Merge branch 'k8s' into new-pricing

Ref #2222

.github/dependabot.yml

@@ -44,19 +44,9 @@ updates:
     schedule:
       interval: "daily"
     groups:
-      dev-patch-updates:
-        dependency-type: "development"
+      patch-updates:
         update-types:
           - "patch"
-      dev-minor-updates:
-        dependency-type: "development"
+      minor-updates:
         update-types:
           - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"

.github/workflows/cicd.yml

@@ -482,14 +482,77 @@ jobs:
                       echo "==> cosign sign (key) --recursive ${REF}"
                       cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"
 
+                      # Retry wrapper for verification to handle registry propagation delays
+                      retry_verify() {
+                        local cmd="$1"
+                        local attempts=6
+                        local delay=5
+                        local i=1
+                        until eval "$cmd"; do
+                          if [ $i -ge $attempts ]; then
+                            echo "Verification failed after $attempts attempts"
+                            return 1
+                          fi
+                          echo "Verification not yet available. Retry $i/$attempts after ${delay}s..."
+                          sleep $delay
+                          i=$((i+1))
+                          delay=$((delay*2))
+                          # Cap the delay to avoid very long waits
+                          if [ $delay -gt 60 ]; then delay=60; fi
+                        done
+                        return 0
+                      }
+
                       echo "==> cosign verify (public key) ${REF}"
-                      cosign verify --key env://COSIGN_PUBLIC_KEY "${REF}" -o text
+                      if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"; then
+                        VERIFIED_INDEX=true
+                      else
+                        VERIFIED_INDEX=false
+                      fi
 
                       echo "==> cosign verify (keyless policy) ${REF}"
-                      cosign verify \
-                        --certificate-oidc-issuer "${issuer}" \
-                        --certificate-identity-regexp "${id_regex}" \
-                        "${REF}" -o text
+                      if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"; then
+                        VERIFIED_INDEX_KEYLESS=true
+                      else
+                        VERIFIED_INDEX_KEYLESS=false
+                      fi
+
+                      # If index verification fails, attempt to verify child platform manifests
+                      if [ "${VERIFIED_INDEX}" != "true" ] || [ "${VERIFIED_INDEX_KEYLESS}" != "true" ]; then
+                        echo "Index verification not available; attempting child manifest verification for ${BASE_IMAGE}:${IMAGE_TAG}"
+                        CHILD_VERIFIED=false
+
+                        for ARCH in arm64 amd64; do
+                          CHILD_TAG="${IMAGE_TAG}-${ARCH}"
+                          echo "Resolving child digest for ${BASE_IMAGE}:${CHILD_TAG}"
+                          CHILD_DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${CHILD_TAG} | jq -r '.Digest' || true)"
+                          if [ -n "${CHILD_DIGEST}" ] && [ "${CHILD_DIGEST}" != "null" ]; then
+                            CHILD_REF="${BASE_IMAGE}@${CHILD_DIGEST}"
+                            echo "==> cosign verify (public key) child ${CHILD_REF}"
+                            if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${CHILD_REF}' -o text"; then
+                              CHILD_VERIFIED=true
+                              echo "Public key verification succeeded for child ${CHILD_REF}"
+                            else
+                              echo "Public key verification failed for child ${CHILD_REF}"
+                            fi
+
+                            echo "==> cosign verify (keyless policy) child ${CHILD_REF}"
+                            if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${CHILD_REF}' -o text"; then
+                              CHILD_VERIFIED=true
+                              echo "Keyless verification succeeded for child ${CHILD_REF}"
+                            else
+                              echo "Keyless verification failed for child ${CHILD_REF}"
+                            fi
+                          else
+                            echo "No child digest found for ${BASE_IMAGE}:${CHILD_TAG}; skipping"
+                          fi
+                        done
+
+                        if [ "${CHILD_VERIFIED}" != "true" ]; then
+                          echo "Failed to verify index and no child manifests verified for ${BASE_IMAGE}:${IMAGE_TAG}"
+                          exit 10
+                        fi
+                      fi
 
                       echo "✓ Successfully signed and verified ${BASE_IMAGE}:${IMAGE_TAG}"
                     done

.github/workflows/linting.yml

@@ -26,7 +26,7 @@ jobs:
             - name: Set up Node.js
               uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
               with:
-                node-version: '22'
+                node-version: '24'
 
             - name: Install dependencies
               run: npm ci

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          node-version: '22'
+          node-version: '24'
 
       - name: Copy config file
         run: cp config/config.example.yml config/config.yml
@@ -34,7 +34,7 @@ jobs:
         run: npm run set:oss
 
       - name: Generate database migrations
-        run: npm run db:sqlite:generate
+        run: npm run db:generate
 
       - name: Apply database migrations
         run: npm run db:sqlite:push
@@ -64,9 +64,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Copy config file
-        run: cp config/config.example.yml config/config.yml
-
       - name: Build Docker image sqlite
         run: make dev-build-sqlite
 
@@ -76,8 +73,5 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Copy config file
-        run: cp config/config.example.yml config/config.yml
-
       - name: Build Docker image pg
         run: make dev-build-pg

Dockerfile

@@ -1,21 +1,11 @@
 FROM node:24-alpine AS builder
 
-# OCI Image Labels - Build Args for dynamic values
-ARG VERSION="dev"
-ARG REVISION=""
-ARG CREATED=""
-ARG LICENSE="AGPL-3.0"
-
 WORKDIR /app
 
 ARG BUILD=oss
 ARG DATABASE=sqlite
 
-# Derive title and description based on BUILD type
-ARG IMAGE_TITLE="Pangolin"
-ARG IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere"
-
-RUN apk add --no-cache curl tzdata python3 make g++
+RUN apk add --no-cache python3 make g++
 
 # COPY package.json package-lock.json ./
 COPY package*.json ./
@@ -23,41 +13,31 @@ RUN npm ci
 
 COPY . .
 
-RUN echo "export * from \"./$DATABASE\";" > server/db/index.ts
-RUN echo "export const driver: \"pg\" | \"sqlite\" = \"$DATABASE\";" >> server/db/index.ts
-
-RUN echo "export const build = \"$BUILD\" as \"saas\" | \"enterprise\" | \"oss\";" > server/build.ts
-
-# Copy the appropriate TypeScript configuration based on build type
-RUN if [ "$BUILD" = "oss" ]; then cp tsconfig.oss.json tsconfig.json; \
-    elif [ "$BUILD" = "saas" ]; then cp tsconfig.saas.json tsconfig.json; \
-    elif [ "$BUILD" = "enterprise" ]; then cp tsconfig.enterprise.json tsconfig.json; \
-    fi
-
-# if the build is oss then remove the server/private directory
-RUN if [ "$BUILD" = "oss" ]; then rm -rf server/private; fi
-
-RUN if [ "$DATABASE" = "pg" ]; then npx drizzle-kit generate --dialect postgresql --schema ./server/db/pg/schema --out init; else npx drizzle-kit generate --dialect $DATABASE --schema ./server/db/$DATABASE/schema --out init; fi
-
-RUN mkdir -p dist
-RUN npm run next:build
-RUN node esbuild.mjs -e server/index.ts -o dist/server.mjs -b $BUILD
-RUN if [ "$DATABASE" = "pg" ]; then \
-    node esbuild.mjs -e server/setup/migrationsPg.ts -o dist/migrations.mjs; \
-    else \
-    node esbuild.mjs -e server/setup/migrationsSqlite.ts -o dist/migrations.mjs; \
-    fi
+RUN if [ "$BUILD" = "oss" ]; then rm -rf server/private; fi && \
+    npm run set:$DATABASE && \
+    npm run set:$BUILD && \
+    npm run db:generate && \
+    npm run build && \
+    npm run build:cli
 
 # test to make sure the build output is there and error if not
 RUN test -f dist/server.mjs
 
-RUN npm run build:cli
-
 # Prune dev dependencies and clean up to prepare for copy to runner
 RUN npm prune --omit=dev && npm cache clean --force
 
 FROM node:24-alpine AS runner
 
+# OCI Image Labels - Build Args for dynamic values
+ARG VERSION="dev"
+ARG REVISION=""
+ARG CREATED=""
+ARG LICENSE="AGPL-3.0"
+
+# Derive title and description based on BUILD type
+ARG IMAGE_TITLE="Pangolin"
+ARG IMAGE_DESCRIPTION="Identity-aware VPN and proxy for remote access to anything, anywhere"
+
 WORKDIR /app
 
 # Only curl and tzdata needed at runtime - no build tools!
@@ -66,11 +46,10 @@ RUN apk add --no-cache curl tzdata
 # Copy pre-built node_modules from builder (already pruned to production only)
 # This includes the compiled native modules like better-sqlite3
 COPY --from=builder /app/node_modules ./node_modules
-
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static
 COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/init ./dist/init
+COPY --from=builder /app/server/migrations ./dist/init
 COPY --from=builder /app/package.json ./package.json
 
 COPY ./cli/wrapper.sh /usr/local/bin/pangctl

esbuild.mjs

@@ -6,6 +6,12 @@ import path from "path";
 import fs from "fs";
 // import { glob } from "glob";
 
+// Read default build type from server/build.ts
+let build = "oss";
+const buildFile = fs.readFileSync(path.resolve("server/build.ts"), "utf8");
+const m = buildFile.match(/export\s+const\s+build\s*=\s*["'](oss|saas|enterprise)["']/);
+if (m) build = m[1];
+
 const banner = `
 // patch __dirname
 // import { fileURLToPath } from "url";
@@ -37,7 +43,7 @@ const argv = yargs(hideBin(process.argv))
         describe: "Build type (oss, saas, enterprise)",
         type: "string",
         choices: ["oss", "saas", "enterprise"],
-        default: "oss"
+        default: build
     })
     .help()
     .alias("help", "h").argv;

install/main.go

@@ -6,7 +6,8 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"math/rand"
+	"crypto/rand"
+	"encoding/base64"
 	"net"
 	"net/http"
 	"net/url"
@@ -592,17 +593,12 @@ func showSetupTokenInstructions(containerType SupportedContainer, dashboardDomai
 }
 
 func generateRandomSecretKey() string {
-	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-	const length = 32
-
-	var seededRand *rand.Rand = rand.New(
-		rand.NewSource(time.Now().UnixNano()))
-
-	b := make([]byte, length)
-	for i := range b {
-		b[i] = charset[seededRand.Intn(len(charset))]
+	secret := make([]byte, 32)
+	_, err := rand.Read(secret)
+	if err != nil {
+		panic(fmt.Sprintf("Failed to generate random secret key: %v", err))
 	}
-	return string(b)
+	return base64.StdEncoding.EncodeToString(secret)
 }
 
 func getPublicIP() string {

messages/en-US.json

@@ -1404,10 +1404,10 @@
     "billingUsageLimitsOverview": "Usage Limits Overview",
     "billingMonitorUsage": "Monitor your usage against configured limits. If you need limits increased please contact us support@pangolin.net.",
     "billingDataUsage": "Data Usage",
-    "billingOnlineTime": "Site Online Time",
-    "billingUsers": "Active Users",
-    "billingDomains": "Active Domains",
-    "billingRemoteExitNodes": "Active Self-hosted Nodes",
+    "billingSites": "Sites",
+    "billingUsers": "Users",
+    "billingDomains": "Domains",
+    "billingRemoteExitNodes": "Remote Nodes",
     "billingNoLimitConfigured": "No limit configured",
     "billingEstimatedPeriod": "Estimated Billing Period",
     "billingIncludedUsage": "Included Usage",
@@ -1432,10 +1432,18 @@
     "billingFailedToGetPortalUrl": "Failed to get portal URL",
     "billingPortalError": "Portal Error",
     "billingDataUsageInfo": "You're charged for all data transferred through your secure tunnels when connected to the cloud. This includes both incoming and outgoing traffic across all your sites. When you reach your limit, your sites will disconnect until you upgrade your plan or reduce usage. Data is not charged when using nodes.",
-    "billingOnlineTimeInfo": "You're charged based on how long your sites stay connected to the cloud. For example, 44,640 minutes equals one site running 24/7 for a full month. When you reach your limit, your sites will disconnect until you upgrade your plan or reduce usage. Time is not charged when using nodes.",
-    "billingUsersInfo": "You're charged for each user in the organization. Billing is calculated daily based on the number of active user accounts in your org.",
-    "billingDomainInfo": "You're charged for each domain in the organization. Billing is calculated daily based on the number of active domain accounts in your org.",
-    "billingRemoteExitNodesInfo": "You're charged for each managed Node in the organization. Billing is calculated daily based on the number of active managed Nodes in your org.",
+    "billingSInfo": "How many sites you can use",
+    "billingUsersInfo": "How many users you can use",
+    "billingDomainInfo": "How many domains you can use",
+    "billingRemoteExitNodesInfo": "How many remote nodes you can use",
+    "billingLicenseKeys": "License Keys",
+    "billingLicenseKeysDescription": "Manage your license key subscriptions",
+    "billingLicenseSubscription": "License Subscription",
+    "billingInactive": "Inactive",
+    "billingLicenseItem": "License Item",
+    "billingQuantity": "Quantity",
+    "billingTotal": "total",
+    "billingModifyLicenses": "Modify License Subscription",
     "domainNotFound": "Domain Not Found",
     "domainNotFoundDescription": "This resource is disabled because the domain no longer exists our system. Please set a new domain for this resource.",
     "failed": "Failed",
@@ -1512,6 +1520,27 @@
     "resourcePortRequired": "Port number is required for non-HTTP resources",
     "resourcePortNotAllowed": "Port number should not be set for HTTP resources",
     "billingPricingCalculatorLink": "Pricing Calculator",
+    "billingYourPlan": "Your Plan",
+    "billingViewOrModifyPlan": "View or modify your current plan",
+    "billingViewPlanDetails": "View Plan Details",
+    "billingUsageAndLimits": "Usage and Limits",
+    "billingViewUsageAndLimits": "View your plan's limits and current usage",
+    "billingCurrentUsage": "Current Usage",
+    "billingMaximumLimits": "Maximum Limits",
+    "billingRemoteNodes": "Remote Nodes",
+    "billingUnlimited": "Unlimited",
+    "billingPaidLicenseKeys": "Paid License Keys",
+    "billingManageLicenseSubscription": "Manage your subscription for paid self-hosted license keys",
+    "billingCurrentKeys": "Current Keys",
+    "billingModifyCurrentPlan": "Modify Current Plan",
+    "billingConfirmUpgrade": "Confirm Upgrade",
+    "billingConfirmDowngrade": "Confirm Downgrade",
+    "billingConfirmUpgradeDescription": "You are about to upgrade your plan. Review the new limits and pricing below.",
+    "billingConfirmDowngradeDescription": "You are about to downgrade your plan. Review the new limits and pricing below.",
+    "billingPlanIncludes": "Plan Includes",
+    "billingProcessing": "Processing...",
+    "billingConfirmUpgradeButton": "Confirm Upgrade",
+    "billingConfirmDowngradeButton": "Confirm Downgrade",
     "signUpTerms": {
         "IAgreeToThe": "I agree to the",
         "termsOfService": "terms of service",
@@ -2113,6 +2142,32 @@
             }
         }
     },
+    "newPricingLicenseForm": {
+        "title": "Get a license",
+        "description": "Choose a plan and tell us how you plan to use Pangolin.",
+        "chooseTier": "Choose your plan",
+        "viewPricingLink": "See pricing, features, and limits",
+        "tiers": {
+            "starter": {
+                "title": "Starter",
+                "description": "Enterprise features, 25 users, 25 sites, and community support."
+            },
+            "scale": {
+                "title": "Scale",
+                "description": "Enterprise features, 50 users, 50 sites, and priority support."
+            }
+        },
+        "personalUseOnly": "Personal use only (free license — no checkout)",
+        "buttons": {
+            "continueToCheckout": "Continue to Checkout"
+        },
+        "toasts": {
+            "checkoutError": {
+                "title": "Checkout error",
+                "description": "Could not start checkout. Please try again."
+            }
+        }
+    },
     "priority": "Priority",
     "priorityDescription": "Higher priority routes are evaluated first. Priority = 100 means automatic ordering (system decides). Use another number to enforce manual priority.",
     "instanceName": "Instance Name",

package.json

@@ -12,24 +12,25 @@
     "license": "SEE LICENSE IN LICENSE AND README.md",
     "scripts": {
         "dev": "NODE_ENV=development ENVIRONMENT=dev tsx watch server/index.ts",
+        "dev:check": "npx tsc --noEmit && npm run format:check",
+        "dev:setup": "cp config/config.example.yml config/config.yml && npm run set:oss && npm run set:sqlite && npm run db:generate && npm run db:sqlite:push",
         "db:pg:generate": "drizzle-kit generate --config=./drizzle.pg.config.ts",
         "db:sqlite:generate": "drizzle-kit generate --config=./drizzle.sqlite.config.ts",
         "db:pg:push": "npx tsx server/db/pg/migrate.ts",
         "db:sqlite:push": "npx tsx server/db/sqlite/migrate.ts",
-        "db:sqlite:studio": "drizzle-kit studio --config=./drizzle.sqlite.config.ts",
-        "db:pg:studio": "drizzle-kit studio --config=./drizzle.pg.config.ts",
+        "db:studio": "drizzle-kit studio --config=./drizzle.config.ts",
         "db:clear-migrations": "rm -rf server/migrations",
         "set:oss": "echo 'export const build = \"oss\" as \"saas\" | \"enterprise\" | \"oss\";' > server/build.ts && cp tsconfig.oss.json tsconfig.json",
         "set:saas": "echo 'export const build = \"saas\" as \"saas\" | \"enterprise\" | \"oss\";' > server/build.ts && cp tsconfig.saas.json tsconfig.json",
         "set:enterprise": "echo 'export const build = \"enterprise\" as \"saas\" | \"enterprise\" | \"oss\";' > server/build.ts && cp tsconfig.enterprise.json tsconfig.json",
-        "set:sqlite": "echo 'export * from \"./sqlite\";\nexport const driver: \"pg\" | \"sqlite\" = \"sqlite\";' > server/db/index.ts",
-        "set:pg": "echo 'export * from \"./pg\";\nexport const driver: \"pg\" | \"sqlite\" = \"pg\";' > server/db/index.ts",
-        "next:build": "next build",
-        "build:sqlite": "mkdir -p dist && next build && node esbuild.mjs -e server/index.ts -o dist/server.mjs && node esbuild.mjs -e server/setup/migrationsSqlite.ts -o dist/migrations.mjs",
-        "build:pg": "mkdir -p dist && next build && node esbuild.mjs -e server/index.ts -o dist/server.mjs && node esbuild.mjs -e server/setup/migrationsPg.ts -o dist/migrations.mjs",
+        "set:sqlite": "echo 'export * from \"./sqlite\";\nexport const driver: \"pg\" | \"sqlite\" = \"sqlite\";' > server/db/index.ts && cp drizzle.sqlite.config.ts drizzle.config.ts && cp server/setup/migrationsSqlite.ts server/setup/migrations.ts",
+        "set:pg": "echo 'export * from \"./pg\";\nexport const driver: \"pg\" | \"sqlite\" = \"pg\";' > server/db/index.ts && cp drizzle.pg.config.ts drizzle.config.ts && cp server/setup/migrationsPg.ts server/setup/migrations.ts",
+        "build:next": "next build",
+        "build": "mkdir -p dist && next build && node esbuild.mjs -e server/index.ts -o dist/server.mjs && node esbuild.mjs -e server/setup/migrations.ts -o dist/migrations.mjs",
         "start": "ENVIRONMENT=prod node dist/migrations.mjs && ENVIRONMENT=prod NODE_ENV=development node --enable-source-maps dist/server.mjs",
         "email": "email dev --dir server/emails/templates --port 3005",
         "build:cli": "node esbuild.mjs -e cli/index.ts -o dist/cli.mjs",
+        "format:check": "prettier --check .",
         "format": "prettier --write ."
     },
     "dependencies": {
@@ -75,9 +76,7 @@
         "class-variance-authority": "0.7.1",
         "clsx": "2.1.1",
         "cmdk": "1.1.1",
-        "cookie": "1.1.1",
         "cookie-parser": "1.4.7",
-        "cookies": "0.9.1",
         "cors": "2.8.5",
         "crypto-js": "4.2.0",
         "d3": "7.9.0",
@@ -90,7 +89,6 @@
         "glob": "13.0.0",
         "helmet": "8.1.0",
         "http-errors": "2.0.1",
-        "i": "0.3.7",
         "input-otp": "1.4.2",
         "ioredis": "5.9.2",
         "jmespath": "0.16.0",
@@ -104,10 +102,7 @@
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "node-fetch": "3.3.2",
         "nodemailer": "7.0.11",
-        "npm": "11.7.0",
-        "nprogress": "0.2.0",
         "oslo": "1.2.1",
         "pg": "8.17.1",
         "posthog-node": "5.23.0",
@@ -118,7 +113,6 @@
         "react-easy-sort": "1.8.0",
         "react-hook-form": "7.71.1",
         "react-icons": "5.5.0",
-        "rebuild": "0.1.2",
         "recharts": "2.15.4",
         "reodotdev": "1.0.0",
         "resend": "6.8.0",

