Merge pull request #467 from fosrl/dev

1.2.0

.dockerignore

@@ -22,7 +22,6 @@ next-env.d.ts
 *.log
 .machinelogs*.json
 *-audit.json
-package-lock.json
 install/
 bruno/
 LICENSE

.github/workflows/stale-bot.yml

@@ -0,0 +1,37 @@
+name: Mark and Close Stale Issues
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: write # only for delete-branch option
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9
+        with:
+          days-before-stale: 30
+          days-before-close: 14
+          stale-issue-message: 'This issue has been automatically marked as stale due to 30 days of inactivity. It will be closed in 14 days if no further activity occurs.'
+          close-issue-message: 'This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.'
+          stale-issue-label: 'stale'
+          
+          exempt-issue-labels: 'needs investigating, networking, new feature, reverse proxy, bug, api, authentication, documentation, enhancement, help wanted, good first issue, question'
+          
+          exempt-all-issue-assignees: true
+          
+          only-labels: ''
+          exempt-pr-labels: ''
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          
+          operations-per-run: 100
+          remove-stale-when-updated: true
+          delete-branch: false
+          enable-statistics: true

.gitignore

@@ -23,7 +23,6 @@ next-env.d.ts
 .machinelogs*.json
 *-audit.json
 migrations
-package-lock.json
 tsconfig.tsbuildinfo
 config/config.yml
 dist

Dockerfile

@@ -2,33 +2,30 @@ FROM node:20-alpine AS builder
 
 WORKDIR /app
 
-COPY package.json ./
-
-RUN npm install
+COPY package.json package-lock.json ./
+RUN npm ci
 
 COPY . .
 
-RUN npx drizzle-kit generate --dialect sqlite --schema ./server/db/schema.ts --out init
+RUN npx drizzle-kit generate --dialect sqlite --schema ./server/db/schemas/ --out init
 
 RUN npm run build
 
 FROM node:20-alpine AS runner
 
-RUN apk add --no-cache curl
-
 WORKDIR /app
 
-COPY package.json ./
+# Curl used for the health checks
+RUN apk add --no-cache curl
 
-RUN npm install --omit=dev
+COPY package.json package-lock.json ./
+RUN npm ci --only=production && npm cache clean --force
 
-COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/init ./dist/init
 
-COPY config/config.example.yml ./dist/config.example.yml
-COPY config/traefik/traefik_config.example.yml ./dist/traefik_config.example.yml
-COPY config/traefik/dynamic_config.example.yml ./dist/dynamic_config.example.yml
 COPY server/db/names.json ./dist/names.json
 
 COPY public ./public

README.md

@@ -18,12 +18,12 @@ _Your own self-hosted zero trust tunnel._
 
 <div align="center">
   <h5>
-      <a href="https://docs.fossorial.io/Getting%20Started/quick-install">
-        Install Guide
+      <a href="https://fossorial.io">
+        Website
       </a>
       <span> | </span>
-      <a href="https://docs.fossorial.io">
-        Full Documentation
+      <a href="https://docs.fossorial.io/Getting%20Started/quick-install">
+        Install Guide
       </a>
       <span> | </span>
       <a href="mailto:numbat@fossorial.io">
@@ -136,7 +136,7 @@ View the [project board](https://github.com/orgs/fosrl/projects/1) for more deta
 
 ## Licensing
 
-Pangolin is dual licensed under the AGPLv3 and the Fossorial Commercial license. For inquiries about commercial licensing, please contact us at [numbat@fossorial.io](mailto:numbat@fossorial.io).
+Pangolin is dual licensed under the AGPL-3 and the Fossorial Commercial license. To see our commercial offerings, please see our [website](https://fossorial.io) for details. For inquiries about commercial licensing, please contact us at [numbat@fossorial.io](mailto:numbat@fossorial.io).
 
 ## Contributions
 

bruno/Auth/login.bru

@@ -12,7 +12,7 @@ post {
 
 body:json {
   {
-    "email": "owen@fossorial.io",
+    "email": "admin@fosrl.io",
     "password": "Password123!"
   }
 }

bruno/Users/adminListUsers.bru

@@ -0,0 +1,11 @@
+meta {
+  name: adminListUsers
+  type: http
+  seq: 2
+}
+
+get {
+  url: http://localhost:3000/api/v1/users
+  body: none
+  auth: none
+}

bruno/Users/adminRemoveUser.bru

@@ -0,0 +1,11 @@
+meta {
+  name: adminRemoveUser
+  type: http
+  seq: 3
+}
+
+delete {
+  url: http://localhost:3000/api/v1/user/ky5r7ivqs8wc7u4
+  body: none
+  auth: none
+}

config/config.example.yml

@@ -18,6 +18,9 @@ server:
     internal_hostname: "pangolin"
     session_cookie_name: "p_session_token"
     resource_access_token_param: "p_token"
+    resource_access_token_headers:
+        id: "P-Access-Token-Id"
+        token: "P-Access-Token"
     resource_session_request_param: "p_session_request"
 
 traefik:
@@ -35,7 +38,7 @@ gerbil:
 rate_limits:
     global:
         window_minutes: 1
-        max_requests: 100
+        max_requests: 500
 
 users:
     server_admin:

config/traefik/dynamic_config.example.yml

@@ -1,53 +0,0 @@
-http:
-  middlewares:
-    redirect-to-https:
-      redirectScheme:
-        scheme: https
-
-  routers:
-    # HTTP to HTTPS redirect router
-    main-app-router-redirect:
-      rule: "Host(`{{.DashboardDomain}}`)"
-      service: next-service
-      entryPoints:
-        - web
-      middlewares:
-        - redirect-to-https
-
-    # Next.js router (handles everything except API and WebSocket paths)
-    next-router:
-      rule: "Host(`{{.DashboardDomain}}`) && !PathPrefix(`/api/v1`)"
-      service: next-service
-      entryPoints:
-        - websecure
-      tls:
-        certResolver: letsencrypt
-
-    # API router (handles /api/v1 paths)
-    api-router:
-      rule: "Host(`{{.DashboardDomain}}`) && PathPrefix(`/api/v1`)"
-      service: api-service
-      entryPoints:
-        - websecure
-      tls:
-        certResolver: letsencrypt
-
-    # WebSocket router
-    ws-router:
-      rule: "Host(`{{.DashboardDomain}}`)"
-      service: api-service
-      entryPoints:
-        - websecure
-      tls:
-        certResolver: letsencrypt
-
-  services:
-    next-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:{{.NEXT_PORT}}"  # Next.js server
-
-    api-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:{{.EXTERNAL_PORT}}"  # API/WebSocket server

config/traefik/traefik_config.example.yml

@@ -1,44 +0,0 @@
-api:
-  insecure: true
-  dashboard: true
-
-providers:
-  http:
-    endpoint: "http://pangolin:{{.INTERNAL_PORT}}/api/v1/traefik-config"
-    pollInterval: "5s"
-  file:
-    filename: "/etc/traefik/dynamic_config.yml"
-
-experimental:
-  plugins:
-    badger:
-      moduleName: "github.com/fosrl/badger"
-      version: "v1.0.0-beta.3"
-
-log:
-  level: "INFO"
-  format: "common"
-
-certificatesResolvers:
-  letsencrypt:
-    acme:
-      httpChallenge:
-        entryPoint: web
-      email: "{{.LetsEncryptEmail}}"
-      storage: "/letsencrypt/acme.json"
-      caServer: "https://acme-v02.api.letsencrypt.org/directory"
-
-entryPoints:
-  web:
-    address: ":80"
-  websecure:
-    address: ":443"
-    transport:
-      respondingTimeouts:
-        readTimeout: "30m"
-    http:
-      tls:
-        certResolver: "letsencrypt"
-
-serversTransport:
-  insecureSkipVerify: true

drizzle.config.ts

@@ -4,10 +4,10 @@ import path from "path";
 
 export default defineConfig({
     dialect: "sqlite",
-    schema: path.join("server", "db", "schema.ts"),
+    schema: path.join("server", "db", "schemas"),
     out: path.join("server", "migrations"),
     verbose: true,
     dbCredentials: {
-        url: path.join(APP_PATH, "db", "db.sqlite"),
-    },
+        url: path.join(APP_PATH, "db", "db.sqlite")
+    }
 });

install/config/config.yml

@@ -18,6 +18,9 @@ server:
     internal_hostname: "pangolin"
     session_cookie_name: "p_session_token"
     resource_access_token_param: "p_token"
+    resource_access_token_headers:
+        id: "P-Access-Token-Id"
+        token: "P-Access-Token"
     resource_session_request_param: "p_session_request"
     cors:
         origins: ["https://{{.DashboardDomain}}"]
@@ -41,7 +44,7 @@ gerbil:
 rate_limits:
     global:
         window_minutes: 1
-        max_requests: 100
+        max_requests: 500
 {{if .EnableEmail}}
 email:
     smtp_host: "{{.EmailSMTPHost}}"

install/config/crowdsec/docker-compose.yml

@@ -22,5 +22,9 @@ services:
       - ./config/crowdsec_logs/syslog:/var/log/syslog:ro # syslog
       - ./config/crowdsec_logs:/var/log # crowdsec logs
       - ./config/traefik/logs:/var/log/traefik # traefik logs
+    ports:
+      - 6060:6060 # metrics endpoint for prometheus
+    expose:
+      - 6060 # metrics endpoint for prometheus
     restart: unless-stopped
     command: -t # Add test config flag to verify configuration

install/main.go

@@ -2,19 +2,19 @@ package main
 
 import (
 	"bufio"
+	"bytes"
 	"embed"
 	"fmt"
 	"io"
 	"io/fs"
 	"os"
-	"time"
 	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"syscall"
-	"bytes"
 	"text/template"
+	"time"
 	"unicode"
 
 	"golang.org/x/term"
@@ -48,8 +48,8 @@ type Config struct {
 	EmailSMTPPass              string
 	EmailNoReply               string
 	InstallGerbil              bool
-	TraefikBouncerKey		  string
-	DoCrowdsecInstall		  bool
+	TraefikBouncerKey          string
+	DoCrowdsecInstall          bool
 }
 
 func main() {
@@ -84,7 +84,7 @@ func main() {
 		}
 
 		fmt.Println("\n=== Starting installation ===")
-	
+
 		if isDockerInstalled() {
 			if readBool(reader, "Would you like to install and start the containers?", true) {
 				pullAndStartContainers()
@@ -95,33 +95,35 @@ func main() {
 	}
 
 	if !checkIsCrowdsecInstalledInCompose() {
-		fmt.Println("\n=== Crowdsec Install ===")
+		fmt.Println("\n=== CrowdSec Install ===")
 		// check if crowdsec is installed
-		if readBool(reader, "Would you like to install Crowdsec?", true) {
+		if readBool(reader, "Would you like to install CrowdSec?", false) {
+			fmt.Println("This installer constitutes a minimal viable CrowdSec deployment. CrowdSec will add extra complexity to your Pangolin installation and may not work to the best of its abilities out of the box. Users are expected to implement configuration adjustments on their own to achieve the best security posture. Consult the CrowdSec documentation for detailed configuration instructions.")
+			if readBool(reader, "Are you willing to manage CrowdSec?", false) {
+				if config.DashboardDomain == "" {
+					traefikConfig, err := ReadTraefikConfig("config/traefik/traefik_config.yml", "config/traefik/dynamic_config.yml")
+					if err != nil {
+						fmt.Printf("Error reading config: %v\n", err)
+						return
+					}
+					config.DashboardDomain = traefikConfig.DashboardDomain
+					config.LetsEncryptEmail = traefikConfig.LetsEncryptEmail
+					config.BadgerVersion = traefikConfig.BadgerVersion
 
-			if config.DashboardDomain == "" {
-				traefikConfig, err := ReadTraefikConfig("config/traefik/traefik_config.yml", "config/traefik/dynamic_config.yml")
-				if err != nil {
-					fmt.Printf("Error reading config: %v\n", err)
-					return
-				}
-				config.DashboardDomain = traefikConfig.DashboardDomain
-				config.LetsEncryptEmail = traefikConfig.LetsEncryptEmail
-				config.BadgerVersion = traefikConfig.BadgerVersion
-				
-				// print the values and check if they are right
-				fmt.Println("Detected values:")
-				fmt.Printf("Dashboard Domain: %s\n", config.DashboardDomain)
-				fmt.Printf("Let's Encrypt Email: %s\n", config.LetsEncryptEmail)
-				fmt.Printf("Badger Version: %s\n", config.BadgerVersion)
+					// print the values and check if they are right
+					fmt.Println("Detected values:")
+					fmt.Printf("Dashboard Domain: %s\n", config.DashboardDomain)
+					fmt.Printf("Let's Encrypt Email: %s\n", config.LetsEncryptEmail)
+					fmt.Printf("Badger Version: %s\n", config.BadgerVersion)
 
-				if !readBool(reader, "Are these values correct?", true) {
-					config = collectUserInput(reader)
+					if !readBool(reader, "Are these values correct?", true) {
+						config = collectUserInput(reader)
+					}
 				}
+
+				config.DoCrowdsecInstall = true
+				installCrowdsec(config)
 			}
-
-			config.DoCrowdsecInstall = true
-			installCrowdsec(config)
 		}
 	}
 
