(clients.userId, olm.userId)
+                )
+            )
+            .limit(1);
+
+        if (!client) {
+            logger.warn("Client not found for olm ping");
+            return;
+        }
+
+        const sessionId = encodeHexLowerCase(
+            sha256(new TextEncoder().encode(userToken))
+        );
+
+        const policyCheck = await checkOrgAccessPolicy({
+            orgId: client.orgId,
+            userId: olm.userId,
+            sessionId // this is the user token passed in the message
+        });
+
+        if (!policyCheck.allowed) {
+            logger.warn(
+                `Olm user ${olm.userId} does not pass access policies for org ${client.orgId}: ${policyCheck.error}`
+            );
+            return;
+        }
+    }
+
     if (!olm.clientId) {
         logger.warn("Olm has no client ID!");
         return;
     }
 
     try {
-        // get the client
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, olm.clientId))
-            .limit(1);
-
-        if (!client) {
-            logger.warn("Client not found for olm ping");
-            return;
-        }
-
-        if (client.blocked) {
-            // NOTE: by returning we dont update the lastPing, so the offline checker will eventually disconnect them
-            logger.debug(`Blocked client ${client.clientId} attempted olm ping`);
-            return;
-        }
-
-        if (olm.userId) {
-            // we need to check a user token to make sure its still valid
-            const { session: userSession, user } =
-                await validateSessionToken(userToken);
-            if (!userSession || !user) {
-                logger.warn("Invalid user session for olm ping");
-                return; // by returning here we just ignore the ping and the setInterval will force it to disconnect
-            }
-            if (user.userId !== olm.userId) {
-                logger.warn("User ID mismatch for olm ping");
-                return;
-            }
-            if (user.userId !== client.userId) {
-                logger.warn("Client user ID mismatch for olm ping");
-                return;
-            }
-
-            const sessionId = encodeHexLowerCase(
-                sha256(new TextEncoder().encode(userToken))
-            );
-
-            const policyCheck = await checkOrgAccessPolicy({
-                orgId: client.orgId,
-                userId: olm.userId,
-                sessionId // this is the user token passed in the message
-            });
-
-            if (!policyCheck.allowed) {
-                logger.warn(
-                    `Olm user ${olm.userId} does not pass access policies for org ${client.orgId}: ${policyCheck.error}`
-                );
-                return;
-            }
-        }
-
+        // Update the client's last ping timestamp
         await db
             .update(clients)
             .set({
                 lastPing: Math.floor(Date.now() / 1000),
-                online: true,
-                archived: false
+                online: true
             })
             .where(eq(clients.clientId, olm.clientId));
-
-        if (olm.archived) {
-            await db
-                .update(olms)
-                .set({ archived: false })
-                .where(eq(olms.olmId, olm.olmId));
-        }
     } catch (error) {
         logger.error("Error handling ping message", { error });
     }
 
-    const now = Math.floor(Date.now() / 1000);
-
-    if (fingerprint && olm.olmId) {
-        const [existingFingerprint] = await db
-            .select()
-            .from(fingerprints)
-            .where(eq(fingerprints.olmId, olm.olmId))
-            .limit(1);
-
-        if (!existingFingerprint) {
-            await db.insert(fingerprints).values({
-                olmId: olm.olmId,
-                firstSeen: now,
-                lastSeen: now,
-
-                username: fingerprint.username,
-                hostname: fingerprint.hostname,
-                platform: fingerprint.platform,
-                osVersion: fingerprint.osVersion,
-                kernelVersion: fingerprint.kernelVersion,
-                arch: fingerprint.arch,
-                deviceModel: fingerprint.deviceModel,
-                serialNumber: fingerprint.serialNumber,
-                platformFingerprint: fingerprint.platformFingerprint
-            });
-        } else {
-            await db
-                .update(fingerprints)
-                .set({
-                    lastSeen: now,
-
-                    username: fingerprint.username,
-                    hostname: fingerprint.hostname,
-                    platform: fingerprint.platform,
-                    osVersion: fingerprint.osVersion,
-                    kernelVersion: fingerprint.kernelVersion,
-                    arch: fingerprint.arch,
-                    deviceModel: fingerprint.deviceModel,
-                    serialNumber: fingerprint.serialNumber,
-                    platformFingerprint: fingerprint.platformFingerprint
-                })
-                .where(eq(fingerprints.olmId, olm.olmId));
-        }
-    }
-
-    if (postures && olm.clientId) {
-        await db.insert(clientPostureSnapshots).values({
-            clientId: olm.clientId,
-
-            biometricsEnabled: postures?.biometricsEnabled,
-            diskEncrypted: postures?.diskEncrypted,
-            firewallEnabled: postures?.firewallEnabled,
-            autoUpdatesEnabled: postures?.autoUpdatesEnabled,
-            tpmAvailable: postures?.tpmAvailable,
-
-            windowsDefenderEnabled: postures?.windowsDefenderEnabled,
-
-            macosSipEnabled: postures?.macosSipEnabled,
-            macosGatekeeperEnabled: postures?.macosGatekeeperEnabled,
-            macosFirewallStealthMode: postures?.macosFirewallStealthMode,
-
-            linuxAppArmorEnabled: postures?.linuxAppArmorEnabled,
-            linuxSELinuxEnabled: postures?.linuxSELinuxEnabled,
-
-            collectedAt: now
-        });
-    }
-
     return {
         message: {
             type: "pong",

server/routers/olm/handleOlmRegisterMessage.ts

@@ -1,8 +1,6 @@
 import {
-    clientPostureSnapshots,
     clientSiteResourcesAssociationsCache,
     db,
-    fingerprints,
     orgs,
     siteResources
 } from "@server/db";
@@ -38,16 +36,8 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const {
-        publicKey,
-        relay,
-        olmVersion,
-        olmAgent,
-        orgId,
-        userToken,
-        fingerprint,
-        postures
-    } = message.data;
+    const { publicKey, relay, olmVersion, olmAgent, orgId, userToken } =
+        message.data;
 
     if (!olm.clientId) {
         logger.warn("Olm client ID not found");
@@ -65,11 +55,6 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         return;
     }
 
-    if (client.blocked) {
-        logger.debug(`Client ${client.clientId} is blocked. Ignoring register.`);
-        return;
-    }
-
     const [org] = await db
         .select()
         .from(orgs)
@@ -127,20 +112,18 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
 
     if (
         (olmVersion && olm.version !== olmVersion) ||
-        (olmAgent && olm.agent !== olmAgent) ||
-        olm.archived
+        (olmAgent && olm.agent !== olmAgent)
     ) {
         await db
             .update(olms)
             .set({
                 version: olmVersion,
-                agent: olmAgent,
-                archived: false
+                agent: olmAgent
             })
             .where(eq(olms.olmId, olm.olmId));
     }
 
-    if (client.pubKey !== publicKey || client.archived) {
+    if (client.pubKey !== publicKey) {
         logger.info(
             "Public key mismatch. Updating public key and clearing session info..."
         );
@@ -148,8 +131,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         await db
             .update(clients)
             .set({
-                pubKey: publicKey,
-                archived: false,
+                pubKey: publicKey
             })
             .where(eq(clients.clientId, client.clientId));
 
@@ -307,72 +289,6 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         });
     }
 
-    if (fingerprint) {
-        const [existingFingerprint] = await db
-            .select()
-            .from(fingerprints)
-            .where(eq(fingerprints.olmId, olm.olmId))
-            .limit(1);
-
-        if (!existingFingerprint) {
-            await db.insert(fingerprints).values({
-                olmId: olm.olmId,
-                firstSeen: now,
-                lastSeen: now,
-
-                username: fingerprint.username,
-                hostname: fingerprint.hostname,
-                platform: fingerprint.platform,
-                osVersion: fingerprint.osVersion,
-                kernelVersion: fingerprint.kernelVersion,
-                arch: fingerprint.arch,
-                deviceModel: fingerprint.deviceModel,
-                serialNumber: fingerprint.serialNumber,
-                platformFingerprint: fingerprint.platformFingerprint
-            });
-        } else {
-            await db
-                .update(fingerprints)
-                .set({
-                    lastSeen: now,
-
-                    username: fingerprint.username,
-                    hostname: fingerprint.hostname,
-                    platform: fingerprint.platform,
-                    osVersion: fingerprint.osVersion,
-                    kernelVersion: fingerprint.kernelVersion,
-                    arch: fingerprint.arch,
-                    deviceModel: fingerprint.deviceModel,
-                    serialNumber: fingerprint.serialNumber,
-                    platformFingerprint: fingerprint.platformFingerprint
-                })
-                .where(eq(fingerprints.olmId, olm.olmId));
-        }
-    }
-
-    if (postures && olm.clientId) {
-        await db.insert(clientPostureSnapshots).values({
-            clientId: olm.clientId,
-
-            biometricsEnabled: postures?.biometricsEnabled,
-            diskEncrypted: postures?.diskEncrypted,
-            firewallEnabled: postures?.firewallEnabled,
-            autoUpdatesEnabled: postures?.autoUpdatesEnabled,
-            tpmAvailable: postures?.tpmAvailable,
-
-            windowsDefenderEnabled: postures?.windowsDefenderEnabled,
-
-            macosSipEnabled: postures?.macosSipEnabled,
-            macosGatekeeperEnabled: postures?.macosGatekeeperEnabled,
-            macosFirewallStealthMode: postures?.macosFirewallStealthMode,
-
-            linuxAppArmorEnabled: postures?.linuxAppArmorEnabled,
-            linuxSELinuxEnabled: postures?.linuxSELinuxEnabled,
-
-            collectedAt: now
-        });
-    }
-
     // REMOVED THIS SO IT CREATES THE INTERFACE AND JUST WAITS FOR THE SITES
     // if (siteConfigurations.length === 0) {
     //     logger.warn("No valid site configurations found");

server/routers/olm/index.ts

@@ -3,10 +3,9 @@ export * from "./getOlmToken";
 export * from "./createUserOlm";
 export * from "./handleOlmRelayMessage";
 export * from "./handleOlmPingMessage";
-export * from "./archiveUserOlm";
-export * from "./unarchiveUserOlm";
+export * from "./deleteUserOlm";
 export * from "./listUserOlms";
+export * from "./deleteUserOlm";
 export * from "./getUserOlm";
 export * from "./handleOlmServerPeerAddMessage";
 export * from "./handleOlmUnRelayMessage";
-export * from "./recoverOlmWithFingerprint";

server/routers/olm/listUserOlms.ts

@@ -1,5 +1,5 @@
 import { NextFunction, Request, Response } from "express";
-import { db, fingerprints } from "@server/db";
+import { db } from "@server/db";
 import { olms } from "@server/db";
 import { eq, count, desc } from "drizzle-orm";
 import HttpCode from "@server/types/HttpCode";
@@ -9,7 +9,6 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
-import { getUserDeviceName } from "@server/db/names";
 
 const querySchema = z.object({
     limit: z
@@ -52,7 +51,6 @@ export type ListUserOlmsResponse = {
         name: string | null;
         clientId: number | null;
         userId: string | null;
-        archived: boolean;
     }>;
     pagination: {
         total: number;
@@ -91,7 +89,7 @@ export async function listUserOlms(
 
         const { userId } = parsedParams.data;
 
-        // Get total count (including archived OLMs)
+        // Get total count
         const [totalCountResult] = await db
             .select({ count: count() })
             .from(olms)
@@ -99,31 +97,22 @@ export async function listUserOlms(
 
         const total = totalCountResult?.count || 0;
 
-        // Get OLMs for the current user (including archived OLMs)
-        const list = await db
-            .select()
+        // Get OLMs for the current user
+        const userOlms = await db
+            .select({
+                olmId: olms.olmId,
+                dateCreated: olms.dateCreated,
+                version: olms.version,
+                name: olms.name,
+                clientId: olms.clientId,
+                userId: olms.userId
+            })
             .from(olms)
             .where(eq(olms.userId, userId))
-            .leftJoin(fingerprints, eq(olms.olmId, fingerprints.olmId))
             .orderBy(desc(olms.dateCreated))
             .limit(limit)
             .offset(offset);
 
-        const userOlms = list.map((item) => {
-            const model = item.fingerprints?.deviceModel || null;
-            const newName = getUserDeviceName(model, item.olms.name);
-
-            return {
-                olmId: item.olms.olmId,
-                dateCreated: item.olms.dateCreated,
-                version: item.olms.version,
-                name: newName,
-                clientId: item.olms.clientId,
-                userId: item.olms.userId,
-                archived: item.olms.archived
-            };
-        });
-
         return response<ListUserOlmsResponse>(res, {
             data: {
                 olms: userOlms,

server/routers/olm/recoverOlmWithFingerprint.ts

@@ -1,120 +0,0 @@
-import { db, fingerprints, olms } from "@server/db";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import response from "@server/lib/response";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import { generateId } from "@server/auth/sessions/app";
-import { hashPassword } from "@server/auth/password";
-
-const paramsSchema = z
-    .object({
-        userId: z.string()
-    })
-    .strict();
-
-const bodySchema = z
-    .object({
-        platformFingerprint: z.string()
-    })
-    .strict();
-
-export async function recoverOlmWithFingerprint(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { userId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { platformFingerprint } = parsedBody.data;
-
-        const result = await db
-            .select({
-                olm: olms,
-                fingerprint: fingerprints
-            })
-            .from(olms)
-            .innerJoin(fingerprints, eq(fingerprints.olmId, olms.olmId))
-            .where(
-                and(
-                    eq(olms.userId, userId),
-                    eq(olms.archived, false),
-                    eq(fingerprints.platformFingerprint, platformFingerprint)
-                )
-            )
-            .orderBy(fingerprints.lastSeen);
-
-        if (!result || result.length == 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "corresponding olm with this fingerprint not found"
-                )
-            );
-        }
-
-        if (result.length > 1) {
-            return next(
-                createHttpError(
-                    HttpCode.CONFLICT,
-                    "multiple matching fingerprints found, not resetting secrets"
-                )
-            );
-        }
-
-        const [{ olm: foundOlm }] = result;
-
-        const newSecret = generateId(48);
-        const newSecretHash = await hashPassword(newSecret);
-
-        await db
-            .update(olms)
-            .set({
-                secretHash: newSecretHash
-            })
-            .where(eq(olms.olmId, foundOlm.olmId));
-
-        return response(res, {
-            data: {
-                olmId: foundOlm.olmId,
-                secret: newSecret
-            },
-            success: true,
-            error: false,
-            message: "Successfully retrieved olm",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to recover olm using provided fingerprint input"
-            )
-        );
-    }
-}

server/routers/olm/unarchiveUserOlm.ts

@@ -1,84 +0,0 @@
-import { NextFunction, Request, Response } from "express";
-import { db } from "@server/db";
-import { olms } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import response from "@server/lib/response";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import logger from "@server/logger";
-
-const paramsSchema = z
-    .object({
-        userId: z.string(),
-        olmId: z.string()
-    })
-    .strict();
-
-export async function unarchiveUserOlm(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { olmId } = parsedParams.data;
-
-        // Check if OLM exists and is archived
-        const [olm] = await db
-            .select()
-            .from(olms)
-            .where(eq(olms.olmId, olmId))
-            .limit(1);
-
-        if (!olm) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `OLM with ID ${olmId} not found`
-                )
-            );
-        }
-
-        if (!olm.archived) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `OLM with ID ${olmId} is not archived`
-                )
-            );
-        }
-
-        // Unarchive the OLM (set archived to false)
-        await db
-            .update(olms)
-            .set({ archived: false })
-            .where(eq(olms.olmId, olmId));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Device unarchived successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to unarchive device"
-            )
-        );
-    }
-}

server/routers/role/createRole.ts

@@ -10,8 +10,6 @@ import { fromError } from "zod-validation-error";
 import { ActionsEnum } from "@server/auth/actions";
 import { eq, and } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
-import { build } from "@server/build";
-import { isLicensedOrSubscribed } from "@server/lib/isLicencedOrSubscribed";
 
 const createRoleParamsSchema = z.strictObject({
     orgId: z.string()
@@ -19,8 +17,7 @@ const createRoleParamsSchema = z.strictObject({
 
 const createRoleSchema = z.strictObject({
     name: z.string().min(1).max(255),
-    description: z.string().optional(),
-    requireDeviceApproval: z.boolean().optional()
+    description: z.string().optional()
 });
 
 export const defaultRoleAllowedActions: ActionsEnum[] = [
@@ -100,11 +97,6 @@ export async function createRole(
             );
         }
 