server/db/pg/schema/privateSchema.ts

@@ -82,7 +82,8 @@ export const subscriptions = pgTable("subscriptions", {
     canceledAt: bigint("canceledAt", { mode: "number" }),
     createdAt: bigint("createdAt", { mode: "number" }).notNull(),
     updatedAt: bigint("updatedAt", { mode: "number" }),
-    billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" })
+    billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }),
+    type: varchar("type", { length: 50 }) // home_lab, starter, scale, or license
 });
 
 export const subscriptionItems = pgTable("subscriptionItems", {

server/db/sqlite/schema/privateSchema.ts

@@ -70,7 +70,8 @@ export const subscriptions = sqliteTable("subscriptions", {
     canceledAt: integer("canceledAt"),
     createdAt: integer("createdAt").notNull(),
     updatedAt: integer("updatedAt"),
-    billingCycleAnchor: integer("billingCycleAnchor")
+    billingCycleAnchor: integer("billingCycleAnchor"),
+    type: text("type") // home_lab, starter, scale, or license
 });
 
 export const subscriptionItems = sqliteTable("subscriptionItems", {

server/emails/templates/EnterpriseEditionKeyGenerated.tsx

@@ -0,0 +1,118 @@
+import React from "react";
+import { Body, Head, Html, Preview, Tailwind } from "@react-email/components";
+import { themeColors } from "./lib/theme";
+import {
+    EmailContainer,
+    EmailFooter,
+    EmailGreeting,
+    EmailHeading,
+    EmailInfoSection,
+    EmailLetterHead,
+    EmailSection,
+    EmailSignature,
+    EmailText
+} from "./components/Email";
+import CopyCodeBox from "./components/CopyCodeBox";
+import ButtonLink from "./components/ButtonLink";
+
+type EnterpriseEditionKeyGeneratedProps = {
+    keyValue: string;
+    personalUseOnly: boolean;
+    users: number;
+    sites: number;
+    modifySubscriptionLink?: string;
+};
+
+export const EnterpriseEditionKeyGenerated = ({
+    keyValue,
+    personalUseOnly,
+    users,
+    sites,
+    modifySubscriptionLink
+}: EnterpriseEditionKeyGeneratedProps) => {
+    const previewText = personalUseOnly
+        ? "Your Enterprise Edition key for personal use is ready"
+        : "Thank you for your purchase — your Enterprise Edition key is ready";
+
+    return (
+        <Html>
+            <Head />
+            <Preview>{previewText}</Preview>
+            <Tailwind config={themeColors}>
+                <Body className="font-sans bg-gray-50">
+                    <EmailContainer>
+                        <EmailLetterHead />
+
+                        <EmailGreeting>Hi there,</EmailGreeting>
+
+                        {personalUseOnly ? (
+                            <EmailText>
+                                Your Enterprise Edition license key has been
+                                generated. Qualifying users can use the
+                                Enterprise Edition for free for{" "}
+                                <strong>personal use only</strong>.
+                            </EmailText>
+                        ) : (
+                            <>
+                                <EmailText>
+                                    Thank you for your purchase. Your Enterprise
+                                    Edition license key is ready. Below are the
+                                    terms of your license.
+                                </EmailText>
+                                <EmailInfoSection
+                                    title="License details"
+                                    items={[
+                                        {
+                                            label: "Licensed users",
+                                            value: users
+                                        },
+                                        {
+                                            label: "Licensed sites",
+                                            value: sites
+                                        }
+                                    ]}
+                                />
+                                {modifySubscriptionLink && (
+                                    <EmailSection>
+                                        <ButtonLink
+                                            href={modifySubscriptionLink}
+                                        >
+                                            Modify subscription
+                                        </ButtonLink>
+                                    </EmailSection>
+                                )}
+                            </>
+                        )}
+
+                        <EmailSection>
+                            <EmailText>Your license key:</EmailText>
+                            <CopyCodeBox
+                                text={keyValue}
+                                hint="Copy this key and use it when activating Enterprise Edition on your Pangolin host."
+                            />
+                        </EmailSection>
+
+                        <EmailText>
+                            If you need to purchase additional license keys or
+                            modify your existing license, please reach out to
+                            our support team at{" "}
+                            <a
+                                href="mailto:support@pangolin.net"
+                                className="text-primary font-medium"
+                            >
+                                support@pangolin.net
+                            </a>
+                            .
+                        </EmailText>
+
+                        <EmailFooter>
+                            <EmailSignature />
+                        </EmailFooter>
+                    </EmailContainer>
+                </Body>
+            </Tailwind>
+        </Html>
+    );
+};
+
+export default EnterpriseEditionKeyGenerated;

server/emails/templates/components/CopyCodeBox.tsx

@@ -1,6 +1,14 @@
 import React from "react";
 
-export default function CopyCodeBox({ text }: { text: string }) {
+const DEFAULT_HINT = "Copy and paste this code when prompted";
+
+export default function CopyCodeBox({
+    text,
+    hint
+}: {
+    text: string;
+    hint?: string;
+}) {
     return (
         <div className="inline-block">
             <div className="bg-gray-50 border border-gray-200 rounded-lg px-6 py-4 mx-auto">
@@ -8,9 +16,7 @@ export default function CopyCodeBox({ text }: { text: string }) {
                     {text}
                 </span>
             </div>
-            <p className="text-xs text-gray-500 mt-2">
-                Copy and paste this code when prompted
-            </p>
+            <p className="text-xs text-gray-500 mt-2">{hint ?? DEFAULT_HINT}</p>
         </div>
     );
 }

server/integrationApiServer.ts

@@ -105,11 +105,13 @@ function getOpenApiDocumentation() {
         servers: [{ url: "/v1" }]
     });
 
-    // convert to yaml and save to file
-    const outputPath = path.join(APP_PATH, "openapi.yaml");
-    const yamlOutput = yaml.dump(generated);
-    fs.writeFileSync(outputPath, yamlOutput, "utf8");
-    logger.info(`OpenAPI documentation saved to ${outputPath}`);
+    if (!process.env.DISABLE_GEN_OPENAPI) {
+        // convert to yaml and save to file
+        const outputPath = path.join(APP_PATH, "openapi.yaml");
+        const yamlOutput = yaml.dump(generated);
+        fs.writeFileSync(outputPath, yamlOutput, "utf8");
+        logger.info(`OpenAPI documentation saved to ${outputPath}`);
+    }
 
     return generated;
 }

server/lib/billing/features.ts

@@ -1,30 +1,24 @@
 import Stripe from "stripe";
+import { usageService } from "./usageService";
 
 export enum FeatureId {
-    SITE_UPTIME = "siteUptime",
     USERS = "users",
+    SITES = "sites",
     EGRESS_DATA_MB = "egressDataMb",
     DOMAINS = "domains",
-    REMOTE_EXIT_NODES = "remoteExitNodes"
+    REMOTE_EXIT_NODES = "remoteExitNodes",
+    HOME_LAB = "home_lab"
 }
 
-export const FeatureMeterIds: Record<FeatureId, string> = {
-    [FeatureId.SITE_UPTIME]: "mtr_61Srrej5wUJuiTWgo41D3Ee2Ir7WmDLU",
-    [FeatureId.USERS]: "mtr_61SrreISyIWpwUNGR41D3Ee2Ir7WmQro",
-    [FeatureId.EGRESS_DATA_MB]: "mtr_61Srreh9eWrExDSCe41D3Ee2Ir7Wm5YW",
-    [FeatureId.DOMAINS]: "mtr_61Ss9nIKDNMw0LDRU41D3Ee2Ir7WmRPU",
-    [FeatureId.REMOTE_EXIT_NODES]: "mtr_61T86UXnfxTVXy9sD41D3Ee2Ir7WmFTE"
+export const FeatureMeterIds: Partial<Record<FeatureId, string>> = { // right now we are not charging for any data
+    // [FeatureId.EGRESS_DATA_MB]: "mtr_61Srreh9eWrExDSCe41D3Ee2Ir7Wm5YW"
 };
 
-export const FeatureMeterIdsSandbox: Record<FeatureId, string> = {
-    [FeatureId.SITE_UPTIME]: "mtr_test_61Snh3cees4w60gv841DCpkOb237BDEu",
-    [FeatureId.USERS]: "mtr_test_61Sn5fLtq1gSfRkyA41DCpkOb237B6au",
-    [FeatureId.EGRESS_DATA_MB]: "mtr_test_61Snh2a2m6qome5Kv41DCpkOb237B3dQ",
-    [FeatureId.DOMAINS]: "mtr_test_61SsA8qrdAlgPpFRQ41DCpkOb237BGts",
-    [FeatureId.REMOTE_EXIT_NODES]: "mtr_test_61T86Vqmwa3D9ra3341DCpkOb237B94K"
+export const FeatureMeterIdsSandbox: Partial<Record<FeatureId, string>> = {
+    // [FeatureId.EGRESS_DATA_MB]: "mtr_test_61Snh2a2m6qome5Kv41DCpkOb237B3dQ"
 };
 
-export function getFeatureMeterId(featureId: FeatureId): string {
+export function getFeatureMeterId(featureId: FeatureId): string | undefined {
     if (
         process.env.ENVIRONMENT == "prod" &&
         process.env.SANDBOX_MODE !== "true"
@@ -43,45 +37,83 @@ export function getFeatureIdByMetricId(
     )?.[0];
 }
 
-export type FeaturePriceSet = {
-    [key in Exclude<FeatureId, FeatureId.DOMAINS>]: string;
-} & {
-    [FeatureId.DOMAINS]?: string; // Optional since domains are not billed
+export type FeaturePriceSet = Partial<Record<FeatureId, string>>;
+
+export const homeLabFeaturePriceSet: FeaturePriceSet = {
+    [FeatureId.HOME_LAB]: "price_1SxgpPDCpkOb237Bfo4rIsoT"
 };
 
-export const standardFeaturePriceSet: FeaturePriceSet = {
-    // Free tier matches the freeLimitSet
-    [FeatureId.SITE_UPTIME]: "price_1RrQc4D3Ee2Ir7WmaJGZ3MtF",
-    [FeatureId.USERS]: "price_1RrQeJD3Ee2Ir7WmgveP3xea",
-    [FeatureId.EGRESS_DATA_MB]: "price_1RrQXFD3Ee2Ir7WmvGDlgxQk",
-    // [FeatureId.DOMAINS]: "price_1Rz3tMD3Ee2Ir7Wm5qLeASzC",
-    [FeatureId.REMOTE_EXIT_NODES]: "price_1S46weD3Ee2Ir7Wm94KEHI4h"
+export const homeLabFeaturePriceSetSandbox: FeaturePriceSet = {
+    [FeatureId.HOME_LAB]: "price_1SxgpPDCpkOb237Bfo4rIsoT"
 };
 
-export const standardFeaturePriceSetSandbox: FeaturePriceSet = {
-    // Free tier matches the freeLimitSet
-    [FeatureId.SITE_UPTIME]: "price_1RefFBDCpkOb237BPrKZ8IEU",
-    [FeatureId.USERS]: "price_1ReNa4DCpkOb237Bc67G5muF",
-    [FeatureId.EGRESS_DATA_MB]: "price_1Rfp9LDCpkOb237BwuN5Oiu0",
-    // [FeatureId.DOMAINS]: "price_1Ryi88DCpkOb237B2D6DM80b",
-    [FeatureId.REMOTE_EXIT_NODES]: "price_1RyiZvDCpkOb237BXpmoIYJL"
-};
-
-export function getStandardFeaturePriceSet(): FeaturePriceSet {
+export function getHomeLabFeaturePriceSet(): FeaturePriceSet {
     if (
         process.env.ENVIRONMENT == "prod" &&
         process.env.SANDBOX_MODE !== "true"
     ) {
-        return standardFeaturePriceSet;
+        return homeLabFeaturePriceSet;
     } else {
-        return standardFeaturePriceSetSandbox;
+        return homeLabFeaturePriceSetSandbox;
     }
 }
 
-export function getLineItems(
-    featurePriceSet: FeaturePriceSet
-): Stripe.Checkout.SessionCreateParams.LineItem[] {
-    return Object.entries(featurePriceSet).map(([featureId, priceId]) => ({
-        price: priceId
-    }));
+export const starterFeaturePriceSet: FeaturePriceSet = {
+    [FeatureId.USERS]: "price_1SxaEHDCpkOb237BD9lBkPiR"
+};
+
+export const starterFeaturePriceSetSandbox: FeaturePriceSet = {
+    [FeatureId.USERS]: "price_1SxaEHDCpkOb237BD9lBkPiR"
+};
+
+export function getStarterFeaturePriceSet(): FeaturePriceSet {
+    if (
+        process.env.ENVIRONMENT == "prod" &&
+        process.env.SANDBOX_MODE !== "true"
+    ) {
+        return starterFeaturePriceSet;
+    } else {
+        return starterFeaturePriceSetSandbox;
+    }
+}
+
+export const scaleFeaturePriceSet: FeaturePriceSet = {
+    [FeatureId.USERS]: "price_1SxaEODCpkOb237BiXdCBSfs"
+};
+
+export const scaleFeaturePriceSetSandbox: FeaturePriceSet = {
+    [FeatureId.USERS]: "price_1SxaEODCpkOb237BiXdCBSfs"
+};
+
+export function getScaleFeaturePriceSet(): FeaturePriceSet {
+    if (
+        process.env.ENVIRONMENT == "prod" &&
+        process.env.SANDBOX_MODE !== "true"
+    ) {
+        return scaleFeaturePriceSet;
+    } else {
+        return scaleFeaturePriceSetSandbox;
+    }
+}
+
+export async function getLineItems(
+    featurePriceSet: FeaturePriceSet,
+    orgId: string,
+): Promise<Stripe.Checkout.SessionCreateParams.LineItem[]> {
+    const users = await usageService.getUsageDaily(orgId, FeatureId.USERS);
+
+    return Object.entries(featurePriceSet).map(([featureId, priceId]) => {
+        let quantity: number | undefined;
+
+        if (featureId === FeatureId.USERS) {
+            quantity = users?.instantaneousValue || 1;
+        } else if (featureId === FeatureId.HOME_LAB) {
+            quantity = 1;
+        }
+
+        return {
+            price: priceId,
+            quantity: quantity
+        };
+    });
 }

server/lib/billing/licenses.ts

@@ -0,0 +1,37 @@
+export enum LicenseId {
+    SMALL_LICENSE = "small_license",
+    BIG_LICENSE = "big_license"
+}
+
+export type LicensePriceSet = {
+    [key in LicenseId]: string;
+};
+
+export const licensePriceSet: LicensePriceSet = {
+    // Free license matches the freeLimitSet
+    [LicenseId.SMALL_LICENSE]: "price_1SxKHiD3Ee2Ir7WmvtEh17A8",
+    [LicenseId.BIG_LICENSE]: "price_1SxKHiD3Ee2Ir7WmMUiP0H6Y"
+};
+
+export const licensePriceSetSandbox: LicensePriceSet = {
+    // Free license matches the freeLimitSet
+    // when matching license the keys closer to 0 index are matched first so list the licenses in descending order of value
+    [LicenseId.SMALL_LICENSE]: "price_1SxDwuDCpkOb237Bz0yTiOgN",
+    [LicenseId.BIG_LICENSE]: "price_1SxDy0DCpkOb237BWJxrxYkl"
+};
+
+export function getLicensePriceSet(
+    environment?: string,
+    sandbox_mode?: boolean
+): LicensePriceSet {
+    if (
+        (process.env.ENVIRONMENT == "prod" &&
+            process.env.SANDBOX_MODE !== "true") ||
+        (environment === "prod" && sandbox_mode !== true)
+    ) {
+        // THIS GETS LOADED CLIENT SIDE AND SERVER SIDE
+        return licensePriceSet;
+    } else {
+        return licensePriceSetSandbox;
+    }
+}

server/lib/billing/limitSet.ts

@@ -1,14 +1,14 @@
 import { FeatureId } from "./features";
 
-export type LimitSet = {
+export type LimitSet = Partial<{
     [key in FeatureId]: {
         value: number | null; // null indicates no limit
         description?: string;
     };
-};
+}>;
 
 export const sandboxLimitSet: LimitSet = {
-    [FeatureId.SITE_UPTIME]: { value: 2880, description: "Sandbox limit" }, // 1 site up for 2 days
+    [FeatureId.SITES]: { value: 1, description: "Sandbox limit" }, // 1 site up for 2 days
     [FeatureId.USERS]: { value: 1, description: "Sandbox limit" },
     [FeatureId.EGRESS_DATA_MB]: { value: 1000, description: "Sandbox limit" }, // 1 GB
     [FeatureId.DOMAINS]: { value: 0, description: "Sandbox limit" },
@@ -16,35 +16,69 @@ export const sandboxLimitSet: LimitSet = {
 };
 
 export const freeLimitSet: LimitSet = {
-    [FeatureId.SITE_UPTIME]: { value: 46080, description: "Free tier limit" }, // 1 site up for 32 days
+    [FeatureId.SITES]: { value: 3, description: "Free tier limit" }, // 1 site up for 32 days
     [FeatureId.USERS]: { value: 3, description: "Free tier limit" },
     [FeatureId.EGRESS_DATA_MB]: {
         value: 25000,
         description: "Free tier limit"
     }, // 25 GB
     [FeatureId.DOMAINS]: { value: 3, description: "Free tier limit" },
-    [FeatureId.REMOTE_EXIT_NODES]: { value: 1, description: "Free tier limit" }
+    [FeatureId.REMOTE_EXIT_NODES]: { value: 0, description: "Free tier limit" }
 };
 
-export const subscribedLimitSet: LimitSet = {
-    [FeatureId.SITE_UPTIME]: {
-        value: 2232000,
-        description: "Contact us to increase soft limit."
+export const homeLabLimitSet: LimitSet = {
+    [FeatureId.SITES]: { value: 3, description: "Home lab limit" }, // 1 site up for 32 days
+    [FeatureId.USERS]: { value: 3, description: "Home lab limit" },
+    [FeatureId.EGRESS_DATA_MB]: {
+        value: 25000,
+        description: "Home lab limit"
+    }, // 25 GB
+    [FeatureId.DOMAINS]: { value: 3, description: "Home lab limit" },
+    [FeatureId.REMOTE_EXIT_NODES]: { value: 1, description: "Home lab limit" }
+};
+
+export const starterLimitSet: LimitSet = {
+    [FeatureId.SITES]: {
+        value: 10,
+        description: "Starter limit"
     }, // 50 sites up for 31 days
     [FeatureId.USERS]: {
         value: 150,
-        description: "Contact us to increase soft limit."
+        description: "Starter limit"
     },
     [FeatureId.EGRESS_DATA_MB]: {
         value: 12000000,
-        description: "Contact us to increase soft limit."
+        description: "Starter limit"
     }, // 12000 GB
     [FeatureId.DOMAINS]: {
-        value: 25,
-        description: "Contact us to increase soft limit."
+        value: 250,
+        description: "Starter limit"
     },
     [FeatureId.REMOTE_EXIT_NODES]: {
         value: 5,
-        description: "Contact us to increase soft limit."
+        description: "Starter limit"
+    }
+};
+
+export const scaleLimitSet: LimitSet = {
+    [FeatureId.SITES]: {
+        value: 10,
+        description: "Scale limit"
+    }, // 50 sites up for 31 days
+    [FeatureId.USERS]: {
+        value: 150,
+        description: "Scale limit"
+    },
+    [FeatureId.EGRESS_DATA_MB]: {
+        value: 12000000,
+        description: "Scale limit"
+    }, // 12000 GB
+    [FeatureId.DOMAINS]: {
+        value: 250,
+        description: "Scale limit"
+    },
+    [FeatureId.REMOTE_EXIT_NODES]: {
+        value: 5,
+        description: "Scale limit"
     }
 };

server/lib/billing/tiers.ts

@@ -1,34 +0,0 @@
-export enum TierId {
-    STANDARD = "standard"
-}
-
-export type TierPriceSet = {
-    [key in TierId]: string;
-};
-
-export const tierPriceSet: TierPriceSet = {
-    // Free tier matches the freeLimitSet
-    [TierId.STANDARD]: "price_1RrQ9cD3Ee2Ir7Wmqdy3KBa0"
-};
-
-export const tierPriceSetSandbox: TierPriceSet = {
-    // Free tier matches the freeLimitSet
-    // when matching tier the keys closer to 0 index are matched first so list the tiers in descending order of value
-    [TierId.STANDARD]: "price_1RrAYJDCpkOb237By2s1P32m"
-};
-
-export function getTierPriceSet(
-    environment?: string,
-    sandbox_mode?: boolean
-): TierPriceSet {
-    if (
-        (process.env.ENVIRONMENT == "prod" &&
-            process.env.SANDBOX_MODE !== "true") ||
-        (environment === "prod" && sandbox_mode !== true)
-    ) {
-        // THIS GETS LOADED CLIENT SIDE AND SERVER SIDE
-        return tierPriceSet;
-    } else {
-        return tierPriceSetSandbox;
-    }
-}

server/lib/billing/usageService.ts

@@ -1,8 +1,6 @@
 import { eq, sql, and } from "drizzle-orm";
 import { v4 as uuidv4 } from "uuid";
 import { PutObjectCommand } from "@aws-sdk/client-s3";
-import * as fs from "fs/promises";
-import * as path from "path";
 import {
     db,
     usage,
@@ -33,9 +31,7 @@ interface StripeEvent {
 
 export function noop() {
     if (
-        build !== "saas" ||
-        !process.env.S3_BUCKET ||
-        !process.env.LOCAL_FILE_PATH
+        build !== "saas"
     ) {
         return true;
     }
@@ -44,31 +40,37 @@ export function noop() {
 
 export class UsageService {
     private bucketName: string | undefined;
-    private currentEventFile: string | null = null;
-    private currentFileStartTime: number = 0;
-    private eventsDir: string | undefined;
-    private uploadingFiles: Set<string> = new Set();
+    private events: StripeEvent[] = [];
+    private lastUploadTime: number = Date.now();
+    private isUploading: boolean = false;
 
     constructor() {
         if (noop()) {
             return;
         }
-        // this.bucketName = privateConfig.getRawPrivateConfig().stripe?.s3Bucket;
-        // this.eventsDir = privateConfig.getRawPrivateConfig().stripe?.localFilePath;
         this.bucketName = process.env.S3_BUCKET || undefined;
-        this.eventsDir = process.env.LOCAL_FILE_PATH || undefined;
 