@@ -143,23 +145,23 @@ func readString(reader *bufio.Reader, prompt string, defaultValue string) string
 }
 
 func readPassword(prompt string, reader *bufio.Reader) string {
-    if term.IsTerminal(int(syscall.Stdin)) {
-    	fmt.Print(prompt + ": ")
-        // Read password without echo if we're in a terminal
-        password, err := term.ReadPassword(int(syscall.Stdin))
-        fmt.Println() // Add a newline since ReadPassword doesn't add one
-        if err != nil {
-            return ""
-        }
-        input := strings.TrimSpace(string(password))
-        if input == "" {
-            return readPassword(prompt, reader)
-        }
-        return input
-    } else {
+	if term.IsTerminal(int(syscall.Stdin)) {
+		fmt.Print(prompt + ": ")
+		// Read password without echo if we're in a terminal
+		password, err := term.ReadPassword(int(syscall.Stdin))
+		fmt.Println() // Add a newline since ReadPassword doesn't add one
+		if err != nil {
+			return ""
+		}
+		input := strings.TrimSpace(string(password))
+		if input == "" {
+			return readPassword(prompt, reader)
+		}
+		return input
+	} else {
 		// Fallback to reading from stdin if not in a terminal
 		return readString(reader, prompt, "")
-    }
+	}
 }
 
 func readBool(reader *bufio.Reader, prompt string, defaultValue bool) bool {
@@ -319,15 +321,15 @@ func createConfigFiles(config Config) error {
 		if !config.DoCrowdsecInstall && strings.Contains(path, "crowdsec") {
 			return nil
 		}
-		
+
 		if config.DoCrowdsecInstall && !strings.Contains(path, "crowdsec") {
 			return nil
 		}
 
-        // skip .DS_Store
-        if strings.Contains(path, ".DS_Store") {
-            return nil
-        }
+		// skip .DS_Store
+		if strings.Contains(path, ".DS_Store") {
+			return nil
+		}
 
 		if d.IsDir() {
 			// Create directory
@@ -376,7 +378,6 @@ func createConfigFiles(config Config) error {
 	return nil
 }
 
-
 func installDocker() error {
 	// Detect Linux distribution
 	cmd := exec.Command("cat", "/etc/os-release")
@@ -654,29 +655,29 @@ func moveFile(src, dst string) error {
 }
 
 func waitForContainer(containerName string) error {
-    maxAttempts := 30
-    retryInterval := time.Second * 2
+	maxAttempts := 30
+	retryInterval := time.Second * 2
 
-    for attempt := 0; attempt < maxAttempts; attempt++ {
-        // Check if container is running
-        cmd := exec.Command("docker", "container", "inspect", "-f", "{{.State.Running}}", containerName)
-        var out bytes.Buffer
-        cmd.Stdout = &out
-        
-        if err := cmd.Run(); err != nil {
-            // If the container doesn't exist or there's another error, wait and retry
-            time.Sleep(retryInterval)
-            continue
-        }
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		// Check if container is running
+		cmd := exec.Command("docker", "container", "inspect", "-f", "{{.State.Running}}", containerName)
+		var out bytes.Buffer
+		cmd.Stdout = &out
 
-        isRunning := strings.TrimSpace(out.String()) == "true"
-        if isRunning {
-            return nil
-        }
+		if err := cmd.Run(); err != nil {
+			// If the container doesn't exist or there's another error, wait and retry
+			time.Sleep(retryInterval)
+			continue
+		}
 
-        // Container exists but isn't running yet, wait and retry
-        time.Sleep(retryInterval)
-    }
+		isRunning := strings.TrimSpace(out.String()) == "true"
+		if isRunning {
+			return nil
+		}
 
-    return fmt.Errorf("container %s did not start within %v seconds", containerName, maxAttempts*int(retryInterval.Seconds()))
-}
+		// Container exists but isn't running yet, wait and retry
+		time.Sleep(retryInterval)
+	}
+
+	return fmt.Errorf("container %s did not start within %v seconds", containerName, maxAttempts*int(retryInterval.Seconds()))
+}

internationalization/es.md

@@ -0,0 +1,291 @@
+## Authentication Site
+
+
+| EN                                                       | ES                                                           | Notes      |
+| -------------------------------------------------------- | ------------------------------------------------------------ | ---------- |
+| Powered by [Pangolin](https://github.com/fosrl/pangolin) | Desarrollado por [Pangolin](https://github.com/fosrl/pangolin)  |            |
+| Authentication Required                                  | Se requiere autenticación                                    |            |
+| Choose your preferred method to access {resource}        | Elije tu método requerido para acceder a {resource}          |            |
+| PIN                                                      | PIN                                                          |            |
+| User                                                     | Usuario                                                      |            |
+| 6-digit PIN Code                                         | Código PIN de 6 dígitos                                      | pin login  |
+| Login in with PIN                                        | Registrate con PIN                                           | pin login  |
+| Email                                                    | Email                                                        | user login |
+| Enter your email                                         | Introduce tu email                                           | user login |
+| Password                                                 | Contraseña                                                   | user login |
+| Enter your password                                      | Introduce tu contraseña                                      | user login |
+| Forgot your password?                                    | ¿Olvidaste tu contraseña?                                    | user login |
+| Log in                                                   | Iniciar sesión                                               | user login |
+
+
+## Login site
+
+| EN                    | ES                                 | Notes       |
+| --------------------- | ---------------------------------- | ----------- |
+| Welcome to Pangolin   | Binvenido a Pangolin               |             |
+| Log in to get started | Registrate para comenzar           |             |
+| Email                 | Email                              |             |
+| Enter your email      | Introduce tu email                 | placeholder |
+| Password              | Contraseña                         |             |
+| Enter your password   | Introduce tu contraseña            | placeholder |
+| Forgot your password? | ¿Olvidaste tu contraseña?          |             |
+| Log in                | Iniciar sesión                     |             |
+
+# Ogranization site after successful login
+
+| EN                                        | ES                                           | Notes |
+| ----------------------------------------- | -------------------------------------------- | ----- |
+| Welcome to Pangolin                       | Binvenido a Pangolin                         |       |
+| You're a member of {number} organization. | Eres miembro de la organización {number}.    |       |
+
+## Shared Header, Navbar and Footer
+##### Header
+
+| EN                  | ES                  | Notes |
+| ------------------- | ------------------- | ----- |
+| Documentation       | Documentación       |       |
+| Support             | Soporte             |       |
+| Organization {name} | Organización {name} |       |
+##### Organization selector
+
+| EN               | ES                | Notes |
+| ---------------- | ----------------- | ----- |
+| Search…          | Buscar…           |       |
+| Create           | Crear             |       |
+| New Organization | Nueva Organización|       |
+| Organizations    | Organizaciones    |       |
+
+##### Navbar
+
+| EN              | ES                     | Notes |
+| --------------- | -----------------------| ----- |
+| Sites           | Sitios                 |       |
+| Resources       | Recursos               |       |
+| User & Roles    | Usuarios y roles       |       |
+| Shareable Links | Enlaces para compartir |       |
+| General         | General                |       |
+
+##### Footer
+| EN                        | ES                          |                             |
+| ------------------------- | --------------------------- | -------|
+| Page {number} of {number} | Página {number} de {number} | footer |        
+| Rows per page             | Filas por página            | footer |
+| Pangolin                  | Pangolin                    | footer |
+| Built by Fossorial        | Construido por Fossorial    | footer |
+| Open Source               | Código abierto              | footer |
+| Documentation             | Documentación               | footer |
+| {version}                 | {version}                   | footer |
+
+## Main “Sites”
+##### “Hero” section
+
+| EN                                                           | ES                                                           | Notes |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----- |
+| Newt (Recommended)                                           | Newt (Recomendado)                                           |       |
+| For the best user experience, use Newt. It uses WireGuard under the hood and allows you to address your private resources by their LAN address on your private network from within the Pangolin dashboard. | Para obtener la mejor experiencia de usuario, utiliza Newt. Utiliza WireGuard internamente y te permite abordar tus recursos privados mediante tu dirección LAN en tu red privada desde el panel de Pangolin. |       |
+| Runs in Docker                                               | Se ejecuta en Docker                                         |       |
+| Runs in shell on macOS, Linux, and Windows                   | Se ejecuta en shell en macOS, Linux y Windows                |       |
+| Install Newt                                                 | Instalar Newt                                                |       |
+| Basic WireGuard<br>                                          | WireGuard básico<br>                                         |       | 
+| Compatible with all WireGuard clients<br>                    | Compatible con todos los clientes WireGuard<br>              |       |
+| Manual configuration required                                | Se requiere configuración manual                             |       |
+
+##### Content
+
+| EN                                                        | ES                                                           | Notes                            |
+| --------------------------------------------------------- | ------------------------------------------------------------ | -------------------------------- |
+| Manage Sites                                              | Administrar sitios                                           |                                  |
+| Allow connectivity to your network through secure tunnels | Permitir la conectividad a tu red a través de túneles seguros|                                  |
+| Search sites                                              | Buscar sitios                                                | placeholder                      |
+| Add Site                                                  | Agregar sitio                                                |                                  |
+| Name                                                      | Nombre                                                       | table header                     |
+| Online                                                    | Conectado                                                    | table header                     |
+| Site                                                      | Sitio                                                        | table header                     |
+| Data In                                                   | Datos en                                                     | table header                     |
+| Data Out                                                  | Datos de salida                                              | table header                     |
+| Connection Type                                           | Tipo de conexión                                             | table header                     |
+| Online                                                    | Conectado                                                    | site state                       |
+| Offline                                                   | Desconectado                                                 | site state                       |
+| Edit →                                                    | Editar →                                                     |                                  |
+| View settings                                             | Ver configuración                                            | Popup after clicking “…” on site |
+| Delete                                                    | Borrar                                                       | Popup after clicking “…” on site |
+
+##### Add Site Popup
+
+| EN                                                     | ES                                                          | Notes       |
+| ------------------------------------------------------ | ----------------------------------------------------------- | ----------- |
+| Create Site                                            | Crear sitio                                                 |             |
+| Create a new site to start connection for this site    | Crear un nuevo sitio para iniciar la conexión para este sitio |             |
+| Name                                                   | Nombre                                                      |             |
+| Site name                                              | Nombre del sitio                                            | placeholder |
+| This is the name that will be displayed for this site. | Este es el nombre que se mostrará para este sitio.          | desc        |
+| Method                                                 | Método                                                      |             |
+| Local                                                  | Local                                                       |             |
+| Newt                                                   | Newt                                                        |             |
+| WireGuard                                              | WireGuard                                                   |             |
+| This is how you will expose connections.               | Así es como expondrás las conexiones.                       |             |
+| You will only be able to see the configuration once.   | Solo podrás ver la configuración una vez.                   |             |
+| Learn how to install Newt on your system               | Aprende a instalar Newt en tu sistema                       |             |
+| I have copied the config                               | He copiado la configuración                                 |             |
+| Create Site                                            | Crear sitio                                                 |             |
+| Close                                                  | Cerrar                                                      |             |
+
+## Main “Resources”
+
+##### “Hero” section
+
+| EN                                                           | ES                                                           | Notes |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----- |
+| Resources                                                    | Recursos                                                     |       |
+| Ressourcen sind Proxy-Server für Anwendungen, die in Ihrem privaten Netzwerk laufen. Erstellen Sie eine Ressource für jede HTTP- oder HTTPS-Anwendung in Ihrem privaten Netzwerk. Jede Ressource muss mit einer Website verbunden sein, um eine private und sichere Verbindung über den verschlüsselten WireGuard-Tunnel zu ermöglichen. |Los recursos son servidores proxy para aplicaciones que se ejecutan en su red privada. Cree un recurso para cada aplicación HTTP o HTTPS en su red privada. Cada recurso debe estar conectado a un sitio web para proporcionar una conexión privada y segura a través del túnel cifrado WireGuard. |       |
+| Secure connectivity with WireGuard encryption                | Conectividad segura con encriptación WireGuard               |       |
+| Configure multiple authentication methods                    | Configura múltiples métodos de autenticación                 |       |
+| User and role-based access control                           | Control de acceso basado en usuarios y roles                 |       |
+
+##### Content
+
+| EN                                                 | ES                                                         | Notes                |
+| -------------------------------------------------- | ---------------------------------------------------------- | -------------------- |
+| Manage Resources                                   | Administrar recursos                                       |                      |
+| Create secure proxies to your private applications | Crea servidores proxy seguros para tus aplicaciones privadas |                      |
+| Search resources                                   | Buscar recursos                                            | placeholder          |
+| Name                                               | Nombre                                                     |                      |
+| Site                                               | Sitio                                                      |                      |
+| Full URL                                           | URL completa                                               |                      |
+| Authentication                                     | Autenticación                                              |                      |
+| Not Protected                                      | No protegido                                               | authentication state |
+| Protected                                          | Protegido                                                  | authentication state |
+| Edit →                                             | Editar →                                                   |                      |
+| Add Resource                                       | Agregar recurso                                            |                      |
+
+##### Add Resource Popup
+
+| EN                                                           | ES                                                           | Notes               |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ------------------- |
+| Create Resource                                              | Crear recurso                                                |                     |
+| Create a new resource to proxy request to your app           | Crea un nuevo recurso para enviar solicitudes a tu aplicación |                     |
+| Name                                                         | Nombre                                                        |                     |
+| My Resource                                                  | Mi recurso                                                    | name placeholder    |
+| This is the name that will be displayed for this resource.   | Este es el nombre que se mostrará para este recurso.         |                     |
+| Subdomain                                                    | Subdominio                                                    |                     |
+| Enter subdomain                                              | Ingresar subdominio                                           |                     |
+| This is the fully qualified domain name that will be used to access the resource. | Este es el nombre de dominio completo que se utilizará para acceder al recurso. |                     |
+| Site                                                         | Sitio                                                        |                     |
+| Search site…                                                 | Buscar sitio…                                                | Site selector popup |
+| This is the site that will be used in the dashboard.         | Este es el sitio que se utilizará en el panel de control.    |                     |
+| Create Resource                                              | Crear recurso                                                |                     |
+| Close                                                        | Cerrar                                                       |                     |
+
+## Main “User & Roles”
+##### Content
+
+| EN                                                           | ES                                                           | Notes                         |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------------- |
+| Manage User & Roles                                          | Administrar usuarios y roles                                 |                               |
+| Invite users and add them to roles to manage access to your organization | Invita a usuarios y agrégalos a roles para administrar el acceso a tu organización |                               |
+| Users                                                        | Usuarios                                                     | sidebar item                  |
+| Roles                                                        | Roles                                                        | sidebar item                  |
+| **User tab**                                                 | **Pestaña de usuario**                                                            |                               |
+| Search users                                                 | Buscar usuarios                                              | placeholder                   |
+| Invite User                                                  | Invitar usuario                                           | addbutton                     |
+| Email                                                        | Email                                                       | table header                  |
+| Status                                                       | Estado                                                       | table header                  |
+| Role                                                         | Role                                                         | table header                  |
+| Confirmed                                                    | Confirmado                                                   | account status                |
+| Not confirmed (?)                                            | No confirmado (?)                                            | unknown for me account status |
+| Owner                                                        | Dueño                                                        | role                          |
+| Admin                                                        | Administrador                                                | role                          |
+| Member                                                       | Miembro                                                      | role                          |
+| **Roles Tab**                                                | **Pestaña Roles**                                            |                               |
+| Search roles                                                 | Buscar roles                                                 | placeholder                   |
+| Add Role                                                     | Agregar rol                                                  | addbutton                     |
+| Name                                                         | Nombre                                                       | table header                  |
+| Description                                                  | Descripción                                                  | table header                  |
+| Admin                                                        | Administrador                                                | role                          |
+| Member                                                       | Miembro                                                      | role                          |
+| Admin role with the most permissions                         | Rol de administrador con más permisos                        | admin role desc               |
+| Members can only view resources                              | Los miembros sólo pueden ver los recursos                    | member role desc              |
+
+##### Invite User popup
+
+| EN                | ES                                                      | Notes       |
+| ----------------- | ------------------------------------------------------- | ----------- |
+| Invite User       | Invitar usuario                                         |             |
+| Email             | Email                                                   |             |
+| Enter an email    | Introduzca un email                                     | placeholder |
+| Role              | Rol                                                     |             |
+| Select role       | Seleccionar rol                                         | placeholder |
+| Gültig für        | Válido para                                             |             |
+| 1 day             | 1 día                                                   |             |
+| 2 days            | 2 días                                                  |             |
+| 3 days            | 3 días                                                  |             |
+| 4 days            | 4 días                                                  |             |
+| 5 days            | 5 días                                                  |             |
+| 6 days            | 6 días                                                  |             |
+| 7 days            | 7 días                                                  |             |
+| Create Invitation | Crear invitación                                        |             |
+| Close             | Cerrar                                                  |             |
+
+
+## Main “Shareable Links”
+##### “Hero” section
+
+| EN                                                           | ES                                                           | Notes |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----- |
+| Shareable Links                                              | Enlaces para compartir                                       |       |
+| Create shareable links to your resources. Links provide temporary or unlimited access to your resource. You can configure the expiration duration of the link when you create one. | Crear enlaces que se puedan compartir a tus recursos. Los enlaces proporcionan acceso temporal o ilimitado a tu recurso. Puedes configurar la duración de caducidad del enlace cuando lo creas.                                |       |
+| Easy to create and share                                     | Fácil de crear y compartir                                   |       |
+| Configurable expiration duration                             | Duración de expiración configurable                          |       |
+| Secure and revocable                                         | Seguro y revocable                                           |       |
+##### Content
+
+| EN                                                           | ES                                                           | Notes             |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----------------- |
+| Manage Shareable Links                                       | Administrar enlaces compartibles                             |                   |
+| Create shareable links to grant temporary or permanent access to your resources | Crear enlaces compartibles para otorgar acceso temporal o permanente a tus recursos |                   |
+| Search links                                                 | Buscar enlaces                                               | placeholder       |
+| Create Share Link                                            | Crear enlace para compartir                                  | addbutton         |
+| Resource                                                     | Recurso                                                      | table header      |
+| Title                                                        | Título                                                       | table header      |
+| Created                                                      | Creado                                                       | table header      |
+| Expires                                                      | Caduca                                                       | table header      |
+| No links. Create one to get started.                         | No hay enlaces. Crea uno para comenzar.                      | table placeholder |
+
+##### Create Shareable Link popup
+
+| EN                                                           | ES                                                           | Notes                   |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ----------------------- |
+| Create Shareable Link                                        | Crear un enlace para compartir                               |                         |
+| Anyone with this link can access the resource                | Cualquier persona con este enlace puede acceder al recurso.  |                         |
+| Resource                                                     | Recurso                                                      |                         |
+| Select resource                                              | Seleccionar recurso                                          |                         |
+| Search resources…                                            | Buscar recursos…                                             | resource selector popup |
+| Title (optional)                                             | Título (opcional)                                            |                         |
+| Enter title                                                  | Introducir título                                            | placeholder             |
+| Expire in                                                    | Caduca en                                                    |                         |
+| Minutes                                                      | Minutos                                                      |                         |
+| Hours                                                        | Horas                                                        |                         |
+| Days                                                         | Días                                                         |                         |
+| Months                                                       | Meses                                                        |                         |
+| Years                                                        | Años                                                         |                         |
+| Never expire                                                 | Nunca caduca                                                 |                         |
+| Expiration time is how long the link will be usable and provide access to the resource. After this time, the link will no longer work, and users who used this link will lose access to the resource. | El tiempo de expiración es el tiempo durante el cual el enlace se podrá utilizar y brindará acceso al recurso. Después de este tiempo, el enlace dejará de funcionar y los usuarios que lo hayan utilizado perderán el acceso al recurso. |                         |
+| Create Link                                                  | Crear enlace                                                |                         |
+| Close                                                        | Cerrar                                                      |                         |
+
+
+## Main “General”
+
+| EN                                                           | ES                                                           | Notes        |
+| ------------------------------------------------------------ | ------------------------------------------------------------ | ------------ |
+| General                                                      | General                                                      |              |
+| Configure your organization’s general settings               | Configura los ajustes generales de tu organización           |              |
+| General                                                      | General                                                      | sidebar item |
+| Organization Settings                                        | Configuración de la organización                             |              |
+| Manage your organization details and configuration           | Administra los detalles y la configuración de tu organización|              |
+| Name                                                         | Nombre                                                       |              |
+| This is the display name of the org                          | Este es el nombre para mostrar de la organización.           |              |
+| Save Settings                                                | Guardar configuración                                        |              |
+| Danger Zone                                                  | Zona de peligro                                              |              |
+| Once you delete this org, there is no going back. Please be certain. | Una vez que elimines esta organización, no habrá vuelta atrás. Asegúrate de hacerlo. |              |
+| Delete Organization Data                                     | Eliminar datos de la organización                             |              |