-        const isLicensed = await isLicensedOrSubscribed(orgId);
-        if (build === "oss" || !isLicensed) {
-            roleData.requireDeviceApproval = undefined;
-        }
-
         await db.transaction(async (trx) => {
             const newRole = await trx
                 .insert(roles)

server/routers/role/listRoles.ts

@@ -1,13 +1,15 @@
-import { db, orgs, roles } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq, sql } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
+import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { db } from "@server/db";
+import { roles, orgs } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { sql, eq } from "drizzle-orm";
+import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import stoi from "@server/lib/stoi";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const listRolesParamsSchema = z.strictObject({
     orgId: z.string()
@@ -36,8 +38,7 @@ async function queryRoles(orgId: string, limit: number, offset: number) {
             isAdmin: roles.isAdmin,
             name: roles.name,
             description: roles.description,
-            orgName: orgs.name,
-            requireDeviceApproval: roles.requireDeviceApproval
+            orgName: orgs.name
         })
         .from(roles)
         .leftJoin(orgs, eq(roles.orgId, orgs.orgId))

server/routers/role/updateRole.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, orgs, type Role } from "@server/db";
+import { db } from "@server/db";
 import { roles } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -8,28 +8,20 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { build } from "@server/build";
-import { isLicensedOrSubscribed } from "@server/lib/isLicencedOrSubscribed";
 
 const updateRoleParamsSchema = z.strictObject({
-    orgId: z.string(),
     roleId: z.string().transform(Number).pipe(z.int().positive())
 });
 
 const updateRoleBodySchema = z
     .strictObject({
         name: z.string().min(1).max(255).optional(),
-        description: z.string().optional(),
-        requireDeviceApproval: z.boolean().optional()
+        description: z.string().optional()
     })
     .refine((data) => Object.keys(data).length > 0, {
         error: "At least one field must be provided for update"
     });
 
-export type UpdateRoleBody = z.infer<typeof updateRoleBodySchema>;
-
-export type UpdateRoleResponse = Role;
-
 export async function updateRole(
     req: Request,
     res: Response,
@@ -56,14 +48,13 @@ export async function updateRole(
             );
         }
 
-        const { roleId, orgId } = parsedParams.data;
+        const { roleId } = parsedParams.data;
         const updateData = parsedBody.data;
 
         const role = await db
             .select()
             .from(roles)
             .where(eq(roles.roleId, roleId))
-            .innerJoin(orgs, eq(roles.orgId, orgs.orgId))
             .limit(1);
 
         if (role.length === 0) {
@@ -75,7 +66,7 @@ export async function updateRole(
             );
         }
 
-        if (role[0].roles.isAdmin) {
+        if (role[0].isAdmin) {
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,
@@ -84,11 +75,6 @@ export async function updateRole(
             );
         }
 
-        const isLicensed = await isLicensedOrSubscribed(orgId);
-        if (build === "oss" || !isLicensed) {
-            updateData.requireDeviceApproval = undefined;
-        }
-
         const updatedRole = await db
             .update(roles)
             .set(updateData)

server/routers/target/updateTarget.ts

@@ -213,11 +213,9 @@ export async function updateTarget(
 
         // When health check is disabled, reset hcHealth to "unknown"
         // to prevent previously unhealthy targets from being excluded
-        // Also when the site is not a newt, set hcHealth to "unknown"
         const hcHealthValue =
             parsedBody.data.hcEnabled === false ||
-            parsedBody.data.hcEnabled === null ||
-            site.type !== "newt"
+            parsedBody.data.hcEnabled === null
                 ? "unknown"
                 : undefined;
 

src/app/[orgId]/settings/(private)/access/approvals/page.tsx

@@ -1,52 +0,0 @@
-import { ApprovalFeed } from "@app/components/ApprovalFeed";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { internal } from "@app/lib/api";
-import { authCookieHeader } from "@app/lib/api/cookies";
-import { getCachedOrg } from "@app/lib/api/getCachedOrg";
-import type { ApprovalItem } from "@app/lib/queries";
-import OrgProvider from "@app/providers/OrgProvider";
-import type { GetOrgResponse } from "@server/routers/org";
-import type { AxiosResponse } from "axios";
-import { getTranslations } from "next-intl/server";
-
-export interface ApprovalFeedPageProps {
-    params: Promise<{ orgId: string }>;
-}
-
-export default async function ApprovalFeedPage(props: ApprovalFeedPageProps) {
-    const params = await props.params;
-
-    let approvals: ApprovalItem[] = [];
-    const res = await internal
-        .get<
-            AxiosResponse<{ approvals: ApprovalItem[] }>
-        >(`/org/${params.orgId}/approvals`, await authCookieHeader())
-        .catch((e) => {});
-
-    if (res && res.status === 200) {
-        approvals = res.data.data.approvals;
-    }
-
-    let org: GetOrgResponse | null = null;
-    const orgRes = await getCachedOrg(params.orgId);
-
-    if (orgRes && orgRes.status === 200) {
-        org = orgRes.data.data;
-    }
-
-    const t = await getTranslations();
-
-    return (
-        <>
-            <SettingsSectionTitle
-                title={t("accessApprovalsManage")}
-                description={t("accessApprovalsDescription")}
-            />
-            <OrgProvider org={org}>
-                <div className="container mx-auto max-w-12xl">
-                    <ApprovalFeed orgId={params.orgId} />
-                </div>
-            </OrgProvider>
-        </>
-    );
-}

src/app/[orgId]/settings/(private)/idp/create/page.tsx

@@ -1,6 +1,5 @@
 "use client";
 
-import AutoProvisionConfigWidget from "@app/components/private/AutoProvisionConfigWidget";
 import {
     SettingsContainer,
     SettingsSection,
@@ -11,10 +10,6 @@ import {
     SettingsSectionHeader,
     SettingsSectionTitle
 } from "@app/components/Settings";
-import HeaderTitle from "@app/components/SettingsSectionTitle";
-import { StrategySelect } from "@app/components/StrategySelect";
-import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
-import { Button } from "@app/components/ui/button";
 import {
     Form,
     FormControl,
@@ -24,21 +19,29 @@ import {
     FormLabel,
     FormMessage
 } from "@app/components/ui/form";
-import { Input } from "@app/components/ui/input";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
+import HeaderTitle from "@app/components/SettingsSectionTitle";
+import { z } from "zod";
+import { createElement, useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { ListRolesResponse } from "@server/routers/role";
-import { AxiosResponse } from "axios";
-import { InfoIcon } from "lucide-react";
+import { Input } from "@app/components/ui/input";
+import { Button } from "@app/components/ui/button";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { toast } from "@app/hooks/useToast";
+import { useParams, useRouter } from "next/navigation";
+import { Checkbox } from "@app/components/ui/checkbox";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
+import { InfoIcon, ExternalLink } from "lucide-react";
+import { StrategySelect } from "@app/components/StrategySelect";
+import { SwitchInput } from "@app/components/SwitchInput";
+import { Badge } from "@app/components/ui/badge";
+import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
 import { useTranslations } from "next-intl";
 import Image from "next/image";
-import { useParams, useRouter } from "next/navigation";
-import { useEffect, useState } from "react";
-import { useForm } from "react-hook-form";
-import { z } from "zod";
+import AutoProvisionConfigWidget from "@app/components/private/AutoProvisionConfigWidget";
+import { AxiosResponse } from "axios";
+import { ListRolesResponse } from "@server/routers/role";
 
 export default function Page() {
     const { env } = useEnvContext();

src/app/[orgId]/settings/(private)/idp/layout.tsx

@@ -1,18 +0,0 @@
-import { pullEnv } from "@app/lib/pullEnv";
-import { build } from "@server/build";
-import { redirect } from "next/navigation";
-
-interface LayoutProps {
-    children: React.ReactNode;
-    params: Promise<{}>;
-}
-
-export default async function Layout(props: LayoutProps) {
-    const env = pullEnv();
-
-    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
-        redirect("/");
-    }
-
-    return props.children;
-}

src/app/[orgId]/settings/access/roles/page.tsx

@@ -2,12 +2,12 @@ import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { AxiosResponse } from "axios";
 import { GetOrgResponse } from "@server/routers/org";
+import { cache } from "react";
 import OrgProvider from "@app/providers/OrgProvider";
 import { ListRolesResponse } from "@server/routers/role";
-import RolesTable, { type RoleRow } from "@app/components/RolesTable";
+import RolesTable, { RoleRow } from "../../../../../components/RolesTable";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { getTranslations } from "next-intl/server";
-import { getCachedOrg } from "@app/lib/api/getCachedOrg";
 
 type RolesPageProps = {
     params: Promise<{ orgId: string }>;
@@ -47,7 +47,14 @@ export default async function RolesPage(props: RolesPageProps) {
     }
 
     let org: GetOrgResponse | null = null;
-    const orgRes = await getCachedOrg(params.orgId);
+    const getOrg = cache(async () =>
+        internal
+            .get<
+                AxiosResponse<GetOrgResponse>
+            >(`/org/${params.orgId}`, await authCookieHeader())
+            .catch((e) => {})
+    );
+    const orgRes = await getOrg();
 
     if (orgRes && orgRes.status === 200) {
         org = orgRes.data.data;

src/app/[orgId]/settings/clients/machine/page.tsx

@@ -59,10 +59,7 @@ export default async function ClientsPage(props: ClientsPageProps) {
             username: client.username,
             userEmail: client.userEmail,
             niceId: client.niceId,
-            agent: client.agent,
-            archived: client.archived || false,
-            blocked: client.blocked || false,
-            approvalState: client.approvalState ?? "approved"
+            agent: client.agent
         };
     };
 

src/app/[orgId]/settings/clients/user/page.tsx

@@ -4,7 +4,7 @@ import { AxiosResponse } from "axios";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { ListClientsResponse } from "@server/routers/client";
 import { getTranslations } from "next-intl/server";
-import type { ClientRow } from "@app/components/UserDevicesTable";
+import type { ClientRow } from "@app/components/MachineClientsTable";
 import UserDevicesTable from "@app/components/UserDevicesTable";
 
 type ClientsPageProps = {
@@ -55,10 +55,7 @@ export default async function ClientsPage(props: ClientsPageProps) {
             username: client.username,
             userEmail: client.userEmail,
             niceId: client.niceId,
-            agent: client.agent,
-            archived: client.archived || false,
-            blocked: client.blocked || false,
-            approvalState: client.approvalState
+            agent: client.agent
         };
     };
 

src/app/[orgId]/settings/layout.tsx

@@ -82,7 +82,7 @@ export default async function SettingsLayout(props: SettingsLayoutProps) {
             <Layout
                 orgId={params.orgId}
                 orgs={orgs}
-                navItems={orgNavSections(env)}
+                navItems={orgNavSections()}
             >
                 {children}
             </Layout>

src/app/[orgId]/settings/resources/proxy/[niceId]/authentication/page.tsx

@@ -36,8 +36,8 @@ import {
 import type { ResourceContextType } from "@app/contexts/resourceContext";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useOrgContext } from "@app/hooks/useOrgContext";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useResourceContext } from "@app/hooks/useResourceContext";
+import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { orgQueries, resourceQueries } from "@app/lib/queries";
@@ -95,7 +95,7 @@ export default function ResourceAuthenticationPage() {
     const router = useRouter();
     const t = useTranslations();
 
-    const { isPaidUser } = usePaidStatus();
+    const subscription = useSubscriptionStatusContext();
 
     const queryClient = useQueryClient();
     const { data: resourceRoles = [], isLoading: isLoadingResourceRoles } =
@@ -129,8 +129,7 @@ export default function ResourceAuthenticationPage() {
     );
     const { data: orgIdps = [], isLoading: isLoadingOrgIdps } = useQuery(
         orgQueries.identityProviders({
-            orgId: org.org.orgId,
-            useOrgOnlyIdp: env.flags.useOrgOnlyIdp
+            orgId: org.org.orgId
         })
     );
 
@@ -160,7 +159,7 @@ export default function ResourceAuthenticationPage() {
 
     const allIdps = useMemo(() => {
         if (build === "saas") {
-            if (isPaidUser) {
+            if (subscription?.subscribed) {
                 return orgIdps.map((idp) => ({
                     id: idp.idpId,
                     text: idp.name

src/app/[orgId]/settings/sites/page.tsx

@@ -2,9 +2,10 @@ import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { ListSitesResponse } from "@server/routers/site";
 import { AxiosResponse } from "axios";
-import SitesTable, { SiteRow } from "@app/components/SitesTable";
+import SitesTable, { SiteRow } from "../../../../components/SitesTable";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import SitesBanner from "@app/components/SitesBanner";
+import SitesSplashCard from "../../../../components/SitesSplashCard";
 import { getTranslations } from "next-intl/server";
 
 type SitesPageProps = {

src/app/admin/layout.tsx

@@ -11,7 +11,6 @@ import { AxiosResponse } from "axios";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { Layout } from "@app/components/Layout";
 import { adminNavSections } from "../navigation";
-import { pullEnv } from "@app/lib/pullEnv";
 
 export const dynamic = "force-dynamic";
 
@@ -28,8 +27,6 @@ export default async function AdminLayout(props: LayoutProps) {
     const getUser = cache(verifySession);
     const user = await getUser();
 
-    const env = pullEnv();
-
     if (!user || !user.serverAdmin) {
         redirect(`/`);
     }
@@ -51,7 +48,7 @@ export default async function AdminLayout(props: LayoutProps) {
 
     return (
         <UserProvider user={user}>
-            <Layout orgs={orgs} navItems={adminNavSections(env)}>
+            <Layout orgs={orgs} navItems={adminNavSections}>
                 {props.children}
             </Layout>
         </UserProvider>

src/app/auth/layout.tsx

@@ -44,7 +44,7 @@ export default async function AuthLayout({ children }: AuthLayoutProps) {
 
     return (
         <div className="h-full flex flex-col">
-            <div className="hidden md:flex justify-end items-center p-3 space-x-2">
+            <div className="flex justify-end items-center p-3 space-x-2">
                 <ThemeSwitcher />
             </div>
 
@@ -113,7 +113,7 @@ export default async function AuthLayout({ children }: AuthLayoutProps) {
                                     aria-label="GitHub"
                                     className="flex items-center space-x-2 whitespace-nowrap"
                                 >
-                                    <span>{t("termsOfService")}</span>
+                                    <span>{t("terms")}</span>
                                 </a>
                                 <Separator orientation="vertical" />
                                 <a
@@ -123,10 +123,30 @@ export default async function AuthLayout({ children }: AuthLayoutProps) {
                                     aria-label="GitHub"
                                     className="flex items-center space-x-2 whitespace-nowrap"
                                 >
-                                    <span>{t("privacyPolicy")}</span>
+                                    <span>{t("privacy")}</span>
                                 </a>
                             </>
                         )}
+                        <Separator orientation="vertical" />
+                        <a
+                            href="https://docs.pangolin.net"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            aria-label="Built by Fossorial"
+                            className="flex items-center space-x-2 whitespace-nowrap"
+                        >
+                            <span>{t("docs")}</span>
+                        </a>
+                        <Separator orientation="vertical" />
+                        <a
+                            href="https://github.com/fosrl/pangolin"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            aria-label="GitHub"
+                            className="flex items-center space-x-2 whitespace-nowrap"
+                        >
+                            <span>{t("github")}</span>
+                        </a>
                     </div>
                 </footer>
             )}

src/app/auth/login/page.tsx

@@ -1,22 +1,19 @@
 import { verifySession } from "@app/lib/auth/verifySession";
 import Link from "next/link";
 import { redirect } from "next/navigation";
-import OrgSignInLink from "@app/components/OrgSignInLink";
 import { cache } from "react";
-import SmartLoginForm from "@app/components/SmartLoginForm";
 import DashboardLoginForm from "@app/components/DashboardLoginForm";
 import { Mail } from "lucide-react";
 import { pullEnv } from "@app/lib/pullEnv";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { idp } from "@server/db";
+import { LoginFormIDP } from "@app/components/LoginForm";
+import { priv } from "@app/lib/api";
+import { AxiosResponse } from "axios";
+import { ListIdpsResponse } from "@server/routers/idp";
 import { getTranslations } from "next-intl/server";
 import { build } from "@server/build";
 import { LoadLoginPageResponse } from "@server/routers/loginPage/types";
-import { Card, CardContent } from "@app/components/ui/card";
-import LoginCardHeader from "@app/components/LoginCardHeader";
-import { priv } from "@app/lib/api";
-import { AxiosResponse } from "axios";
-import { LoginFormIDP } from "@app/components/LoginForm";
-import { ListIdpsResponse } from "@server/routers/idp";
 
 export const dynamic = "force-dynamic";
 
@@ -72,57 +69,22 @@ export default async function Page(props: {
         searchParams.redirect = redirectUrl;
     }
 
-    // Only use SmartLoginForm if NOT (OSS build OR org-only IdP enabled)
-    const useSmartLogin =
-        build === "saas" || (build === "enterprise" && env.flags.useOrgOnlyIdp);
-
     let loginIdps: LoginFormIDP[] = [];
-    if (!useSmartLogin) {
-        // Load IdPs for DashboardLoginForm (OSS or org-only IdP mode)
-        if (build === "oss" || !env.flags.useOrgOnlyIdp) {
-            const idpsRes = await cache(
-                async () =>
-                    await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
-            )();
-            loginIdps = idpsRes.data.data.idps.map((idp) => ({
-                idpId: idp.idpId,
-                name: idp.name,
-                variant: idp.type
-            })) as LoginFormIDP[];
-        }
+    if (build !== "saas") {
+        const idpsRes = await cache(
+            async () => await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
+        )();
+        loginIdps = idpsRes.data.data.idps.map((idp) => ({
+            idpId: idp.idpId,
+            name: idp.name,
+            variant: idp.type
+        })) as LoginFormIDP[];
     }
 
     const t = await getTranslations();
 
     return (
         <>
-            {build === "saas" && (
-                <p className="text-xs text-muted-foreground text-center mb-4">
-                    {t.rich("loginLegalDisclaimer", {
-                        termsOfService: (chunks) => (
-                            <Link
-                                href="https://pangolin.net/terms-of-service.html"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                className="underline"
-                            >
-                                {chunks}
-                            </Link>
-                        ),
-                        privacyPolicy: (chunks) => (
-                            <Link
-                                href="https://pangolin.net/privacy-policy.html"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                className="underline"
-                            >
-                                {chunks}
-                            </Link>
-                        )
-                    })}
-                </p>
-            )}
-
             {isInvite && (
                 <div className="border rounded-md p-3 mb-4 bg-card">
                     <div className="flex flex-col items-center">
@@ -137,36 +99,11 @@ export default async function Page(props: {
                 </div>
             )}
 