-        // Ensure events directory exists
-        this.initializeEventsDirectory().then(() => {
-            this.uploadPendingEventFilesOnStartup();
-        });
-
-        // Periodically check for old event files to upload
+        // Periodically check and upload events
         setInterval(() => {
-            this.uploadOldEventFiles().catch((err) => {
-                logger.error("Error in periodic event file upload:", err);
+            this.checkAndUploadEvents().catch((err) => {
+                logger.error("Error in periodic event upload:", err);
             });
         }, 30000); // every 30 seconds
+
+        // Handle graceful shutdown on SIGTERM
+        process.on("SIGTERM", async () => {
+            logger.info("SIGTERM received, uploading events before shutdown...");
+            await this.forceUpload();
+            logger.info("Events uploaded, proceeding with shutdown");
+        });
+
+        // Handle SIGINT as well (Ctrl+C)
+        process.on("SIGINT", async () => {
+            logger.info("SIGINT received, uploading events before shutdown...");
+            await this.forceUpload();
+            logger.info("Events uploaded, proceeding with shutdown");
+            process.exit(0);
+        });
     }
 
     /**
@@ -78,85 +80,6 @@ export class UsageService {
         return Math.round(value * 100000000000) / 100000000000; // 11 decimal places
     }
 
-    private async initializeEventsDirectory(): Promise<void> {
-        if (!this.eventsDir) {
-            logger.warn(
-                "Stripe local file path is not configured, skipping events directory initialization."
-            );
-            return;
-        }
-        try {
-            await fs.mkdir(this.eventsDir, { recursive: true });
-        } catch (error) {
-            logger.error("Failed to create events directory:", error);
-        }
-    }
-
-    private async uploadPendingEventFilesOnStartup(): Promise<void> {
-        if (!this.eventsDir || !this.bucketName) {
-            logger.warn(
-                "Stripe local file path or bucket name is not configured, skipping leftover event file upload."
-            );
-            return;
-        }
-        try {
-            const files = await fs.readdir(this.eventsDir);
-            for (const file of files) {
-                if (file.endsWith(".json")) {
-                    const filePath = path.join(this.eventsDir, file);
-                    try {
-                        const fileContent = await fs.readFile(
-                            filePath,
-                            "utf-8"
-                        );
-                        const events = JSON.parse(fileContent);
-                        if (Array.isArray(events) && events.length > 0) {
-                            // Upload to S3
-                            const uploadCommand = new PutObjectCommand({
-                                Bucket: this.bucketName,
-                                Key: file,
-                                Body: fileContent,
-                                ContentType: "application/json"
-                            });
-                            await s3Client.send(uploadCommand);
-
-                            // Check if file still exists before unlinking
-                            try {
-                                await fs.access(filePath);
-                                await fs.unlink(filePath);
-                            } catch (unlinkError) {
-                                logger.debug(
-                                    `Startup file ${file} was already deleted`
-                                );
-                            }
-
-                            logger.info(
-                                `Uploaded leftover event file ${file} to S3 with ${events.length} events`
-                            );
-                        } else {
-                            // Remove empty file
-                            try {
-                                await fs.access(filePath);
-                                await fs.unlink(filePath);
-                            } catch (unlinkError) {
-                                logger.debug(
-                                    `Empty startup file ${file} was already deleted`
-                                );
-                            }
-                        }
-                    } catch (err) {
-                        logger.error(
-                            `Error processing leftover event file ${file}:`,
-                            err
-                        );
-                    }
-                }
-            }
-        } catch (error) {
-            logger.error("Failed to scan for leftover event files");
-        }
-    }
-
     public async add(
         orgId: string,
         featureId: FeatureId,
@@ -450,121 +373,58 @@ export class UsageService {
             }
         };
 
-        await this.writeEventToFile(event);
-        await this.checkAndUploadFile();
+        this.addEventToMemory(event);
+        await this.checkAndUploadEvents();
     }
 
-    private async writeEventToFile(event: StripeEvent): Promise<void> {
-        if (!this.eventsDir || !this.bucketName) {
+    private addEventToMemory(event: StripeEvent): void {
+        if (!this.bucketName) {
             logger.warn(
-                "Stripe local file path or bucket name is not configured, skipping event file write."
+                "S3 bucket name is not configured, skipping event storage."
             );
             return;
         }
-        if (!this.currentEventFile) {
-            this.currentEventFile = this.generateEventFileName();
-            this.currentFileStartTime = Date.now();
-        }
-
-        const filePath = path.join(this.eventsDir, this.currentEventFile);
-
-        try {
-            let events: StripeEvent[] = [];
-
-            // Try to read existing file
-            try {
-                const fileContent = await fs.readFile(filePath, "utf-8");
-                events = JSON.parse(fileContent);
-            } catch (error) {
-                // File doesn't exist or is empty, start with empty array
-                events = [];
-            }
-
-            // Add new event
-            events.push(event);
-
-            // Write back to file
-            await fs.writeFile(filePath, JSON.stringify(events, null, 2));
-        } catch (error) {
-            logger.error("Failed to write event to file:", error);
-        }
+        this.events.push(event);
     }
 
-    private async checkAndUploadFile(): Promise<void> {
-        if (!this.currentEventFile) {
-            return;
-        }
-
+    private async checkAndUploadEvents(): Promise<void> {
         const now = Date.now();
-        const fileAge = now - this.currentFileStartTime;
+        const timeSinceLastUpload = now - this.lastUploadTime;
 
-        // Check if file is at least 1 minute old
-        if (fileAge >= 60000) {
-            // 60 seconds
-            await this.uploadFileToS3();
+        // Check if at least 1 minute has passed since last upload
+        if (timeSinceLastUpload >= 60000 && this.events.length > 0) {
+            await this.uploadEventsToS3();
         }
     }
 
-    private async uploadFileToS3(): Promise<void> {
-        if (!this.bucketName || !this.eventsDir) {
+    private async uploadEventsToS3(): Promise<void> {
+        if (!this.bucketName) {
             logger.warn(
-                "Stripe local file path or bucket name is not configured, skipping S3 upload."
-            );
-            return;
-        }
-        if (!this.currentEventFile) {
-            return;
-        }
-
-        const fileName = this.currentEventFile;
-        const filePath = path.join(this.eventsDir, fileName);
-
-        // Check if this file is already being uploaded
-        if (this.uploadingFiles.has(fileName)) {
-            logger.debug(
-                `File ${fileName} is already being uploaded, skipping`
+                "S3 bucket name is not configured, skipping S3 upload."
             );
             return;
         }
 
-        // Mark file as being uploaded
-        this.uploadingFiles.add(fileName);
+        if (this.events.length === 0) {
+            return;
+        }
+
+        // Check if already uploading
+        if (this.isUploading) {
+            logger.debug("Already uploading events, skipping");
+            return;
+        }
+
+        this.isUploading = true;
 
         try {
-            // Check if file exists before trying to read it
-            try {
-                await fs.access(filePath);
-            } catch (error) {
-                logger.debug(
-                    `File ${fileName} does not exist, may have been already processed`
-                );
-                this.uploadingFiles.delete(fileName);
-                // Reset current file if it was this file
-                if (this.currentEventFile === fileName) {
-                    this.currentEventFile = null;
-                    this.currentFileStartTime = 0;
-                }
-                return;
-            }
+            // Take a snapshot of current events and clear the array
+            const eventsToUpload = [...this.events];
+            this.events = [];
+            this.lastUploadTime = Date.now();
 
-            // Check if file exists and has content
-            const fileContent = await fs.readFile(filePath, "utf-8");
-            const events = JSON.parse(fileContent);
-
-            if (events.length === 0) {
-                // No events to upload, just clean up
-                try {
-                    await fs.unlink(filePath);
-                } catch (unlinkError) {
-                    // File may have been already deleted
-                    logger.debug(
-                        `File ${fileName} was already deleted during cleanup`
-                    );
-                }
-                this.currentEventFile = null;
-                this.uploadingFiles.delete(fileName);
-                return;
-            }
+            const fileName = this.generateEventFileName();
+            const fileContent = JSON.stringify(eventsToUpload, null, 2);
 
             // Upload to S3
             const uploadCommand = new PutObjectCommand({
@@ -576,29 +436,15 @@ export class UsageService {
 
             await s3Client.send(uploadCommand);
 
-            // Clean up local file - check if it still exists before unlinking
-            try {
-                await fs.access(filePath);
-                await fs.unlink(filePath);
-            } catch (unlinkError) {
-                // File may have been already deleted by another process
-                logger.debug(
-                    `File ${fileName} was already deleted during upload`
-                );
-            }
-
             logger.info(
-                `Uploaded ${fileName} to S3 with ${events.length} events`
+                `Uploaded ${fileName} to S3 with ${eventsToUpload.length} events`
             );
-
-            // Reset for next file
-            this.currentEventFile = null;
-            this.currentFileStartTime = 0;
         } catch (error) {
-            logger.error(`Failed to upload ${fileName} to S3:`, error);
+            logger.error("Failed to upload events to S3:", error);
+            // Note: Events are lost if upload fails. In a production system,
+            // you might want to add the events back to the array or implement retry logic
         } finally {
-            // Always remove from uploading set
-            this.uploadingFiles.delete(fileName);
+            this.isUploading = false;
         }
     }
 
@@ -695,111 +541,10 @@ export class UsageService {
     }
 
     public async forceUpload(): Promise<void> {
-        await this.uploadFileToS3();
-    }
-
-    /**
-     * Scan the events directory for files older than 1 minute and upload them if not empty.
-     */
-    private async uploadOldEventFiles(): Promise<void> {
-        if (!this.eventsDir || !this.bucketName) {
-            logger.warn(
-                "Stripe local file path or bucket name is not configured, skipping old event file upload."
-            );
-            return;
-        }
-        try {
-            const files = await fs.readdir(this.eventsDir);
-            const now = Date.now();
-            for (const file of files) {
-                if (!file.endsWith(".json")) continue;
-
-                // Skip files that are already being uploaded
-                if (this.uploadingFiles.has(file)) {
-                    logger.debug(
-                        `Skipping file ${file} as it's already being uploaded`
-                    );
-                    continue;
-                }
-
-                const filePath = path.join(this.eventsDir, file);
-
-                try {
-                    // Check if file still exists before processing
-                    try {
-                        await fs.access(filePath);
-                    } catch (accessError) {
-                        logger.debug(`File ${file} does not exist, skipping`);
-                        continue;
-                    }
-
-                    const stat = await fs.stat(filePath);
-                    const age = now - stat.mtimeMs;
-                    if (age >= 90000) {
-                        // 1.5 minutes - Mark as being uploaded
-                        this.uploadingFiles.add(file);
-
-                        try {
-                            const fileContent = await fs.readFile(
-                                filePath,
-                                "utf-8"
-                            );
-                            const events = JSON.parse(fileContent);
-                            if (Array.isArray(events) && events.length > 0) {
-                                // Upload to S3
-                                const uploadCommand = new PutObjectCommand({
-                                    Bucket: this.bucketName,
-                                    Key: file,
-                                    Body: fileContent,
-                                    ContentType: "application/json"
-                                });
-                                await s3Client.send(uploadCommand);
-
-                                // Check if file still exists before unlinking
-                                try {
-                                    await fs.access(filePath);
-                                    await fs.unlink(filePath);
-                                } catch (unlinkError) {
-                                    logger.debug(
-                                        `File ${file} was already deleted during interval upload`
-                                    );
-                                }
-
-                                logger.info(
-                                    `Interval: Uploaded event file ${file} to S3 with ${events.length} events`
-                                );
-                                // If this was the current event file, reset it
-                                if (this.currentEventFile === file) {
-                                    this.currentEventFile = null;
-                                    this.currentFileStartTime = 0;
-                                }
-                            } else {
-                                // Remove empty file
-                                try {
-                                    await fs.access(filePath);
-                                    await fs.unlink(filePath);
-                                } catch (unlinkError) {
-                                    logger.debug(
-                                        `Empty file ${file} was already deleted`
-                                    );
-                                }
-                            }
-                        } finally {
-                            // Always remove from uploading set
-                            this.uploadingFiles.delete(file);
-                        }
-                    }
-                } catch (err) {
-                    logger.error(
-                        `Interval: Error processing event file ${file}:`,
-                        err
-                    );
-                    // Remove from uploading set on error
-                    this.uploadingFiles.delete(file);
-                }
-            }
-        } catch (err) {
-            logger.error("Interval: Failed to scan for event files:", err);
+        if (this.events.length > 0) {
+            // Force upload regardless of time
+            this.lastUploadTime = 0; // Reset to force upload
+            await this.uploadEventsToS3();
         }
     }
 

server/lib/getEnvOrYaml.ts

@@ -0,0 +1,3 @@
+export const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
+    return process.env[envVar] ?? valFromYaml;
+};

server/lib/isSubscribed.ts

@@ -0,0 +1,3 @@
+export async function isSubscribed(orgId: string): Promise<boolean> {
+    return false;
+}

server/lib/readConfigFile.ts

@@ -3,13 +3,10 @@ import yaml from "js-yaml";
 import { configFilePath1, configFilePath2 } from "./consts";
 import { z } from "zod";
 import stoi from "./stoi";
+import { getEnvOrYaml } from "./getEnvOrYaml";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
 
-const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
-    return process.env[envVar] ?? valFromYaml;
-};
-
 export const configSchema = z
     .object({
         app: z
@@ -311,7 +308,10 @@ export const configSchema = z
             .object({
                 smtp_host: z.string().optional(),
                 smtp_port: portSchema.optional(),
-                smtp_user: z.string().optional(),
+                smtp_user: z
+                    .string()
+                    .optional()
+                    .transform(getEnvOrYaml("EMAIL_SMTP_USER")),
                 smtp_pass: z
                     .string()
                     .optional()

server/license/license.ts

@@ -12,6 +12,10 @@ export type LicenseStatus = {
     isLicenseValid: boolean; // Is the license key valid?
     hostId: string; // Host ID
     tier?: LicenseKeyTier;
+    maxSites?: number;
+    usedSites?: number;
+    maxUsers?: number;
+    usedUsers?: number;
 };
 
 export type LicenseKeyCache = {
@@ -22,12 +26,14 @@ export type LicenseKeyCache = {
     type?: LicenseKeyType;
     tier?: LicenseKeyTier;
     terminateAt?: Date;
+    quantity?: number;
+    quantity_2?: number;
 };
 
 export class License {
     private serverSecret!: string;
 
-    constructor(private hostMeta: HostMeta) {}
+    constructor(private hostMeta: HostMeta) { }
 
     public async check(): Promise<LicenseStatus> {
         return {

server/private/lib/billing/getOrgTierData.ts

@@ -11,36 +11,58 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { getTierPriceSet } from "@server/lib/billing/tiers";
-import { getOrgSubscriptionData } from "#private/routers/billing/getOrgSubscription";
 import { build } from "@server/build";
+import { db, customers, subscriptions } from "@server/db";
+import { eq, and, ne } from "drizzle-orm";
 
 export async function getOrgTierData(
     orgId: string
-): Promise<{ tier: string | null; active: boolean }> {
-    let tier = null;
+): Promise<{ tier: "home_lab" | "starter" | "scale" | null; active: boolean }> {
+    let tier: "home_lab" | "starter" | "scale" | null = null;
     let active = false;
 
     if (build !== "saas") {
         return { tier, active };
     }
 
-    const { subscription, items } = await getOrgSubscriptionData(orgId);
+    try {
+        // Get customer for org
+        const [customer] = await db
+            .select()
+            .from(customers)
+            .where(eq(customers.orgId, orgId))
+            .limit(1);
 
-    if (items && items.length > 0) {
-        const tierPriceSet = getTierPriceSet();
-        // Iterate through tiers in order (earlier keys are higher tiers)
-        for (const [tierId, priceId] of Object.entries(tierPriceSet)) {
-            // Check if any subscription item matches this tier's price ID
-            const matchingItem = items.find((item) => item.priceId === priceId);
-            if (matchingItem) {
-                tier = tierId;
-                break;
+        if (customer) {
+            // Query for active subscriptions that are not license type
+            const [subscription] = await db
+                .select()
+                .from(subscriptions)
+                .where(
+                    and(
+                        eq(subscriptions.customerId, customer.customerId),
+                        eq(subscriptions.status, "active"),
+                        ne(subscriptions.type, "license")
+                    )
+                )
+                .limit(1);
+
+            if (subscription) {
+                // Validate that subscription.type is one of the expected tier values
+                if (
+                    subscription.type === "home_lab" ||
+                    subscription.type === "starter" ||
+                    subscription.type === "scale"
+                ) {
+                    tier = subscription.type;
+                    active = true;
+                }
             }
         }
+    } catch (error) {
+        // If org not found or error occurs, return null tier and inactive
+        // This is acceptable behavior as per the function signature
     }
-    if (subscription && subscription.status === "active") {
-        active = true;
-    }
+
     return { tier, active };
 }

server/private/lib/certificates.ts

@@ -19,7 +19,6 @@ import * as fs from "fs";
 import logger from "@server/logger";
 import cache from "@server/lib/cache";
 
-let encryptionKeyPath = "";
 let encryptionKeyHex = "";
 let encryptionKey: Buffer;
 function loadEncryptData() {
@@ -27,15 +26,7 @@ function loadEncryptData() {
         return; // already loaded
     }
 
-    encryptionKeyPath = config.getRawPrivateConfig().server.encryption_key_path;
-
-    if (!fs.existsSync(encryptionKeyPath)) {
-        throw new Error(
-            "Encryption key file not found. Please generate one first."
-        );
-    }
-
-    encryptionKeyHex = fs.readFileSync(encryptionKeyPath, "utf8").trim();
+    encryptionKeyHex = config.getRawPrivateConfig().server.encryption_key;
     encryptionKey = Buffer.from(encryptionKeyHex, "hex");
 }
 

server/private/lib/checkOrgAccessPolicy.ts

@@ -13,8 +13,6 @@
 
 import { build } from "@server/build";
 import { db, Org, orgs, ResourceSession, sessions, users } from "@server/db";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import license from "#private/license/license";
 import { eq } from "drizzle-orm";
 import {

server/private/lib/config.ts

@@ -128,10 +128,7 @@ export class PrivateConfig {
         if (this.rawPrivateConfig.stripe?.s3Bucket) {
             process.env.S3_BUCKET = this.rawPrivateConfig.stripe.s3Bucket;
         }
-        if (this.rawPrivateConfig.stripe?.localFilePath) {
-            process.env.LOCAL_FILE_PATH =
-                this.rawPrivateConfig.stripe.localFilePath;
-        }
+
         if (this.rawPrivateConfig.stripe?.s3Region) {
             process.env.S3_REGION = this.rawPrivateConfig.stripe.s3Region;
         }

server/private/lib/isLicencedOrSubscribed.ts

@@ -14,7 +14,6 @@
 import { build } from "@server/build";
 import license from "#private/license/license";
 import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 
 export async function isLicensedOrSubscribed(orgId: string): Promise<boolean> {
     if (build === "enterprise") {
@@ -22,9 +21,9 @@ export async function isLicensedOrSubscribed(orgId: string): Promise<boolean> {
     }
 
     if (build === "saas") {
-        const { tier } = await getOrgTierData(orgId);
-        return tier === TierId.STANDARD;
+        const { tier, active } = await getOrgTierData(orgId);
+        return (tier == "home_lab" || tier == "starter" || tier == "scale") && active;
     }
 
     return false;
-}
+}

server/private/lib/isSubscribed.ts

@@ -0,0 +1,24 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { build } from "@server/build";
+import { getOrgTierData } from "#private/lib/billing";
+
+export async function isSubscribed(orgId: string): Promise<boolean> {
+    if (build === "saas") {
+        const { tier, active } = await getOrgTierData(orgId);
+        return (tier == "home_lab" || tier == "starter" || tier == "scale") && active;
+    }
+
+    return false;
+}

server/private/lib/readConfigFile.ts

@@ -17,6 +17,7 @@ import { privateConfigFilePath1 } from "@server/lib/consts";
 import { z } from "zod";
 import { colorsSchema } from "@server/lib/colorsSchema";
 import { build } from "@server/build";
+import { getEnvOrYaml } from "@server/lib/getEnvOrYaml";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
 