next.config.mjs

@@ -2,7 +2,8 @@
 const nextConfig = {
     eslint: {
         ignoreDuringBuilds: true,
-    }
+    },
+    output: "standalone"
 };
 
 export default nextConfig;

package.json

@@ -57,6 +57,7 @@
         "glob": "11.0.0",
         "helmet": "8.0.0",
         "http-errors": "2.0.0",
+        "i": "^0.3.7",
         "input-otp": "1.4.1",
         "js-yaml": "4.1.0",
         "lucide-react": "0.469.0",
@@ -66,12 +67,14 @@
         "node-cache": "5.1.2",
         "node-fetch": "3.3.2",
         "nodemailer": "6.9.16",
+        "npm": "^11.2.0",
         "oslo": "1.2.1",
         "qrcode.react": "4.2.0",
         "react": "19.0.0",
         "react-dom": "19.0.0",
         "react-easy-sort": "^1.6.0",
         "react-hook-form": "7.54.2",
+        "react-icons": "^5.5.0",
         "rebuild": "0.1.2",
         "semver": "7.6.3",
         "tailwind-merge": "2.6.0",

server/apiServer.ts

@@ -14,7 +14,7 @@ import { logIncomingMiddleware } from "./middlewares/logIncoming";
 import { csrfProtectionMiddleware } from "./middlewares/csrfProtection";
 import helmet from "helmet";
 
-const dev = process.env.ENVIRONMENT !== "prod";
+const dev = config.isDev;
 const externalPort = config.getRawConfig().server.external_port;
 
 export function createApiServer() {

server/auth/actions.ts

@@ -1,6 +1,6 @@
 import { Request } from "express";
 import { db } from "@server/db";
-import { userActions, roleActions, userOrgs } from "@server/db/schema";
+import { userActions, roleActions, userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
@@ -63,6 +63,7 @@ export enum ActionsEnum {
     listResourceRules = "listResourceRules",
     updateResourceRule = "updateResourceRule",
     listOrgDomains = "listOrgDomains",
+    createNewt = "createNewt",
 }
 
 export async function checkUserActionPermission(

server/auth/canUserAccessResource.ts

@@ -1,6 +1,6 @@
 import db from "@server/db";
 import { and, eq } from "drizzle-orm";
-import { roleResources, userResources } from "@server/db/schema";
+import { roleResources, userResources } from "@server/db/schemas";
 
 export async function canUserAccessResource({
     userId,

server/auth/checkValidInvite.ts

@@ -1,5 +1,5 @@
 import db from "@server/db";
-import { UserInvite, userInvites } from "@server/db/schema";
+import { UserInvite, userInvites } from "@server/db/schemas";
 import { isWithinExpirationDate } from "oslo";
 import { verifyPassword } from "./password";
 import { eq } from "drizzle-orm";

server/auth/limits.ts

@@ -1,5 +1,5 @@
 import { db } from '@server/db';
-import { limitsTable } from '@server/db/schema';
+import { limitsTable } from '@server/db/schemas';
 import { and, eq } from 'drizzle-orm';
 import createHttpError from 'http-errors';
 import HttpCode from '@server/types/HttpCode';
@@ -37,4 +37,4 @@ export async function checkOrgLimit({ orgId, limitName, currentValue, increment
         }
         throw createHttpError(HttpCode.INTERNAL_SERVER_ERROR, 'Unknown error occurred while checking limit');
     }
-}
+}

server/auth/resourceOtp.ts

@@ -1,5 +1,5 @@
 import db from "@server/db";
-import { resourceOtp } from "@server/db/schema";
+import { resourceOtp } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import { createDate, isWithinExpirationDate, TimeSpan } from "oslo";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";

server/auth/sendEmailVerificationCode.ts

@@ -1,7 +1,7 @@
 import { TimeSpan, createDate } from "oslo";
 import { generateRandomString, alphabet } from "oslo/crypto";
 import db from "@server/db";
-import { users, emailVerificationCodes } from "@server/db/schema";
+import { users, emailVerificationCodes } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { sendEmail } from "@server/emails";
 import config from "@server/lib/config";

server/auth/sessions/app.ts

@@ -9,7 +9,7 @@ import {
     sessions,
     User,
     users
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import db from "@server/db";
 import { eq, inArray } from "drizzle-orm";
 import config from "@server/lib/config";

server/auth/sessions/newt.ts

@@ -2,7 +2,7 @@ import {
     encodeHexLowerCase,
 } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
-import { Newt, newts, newtSessions, NewtSession } from "@server/db/schema";
+import { Newt, newts, newtSessions, NewtSession } from "@server/db/schemas";
 import db from "@server/db";
 import { eq } from "drizzle-orm";
 

server/auth/sessions/resource.ts

@@ -1,6 +1,6 @@
 import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
-import { resourceSessions, ResourceSession } from "@server/db/schema";
+import { resourceSessions, ResourceSession } from "@server/db/schemas";
 import db from "@server/db";
 import { eq, and } from "drizzle-orm";
 import config from "@server/lib/config";
@@ -170,16 +170,17 @@ export function serializeResourceSessionCookie(
     isHttp: boolean = false,
     expiresAt?: Date
 ): string {
+    const now = new Date().getTime();
     if (!isHttp) {
         if (expiresAt === undefined) {
-            return `${cookieName}_s=${token}; HttpOnly; SameSite=Lax; Path=/; Secure; Domain=${"." + domain}`;
+            return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Secure; Domain=${"." + domain}`;
         }
-        return `${cookieName}_s=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${"." + domain}`;
+        return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${"." + domain}`;
     } else {
         if (expiresAt === undefined) {
-            return `${cookieName}=${token}; HttpOnly; SameSite=Lax; Path=/; Domain=${"." + domain}`;
+            return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Domain=${"." + domain}`;
         }
-        return `${cookieName}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Domain=${"." + domain}`;
+        return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Domain=${"." + domain}`;
     }
 }
 

server/auth/totp.ts

@@ -1,6 +1,6 @@
 import { verify } from "@node-rs/argon2";
 import db from "@server/db";
-import { twoFactorBackupCodes } from "@server/db/schema";
+import { twoFactorBackupCodes } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { decodeHex } from "oslo/encoding";
 import { TOTPController } from "oslo/otp";

server/auth/verifyResourceAccessToken.ts

@@ -3,53 +3,95 @@ import {
     Resource,
     ResourceAccessToken,
     resourceAccessToken,
-} from "@server/db/schema";
+    resources
+} from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import { isWithinExpirationDate } from "oslo";
 import { verifyPassword } from "./password";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+import { sha256 } from "@oslojs/crypto/sha2";
 
 export async function verifyResourceAccessToken({
-    resource,
+    accessToken,
     accessTokenId,
-    accessToken
+    resourceId
 }: {
-    resource: Resource;
-    accessTokenId: string;
     accessToken: string;
+    accessTokenId?: string;
+    resourceId?: number; // IF THIS IS NOT SET, THE TOKEN IS VALID FOR ALL RESOURCES
 }): Promise<{
     valid: boolean;
     error?: string;
     tokenItem?: ResourceAccessToken;
+    resource?: Resource;
 }> {
-    const [result] = await db
-        .select()
-        .from(resourceAccessToken)
-        .where(
-            and(
-                eq(resourceAccessToken.resourceId, resource.resourceId),
-                eq(resourceAccessToken.accessTokenId, accessTokenId)
-            )
-        )
-        .limit(1);
+    const accessTokenHash = encodeHexLowerCase(
+        sha256(new TextEncoder().encode(accessToken))
+    );
 