-            {useSmartLogin ? (
-                <>
-                    <Card className="w-full max-w-md">
-                        <LoginCardHeader
-                            subtitle={
-                                forceLogin
-                                    ? t("loginRequiredForDevice")
-                                    : t("loginStart")
-                            }
-                        />
-                        <CardContent className="pt-6">
-                            <SmartLoginForm
-                                redirect={redirectUrl}
-                                forceLogin={forceLogin}
-                            />
-                        </CardContent>
-                    </Card>
-                </>
-            ) : (
-                <DashboardLoginForm
-                    redirect={redirectUrl}
-                    idps={loginIdps}
-                    forceLogin={forceLogin}
-                    showOrgLogin={
-                        !isInvite &&
-                        (build === "saas" || env.flags.useOrgOnlyIdp)
-                    }
-                    searchParams={searchParams}
-                />
-            )}
+            <DashboardLoginForm
+                redirect={redirectUrl}
+                idps={loginIdps}
+                forceLogin={forceLogin}
+            />
 
             {(!signUpDisabled || isInvite) && (
                 <p className="text-center text-muted-foreground mt-4">
@@ -184,12 +121,16 @@ export default async function Page(props: {
                 </p>
             )}
 
-            {!isInvite && (build === "saas" || env.flags.useOrgOnlyIdp) ? (
-                <OrgSignInLink
-                    href={`/auth/org${buildQueryString(searchParams)}`}
-                    linkText={t("orgAuthSignInToOrg")}
-                    descriptionText={t("needToSignInToOrg")}
-                />
+            {!isInvite && build === "saas" ? (
+                <div className="text-center text-muted-foreground mt-12 flex flex-col items-center">
+                    <span>{t("needToSignInToOrg")}</span>
+                    <Link
+                        href={`/auth/org${buildQueryString(searchParams)}`}
+                        className="underline"
+                    >
+                        {t("orgAuthSignInToOrg")}
+                    </Link>
+                </div>
             ) : null}
         </>
     );

src/app/auth/org/[orgId]/page.tsx

@@ -11,7 +11,6 @@ import {
 } from "@server/routers/loginPage/types";
 import { redirect } from "next/navigation";
 import OrgLoginPage from "@app/components/OrgLoginPage";
-import { pullEnv } from "@app/lib/pullEnv";
 
 export const dynamic = "force-dynamic";
 
@@ -22,9 +21,7 @@ export default async function OrgAuthPage(props: {
     const searchParams = await props.searchParams;
     const params = await props.params;
 
-    const env = pullEnv();
-
-    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
+    if (build !== "saas") {
         const queryString = new URLSearchParams(searchParams as any).toString();
         redirect(`/auth/login${queryString ? `?${queryString}` : ""}`);
     }
@@ -53,25 +50,29 @@ export default async function OrgAuthPage(props: {
     } catch (e) {}
 
     let loginIdps: LoginFormIDP[] = [];
-    const idpsRes = await priv.get<AxiosResponse<ListOrgIdpsResponse>>(
-        `/org/${orgId}/idp`
-    );
+    if (build === "saas") {
+        const idpsRes = await priv.get<AxiosResponse<ListOrgIdpsResponse>>(
+            `/org/${orgId}/idp`
+        );
 
-    loginIdps = idpsRes.data.data.idps.map((idp) => ({
-        idpId: idp.idpId,
-        name: idp.name,
-        variant: idp.variant
-    })) as LoginFormIDP[];
+        loginIdps = idpsRes.data.data.idps.map((idp) => ({
+            idpId: idp.idpId,
+            name: idp.name,
+            variant: idp.variant
+        })) as LoginFormIDP[];
+    }
 
     let branding: LoadLoginPageBrandingResponse | null = null;
-    try {
-        const res = await priv.get<
-            AxiosResponse<LoadLoginPageBrandingResponse>
-        >(`/login-page-branding?orgId=${orgId}`);
-        if (res.status === 200) {
-            branding = res.data.data;
-        }
-    } catch (error) {}
+    if (build === "saas") {
+        try {
+            const res = await priv.get<
+                AxiosResponse<LoadLoginPageBrandingResponse>
+            >(`/login-page-branding?orgId=${orgId}`);
+            if (res.status === 200) {
+                branding = res.data.data;
+            }
+        } catch (error) {}
+    }
 
     return (
         <OrgLoginPage

src/app/auth/org/page.tsx

@@ -33,12 +33,12 @@ export default async function OrgAuthPage(props: {
     const forceLoginParam = searchParams.forceLogin;
     const forceLogin = forceLoginParam === "true";
 
-    const env = pullEnv();
-
-    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
+    if (build !== "saas") {
         redirect("/");
     }
 
+    const env = pullEnv();
+
     const authHeader = await authCookieHeader();
 
     if (searchParams.token) {

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -204,7 +204,7 @@ export default async function ResourceAuthPage(props: {
     }
 
     let loginIdps: LoginFormIDP[] = [];
-    if (build === "saas" || env.flags.useOrgOnlyIdp) {
+    if (build === "saas") {
         if (subscribed) {
             const idpsRes = await cache(
                 async () =>

src/app/auth/signup/page.tsx

@@ -14,7 +14,6 @@ export default async function Page(props: {
     searchParams: Promise<{
         redirect: string | undefined;
         email: string | undefined;
-        fromSmartLogin: string | undefined;
     }>;
 }) {
     const searchParams = await props.searchParams;
@@ -74,7 +73,6 @@ export default async function Page(props: {
                 inviteToken={inviteToken}
                 inviteId={inviteId}
                 emailParam={searchParams.email}
-                fromSmartLogin={searchParams.fromSmartLogin === "true"}
             />
 
             <p className="text-center text-muted-foreground mt-4">

src/app/globals.css

@@ -21,7 +21,6 @@
     --accent: oklch(0.967 0.001 286.375);
     --accent-foreground: oklch(0.21 0.006 285.885);
     --destructive: oklch(0.577 0.245 27.325);
-    --destructive-foreground: oklch(0.985 0 0);
     --border: oklch(0.91 0.004 286.32);
     --input: oklch(0.92 0.004 286.32);
     --ring: oklch(0.705 0.213 47.604);
@@ -56,7 +55,6 @@
     --accent: oklch(0.274 0.006 286.033);
     --accent-foreground: oklch(0.985 0 0);
     --destructive: oklch(0.5382 0.1949 22.216);
-    --destructive-foreground: oklch(0.985 0 0);
     --border: oklch(1 0 0 / 13%);
     --input: oklch(1 0 0 / 18%);
     --ring: oklch(0.646 0.222 41.116);

src/app/navigation.tsx

@@ -1,28 +1,27 @@
 import { SidebarNavItem } from "@app/components/SidebarNav";
-import { Env } from "@app/lib/types/env";
 import { build } from "@server/build";
 import {
-    ChartLine,
-    Combine,
-    CreditCard,
-    Fingerprint,
-    Globe,
-    GlobeLock,
-    KeyRound,
-    Laptop,
-    Link as LinkIcon,
-    Logs, // Added from 'dev' branch
-    MonitorUp,
-    ReceiptText,
-    ScanEye, // Added from 'dev' branch
-    Server,
     Settings,
-    SquareMousePointer,
+    Users,
+    Link as LinkIcon,
+    Waypoints,
+    Combine,
+    Fingerprint,
+    KeyRound,
     TicketCheck,
     User,
-    UserCog,
-    Users,
-    Waypoints
+    Globe, // Added from 'dev' branch
+    MonitorUp, // Added from 'dev' branch
+    Server,
+    ReceiptText,
+    CreditCard,
+    Logs,
+    SquareMousePointer,
+    ScanEye,
+    GlobeLock,
+    Smartphone,
+    Laptop,
+    ChartLine
 } from "lucide-react";
 
 export type SidebarNavSection = {
@@ -40,7 +39,7 @@ export const orgLangingNavItems: SidebarNavItem[] = [
     }
 ];
 
-export const orgNavSections = (env?: Env): SidebarNavSection[] => [
+export const orgNavSections = (): SidebarNavSection[] => [
     {
         heading: "sidebarGeneral",
         items: [
@@ -93,7 +92,8 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
                       {
                           title: "sidebarRemoteExitNodes",
                           href: "/{orgId}/settings/remote-exit-nodes",
-                          icon: <Server className="size-4 flex-none" />
+                          icon: <Server className="size-4 flex-none" />,
+                          showEE: true
                       }
                   ]
                 : [])
@@ -123,21 +123,13 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/{orgId}/settings/access/roles",
                 icon: <Users className="size-4 flex-none" />
             },
-            ...(build === "saas" || env?.flags.useOrgOnlyIdp
+            ...(build == "saas"
                 ? [
                       {
                           title: "sidebarIdentityProviders",
                           href: "/{orgId}/settings/idp",
-                          icon: <Fingerprint className="size-4 flex-none" />
-                      }
-                  ]
-                : []),
-            ...(build !== "oss"
-                ? [
-                      {
-                          title: "sidebarApprovals",
-                          href: "/{orgId}/settings/access/approvals",
-                          icon: <UserCog className="size-4 flex-none" />
+                          icon: <Fingerprint className="size-4 flex-none" />,
+                          showEE: true
                       }
                   ]
                 : []),
@@ -236,7 +228,7 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
     }
 ];
 
-export const adminNavSections = (env?: Env): SidebarNavSection[] => [
+export const adminNavSections: SidebarNavSection[] = [
     {
         heading: "sidebarAdmin",
         items: [
@@ -250,15 +242,11 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/admin/api-keys",
                 icon: <KeyRound className="size-4 flex-none" />
             },
-            ...(build === "oss" || !env?.flags.useOrgOnlyIdp
-                ? [
-                      {
-                          title: "sidebarIdentityProviders",
-                          href: "/admin/idp",
-                          icon: <Fingerprint className="size-4 flex-none" />
-                      }
-                  ]
-                : []),
+            {
+                title: "sidebarIdentityProviders",
+                href: "/admin/idp",
+                icon: <Fingerprint className="size-4 flex-none" />
+            },
             ...(build == "enterprise"
                 ? [
                       {

src/components/ApprovalFeed.tsx

@@ -1,243 +0,0 @@
-"use client";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { cn } from "@app/lib/cn";
-import {
-    approvalFiltersSchema,
-    approvalQueries,
-    type ApprovalItem
-} from "@app/lib/queries";
-import { useQuery } from "@tanstack/react-query";
-import { ArrowRight, Ban, Check, LaptopMinimal, RefreshCw } from "lucide-react";
-import { useTranslations } from "next-intl";
-import Link from "next/link";
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
-import { Fragment, useActionState } from "react";
-import { Badge } from "./ui/badge";
-import { Button } from "./ui/button";
-import { Card, CardHeader } from "./ui/card";
-import { Label } from "./ui/label";
-import {
-    Select,
-    SelectContent,
-    SelectItem,
-    SelectTrigger,
-    SelectValue
-} from "./ui/select";
-import { Separator } from "./ui/separator";
-
-export type ApprovalFeedProps = {
-    orgId: string;
-};
-
-export function ApprovalFeed({ orgId }: ApprovalFeedProps) {
-    const searchParams = useSearchParams();
-    const path = usePathname();
-    const t = useTranslations();
-
-    const router = useRouter();
-
-    const filters = approvalFiltersSchema.parse(
-        Object.fromEntries(searchParams.entries())
-    );
-
-    const { data, isFetching, refetch } = useQuery(
-        approvalQueries.listApprovals(orgId, filters)
-    );
-
-    const approvals = data?.approvals ?? [];
-
-    return (
-        <div className="flex flex-col gap-5">
-            <Card className="">
-                <CardHeader className="flex flex-col sm:flex-row sm:items-end lg:items-end gap-2 ">
-                    <div className="flex flex-col items-start gap-2 w-48 mb-0">
-                        <Label htmlFor="approvalState">
-                            {t("filterByApprovalState")}
-                        </Label>
-                        <Select
-                            onValueChange={(newValue) => {
-                                const newSearch = new URLSearchParams(
-                                    searchParams
-                                );
-                                newSearch.set("approvalState", newValue);
-
-                                router.replace(
-                                    `${path}?${newSearch.toString()}`
-                                );
-                            }}
-                            value={filters.approvalState ?? "all"}
-                        >
-                            <SelectTrigger
-                                id="approvalState"
-                                className="w-full"
-                            >
-                                <SelectValue
-                                    placeholder={t("selectApprovalState")}
-                                />
-                            </SelectTrigger>
-                            <SelectContent className="w-full">
-                                <SelectItem value="pending">
-                                    {t("pending")}
-                                </SelectItem>
-                                <SelectItem value="approved">
-                                    {t("approved")}
-                                </SelectItem>
-                                <SelectItem value="denied">
-                                    {t("denied")}
-                                </SelectItem>
-                                <SelectItem value="all">{t("all")}</SelectItem>
-                            </SelectContent>
-                        </Select>
-                    </div>
-
-                    <Button
-                        variant="outline"
-                        onClick={() => {
-                            refetch();
-                        }}
-                        disabled={isFetching}
-                        className="lg:static gap-2"
-                    >
-                        <RefreshCw
-                            className={cn(
-                                "size-4",
-                                isFetching && "animate-spin"
-                            )}
-                        />
-                        {t("refresh")}
-                    </Button>
-                </CardHeader>
-            </Card>
-            <Card>
-                <CardHeader>
-                    <ul className="flex flex-col gap-4">
-                        {approvals.map((approval, index) => (
-                            <Fragment key={approval.approvalId}>
-                                <li>
-                                    <ApprovalRequest
-                                        approval={approval}
-                                        orgId={orgId}
-                                        onSuccess={() => refetch()}
-                                    />
-                                </li>
-                                {index < approvals.length - 1 && <Separator />}
-                            </Fragment>
-                        ))}
-
-                        {approvals.length === 0 && (
-                            <li className="flex justify-center items-center p-4 text-muted-foreground">
-                                {t("approvalListEmpty")}
-                            </li>
-                        )}
-                    </ul>
-                </CardHeader>
-            </Card>
-        </div>
-    );
-}
-
-type ApprovalRequestProps = {
-    approval: ApprovalItem;
-    orgId: string;
-    onSuccess?: () => void;
-};
-
-function ApprovalRequest({ approval, orgId, onSuccess }: ApprovalRequestProps) {
-    const t = useTranslations();
-
-    const [_, formAction, isSubmitting] = useActionState(onSubmit, null);
-    const api = createApiClient(useEnvContext());
-
-    async function onSubmit(_previousState: any, formData: FormData) {
-        const decision = formData.get("decision");
-        const res = await api
-            .put(`/org/${orgId}/approvals/${approval.approvalId}`, { decision })
-            .catch((e) => {
-                toast({
-                    variant: "destructive",
-                    title: t("accessApprovalErrorUpdate"),
-                    description: formatAxiosError(
-                        e,
-                        t("accessApprovalErrorUpdateDescription")
-                    )
-                });
-            });
-        if (res && res.status === 200) {
-            const result = res.data.data;
-            toast({
-                variant: "default",
-                title: t("accessApprovalUpdated"),
-                description:
-                    result.decision === "approved"
-                        ? t("accessApprovalApprovedDescription")
-                        : t("accessApprovalDeniedDescription")
-            });
-
-            onSuccess?.();
-        }
-    }
-
-    return (
-        <div className="flex items-center justify-between gap-4 flex-wrap">
-            <div className="inline-flex items-start md:items-center gap-2">
-                <LaptopMinimal className="size-4 text-muted-foreground flex-none relative top-2 sm:top-0" />
-                <span>
-                    <span className="text-primary">
-                        {approval.user.username}
-                    </span>
-                    &nbsp;
-                    {approval.type === "user_device" && (
-                        <span>{t("requestingNewDeviceApproval")}</span>
-                    )}
-                </span>
-            </div>
-            <div className="inline-flex gap-2">
-                {approval.decision === "pending" && (
-                    <form action={formAction} className="inline-flex gap-2">
-                        <Button
-                            value="approved"
-                            name="decision"
-                            className="gap-2"
-                            type="submit"
-                            loading={isSubmitting}
-                        >
-                            <Check className="size-4 flex-none" />
-                            {t("approve")}
-                        </Button>
-                        <Button
-                            value="denied"
-                            name="decision"
-                            variant="destructive"
-                            className="gap-2"
-                            type="submit"
-                            loading={isSubmitting}
-                        >
-                            <Ban className="size-4 flex-none" />
-                            {t("deny")}
-                        </Button>
-                    </form>
-                )}
-                {approval.decision === "approved" && (
-                    <Badge variant="green">{t("approved")}</Badge>
-                )}
-                {approval.decision === "denied" && (
-                    <Badge variant="red">{t("denied")}</Badge>
-                )}
-
-                <Button
-                    variant="outline"
-                    onClick={() => {}}
-                    className="gap-2"
-                    asChild
-                >
-                    <Link href={"#"}>
-                        {t("viewDetails")}
-                        <ArrowRight className="size-4 flex-none" />
-                    </Link>
-                </Button>
-            </div>
-        </div>
-    );
-}

src/components/AuthPageBrandingForm.tsx

@@ -118,7 +118,6 @@ export default function AuthPageBrandingForm({
         const brandingData = form.getValues();
 
         if (!isValid || !isPaidUser) return;
-
         try {
             const updateRes = await api.put(
                 `/org/${orgId}/login-page-branding`,
@@ -290,8 +289,7 @@ export default function AuthPageBrandingForm({
                                     </div>
                                 </div>
 