@@ -32,19 +33,29 @@ export const privateConfigSchema = z.object({
         }),
     server: z
         .object({
-            encryption_key_path: z
+            encryption_key: z
                 .string()
                 .optional()
-                .default("./config/encryption.pem")
-                .pipe(z.string().min(8)),
-            resend_api_key: z.string().optional(),
-            reo_client_id: z.string().optional(),
-            fossorial_api_key: z.string().optional()
+                .transform(getEnvOrYaml("SERVER_ENCRYPTION_KEY")),
+            resend_api_key: z
+                .string()
+                .optional()
+                .transform(getEnvOrYaml("RESEND_API_KEY")),
+            reo_client_id: z
+                .string()
+                .optional()
+                .transform(getEnvOrYaml("REO_CLIENT_ID")),
+            fossorial_api: z
+                .string()
+                .optional()
+                .default("https://api.fossorial.io"),
+            fossorial_api_key: z
+                .string()
+                .optional()
+                .transform(getEnvOrYaml("FOSSORIAL_API_KEY"))
         })
         .optional()
-        .default({
-            encryption_key_path: "./config/encryption.pem"
-        }),
+        .prefault({}),
     redis: z
         .object({
             host: z.string(),
@@ -157,11 +168,17 @@ export const privateConfigSchema = z.object({
         .optional(),
     stripe: z
         .object({
-            secret_key: z.string(),
-            webhook_secret: z.string(),
+            secret_key: z
+                .string()
+                .optional()
+                .transform(getEnvOrYaml("STRIPE_SECRET_KEY")),
+            webhook_secret: z
+                .string()
+                .optional()
+                .transform(getEnvOrYaml("STRIPE_WEBHOOK_SECRET")),
             s3Bucket: z.string(),
             s3Region: z.string().default("us-east-1"),
-            localFilePath: z.string()
+            localFilePath: z.string().optional()
         })
         .optional()
 });

server/private/license/license.ts

@@ -11,12 +11,12 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { db, HostMeta } from "@server/db";
+import { db, HostMeta, sites, users } from "@server/db";
 import { hostMeta, licenseKey } from "@server/db";
 import logger from "@server/logger";
 import NodeCache from "node-cache";
 import { validateJWT } from "./licenseJwt";
-import { eq } from "drizzle-orm";
+import { count, eq } from "drizzle-orm";
 import moment from "moment";
 import { encrypt, decrypt } from "@server/lib/crypto";
 import {
@@ -54,6 +54,7 @@ type TokenPayload = {
     type: LicenseKeyType;
     tier: LicenseKeyTier;
     quantity: number;
+    quantity_2: number;
     terminateAt: string; // ISO
     iat: number; // Issued at
 };
@@ -140,10 +141,20 @@ LQIDAQAB
             };
         }
 
+        // Count used sites and users for license comparison
+        const [siteCountRes] = await db
+            .select({ value: count() })
+            .from(sites);
+        const [userCountRes] = await db
+            .select({ value: count() })
+            .from(users);
+
         const status: LicenseStatus = {
             hostId: this.hostMeta.hostMetaId,
             isHostLicensed: true,
-            isLicenseValid: false
+            isLicenseValid: false,
+            usedSites: siteCountRes?.value ?? 0,
+            usedUsers: userCountRes?.value ?? 0
         };
 
         this.checkInProgress = true;
@@ -151,6 +162,8 @@ LQIDAQAB
         try {
             if (!this.doRecheck && this.statusCache.has(this.statusKey)) {
                 const res = this.statusCache.get("status") as LicenseStatus;
+                res.usedSites = status.usedSites;
+                res.usedUsers = status.usedUsers;
                 return res;
             }
             logger.debug("Checking license status...");
@@ -193,7 +206,9 @@ LQIDAQAB
                         type: payload.type,
                         tier: payload.tier,
                         iat: new Date(payload.iat * 1000),
-                        terminateAt: new Date(payload.terminateAt)
+                        terminateAt: new Date(payload.terminateAt),
+                        quantity: payload.quantity,
+                        quantity_2: payload.quantity_2
                     });
 
                     if (payload.type === "host") {
@@ -292,6 +307,8 @@ LQIDAQAB
                     cached.tier = payload.tier;
                     cached.iat = new Date(payload.iat * 1000);
                     cached.terminateAt = new Date(payload.terminateAt);
+                    cached.quantity = payload.quantity;
+                    cached.quantity_2 = payload.quantity_2;
 
                     // Encrypt the updated token before storing
                     const encryptedKey = encrypt(
@@ -317,7 +334,7 @@ LQIDAQAB
                 }
             }
 
-            // Compute host status
+            // Compute host status: quantity = users, quantity_2 = sites
             for (const key of keys) {
                 const cached = newCache.get(key.licenseKey)!;
 
@@ -329,6 +346,28 @@ LQIDAQAB
                 if (!cached.valid) {
                     continue;
                 }
+
+                // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
+                if (
+                    cached.quantity_2 !== undefined &&
+                    cached.quantity_2 >= 0
+                ) {
+                    status.maxSites =
+                        (status.maxSites ?? 0) + cached.quantity_2;
+                }
+                if (cached.quantity !== undefined && cached.quantity >= 0) {
+                    status.maxUsers = (status.maxUsers ?? 0) + cached.quantity;
+                }
+            }
+
+            // Invalidate license if over user or site limits
+            if (
+                (status.maxSites !== undefined &&
+                    (status.usedSites ?? 0) > status.maxSites) ||
+                (status.maxUsers !== undefined &&
+                    (status.usedUsers ?? 0) > status.maxUsers)
+            ) {
+                status.isLicenseValid = false;
             }
 
             // Invalidate old cache and set new cache
@@ -502,7 +541,7 @@ LQIDAQAB
                     // Calculate exponential backoff delay
                     const retryDelay = Math.floor(
                         initialRetryDelay *
-                            Math.pow(exponentialFactor, attempt - 1)
+                        Math.pow(exponentialFactor, attempt - 1)
                     );
 
                     logger.debug(

server/private/middlewares/verifySubscription.ts

@@ -38,9 +38,8 @@ export async function verifyValidSubscription(
             );
         }
 
-        const tier = await getOrgTierData(orgId);
-
-        if (!tier.active) {
+        const { tier, active  } = await getOrgTierData(orgId);
+        if ((tier == "home_lab" || tier == "starter" || tier == "scale") && active) {
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,

server/private/routers/approvals/listApprovals.ts

@@ -19,8 +19,6 @@ import { fromError } from "zod-validation-error";
 
 import type { Request, Response, NextFunction } from "express";
 import { build } from "@server/build";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import {
     approvals,
     clients,
@@ -221,19 +219,6 @@ export async function listApprovals(
 
         const { orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         const approvalsList = await queryApprovals(
             orgId.toString(),
             limit,

server/private/routers/approvals/processPendingApproval.ts

@@ -17,10 +17,7 @@ import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 
-import { build } from "@server/build";
 import { approvals, clients, db, orgs, type Approval } from "@server/db";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import response from "@server/lib/response";
 import { and, eq, type InferInsertModel } from "drizzle-orm";
 import type { NextFunction, Request, Response } from "express";
@@ -64,20 +61,6 @@ export async function processPendingApproval(
         }
 
         const { orgId, approvalId } = parsedParams.data;
-
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         const updateData = parsedBody.data;
 
         const approval = await db

server/private/routers/auth/index.ts

@@ -13,4 +13,3 @@
 
 export * from "./transferSession";
 export * from "./getSessionTransferToken";
-export * from "./quickStart";

server/private/routers/auth/quickStart.ts

@@ -1,585 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { NextFunction, Request, Response } from "express";
-import {
-    account,
-    db,
-    domainNamespaces,
-    domains,
-    exitNodes,
-    newts,
-    newtSessions,
-    orgs,
-    passwordResetTokens,
-    Resource,
-    resourcePassword,
-    resourcePincode,
-    resources,
-    resourceWhitelist,
-    roleResources,
-    roles,
-    roleSites,
-    sites,
-    targetHealthCheck,
-    targets,
-    userResources,
-    userSites
-} from "@server/db";
-import HttpCode from "@server/types/HttpCode";
-import { z } from "zod";
-import { users } from "@server/db";
-import { fromError } from "zod-validation-error";
-import createHttpError from "http-errors";
-import response from "@server/lib/response";
-import { SqliteError } from "better-sqlite3";
-import { eq, and, sql } from "drizzle-orm";
-import moment from "moment";
-import { generateId } from "@server/auth/sessions/app";
-import config from "@server/lib/config";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { UserType } from "@server/types/UserTypes";
-import { createUserAccountOrg } from "@server/lib/createUserAccountOrg";
-import { sendEmail } from "@server/emails";
-import WelcomeQuickStart from "@server/emails/templates/WelcomeQuickStart";
-import { alphabet, generateRandomString } from "oslo/crypto";
-import { createDate, TimeSpan } from "oslo";
-import { getUniqueResourceName, getUniqueSiteName } from "@server/db/names";
-import { pickPort } from "@server/routers/target/helpers";
-import { addTargets } from "@server/routers/newt/targets";
-import { isTargetValid } from "@server/lib/validators";
-import { listExitNodes } from "#private/lib/exitNodes";
-
-const bodySchema = z.object({
-    email: z.email().toLowerCase(),
-    ip: z.string().refine(isTargetValid),
-    method: z.enum(["http", "https"]),
-    port: z.int().min(1).max(65535),
-    pincode: z
-        .string()
-        .regex(/^\d{6}$/)
-        .optional(),
-    password: z.string().min(4).max(100).optional(),
-    enableWhitelist: z.boolean().optional().default(true),
-    animalId: z.string() // This is actually the secret key for the backend
-});
-
-export type QuickStartBody = z.infer<typeof bodySchema>;
-
-export type QuickStartResponse = {
-    newtId: string;
-    newtSecret: string;
-    resourceUrl: string;
-    completeSignUpLink: string;
-};
-
-const DEMO_UBO_KEY = "b460293f-347c-4b30-837d-4e06a04d5a22";
-
-export async function quickStart(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    const parsedBody = bodySchema.safeParse(req.body);
-
-    if (!parsedBody.success) {
-        return next(
-            createHttpError(
-                HttpCode.BAD_REQUEST,
-                fromError(parsedBody.error).toString()
-            )
-        );
-    }
-
-    const {
-        email,
-        ip,
-        method,
-        port,
-        pincode,
-        password,
-        enableWhitelist,
-        animalId
-    } = parsedBody.data;
-
-    try {
-        const tokenValidation = validateTokenOnApi(animalId);
-
-        if (!tokenValidation.isValid) {
-            logger.warn(
-                `Quick start failed for ${email} token ${animalId}: ${tokenValidation.message}`
-            );
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Invalid or expired token"
-                )
-            );
-        }
-
-        if (animalId === DEMO_UBO_KEY) {
-            if (email !== "mehrdad@getubo.com") {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid email for demo Ubo key"
-                    )
-                );
-            }
-
-            const [existing] = await db
-                .select()
-                .from(users)
-                .where(
-                    and(
-                        eq(users.email, email),
-                        eq(users.type, UserType.Internal)
-                    )
-                );
-
-            if (existing) {
-                // delete the user if it already exists
-                await db.delete(users).where(eq(users.userId, existing.userId));
-                const orgId = `org_${existing.userId}`;
-                await db.delete(orgs).where(eq(orgs.orgId, orgId));
-            }
-        }
-
-        const tempPassword = generateId(15);
-        const passwordHash = await hashPassword(tempPassword);
-        const userId = generateId(15);
-
-        // TODO: see if that user already exists?
-
-        // Create the sandbox user
-        const existing = await db
-            .select()
-            .from(users)
-            .where(
-                and(eq(users.email, email), eq(users.type, UserType.Internal))
-            );
-
-        if (existing && existing.length > 0) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "A user with that email address already exists"
-                )
-            );
-        }
-
-        let newtId: string;
-        let secret: string;
-        let fullDomain: string;
-        let resource: Resource;
-        let completeSignUpLink: string;
-
-        await db.transaction(async (trx) => {
-            await trx.insert(users).values({
-                userId: userId,
-                type: UserType.Internal,
-                username: email,
-                email: email,
-                passwordHash,
-                dateCreated: moment().toISOString()
-            });
-
-            // create user"s account
-            await trx.insert(account).values({
-                userId
-            });
-        });
-
-        const { success, error, org } = await createUserAccountOrg(
-            userId,
-            email
-        );
-        if (!success) {
-            if (error) {
-                throw new Error(error);
-            }
-            throw new Error("Failed to create user account and organization");
-        }
-        if (!org) {
-            throw new Error("Failed to create user account and organization");
-        }
-
-        const orgId = org.orgId;
-
-        await db.transaction(async (trx) => {
-            const token = generateRandomString(
-                8,
-                alphabet("0-9", "A-Z", "a-z")
-            );
-
-            await trx
-                .delete(passwordResetTokens)
-                .where(eq(passwordResetTokens.userId, userId));
-
-            const tokenHash = await hashPassword(token);
-
-            await trx.insert(passwordResetTokens).values({
-                userId: userId,
-                email: email,
-                tokenHash,
-                expiresAt: createDate(new TimeSpan(7, "d")).getTime()
-            });
-
-            // // Create the sandbox newt
-            // const newClientAddress = await getNextAvailableClientSubnet(orgId);
-            // if (!newClientAddress) {
-            //     throw new Error("No available subnet found");
-            // }
-
-            // const clientAddress = newClientAddress.split("/")[0];
-
-            newtId = generateId(15);
-            secret = generateId(48);
-
-            // Create the sandbox site
-            const siteNiceId = await getUniqueSiteName(orgId);
-            const siteName = `First Site`;
-
-            // pick a random exit node
-            const exitNodesList = await listExitNodes(orgId);
-
-            // select a random exit node
-            const randomExitNode =
-                exitNodesList[Math.floor(Math.random() * exitNodesList.length)];
-
-            if (!randomExitNode) {
-                throw new Error("No exit nodes available");
-            }
-
-            const [newSite] = await trx
-                .insert(sites)
-                .values({
-                    orgId,
-                    exitNodeId: randomExitNode.exitNodeId,
-                    name: siteName,
-                    niceId: siteNiceId,
-                    // address: clientAddress,
-                    type: "newt",
-                    dockerSocketEnabled: true
-                })
-                .returning();
-
-            const siteId = newSite.siteId;
-
-            const adminRole = await trx
-                .select()
-                .from(roles)
-                .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-                .limit(1);
-
-            if (adminRole.length === 0) {
-                throw new Error("Admin role not found");
-            }
-
-            await trx.insert(roleSites).values({
-                roleId: adminRole[0].roleId,
-                siteId: newSite.siteId
-            });
-
-            if (req.user && req.userOrgRoleId != adminRole[0].roleId) {
-                // make sure the user can access the site
-                await trx.insert(userSites).values({
-                    userId: req.user?.userId!,
-                    siteId: newSite.siteId
-                });
-            }
-
-            // add the peer to the exit node
-            const secretHash = await hashPassword(secret!);
-
-            await trx.insert(newts).values({
-                newtId: newtId!,
-                secretHash,
-                siteId: newSite.siteId,
-                dateCreated: moment().toISOString()
-            });
-
-            const [randomNamespace] = await trx
-                .select()
-                .from(domainNamespaces)
-                .orderBy(sql`RANDOM()`)
-                .limit(1);
-
-            if (!randomNamespace) {
-                throw new Error("No domain namespace available");
-            }
-
-            const [randomNamespaceDomain] = await trx
-                .select()
-                .from(domains)
-                .where(eq(domains.domainId, randomNamespace.domainId))
-                .limit(1);
-
-            if (!randomNamespaceDomain) {
-                throw new Error("No domain found for the namespace");
-            }
-
-            const resourceNiceId = await getUniqueResourceName(orgId);
-
-            // Create sandbox resource
-            const subdomain = `${resourceNiceId}-${generateId(5)}`;
-            fullDomain = `${subdomain}.${randomNamespaceDomain.baseDomain}`;
-
-            const resourceName = `First Resource`;
-
-            const newResource = await trx
-                .insert(resources)
-                .values({
-                    niceId: resourceNiceId,
-                    fullDomain,
-                    domainId: randomNamespaceDomain.domainId,
-                    orgId,
-                    name: resourceName,
-                    subdomain,
-                    http: true,
-                    protocol: "tcp",
-                    ssl: true,
-                    sso: false,
-                    emailWhitelistEnabled: enableWhitelist
-                })
-                .returning();
-
-            await trx.insert(roleResources).values({
-                roleId: adminRole[0].roleId,
-                resourceId: newResource[0].resourceId
-            });
-
-            if (req.user && req.userOrgRoleId != adminRole[0].roleId) {
-                // make sure the user can access the resource
-                await trx.insert(userResources).values({
-                    userId: req.user?.userId!,
-                    resourceId: newResource[0].resourceId
-                });
-            }
-
-            resource = newResource[0];
-
-            // Create the sandbox target
-            const { internalPort, targetIps } = await pickPort(siteId!, trx);
-
-            if (!internalPort) {
-                throw new Error("No available internal port");
-            }
-
-            const newTarget = await trx
-                .insert(targets)
-                .values({
-                    resourceId: resource.resourceId,
-                    siteId: siteId!,
-                    internalPort,
-                    ip,
-                    method,
-                    port,
-                    enabled: true
-                })
-                .returning();
-
-            const newHealthcheck = await trx
-                .insert(targetHealthCheck)
-                .values({
-                    targetId: newTarget[0].targetId,
-                    hcEnabled: false
-                })
-                .returning();
-
-            // add the new target to the targetIps array
-            targetIps.push(`${ip}/32`);
-
-            const [newt] = await trx
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, siteId!))
-                .limit(1);
-
-            await addTargets(
-                newt.newtId,
-                newTarget,
-                newHealthcheck,
-                resource.protocol
-            );
-
-            // Set resource pincode if provided
-            if (pincode) {
-                await trx
-                    .delete(resourcePincode)
-                    .where(
-                        eq(resourcePincode.resourceId, resource!.resourceId)
-                    );
-
-                const pincodeHash = await hashPassword(pincode);
-
-                await trx.insert(resourcePincode).values({
-                    resourceId: resource!.resourceId,
-                    pincodeHash,
-                    digitLength: 6
-                });
-            }
-
-            // Set resource password if provided
-            if (password) {
-                await trx
-                    .delete(resourcePassword)
-                    .where(
-                        eq(resourcePassword.resourceId, resource!.resourceId)
-                    );
-
-                const passwordHash = await hashPassword(password);
-
-                await trx.insert(resourcePassword).values({
-                    resourceId: resource!.resourceId,
-                    passwordHash
-                });
-            }
-
-            // Set resource OTP if whitelist is enabled
-            if (enableWhitelist) {
-                await trx.insert(resourceWhitelist).values({
-                    email,
-                    resourceId: resource!.resourceId
-                });
-            }
-
-            completeSignUpLink = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?quickstart=true&email=${email}&token=${token}`;
-
-            // Store token for email outside transaction
-            await sendEmail(
-                WelcomeQuickStart({
-                    username: email,
-                    link: completeSignUpLink,
-                    fallbackLink: `${config.getRawConfig().app.dashboard_url}/auth/reset-password?quickstart=true&email=${email}`,
-                    resourceMethod: method,
-                    resourceHostname: ip,
-                    resourcePort: port,
-                    resourceUrl: `https://${fullDomain}`,
-                    cliCommand: `newt --id ${newtId} --secret ${secret}`
-                }),
-                {
-                    to: email,
-                    from: config.getNoReplyEmail(),
-                    subject: `Access your Pangolin dashboard and resources`
-                }
-            );
-        });
-
-        return response<QuickStartResponse>(res, {
-            data: {
-                newtId: newtId!,
-                newtSecret: secret!,
-                resourceUrl: `https://${fullDomain!}`,
-                completeSignUpLink: completeSignUpLink!
-            },
-            success: true,
-            error: false,
-            message: "Quick start completed successfully",
-            status: HttpCode.OK
-        });
-    } catch (e) {
-        if (e instanceof SqliteError && e.code === "SQLITE_CONSTRAINT_UNIQUE") {
-            if (config.getRawConfig().app.log_failed_attempts) {
-                logger.info(
-                    `Account already exists with that email. Email: ${email}. IP: ${req.ip}.`
-                );
-            }
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "A user with that email address already exists"
-                )
-            );
-        } else {
-            logger.error(e);
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Failed to do quick start"
-                )
-            );
-        }
-    }
-}
-
-const BACKEND_SECRET_KEY = "4f9b6000-5d1a-11f0-9de7-ff2cc032f501";
-
-/**
- * Validates a token received from the frontend.
- * @param {string} token The validation token from the request.
- * @returns {{ isValid: boolean; message: string }} An object indicating if the token is valid.
- */
-const validateTokenOnApi = (
-    token: string
-): { isValid: boolean; message: string } => {
-    if (token === DEMO_UBO_KEY) {
-        // Special case for demo UBO key
-        return { isValid: true, message: "Demo UBO key is valid." };
-    }
-
-    if (!token) {
-        return { isValid: false, message: "Error: No token provided." };
-    }
-
-    try {
-        // 1. Decode the base64 string
-        const decodedB64 = atob(token);
-
-        // 2. Reverse the character code manipulation
-        const deobfuscated = decodedB64
-            .split("")
-            .map((char) => String.fromCharCode(char.charCodeAt(0) - 5)) // Reverse the shift
-            .join("");
-
-        // 3. Split the data to get the original secret and timestamp
-        const parts = deobfuscated.split("|");
-        if (parts.length !== 2) {
-            throw new Error("Invalid token format.");
-        }
-        const receivedKey = parts[0];
-        const tokenTimestamp = parseInt(parts[1], 10);
-
-        // 4. Check if the secret key matches
-        if (receivedKey !== BACKEND_SECRET_KEY) {
-            return { isValid: false, message: "Invalid token: Key mismatch." };
-        }
-
-        // 5. Check if the timestamp is recent (e.g., within 30 seconds) to prevent replay attacks
-        const now = Date.now();
-        const timeDifference = now - tokenTimestamp;
-
-        if (timeDifference > 30000) {
-            // 30 seconds
-            return { isValid: false, message: "Invalid token: Expired." };
-        }
-
-        if (timeDifference < 0) {
-            // Timestamp is in the future
-            return {
-                isValid: false,
-                message: "Invalid token: Timestamp is in the future."
-            };
-        }
-
-        // If all checks pass, the token is valid
-        return { isValid: true, message: "Token is valid!" };
-    } catch (error) {
-        // This will catch errors from atob (if not valid base64) or other issues.
-        return {
-            isValid: false,
-            message: `Error: ${(error as Error).message}`
-        };
-    }
-};