-    const tokenItem = result;
+    let tokenItem: ResourceAccessToken | undefined;
+    let resource: Resource | undefined;
 
-    if (!tokenItem) {
+    if (!accessTokenId) {
+        const [res] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(and(eq(resourceAccessToken.tokenHash, accessTokenHash)))
+            .innerJoin(
+                resources,
+                eq(resourceAccessToken.resourceId, resources.resourceId)
+            );
+
+        tokenItem = res?.resourceAccessToken;
+        resource = res?.resources;
+    } else {
+        const [res] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(and(eq(resourceAccessToken.accessTokenId, accessTokenId)))
+            .innerJoin(
+                resources,
+                eq(resourceAccessToken.resourceId, resources.resourceId)
+            );
+
+        if (res && res.resourceAccessToken) {
+            if (res.resourceAccessToken.tokenHash?.startsWith("$argon")) {
+                const validCode = await verifyPassword(
+                    accessToken,
+                    res.resourceAccessToken.tokenHash
+                );
+
+                if (!validCode) {
+                    return {
+                        valid: false,
+                        error: "Invalid access token"
+                    };
+                }
+            } else {
+                const tokenHash = encodeHexLowerCase(
+                    sha256(new TextEncoder().encode(accessToken))
+                );
+
+                if (res.resourceAccessToken.tokenHash !== tokenHash) {
+                    return {
+                        valid: false,
+                        error: "Invalid access token"
+                    };
+                }
+            }
+        }
+
+        tokenItem = res?.resourceAccessToken;
+        resource = res?.resources;
+    }
+
+    if (!tokenItem || !resource) {
         return {
             valid: false,
             error: "Access token does not exist for resource"
         };
     }
 
-    const validCode = await verifyPassword(accessToken, tokenItem.tokenHash);
-
-    if (!validCode) {
-        return {
-            valid: false,
-            error: "Invalid access token"
-        };
-    }
-
     if (
         tokenItem.expiresAt &&
         !isWithinExpirationDate(new Date(tokenItem.expiresAt))
@@ -60,8 +102,16 @@ export async function verifyResourceAccessToken({
         };
     }
 
+    if (resourceId && resource.resourceId !== resourceId) {
+        return {
+            valid: false,
+            error: "Resource ID does not match"
+        };
+    }
+
     return {
         valid: true,
-        tokenItem
+        tokenItem,
+        resource
     };
 }

server/db/index.ts

@@ -1,6 +1,6 @@
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import Database from "better-sqlite3";
-import * as schema from "@server/db/schema";
+import * as schema from "@server/db/schemas";
 import path from "path";
 import fs from "fs/promises";
 import { APP_PATH } from "@server/lib/consts";

server/db/names.ts

@@ -1,7 +1,7 @@
 import { join } from "path";
 import { readFileSync } from "fs";
 import { db } from "@server/db";
-import { exitNodes, sites } from "./schema";
+import { exitNodes, sites } from "./schemas/schema";
 import { eq, and } from "drizzle-orm";
 import { __DIRNAME } from "@server/lib/consts";
 

server/db/schemas/index.ts

@@ -0,0 +1 @@
+export * from "./schema";

server/db/schemas/schema.ts

@@ -76,7 +76,8 @@ export const resources = sqliteTable("resources", {
     isBaseDomain: integer("isBaseDomain", { mode: "boolean" }),
     applyRules: integer("applyRules", { mode: "boolean" })
         .notNull()
-        .default(false)
+        .default(false),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true)
 });
 
 export const targets = sqliteTable("targets", {
@@ -405,6 +406,15 @@ export const resourceRules = sqliteTable("resourceRules", {
     value: text("value").notNull()
 });
 
+export const supporterKey = sqliteTable("supporterKey", {
+    keyId: integer("keyId").primaryKey({ autoIncrement: true }),
+    key: text("key").notNull(),
+    githubUsername: text("githubUsername").notNull(),
+    phrase: text("phrase"),
+    tier: text("tier"),
+    valid: integer("valid", { mode: "boolean" }).notNull().default(false)
+});
+
 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
 export type Site = InferSelectModel<typeof sites>;
@@ -439,3 +449,4 @@ export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
 export type VersionMigration = InferSelectModel<typeof versionMigrations>;
 export type ResourceRule = InferSelectModel<typeof resourceRules>;
 export type Domain = InferSelectModel<typeof domains>;
+export type SupporterKey = InferSelectModel<typeof supporterKey>;

server/index.ts

@@ -2,7 +2,7 @@ import { runSetupFunctions } from "./setup";
 import { createApiServer } from "./apiServer";
 import { createNextServer } from "./nextServer";
 import { createInternalServer } from "./internalServer";
-import { Session, User, UserOrg } from "./db/schema";
+import { Session, User, UserOrg } from "./db/schemas/schema";
 
 async function startServers() {
     await runSetupFunctions();

server/lib/canUserAccessResource.ts

@@ -1,6 +1,6 @@
 import db from "@server/db";
 import { and, eq } from "drizzle-orm";
-import { roleResources, userResources } from "@server/db/schema";
+import { roleResources, userResources } from "@server/db/schemas";
 
 export async function canUserAccessResource({
     userId,

server/lib/config.ts

@@ -1,25 +1,21 @@
 import fs from "fs";
 import yaml from "js-yaml";
-import path from "path";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import {
     __DIRNAME,
-    APP_PATH,
     APP_VERSION,
     configFilePath1,
     configFilePath2
 } from "@server/lib/consts";
 import { passwordSchema } from "@server/auth/passwordSchema";
 import stoi from "./stoi";
+import db from "@server/db";
+import { SupporterKey, supporterKey } from "@server/db/schemas";
+import { suppressDeprecationWarnings } from "moment";
+import { eq } from "drizzle-orm";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
-// const hostnameSchema = z
-//     .string()
-//     .regex(
-//         /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z]|[A-Za-z][A-Za-z0-9\-]*[A-Za-z0-9])$/
-//     )
-//     .or(z.literal("localhost"));
 
 const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
     return process.env[envVar] ?? valFromYaml;
@@ -31,7 +27,6 @@ const configSchema = z.object({
             .string()
             .url()
             .optional()
-            .transform(getEnvOrYaml("APP_DASHBOARDURL"))
             .pipe(z.string().url())
             .transform((url) => url.toLowerCase()),
         log_level: z.enum(["debug", "info", "warn", "error"]),
@@ -63,40 +58,18 @@ const configSchema = z.object({
             {
                 message: "At least one domain must be defined"
             }
-        )
-        .refine(
-            (domains) => {
-                const envBaseDomain = process.env.APP_BASE_DOMAIN;
-
-                if (envBaseDomain) {
-                    return z.string().nonempty().safeParse(envBaseDomain).success;
-                }
-
-                return true;
-            },
-            {
-                message: "APP_BASE_DOMAIN must be a valid hostname"
-            }
         ),
     server: z.object({
-        external_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_EXTERNALPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
-        internal_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_INTERNALPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
-        next_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_NEXTPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
+        external_port: portSchema.optional().transform(stoi).pipe(portSchema),
+        internal_port: portSchema.optional().transform(stoi).pipe(portSchema),
+        next_port: portSchema.optional().transform(stoi).pipe(portSchema),
         internal_hostname: z.string().transform((url) => url.toLowerCase()),
         session_cookie_name: z.string(),
         resource_access_token_param: z.string(),
+        resource_access_token_headers: z.object({
+            id: z.string(),
+            token: z.string()
+        }),
         resource_session_request_param: z.string(),
         dashboard_session_length_hours: z
             .number()
@@ -126,15 +99,10 @@ const configSchema = z.object({
         additional_middlewares: z.array(z.string()).optional()
     }),
     gerbil: z.object({
-        start_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("GERBIL_STARTPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
+        start_port: portSchema.optional().transform(stoi).pipe(portSchema),
         base_endpoint: z
             .string()
             .optional()
-            .transform(getEnvOrYaml("GERBIL_BASEENDPOINT"))
             .pipe(z.string())
             .transform((url) => url.toLowerCase()),
         use_subdomain: z.boolean(),
@@ -195,12 +163,14 @@ const configSchema = z.object({
 export class Config {
     private rawConfig!: z.infer<typeof configSchema>;
 
+    supporterData: SupporterKey | null = null;
+
+    supporterHiddenUntil: number | null = null;
+
+    isDev: boolean = process.env.ENVIRONMENT !== "prod";
+
     constructor() {
         this.loadConfig();
-
-        if (process.env.GENERATE_TRAEFIK_CONFIG === "true") {
-            this.createTraefikConfig();
-        }
     }
 
     public loadConfig() {
@@ -225,45 +195,17 @@ export class Config {
         } else if (fs.existsSync(configFilePath2)) {
             environment = loadConfig(configFilePath2);
         }
-        if (!environment) {
-            const exampleConfigPath = path.join(
-                __DIRNAME,
-                "config.example.yml"
+
+        if (process.env.APP_BASE_DOMAIN) {
+            console.log(
+                "You're using deprecated environment variables. Transition to the configuration file. https://docs.fossorial.io/"
             );
-            if (fs.existsSync(exampleConfigPath)) {
-                try {
-                    const exampleConfigContent = fs.readFileSync(
-                        exampleConfigPath,
-                        "utf8"
-                    );
-                    fs.writeFileSync(
-                        configFilePath1,
-                        exampleConfigContent,
-                        "utf8"
-                    );
-                    environment = loadConfig(configFilePath1);
-                } catch (error) {
-                    console.log(
-                        "See the docs for information about what to include in the configuration file: https://docs.fossorial.io/Pangolin/Configuration/config"
-                    );
-                    if (error instanceof Error) {
-                        throw new Error(
-                            `Error creating configuration file from example: ${
-                                error.message
-                            }`
-                        );
-                    }
-                    throw error;
-                }
-            } else {
-                throw new Error(
-                    "No configuration file found and no example configuration available"
-                );
-            }
         }
 
         if (!environment) {
-            throw new Error("No configuration file found");
+            throw new Error(
+                "No configuration file found. Please create one. https://docs.fossorial.io/"
+            );
         }
 
         const parsedConfig = configSchema.safeParse(environment);
@@ -301,6 +243,10 @@ export class Config {
             : "false";
         process.env.RESOURCE_ACCESS_TOKEN_PARAM =
             parsedConfig.data.server.resource_access_token_param;
+        process.env.RESOURCE_ACCESS_TOKEN_HEADERS_ID =
+            parsedConfig.data.server.resource_access_token_headers.id;
+        process.env.RESOURCE_ACCESS_TOKEN_HEADERS_TOKEN =
+            parsedConfig.data.server.resource_access_token_headers.token;
         process.env.RESOURCE_SESSION_REQUEST_PARAM =
             parsedConfig.data.server.resource_session_request_param;
         process.env.FLAGS_ALLOW_BASE_DOMAIN_RESOURCES = parsedConfig.data.flags
@@ -309,15 +255,8 @@ export class Config {
             : "false";
         process.env.DASHBOARD_URL = parsedConfig.data.app.dashboard_url;
 
-        if (process.env.APP_BASE_DOMAIN) {
-            console.log(
-                `DEPRECATED! APP_BASE_DOMAIN is deprecated and will be removed in a future release. Use the domains section in the configuration file instead. See https://docs.fossorial.io/Pangolin/Configuration/config for more information.`
-            );
-
-            parsedConfig.data.domains.domain1 = {
-                base_domain: process.env.APP_BASE_DOMAIN,
-                cert_resolver: "letsencrypt"
-            };
+        if (!this.isDev) {
+            this.checkSupporterKey();
         }
 
         this.rawConfig = parsedConfig.data;
@@ -337,71 +276,89 @@ export class Config {
         return this.rawConfig.domains[domainId];
     }
 
-    private createTraefikConfig() {
+    public hideSupporterKey(days: number = 7) {
+        const now = new Date().getTime();
+
+        if (this.supporterHiddenUntil && now < this.supporterHiddenUntil) {
+            return;
+        }
+
+        this.supporterHiddenUntil = now + 1000 * 60 * 60 * 24 * days;
+    }
+
+    public isSupporterKeyHidden() {
+        const now = new Date().getTime();
+
+        if (this.supporterHiddenUntil && now < this.supporterHiddenUntil) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public async checkSupporterKey() {
+        const [key] = await db.select().from(supporterKey).limit(1);
+
+        if (!key) {
+            return;
+        }
+
+        const { key: licenseKey, githubUsername } = key;
+
         try {
-            // check if traefik_config.yml and dynamic_config.yml exists in APP_PATH/traefik
-            const defaultTraefikConfigPath = path.join(
-                __DIRNAME,
-                "traefik_config.example.yml"
-            );
-            const defaultDynamicConfigPath = path.join(
-                __DIRNAME,
-                "dynamic_config.example.yml"
+            const response = await fetch(
+                "https://api.dev.fossorial.io/api/v1/license/validate",
+                {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json"
+                    },
+                    body: JSON.stringify({
+                        licenseKey,
+                        githubUsername
+                    })
+                }
             );
 