-                                {build === "saas" ||
-                                env.env.flags.useOrgOnlyIdp ? (
+                                {build === "saas" && (
                                     <>
                                         <div className="mt-3 mb-6">
                                             <SettingsSectionTitle>
@@ -345,7 +343,7 @@ export default function AuthPageBrandingForm({
                                             />
                                         </div>
                                     </>
-                                ) : null}
+                                )}
 
                                 <div className="mt-3 mb-6">
                                     <SettingsSectionTitle>

src/components/CreateRoleForm.tsx

@@ -1,5 +1,21 @@
 "use client";
 
+import { Button } from "@app/components/ui/button";
+import {
+    Form,
+    FormControl,
+    FormField,
+    FormItem,
+    FormLabel,
+    FormMessage
+} from "@app/components/ui/form";
+import { Input } from "@app/components/ui/input";
+import { toast } from "@app/hooks/useToast";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { AxiosResponse } from "axios";
+import { useState } from "react";
+import { useForm } from "react-hook-form";
+import { z } from "zod";
 import {
     Credenza,
     CredenzaBody,
@@ -10,37 +26,17 @@ import {
     CredenzaHeader,
     CredenzaTitle
 } from "@app/components/Credenza";
-import { Button } from "@app/components/ui/button";
-import {
-    Form,
-    FormControl,
-    FormDescription,
-    FormField,
-    FormItem,
-    FormLabel,
-    FormMessage
-} from "@app/components/ui/form";
-import { Input } from "@app/components/ui/input";
-import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useOrgContext } from "@app/hooks/useOrgContext";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { build } from "@server/build";
-import type { CreateRoleBody, CreateRoleResponse } from "@server/routers/role";
-import { AxiosResponse } from "axios";
+import { CreateRoleBody, CreateRoleResponse } from "@server/routers/role";
+import { formatAxiosError } from "@app/lib/api";
+import { createApiClient } from "@app/lib/api";
+import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useTranslations } from "next-intl";
-import { useTransition } from "react";
-import { useForm } from "react-hook-form";
-import { z } from "zod";
-import { PaidFeaturesAlert } from "./PaidFeaturesAlert";
-import { CheckboxWithLabel } from "./ui/checkbox";
 
 type CreateRoleFormProps = {
     open: boolean;
     setOpen: (open: boolean) => void;
-    afterCreate?: (res: CreateRoleResponse) => void;
+    afterCreate?: (res: CreateRoleResponse) => Promise<void>;
 };
 
 export default function CreateRoleForm({
@@ -50,35 +46,35 @@ export default function CreateRoleForm({
 }: CreateRoleFormProps) {
     const { org } = useOrgContext();
     const t = useTranslations();
-    const { isPaidUser } = usePaidStatus();
 
     const formSchema = z.object({
-        name: z
-            .string({ message: t("nameRequired") })
-            .min(1)
-            .max(32),
-        description: z.string().max(255).optional(),
-        requireDeviceApproval: z.boolean().optional()
+        name: z.string({ message: t("nameRequired") }).max(32),
+        description: z.string().max(255).optional()
     });
 
+    const [loading, setLoading] = useState(false);
+
     const api = createApiClient(useEnvContext());
 
     const form = useForm<z.infer<typeof formSchema>>({
         resolver: zodResolver(formSchema),
         defaultValues: {
             name: "",
-            description: "",
-            requireDeviceApproval: false
+            description: ""
         }
     });
 
-    const [loading, startTransition] = useTransition();
-
     async function onSubmit(values: z.infer<typeof formSchema>) {
+        setLoading(true);
+
         const res = await api
-            .put<
-                AxiosResponse<CreateRoleResponse>
-            >(`/org/${org?.org.orgId}/role`, values satisfies CreateRoleBody)
+            .put<AxiosResponse<CreateRoleResponse>>(
+                `/org/${org?.org.orgId}/role`,
+                {
+                    name: values.name,
+                    description: values.description
+                } as CreateRoleBody
+            )
             .catch((e) => {
                 toast({
                     variant: "destructive",
@@ -101,8 +97,12 @@ export default function CreateRoleForm({
                 setOpen(false);
             }
 
-            afterCreate?.(res.data.data);
+            if (afterCreate) {
+                afterCreate(res.data.data);
+            }
         }
+
+        setLoading(false);
     }
 
     return (
@@ -111,6 +111,7 @@ export default function CreateRoleForm({
                 open={open}
                 onOpenChange={(val) => {
                     setOpen(val);
+                    setLoading(false);
                     form.reset();
                 }}
             >
@@ -124,9 +125,7 @@ export default function CreateRoleForm({
                     <CredenzaBody>
                         <Form {...form}>
                             <form
-                                onSubmit={form.handleSubmit((values) =>
-                                    startTransition(() => onSubmit(values))
-                                )}
+                                onSubmit={form.handleSubmit(onSubmit)}
                                 className="space-y-4"
                                 id="create-role-form"
                             >
@@ -160,56 +159,6 @@ export default function CreateRoleForm({
                                         </FormItem>
                                     )}
                                 />
-                                {build !== "oss" && (
-                                    <div className="pt-3">
-                                        <PaidFeaturesAlert />
-
-                                        <FormField
-                                            control={form.control}
-                                            name="requireDeviceApproval"
-                                            render={({ field }) => (
-                                                <FormItem className="my-2">
-                                                    <FormControl>
-                                                        <CheckboxWithLabel
-                                                            {...field}
-                                                            disabled={
-                                                                !isPaidUser
-                                                            }
-                                                            value="on"
-                                                            checked={form.watch(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                            onCheckedChange={(
-                                                                checked
-                                                            ) => {
-                                                                if (
-                                                                    checked !==
-                                                                    "indeterminate"
-                                                                ) {
-                                                                    form.setValue(
-                                                                        "requireDeviceApproval",
-                                                                        checked
-                                                                    );
-                                                                }
-                                                            }}
-                                                            label={t(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                        />
-                                                    </FormControl>
-
-                                                    <FormDescription>
-                                                        {t(
-                                                            "requireDeviceApprovalDescription"
-                                                        )}
-                                                    </FormDescription>
-
-                                                    <FormMessage />
-                                                </FormItem>
-                                            )}
-                                        />
-                                    </div>
-                                )}
                             </form>
                         </Form>
                     </CredenzaBody>

src/components/Credenza.tsx

@@ -2,6 +2,8 @@
 
 import * as React from "react";
 
+import { cn } from "@app/lib/cn";
+import { useMediaQuery } from "@app/hooks/useMediaQuery";
 import {
     Dialog,
     DialogClose,
@@ -12,9 +14,16 @@ import {
     DialogTitle,
     DialogTrigger
 } from "@/components/ui/dialog";
-import { DrawerClose } from "@/components/ui/drawer";
-import { useMediaQuery } from "@app/hooks/useMediaQuery";
-import { cn } from "@app/lib/cn";
+import {
+    Drawer,
+    DrawerClose,
+    DrawerContent,
+    DrawerDescription,
+    DrawerFooter,
+    DrawerHeader,
+    DrawerTitle,
+    DrawerTrigger
+} from "@/components/ui/drawer";
 import {
     Sheet,
     SheetContent,
@@ -69,7 +78,10 @@ const CredenzaClose = ({ className, children, ...props }: CredenzaProps) => {
     const CredenzaClose = isDesktop ? DialogClose : DrawerClose;
 
     return (
-        <CredenzaClose className={cn("", className)} {...props}>
+        <CredenzaClose
+            className={cn("mb-3 mt-3 md:mt-0 md:mb-0", className)}
+            {...props}
+        >
             {children}
         </CredenzaClose>
     );
@@ -160,13 +172,14 @@ const CredenzaBody = ({ className, children, ...props }: CredenzaProps) => {
 
 const CredenzaFooter = ({ className, children, ...props }: CredenzaProps) => {
     const isDesktop = useMediaQuery(desktop);
+    // const isDesktop = true;
 
     const CredenzaFooter = isDesktop ? DialogFooter : SheetFooter;
 
     return (
         <CredenzaFooter
             className={cn(
-                "mt-8 md:mt-0 -mx-6 px-6 py-4 border-t border-border",
+                "mt-8 md:mt-0 -mx-6 px-6 pt-4 border-t border-border",
                 className
             )}
             {...props}
@@ -178,12 +191,12 @@ const CredenzaFooter = ({ className, children, ...props }: CredenzaProps) => {
 
 export {
     Credenza,
-    CredenzaBody,
+    CredenzaTrigger,
     CredenzaClose,
     CredenzaContent,
     CredenzaDescription,
-    CredenzaFooter,
     CredenzaHeader,
     CredenzaTitle,
-    CredenzaTrigger
+    CredenzaBody,
+    CredenzaFooter
 };

src/components/DashboardLoginForm.tsx

@@ -17,26 +17,17 @@ import { cleanRedirect } from "@app/lib/cleanRedirect";
 import BrandingLogo from "@app/components/BrandingLogo";
 import { useTranslations } from "next-intl";
 import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import Link from "next/link";
-import { Button } from "./ui/button";
-import { ArrowRight } from "lucide-react";
 
 type DashboardLoginFormProps = {
     redirect?: string;
     idps?: LoginFormIDP[];
     forceLogin?: boolean;
-    showOrgLogin?: boolean;
-    searchParams?: {
-        [key: string]: string | string[] | undefined;
-    };
 };
 
 export default function DashboardLoginForm({
     redirect,
     idps,
-    forceLogin,
-    showOrgLogin,
-    searchParams
+    forceLogin
 }: DashboardLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -44,9 +35,6 @@ export default function DashboardLoginForm({
     const { isUnlocked } = useLicenseStatusContext();
 
     function getSubtitle() {
-        if (forceLogin) {
-            return t("loginRequiredForDevice");
-        }
         if (isUnlocked() && env.branding?.loginPage?.subtitleText) {
             return env.branding.loginPage.subtitleText;
         }

src/components/DeviceLoginForm.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useEffect, useCallback } from "react";
+import { useState } from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import * as z from "zod";
@@ -13,13 +13,7 @@ import {
     FormLabel,
     FormMessage
 } from "@/components/ui/form";
-import {
-    Card,
-    CardContent,
-    CardHeader,
-    CardTitle,
-    CardDescription
-} from "@/components/ui/card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Alert, AlertDescription } from "@/components/ui/alert";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
@@ -31,12 +25,12 @@ import {
     InputOTPSlot
 } from "@/components/ui/input-otp";
 import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
-import { AlertTriangle, Loader2 } from "lucide-react";
+import { AlertTriangle } from "lucide-react";
 import { DeviceAuthConfirmation } from "@/components/DeviceAuthConfirmation";
 import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
 import BrandingLogo from "./BrandingLogo";
 import { useTranslations } from "next-intl";
-import UserProfileCard from "@/components/UserProfileCard";
+import { Avatar, AvatarFallback } from "@/components/ui/avatar";
 
 const createFormSchema = (t: (key: string) => string) =>
     z.object({
@@ -67,8 +61,6 @@ export default function DeviceLoginForm({
     const api = createApiClient({ env });
     const [error, setError] = useState<string | null>(null);
     const [loading, setLoading] = useState(false);
-    const [validatingInitialCode, setValidatingInitialCode] = useState(false);
-    const [verifyingInitialCode, setVerifyingInitialCode] = useState(false);
     const [metadata, setMetadata] = useState<DeviceAuthMetadata | null>(null);
     const [code, setCode] = useState<string>("");
     const { isUnlocked } = useLicenseStatusContext();
@@ -83,87 +75,40 @@ export default function DeviceLoginForm({
         }
     });
 
-    const validateCode = useCallback(
-        async (codeToValidate: string, skipConfirmation = false) => {
-            setError(null);
-            setLoading(true);
-
-            try {
-                // split code and add dash if missing
-                let formattedCode = codeToValidate;
-                if (
-                    !formattedCode.includes("-") &&
-                    formattedCode.length === 8
-                ) {
-                    formattedCode =
-                        formattedCode.slice(0, 4) +
-                        "-" +
-                        formattedCode.slice(4);
-                }
-
-                // First check - get metadata
-                const res = await api.post(
-                    "/device-web-auth/verify?forceLogin=true",
-                    {
-                        code: formattedCode.toUpperCase(),
-                        verify: false
-                    }
-                );
-
-                if (res.data.success && res.data.data.metadata) {
-                    setCode(formattedCode.toUpperCase());
-
-                    // If skipping confirmation (initial code), go straight to verify
-                    if (skipConfirmation) {
-                        setVerifyingInitialCode(true);
-                        try {
-                            await api.post("/device-web-auth/verify", {
-                                code: formattedCode.toUpperCase(),
-                                verify: true
-                            });
-                            router.push("/auth/login/device/success");
-                        } catch (e: any) {
-                            const errorMessage = formatAxiosError(e);
-                            setError(
-                                errorMessage || t("deviceCodeVerifyFailed")
-                            );
-                            setVerifyingInitialCode(false);
-                            return false;
-                        }
-                        return true;
-                    } else {
-                        setMetadata(res.data.data.metadata);
-                        return true;
-                    }
-                } else {
-                    setError(t("deviceCodeInvalidOrExpired"));
-                    return false;
-                }
-            } catch (e: any) {
-                const errorMessage = formatAxiosError(e);
-                setError(errorMessage || t("deviceCodeInvalidOrExpired"));
-                return false;
-            } finally {
-                setLoading(false);
-            }
-        },
-        [api, t, router]
-    );
-
     async function onSubmit(data: z.infer<typeof formSchema>) {
-        await validateCode(data.code);
-    }
+        setError(null);
+        setLoading(true);
 
-    // Auto-validate initial code if provided
-    useEffect(() => {
-        const cleanedInitialCode = initialCode.replace(/-/g, "").toUpperCase();
-        if (cleanedInitialCode && cleanedInitialCode.length === 8) {
-            setValidatingInitialCode(true);
-            validateCode(cleanedInitialCode, false).finally(() => {
-                setValidatingInitialCode(false);
-            });
+        try {
+            // split code and add dash if missing
+            if (!data.code.includes("-") && data.code.length === 8) {
+                data.code = data.code.slice(0, 4) + "-" + data.code.slice(4);
+            }
+
+            await new Promise((resolve) => setTimeout(resolve, 300));
+
+            // First check - get metadata
+            const res = await api.post(
+                "/device-web-auth/verify?forceLogin=true",
+                {
+                    code: data.code.toUpperCase(),
+                    verify: false
+                }
+            );
+
+            if (res.data.success && res.data.data.metadata) {
+                setMetadata(res.data.data.metadata);
+                setCode(data.code.toUpperCase());
+            } else {
+                setError(t("deviceCodeInvalidOrExpired"));
+            }
+        } catch (e: any) {
+            const errorMessage = formatAxiosError(e);
+            setError(errorMessage || t("deviceCodeInvalidOrExpired"));
+        } finally {
+            setLoading(false);
         }
-    }, [initialCode, validateCode]);
+    }
 
     async function onConfirm() {
         if (!code || !metadata) return;
@@ -172,6 +117,8 @@ export default function DeviceLoginForm({
         setLoading(true);
 
         try {
+            await new Promise((resolve) => setTimeout(resolve, 300));
+
             // Final verify
             await api.post("/device-web-auth/verify", {
                 code: code,
@@ -206,6 +153,9 @@ export default function DeviceLoginForm({
     }
 
     const profileLabel = (userName || userEmail || "").trim();
+    const profileInitial = profileLabel
+        ? profileLabel.charAt(0).toUpperCase()
+        : "?";
 
     async function handleUseDifferentAccount() {
         try {
@@ -226,39 +176,6 @@ export default function DeviceLoginForm({
         }
     }
 