server/private/routers/billing/changeTier.ts

@@ -0,0 +1,263 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { customers, db, subscriptions, subscriptionItems } from "@server/db";
+import { eq, and, or } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import stripe from "#private/lib/stripe";
+import {
+    getHomeLabFeaturePriceSet,
+    getScaleFeaturePriceSet,
+    getStarterFeaturePriceSet,
+    getLineItems,
+    FeatureId,
+    type FeaturePriceSet
+} from "@server/lib/billing";
+
+const changeTierSchema = z.strictObject({
+    orgId: z.string()
+});
+
+const changeTierBodySchema = z.strictObject({
+    tier: z.enum(["home_lab", "starter", "scale"])
+});
+
+export async function changeTier(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = changeTierSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = changeTierBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { tier } = parsedBody.data;
+
+        // Get the customer for this org
+        const [customer] = await db
+            .select()
+            .from(customers)
+            .where(eq(customers.orgId, orgId))
+            .limit(1);
+
+        if (!customer) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "No customer found for this organization"
+                )
+            );
+        }
+
+        // Get the active subscription for this customer
+        const [subscription] = await db
+            .select()
+            .from(subscriptions)
+            .where(
+                and(
+                    eq(subscriptions.customerId, customer.customerId),
+                    eq(subscriptions.status, "active"),
+                    or(
+                        eq(subscriptions.type, "home_lab"),
+                        eq(subscriptions.type, "starter"),
+                        eq(subscriptions.type, "scale")
+                    )
+                )
+            )
+            .limit(1);
+
+        if (!subscription) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "No active subscription found for this organization"
+                )
+            );
+        }
+
+        // Get the target tier's price set
+        let targetPriceSet: FeaturePriceSet;
+        if (tier === "home_lab") {
+            targetPriceSet = getHomeLabFeaturePriceSet();
+        } else if (tier === "starter") {
+            targetPriceSet = getStarterFeaturePriceSet();
+        } else if (tier === "scale") {
+            targetPriceSet = getScaleFeaturePriceSet();
+        } else {
+            return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid tier"));
+        }
+
+        // Get current subscription items from our database
+        const currentItems = await db
+            .select()
+            .from(subscriptionItems)
+            .where(
+                eq(
+                    subscriptionItems.subscriptionId,
+                    subscription.subscriptionId
+                )
+            );
+
+        if (currentItems.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "No subscription items found"
+                )
+            );
+        }
+
+        // Retrieve the full subscription from Stripe to get item IDs
+        const stripeSubscription = await stripe!.subscriptions.retrieve(
+            subscription.subscriptionId
+        );
+
+        // Determine if we're switching between different products
+        // home_lab uses HOME_LAB product, starter/scale use USERS product
+        const currentTier = subscription.type;
+        const switchingProducts =
+            (currentTier === "home_lab" && (tier === "starter" || tier === "scale")) ||
+            ((currentTier === "starter" || currentTier === "scale") && tier === "home_lab");
+
+        let updatedSubscription;
+
+        if (switchingProducts) {
+            // When switching between different products, we need to:
+            // 1. Delete old subscription items
+            // 2. Add new subscription items
+            logger.info(
+                `Switching products from ${currentTier} to ${tier} for subscription ${subscription.subscriptionId}`
+            );
+
+            // Build array to delete all existing items and add new ones
+            const itemsToUpdate: any[] = [];
+
+            // Mark all existing items for deletion
+            for (const stripeItem of stripeSubscription.items.data) {
+                itemsToUpdate.push({
+                    id: stripeItem.id,
+                    deleted: true
+                });
+            }
+
+            // Add new items for the target tier
+            const newLineItems = await getLineItems(targetPriceSet, orgId);
+            for (const lineItem of newLineItems) {
+                itemsToUpdate.push(lineItem);
+            }
+
+            updatedSubscription = await stripe!.subscriptions.update(
+                subscription.subscriptionId,
+                {
+                    items: itemsToUpdate,
+                    proration_behavior: "create_prorations"
+                }
+            );
+        } else {
+            // Same product, different price tier (starter <-> scale)
+            // We can simply update the price
+            logger.info(
+                `Updating price from ${currentTier} to ${tier} for subscription ${subscription.subscriptionId}`
+            );
+
+            const itemsToUpdate = stripeSubscription.items.data.map(
+                (stripeItem) => {
+                    // Find the corresponding item in our database
+                    const dbItem = currentItems.find(
+                        (item) => item.priceId === stripeItem.price.id
+                    );
+
+                    if (!dbItem) {
+                        // Keep the existing item unchanged if we can't find it
+                        return {
+                            id: stripeItem.id,
+                            price: stripeItem.price.id
+                        };
+                    }
+
+                    // Map to the corresponding feature in the new tier
+                    const newPriceId = targetPriceSet[FeatureId.USERS];
+
+                    if (newPriceId) {
+                        return {
+                            id: stripeItem.id,
+                            price: newPriceId
+                        };
+                    }
+
+                    // If no mapping found, keep existing
+                    return {
+                        id: stripeItem.id,
+                        price: stripeItem.price.id
+                    };
+                }
+            );
+
+            updatedSubscription = await stripe!.subscriptions.update(
+                subscription.subscriptionId,
+                {
+                    items: itemsToUpdate,
+                    proration_behavior: "create_prorations"
+                }
+            );
+        }
+
+        logger.info(
+            `Successfully changed tier to ${tier} for org ${orgId}, subscription ${subscription.subscriptionId}`
+        );
+
+        return response<{ subscriptionId: string; newTier: string }>(res, {
+            data: {
+                subscriptionId: updatedSubscription.id,
+                newTier: tier
+            },
+            success: true,
+            error: false,
+            message: "Tier change successful",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error("Error changing tier:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while changing tier"
+            )
+        );
+    }
+}

server/private/routers/billing/createCheckoutSession.ts

@@ -22,13 +22,18 @@ import logger from "@server/logger";
 import config from "@server/lib/config";
 import { fromError } from "zod-validation-error";
 import stripe from "#private/lib/stripe";
-import { getLineItems, getStandardFeaturePriceSet } from "@server/lib/billing";
-import { getTierPriceSet, TierId } from "@server/lib/billing/tiers";
+import { getHomeLabFeaturePriceSet, getLineItems, getScaleFeaturePriceSet, getStarterFeaturePriceSet } from "@server/lib/billing";
+import { usageService } from "@server/lib/billing/usageService";
+import Stripe from "stripe";
 
 const createCheckoutSessionSchema = z.strictObject({
     orgId: z.string()
 });
 
+const createCheckoutSessionBodySchema = z.strictObject({
+    tier: z.enum(["home_lab", "starter", "scale"]),
+});
+
 export async function createCheckoutSession(
     req: Request,
     res: Response,
@@ -47,6 +52,18 @@ export async function createCheckoutSession(
 
         const { orgId } = parsedParams.data;
 
+        const parsedBody = createCheckoutSessionBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { tier } = parsedBody.data;
+
         // check if we already have a customer for this org
         const [customer] = await db
             .select()
@@ -65,18 +82,25 @@ export async function createCheckoutSession(
             );
         }
 
-        const standardTierPrice = getTierPriceSet()[TierId.STANDARD];
+        let lineItems: Stripe.Checkout.SessionCreateParams.LineItem[];
+        if (tier === "home_lab") {
+            lineItems = await getLineItems(getHomeLabFeaturePriceSet(), orgId);
+        } else if (tier === "starter") {
+            lineItems = await getLineItems(getStarterFeaturePriceSet(), orgId);
+        } else if (tier === "scale") {
+            lineItems = await getLineItems(getScaleFeaturePriceSet(), orgId);
+        } else {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid plan")
+            );
+        }
+
+        logger.debug(`Line items: ${JSON.stringify(lineItems)}`)
 
         const session = await stripe!.checkout.sessions.create({
             client_reference_id: orgId, // So we can look it up the org later on the webhook
             billing_address_collection: "required",
-            line_items: [
-                {
-                    price: standardTierPrice, // Use the standard tier
-                    quantity: 1
-                },
-                ...getLineItems(getStandardFeaturePriceSet())
-            ], // Start with the standard feature set that matches the free limits
+            line_items: lineItems,
             customer: customer.customerId,
             mode: "subscription",
             success_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/billing?success=true&session_id={CHECKOUT_SESSION_ID}`,
@@ -87,7 +111,7 @@ export async function createCheckoutSession(
             data: session.url,
             success: true,
             error: false,
-            message: "Organization created successfully",
+            message: "Checkout session created successfully",
             status: HttpCode.CREATED
         });
     } catch (error) {

server/private/routers/billing/getOrgSubscriptions.ts

@@ -37,18 +37,7 @@ const getOrgSchema = z.strictObject({
     orgId: z.string()
 });
 
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/billing/subscription",
-    description: "Get an organization",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: getOrgSchema
-    },
-    responses: {}
-});
-
-export async function getOrgSubscription(
+export async function getOrgSubscriptions(
     req: Request,
     res: Response,
     next: NextFunction
@@ -66,12 +55,9 @@ export async function getOrgSubscription(
 
         const { orgId } = parsedParams.data;
 
-        let subscriptionData = null;
-        let itemsData: SubscriptionItem[] = [];
+        let subscriptions = null;
         try {
-            const { subscription, items } = await getOrgSubscriptionData(orgId);
-            subscriptionData = subscription;
-            itemsData = items;
+            subscriptions = await getOrgSubscriptionsData(orgId);
         } catch (err) {
             if ((err as Error).message === "Not found") {
                 return next(
@@ -86,8 +72,7 @@ export async function getOrgSubscription(
 
         return response<GetOrgSubscriptionResponse>(res, {
             data: {
-                subscription: subscriptionData,
-                items: itemsData
+                subscriptions
             },
             success: true,
             error: false,
@@ -102,9 +87,9 @@ export async function getOrgSubscription(
     }
 }
 
-export async function getOrgSubscriptionData(
+export async function getOrgSubscriptionsData(
     orgId: string
-): Promise<{ subscription: Subscription | null; items: SubscriptionItem[] }> {
+): Promise<Array<{ subscription: Subscription; items: SubscriptionItem[] }>> {
     const org = await db
         .select()
         .from(orgs)
@@ -122,21 +107,21 @@ export async function getOrgSubscriptionData(
         .where(eq(customers.orgId, orgId))
         .limit(1);
 
-    let subscription = null;
-    let items: SubscriptionItem[] = [];
+    const subscriptionsWithItems: Array<{
+        subscription: Subscription;
+        items: SubscriptionItem[];
+    }> = [];
 
     if (customer.length > 0) {
-        // Get subscription for customer
+        // Get all subscriptions for customer
         const subs = await db
             .select()
             .from(subscriptions)
-            .where(eq(subscriptions.customerId, customer[0].customerId))
-            .limit(1);
+            .where(eq(subscriptions.customerId, customer[0].customerId));
 
-        if (subs.length > 0) {
-            subscription = subs[0];
-            // Get subscription items
-            items = await db
+        for (const subscription of subs) {
+            // Get subscription items for each subscription
+            const items = await db
                 .select()
                 .from(subscriptionItems)
                 .where(
@@ -145,8 +130,13 @@ export async function getOrgSubscriptionData(
                         subscription.subscriptionId
                     )
                 );
+
+            subscriptionsWithItems.push({
+                subscription,
+                items
+            });
         }
     }
 
-    return { subscription, items };
+    return subscriptionsWithItems;
 }

server/private/routers/billing/getOrgUsage.ts

@@ -78,9 +78,9 @@ export async function getOrgUsage(
         // Get usage for org
         const usageData = [];
 
-        const siteUptime = await usageService.getUsage(
+        const sites = await usageService.getUsage(
             orgId,
-            FeatureId.SITE_UPTIME
+            FeatureId.SITES
         );
         const users = await usageService.getUsageDaily(orgId, FeatureId.USERS);
         const domains = await usageService.getUsageDaily(
@@ -96,8 +96,8 @@ export async function getOrgUsage(
             FeatureId.EGRESS_DATA_MB
         );
 
-        if (siteUptime) {
-            usageData.push(siteUptime);
+        if (sites) {
+            usageData.push(sites);
         }
         if (users) {
             usageData.push(users);

server/private/routers/billing/hooks/getSubType.ts

@@ -0,0 +1,61 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import {
+    getLicensePriceSet,
+} from "@server/lib/billing/licenses";
+import {
+    getHomeLabFeaturePriceSet,
+    getStarterFeaturePriceSet,
+    getScaleFeaturePriceSet,
+} from "@server/lib/billing/features";
+import Stripe from "stripe";
+
+export type SubscriptionType = "home_lab" | "starter" | "scale" | "license";
+
+export function getSubType(fullSubscription: Stripe.Response<Stripe.Subscription>): SubscriptionType | null {
+    // Determine subscription type by checking subscription items
+    if (!Array.isArray(fullSubscription.items?.data) || fullSubscription.items.data.length === 0) {
+        return null;
+    }
+
+    for (const item of fullSubscription.items.data) {
+        const priceId = item.price.id;
+
+        // Check if price ID matches any license price
+        const licensePrices = Object.values(getLicensePriceSet());
+        if (licensePrices.includes(priceId)) {
+            return "license";
+        }
+
+        // Check if price ID matches home lab tier
+        const homeLabPrices = Object.values(getHomeLabFeaturePriceSet());
+        if (homeLabPrices.includes(priceId)) {
+            return "home_lab";
+        }
+
+        // Check if price ID matches starter tier
+        const starterPrices = Object.values(getStarterFeaturePriceSet());
+        if (starterPrices.includes(priceId)) {
+            return "starter";
+        }
+
+        // Check if price ID matches scale tier
+        const scalePrices = Object.values(getScaleFeaturePriceSet());
+        if (scalePrices.includes(priceId)) {
+            return "scale";
+        }
+    }
+
+    return null;
+}

server/private/routers/billing/hooks/handleSubscriptionCreated.ts

@@ -25,6 +25,12 @@ import logger from "@server/logger";
 import stripe from "#private/lib/stripe";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
 import { AudienceIds, moveEmailToAudience } from "#private/lib/resend";
+import { getSubType } from "./getSubType";
+import privateConfig from "#private/lib/config";
+import { getLicensePriceSet, LicenseId } from "@server/lib/billing/licenses";
+import { sendEmail } from "@server/emails";
+import EnterpriseEditionKeyGenerated from "@server/emails/templates/EnterpriseEditionKeyGenerated";
+import config from "@server/lib/config";
 
 export async function handleSubscriptionCreated(
     subscription: Stripe.Subscription
@@ -53,6 +59,8 @@ export async function handleSubscriptionCreated(
             return;
         }
 
+        const type = getSubType(fullSubscription);
+
         const newSubscription = {
             subscriptionId: subscription.id,
             customerId: subscription.customer as string,
@@ -60,7 +68,8 @@ export async function handleSubscriptionCreated(
             canceledAt: subscription.canceled_at
                 ? subscription.canceled_at
                 : null,
-            createdAt: subscription.created
+            createdAt: subscription.created,
+            type: type
         };
 
         await db.insert(subscriptions).values(newSubscription);
@@ -123,24 +132,142 @@ export async function handleSubscriptionCreated(
             return;
         }
 
-        await handleSubscriptionLifesycle(customer.orgId, subscription.status);
+        if (type === "home_lab" || type === "starter" || type === "scale") {
+            logger.debug(
+                `Handling SAAS subscription lifecycle for org ${customer.orgId} with type ${type}`
+            );
+            // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
+            await handleSubscriptionLifesycle(
+                customer.orgId,
+                subscription.status,
+                type
+            );
 
-        const [orgUserRes] = await db
-            .select()
-            .from(userOrgs)
-            .where(
-                and(
-                    eq(userOrgs.orgId, customer.orgId),
-                    eq(userOrgs.isOwner, true)
+            const [orgUserRes] = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(
+                        eq(userOrgs.orgId, customer.orgId),
+                        eq(userOrgs.isOwner, true)
+                    )
                 )
-            )
-            .innerJoin(users, eq(userOrgs.userId, users.userId));
+                .innerJoin(users, eq(userOrgs.userId, users.userId));
 
-        if (orgUserRes) {
-            const email = orgUserRes.user.email;
+            if (orgUserRes) {
+                const email = orgUserRes.user.email;
 
-            if (email) {
-                moveEmailToAudience(email, AudienceIds.Subscribed);
+                if (email) {
+                    moveEmailToAudience(email, AudienceIds.Subscribed);
+                }
+            }
+        } else if (type === "license") {
+            logger.debug(
+                `License subscription created for org ${customer.orgId}, no lifecycle handling needed.`
+            );
+
+            // Retrieve the client_reference_id from the checkout session
+            let licenseId: string | null = null;
+
+            try {
+                const sessions = await stripe!.checkout.sessions.list({
+                    subscription: subscription.id,
+                    limit: 1
+                });
+                if (sessions.data.length > 0) {
+                    licenseId = sessions.data[0].client_reference_id || null;
+                }
+
+                if (!licenseId) {
+                    logger.error(
+                        `No client_reference_id found for subscription ${subscription.id}`
+                    );
+                    return;
+                }
+
+                logger.debug(
+                    `Retrieved licenseId ${licenseId} from checkout session for subscription ${subscription.id}`
+                );
+
+                // Determine users and sites based on license type
+                const priceSet = getLicensePriceSet();
+                const subscriptionPriceId =
+                    fullSubscription.items.data[0]?.price.id;
+
+                let numUsers: number;
+                let numSites: number;
+
+                if (subscriptionPriceId === priceSet[LicenseId.SMALL_LICENSE]) {
+                    numUsers = 25;
+                    numSites = 25;
+                } else if (
+                    subscriptionPriceId === priceSet[LicenseId.BIG_LICENSE]
+                ) {
+                    numUsers = 50;
+                    numSites = 50;
+                } else {
+                    logger.error(
+                        `Unknown price ID ${subscriptionPriceId} for subscription ${subscription.id}`
+                    );
+                    return;
+                }
+
+                logger.debug(
+                    `License type determined: ${numUsers} users, ${numSites} sites for subscription ${subscription.id}`
+                );
+
+                const response = await fetch(
+                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/paid-for`,
+                    {
+                        method: "POST",
+                        headers: {
+                            "api-key":
+                                privateConfig.getRawPrivateConfig().server
+                                    .fossorial_api_key!,
+                            "Content-Type": "application/json"
+                        },
+                        body: JSON.stringify({
+                            licenseId: parseInt(licenseId),
+                            paidFor: true,
+                            users: numUsers,
+                            sites: numSites
+                        })
+                    }
+                );
+
+                const data = await response.json();
+
+                logger.debug(`Fossorial API response: ${JSON.stringify(data)}`);
+
+                if (customer.email) {
+                    logger.debug(
+                        `Sending license key email to ${customer.email} for subscription ${subscription.id}`
+                    );
+                    await sendEmail(
+                        EnterpriseEditionKeyGenerated({
+                            keyValue: data.data.licenseKey,
+                            personalUseOnly: false,
+                            users: numUsers,
+                            sites: numSites,
+                            modifySubscriptionLink: `${config.getRawConfig().app.dashboard_url}/${customer.orgId}/settings/billing`
+                        }),
+                        {
+                            to: customer.email,
+                            from: config.getNoReplyEmail(),
+                            subject:
+                                "Your Enterprise Edition license key is ready"
+                        }
+                    );
+                } else {
+                    logger.error(
+                        `No email found for customer ${customer.customerId} to send license key.`
+                    );
+                }
+
+                return data;
+            } catch (error) {
+                console.error("Error creating new license:", error);
+                throw error;
             }
         }
     } catch (error) {