-            const traefikPath = path.join(APP_PATH, "traefik");
-            if (!fs.existsSync(traefikPath)) {
+            if (!response.ok) {
+                this.supporterData = key;
                 return;
             }
 
-            // load default configs
-            let traefikConfig = fs.readFileSync(
-                defaultTraefikConfigPath,
-                "utf8"
-            );
-            let dynamicConfig = fs.readFileSync(
-                defaultDynamicConfigPath,
-                "utf8"
-            );
+            const data = await response.json();
 
-            traefikConfig = traefikConfig
-                .split("{{.LetsEncryptEmail}}")
-                .join(this.rawConfig.users.server_admin.email);
-            traefikConfig = traefikConfig
-                .split("{{.INTERNAL_PORT}}")
-                .join(this.rawConfig.server.internal_port.toString());
+            if (!data.data.valid) {
+                this.supporterData = {
+                    ...key,
+                    valid: false
+                };
+                return;
+            }
 
-            dynamicConfig = dynamicConfig
-                .split("{{.DashboardDomain}}")
-                .join(new URL(this.rawConfig.app.dashboard_url).hostname);
-            dynamicConfig = dynamicConfig
-                .split("{{.NEXT_PORT}}")
-                .join(this.rawConfig.server.next_port.toString());
-            dynamicConfig = dynamicConfig
-                .split("{{.EXTERNAL_PORT}}")
-                .join(this.rawConfig.server.external_port.toString());
+            this.supporterData = {
+                ...key,
+                tier: data.data.tier,
+                valid: true
+            };
 
-            // write thiese to the traefik directory
-            const traefikConfigPath = path.join(
-                traefikPath,
-                "traefik_config.yml"
-            );
-            const dynamicConfigPath = path.join(
-                traefikPath,
-                "dynamic_config.yml"
-            );
-
-            fs.writeFileSync(traefikConfigPath, traefikConfig, "utf8");
-            fs.writeFileSync(dynamicConfigPath, dynamicConfig, "utf8");
-
-            console.log("Traefik configuration files created");
+            // update the supporter key in the database
+            await db
+                .update(supporterKey)
+                .set({
+                    tier: data.data.tier || null,
+                    phrase: data.data.cutePhrase || null,
+                    valid: true
+                })
+                .where(eq(supporterKey.keyId, key.keyId));
         } catch (e) {
-            console.log(
-                "Failed to generate the Traefik configuration files. Please create them manually."
-            );
-            console.error(e);
+            this.supporterData = key;
+            console.error("Failed to validate supporter key", e);
         }
     }
+
+    public getSupporterData() {
+        return this.supporterData;
+    }
 }
 
 export const config = new Config();

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.0.0";
+export const APP_VERSION = "1.2.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/lib/ip.test.ts

@@ -1,61 +1,5 @@
 import { cidrToRange, findNextAvailableCidr } from "./ip";
-
-/**
- * Compares two objects for deep equality
- * @param actual The actual value to test
- * @param expected The expected value to compare against
- * @param message The message to display if assertion fails
- * @throws Error if objects are not equal
- */
-export function assertEqualsObj<T>(actual: T, expected: T, message: string): void {
-    const actualStr = JSON.stringify(actual);
-    const expectedStr = JSON.stringify(expected);
-    if (actualStr !== expectedStr) {
-        throw new Error(`${message}\nExpected: ${expectedStr}\nActual: ${actualStr}`);
-    }
-}
-
-/**
- * Compares two primitive values for equality
- * @param actual The actual value to test
- * @param expected The expected value to compare against
- * @param message The message to display if assertion fails
- * @throws Error if values are not equal
- */
-export function assertEquals<T>(actual: T, expected: T, message: string): void {
-    if (actual !== expected) {
-        throw new Error(`${message}\nExpected: ${expected}\nActual: ${actual}`);
-    }
-}
-
-/**
- * Tests if a function throws an expected error
- * @param fn The function to test
- * @param expectedError The expected error message or part of it
- * @param message The message to display if assertion fails
- * @throws Error if function doesn't throw or throws unexpected error
- */
-export function assertThrows(
-    fn: () => void,
-    expectedError: string,
-    message: string
-): void {
-    try {
-        fn();
-        throw new Error(`${message}: Expected to throw "${expectedError}"`);
-    } catch (error) {
-        if (!(error instanceof Error)) {
-            throw new Error(`${message}\nUnexpected error type: ${typeof error}`);
-        }
-        
-        if (!error.message.includes(expectedError)) {
-            throw new Error(
-                `${message}\nExpected error: ${expectedError}\nActual error: ${error.message}`
-            );
-        }
-    }
-}
-
+import { assertEquals } from "@test/assert";
 
 // Test cases
 function testFindNextAvailableCidr() {

server/lib/validators.test.ts

@@ -0,0 +1,71 @@
+import { isValidUrlGlobPattern } from "./validators"; 
+import { assertEquals } from "@test/assert";
+
+function runTests() {
+    console.log('Running URL pattern validation tests...');
+    
+    // Test valid patterns
+    assertEquals(isValidUrlGlobPattern('simple'), true, 'Simple path segment should be valid');
+    assertEquals(isValidUrlGlobPattern('simple/path'), true, 'Simple path with slash should be valid');
+    assertEquals(isValidUrlGlobPattern('/leading/slash'), true, 'Path with leading slash should be valid');
+    assertEquals(isValidUrlGlobPattern('path/'), true, 'Path with trailing slash should be valid');
+    assertEquals(isValidUrlGlobPattern('path/*'), true, 'Path with wildcard segment should be valid');
+    assertEquals(isValidUrlGlobPattern('*'), true, 'Single wildcard should be valid');
+    assertEquals(isValidUrlGlobPattern('*/subpath'), true, 'Wildcard with subpath should be valid');
+    assertEquals(isValidUrlGlobPattern('path/*/more'), true, 'Path with wildcard in the middle should be valid');
+    
+    // Test with special characters
+    assertEquals(isValidUrlGlobPattern('path-with-dash'), true, 'Path with dash should be valid');
+    assertEquals(isValidUrlGlobPattern('path_with_underscore'), true, 'Path with underscore should be valid');
+    assertEquals(isValidUrlGlobPattern('path.with.dots'), true, 'Path with dots should be valid');
+    assertEquals(isValidUrlGlobPattern('path~with~tilde'), true, 'Path with tilde should be valid');
+    assertEquals(isValidUrlGlobPattern('path!with!exclamation'), true, 'Path with exclamation should be valid');
+    assertEquals(isValidUrlGlobPattern('path$with$dollar'), true, 'Path with dollar should be valid');
+    assertEquals(isValidUrlGlobPattern('path&with&ampersand'), true, 'Path with ampersand should be valid');
+    assertEquals(isValidUrlGlobPattern("path'with'quote"), true, "Path with quote should be valid");
+    assertEquals(isValidUrlGlobPattern('path(with)parentheses'), true, 'Path with parentheses should be valid');
+    assertEquals(isValidUrlGlobPattern('path+with+plus'), true, 'Path with plus should be valid');
+    assertEquals(isValidUrlGlobPattern('path,with,comma'), true, 'Path with comma should be valid');
+    assertEquals(isValidUrlGlobPattern('path;with;semicolon'), true, 'Path with semicolon should be valid');
+    assertEquals(isValidUrlGlobPattern('path=with=equals'), true, 'Path with equals should be valid');
+    assertEquals(isValidUrlGlobPattern('path:with:colon'), true, 'Path with colon should be valid');
+    assertEquals(isValidUrlGlobPattern('path@with@at'), true, 'Path with at should be valid');
+    
+    // Test with percent encoding
+    assertEquals(isValidUrlGlobPattern('path%20with%20spaces'), true, 'Path with percent-encoded spaces should be valid');
+    assertEquals(isValidUrlGlobPattern('path%2Fwith%2Fencoded%2Fslashes'), true, 'Path with percent-encoded slashes should be valid');
+    
+    // Test with wildcards in segments (the fixed functionality)
+    assertEquals(isValidUrlGlobPattern('padbootstrap*'), true, 'Path with wildcard at the end of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('pad*bootstrap'), true, 'Path with wildcard in the middle of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('*bootstrap'), true, 'Path with wildcard at the start of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('multiple*wildcards*in*segment'), true, 'Path with multiple wildcards in segment should be valid');
+    assertEquals(isValidUrlGlobPattern('wild*/cards/in*/different/seg*ments'), true, 'Path with wildcards in different segments should be valid');
+    
+    // Test invalid patterns
+    assertEquals(isValidUrlGlobPattern(''), false, 'Empty string should be invalid');
+    assertEquals(isValidUrlGlobPattern('//double/slash'), false, 'Path with double slash should be invalid');
+    assertEquals(isValidUrlGlobPattern('path//end'), false, 'Path with double slash in the middle should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid<char>'), false, 'Path with invalid characters should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid|char'), false, 'Path with invalid pipe character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid"char'), false, 'Path with invalid quote character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid`char'), false, 'Path with invalid backtick character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid^char'), false, 'Path with invalid caret character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid\\char'), false, 'Path with invalid backslash character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid[char]'), false, 'Path with invalid square brackets should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid{char}'), false, 'Path with invalid curly braces should be invalid');
+    
+    // Test invalid percent encoding
+    assertEquals(isValidUrlGlobPattern('invalid%2'), false, 'Path with incomplete percent encoding should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid%GZ'), false, 'Path with invalid hex in percent encoding should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid%'), false, 'Path with isolated percent sign should be invalid');
+    
+    console.log('All tests passed!');
+}
+
+// Run all tests
+try {
+    runTests();
+} catch (error) {
+    console.error('Test failed:', error);
+}

server/lib/validators.ts

@@ -29,11 +29,6 @@ export function isValidUrlGlobPattern(pattern: string): boolean {
             return false;
         }
 
-        // If segment contains *, it must be exactly *
-        if (segment.includes("*") && segment !== "*") {
-            return false;
-        }
-
         // Check each character in the segment
         for (let j = 0; j < segment.length; j++) {
             const char = segment[j];

server/middlewares/getUserOrgs.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { userOrgs, orgs } from "@server/db/schema";
+import { userOrgs, orgs } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/index.ts

@@ -14,3 +14,4 @@ export * from "./verifyAdmin";
 export * from "./verifySetResourceUsers";
 export * from "./verifyUserInRole";
 export * from "./verifyAccessTokenAccess";
+export * from "./verifyUserIsServerAdmin";

server/middlewares/verifyAccessTokenAccess.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { resourceAccessToken, resources, userOrgs } from "@server/db/schema";
+import { resourceAccessToken, resources, userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyAdmin.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { roles, userOrgs } from "@server/db/schema";
+import { roles, userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyOrgAccess.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { userOrgs } from "@server/db/schema";
+import { userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyResourceAccess.ts

@@ -5,7 +5,7 @@ import {
     userOrgs,
     userResources,
     roleResources,
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyRoleAccess.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { roles, userOrgs } from "@server/db/schema";
+import { roles, userOrgs } from "@server/db/schemas";
 import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
@@ -44,6 +44,8 @@ export async function verifyRoleAccess(
             );
         }
 
+        const orgIds = new Set(rolesData.map((role) => role.orgId));
+
         // Check user access to each role's organization
         for (const role of rolesData) {
             const userOrgRole = await db
@@ -69,7 +71,16 @@ export async function verifyRoleAccess(
             req.userOrgId = role.orgId;
         }
 
-        const orgId = req.userOrgId;
+        if (orgIds.size > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Roles must belong to the same organization"
+                )
+            );
+        }
+
+        const orgId = orgIds.values().next().value;
 
         if (!orgId) {
             return next(
@@ -105,3 +116,4 @@ export async function verifyRoleAccess(
         );
     }
 }
+

server/middlewares/verifySession.ts

@@ -1,7 +1,7 @@
 import { NextFunction, Response } from "express";
 import ErrorResponse from "@server/types/ErrorResponse";
 import { db } from "@server/db";
-import { users } from "@server/db/schema";
+import { users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifySetResourceUsers.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { userOrgs } from "@server/db/schema";
+import { userOrgs } from "@server/db/schemas";
 import { and, eq, inArray, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifySiteAccess.ts

@@ -6,7 +6,7 @@ import {
     userSites,
     roleSites,
     roles,
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import { and, eq, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyTargetAccess.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { resources, targets, userOrgs } from "@server/db/schema";
+import { resources, targets, userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyUser.ts