-    // Show loading state while validating/verifying initial code
-    if (validatingInitialCode || verifyingInitialCode) {
-        return (
-            <div className="flex items-center justify-center">
-                <Card className="w-full max-w-md">
-                    <CardHeader>
-                        <CardTitle>{t("deviceActivation")}</CardTitle>
-                        <CardDescription>
-                            {validatingInitialCode
-                                ? t("deviceCodeValidating")
-                                : t("deviceCodeVerifying")}
-                        </CardDescription>
-                    </CardHeader>
-                    <CardContent className="flex flex-col items-center space-y-4">
-                        <div className="flex items-center space-x-2">
-                            <Loader2 className="h-5 w-5 animate-spin" />
-                            <span>
-                                {validatingInitialCode
-                                    ? t("deviceCodeValidating")
-                                    : t("deviceCodeVerifying")}
-                            </span>
-                        </div>
-                        {error && (
-                            <Alert variant="destructive" className="w-full">
-                                <AlertDescription>{error}</AlertDescription>
-                            </Alert>
-                        )}
-                    </CardContent>
-                </Card>
-            </div>
-        );
-    }
-
     if (metadata) {
         return (
             <DeviceAuthConfirmation
@@ -282,17 +199,32 @@ export default function DeviceLoginForm({
                     </p>
                 </div>
             </CardHeader>
-            <CardContent className="pt-6 space-y-4">
-                <UserProfileCard
-                    identifier={profileLabel || userEmail}
-                    description={t(
-                        "deviceLoginDeviceRequestingAccessToAccount"
-                    )}
-                    onUseDifferentAccount={handleUseDifferentAccount}
-                    useDifferentAccountText={t(
-                        "deviceLoginUseDifferentAccount"
-                    )}
-                />
+            <CardContent className="pt-6">
+                <div className="flex items-center gap-3 p-3 mb-4 border rounded-md">
+                    <Avatar className="h-10 w-10">
+                        <AvatarFallback>{profileInitial}</AvatarFallback>
+                    </Avatar>
+                    <div className="flex-1 space-y-1">
+                        <div>
+                            <p className="text-sm font-medium">
+                                {profileLabel || userEmail}
+                            </p>
+                            <p className="text-xs text-muted-foreground break-all">
+                                {t(
+                                    "deviceLoginDeviceRequestingAccessToAccount"
+                                )}
+                            </p>
+                        </div>
+                        <Button
+                            type="button"
+                            variant="link"
+                            className="h-auto px-0 text-xs"
+                            onClick={handleUseDifferentAccount}
+                        >
+                            {t("deviceLoginUseDifferentAccount")}
+                        </Button>
+                    </div>
+                </div>
 
                 <Form {...form}>
                     <form

src/components/DismissableBanner.tsx

@@ -71,10 +71,10 @@ export const DismissableBanner = ({
     }
 
     return (
-        <Card className="mb-6 relative border-primary/30 bg-linear-to-br from-primary/10 via-background to-background overflow-hidden">
+        <Card className="mb-6 relative border-primary/30 bg-gradient-to-br from-primary/10 via-background to-background overflow-hidden">
             <button
                 onClick={handleDismiss}
-                className="absolute top-3 right-3 z-10 p-1.5 rounded-md hover:bg-background/80 transition-colors cursor-pointer"
+                className="absolute top-3 right-3 z-10 p-1.5 rounded-md hover:bg-background/80 transition-colors"
                 aria-label={t("dismiss")}
             >
                 <X className="w-4 h-4 text-muted-foreground" />
@@ -91,7 +91,7 @@ export const DismissableBanner = ({
                         </p>
                     </div>
                     {children && (
-                        <div className="flex flex-wrap gap-3 lg:shrink-0 lg:justify-end">
+                        <div className="flex flex-wrap gap-3 lg:flex-shrink-0 lg:justify-end">
                             {children}
                         </div>
                     )}

src/components/EditRoleForm.tsx

@@ -1,241 +0,0 @@
-"use client";
-
-import {
-    Credenza,
-    CredenzaBody,
-    CredenzaClose,
-    CredenzaContent,
-    CredenzaDescription,
-    CredenzaFooter,
-    CredenzaHeader,
-    CredenzaTitle
-} from "@app/components/Credenza";
-import { Button } from "@app/components/ui/button";
-import {
-    Form,
-    FormControl,
-    FormDescription,
-    FormField,
-    FormItem,
-    FormLabel,
-    FormMessage
-} from "@app/components/ui/form";
-import { Input } from "@app/components/ui/input";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useOrgContext } from "@app/hooks/useOrgContext";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { build } from "@server/build";
-import type { Role } from "@server/db";
-import type {
-    CreateRoleBody,
-    CreateRoleResponse,
-    UpdateRoleBody,
-    UpdateRoleResponse
-} from "@server/routers/role";
-import { AxiosResponse } from "axios";
-import { useTranslations } from "next-intl";
-import { useTransition } from "react";
-import { useForm } from "react-hook-form";
-import { z } from "zod";
-import { PaidFeaturesAlert } from "./PaidFeaturesAlert";
-import { CheckboxWithLabel } from "./ui/checkbox";
-
-type CreateRoleFormProps = {
-    role: Role;
-    open: boolean;
-    setOpen: (open: boolean) => void;
-    onSuccess?: (res: CreateRoleResponse) => void;
-};
-
-export default function EditRoleForm({
-    open,
-    role,
-    setOpen,
-    onSuccess
-}: CreateRoleFormProps) {
-    const { org } = useOrgContext();
-    const t = useTranslations();
-    const { isPaidUser } = usePaidStatus();
-
-    const formSchema = z.object({
-        name: z
-            .string({ message: t("nameRequired") })
-            .min(1)
-            .max(32),
-        description: z.string().max(255).optional(),
-        requireDeviceApproval: z.boolean().optional()
-    });
-
-    const api = createApiClient(useEnvContext());
-
-    const form = useForm<z.infer<typeof formSchema>>({
-        resolver: zodResolver(formSchema),
-        defaultValues: {
-            name: role.name,
-            description: role.description ?? "",
-            requireDeviceApproval: role.requireDeviceApproval ?? false
-        }
-    });
-
-    const [loading, startTransition] = useTransition();
-
-    async function onSubmit(values: z.infer<typeof formSchema>) {
-        const res = await api
-            .post<
-                AxiosResponse<UpdateRoleResponse>
-            >(`/org/${org?.org.orgId}/role/${role.roleId}`, values satisfies UpdateRoleBody)
-            .catch((e) => {
-                toast({
-                    variant: "destructive",
-                    title: t("accessRoleErrorUpdate"),
-                    description: formatAxiosError(
-                        e,
-                        t("accessRoleErrorUpdateDescription")
-                    )
-                });
-            });
-
-        if (res && res.status === 200) {
-            toast({
-                variant: "default",
-                title: t("accessRoleUpdated"),
-                description: t("accessRoleUpdatedDescription")
-            });
-
-            if (open) {
-                setOpen(false);
-            }
-
-            onSuccess?.(res.data.data);
-        }
-    }
-
-    return (
-        <>
-            <Credenza
-                open={open}
-                onOpenChange={(val) => {
-                    setOpen(val);
-                    form.reset();
-                }}
-            >
-                <CredenzaContent>
-                    <CredenzaHeader>
-                        <CredenzaTitle>{t("accessRoleEdit")}</CredenzaTitle>
-                        <CredenzaDescription>
-                            {t("accessRoleEditDescription")}
-                        </CredenzaDescription>
-                    </CredenzaHeader>
-                    <CredenzaBody>
-                        <Form {...form}>
-                            <form
-                                onSubmit={form.handleSubmit((values) =>
-                                    startTransition(() => onSubmit(values))
-                                )}
-                                className="space-y-4"
-                                id="create-role-form"
-                            >
-                                <FormField
-                                    control={form.control}
-                                    name="name"
-                                    render={({ field }) => (
-                                        <FormItem>
-                                            <FormLabel>
-                                                {t("accessRoleName")}
-                                            </FormLabel>
-                                            <FormControl>
-                                                <Input {...field} />
-                                            </FormControl>
-                                            <FormMessage />
-                                        </FormItem>
-                                    )}
-                                />
-                                <FormField
-                                    control={form.control}
-                                    name="description"
-                                    render={({ field }) => (
-                                        <FormItem>
-                                            <FormLabel>
-                                                {t("description")}
-                                            </FormLabel>
-                                            <FormControl>
-                                                <Input {...field} />
-                                            </FormControl>
-                                            <FormMessage />
-                                        </FormItem>
-                                    )}
-                                />
-                                {build !== "oss" && (
-                                    <div className="pt-3">
-                                        <PaidFeaturesAlert />
-
-                                        <FormField
-                                            control={form.control}
-                                            name="requireDeviceApproval"
-                                            render={({ field }) => (
-                                                <FormItem className="my-2">
-                                                    <FormControl>
-                                                        <CheckboxWithLabel
-                                                            {...field}
-                                                            disabled={
-                                                                !isPaidUser
-                                                            }
-                                                            value="on"
-                                                            checked={form.watch(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                            onCheckedChange={(
-                                                                checked
-                                                            ) => {
-                                                                if (
-                                                                    checked !==
-                                                                    "indeterminate"
-                                                                ) {
-                                                                    form.setValue(
-                                                                        "requireDeviceApproval",
-                                                                        checked
-                                                                    );
-                                                                }
-                                                            }}
-                                                            label={t(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                        />
-                                                    </FormControl>
-
-                                                    <FormDescription>
-                                                        {t(
-                                                            "requireDeviceApprovalDescription"
-                                                        )}
-                                                    </FormDescription>
-
-                                                    <FormMessage />
-                                                </FormItem>
-                                            )}
-                                        />
-                                    </div>
-                                )}
-                            </form>
-                        </Form>
-                    </CredenzaBody>
-                    <CredenzaFooter>
-                        <CredenzaClose asChild>
-                            <Button variant="outline">{t("close")}</Button>
-                        </CredenzaClose>
-                        <Button
-                            type="submit"
-                            form="create-role-form"
-                            loading={loading}
-                            disabled={loading}
-                        >
-                            {t("accessRoleUpdateSubmit")}
-                        </Button>
-                    </CredenzaFooter>
-                </CredenzaContent>
-            </Credenza>
-        </>
-    );
-}

src/components/LoginCardHeader.tsx

@@ -1,33 +0,0 @@
-"use client";
-
-import BrandingLogo from "@app/components/BrandingLogo";
-import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { CardHeader } from "./ui/card";
-
-type LoginCardHeaderProps = {
-    subtitle: string;
-};
-
-export default function LoginCardHeader({ subtitle }: LoginCardHeaderProps) {
-    const { env } = useEnvContext();
-    const { isUnlocked } = useLicenseStatusContext();
-
-    const logoWidth = isUnlocked()
-        ? env.branding.logo?.authPage?.width || 175
-        : 175;
-    const logoHeight = isUnlocked()
-        ? env.branding.logo?.authPage?.height || 58
-        : 58;
-
-    return (
-        <CardHeader className="border-b">
-            <div className="flex flex-row items-center justify-center">
-                <BrandingLogo height={logoHeight} width={logoWidth} />
-            </div>
-            <div className="text-center space-y-1 pt-3">
-                <p className="text-muted-foreground">{subtitle}</p>
-            </div>
-        </CardHeader>
-    );
-}

src/components/LoginForm.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useState } from "react";
+import { useEffect, useState, useRef } from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import * as z from "zod";
@@ -23,24 +23,32 @@ import {
 } from "@app/components/ui/card";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useParams, useRouter } from "next/navigation";
-import { LockIcon } from "lucide-react";
-import SecurityKeyAuthButton from "@app/components/SecurityKeyAuthButton";
+import { LockIcon, FingerprintIcon } from "lucide-react";
 import { createApiClient } from "@app/lib/api";
+import {
+    InputOTP,
+    InputOTPGroup,
+    InputOTPSeparator,
+    InputOTPSlot
+} from "./ui/input-otp";
 import Link from "next/link";
+import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
 import Image from "next/image";
 import { GenerateOidcUrlResponse } from "@server/routers/idp";
 import { Separator } from "./ui/separator";
 import { useTranslations } from "next-intl";
+import { startAuthentication } from "@simplewebauthn/browser";
 import {
     generateOidcUrlProxy,
-    loginProxy
+    loginProxy,
+    securityKeyStartProxy,
+    securityKeyVerifyProxy
 } from "@app/actions/server";
 import { redirect as redirectTo } from "next/navigation";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 // @ts-ignore
 import { loadReoScript } from "reodotdev";
 import { build } from "@server/build";
-import MfaInputForm from "@app/components/MfaInputForm";
 
 export type LoginFormIDP = {
     idpId: number;
@@ -75,6 +83,8 @@ export default function LoginForm({
     const hasIdp = idps && idps.length > 0;
 
     const [mfaRequested, setMfaRequested] = useState(false);
+    const [showSecurityKeyPrompt, setShowSecurityKeyPrompt] = useState(false);
+    const otpContainerRef = useRef<HTMLDivElement>(null);
 
     const t = useTranslations();
     const currentHost =
@@ -103,6 +113,52 @@ export default function LoginForm({
         }
     }, []);
 
+    // Auto-focus MFA input when MFA is requested
+    useEffect(() => {
+        if (!mfaRequested) return;
+
+        const focusInput = () => {
+            // Try using the ref first
+            if (otpContainerRef.current) {
+                const hiddenInput = otpContainerRef.current.querySelector(
+                    "input"
+                ) as HTMLInputElement;
+                if (hiddenInput) {
+                    hiddenInput.focus();
+                    return;
+                }
+            }
+
+            // Fallback: query the DOM
+            const otpContainer = document.querySelector(
+                '[data-slot="input-otp"]'
+            );
+            if (!otpContainer) return;
+
+            const hiddenInput = otpContainer.querySelector(
+                "input"
+            ) as HTMLInputElement;
+            if (hiddenInput) {
+                hiddenInput.focus();
+                return;
+            }
+
+            // Last resort: click the first slot
+            const firstSlot = otpContainer.querySelector(
+                '[data-slot="input-otp-slot"]'
+            ) as HTMLElement;
+            if (firstSlot) {
+                firstSlot.click();
+            }
+        };
+
+        // Use requestAnimationFrame to wait for the next paint
+        requestAnimationFrame(() => {
+            requestAnimationFrame(() => {
+                focusInput();
+            });
+        });
+    }, [mfaRequested]);
 
     const formSchema = z.object({
         email: z.string().email({ message: t("emailInvalid") }),
@@ -128,6 +184,97 @@ export default function LoginForm({
         }
     });
 
+    async function initiateSecurityKeyAuth() {
+        setShowSecurityKeyPrompt(true);
+        setLoading(true);
+        setError(null);
+
+        try {
+            // Start WebAuthn authentication without email
+            const startResponse = await securityKeyStartProxy({}, forceLogin);
+
+            if (startResponse.error) {
+                setError(startResponse.message);
+                return;
+            }
+
+            const { tempSessionId, ...options } = startResponse.data!;
+
+            // Perform WebAuthn authentication
+            try {
+                const credential = await startAuthentication({
+                    optionsJSON: {
+                        ...options,
+                        userVerification: options.userVerification as
+                            | "required"
+                            | "preferred"
+                            | "discouraged"
+                    }
+                });
+
+                // Verify authentication
+                const verifyResponse = await securityKeyVerifyProxy(
+                    { credential },
+                    tempSessionId,
+                    forceLogin
+                );
+
+                if (verifyResponse.error) {
+                    setError(verifyResponse.message);
+                    return;
+                }
+
+                if (verifyResponse.success) {
+                    if (onLogin) {
+                        await onLogin(redirect);
+                    }
+                }
+            } catch (error: any) {
+                if (error.name === "NotAllowedError") {
+                    if (error.message.includes("denied permission")) {
+                        setError(
+                            t("securityKeyPermissionDenied", {
+                                defaultValue:
+                                    "Please allow access to your security key to continue signing in."
+                            })
+                        );
+                    } else {
+                        setError(
+                            t("securityKeyRemovedTooQuickly", {
+                                defaultValue:
+                                    "Please keep your security key connected until the sign-in process completes."
+                            })
+                        );
+                    }
+                } else if (error.name === "NotSupportedError") {
+                    setError(
+                        t("securityKeyNotSupported", {
+                            defaultValue:
+                                "Your security key may not be compatible. Please try a different security key."
+                        })
+                    );
+                } else {
+                    setError(
+                        t("securityKeyUnknownError", {
+                            defaultValue:
+                                "There was a problem using your security key. Please try again."
+                        })
+                    );
+                }
+            }
+        } catch (e: any) {
+            console.error(e);
+            setError(
+                t("securityKeyAuthError", {
+                    defaultValue:
+                        "An unexpected error occurred. Please try again."
+                })
+            );
+        } finally {
+            setLoading(false);
+            setShowSecurityKeyPrompt(false);
+        }
+    }
 
     async function onSubmit(values: any) {
         const { email, password } = form.getValues();
@@ -135,6 +282,7 @@ export default function LoginForm({
 
         setLoading(true);
         setError(null);
+        setShowSecurityKeyPrompt(false);
 
         try {
             const response = await loginProxy(
@@ -175,12 +323,7 @@ export default function LoginForm({
             }
 
             if (data.useSecurityKey) {
-                setError(
-                    t("securityKeyRequired", {
-                        defaultValue:
-                            "Please use your security key to sign in."
-                    })
-                );
+                await initiateSecurityKeyAuth();
                 return;
             }
 