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -24,11 +24,22 @@ import { eq, and } from "drizzle-orm";
 import logger from "@server/logger";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
 import { AudienceIds, moveEmailToAudience } from "#private/lib/resend";
+import { getSubType } from "./getSubType";
+import stripe from "#private/lib/stripe";
+import privateConfig from "#private/lib/config";
 
 export async function handleSubscriptionDeleted(
     subscription: Stripe.Subscription
 ): Promise<void> {
     try {
+        // Fetch the subscription from Stripe with expanded price.tiers
+        const fullSubscription = await stripe!.subscriptions.retrieve(
+            subscription.id,
+            {
+                expand: ["items.data.price.tiers"]
+            }
+        );
+
         const [existingSubscription] = await db
             .select()
             .from(subscriptions)
@@ -64,24 +75,63 @@ export async function handleSubscriptionDeleted(
             return;
         }
 
-        await handleSubscriptionLifesycle(customer.orgId, subscription.status);
+        const type = getSubType(fullSubscription);
+        if (type == "home_lab" || type == "starter" || type == "scale") {
+            logger.debug(
+                `Handling SaaS subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}`
+            );
 
-        const [orgUserRes] = await db
-            .select()
-            .from(userOrgs)
-            .where(
-                and(
-                    eq(userOrgs.orgId, customer.orgId),
-                    eq(userOrgs.isOwner, true)
+            await handleSubscriptionLifesycle(
+                customer.orgId,
+                subscription.status,
+                type
+            );
+
+            const [orgUserRes] = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(
+                        eq(userOrgs.orgId, customer.orgId),
+                        eq(userOrgs.isOwner, true)
+                    )
                 )
-            )
-            .innerJoin(users, eq(userOrgs.userId, users.userId));
+                .innerJoin(users, eq(userOrgs.userId, users.userId));
 
-        if (orgUserRes) {
-            const email = orgUserRes.user.email;
+            if (orgUserRes) {
+                const email = orgUserRes.user.email;
 
-            if (email) {
-                moveEmailToAudience(email, AudienceIds.Churned);
+                if (email) {
+                    moveEmailToAudience(email, AudienceIds.Churned);
+                }
+            }
+        } else if (type === "license") {
+            logger.debug(
+                `Handling license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}`
+            );
+            try {
+                // WARNING:
+                // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
+                await fetch(
+                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
+                    {
+                        method: "POST",
+                        headers: {
+                            "api-key":
+                                privateConfig.getRawPrivateConfig().server
+                                    .fossorial_api_key!,
+                            "Content-Type": "application/json"
+                        },
+                        body: JSON.stringify({
+                            orgId: customer.orgId,
+                        })
+                    }
+                );
+            } catch (error) {
+                logger.error(
+                    `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
+                    error
+                );
             }
         }
     } catch (error) {

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -26,6 +26,8 @@ import logger from "@server/logger";
 import { getFeatureIdByMetricId } from "@server/lib/billing/features";
 import stripe from "#private/lib/stripe";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
+import { getSubType } from "./getSubType";
+import privateConfig from "#private/lib/config";
 
 export async function handleSubscriptionUpdated(
     subscription: Stripe.Subscription,
@@ -56,12 +58,14 @@ export async function handleSubscriptionUpdated(
         }
 
         // get the customer
-        const [existingCustomer] = await db
+        const [customer] = await db
             .select()
             .from(customers)
             .where(eq(customers.customerId, subscription.customer as string))
             .limit(1);
 
+        const type = getSubType(fullSubscription);
+
         await db
             .update(subscriptions)
             .set({
@@ -70,15 +74,11 @@ export async function handleSubscriptionUpdated(
                     ? subscription.canceled_at
                     : null,
                 updatedAt: Math.floor(Date.now() / 1000),
-                billingCycleAnchor: subscription.billing_cycle_anchor
+                billingCycleAnchor: subscription.billing_cycle_anchor,
+                type: type
             })
             .where(eq(subscriptions.subscriptionId, subscription.id));
 
-        await handleSubscriptionLifesycle(
-            existingCustomer.orgId,
-            subscription.status
-        );
-
         // Upsert subscription items
         if (Array.isArray(fullSubscription.items?.data)) {
             const itemsToUpsert = fullSubscription.items.data.map((item) => ({
@@ -141,20 +141,20 @@ export async function handleSubscriptionUpdated(
                             // This item has cycled
                             const meterId = item.plan.meter;
                             if (!meterId) {
-                                logger.warn(
+                                logger.debug(
                                     `No meterId found for subscription item ${item.id}. Skipping usage reset.`
                                 );
                                 continue;
                             }
                             const featureId = getFeatureIdByMetricId(meterId);
                             if (!featureId) {
-                                logger.warn(
+                                logger.debug(
                                     `No featureId found for meterId ${meterId}. Skipping usage reset.`
                                 );
                                 continue;
                             }
 
-                            const orgId = existingCustomer.orgId;
+                            const orgId = customer.orgId;
 
                             if (!orgId) {
                                 logger.warn(
@@ -236,6 +236,45 @@ export async function handleSubscriptionUpdated(
                 }
             }
             // --- end usage update ---
+
+            if (type === "home_lab" || type === "starter" || type === "scale") {
+                logger.debug(
+                    `Handling SAAS subscription lifecycle for org ${customer.orgId} with type ${type}`
+                );
+                // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
+                await handleSubscriptionLifesycle(
+                    customer.orgId,
+                    subscription.status,
+                    type
+                );
+            } else if (type === "license") {
+                if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") {
+                    try {
+                        // WARNING:
+                        // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
+                        await fetch(
+                            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
+                            {
+                                method: "POST",
+                                headers: {
+                                    "api-key":
+                                        privateConfig.getRawPrivateConfig()
+                                            .server.fossorial_api_key!,
+                                    "Content-Type": "application/json"
+                                },
+                                body: JSON.stringify({
+                                    orgId: customer.orgId
+                                })
+                            }
+                        );
+                    } catch (error) {
+                        logger.error(
+                            `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
+                            error
+                        );
+                    }
+                }
+            }
         }
     } catch (error) {
         logger.error(

server/private/routers/billing/index.ts

@@ -13,6 +13,7 @@
 
 export * from "./createCheckoutSession";
 export * from "./createPortalSession";
-export * from "./getOrgSubscription";
+export * from "./getOrgSubscriptions";
 export * from "./getOrgUsage";
 export * from "./internalGetOrgTier";
+export * from "./changeTier";

server/private/routers/billing/subscriptionLifecycle.ts

@@ -13,36 +13,62 @@
 
 import {
     freeLimitSet,
+    homeLabLimitSet,
+    starterLimitSet,
+    scaleLimitSet,
     limitsService,
-    subscribedLimitSet
+    LimitSet
 } from "@server/lib/billing";
 import { usageService } from "@server/lib/billing/usageService";
-import logger from "@server/logger";
+import { SubscriptionType } from "./hooks/getSubType";
+
+function getLimitSetForSubscriptionType(subType: SubscriptionType | null): LimitSet {
+    switch (subType) {
+        case "home_lab":
+            return homeLabLimitSet;
+        case "starter":
+            return starterLimitSet;
+        case "scale":
+            return scaleLimitSet;
+        case "license":
+            // License subscriptions use starter limits by default
+            // This can be adjusted based on your business logic
+            return starterLimitSet;
+        default:
+            return freeLimitSet;
+    }
+}
 
 export async function handleSubscriptionLifesycle(
     orgId: string,
-    status: string
+    status: string,
+    subType: SubscriptionType | null
 ) {
     switch (status) {
         case "active":
-            await limitsService.applyLimitSetToOrg(orgId, subscribedLimitSet);
+            const activeLimitSet = getLimitSetForSubscriptionType(subType);
+            await limitsService.applyLimitSetToOrg(orgId, activeLimitSet);
             await usageService.checkLimitSet(orgId, true);
             break;
         case "canceled":
+            // Subscription canceled - revert to free tier
             await limitsService.applyLimitSetToOrg(orgId, freeLimitSet);
             await usageService.checkLimitSet(orgId, true);
             break;
         case "past_due":
-            // Optionally handle past due status, e.g., notify customer
+            // Payment past due - keep current limits but notify customer
+            // Limits will revert to free tier if it becomes unpaid
             break;
         case "unpaid":
+            // Subscription unpaid - revert to free tier
             await limitsService.applyLimitSetToOrg(orgId, freeLimitSet);
             await usageService.checkLimitSet(orgId, true);
             break;
         case "incomplete":
-            // Optionally handle incomplete status, e.g., notify customer
+            // Payment incomplete - give them time to complete payment
             break;
         case "incomplete_expired":
+            // Payment never completed - revert to free tier
             await limitsService.applyLimitSetToOrg(orgId, freeLimitSet);
             await usageService.checkLimitSet(orgId, true);
             break;

server/private/routers/external.ts

@@ -76,6 +76,7 @@ unauthenticated.post(
 authenticated.put(
     "/org/:orgId/idp/oidc",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createIdp),
     logActionAudit(ActionsEnum.createIdp),
@@ -85,6 +86,7 @@ authenticated.put(
 authenticated.post(
     "/org/:orgId/idp/:idpId/oidc",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyUserHasAction(ActionsEnum.updateIdp),
@@ -141,23 +143,6 @@ authenticated.post(
 );
 
 if (build === "saas") {
-    unauthenticated.post(
-        "/quick-start",
-        rateLimit({
-            windowMs: 15 * 60 * 1000,
-            max: 100,
-            keyGenerator: (req) => req.path,
-            handler: (req, res, next) => {
-                const message = `We're too busy right now. Please try again later.`;
-                return next(
-                    createHttpError(HttpCode.TOO_MANY_REQUESTS, message)
-                );
-            },
-            store: createStore()
-        }),
-        auth.quickStart
-    );
-
     authenticated.post(
         "/org/:orgId/billing/create-checkout-session",
         verifyOrgAccess,
@@ -166,6 +151,14 @@ if (build === "saas") {
         billing.createCheckoutSession
     );
 
+    authenticated.post(
+        "/org/:orgId/billing/change-tier",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        logActionAudit(ActionsEnum.billing),
+        billing.changeTier
+    );
+
     authenticated.post(
         "/org/:orgId/billing/create-portal-session",
         verifyOrgAccess,
@@ -175,10 +168,10 @@ if (build === "saas") {
     );
 
     authenticated.get(
-        "/org/:orgId/billing/subscription",
+        "/org/:orgId/billing/subscriptions",
         verifyOrgAccess,
         verifyUserHasAction(ActionsEnum.billing),
-        billing.getOrgSubscription
+        billing.getOrgSubscriptions
     );
 
     authenticated.get(
@@ -200,6 +193,14 @@ if (build === "saas") {
         generateLicense.generateNewLicense
     );
 
+    authenticated.put(
+        "/org/:orgId/license/enterprise",
+        verifyOrgAccess,
+        verifyUserHasAction(ActionsEnum.billing),
+        logActionAudit(ActionsEnum.billing),
+        generateLicense.generateNewEnterpriseLicense
+    );
+
     authenticated.post(
         "/send-support-request",
         rateLimit({
@@ -278,6 +279,7 @@ authenticated.delete(
 authenticated.put(
     "/org/:orgId/login-page",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.createLoginPage),
     logActionAudit(ActionsEnum.createLoginPage),
@@ -287,6 +289,7 @@ authenticated.put(
 authenticated.post(
     "/org/:orgId/login-page/:loginPageId",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyLoginPageAccess,
     verifyUserHasAction(ActionsEnum.updateLoginPage),
@@ -315,6 +318,7 @@ authenticated.get(
 authenticated.get(
     "/org/:orgId/approvals",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.listApprovals),
     logActionAudit(ActionsEnum.listApprovals),
@@ -331,6 +335,7 @@ authenticated.get(
 authenticated.put(
     "/org/:orgId/approvals/:approvalId",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.updateApprovals),
     logActionAudit(ActionsEnum.updateApprovals),
@@ -340,6 +345,7 @@ authenticated.put(
 authenticated.get(
     "/org/:orgId/login-page-branding",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.getLoginPage),
     logActionAudit(ActionsEnum.getLoginPage),
@@ -349,6 +355,7 @@ authenticated.get(
 authenticated.put(
     "/org/:orgId/login-page-branding",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.updateLoginPage),
     logActionAudit(ActionsEnum.updateLoginPage),
@@ -358,6 +365,7 @@ authenticated.put(
 authenticated.delete(
     "/org/:orgId/login-page-branding",
     verifyValidLicense,
+    verifyValidSubscription,
     verifyOrgAccess,
     verifyUserHasAction(ActionsEnum.deleteLoginPage),
     logActionAudit(ActionsEnum.deleteLoginPage),

server/private/routers/generatedLicense/generateNewEnterpriseLicense.ts

@@ -0,0 +1,149 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib/response";
+import privateConfig from "#private/lib/config";
+import { createNewLicense } from "./generateNewLicense";
+import config from "@server/lib/config";
+import { getLicensePriceSet, LicenseId } from "@server/lib/billing/licenses";
+import stripe from "#private/lib/stripe";
+import { customers, db } from "@server/db";
+import { fromError } from "zod-validation-error";
+import z from "zod";
+import { eq } from "drizzle-orm";
+import { log } from "winston";
+
+const generateNewEnterpriseLicenseParamsSchema = z.strictObject({
+    orgId: z.string()
+});
+
+export async function generateNewEnterpriseLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+
+        const parsedParams = generateNewEnterpriseLicenseParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        if (!orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Organization ID is required"
+                )
+            );
+        }
+
+        logger.debug(`Generating new license for orgId: ${orgId}`);
+
+        const licenseData = req.body;
+
+        if (licenseData.tier != "big_license" && licenseData.tier != "small_license") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid tier specified. Must be either 'big_license' or 'small_license'."
+                )
+            );
+        }
+
+        const apiResponse = await createNewLicense(orgId, licenseData);
+
+        // Check if the API call was successful
+        if (!apiResponse.success || apiResponse.error) {
+            return next(
+                createHttpError(
+                    apiResponse.status || HttpCode.BAD_REQUEST,
+                    apiResponse.message || "Failed to create license from Fossorial API"
+                )
+            );
+        }
+
+        const keyId = apiResponse?.data?.licenseKey?.id;
+        if (!keyId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Fossorial API did not return a valid license key ID"
+                )
+            );
+        }
+
+        // check if we already have a customer for this org
+        const [customer] = await db
+            .select()
+            .from(customers)
+            .where(eq(customers.orgId, orgId))
+            .limit(1);
+
+        // If we don't have a customer, create one
+        if (!customer) {
+            // error
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "No customer found for this organization"
+                )
+            );
+        }
+
+        const tier = licenseData.tier === "big_license" ? LicenseId.BIG_LICENSE : LicenseId.SMALL_LICENSE;
+        const tierPrice = getLicensePriceSet()[tier]
+
+        const session = await stripe!.checkout.sessions.create({
+            client_reference_id: keyId.toString(),
+            billing_address_collection: "required",
+            line_items: [
+                {
+                    price: tierPrice, // Use the standard tier
+                    quantity: 1
+                },
+            ], // Start with the standard feature set that matches the free limits
+            customer: customer.customerId,
+            mode: "subscription",
+            success_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?success=true&session_id={CHECKOUT_SESSION_ID}`,
+            cancel_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?canceled=true`
+        });
+
+        return sendResponse<string>(res, {
+            data: session.url,
+            success: true,
+            error: false,
+            message: "License and checkout session created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while generating new license."
+            )
+        );
+    }
+}

server/private/routers/generatedLicense/generateNewLicense.ts

@@ -19,10 +19,40 @@ import { response as sendResponse } from "@server/lib/response";
 import privateConfig from "#private/lib/config";
 import { GenerateNewLicenseResponse } from "@server/routers/generatedLicense/types";
 
-async function createNewLicense(orgId: string, licenseData: any): Promise<any> {
+export interface CreateNewLicenseResponse {
+  data: Data
+  success: boolean
+  error: boolean
+  message: string
+  status: number
+}
+
+export interface Data {
+  licenseKey: LicenseKey
+}
+
+export interface LicenseKey {
+  id: number
+  instanceName: any
+  instanceId: string
+  licenseKey: string
+  tier: string
+  type: string
+  quantity: number
+  quantity_2: number
+  isValid: boolean
+  updatedAt: string
+  createdAt: string
+  expiresAt: string
+  paidFor: boolean
+  orgId: string
+  metadata: string
+}
+
+export async function createNewLicense(orgId: string, licenseData: any): Promise<CreateNewLicenseResponse> {
     try {
         const response = await fetch(
-            `https://api.fossorial.io/api/v1/license-internal/enterprise/${orgId}/create`,
+            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/${orgId}/create`, // this says enterprise but it does both
             {
                 method: "PUT",
                 headers: {
@@ -35,9 +65,8 @@ async function createNewLicense(orgId: string, licenseData: any): Promise<any> {
             }
         );
 
-        const data = await response.json();
+        const data: CreateNewLicenseResponse = await response.json();
 
-        logger.debug("Fossorial API response:", { data });
         return data;
     } catch (error) {
         console.error("Error creating new license:", error);

server/private/routers/generatedLicense/index.ts

@@ -13,3 +13,4 @@
 
 export * from "./listGeneratedLicenses";
 export * from "./generateNewLicense";
+export * from "./generateNewEnterpriseLicense";

server/private/routers/generatedLicense/listGeneratedLicenses.ts

@@ -25,7 +25,7 @@ import {
 async function fetchLicenseKeys(orgId: string): Promise<any> {
     try {
         const response = await fetch(
-            `https://api.fossorial.io/api/v1/license-internal/enterprise/${orgId}/list`,
+            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/${orgId}/list`,
             {
                 method: "GET",
                 headers: {

server/private/routers/hybrid.ts

@@ -186,7 +186,7 @@ export type ResourceWithAuth = {
     password: ResourcePassword | null;
     headerAuth: ResourceHeaderAuth | null;
     headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
-    org: Org
+    org: Org;
 };
 
 export type UserSessionWithUser = {
@@ -270,7 +270,6 @@ hybridRouter.get(
     }
 );
 
-let encryptionKeyPath = "";
 let encryptionKeyHex = "";
 let encryptionKey: Buffer;
 function loadEncryptData() {
@@ -278,16 +277,8 @@ function loadEncryptData() {
         return; // already loaded
     }
 