@@ -1,7 +1,7 @@
 import { NextFunction, Response } from "express";
 import ErrorResponse from "@server/types/ErrorResponse";
 import { db } from "@server/db";
-import { users } from "@server/db/schema";
+import { users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyUserAccess.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { userOrgs } from "@server/db/schema";
+import { userOrgs } from "@server/db/schemas";
 import { and, eq, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";

server/middlewares/verifyUserIsOrgOwner.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { db } from "@server/db";
-import { userOrgs } from "@server/db/schema";
+import { userOrgs } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
@@ -55,7 +55,7 @@ export async function verifyUserIsOrgOwner(
                 )
             );
         }
-        
+
         return next();
     } catch (e) {
         return next(

server/middlewares/verifyUserIsServerAdmin.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyUserIsServerAdmin(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    const userId = req.user!.userId;
+
+    if (!userId) {
+        return next(
+            createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
+        );
+    }
+
+    try {
+        if (!req.user?.serverAdmin) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User is not a server admin"
+                )
+            );
+        }
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying organization access"
+            )
+        );
+    }
+}

server/routers/accessToken/deleteAccessToken.ts

@@ -5,7 +5,7 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { resourceAccessToken } from "@server/db/schema";
+import { resourceAccessToken } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import db from "@server/db";
 

server/routers/accessToken/generateAccessToken.ts

@@ -9,7 +9,7 @@ import {
     ResourceAccessToken,
     resourceAccessToken,
     resources
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";
@@ -20,6 +20,8 @@ import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { createDate, TimeSpan } from "oslo";
 import { hashPassword } from "@server/auth/password";
+import { encodeHexLowerCase } from "@oslojs/encoding";
+import { sha256 } from "@oslojs/crypto/sha2";
 
 export const generateAccessTokenBodySchema = z
     .object({
@@ -90,11 +92,13 @@ export async function generateAccessToken(
             ? createDate(new TimeSpan(validForSeconds, "s")).getTime()
             : undefined;
 
-        const token = generateIdFromEntropySize(25);
+        const token = generateIdFromEntropySize(16);
 
-        const tokenHash = await hashPassword(token);
+        const tokenHash = encodeHexLowerCase(
+            sha256(new TextEncoder().encode(token))
+        );
 
-        const id = generateId(15);
+        const id = generateId(8);
         const [result] = await db
             .insert(resourceAccessToken)
             .values({

server/routers/accessToken/listAccessTokens.ts

@@ -5,14 +5,16 @@ import {
     resources,
     userResources,
     roleResources,
-    resourceAccessToken
-} from "@server/db/schema";
+    resourceAccessToken,
+    sites
+} from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import { sql, eq, or, inArray, and, count, isNull, lt, gt } from "drizzle-orm";
 import logger from "@server/logger";
 import stoi from "@server/lib/stoi";
+import { fromZodError } from "zod-validation-error";
 
 const listAccessTokensParamsSchema = z
     .object({
@@ -59,7 +61,8 @@ function queryAccessTokens(
         title: resourceAccessToken.title,
         description: resourceAccessToken.description,
         createdAt: resourceAccessToken.createdAt,
-        resourceName: resources.name
+        resourceName: resources.name,
+        siteName: sites.name
     };
 
     if (orgId) {
@@ -70,6 +73,10 @@ function queryAccessTokens(
                 resources,
                 eq(resourceAccessToken.resourceId, resources.resourceId)
             )
+            .leftJoin(
+                sites,
+                eq(resources.resourceId, sites.siteId)
+            )
             .where(
                 and(
                     inArray(
@@ -91,6 +98,10 @@ function queryAccessTokens(
                 resources,
                 eq(resourceAccessToken.resourceId, resources.resourceId)
             )
+            .leftJoin(
+                sites,
+                eq(resources.resourceId, sites.siteId)
+            )
             .where(
                 and(
                     inArray(
@@ -123,7 +134,7 @@ export async function listAccessTokens(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    parsedQuery.error.errors.map((e) => e.message).join(", ")
+                    fromZodError(parsedQuery.error)
                 )
             );
         }
@@ -134,7 +145,7 @@ export async function listAccessTokens(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    parsedParams.error.errors.map((e) => e.message).join(", ")
+                    fromZodError(parsedParams.error)
                 )
             );
         }

server/routers/auth/changePassword.ts

@@ -4,7 +4,7 @@ import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
 import { z } from "zod";
 import { db } from "@server/db";
-import { User, users } from "@server/db/schema";
+import { User, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { response } from "@server/lib";
 import {

server/routers/auth/disable2fa.ts

@@ -4,7 +4,7 @@ import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
 import { z } from "zod";
 import { db } from "@server/db";
-import { User, users } from "@server/db/schema";
+import { User, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { response } from "@server/lib";
 import { verifyPassword } from "@server/auth/password";

server/routers/auth/login.ts

@@ -4,7 +4,7 @@ import {
     serializeSessionCookie
 } from "@server/auth/sessions/app";
 import db from "@server/db";
-import { users } from "@server/db/schema";
+import { users } from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";
@@ -78,7 +78,7 @@ export async function login(
             }
             return next(
                 createHttpError(
-                    HttpCode.BAD_REQUEST,
+                    HttpCode.UNAUTHORIZED,
                     "Username or password is incorrect"
                 )
             );
@@ -98,7 +98,7 @@ export async function login(
             }
             return next(
                 createHttpError(
-                    HttpCode.BAD_REQUEST,
+                    HttpCode.UNAUTHORIZED,
                     "Username or password is incorrect"
                 )
             );
@@ -129,7 +129,7 @@ export async function login(
                 }
                 return next(
                     createHttpError(
-                        HttpCode.BAD_REQUEST,
+                        HttpCode.UNAUTHORIZED,
                         "The two-factor code you entered is incorrect"
                     )
                 );

server/routers/auth/requestEmailVerificationCode.ts

@@ -2,7 +2,7 @@ import { Request, Response, NextFunction } from "express";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
-import { User } from "@server/db/schema";
+import { User } from "@server/db/schemas";
 import { sendEmailVerificationCode } from "../../auth/sendEmailVerificationCode";
 import config from "@server/lib/config";
 import logger from "@server/logger";

server/routers/auth/requestPasswordReset.ts

@@ -5,7 +5,7 @@ import { fromError } from "zod-validation-error";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
 import { db } from "@server/db";
-import { passwordResetTokens, users } from "@server/db/schema";
+import { passwordResetTokens, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
 import { createDate } from "oslo";

server/routers/auth/requestTotpSecret.ts

@@ -6,7 +6,7 @@ import { encodeHex } from "oslo/encoding";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
 import { db } from "@server/db";
-import { User, users } from "@server/db/schema";
+import { User, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { createTOTPKeyURI } from "oslo/otp";
 import logger from "@server/logger";

server/routers/auth/resetPassword.ts

@@ -6,7 +6,7 @@ import { fromError } from "zod-validation-error";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
 import { db } from "@server/db";
-import { passwordResetTokens, users } from "@server/db/schema";
+import { passwordResetTokens, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { hashPassword, verifyPassword } from "@server/auth/password";
 import { verifyTotpCode } from "@server/auth/totp";

server/routers/auth/signup.ts

@@ -2,7 +2,7 @@ import { NextFunction, Request, Response } from "express";
 import db from "@server/db";
 import HttpCode from "@server/types/HttpCode";
 import { z } from "zod";
-import { users } from "@server/db/schema";
+import { users } from "@server/db/schemas";
 import { fromError } from "zod-validation-error";
 import createHttpError from "http-errors";
 import response from "@server/lib/response";

server/routers/auth/verifyEmail.ts

@@ -5,7 +5,7 @@ import { fromError } from "zod-validation-error";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
 import { db } from "@server/db";
-import { User, emailVerificationCodes, users } from "@server/db/schema";
+import { User, emailVerificationCodes, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { isWithinExpirationDate } from "oslo";
 import config from "@server/lib/config";

server/routers/auth/verifyTotp.ts

@@ -5,7 +5,7 @@ import { fromError } from "zod-validation-error";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib";
 import { db } from "@server/db";
-import { twoFactorBackupCodes, User, users } from "@server/db/schema";
+import { twoFactorBackupCodes, User, users } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { alphabet, generateRandomString } from "oslo/crypto";
 import { hashPassword } from "@server/auth/password";

server/routers/badger/exchangeSession.ts

@@ -4,7 +4,7 @@ import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { resourceAccessToken, resources, sessions } from "@server/db/schema";
+import { resourceAccessToken, resources, sessions } from "@server/db/schemas";
 import db from "@server/db";
 import { eq } from "drizzle-orm";
 import {

server/routers/badger/verifySession.test.ts

@@ -0,0 +1,67 @@
+import { isPathAllowed } from './verifySession';
+import { assertEquals } from '@test/assert';
+
+function runTests() {
+    console.log('Running path matching tests...');
+    
+    // Test exact matching
+    assertEquals(isPathAllowed('foo', 'foo'), true, 'Exact match should be allowed');
+    assertEquals(isPathAllowed('foo', 'bar'), false, 'Different segments should not match');
+    assertEquals(isPathAllowed('foo/bar', 'foo/bar'), true, 'Exact multi-segment match should be allowed');
+    assertEquals(isPathAllowed('foo/bar', 'foo/baz'), false, 'Partial multi-segment match should not be allowed');
+    
+    // Test with leading and trailing slashes
+    assertEquals(isPathAllowed('/foo', 'foo'), true, 'Pattern with leading slash should match');
+    assertEquals(isPathAllowed('foo/', 'foo'), true, 'Pattern with trailing slash should match');
+    assertEquals(isPathAllowed('/foo/', 'foo'), true, 'Pattern with both leading and trailing slashes should match');
+    assertEquals(isPathAllowed('foo', '/foo/'), true, 'Path with leading and trailing slashes should match');
+    
+    // Test simple wildcard matching
+    assertEquals(isPathAllowed('*', 'foo'), true, 'Single wildcard should match any single segment');
+    assertEquals(isPathAllowed('*', 'foo/bar'), true, 'Single wildcard should match multiple segments');
+    assertEquals(isPathAllowed('*/bar', 'foo/bar'), true, 'Wildcard prefix should match');
+    assertEquals(isPathAllowed('foo/*', 'foo/bar'), true, 'Wildcard suffix should match');
+    assertEquals(isPathAllowed('foo/*/baz', 'foo/bar/baz'), true, 'Wildcard in middle should match');
+    
+    // Test multiple wildcards
+    assertEquals(isPathAllowed('*/*', 'foo/bar'), true, 'Multiple wildcards should match corresponding segments');
+    assertEquals(isPathAllowed('*/*/*', 'foo/bar/baz'), true, 'Three wildcards should match three segments');
+    assertEquals(isPathAllowed('foo/*/*', 'foo/bar/baz'), true, 'Specific prefix with wildcards should match');
+    assertEquals(isPathAllowed('*/*/baz', 'foo/bar/baz'), true, 'Wildcards with specific suffix should match');
+    
+    // Test wildcard consumption behavior
+    assertEquals(isPathAllowed('*', ''), true, 'Wildcard should optionally consume segments');
+    assertEquals(isPathAllowed('foo/*', 'foo'), true, 'Trailing wildcard should be optional');
+    assertEquals(isPathAllowed('*/*', 'foo'), true, 'Multiple wildcards can match fewer segments');
+    assertEquals(isPathAllowed('*/*/*', 'foo/bar'), true, 'Extra wildcards can be skipped');
+    
+    // Test complex nested paths
+    assertEquals(isPathAllowed('api/*/users', 'api/v1/users'), true, 'API versioning pattern should match');
+    assertEquals(isPathAllowed('api/*/users/*', 'api/v1/users/123'), true, 'API resource pattern should match');
+    assertEquals(isPathAllowed('api/*/users/*/profile', 'api/v1/users/123/profile'), true, 'Nested API pattern should match');
+    
+    // Test for the requested padbootstrap* pattern
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap'), true, 'padbootstrap* should match padbootstrap');
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrapv1'), true, 'padbootstrap* should match padbootstrapv1');
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap/files'), false, 'padbootstrap* should not match padbootstrap/files');
+    assertEquals(isPathAllowed('padbootstrap*/*', 'padbootstrap/files'), true, 'padbootstrap*/* should match padbootstrap/files');
+    assertEquals(isPathAllowed('padbootstrap*/files', 'padbootstrapv1/files'), true, 'padbootstrap*/files should not match padbootstrapv1/files (wildcard is segment-based, not partial)');
+    
+    // Test wildcard edge cases
+    assertEquals(isPathAllowed('*/*/*/*/*/*', 'a/b'), true, 'Many wildcards can match few segments');
+    assertEquals(isPathAllowed('a/*/b/*/c', 'a/anything/b/something/c'), true, 'Multiple wildcards in pattern should match corresponding segments');
+    
+    // Test patterns with partial segment matches
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap-123'), true, 'Wildcards in isPathAllowed should be segment-based, not character-based');
+    assertEquals(isPathAllowed('test*', 'testuser'), true, 'Asterisk as part of segment name is treated as a literal, not a wildcard');
+    assertEquals(isPathAllowed('my*app', 'myapp'), true, 'Asterisk in middle of segment name is treated as a literal, not a wildcard');
+
+    console.log('All tests passed!');
+}
+
+// Run all tests
+try {
+    runTests();
+} catch (error) {
+    console.error('Test failed:', error);
+}

server/routers/badger/verifySession.ts

@@ -21,7 +21,7 @@ import {
     userOrgs,
     userResources,
     users
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import config from "@server/lib/config";
 import { isIpInCidr } from "@server/lib/ip";
 import { response } from "@server/lib/response";
@@ -41,12 +41,13 @@ const cache = new NodeCache({
 
 const verifyResourceSessionSchema = z.object({
     sessions: z.record(z.string()).optional(),
+    headers: z.record(z.string()).optional(),
+    query: z.record(z.string()).optional(),
     originalRequestURL: z.string().url(),
     scheme: z.string(),
     host: z.string(),
     path: z.string(),
     method: z.string(),
-    accessToken: z.string().optional(),
     tls: z.boolean(),
     requestIp: z.string().optional()
 });
@@ -85,7 +86,8 @@ export async function verifyResourceSession(
             originalRequestURL,
             requestIp,
             path,
-            accessToken: token
+            headers,
+            query
         } = parsedBody.data;
 
         const clientIp = requestIp?.split(":")[0];
@@ -183,12 +185,33 @@ export async function verifyResourceSession(
             resource.resourceId
         )}?redirect=${encodeURIComponent(originalRequestURL)}`;
 