@@ -266,6 +409,27 @@ export default function LoginForm({
 
     return (
         <div className="space-y-4">
+            {forceLogin && (
+                <Alert variant="neutral">
+                    <AlertDescription className="flex items-center gap-2">
+                        <LockIcon className="w-4 h-4" />
+                        {t("loginRequiredForDevice")}
+                    </AlertDescription>
+                </Alert>
+            )}
+
+            {showSecurityKeyPrompt && (
+                <Alert>
+                    <FingerprintIcon className="w-5 h-5 mr-2" />
+                    <AlertDescription>
+                        {t("securityKeyPrompt", {
+                            defaultValue:
+                                "Please verify your identity using your security key. Make sure your security key is connected and ready."
+                        })}
+                    </AlertDescription>
+                </Alert>
+            )}
+
             {!mfaRequested && (
                 <>
                     <Form {...form}>
@@ -333,36 +497,115 @@ export default function LoginForm({
             )}
 
             {mfaRequested && (
-                <MfaInputForm
-                    form={mfaForm}
-                    onSubmit={onSubmit}
-                    onBack={() => {
-                        setMfaRequested(false);
-                        mfaForm.reset();
-                    }}
-                    error={error}
-                    loading={loading}
-                    formId="form"
-                />
+                <>
+                    <div className="text-center">
+                        <h3 className="text-lg font-medium">{t("otpAuth")}</h3>
+                        <p className="text-sm text-muted-foreground">
+                            {t("otpAuthDescription")}
+                        </p>
+                    </div>
+                    <Form {...mfaForm}>
+                        <form
+                            onSubmit={mfaForm.handleSubmit(onSubmit)}
+                            className="space-y-4"
+                            id="form"
+                        >
+                            <FormField
+                                control={mfaForm.control}
+                                name="code"
+                                render={({ field }) => (
+                                    <FormItem>
+                                        <FormControl>
+                                            <div
+                                                ref={otpContainerRef}
+                                                className="flex justify-center"
+                                            >
+                                                <InputOTP
+                                                    maxLength={6}
+                                                    {...field}
+                                                    autoFocus
+                                                    pattern={
+                                                        REGEXP_ONLY_DIGITS_AND_CHARS
+                                                    }
+                                                    onChange={(
+                                                        value: string
+                                                    ) => {
+                                                        field.onChange(value);
+                                                        if (
+                                                            value.length === 6
+                                                        ) {
+                                                            mfaForm.handleSubmit(
+                                                                onSubmit
+                                                            )();
+                                                        }
+                                                    }}
+                                                >
+                                                    <InputOTPGroup>
+                                                        <InputOTPSlot
+                                                            index={0}
+                                                        />
+                                                        <InputOTPSlot
+                                                            index={1}
+                                                        />
+                                                        <InputOTPSlot
+                                                            index={2}
+                                                        />
+                                                        <InputOTPSlot
+                                                            index={3}
+                                                        />
+                                                        <InputOTPSlot
+                                                            index={4}
+                                                        />
+                                                        <InputOTPSlot
+                                                            index={5}
+                                                        />
+                                                    </InputOTPGroup>
+                                                </InputOTP>
+                                            </div>
+                                        </FormControl>
+                                        <FormMessage />
+                                    </FormItem>
+                                )}
+                            />
+                        </form>
+                    </Form>
+                </>
             )}
 
-            {!mfaRequested && error && (
+            {error && (
                 <Alert variant="destructive">
                     <AlertDescription>{error}</AlertDescription>
                 </Alert>
             )}
 
             <div className="space-y-4">
+                {mfaRequested && (
+                    <Button
+                        type="submit"
+                        form="form"
+                        className="w-full"
+                        loading={loading}
+                        disabled={loading}
+                    >
+                        {t("otpAuthSubmit")}
+                    </Button>
+                )}
 
                 {!mfaRequested && (
                     <>
-                        <SecurityKeyAuthButton
-                            redirect={redirect}
-                            forceLogin={forceLogin}
-                            onSuccess={onLogin}
-                            onError={setError}
-                            disabled={loading}
-                        />
+                        <Button
+                            type="button"
+                            variant="outline"
+                            className="w-full"
+                            onClick={initiateSecurityKeyAuth}
+                            loading={loading}
+                            disabled={loading || showSecurityKeyPrompt}
+                        >
+                            <FingerprintIcon className="w-4 h-4 mr-2" />
+                            {t("securityKeyLogin", {
+                                defaultValue: "Sign in with security key"
+                            })}
+                        </Button>
 
                         {hasIdp && (
                             <>
@@ -418,6 +661,19 @@ export default function LoginForm({
                     </>
                 )}
 
+                {mfaRequested && (
+                    <Button
+                        type="button"
+                        className="w-full"
+                        variant="outline"
+                        onClick={() => {
+                            setMfaRequested(false);
+                            mfaForm.reset();
+                        }}
+                    >
+                        {t("otpAuthBack")}
+                    </Button>
+                )}
             </div>
         </div>
     );

src/components/LoginOrgSelector.tsx

@@ -1,155 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { Button } from "@app/components/ui/button";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { useTranslations } from "next-intl";
-import { Separator } from "./ui/separator";
-import LoginPasswordForm from "./LoginPasswordForm";
-import IdpLoginButtons from "./private/IdpLoginButtons";
-import { LookupUserResponse } from "@server/routers/auth/lookupUser";
-import UserProfileCard from "./UserProfileCard";
-
-type LoginOrgSelectorProps = {
-    identifier: string;
-    lookupResult: LookupUserResponse;
-    redirect?: string;
-    forceLogin?: boolean;
-    onUseDifferentAccount?: () => void;
-};
-
-export default function LoginOrgSelector({
-    identifier,
-    lookupResult,
-    redirect,
-    forceLogin,
-    onUseDifferentAccount
-}: LoginOrgSelectorProps) {
-    const t = useTranslations();
-    const [showPasswordForm, setShowPasswordForm] = useState(false);
-
-    // Collect all unique orgs from all accounts
-    const orgMap = new Map<
-        string,
-        {
-            orgId: string;
-            orgName: string;
-            idps: Array<{
-                idpId: number;
-                name: string;
-                variant: string | null;
-            }>;
-            hasInternalAuth: boolean;
-        }
-    >();
-
-    for (const account of lookupResult.accounts) {
-        for (const org of account.orgs) {
-            if (!orgMap.has(org.orgId)) {
-                orgMap.set(org.orgId, {
-                    orgId: org.orgId,
-                    orgName: org.orgName,
-                    idps: org.idps,
-                    hasInternalAuth: org.hasInternalAuth
-                });
-            } else {
-                // Merge IdPs if org appears in multiple accounts
-                const existing = orgMap.get(org.orgId)!;
-                const existingIdpIds = new Set(
-                    existing.idps.map((i) => i.idpId)
-                );
-                for (const idp of org.idps) {
-                    if (!existingIdpIds.has(idp.idpId)) {
-                        existing.idps.push(idp);
-                    }
-                }
-                if (org.hasInternalAuth) {
-                    existing.hasInternalAuth = true;
-                }
-            }
-        }
-    }
-
-    const orgs = Array.from(orgMap.values());
-
-    // Check if there's an internal account (can only be one)
-    const hasInternalAccount = lookupResult.accounts.some(
-        (acc) => acc.hasInternalAuth
-    );
-
-    // If user selected password auth, show password form
-    if (showPasswordForm) {
-        return (
-            <div className="space-y-4">
-                <UserProfileCard
-                    identifier={identifier}
-                    description={t("loginSelectAuthenticationMethod")}
-                    onUseDifferentAccount={onUseDifferentAccount}
-                    useDifferentAccountText={t(
-                        "deviceLoginUseDifferentAccount"
-                    )}
-                />
-                <LoginPasswordForm
-                    identifier={identifier}
-                    redirect={redirect}
-                    forceLogin={forceLogin}
-                />
-            </div>
-        );
-    }
-
-    return (
-        <div>
-            <UserProfileCard
-                identifier={identifier}
-                description={t("loginSelectAuthenticationMethod")}
-                onUseDifferentAccount={onUseDifferentAccount}
-                useDifferentAccountText={t("deviceLoginUseDifferentAccount")}
-            />
-
-            {hasInternalAccount && (
-                <div className="mt-3">
-                    <Button
-                        type="button"
-                        className="w-full"
-                        onClick={() => setShowPasswordForm(true)}
-                    >
-                        {t("signInWithPassword")}
-                    </Button>
-                </div>
-            )}
-
-            <div className="space-y-0 mt-3">
-                {orgs.map((org, index) => {
-                    const hasIdps = org.idps.length > 0;
-
-                    if (!hasIdps) {
-                        return null;
-                    }
-
-                    // Convert org.idps to LoginFormIDP format
-                    const idps = org.idps.map((idp) => ({
-                        idpId: idp.idpId,
-                        name: idp.name,
-                        variant: idp.variant || undefined
-                    }));
-
-                    return (
-                        <div key={org.orgId}>
-                            <div className="py-3">
-                                <h3 className="text-base font-semibold mb-3">
-                                    {org.orgName}
-                                </h3>
-                                <IdpLoginButtons
-                                    idps={idps}
-                                    redirect={redirect}
-                                    orgId={org.orgId}
-                                />
-                            </div>
-                        </div>
-                    );
-                })}
-            </div>
-        </div>
-    );
-}

src/components/LoginPasswordForm.tsx

@@ -1,326 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { useForm } from "react-hook-form";
-import { zodResolver } from "@hookform/resolvers/zod";
-import * as z from "zod";
-import { Button } from "@app/components/ui/button";
-import { Input } from "@app/components/ui/input";
-import {
-    Form,
-    FormControl,
-    FormField,
-    FormItem,
-    FormLabel,
-    FormMessage
-} from "@app/components/ui/form";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { useRouter } from "next/navigation";
-import { useTranslations } from "next-intl";
-import { loginProxy } from "@app/actions/server";
-import Link from "next/link";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { cleanRedirect } from "@app/lib/cleanRedirect";
-import MfaInputForm from "@app/components/MfaInputForm";
-
-type LoginPasswordFormProps = {
-    identifier: string;
-    redirect?: string;
-    forceLogin?: boolean;
-};
-
-export default function LoginPasswordForm({
-    identifier,
-    redirect,
-    forceLogin
-}: LoginPasswordFormProps) {
-    const router = useRouter();
-    const { env } = useEnvContext();
-    const t = useTranslations();
-    const [error, setError] = useState<string | null>(null);
-    const [loading, setLoading] = useState(false);
-    const [mfaRequested, setMfaRequested] = useState(false);
-
-    // Check if identifier is a valid email
-    const isEmail = (() => {
-        try {
-            z.string().email().parse(identifier);
-            return true;
-        } catch {
-            return false;
-        }
-    })();
-
-    const currentHost =
-        typeof window !== "undefined" ? window.location.hostname : "";
-    const expectedHost = new URL(env.app.dashboardUrl).host;
-    const isExpectedHost = currentHost === expectedHost;
-
-    const formSchema = z.object({
-        password: z.string().min(8, { message: t("passwordRequirementsChars") })
-    });
-
-    const mfaSchema = z.object({
-        code: z.string().length(6, { message: t("pincodeInvalid") })
-    });
-
-    const form = useForm({
-        resolver: zodResolver(formSchema),
-        defaultValues: {
-            password: ""
-        }
-    });
-
-    const mfaForm = useForm({
-        resolver: zodResolver(mfaSchema),
-        defaultValues: {
-            code: ""
-        }
-    });
-
-    async function onSubmit(values: z.infer<typeof formSchema>) {
-        const { password } = values;
-        const { code } = mfaForm.getValues();
-
-        setLoading(true);
-        setError(null);
-
-        try {
-            const response = await loginProxy(
-                {
-                    email: identifier,
-                    password,
-                    code,
-                    resourceGuid: undefined
-                },
-                forceLogin
-            );
-
-            if (response.error) {
-                setError(response.message);
-                return;
-            }
-
-            const data = response.data;
-
-            if (!data) {
-                // Already logged in
-                if (redirect) {
-                    const safe = cleanRedirect(redirect);
-                    router.replace(safe);
-                } else {
-                    router.replace("/");
-                }
-                return;
-            }
-
-            if (data.useSecurityKey) {
-                setError(t("securityKeyRequired"));
-                return;
-            }
-
-            if (data.codeRequested) {
-                setMfaRequested(true);
-                setLoading(false);
-                mfaForm.reset();
-                return;
-            }
-
-            if (data.emailVerificationRequired) {
-                if (!isExpectedHost) {
-                    setError(
-                        t("emailVerificationRequired", {
-                            dashboardUrl: env.app.dashboardUrl
-                        })
-                    );
-                    return;
-                }
-                if (redirect) {
-                    router.push(`/auth/verify-email?redirect=${redirect}`);
-                } else {
-                    router.push("/auth/verify-email");
-                }
-                return;
-            }
-
-            if (data.twoFactorSetupRequired) {
-                if (!isExpectedHost) {
-                    setError(
-                        t("twoFactorSetupRequired", {
-                            dashboardUrl: env.app.dashboardUrl
-                        })
-                    );
-                    return;
-                }
-                const setupUrl = `/auth/2fa/setup?email=${encodeURIComponent(identifier)}${redirect ? `&redirect=${encodeURIComponent(redirect)}` : ""}`;
-                router.push(setupUrl);
-                return;
-            }
-
-            // Success
-            if (redirect) {
-                const safe = cleanRedirect(redirect);
-                router.replace(safe);
-            } else {
-                router.replace("/");
-            }
-        } catch (e: any) {
-            console.error(e);
-            setError(t("loginError"));
-        } finally {
-            setLoading(false);
-        }
-    }
-
-    async function onMfaSubmit(values: z.infer<typeof mfaSchema>) {
-        const { password } = form.getValues();
-        const { code } = values;
-
-        setLoading(true);
-        setError(null);
-
-        try {
-            const response = await loginProxy(
-                {
-                    email: identifier,
-                    password,
-                    code,
-                    resourceGuid: undefined
-                },
-                forceLogin
-            );
-
-            if (response.error) {
-                setError(response.message);
-                setLoading(false);
-                return;
-            }
-
-            const data = response.data;
-
-            if (!data) {
-                if (redirect) {
-                    const safe = cleanRedirect(redirect);
-                    router.replace(safe);
-                } else {
-                    router.replace("/");
-                }
-                return;
-            }
-
-            if (data.emailVerificationRequired) {
-                if (!isExpectedHost) {
-                    setError(
-                        t("emailVerificationRequired", {
-                            dashboardUrl: env.app.dashboardUrl
-                        })
-                    );
-                    return;
-                }
-                if (redirect) {
-                    router.push(`/auth/verify-email?redirect=${redirect}`);
-                } else {
-                    router.push("/auth/verify-email");
-                }
-                return;
-            }
-
-            if (data.twoFactorSetupRequired) {
-                if (!isExpectedHost) {
-                    setError(
-                        t("twoFactorSetupRequired", {
-                            dashboardUrl: env.app.dashboardUrl
-                        })
-                    );
-                    return;
-                }
-                const setupUrl = `/auth/2fa/setup?email=${encodeURIComponent(identifier)}${redirect ? `&redirect=${encodeURIComponent(redirect)}` : ""}`;
-                router.push(setupUrl);
-                return;
-            }
-
-            // Success
-            if (redirect) {
-                const safe = cleanRedirect(redirect);
-                router.replace(safe);
-            } else {
-                router.replace("/");
-            }
-        } catch (e: any) {
-            console.error(e);
-            setError(t("loginError"));
-        } finally {
-            setLoading(false);
-        }
-    }
-
-    if (mfaRequested) {
-        return (
-            <MfaInputForm
-                form={mfaForm}
-                onSubmit={onMfaSubmit}
-                onBack={() => {
-                    setMfaRequested(false);
-                    mfaForm.reset();
-                }}
-                error={error}
-                loading={loading}
-            />
-        );
-    }
-
-    return (
-        <div className="space-y-4">
-            <Form {...form}>
-                <form
-                    onSubmit={form.handleSubmit(onSubmit)}
-                    className="space-y-4"
-                >
-                    <FormField
-                        control={form.control}
-                        name="password"
-                        render={({ field }) => (
-                            <FormItem>
-                                <FormLabel>{t("password")}</FormLabel>
-                                <FormControl>
-                                    <Input
-                                        {...field}
-                                        type="password"
-                                        autoComplete="current-password"
-                                        autoFocus
-                                        disabled={loading}
-                                    />
-                                </FormControl>
-                                <FormMessage />
-                            </FormItem>
-                        )}
-                    />
-
-                    {error && (
-                        <Alert variant="destructive">
-                            <AlertDescription>{error}</AlertDescription>
-                        </Alert>
-                    )}
-
-                    <div className="text-center">
-                        <Link
-                            href={`${env.app.dashboardUrl}/auth/reset-password${isEmail ? `?email=${encodeURIComponent(identifier)}` : ""}${redirect ? `${isEmail ? "&" : "?"}redirect=${encodeURIComponent(redirect)}` : ""}`}
-                            className="text-sm text-muted-foreground"
-                        >
-                            {t("passwordForgot")}
-                        </Link>
-                    </div>
-
-                    <Button
-                        type="submit"
-                        className="w-full"
-                        disabled={loading}
-                        loading={loading}
-                    >
-                        {t("logIn")}
-                    </Button>
-                </form>
-            </Form>
-        </div>
-    );
-}

src/components/MachineClientsTable.tsx

@@ -1,8 +1,9 @@
 "use client";
 