-    encryptionKeyPath =
-        privateConfig.getRawPrivateConfig().server.encryption_key_path;
-
-    if (!fs.existsSync(encryptionKeyPath)) {
-        throw new Error(
-            "Encryption key file not found. Please generate one first."
-        );
-    }
-
-    encryptionKeyHex = fs.readFileSync(encryptionKeyPath, "utf8").trim();
+    encryptionKeyHex =
+        privateConfig.getRawPrivateConfig().server.encryption_key;
     encryptionKey = Buffer.from(encryptionKeyHex, "hex");
 }
 

server/private/routers/loginPage/createLoginPage.ts

@@ -30,9 +30,7 @@ import { fromError } from "zod-validation-error";
 import { eq, and } from "drizzle-orm";
 import { validateAndConstructDomain } from "@server/lib/domainUtils";
 import { createCertificate } from "#private/routers/certificates/createCertificate";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import { build } from "@server/build";
+
 import { CreateLoginPageResponse } from "@server/routers/loginPage/types";
 
 const paramsSchema = z.strictObject({
@@ -76,19 +74,6 @@ export async function createLoginPage(
 
         const { orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         const [existing] = await db
             .select()
             .from(loginPageOrg)

server/private/routers/loginPage/deleteLoginPageBranding.ts

@@ -25,9 +25,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import { build } from "@server/build";
+
 
 const paramsSchema = z
     .object({
@@ -53,18 +51,6 @@ export async function deleteLoginPageBranding(
 
         const { orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
 
         const [existingLoginPageBranding] = await db
             .select()

server/private/routers/loginPage/getLoginPageBranding.ts

@@ -25,9 +25,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import { build } from "@server/build";
+
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -51,19 +49,6 @@ export async function getLoginPageBranding(
 
         const { orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         const [existingLoginPageBranding] = await db
             .select()
             .from(loginPageBranding)

server/private/routers/loginPage/updateLoginPage.ts

@@ -23,9 +23,7 @@ import { eq, and } from "drizzle-orm";
 import { validateAndConstructDomain } from "@server/lib/domainUtils";
 import { subdomainSchema } from "@server/lib/schemas";
 import { createCertificate } from "#private/routers/certificates/createCertificate";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
-import { build } from "@server/build";
+
 import { UpdateLoginPageResponse } from "@server/routers/loginPage/types";
 
 const paramsSchema = z
@@ -87,18 +85,6 @@ export async function updateLoginPage(
 
         const { loginPageId, orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
 
         const [existingLoginPage] = await db
             .select()

server/private/routers/loginPage/upsertLoginPageBranding.ts

@@ -25,10 +25,8 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq, InferInsertModel } from "drizzle-orm";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import { build } from "@server/build";
-import config from "@server/private/lib/config";
+import config from "#private/lib/config";
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -37,27 +35,55 @@ const paramsSchema = z.strictObject({
 const bodySchema = z.strictObject({
     logoUrl: z
         .union([
-            z.string().length(0),
-            z.url().refine(
-                async (url) => {
+            z.literal(""),
+            z
+                .url("Must be a valid URL")
+                .superRefine(async (url, ctx) => {
                     try {
-                        const response = await fetch(url);
-                        return (
-                            response.status === 200 &&
-                            (
-                                response.headers.get("content-type") ?? ""
-                            ).startsWith("image/")
-                        );
+                        const response = await fetch(url, {
+                            method: "HEAD"
+                        }).catch(() => {
+                            // If HEAD fails (CORS or method not allowed), try GET
+                            return fetch(url, { method: "GET" });
+                        });
+
+                        if (response.status !== 200) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `Failed to load image. Please check that the URL is accessible.`
+                            });
+                            return;
+                        }
+
+                        const contentType =
+                            response.headers.get("content-type") ?? "";
+                        if (!contentType.startsWith("image/")) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `URL does not point to an image. Please provide a URL to an image file (e.g., .png, .jpg, .svg).`
+                            });
+                            return;
+                        }
                     } catch (error) {
-                        return false;
+                        let errorMessage =
+                            "Unable to verify image URL. Please check that the URL is accessible and points to an image file.";
+
+                        if (error instanceof TypeError && error.message.includes("fetch")) {
+                            errorMessage =
+                                "Network error: Unable to reach the URL. Please check your internet connection and verify the URL is correct.";
+                        } else if (error instanceof Error) {
+                            errorMessage = `Error verifying URL: ${error.message}`;
+                        }
+
+                        ctx.addIssue({
+                            code: "custom",
+                            message: errorMessage
+                        });
                     }
-                },
-                {
-                    error: "Invalid logo URL, must be a valid image URL"
-                }
-            )
+                })
         ])
-        .optional(),
+        .transform((val) => (val === "" ? null : val))
+        .nullish(),
     logoWidth: z.coerce.number<number>().min(1),
     logoHeight: z.coerce.number<number>().min(1),
     resourceTitle: z.string(),
@@ -78,7 +104,7 @@ export async function upsertLoginPageBranding(
     next: NextFunction
 ): Promise<any> {
     try {
-        const parsedBody = bodySchema.safeParse(req.body);
+        const parsedBody = await bodySchema.safeParseAsync(req.body);
         if (!parsedBody.success) {
             return next(
                 createHttpError(
@@ -100,26 +126,12 @@ export async function upsertLoginPageBranding(
 
         const { orgId } = parsedParams.data;
 
-        if (build === "saas") {
-            const { tier } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         let updateData = parsedBody.data satisfies InferInsertModel<
             typeof loginPageBranding
         >;
 
-        if ((updateData.logoUrl ?? "").trim().length === 0) {
-            updateData.logoUrl = undefined;
-        }
+        // Empty strings are transformed to null by the schema, which will clear the logo URL in the database
+        // We keep it as null (not undefined) because undefined fields are omitted from Drizzle updates
 
         if (
             build !== "saas" &&

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -24,9 +24,6 @@ import { idp, idpOidcConfig, idpOrg, orgs } from "@server/db";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
-import { build } from "@server/build";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import { CreateOrgIdpResponse } from "@server/routers/orgIdp/types";
 
 const paramsSchema = z.strictObject({ orgId: z.string().nonempty() });
@@ -109,19 +106,6 @@ export async function createOrgOidcIdp(
             tags
         } = parsedBody.data;
 
-        if (build === "saas") {
-            const { tier, active } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         const key = config.getRawConfig().server.secret!;
 
         const encryptedSecret = encrypt(clientSecret, key);

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -24,9 +24,6 @@ import { idp, idpOidcConfig } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
-import { build } from "@server/build";
-import { getOrgTierData } from "#private/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 
 const paramsSchema = z
     .object({
@@ -114,19 +111,6 @@ export async function updateOrgOidcIdp(
             tags
         } = parsedBody.data;
 
-        if (build === "saas") {
-            const { tier, active } = await getOrgTierData(orgId);
-            const subscribed = tier === TierId.STANDARD;
-            if (!subscribed) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "This organization's current plan does not support this feature."
-                    )
-                );
-            }
-        }
-
         // Check if IDP exists and is of type OIDC
         const [existingIdp] = await db
             .select()

server/routers/badger/logRequestAudit.ts

@@ -1,6 +1,6 @@
 import { db, orgs, requestAuditLog } from "@server/db";
 import logger from "@server/logger";
-import { and, eq, lt } from "drizzle-orm";
+import { and, eq, lt, sql } from "drizzle-orm";
 import cache from "@server/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { stripPortFromHost } from "@server/lib/ip";
@@ -67,17 +67,27 @@ async function flushAuditLogs() {
     const logsToWrite = auditLogBuffer.splice(0, auditLogBuffer.length);
 
     try {
-        // Batch insert logs in groups of 25 to avoid overwhelming the database
-        const BATCH_DB_SIZE = 25;
-        for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
-            const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
-            await db.insert(requestAuditLog).values(batch);
-        }
+        // Use a transaction to ensure all inserts succeed or fail together
+        // This prevents index corruption from partial writes
+        await db.transaction(async (tx) => {
+            // Batch insert logs in groups of 25 to avoid overwhelming the database
+            const BATCH_DB_SIZE = 25;
+            for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
+                const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
+                await tx.insert(requestAuditLog).values(batch);
+            }
+        });
         logger.debug(`Flushed ${logsToWrite.length} audit logs to database`);
     } catch (error) {
         logger.error("Error flushing audit logs:", error);
-        // On error, we lose these logs - consider a fallback strategy if needed
-        // (e.g., write to file, or put back in buffer with retry limit)
+        // On transaction error, put logs back at the front of the buffer to retry
+        // but only if buffer isn't too large
+        if (auditLogBuffer.length < MAX_BUFFER_SIZE - logsToWrite.length) {
+            auditLogBuffer.unshift(...logsToWrite);
+            logger.info(`Re-queued ${logsToWrite.length} audit logs for retry`);
+        } else {
+            logger.error(`Buffer full, dropped ${logsToWrite.length} audit logs`);
+        }
     } finally {
         isFlushInProgress = false;
         // If buffer filled up while we were flushing, flush again

server/routers/badger/verifySession.ts

@@ -18,7 +18,6 @@ import {
     ResourcePassword,
     ResourcePincode,
     ResourceRule,
-    resourceSessions
 } from "@server/db";
 import config from "@server/lib/config";
 import { isIpInCidr, stripPortFromHost } from "@server/lib/ip";
@@ -32,7 +31,6 @@ import { fromError } from "zod-validation-error";
 import { getCountryCodeForIp } from "@server/lib/geoip";
 import { getAsnForIp } from "@server/lib/asn";
 import { getOrgTierData } from "#dynamic/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import { verifyPassword } from "@server/auth/password";
 import {
     checkOrgAccessPolicy,
@@ -40,8 +38,8 @@ import {
 } from "#dynamic/lib/checkOrgAccessPolicy";
 import { logRequestAudit } from "./logRequestAudit";
 import cache from "@server/lib/cache";
-import semver from "semver";
 import { APP_VERSION } from "@server/lib/consts";
+import { isSubscribed } from "#private/lib/isSubscribed";
 
 const verifyResourceSessionSchema = z.object({
     sessions: z.record(z.string(), z.string()).optional(),
@@ -798,8 +796,8 @@ async function notAllowed(
 ) {
     let loginPage: LoginPage | null = null;
     if (orgId) {
-        const { tier } = await getOrgTierData(orgId); // returns null in oss
-        if (tier === TierId.STANDARD) {
+        const subscribed = await isSubscribed(orgId);
+        if (subscribed) {
             loginPage = await getOrgLoginPage(orgId);
         }
     }
@@ -852,8 +850,8 @@ async function headerAuthChallenged(
 ) {
     let loginPage: LoginPage | null = null;
     if (orgId) {
-        const { tier } = await getOrgTierData(orgId); // returns null in oss
-        if (tier === TierId.STANDARD) {
+        const subscribed = await isSubscribed(orgId);
+        if (subscribed) {
             loginPage = await getOrgLoginPage(orgId);
         }
     }

server/routers/billing/types.ts

@@ -1,8 +1,7 @@
 import { Limit, Subscription, SubscriptionItem, Usage } from "@server/db";
 
 export type GetOrgSubscriptionResponse = {
-    subscription: Subscription | null;
-    items: SubscriptionItem[];
+    subscriptions: Array<{ subscription: Subscription; items: SubscriptionItem[] }>;
 };
 
 export type GetOrgUsageResponse = {

server/routers/client/archiveClient.ts

@@ -9,9 +9,6 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-import { sendTerminateClient } from "./terminate";
-import { OlmErrorCodes } from "../olm/error";
 
 const archiveClientSchema = z.strictObject({
     clientId: z.string().transform(Number).pipe(z.int().positive())
@@ -77,9 +74,6 @@ export async function archiveClient(
                 .update(clients)
                 .set({ archived: true })
                 .where(eq(clients.clientId, clientId));
-
-            // Rebuild associations to clean up related data
-            await rebuildClientAssociationsFromClient(client, trx);
         });
 
         return response(res, {

server/routers/client/getClient.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, olms } from "@server/db";
+import { db, olms, users } from "@server/db";
 import { clients, currentFingerprint } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -36,6 +36,7 @@ async function query(clientId?: number, niceId?: string, orgId?: string) {
                 currentFingerprint,
                 eq(olms.olmId, currentFingerprint.olmId)
             )
+            .leftJoin(users, eq(clients.userId, users.userId))
             .limit(1);
         return res;
     } else if (niceId && orgId) {
@@ -48,6 +49,7 @@ async function query(clientId?: number, niceId?: string, orgId?: string) {
                 currentFingerprint,
                 eq(olms.olmId, currentFingerprint.olmId)
             )
+            .leftJoin(users, eq(clients.userId, users.userId))
             .limit(1);
         return res;
     }
@@ -207,6 +209,9 @@ export type GetClientResponse = NonNullable<
     olmId: string | null;
     agent: string | null;
     olmVersion: string | null;
+    userEmail: string | null;
+    userName: string | null;
+    userUsername: string | null;
     fingerprint: {
         username: string | null;
         hostname: string | null;
@@ -322,6 +327,9 @@ export async function getClient(
             olmId: client.olms ? client.olms.olmId : null,
             agent: client.olms?.agent || null,
             olmVersion: client.olms?.version || null,
+            userEmail: client.user?.email ?? null,
+            userName: client.user?.name ?? null,
+            userUsername: client.user?.username ?? null,
             fingerprint: fingerprintData,
             posture: postureData
         };

server/routers/generatedLicense/types.ts

@@ -6,6 +6,8 @@ export type GeneratedLicenseKey = {
     createdAt: string;
     tier: string;
     type: string;
+    users: number;
+    sites: number;
 };
 
 export type ListGeneratedLicenseKeysResponse = GeneratedLicenseKey[];
@@ -19,6 +21,7 @@ export type NewLicenseKey = {
         tier: string;
         type: string;
         quantity: number;
+        quantity_2: number;
         isValid: boolean;
         updatedAt: string;
         createdAt: string;

server/routers/gerbil/receiveBandwidth.ts

@@ -114,7 +114,6 @@ export async function updateSiteBandwidth(
 
     // Aggregate usage data by organization (collected outside transaction)
     const orgUsageMap = new Map<string, number>();
-    const orgUptimeMap = new Map<string, number>();
 
     if (activePeers.length > 0) {
         // Remove any active peers from offline tracking since they're sending data
@@ -166,14 +165,6 @@ export async function updateSiteBandwidth(
                         updatedSite.orgId,
                         currentOrgUsage + totalBandwidth
                     );
-
-                    // Add 10 seconds of uptime for each active site
-                    const currentOrgUptime =
-                        orgUptimeMap.get(updatedSite.orgId) || 0;
-                    orgUptimeMap.set(
-                        updatedSite.orgId,
-                        currentOrgUptime + 10 / 60
-                    );
                 }
             } catch (error) {
                 logger.error(
@@ -187,10 +178,10 @@ export async function updateSiteBandwidth(
 
     // Process usage updates outside of site update transactions
     // This separates the concerns and reduces lock contention
-    if (calcUsageAndLimits && (orgUsageMap.size > 0 || orgUptimeMap.size > 0)) {
+    if (calcUsageAndLimits && (orgUsageMap.size > 0)) {
         // Sort org IDs to ensure consistent lock ordering
         const allOrgIds = [
-            ...new Set([...orgUsageMap.keys(), ...orgUptimeMap.keys()])
+            ...new Set([...orgUsageMap.keys()])
         ].sort();
 
         for (const orgId of allOrgIds) {
@@ -220,32 +211,6 @@ export async function updateSiteBandwidth(
                             });
                     }
                 }
-
-                // Process uptime usage for this org
-                const totalUptime = orgUptimeMap.get(orgId);
-                if (totalUptime) {
-                    const uptimeUsage = await usageService.add(
-                        orgId,
-                        FeatureId.SITE_UPTIME,
-                        totalUptime
-                    );
-                    if (uptimeUsage) {
-                        // Fire and forget - don't block on limit checking
-                        usageService
-                            .checkLimitSet(
-                                orgId,
-                                true,
-                                FeatureId.SITE_UPTIME,
-                                uptimeUsage
-                            )
-                            .catch((error: any) => {
-                                logger.error(
-                                    `Error checking uptime limits for org ${orgId}:`,
-                                    error
-                                );
-                            });
-                    }
-                }
             } catch (error) {
                 logger.error(`Error processing usage for org ${orgId}:`, error);
                 // Continue with other orgs

server/routers/idp/generateOidcUrl.ts

@@ -14,8 +14,7 @@ import jsonwebtoken from "jsonwebtoken";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import { build } from "@server/build";
-import { getOrgTierData } from "#dynamic/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
+import { isSubscribed } from "#dynamic/lib/isSubscribed";
 
 const paramsSchema = z
     .object({
@@ -113,8 +112,7 @@ export async function generateOidcUrl(
             }
 
             if (build === "saas") {
-                const { tier } = await getOrgTierData(orgId);
-                const subscribed = tier === TierId.STANDARD;
+                const subscribed = await isSubscribed(orgId);
                 if (!subscribed) {
                     return next(
                         createHttpError(

server/routers/newt/handleNewtRegisterMessage.ts

@@ -96,10 +96,10 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
         fetchContainers(newt.newtId);
     }
 
-    const rejectSiteUptime = await usageService.checkLimitSet(
+    const rejectSites = await usageService.checkLimitSet(
         oldSite.orgId,
         false,
-        FeatureId.SITE_UPTIME
+        FeatureId.SITES
     );
     const rejectEgressDataMb = await usageService.checkLimitSet(
         oldSite.orgId,
@@ -111,8 +111,8 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
     // const rejectUsers = await usageService.checkLimitSet(oldSite.orgId, false, FeatureId.USERS);
     // const rejectDomains = await usageService.checkLimitSet(oldSite.orgId, false, FeatureId.DOMAINS);
 
-    // if (rejectEgressDataMb || rejectSiteUptime || rejectUsers || rejectDomains) {
-    if (rejectEgressDataMb || rejectSiteUptime) {
+    // if (rejectEgressDataMb || rejectSites || rejectUsers || rejectDomains) {
+    if (rejectEgressDataMb || rejectSites) {
         logger.info(
             `Usage limits exceeded for org ${oldSite.orgId}. Rejecting newt registration.`
         );

server/routers/olm/archiveUserOlm.ts

@@ -1,6 +1,6 @@
 import { NextFunction, Request, Response } from "express";
 import { db } from "@server/db";
-import { olms, clients } from "@server/db";
+import { olms } from "@server/db";
 import { eq } from "drizzle-orm";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -8,9 +8,6 @@ import response from "@server/lib/response";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-import { sendTerminateClient } from "../client/terminate";
-import { OlmErrorCodes } from "./error";
 
 const paramsSchema = z
     .object({
@@ -37,26 +34,7 @@ export async function archiveUserOlm(
 
         const { olmId } = parsedParams.data;
 
-        // Archive the OLM and disconnect associated clients in a transaction
         await db.transaction(async (trx) => {
-            // Find all clients associated with this OLM
-            const associatedClients = await trx
-                .select()
-                .from(clients)
-                .where(eq(clients.olmId, olmId));
-
-            // Disconnect clients from the OLM (set olmId to null)
-            for (const client of associatedClients) {
-                await trx
-                    .update(clients)
-                    .set({ olmId: null })
-                    .where(eq(clients.clientId, client.clientId));
-
-                await rebuildClientAssociationsFromClient(client, trx);
-                await sendTerminateClient(client.clientId, OlmErrorCodes.TERMINATED_ARCHIVED, olmId);
-            }
-
-            // Archive the OLM (set archived to true)
             await trx
                 .update(olms)
                 .set({ archived: true })

server/routers/olm/handleOlmRegisterMessage.ts

@@ -13,6 +13,7 @@ import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { validateSessionToken } from "@server/auth/sessions/app";
 import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
+import { getUserDeviceName } from "@server/db/names";
 import { buildSiteConfigurationForOlmClient } from "./buildConfiguration";
 import { OlmErrorCodes, sendOlmError } from "./error";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
@@ -97,6 +98,21 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         return;
     }
 
+    const deviceModel = fingerprint?.deviceModel ?? null;
+    const computedName = getUserDeviceName(deviceModel, client.name);
+    if (computedName && computedName !== client.name) {
+        await db
+            .update(clients)
+            .set({ name: computedName })
+            .where(eq(clients.clientId, client.clientId));
+    }
+    if (computedName && computedName !== olm.name) {
+        await db
+            .update(olms)
+            .set({ name: computedName })
+            .where(eq(olms.olmId, olm.olmId));
+    }
+
     const [org] = await db
         .select()
         .from(orgs)

server/routers/org/updateOrg.ts

@@ -10,10 +10,9 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { build } from "@server/build";
-import { getOrgTierData } from "#dynamic/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import { cache } from "@server/lib/cache";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { isSubscribed } from "#dynamic/lib/isSubscribed";
 
 const updateOrgParamsSchema = z.strictObject({
     orgId: z.string()
@@ -95,10 +94,10 @@ export async function updateOrg(
             parsedBody.data.passwordExpiryDays = undefined;
         }
 
-        const { tier } = await getOrgTierData(orgId);
+        const subscribed = await isSubscribed(orgId);
         if (
             build == "saas" &&
-            tier != TierId.STANDARD &&
+            subscribed &&
             parsedBody.data.settingsLogRetentionDaysRequest &&
             parsedBody.data.settingsLogRetentionDaysRequest > 30
         ) {

server/routers/site/createSite.ts

@@ -18,6 +18,8 @@ import { isValidIP } from "@server/lib/validators";
 import { isIpInCidr } from "@server/lib/ip";
 import { verifyExitNodeOrgAccess } from "#dynamic/lib/exitNodes";
 import { build } from "@server/build";
+import { usageService } from "@server/lib/billing/usageService";
+import { FeatureId } from "@server/lib/billing";
 
 const createSiteParamsSchema = z.strictObject({
     orgId: z.string()
@@ -126,6 +128,35 @@ export async function createSite(
             );
         }
 