-        // check for access token
-        let validAccessToken: ResourceAccessToken | undefined;
-        if (token) {
-            const [accessTokenId, accessToken] = token.split(".");
+        // check for access token in headers
+        if (
+            headers &&
+            headers[
+                config.getRawConfig().server.resource_access_token_headers.id
+            ] &&
+            headers[
+                config.getRawConfig().server.resource_access_token_headers.token
+            ]
+        ) {
+            const accessTokenId =
+                headers[
+                    config.getRawConfig().server.resource_access_token_headers
+                        .id
+                ];
+            const accessToken =
+                headers[
+                    config.getRawConfig().server.resource_access_token_headers
+                        .token
+                ];
+
             const { valid, error, tokenItem } = await verifyResourceAccessToken(
-                { resource, accessTokenId, accessToken }
+                {
+                    accessToken,
+                    accessTokenId,
+                    resourceId: resource.resourceId
+                }
             );
 
             if (error) {
@@ -206,16 +229,44 @@ export async function verifyResourceSession(
             }
 
             if (valid && tokenItem) {
-                validAccessToken = tokenItem;
+                return allowed(res);
+            }
+        }
 
-                if (!sessions) {
-                    return await createAccessTokenSession(
-                        res,
-                        resource,
-                        tokenItem
+        if (
+            query &&
+            query[config.getRawConfig().server.resource_access_token_param]
+        ) {
+            const token =
+                query[config.getRawConfig().server.resource_access_token_param];
+
+            const [accessTokenId, accessToken] = token.split(".");
+
+            const { valid, error, tokenItem } = await verifyResourceAccessToken(
+                {
+                    accessToken,
+                    accessTokenId,
+                    resourceId: resource.resourceId
+                }
+            );
+
+            if (error) {
+                logger.debug("Access token invalid: " + error);
+            }
+
+            if (!valid) {
+                if (config.getRawConfig().app.log_failed_attempts) {
+                    logger.info(
+                        `Resource access token is invalid. Resource ID: ${
+                            resource.resourceId
+                        }. IP: ${clientIp}.`
                     );
                 }
             }
+
+            if (valid && tokenItem) {
+                return allowed(res);
+            }
         }
 
         if (!sessions) {
@@ -229,12 +280,10 @@ export async function verifyResourceSession(
             return notAllowed(res);
         }
 
-        const resourceSessionToken =
-            sessions[
-                `${config.getRawConfig().server.session_cookie_name}${
-                    resource.ssl ? "_s" : ""
-                }`
-            ];
+        const resourceSessionToken = extractResourceSessionToken(
+            sessions,
+            resource.ssl
+        );
 
         if (resourceSessionToken) {
             const sessionCacheKey = `session:${resourceSessionToken}`;
@@ -323,16 +372,6 @@ export async function verifyResourceSession(
             }
         }
 
-        // At this point we have checked all sessions, but since the access token is
-        // valid, we should allow access and create a new session.
-        if (validAccessToken) {
-            return await createAccessTokenSession(
-                res,
-                resource,
-                validAccessToken
-            );
-        }
-
         logger.debug("No more auth to check, resource not allowed");
 
         if (config.getRawConfig().app.log_failed_attempts) {
@@ -354,6 +393,49 @@ export async function verifyResourceSession(
     }
 }
 
+function extractResourceSessionToken(
+    sessions: Record<string, string>,
+    ssl: boolean
+) {
+    const prefix = `${config.getRawConfig().server.session_cookie_name}${
+        ssl ? "_s" : ""
+    }`;
+
+    const all: { cookieName: string; token: string; priority: number }[] = [];
+
+    for (const [key, value] of Object.entries(sessions)) {
+        const parts = key.split(".");
+        const timestamp = parts[parts.length - 1];
+
+        // check if string is only numbers
+        if (!/^\d+$/.test(timestamp)) {
+            continue;
+        }
+
+        // cookie name is the key without the timestamp
+        const cookieName = key.slice(0, -timestamp.length - 1);
+
+        if (cookieName === prefix) {
+            all.push({
+                cookieName,
+                token: value,
+                priority: parseInt(timestamp)
+            });
+        }
+    }
+
+    // sort by priority in desc order
+    all.sort((a, b) => b.priority - a.priority);
+
+    const latest = all[0];
+
+    if (!latest) {
+        return;
+    }
+
+    return latest.token;
+}
+
 function notAllowed(res: Response, redirectUrl?: string) {
     const data = {
         data: { valid: false, redirectUrl },
@@ -534,7 +616,7 @@ async function checkRules(
     return;
 }
 
-function isPathAllowed(pattern: string, path: string): boolean {
+export function isPathAllowed(pattern: string, path: string): boolean {
     logger.debug(`\nMatching path "${path}" against pattern "${pattern}"`);
 
     // Normalize and split paths into segments
@@ -575,7 +657,7 @@ function isPathAllowed(pattern: string, path: string): boolean {
             return result;
         }
 
-        // For wildcards, try consuming different numbers of path segments
+        // For full segment wildcards, try consuming different numbers of path segments
         if (currentPatternPart === "*") {
             logger.debug(
                 `${indent}Found wildcard at pattern index ${patternIndex}`
@@ -607,6 +689,32 @@ function isPathAllowed(pattern: string, path: string): boolean {
             return false;
         }
 
+        // Check for in-segment wildcard (e.g., "prefix*" or "prefix*suffix")
+        if (currentPatternPart.includes("*")) {
+            logger.debug(
+                `${indent}Found in-segment wildcard in "${currentPatternPart}"`
+            );
+
+            // Convert the pattern segment to a regex pattern
+            const regexPattern = currentPatternPart
+                .replace(/\*/g, ".*") // Replace * with .* for regex wildcard
+                .replace(/\?/g, "."); // Replace ? with . for single character wildcard if needed
+
+            const regex = new RegExp(`^${regexPattern}$`);
+
+            if (regex.test(currentPathPart)) {
+                logger.debug(
+                    `${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"`
+                );
+                return matchSegments(patternIndex + 1, pathIndex + 1);
+            }
+
+            logger.debug(
+                `${indent}Segment with wildcard mismatch: "${currentPatternPart}" doesn't match "${currentPathPart}"`
+            );
+            return false;
+        }
+
         // For regular segments, they must match exactly
         if (currentPatternPart !== currentPathPart) {
             logger.debug(

server/routers/domain/listDomains.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { domains, orgDomains, users } from "@server/db/schema";
+import { domains, orgDomains, users } from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -80,15 +80,15 @@ export async function listDomains(
 
         const { orgId } = parsedParams.data;
 
-        const domains = await queryDomains(orgId.toString(), limit, offset);
+        const domainsList = await queryDomains(orgId.toString(), limit, offset);
 
         const [{ count }] = await db
             .select({ count: sql<number>`count(*)` })
-            .from(users);
+            .from(domains);
 
         return response<ListDomainsResponse>(res, {
             data: {
-                domains,
+                domains: domainsList,
                 pagination: {
                     total: count,
                     limit,

server/routers/external.ts

@@ -8,6 +8,7 @@ import * as target from "./target";
 import * as user from "./user";
 import * as auth from "./auth";
 import * as role from "./role";
+import * as supporterKey from "./supporterKey";
 import * as accessToken from "./accessToken";
 import HttpCode from "@server/types/HttpCode";
 import {
@@ -22,7 +23,8 @@ import {
     verifyRoleAccess,
     verifySetResourceUsers,
     verifyUserAccess,
-    getUserOrgs
+    getUserOrgs,
+    verifyUserIsServerAdmin
 } from "@server/middlewares";
 import { verifyUserHasAction } from "../middlewares/verifyUserHasAction";
 import { ActionsEnum } from "@server/auth/actions";
@@ -239,7 +241,6 @@ authenticated.delete(
     target.deleteTarget
 );
 
-
 authenticated.put(
     "/org/:orgId/role",
     verifyOrgAccess,
@@ -382,6 +383,12 @@ authenticated.get(
 
 authenticated.get(`/org/:orgId/overview`, verifyOrgAccess, org.getOrgOverview);
 
+authenticated.post(
+    `/supporter-key/validate`,
+    supporterKey.validateSupporterKey
+);
+authenticated.post(`/supporter-key/hide`, supporterKey.hideSupporterKey);
+
 unauthenticated.get("/resource/:resourceId/auth", resource.getResourceAuthInfo);
 
 // authenticated.get(
@@ -415,6 +422,13 @@ unauthenticated.get("/resource/:resourceId/auth", resource.getResourceAuthInfo);
 
 unauthenticated.get("/user", verifySessionMiddleware, user.getUser);
 
+authenticated.get("/users", verifyUserIsServerAdmin, user.adminListUsers);
+authenticated.delete(
+    "/user/:userId",
+    verifyUserIsServerAdmin,
+    user.adminRemoveUser
+);
+
 authenticated.get("/org/:orgId/user/:userId", verifyOrgAccess, user.getOrgUser);
 authenticated.get(
     "/org/:orgId/users",
@@ -459,7 +473,11 @@ authenticated.delete(
 //     role.removeRoleAction
 // );
 
-authenticated.put("/newt", createNewt);
+// authenticated.put(
+//     "/newt",
+//     verifyUserHasAction(ActionsEnum.createNewt),
+//     createNewt
+// );
 
 // Auth routes
 export const authRouter = Router();
@@ -548,3 +566,8 @@ authRouter.post(
     "/resource/:resourceId/access-token",
     resource.authWithAccessToken
 );
+
+authRouter.post(
+    "/access-token",
+    resource.authWithAccessToken
+);

server/routers/gerbil/getConfig.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
 import { z } from 'zod';
-import { sites, resources, targets, exitNodes } from '@server/db/schema';
+import { sites, resources, targets, exitNodes } from '@server/db/schemas';
 import { db } from '@server/db';
 import { eq } from 'drizzle-orm';
 import response from "@server/lib/response";

server/routers/gerbil/peers.ts

@@ -1,7 +1,7 @@
 import axios from 'axios';
 import logger from '@server/logger';
 import db from '@server/db';
-import { exitNodes } from '@server/db/schema';
+import { exitNodes } from '@server/db/schemas';
 import { eq } from 'drizzle-orm';
 
 export async function addPeer(exitNodeId: number, peer: {
@@ -52,4 +52,4 @@ export async function deletePeer(exitNodeId: number, publicKey: string) {
         }
         throw error;
     }
-}
+}

server/routers/gerbil/receiveBandwidth.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { DrizzleError, eq } from "drizzle-orm";
-import { sites, resources, targets, exitNodes } from "@server/db/schema";
+import { sites, resources, targets, exitNodes } from "@server/db/schemas";
 import db from "@server/db";
 import logger from "@server/logger";
 import createHttpError from "http-errors";
@@ -59,8 +59,8 @@ export const receiveBandwidth = async (
                 await trx
                     .update(sites)
                     .set({
-                        megabytesOut: (site.megabytesIn || 0) + bytesIn,
-                        megabytesIn: (site.megabytesOut || 0) + bytesOut,
+                        megabytesOut: (site.megabytesOut || 0) + bytesIn,
+                        megabytesIn: (site.megabytesIn || 0) + bytesOut,
                         lastBandwidthUpdate: new Date().toISOString(),
                         online
                     })

server/routers/internal.ts

@@ -4,8 +4,12 @@ import * as traefik from "@server/routers/traefik";
 import * as resource from "./resource";
 import * as badger from "./badger";
 import * as auth from "@server/routers/auth";
+import * as supporterKey from "@server/routers/supporterKey";
 import HttpCode from "@server/types/HttpCode";
-import { verifyResourceAccess, verifySessionUserMiddleware } from "@server/middlewares";
+import {
+    verifyResourceAccess,
+    verifySessionUserMiddleware
+} from "@server/middlewares";
 
 // Root routes
 const internalRouter = Router();
@@ -28,6 +32,11 @@ internalRouter.post(
     resource.getExchangeToken
 );
 
+internalRouter.get(
+    `/supporter-key/visible`,
+    supporterKey.isSupporterKeyVisible
+);
+
 // Gerbil routes
 const gerbilRouter = Router();
 internalRouter.use("/gerbil", gerbilRouter);

server/routers/newt/createNewt.ts

@@ -3,7 +3,7 @@ import db from "@server/db";
 import { hash } from "@node-rs/argon2";
 import HttpCode from "@server/types/HttpCode";
 import { z } from "zod";
-import { newts } from "@server/db/schema";
+import { newts } from "@server/db/schemas";
 import createHttpError from "http-errors";
 import response from "@server/lib/response";
 import { SqliteError } from "better-sqlite3";

server/routers/newt/getToken.ts

@@ -1,6 +1,6 @@
 import { generateSessionToken } from "@server/auth/sessions/app";
 import db from "@server/db";
-import { newts } from "@server/db/schema";
+import { newts } from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";

server/routers/newt/handleRegisterMessage.ts

@@ -6,8 +6,8 @@ import {
     sites,
     Target,
     targets
-} from "@server/db/schema";
-import { eq, and, sql } from "drizzle-orm";
+} from "@server/db/schemas";
+import { eq, and, sql, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../gerbil/peers";
 import logger from "@server/logger";
 
@@ -75,68 +75,84 @@ export const handleRegisterMessage: MessageHandler = async (context) => {
         allowedIps: [site.subnet]
     });
 