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
+import { DataTable } from "@app/components/ui/data-table";
+import { ExtendedColumnDef } from "@app/components/ui/data-table";
 import { Button } from "@app/components/ui/button";
-import { DataTable, ExtendedColumnDef } from "@app/components/ui/data-table";
 import {
     DropdownMenu,
     DropdownMenuContent,
@@ -15,14 +16,15 @@ import { createApiClient, formatAxiosError } from "@app/lib/api";
 import {
     ArrowRight,
     ArrowUpDown,
-    MoreHorizontal,
-    CircleSlash
+    ArrowUpRight,
+    MoreHorizontal
 } from "lucide-react";
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useMemo, useState, useTransition } from "react";
 import { Badge } from "./ui/badge";
+import { InfoPopup } from "./ui/info-popup";
 
 export type ClientRow = {
     id: number;
@@ -40,9 +42,6 @@ export type ClientRow = {
     userEmail: string | null;
     niceId: string;
     agent: string | null;
-    archived?: boolean;
-    blocked?: boolean;
-    approvalState: "approved" | "pending" | "denied";
 };
 
 type ClientTableProps = {
@@ -59,7 +58,6 @@ export default function MachineClientsTable({
     const t = useTranslations();
 
     const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-    const [isBlockModalOpen, setIsBlockModalOpen] = useState(false);
     const [selectedClient, setSelectedClient] = useState<ClientRow | null>(
         null
     );
@@ -105,76 +103,6 @@ export default function MachineClientsTable({
             });
     };
 
-    const archiveClient = (clientId: number) => {
-        api.post(`/client/${clientId}/archive`)
-            .catch((e) => {
-                console.error("Error archiving client", e);
-                toast({
-                    variant: "destructive",
-                    title: "Error archiving client",
-                    description: formatAxiosError(e, "Error archiving client")
-                });
-            })
-            .then(() => {
-                startTransition(() => {
-                    router.refresh();
-                });
-            });
-    };
-
-    const unarchiveClient = (clientId: number) => {
-        api.post(`/client/${clientId}/unarchive`)
-            .catch((e) => {
-                console.error("Error unarchiving client", e);
-                toast({
-                    variant: "destructive",
-                    title: "Error unarchiving client",
-                    description: formatAxiosError(e, "Error unarchiving client")
-                });
-            })
-            .then(() => {
-                startTransition(() => {
-                    router.refresh();
-                });
-            });
-    };
-
-    const blockClient = (clientId: number) => {
-        api.post(`/client/${clientId}/block`)
-            .catch((e) => {
-                console.error("Error blocking client", e);
-                toast({
-                    variant: "destructive",
-                    title: "Error blocking client",
-                    description: formatAxiosError(e, "Error blocking client")
-                });
-            })
-            .then(() => {
-                startTransition(() => {
-                    router.refresh();
-                    setIsBlockModalOpen(false);
-                    setSelectedClient(null);
-                });
-            });
-    };
-
-    const unblockClient = (clientId: number) => {
-        api.post(`/client/${clientId}/unblock`)
-            .catch((e) => {
-                console.error("Error unblocking client", e);
-                toast({
-                    variant: "destructive",
-                    title: "Error unblocking client",
-                    description: formatAxiosError(e, "Error unblocking client")
-                });
-            })
-            .then(() => {
-                startTransition(() => {
-                    router.refresh();
-                });
-            });
-    };
-
     // Check if there are any rows without userIds in the current view's data
     const hasRowsWithoutUserId = useMemo(() => {
         return machineClients.some((client) => !client.userId) ?? false;
@@ -200,28 +128,6 @@ export default function MachineClientsTable({
                             <ArrowUpDown className="ml-2 h-4 w-4" />
                         </Button>
                     );
-                },
-                cell: ({ row }) => {
-                    const r = row.original;
-                    return (
-                        <div className="flex items-center gap-2">
-                            <span>{r.name}</span>
-                            {r.archived && (
-                                <Badge variant="secondary">
-                                    {t("archived")}
-                                </Badge>
-                            )}
-                            {r.blocked && (
-                                <Badge
-                                    variant="destructive"
-                                    className="flex items-center gap-1"
-                                >
-                                    <CircleSlash className="h-3 w-3" />
-                                    {t("blocked")}
-                                </Badge>
-                            )}
-                        </div>
-                    );
                 }
             },
             {
@@ -401,37 +307,14 @@ export default function MachineClientsTable({
                                     </Button>
                                 </DropdownMenuTrigger>
                                 <DropdownMenuContent align="end">
-                                    <DropdownMenuItem
-                                        onClick={() => {
-                                            if (clientRow.archived) {
-                                                unarchiveClient(clientRow.id);
-                                            } else {
-                                                archiveClient(clientRow.id);
-                                            }
-                                        }}
-                                    >
-                                        <span>
-                                            {clientRow.archived
-                                                ? "Unarchive"
-                                                : "Archive"}
-                                        </span>
-                                    </DropdownMenuItem>
-                                    <DropdownMenuItem
-                                        onClick={() => {
-                                            if (clientRow.blocked) {
-                                                unblockClient(clientRow.id);
-                                            } else {
-                                                setSelectedClient(clientRow);
-                                                setIsBlockModalOpen(true);
-                                            }
-                                        }}
-                                    >
-                                        <span>
-                                            {clientRow.blocked
-                                                ? "Unblock"
-                                                : "Block"}
-                                        </span>
-                                    </DropdownMenuItem>
+                                    {/* <Link */}
+                                    {/*     className="block w-full" */}
+                                    {/*     href={`/${clientRow.orgId}/settings/sites/${clientRow.nice}`} */}
+                                    {/* > */}
+                                    {/*     <DropdownMenuItem> */}
+                                    {/*         View settings */}
+                                    {/*     </DropdownMenuItem> */}
+                                    {/* </Link> */}
                                     <DropdownMenuItem
                                         onClick={() => {
                                             setSelectedClient(clientRow);
@@ -482,27 +365,6 @@ export default function MachineClientsTable({
                     title="Delete Client"
                 />
             )}
-            {selectedClient && (
-                <ConfirmDeleteDialog
-                    open={isBlockModalOpen}
-                    setOpen={(val) => {
-                        setIsBlockModalOpen(val);
-                        if (!val) {
-                            setSelectedClient(null);
-                        }
-                    }}
-                    dialog={
-                        <div className="space-y-2">
-                            <p>{t("blockClientQuestion")}</p>
-                            <p>{t("blockClientMessage")}</p>
-                        </div>
-                    }
-                    buttonText={t("blockClientConfirm")}
-                    onConfirm={async () => blockClient(selectedClient!.id)}
-                    string={selectedClient.name}
-                    title={t("blockClient")}
-                />
-            )}
 
             <DataTable
                 columns={columns}
@@ -521,55 +383,6 @@ export default function MachineClientsTable({
                 columnVisibility={defaultMachineColumnVisibility}
                 stickyLeftColumn="name"
                 stickyRightColumn="actions"
-                filters={[
-                    {
-                        id: "status",
-                        label: t("status") || "Status",
-                        multiSelect: true,
-                        displayMode: "calculated",
-                        options: [
-                            {
-                                id: "active",
-                                label: t("active") || "Active",
-                                value: "active"
-                            },
-                            {
-                                id: "archived",
-                                label: t("archived") || "Archived",
-                                value: "archived"
-                            },
-                            {
-                                id: "blocked",
-                                label: t("blocked") || "Blocked",
-                                value: "blocked"
-                            }
-                        ],
-                        filterFn: (
-                            row: ClientRow,
-                            selectedValues: (string | number | boolean)[]
-                        ) => {
-                            if (selectedValues.length === 0) return true;
-                            const rowArchived = row.archived || false;
-                            const rowBlocked = row.blocked || false;
-                            const isActive = !rowArchived && !rowBlocked;
-
-                            if (selectedValues.includes("active") && isActive)
-                                return true;
-                            if (
-                                selectedValues.includes("archived") &&
-                                rowArchived
-                            )
-                                return true;
-                            if (
-                                selectedValues.includes("blocked") &&
-                                rowBlocked
-                            )
-                                return true;
-                            return false;
-                        },
-                        defaultValues: ["active"] // Default to showing active clients
-                    }
-                ]}
             />
         </>
     );

src/components/MfaInputForm.tsx

@@ -1,169 +0,0 @@
-"use client";
-
-import { useEffect, useRef } from "react";
-import { UseFormReturn } from "react-hook-form";
-import { Button } from "@app/components/ui/button";
-import {
-    Form,
-    FormControl,
-    FormField,
-    FormItem,
-    FormMessage
-} from "@app/components/ui/form";
-import {
-    InputOTP,
-    InputOTPGroup,
-    InputOTPSlot
-} from "./ui/input-otp";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
-import * as z from "zod";
-
-type MfaInputFormProps = {
-    form: UseFormReturn<{ code: string }>;
-    onSubmit: (values: { code: string }) => void | Promise<void>;
-    onBack: () => void;
-    error?: string | null;
-    loading?: boolean;
-    formId?: string;
-};
-
-export default function MfaInputForm({
-    form,
-    onSubmit,
-    onBack,
-    error,
-    loading = false,
-    formId = "mfaForm"
-}: MfaInputFormProps) {
-    const t = useTranslations();
-    const otpContainerRef = useRef<HTMLDivElement>(null);
-
-    // Auto-focus MFA input when component mounts
-    useEffect(() => {
-        const focusInput = () => {
-            // Try using the ref first
-            if (otpContainerRef.current) {
-                const hiddenInput = otpContainerRef.current.querySelector(
-                    "input"
-                ) as HTMLInputElement;
-                if (hiddenInput) {
-                    hiddenInput.focus();
-                    return;
-                }
-            }
-
-            // Fallback: query the DOM
-            const otpContainer = document.querySelector(
-                '[data-slot="input-otp"]'
-            );
-            if (!otpContainer) return;
-
-            const hiddenInput = otpContainer.querySelector(
-                "input"
-            ) as HTMLInputElement;
-            if (hiddenInput) {
-                hiddenInput.focus();
-                return;
-            }
-
-            // Last resort: click the first slot
-            const firstSlot = otpContainer.querySelector(
-                '[data-slot="input-otp-slot"]'
-            ) as HTMLElement;
-            if (firstSlot) {
-                firstSlot.click();
-            }
-        };
-
-        // Use requestAnimationFrame to wait for the next paint
-        requestAnimationFrame(() => {
-            requestAnimationFrame(() => {
-                focusInput();
-            });
-        });
-    }, []);
-
-    return (
-        <div className="space-y-4">
-            <div className="text-center">
-                <h3 className="text-lg font-medium">{t("otpAuth")}</h3>
-                <p className="text-sm text-muted-foreground">
-                    {t("otpAuthDescription")}
-                </p>
-            </div>
-            <Form {...form}>
-                <form
-                    onSubmit={form.handleSubmit(onSubmit)}
-                    className="space-y-4"
-                    id={formId}
-                >
-                    <FormField
-                        control={form.control}
-                        name="code"
-                        render={({ field }) => (
-                            <FormItem>
-                                <FormControl>
-                                    <div
-                                        ref={otpContainerRef}
-                                        className="flex justify-center"
-                                    >
-                                        <InputOTP
-                                            maxLength={6}
-                                            {...field}
-                                            autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS_AND_CHARS}
-                                            onChange={(value: string) => {
-                                                field.onChange(value);
-                                                if (value.length === 6) {
-                                                    form.handleSubmit(onSubmit)();
-                                                }
-                                            }}
-                                        >
-                                            <InputOTPGroup>
-                                                <InputOTPSlot index={0} />
-                                                <InputOTPSlot index={1} />
-                                                <InputOTPSlot index={2} />
-                                                <InputOTPSlot index={3} />
-                                                <InputOTPSlot index={4} />
-                                                <InputOTPSlot index={5} />
-                                            </InputOTPGroup>
-                                        </InputOTP>
-                                    </div>
-                                </FormControl>
-                                <FormMessage />
-                            </FormItem>
-                        )}
-                    />
-                </form>
-            </Form>
-
-            {error && (
-                <Alert variant="destructive">
-                    <AlertDescription>{error}</AlertDescription>
-                </Alert>
-            )}
-
-            <div className="space-y-2">
-                <Button
-                    type="submit"
-                    form={formId}
-                    className="w-full"
-                    loading={loading}
-                    disabled={loading}
-                >
-                    {t("otpAuthSubmit")}
-                </Button>
-                <Button
-                    type="button"
-                    className="w-full"
-                    variant="outline"
-                    onClick={onBack}
-                >
-                    {t("otpAuthBack")}
-                </Button>
-            </div>
-        </div>
-    );
-}

src/components/OrgLoginPage.tsx

@@ -116,14 +116,6 @@ export default async function OrgLoginPage({
                     )}
                 </CardContent>
             </Card>
-            <p className="text-center text-muted-foreground mt-4">
-                <Link
-                    href={`${env.app.dashboardUrl}/auth/login${buildQueryString(searchParams)}`}
-                    className="underline"
-                >
-                    {t("loginBack")}
-                </Link>
-            </p>
         </div>
     );
 }

src/components/OrgSignInLink.tsx

@@ -1,107 +0,0 @@
-"use client";
-
-import { useState, useEffect } from "react";
-import { useRouter } from "next/navigation";
-import { useTranslations } from "next-intl";
-import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
-import { Button } from "@app/components/ui/button";
-
-type OrgSignInLinkProps = {
-    href: string;
-    linkText: string;
-    descriptionText: string;
-};
-
-const STORAGE_KEY_CLICKED = "orgSignInLinkClicked";
-const STORAGE_KEY_ACKNOWLEDGED = "orgSignInTipAcknowledged";
-
-export default function OrgSignInLink({
-    href,
-    linkText,
-    descriptionText
-}: OrgSignInLinkProps) {
-    const router = useRouter();
-    const t = useTranslations();
-    const [showTip, setShowTip] = useState(false);
-
-    useEffect(() => {
-        // Check if tip was previously acknowledged
-        const acknowledged =
-            localStorage.getItem(STORAGE_KEY_ACKNOWLEDGED) === "true";
-        if (acknowledged) {
-            // Clear the clicked flag if tip was acknowledged
-            localStorage.removeItem(STORAGE_KEY_CLICKED);
-        }
-    }, []);
-
-    const handleClick = (e: React.MouseEvent) => {
-        e.preventDefault();
-
-        const hasClickedBefore =
-            localStorage.getItem(STORAGE_KEY_CLICKED) === "true";
-        const isAcknowledged =
-            localStorage.getItem(STORAGE_KEY_ACKNOWLEDGED) === "true";
-
-        if (hasClickedBefore && !isAcknowledged) {
-            // Second click (or later) - show tip
-            setShowTip(true);
-        } else {
-            // First click - store flag and navigate
-            localStorage.setItem(STORAGE_KEY_CLICKED, "true");
-            router.push(href);
-        }
-    };
-
-    const handleContinueAnyway = () => {
-        setShowTip(false);
-        router.push(href);
-    };
-
-    const handleDontShowAgain = () => {
-        setShowTip(false);
-        localStorage.setItem(STORAGE_KEY_ACKNOWLEDGED, "true");
-        localStorage.removeItem(STORAGE_KEY_CLICKED);
-    };
-
-    return (
-        <>
-            {showTip && (
-                <Alert className="mb-4 mt-8">
-                    <AlertTitle>{t("orgSignInNotice")}</AlertTitle>
-                    <AlertDescription className="space-y-3 mt-3">
-                        <p>{t("orgSignInTip")}</p>
-                        <div className="flex items-center gap-2">
-                            <Button
-                                type="button"
-                                variant="ghost"
-                                size="sm"
-                                className="w-full"
-                                onClick={handleDontShowAgain}
-                            >
-                                {t("dontShowAgain")}
-                            </Button>
-                            <Button
-                                type="button"
-                                variant="outline"
-                                size="sm"
-                                className="w-full"
-                                onClick={handleContinueAnyway}
-                            >
-                                {t("continueAnyway")}
-                            </Button>
-                        </div>
-                    </AlertDescription>
-                </Alert>
-            )}
-            <div className="text-sm text-center text-muted-foreground mt-8 flex flex-col items-center">
-                <span>{descriptionText}</span>
-                <button
-                    onClick={handleClick}
-                    className="underline text-inherit bg-transparent border-none p-0 cursor-pointer"
-                >
-                    {linkText}
-                </button>
-            </div>
-        </>
-    );
-}

src/components/PermissionsSelectBox.tsx

@@ -103,10 +103,6 @@ function getActionsCategories(root: boolean) {
         Client: {
             [t("actionCreateClient")]: "createClient",
             [t("actionDeleteClient")]: "deleteClient",
-            [t("actionArchiveClient")]: "archiveClient",
-            [t("actionUnarchiveClient")]: "unarchiveClient",
-            [t("actionBlockClient")]: "blockClient",
-            [t("actionUnblockClient")]: "unblockClient",
             [t("actionUpdateClient")]: "updateClient",
             [t("actionListClients")]: "listClients",
             [t("actionGetClient")]: "getClient"
@@ -118,16 +114,6 @@ function getActionsCategories(root: boolean) {
         }
     };
 