-    const allResources = await db
-        .select({
-            // Resource fields
-            resourceId: resources.resourceId,
-            subdomain: resources.subdomain,
-            fullDomain: resources.fullDomain,
-            ssl: resources.ssl,
-            blockAccess: resources.blockAccess,
-            sso: resources.sso,
-            emailWhitelistEnabled: resources.emailWhitelistEnabled,
-            http: resources.http,
-            proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
-            // Targets as a subquery
-            targets: sql<string>`json_group_array(json_object(
-          'targetId', ${targets.targetId},
-          'ip', ${targets.ip},
-          'method', ${targets.method},
-          'port', ${targets.port},
-          'internalPort', ${targets.internalPort},
-          'enabled', ${targets.enabled}
-        ))`.as("targets")
-        })
-        .from(resources)
-        .leftJoin(
-            targets,
-            and(
-                eq(targets.resourceId, resources.resourceId),
-                eq(targets.enabled, true)
+    // Improved version
+    const allResources = await db.transaction(async (tx) => {
+        // First get all resources for the site
+        const resourcesList = await tx
+            .select({
+                resourceId: resources.resourceId,
+                subdomain: resources.subdomain,
+                fullDomain: resources.fullDomain,
+                ssl: resources.ssl,
+                blockAccess: resources.blockAccess,
+                sso: resources.sso,
+                emailWhitelistEnabled: resources.emailWhitelistEnabled,
+                http: resources.http,
+                proxyPort: resources.proxyPort,
+                protocol: resources.protocol
+            })
+            .from(resources)
+            .where(eq(resources.siteId, siteId));
+
+        // Get all enabled targets for these resources in a single query
+        const resourceIds = resourcesList.map((r) => r.resourceId);
+        const allTargets =
+            resourceIds.length > 0
+                ? await tx
+                      .select({
+                          resourceId: targets.resourceId,
+                          targetId: targets.targetId,
+                          ip: targets.ip,
+                          method: targets.method,
+                          port: targets.port,
+                          internalPort: targets.internalPort,
+                          enabled: targets.enabled
+                      })
+                      .from(targets)
+                      .where(
+                          and(
+                              inArray(targets.resourceId, resourceIds),
+                              eq(targets.enabled, true)
+                          )
+                      )
+                : [];
+
+        // Combine the data in JS instead of using SQL for the JSON
+        return resourcesList.map((resource) => ({
+            ...resource,
+            targets: allTargets.filter(
+                (target) => target.resourceId === resource.resourceId
             )
-        )
-        .where(eq(resources.siteId, siteId))
-        .groupBy(resources.resourceId);
+        }));
+    });
 
-    let tcpTargets: string[] = [];
-    let udpTargets: string[] = [];
+    const { tcpTargets, udpTargets } = allResources.reduce(
+        (acc, resource) => {
+            // Skip resources with no targets
+            if (!resource.targets?.length) return acc;
 
-    for (const resource of allResources) {
-        const targets = JSON.parse(resource.targets);
-        if (!targets || targets.length === 0) {
-            continue;
-        }
-        if (resource.protocol === "tcp") {
-            tcpTargets = tcpTargets.concat(
-                targets.map(
+            // Format valid targets into strings
+            const formattedTargets = resource.targets
+                .filter(
                     (target: Target) =>
-                        `${
-                            target.internalPort ? target.internalPort + ":" : ""
-                        }${target.ip}:${target.port}`
+                        target?.internalPort && target?.ip && target?.port
                 )
-            );
-        } else {
-            udpTargets = tcpTargets.concat(
-                targets.map(
+                .map(
                     (target: Target) =>
-                        `${
-                            target.internalPort ? target.internalPort + ":" : ""
-                        }${target.ip}:${target.port}`
-                )
-            );
-        }
-    }
+                        `${target.internalPort}:${target.ip}:${target.port}`
+                );
+
+            // Add to the appropriate protocol array
+            if (resource.protocol === "tcp") {
+                acc.tcpTargets.push(...formattedTargets);
+            } else {
+                acc.udpTargets.push(...formattedTargets);
+            }
+
+            return acc;
+        },
+        { tcpTargets: [] as string[], udpTargets: [] as string[] }
+    );
 
     return {
         message: {

server/routers/newt/targets.ts

@@ -1,4 +1,4 @@
-import { Target } from "@server/db/schema";
+import { Target } from "@server/db/schemas";
 import { sendToClient } from "../ws";
 
 export function addTargets(

server/routers/org/checkId.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { orgs } from "@server/db/schema";
+import { orgs } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";

server/routers/org/createOrg.ts

@@ -10,7 +10,7 @@ import {
     roleActions,
     roles,
     userOrgs
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -27,7 +27,7 @@ const createOrgSchema = z
     })
     .strict();
 
-const MAX_ORGS = 5;
+// const MAX_ORGS = 5;
 
 export async function createOrg(
     req: Request,
@@ -57,15 +57,15 @@ export async function createOrg(
             );
         }
 
-        const userOrgIds = req.userOrgIds;
-        if (userOrgIds && userOrgIds.length > MAX_ORGS) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    `Maximum number of organizations reached.`
-                )
-            );
-        }
+        // const userOrgIds = req.userOrgIds;
+        // if (userOrgIds && userOrgIds.length > MAX_ORGS) {
+        //     return next(
+        //         createHttpError(
+        //             HttpCode.FORBIDDEN,
+        //             `Maximum number of organizations reached.`
+        //         )
+        //     );
+        // }
 
         const { orgId, name } = parsedBody.data;
 

server/routers/org/deleteOrg.ts

@@ -7,7 +7,7 @@ import {
     orgs,
     sites,
     userActions
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";

server/routers/org/getOrg.ts

@@ -1,12 +1,13 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { Org, orgs } from "@server/db/schema";
+import { Org, orgs } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
+import { fromZodError } from "zod-validation-error";
 
 const getOrgSchema = z
     .object({
@@ -29,7 +30,7 @@ export async function getOrg(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    parsedParams.error.errors.map((e) => e.message).join(", ")
+                    fromZodError(parsedParams.error)
                 )
             );
         }

server/routers/org/getOrgOverview.ts

@@ -10,12 +10,13 @@ import {
     userResources,
     users,
     userSites
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import { and, count, eq, inArray } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
+import { fromZodError } from "zod-validation-error";
 
 const getOrgParamsSchema = z
     .object({
@@ -45,7 +46,7 @@ export async function getOrgOverview(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    parsedParams.error.errors.map((e) => e.message).join(", ")
+                    fromZodError(parsedParams.error)
                 )
             );
         }

server/routers/org/listOrgs.ts

@@ -1,12 +1,13 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { Org, orgs } from "@server/db/schema";
+import { Org, orgs } from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import { sql, inArray } from "drizzle-orm";
 import logger from "@server/logger";
+import { fromZodError } from "zod-validation-error";
 
 const listOrgsSchema = z.object({
     limit: z
@@ -39,7 +40,7 @@ export async function listOrgs(
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    parsedQuery.error.errors.map((e) => e.message).join(", ")
+                    fromZodError(parsedQuery.error)
                 )
             );
         }

server/routers/org/updateOrg.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { orgs } from "@server/db/schema";
+import { orgs } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";

server/routers/resource/authWithAccessToken.ts

@@ -1,6 +1,6 @@
 import { generateSessionToken } from "@server/auth/sessions/app";
 import db from "@server/db";
-import { resources } from "@server/db/schema";
+import { Resource, resources } from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";
@@ -10,13 +10,16 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { createResourceSession } from "@server/auth/sessions/resource";
 import logger from "@server/logger";
-import { verifyResourceAccessToken } from "@server/auth/verifyResourceAccessToken";
+import {
+    verifyResourceAccessToken
+} from "@server/auth/verifyResourceAccessToken";
 import config from "@server/lib/config";
+import stoi from "@server/lib/stoi";
 
 const authWithAccessTokenBodySchema = z
     .object({
         accessToken: z.string(),
-        accessTokenId: z.string()
+        accessTokenId: z.string().optional()
     })
     .strict();
 
@@ -24,13 +27,15 @@ const authWithAccessTokenParamsSchema = z
     .object({
         resourceId: z
             .string()
-            .transform(Number)
-            .pipe(z.number().int().positive())
+            .optional()
+            .transform(stoi)
+            .pipe(z.number().int().positive().optional())
     })
     .strict();
 
 export type AuthWithAccessTokenResponse = {
     session?: string;
+    redirectUrl?: string | null;
 };
 
 export async function authWithAccessToken(
@@ -64,23 +69,61 @@ export async function authWithAccessToken(
     const { accessToken, accessTokenId } = parsedBody.data;
 
     try {
-        const [resource] = await db
-            .select()
-            .from(resources)
-            .where(eq(resources.resourceId, resourceId))
-            .limit(1);
+        let valid;
+        let tokenItem;
+        let error;
+        let resource: Resource | undefined;
 
-        if (!resource) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
-            );
+        if (accessTokenId) {
+            if (!resourceId) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Resource ID is required"
+                    )
+                );
+            }
+
+            const [foundResource] = await db
+                .select()
+                .from(resources)
+                .where(eq(resources.resourceId, resourceId))
+                .limit(1);
+
+            if (!foundResource) {
+                return next(
+                    createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+                );
+            }
+
+            const res = await verifyResourceAccessToken({
+                accessTokenId,
+                accessToken
+            });
+
+            valid = res.valid;
+            tokenItem = res.tokenItem;
+            error = res.error;
+            resource = foundResource;
+        } else {
+            const res = await verifyResourceAccessToken({
+                accessToken
+            });
+
+            valid = res.valid;
+            tokenItem = res.tokenItem;
+            error = res.error;
+            resource = res.resource;
         }
 
-        const { valid, error, tokenItem } = await verifyResourceAccessToken({
-            resource,
-            accessTokenId,
-            accessToken
-        });
+        if (!tokenItem || !resource) {
+            return next(
+                createHttpError(
+                    HttpCode.UNAUTHORIZED,
+                    "Access token does not exist for resource"
+                )
+            );
+        }
 
         if (!valid) {
             if (config.getRawConfig().app.log_failed_attempts) {
@@ -96,18 +139,9 @@ export async function authWithAccessToken(
             );
         }
 
-        if (!tokenItem || !resource) {
-            return next(
-                createHttpError(
-                    HttpCode.UNAUTHORIZED,
-                    "Access token does not exist for resource"
-                )
-            );
-        }
-
         const token = generateSessionToken();
         await createResourceSession({
-            resourceId,
+            resourceId: resource.resourceId,
             token,
             accessTokenId: tokenItem.accessTokenId,
             isRequestToken: true,
@@ -118,7 +152,8 @@ export async function authWithAccessToken(
 
         return response<AuthWithAccessTokenResponse>(res, {
             data: {
-                session: token
+                session: token,
+                redirectUrl: `${resource.ssl ? "https" : "http"}://${resource.fullDomain}`
             },
             success: true,
             error: false,

server/routers/resource/authWithPassword.ts

@@ -1,7 +1,7 @@
 import { verify } from "@node-rs/argon2";
 import { generateSessionToken } from "@server/auth/sessions/app";
 import db from "@server/db";
-import { orgs, resourcePassword, resources } from "@server/db/schema";
+import { orgs, resourcePassword, resources } from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";

server/routers/resource/authWithPincode.ts

@@ -1,6 +1,6 @@
 import { generateSessionToken } from "@server/auth/sessions/app";
 import db from "@server/db";
-import { orgs, resourcePincode, resources } from "@server/db/schema";
+import { orgs, resourcePincode, resources } from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";

server/routers/resource/authWithWhitelist.ts

@@ -5,7 +5,7 @@ import {
     resourceOtp,
     resources,
     resourceWhitelist
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq, and } from "drizzle-orm";

server/routers/resource/createResource.ts

@@ -10,7 +10,7 @@ import {
     roleResources,
     roles,
     userResources
-} from "@server/db/schema";
+} from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";

server/routers/resource/createResourceRule.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resourceRules, resources } from "@server/db/schema";
+import { resourceRules, resources } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";

server/routers/resource/deleteResource.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { newts, resources, sites, targets } from "@server/db/schema";
+import { newts, resources, sites, targets } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";

server/routers/resource/deleteResourceRule.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resourceRules, resources } from "@server/db/schema";
+import { resourceRules, resources } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -68,4 +68,4 @@ export async function deleteResourceRule(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
+}

server/routers/resource/getExchangeToken.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { resources } from "@server/db/schema";
+import { resources } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { createResourceSession } from "@server/auth/sessions/resource";
 import HttpCode from "@server/types/HttpCode";

server/routers/resource/getResource.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { Resource, resources } from "@server/db/schema";
+import { Resource, resources, sites } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -18,7 +18,9 @@ const getResourceSchema = z
     })
     .strict();
 
-export type GetResourceResponse = Resource;
+export type GetResourceResponse = Resource & {
+    siteName: string;
+};
 
 export async function getResource(
     req: Request,
@@ -38,13 +40,17 @@ export async function getResource(
 
         const { resourceId } = parsedParams.data;
 
-        const resource = await db
+        const [resp] = await db
             .select()
             .from(resources)
             .where(eq(resources.resourceId, resourceId))
+            .leftJoin(sites, eq(sites.siteId, resources.siteId))
             .limit(1);
 
-        if (resource.length === 0) {
+        const resource = resp.resources;
+        const site = resp.sites;
+
+        if (!resource) {
             return next(
                 createHttpError(
                     HttpCode.NOT_FOUND,
@@ -54,7 +60,10 @@ export async function getResource(
         }
 
         return response(res, {
-            data: resource[0],
+            data: {
+                ...resource,
+                siteName: site?.name
+            },
             success: true,
             error: false,
             message: "Resource retrieved successfully",