-    if (root || build === "saas" || env.flags.useOrgOnlyIdp) {
-        actionsByCategory["Identity Provider (IDP)"] = {
-            [t("actionCreateIdp")]: "createIdp",
-            [t("actionUpdateIdp")]: "updateIdp",
-            [t("actionDeleteIdp")]: "deleteIdp",
-            [t("actionListIdps")]: "listIdps",
-            [t("actionGetIdp")]: "getIdp"
-        };
-    }
-
     if (root) {
         actionsByCategory["Organization"] = {
             [t("actionListOrgs")]: "listOrgs",
@@ -142,21 +128,24 @@ function getActionsCategories(root: boolean) {
             ...actionsByCategory["Organization"]
         };
 
-        actionsByCategory["Identity Provider (IDP)"][t("actionCreateIdpOrg")] =
-            "createIdpOrg";
-        actionsByCategory["Identity Provider (IDP)"][t("actionDeleteIdpOrg")] =
-            "deleteIdpOrg";
-        actionsByCategory["Identity Provider (IDP)"][t("actionListIdpOrgs")] =
-            "listIdpOrgs";
-        actionsByCategory["Identity Provider (IDP)"][t("actionUpdateIdpOrg")] =
-            "updateIdpOrg";
+        actionsByCategory["Identity Provider (IDP)"] = {
+            [t("actionCreateIdp")]: "createIdp",
+            [t("actionUpdateIdp")]: "updateIdp",
+            [t("actionDeleteIdp")]: "deleteIdp",
+            [t("actionListIdps")]: "listIdps",
+            [t("actionGetIdp")]: "getIdp",
+            [t("actionCreateIdpOrg")]: "createIdpOrg",
+            [t("actionDeleteIdpOrg")]: "deleteIdpOrg",
+            [t("actionListIdpOrgs")]: "listIdpOrgs",
+            [t("actionUpdateIdpOrg")]: "updateIdpOrg"
+        };
 
         actionsByCategory["User"] = {
             [t("actionUpdateUser")]: "updateUser",
             [t("actionGetUser")]: "getUser"
         };
 
-        if (build === "saas") {
+        if (build == "saas") {
             actionsByCategory["SAAS"] = {
                 ["Send Usage Notification Email"]: "sendUsageNotification"
             };

src/components/RolesTable.tsx

@@ -1,27 +1,27 @@
 "use client";
 
-import CreateRoleForm from "@app/components/CreateRoleForm";
-import DeleteRoleForm from "@app/components/DeleteRoleForm";
-import { RolesDataTable } from "@app/components/RolesDataTable";
-import { Button } from "@app/components/ui/button";
+import { ColumnDef } from "@tanstack/react-table";
 import { ExtendedColumnDef } from "@app/components/ui/data-table";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useOrgContext } from "@app/hooks/useOrgContext";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient } from "@app/lib/api";
-import { Role } from "@server/db";
-import { ArrowRight, ArrowUpDown, Link, MoreHorizontal } from "lucide-react";
-import { useTranslations } from "next-intl";
-import { useRouter } from "next/navigation";
-import { useState, useTransition } from "react";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import {
     DropdownMenu,
-    DropdownMenuTrigger,
     DropdownMenuContent,
-    DropdownMenuItem
-} from "./ui/dropdown-menu";
-import EditRoleForm from "./EditRoleForm";
+    DropdownMenuItem,
+    DropdownMenuTrigger
+} from "@app/components/ui/dropdown-menu";
+import { Button } from "@app/components/ui/button";
+import { ArrowUpDown, Crown, MoreHorizontal } from "lucide-react";
+import { useState } from "react";
+import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
+import { useOrgContext } from "@app/hooks/useOrgContext";
+import { toast } from "@app/hooks/useToast";
+import { RolesDataTable } from "@app/components/RolesDataTable";
+import { Role } from "@server/db";
+import CreateRoleForm from "@app/components/CreateRoleForm";
+import DeleteRoleForm from "@app/components/DeleteRoleForm";
+import { createApiClient } from "@app/lib/api";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useTranslations } from "next-intl";
+import { useRouter } from "next/navigation";
 
 export type RoleRow = Role;
 
@@ -29,26 +29,27 @@ type RolesTableProps = {
     roles: RoleRow[];
 };
 
-export default function UsersTable({ roles }: RolesTableProps) {
+export default function UsersTable({ roles: r }: RolesTableProps) {
     const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
     const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-    const [editingRole, setEditingRole] = useState<RoleRow | null>(null);
-    const [isEditDialogOpen, setIsEditDialogOpen] = useState(false);
     const router = useRouter();
 
-    const [roleToRemove, setRoleToRemove] = useState<RoleRow | null>(null);
+    const [roles, setRoles] = useState<RoleRow[]>(r);
+
+    const [roleToRemove, setUserToRemove] = useState<RoleRow | null>(null);
 
     const api = createApiClient(useEnvContext());
 
     const { org } = useOrgContext();
-    const { isPaidUser } = usePaidStatus();
 
     const t = useTranslations();
-    const [isRefreshing, startTransition] = useTransition();
+    const [isRefreshing, setIsRefreshing] = useState(false);
 
     const refreshData = async () => {
         console.log("Data refreshed");
+        setIsRefreshing(true);
         try {
+            await new Promise((resolve) => setTimeout(resolve, 200));
             router.refresh();
         } catch (error) {
             toast({
@@ -56,6 +57,8 @@ export default function UsersTable({ roles }: RolesTableProps) {
                 description: t("refreshError"),
                 variant: "destructive"
             });
+        } finally {
+            setIsRefreshing(false);
         }
     };
 
@@ -83,74 +86,26 @@ export default function UsersTable({ roles }: RolesTableProps) {
             friendlyName: t("description"),
             header: () => <span className="p-3">{t("description")}</span>
         },
-        // {
-        //     id: "actions",
-        //     enableHiding: false,
-        //     header: () => <span className="p-3"></span>,
-        //     cell: ({ row }) => {
-        //         const roleRow = row.original;
-
-        //         return (
-        //             <div className="flex items-center gap-2 justify-end">
-        //                 <Button
-        //                     variant={"outline"}
-        //                     disabled={roleRow.isAdmin || false}
-        //                     onClick={() => {
-        //                         setIsDeleteModalOpen(true);
-        //                         setUserToRemove(roleRow);
-        //                     }}
-        //                 >
-        //                     {t("accessRoleDelete")}
-        //                 </Button>
-        //             </div>
-        //         );
-        //     }
-        // },
         {
             id: "actions",
             enableHiding: false,
             header: () => <span className="p-3"></span>,
             cell: ({ row }) => {
                 const roleRow = row.original;
+
                 return (
-                    !roleRow.isAdmin && (
-                        <div className="flex items-center gap-2 justify-end">
-                            <DropdownMenu>
-                                <DropdownMenuTrigger asChild>
-                                    <Button
-                                        variant="ghost"
-                                        className="h-8 w-8 p-0"
-                                    >
-                                        <span className="sr-only">
-                                            {t("openMenu")}
-                                        </span>
-                                        <MoreHorizontal className="h-4 w-4" />
-                                    </Button>
-                                </DropdownMenuTrigger>
-                                <DropdownMenuContent align="end">
-                                    <DropdownMenuItem
-                                        onClick={() => {
-                                            setRoleToRemove(roleRow);
-                                            setIsDeleteModalOpen(true);
-                                        }}
-                                    >
-                                        <span className="text-red-500">
-                                            {t("delete")}
-                                        </span>
-                                    </DropdownMenuItem>
-                                </DropdownMenuContent>
-                            </DropdownMenu>
-                            <Button
-                                variant={"outline"}
-                                onClick={() => {
-                                    setEditingRole(roleRow);
-                                    setIsEditDialogOpen(true);
-                                }}
-                            >
-                                {t("edit")}
-                            </Button>
-                        </div>
-                    )
+                    <div className="flex items-center gap-2 justify-end">
+                        <Button
+                            variant={"outline"}
+                            disabled={roleRow.isAdmin || false}
+                            onClick={() => {
+                                setIsDeleteModalOpen(true);
+                                setUserToRemove(roleRow);
+                            }}
+                        >
+                            {t("accessRoleDelete")}
+                        </Button>
+                    </div>
                 );
             }
         }
@@ -158,29 +113,11 @@ export default function UsersTable({ roles }: RolesTableProps) {
 
     return (
         <>
-            {editingRole && (
-                <EditRoleForm
-                    role={editingRole}
-                    open={isEditDialogOpen}
-                    key={editingRole.roleId}
-                    setOpen={setIsEditDialogOpen}
-                    onSuccess={() => {
-                        // Delay refresh to allow modal to close smoothly
-                        setTimeout(() => {
-                            startTransition(async () => {
-                                await refreshData().then(() =>
-                                    setEditingRole(null)
-                                );
-                            });
-                        }, 150);
-                    }}
-                />
-            )}
             <CreateRoleForm
                 open={isCreateModalOpen}
                 setOpen={setIsCreateModalOpen}
-                afterCreate={() => {
-                    startTransition(refreshData);
+                afterCreate={async (role) => {
+                    setRoles((prev) => [...prev, role]);
                 }}
             />
 
@@ -190,11 +127,10 @@ export default function UsersTable({ roles }: RolesTableProps) {
                     setOpen={setIsDeleteModalOpen}
                     roleToDelete={roleToRemove}
                     afterDelete={() => {
-                        startTransition(async () => {
-                            await refreshData().then(() =>
-                                setRoleToRemove(null)
-                            );
-                        });
+                        setRoles((prev) =>
+                            prev.filter((r) => r.roleId !== roleToRemove.roleId)
+                        );
+                        setUserToRemove(null);
                     }}
                 />
             )}
@@ -205,7 +141,7 @@ export default function UsersTable({ roles }: RolesTableProps) {
                 createRole={() => {
                     setIsCreateModalOpen(true);
                 }}
-                onRefresh={() => startTransition(refreshData)}
+                onRefresh={refreshData}
                 isRefreshing={isRefreshing}
             />
         </>

src/components/SecurityKeyAuthButton.tsx

@@ -1,157 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { Button } from "@app/components/ui/button";
-import { FingerprintIcon } from "lucide-react";
-import { useTranslations } from "next-intl";
-import { startAuthentication } from "@simplewebauthn/browser";
-import {
-    securityKeyStartProxy,
-    securityKeyVerifyProxy
-} from "@app/actions/server";
-import { useRouter } from "next/navigation";
-import { cleanRedirect } from "@app/lib/cleanRedirect";
-
-type SecurityKeyAuthButtonProps = {
-    redirect?: string;
-    forceLogin?: boolean;
-    onSuccess?: (redirectUrl?: string) => void | Promise<void>;
-    onError?: (error: string) => void;
-    disabled?: boolean;
-    className?: string;
-};
-
-export default function SecurityKeyAuthButton({
-    redirect,
-    forceLogin,
-    onSuccess,
-    onError,
-    disabled: externalDisabled,
-    className
-}: SecurityKeyAuthButtonProps) {
-    const router = useRouter();
-    const t = useTranslations();
-    const [loading, setLoading] = useState(false);
-    const [error, setError] = useState<string | null>(null);
-
-    async function initiateSecurityKeyAuth() {
-        setLoading(true);
-        setError(null);
-
-        try {
-            // Start WebAuthn authentication without email
-            const startResponse = await securityKeyStartProxy({}, forceLogin);
-
-            if (startResponse.error) {
-                const errorMessage = startResponse.message;
-                setError(errorMessage);
-                if (onError) {
-                    onError(errorMessage);
-                }
-                setLoading(false);
-                return;
-            }
-
-            const { tempSessionId, ...options } = startResponse.data!;
-
-            // Perform WebAuthn authentication
-            try {
-                const credential = await startAuthentication({
-                    optionsJSON: {
-                        ...options,
-                        userVerification: options.userVerification as
-                            | "required"
-                            | "preferred"
-                            | "discouraged"
-                    }
-                });
-
-                // Verify authentication
-                const verifyResponse = await securityKeyVerifyProxy(
-                    { credential },
-                    tempSessionId,
-                    forceLogin
-                );
-
-                if (verifyResponse.error) {
-                    const errorMessage = verifyResponse.message;
-                    setError(errorMessage);
-                    if (onError) {
-                        onError(errorMessage);
-                    }
-                    setLoading(false);
-                    return;
-                }
-
-                if (verifyResponse.success) {
-                    if (onSuccess) {
-                        await onSuccess(redirect);
-                    } else {
-                        // Default behavior: redirect
-                        if (redirect) {
-                            const safe = cleanRedirect(redirect);
-                            router.replace(safe);
-                        } else {
-                            router.replace("/");
-                        }
-                    }
-                }
-            } catch (error: any) {
-                let errorMessage: string;
-                if (error.name === "NotAllowedError") {
-                    if (error.message.includes("denied permission")) {
-                        errorMessage = t("securityKeyPermissionDenied", {
-                            defaultValue:
-                                "Please allow access to your security key to continue signing in."
-                        });
-                    } else {
-                        errorMessage = t("securityKeyRemovedTooQuickly", {
-                            defaultValue:
-                                "Please keep your security key connected until the sign-in process completes."
-                        });
-                    }
-                } else if (error.name === "NotSupportedError") {
-                    errorMessage = t("securityKeyNotSupported", {
-                        defaultValue:
-                            "Your security key may not be compatible. Please try a different security key."
-                    });
-                } else {
-                    errorMessage = t("securityKeyUnknownError", {
-                        defaultValue:
-                            "There was a problem using your security key. Please try again."
-                    });
-                }
-                setError(errorMessage);
-                if (onError) {
-                    onError(errorMessage);
-                }
-                setLoading(false);
-            }
-        } catch (e: any) {
-            console.error(e);
-            const errorMessage = t("securityKeyAuthError", {
-                defaultValue:
-                    "An unexpected error occurred. Please try again."
-            });
-            setError(errorMessage);
-            if (onError) {
-                onError(errorMessage);
-            }
-            setLoading(false);
-        }
-    }
-
-    return (
-        <Button
-            type="button"
-            variant="outline"
-            className={className || "w-full"}
-            onClick={initiateSecurityKeyAuth}
-            disabled={externalDisabled || loading}
-            loading={loading}
-        >
-            <FingerprintIcon className="w-4 h-4 mr-2" />
-            {t("securityKeyLogin")}
-        </Button>
-    );
-}

src/components/SignupForm.tsx

@@ -16,8 +16,7 @@ import {
     FormMessage
 } from "@/components/ui/form";
 import { Card, CardContent, CardHeader } from "@/components/ui/card";
-import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
-import Link from "next/link";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Progress } from "@/components/ui/progress";
 import { SignUpResponse } from "@server/routers/auth";
 import { useRouter } from "next/navigation";
@@ -71,7 +70,6 @@ type SignupFormProps = {
     inviteId?: string;
     inviteToken?: string;
     emailParam?: string;
-    fromSmartLogin?: boolean;
 };
 
 const formSchema = z
@@ -102,8 +100,7 @@ export default function SignupForm({
     redirect,
     inviteId,
     inviteToken,
-    emailParam,
-    fromSmartLogin = false
+    emailParam
 }: SignupFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -204,28 +201,8 @@ export default function SignupForm({
         ? env.branding.logo?.authPage?.height || 58
         : 58;
 
-    const showOrgBanner = fromSmartLogin && (build === "saas" || env.flags.useOrgOnlyIdp);
-    const orgBannerHref = redirect
-        ? `/auth/org?redirect=${encodeURIComponent(redirect)}`
-        : "/auth/org";
-
     return (
-        <>
-            {showOrgBanner && (
-                <Alert className="mb-4 w-full max-w-md">
-                    <AlertTitle>{t("signupOrgNotice")}</AlertTitle>
-                    <AlertDescription className="space-y-2 mt-3">
-                        <p>{t("signupOrgTip")}</p>
-                        <Link
-                            href={orgBannerHref}
-                            className="text-sm font-medium underline"
-                        >
-                            {t("signupOrgLink")}
-                        </Link>
-                    </AlertDescription>
-                </Alert>
-            )}
-            <Card className="w-full max-w-md">
+        <Card className="w-full max-w-md">
             <CardHeader className="border-b">
                 <div className="flex flex-row items-center justify-center">
                     <BrandingLogo height={logoHeight} width={logoWidth} />
@@ -604,10 +581,9 @@ export default function SignupForm({
                         <Button type="submit" className="w-full">
                             {t("createAccount")}
                         </Button>
-                </form>
-            </Form>
-        </CardContent>
-    </Card>
-        </>
+                    </form>
+                </Form>
+            </CardContent>
+        </Card>
     );
 }