+        if (build == "saas") {
+            const usage = await usageService.getUsage(orgId, FeatureId.SITES);
+            if (!usage) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "No usage data found for this organization"
+                    )
+                );
+            }
+            const rejectSites = await usageService.checkLimitSet(
+                orgId,
+                false,
+                FeatureId.SITES,
+                {
+                    ...usage,
+                    instantaneousValue: (usage.instantaneousValue || 0) + 1
+                } // We need to add one to know if we are violating the limit
+            );
+            if (rejectSites) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Sites limit exceeded. Please upgrade your plan."
+                    )
+                );
+            }
+        }
+
         let updatedAddress = null;
         if (address) {
             if (!org.subnet) {
@@ -256,8 +287,8 @@ export async function createSite(
 
         const niceId = await getUniqueSiteName(orgId);
 
-        let newSite: Site;
-
+        let newSite: Site | undefined;
+        let numSites: Site[] | undefined;
         await db.transaction(async (trx) => {
             if (type == "wireguard" || type == "newt") {
                 // we are creating a site with an exit node (tunneled)
@@ -402,13 +433,35 @@ export async function createSite(
                 });
             }
 
-            return response<CreateSiteResponse>(res, {
-                data: newSite,
-                success: true,
-                error: false,
-                message: "Site created successfully",
-                status: HttpCode.CREATED
-            });
+            numSites = await trx
+                .select()
+                .from(sites)
+                .where(eq(sites.orgId, orgId));
+        });
+
+        if (numSites) {
+            await usageService.updateDaily(
+                orgId,
+                FeatureId.SITES,
+                numSites.length
+            );
+        }
+
+        if (!newSite) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Failed to create site"
+                )
+            );
+        }
+
+        return response<CreateSiteResponse>(res, {
+            data: newSite,
+            success: true,
+            error: false,
+            message: "Site created successfully",
+            status: HttpCode.CREATED
         });
     } catch (error) {
         logger.error(error);

server/routers/site/deleteSite.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, siteResources } from "@server/db";
+import { db, Site, siteResources } from "@server/db";
 import { newts, newtSessions, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -12,6 +12,8 @@ import { fromError } from "zod-validation-error";
 import { sendToClient } from "#dynamic/routers/ws";
 import { OpenAPITags, registry } from "@server/openApi";
 import { rebuildClientAssociationsFromSiteResource } from "@server/lib/rebuildClientAssociations";
+import { usageService } from "@server/lib/billing/usageService";
+import { FeatureId } from "@server/lib/billing";
 
 const deleteSiteSchema = z.strictObject({
     siteId: z.string().transform(Number).pipe(z.int().positive())
@@ -62,6 +64,7 @@ export async function deleteSite(
         }
 
         let deletedNewtId: string | null = null;
+        let numSites: Site[] | undefined;
 
         await db.transaction(async (trx) => {
             if (site.type == "wireguard") {
@@ -99,8 +102,20 @@ export async function deleteSite(
             }
 
             await trx.delete(sites).where(eq(sites.siteId, siteId));
+
+            numSites = await trx
+                .select()
+                .from(sites)
+                .where(eq(sites.orgId, site.orgId));
         });
 
+        if (numSites) {
+            await usageService.updateDaily(
+                site.orgId,
+                FeatureId.SITES,
+                numSites.length
+            );
+        }
         // Send termination message outside of transaction to prevent blocking
         if (deletedNewtId) {
             const payload = {

server/routers/user/createOrgUser.ts

@@ -13,9 +13,8 @@ import { generateId } from "@server/auth/sessions/app";
 import { usageService } from "@server/lib/billing/usageService";
 import { FeatureId } from "@server/lib/billing";
 import { build } from "@server/build";
-import { getOrgTierData } from "#dynamic/lib/billing";
-import { TierId } from "@server/lib/billing/tiers";
 import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsForOrgs";
+import { isSubscribed } from "#dynamic/lib/isSubscribed";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -132,9 +131,8 @@ export async function createOrgUser(
             );
         } else if (type === "oidc") {
             if (build === "saas") {
-                const { tier } = await getOrgTierData(orgId);
-                const subscribed = tier === TierId.STANDARD;
-                if (!subscribed) {
+                const subscribed = await isSubscribed(orgId);
+                if (subscribed) {
                     return next(
                         createHttpError(
                             HttpCode.FORBIDDEN,

server/setup/ensureSetupToken.ts

@@ -64,16 +64,20 @@ export async function ensureSetupToken() {
                 );
             }
 
-            if (existingToken?.token !== envSetupToken) {
-                console.warn(
-                    "Overwriting existing token in DB since PANGOLIN_SETUP_TOKEN is set"
-                );
+            if (existingToken) {
+                // Token exists in DB - update it if different
+                if (existingToken.token !== envSetupToken) {
+                    console.warn(
+                        "Overwriting existing token in DB since PANGOLIN_SETUP_TOKEN is set"
+                    );
 
-                await db
-                    .update(setupTokens)
-                    .set({ token: envSetupToken })
-                    .where(eq(setupTokens.tokenId, existingToken.tokenId));
+                    await db
+                        .update(setupTokens)
+                        .set({ token: envSetupToken })
+                        .where(eq(setupTokens.tokenId, existingToken.tokenId));
+                }
             } else {
+                // No existing token - insert new one
                 const tokenId = generateId(15);
 
                 await db.insert(setupTokens).values({

src/app/[orgId]/layout.tsx

@@ -18,6 +18,7 @@ import { build } from "@server/build";
 import OrgPolicyResult from "@app/components/OrgPolicyResult";
 import UserProvider from "@app/providers/UserProvider";
 import { Layout } from "@app/components/Layout";
+import ApplyInternalRedirect from "@app/components/ApplyInternalRedirect";
 
 export default async function OrgLayout(props: {
     children: React.ReactNode;
@@ -70,6 +71,7 @@ export default async function OrgLayout(props: {
         } catch (e) {}
         return (
             <UserProvider user={user}>
+                <ApplyInternalRedirect orgId={orgId} />
                 <Layout orgId={orgId} navItems={[]} orgs={orgs}>
                     <OrgPolicyResult
                         orgId={orgId}
@@ -86,7 +88,7 @@ export default async function OrgLayout(props: {
         try {
             const getSubscription = cache(() =>
                 internal.get<AxiosResponse<GetOrgSubscriptionResponse>>(
-                    `/org/${orgId}/billing/subscription`,
+                    `/org/${orgId}/billing/subscriptions`,
                     cookie
                 )
             );
@@ -104,6 +106,7 @@ export default async function OrgLayout(props: {
             env={env.app.environment}
             sandbox_mode={env.app.sandbox_mode}
         >
+            <ApplyInternalRedirect orgId={orgId} />
             {props.children}
             <SetLastOrgCookie orgId={orgId} />
         </SubscriptionStatusProvider>

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -48,7 +48,6 @@ import { useTranslations } from "next-intl";
 import { build } from "@server/build";
 import Image from "next/image";
 import { useSubscriptionStatusContext } from "@app/hooks/useSubscriptionStatusContext";
-import { TierId } from "@server/lib/billing/tiers";
 
 type UserType = "internal" | "oidc";
 

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -23,8 +23,6 @@ import type {
     LoadLoginPageBrandingResponse,
     LoadLoginPageResponse
 } from "@server/routers/loginPage/types";
-import { GetOrgTierResponse } from "@server/routers/billing/types";
-import { TierId } from "@server/lib/billing/tiers";
 import { CheckOrgUserAccessResponse } from "@server/routers/org";
 import OrgPolicyRequired from "@app/components/OrgPolicyRequired";
 import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";

src/app/layout.tsx

@@ -23,6 +23,7 @@ import Script from "next/script";
 import { TanstackQueryProvider } from "@app/components/TanstackQueryProvider";
 import { TailwindIndicator } from "@app/components/TailwindIndicator";
 import { ViewportHeightFix } from "@app/components/ViewportHeightFix";
+import StoreInternalRedirect from "@app/components/StoreInternalRedirect";
 
 export const metadata: Metadata = {
     title: `Dashboard - ${process.env.BRANDING_APP_NAME || "Pangolin"}`,
@@ -79,6 +80,7 @@ export default async function RootLayout({
     return (
         <html suppressHydrationWarning lang={locale}>
             <body className={`${font.className} h-screen-safe overflow-hidden`}>
+                <StoreInternalRedirect />
                 <TopLoader />
                 {build === "saas" && (
                     <Script

src/app/page.tsx

@@ -10,6 +10,7 @@ import OrganizationLanding from "@app/components/OrganizationLanding";
 import { pullEnv } from "@app/lib/pullEnv";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
 import { Layout } from "@app/components/Layout";
+import RedirectToOrg from "@app/components/RedirectToOrg";
 import { InitialSetupCompleteResponse } from "@server/routers/auth";
 import { cookies } from "next/headers";
 import { build } from "@server/build";
@@ -80,15 +81,16 @@ export default async function Page(props: {
     const lastOrgCookie = allCookies.get("pangolin-last-org")?.value;
 
     const lastOrgExists = orgs.some((org) => org.orgId === lastOrgCookie);
+    let targetOrgId: string | null = null;
     if (lastOrgExists && lastOrgCookie) {
-        redirect(`/${lastOrgCookie}`);
+        targetOrgId = lastOrgCookie;
     } else {
         let ownedOrg = orgs.find((org) => org.isOwner);
         if (!ownedOrg) {
             ownedOrg = orgs[0];
         }
         if (ownedOrg) {
-            redirect(`/${ownedOrg.orgId}`);
+            targetOrgId = ownedOrg.orgId;
         } else {
             if (!env.flags.disableUserCreateOrg || user.serverAdmin) {
                 redirect("/setup");
@@ -96,6 +98,10 @@ export default async function Page(props: {
         }
     }
 
+    if (targetOrgId) {
+        return <RedirectToOrg targetOrgId={targetOrgId} />;
+    }
+
     return (
         <UserProvider user={user}>
             <Layout orgs={orgs} navItems={[]}>

src/components/ApplyInternalRedirect.tsx

@@ -0,0 +1,24 @@
+"use client";
+
+import { useEffect } from "react";
+import { useRouter } from "next/navigation";
+import { consumeInternalRedirectPath } from "@app/lib/internalRedirect";
+
+type ApplyInternalRedirectProps = {
+    orgId: string;
+};
+
+export default function ApplyInternalRedirect({
+    orgId
+}: ApplyInternalRedirectProps) {
+    const router = useRouter();
+
+    useEffect(() => {
+        const path = consumeInternalRedirectPath();
+        if (path) {
+            router.replace(`/${orgId}${path}`);
+        }
+    }, [orgId, router]);
+
+    return null;
+}

src/components/AuthPageBrandingForm.tsx

@@ -43,25 +43,52 @@ export type AuthPageCustomizationProps = {
 
 const AuthPageFormSchema = z.object({
     logoUrl: z.union([
-        z.string().length(0),
-        z.url().refine(
-            async (url) => {
-                try {
-                    const response = await fetch(url);
-                    return (
-                        response.status === 200 &&
-                        (response.headers.get("content-type") ?? "").startsWith(
-                            "image/"
-                        )
-                    );
-                } catch (error) {
-                    return false;
+        z.literal(""),
+        z.url("Must be a valid URL").superRefine(async (url, ctx) => {
+            try {
+                const response = await fetch(url, {
+                    method: "HEAD"
+                }).catch(() => {
+                    // If HEAD fails (CORS or method not allowed), try GET
+                    return fetch(url, { method: "GET" });
+                });
+
+                if (response.status !== 200) {
+                    ctx.addIssue({
+                        code: "custom",
+                        message: `Failed to load image. Please check that the URL is accessible.`
+                    });
+                    return;
                 }
-            },
-            {
-                error: "Invalid logo URL, must be a valid image URL"
+
+                const contentType = response.headers.get("content-type") ?? "";
+                if (!contentType.startsWith("image/")) {
+                    ctx.addIssue({
+                        code: "custom",
+                        message: `URL does not point to an image. Please provide a URL to an image file (e.g., .png, .jpg, .svg).`
+                    });
+                    return;
+                }
+            } catch (error) {
+                let errorMessage =
+                    "Unable to verify image URL. Please check that the URL is accessible and points to an image file.";
+
+                if (
+                    error instanceof TypeError &&
+                    error.message.includes("fetch")
+                ) {
+                    errorMessage =
+                        "Network error: Unable to reach the URL. Please check your internet connection and verify the URL is correct.";
+                } else if (error instanceof Error) {
+                    errorMessage = `Error verifying URL: ${error.message}`;
+                }
+
+                ctx.addIssue({
+                    code: "custom",
+                    message: errorMessage
+                });
             }
-        )
+        })
     ]),
     logoWidth: z.coerce.number<number>().min(1),
     logoHeight: z.coerce.number<number>().min(1),
@@ -405,9 +432,7 @@ export default function AuthPageBrandingForm({
                             <Button
                                 variant="destructive"
                                 type="submit"
-                                loading={
-                                    isUpdatingBranding || isDeletingBranding
-                                }
+                                loading={isDeletingBranding}
                                 disabled={
                                     isUpdatingBranding ||
                                     isDeletingBranding ||
@@ -422,7 +447,7 @@ export default function AuthPageBrandingForm({
                     <Button
                         type="submit"
                         form="auth-page-branding-form"
-                        loading={isUpdatingBranding || isDeletingBranding}
+                        loading={isUpdatingBranding}
                         disabled={
                             isUpdatingBranding ||
                             isDeletingBranding ||

src/components/ClientInfoCard.tsx

@@ -8,6 +8,7 @@ import {
     InfoSections,
     InfoSectionTitle
 } from "@app/components/InfoSection";
+import { getUserDisplayName } from "@app/lib/getUserDisplayName";
 import { useTranslations } from "next-intl";
 
 type ClientInfoCardProps = {};
@@ -16,6 +17,12 @@ export default function SiteInfoCard({}: ClientInfoCardProps) {
     const { client, updateClient } = useClientContext();
     const t = useTranslations();
 
+    const userDisplayName = getUserDisplayName({
+        email: client.userEmail,
+        name: client.userName,
+        username: client.userUsername
+    });
+
     return (
         <Alert>
             <AlertDescription>
@@ -25,8 +32,12 @@ export default function SiteInfoCard({}: ClientInfoCardProps) {
                         <InfoSectionContent>{client.name}</InfoSectionContent>
                     </InfoSection>
                     <InfoSection>
-                        <InfoSectionTitle>{t("identifier")}</InfoSectionTitle>
-                        <InfoSectionContent>{client.niceId}</InfoSectionContent>
+                        <InfoSectionTitle>
+                            {userDisplayName ? t("user") : t("identifier")}
+                        </InfoSectionTitle>
+                        <InfoSectionContent>
+                            {userDisplayName || client.niceId}
+                        </InfoSectionContent>
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("status")}</InfoSectionTitle>

src/components/GenerateLicenseKeyForm.tsx

@@ -250,20 +250,41 @@ export default function GenerateLicenseKeyForm({
     const submitLicenseRequest = async (payload: any) => {
         setLoading(true);
         try {
-            const response = await api.put<
-                AxiosResponse<GenerateNewLicenseResponse>
-            >(`/org/${orgId}/license`, payload);
+            // Check if this is a business/enterprise license request
+            if (payload.useCaseType === "business") {
+                const response = await api.put<
+                    AxiosResponse<string>
+                    >(`/org/${orgId}/license/enterprise`, { ...payload, tier: "big_license" } );
 
-            if (response.data.data?.licenseKey?.licenseKey) {
-                setGeneratedKey(response.data.data.licenseKey.licenseKey);
-                onGenerated?.();
-                toast({
-                    title: t("generateLicenseKeyForm.toasts.success.title"),
-                    description: t(
-                        "generateLicenseKeyForm.toasts.success.description"
-                    ),
-                    variant: "default"
-                });
+                console.log("Checkout session response:", response.data);
+                const checkoutUrl = response.data.data;
+                if (checkoutUrl) {
+                    window.location.href = checkoutUrl;
+                } else {
+                    toast({
+                        title: "Failed to get checkout URL",
+                        description: "Please try again later",
+                        variant: "destructive"
+                    });
+                    setLoading(false);
+                }
+            } else {
+                // Personal license flow
+                const response = await api.put<
+                    AxiosResponse<GenerateNewLicenseResponse>
+                >(`/org/${orgId}/license`, payload);
+
+                if (response.data.data?.licenseKey?.licenseKey) {
+                    setGeneratedKey(response.data.data.licenseKey.licenseKey);
+                    onGenerated?.();
+                    toast({
+                        title: t("generateLicenseKeyForm.toasts.success.title"),
+                        description: t(
+                            "generateLicenseKeyForm.toasts.success.description"
+                        ),
+                        variant: "default"
+                    });
+                }
             }
         } catch (e) {
             console.error(e);
@@ -1066,16 +1087,16 @@ export default function GenerateLicenseKeyForm({
                     )}
 
                     {!generatedKey && useCaseType === "business" && (
-                        <Button
-                            type="submit"
-                            form="generate-license-business-form"
-                            disabled={loading}
-                            loading={loading}
-                        >
-                            {t(
-                                "generateLicenseKeyForm.buttons.generateLicenseKey"
-                            )}
-                        </Button>
+                            <Button
+                                type="submit"
+                                form="generate-license-business-form"
+                                disabled={loading}
+                                loading={loading}
+                            >
+                                {t(
+                                    "generateLicenseKeyForm.buttons.generateLicenseKey"
+                                )}
+                            </Button>
                     )}
                 </CredenzaFooter>
             </CredenzaContent>

src/components/GenerateLicenseKeysTable.tsx

@@ -10,12 +10,12 @@ import { Badge } from "./ui/badge";
 import moment from "moment";
 import { DataTable } from "./ui/data-table";
 import { GeneratedLicenseKey } from "@server/routers/generatedLicense/types";
-import { useState } from "react";
-import { useRouter } from "next/navigation";
+import { useState, useEffect } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import GenerateLicenseKeyForm from "./GenerateLicenseKeyForm";
+import NewPricingLicenseForm from "./NewPricingLicenseForm";
 
 type GnerateLicenseKeysTableProps = {
     licenseKeys: GeneratedLicenseKey[];
@@ -29,12 +29,15 @@ function obfuscateLicenseKey(key: string): string {
     return `${firstPart}••••••••••••••••••••${lastPart}`;
 }
 
+const GENERATE_QUERY = "generate";
+
 export default function GenerateLicenseKeysTable({
     licenseKeys,
     orgId
 }: GnerateLicenseKeysTableProps) {
     const t = useTranslations();
     const router = useRouter();
+    const searchParams = useSearchParams();
 
     const { env } = useEnvContext();
     const api = createApiClient({ env });
@@ -42,6 +45,19 @@ export default function GenerateLicenseKeysTable({
     const [isRefreshing, setIsRefreshing] = useState(false);
     const [showGenerateForm, setShowGenerateForm] = useState(false);
 
+    useEffect(() => {
+        if (searchParams.get(GENERATE_QUERY) !== null) {
+            setShowGenerateForm(true);
+            const next = new URLSearchParams(searchParams);
+            next.delete(GENERATE_QUERY);
+            const qs = next.toString();
+            const url = qs
+                ? `${window.location.pathname}?${qs}`
+                : window.location.pathname;
+            window.history.replaceState(null, "", url);
+        }
+    }, [searchParams]);
+
     const handleLicenseGenerated = () => {
         // Refresh the data after license is generated
         refreshData();
@@ -158,6 +174,48 @@ export default function GenerateLicenseKeysTable({
                     : t("licenseTierPersonal");
             }
         },
+        {
+            accessorKey: "users",
+            friendlyName: t("users"),
+            header: ({ column }) => {
+                return (
+                    <Button
+                        variant="ghost"
+                        onClick={() =>
+                            column.toggleSorting(column.getIsSorted() === "asc")
+                        }
+                    >
+                        {t("users")}
+                        <ArrowUpDown className="ml-2 h-4 w-4" />
+                    </Button>
+                );
+            },
+            cell: ({ row }) => {
+                const users = row.original.users;
+                return users === -1 ? "∞" : users;
+            }
+        },
+        {
+            accessorKey: "sites",
+            friendlyName: t("sites"),
+            header: ({ column }) => {
+                return (
+                    <Button
+                        variant="ghost"
+                        onClick={() =>
+                            column.toggleSorting(column.getIsSorted() === "asc")
+                        }
+                    >
+                        {t("sites")}
+                        <ArrowUpDown className="ml-2 h-4 w-4" />
+                    </Button>
+                );
+            },
+            cell: ({ row }) => {
+                const sites = row.original.sites;
+                return sites === -1 ? "∞" : sites;
+            }
+        },
         {
             accessorKey: "terminateAt",
             friendlyName: t("licenseTableValidUntil"),
@@ -198,7 +256,7 @@ export default function GenerateLicenseKeysTable({
                 }}
             />
 
-            <GenerateLicenseKeyForm
+            <NewPricingLicenseForm
                 open={showGenerateForm}
                 setOpen={setShowGenerateForm}
                 orgId={orgId}

src/components/NewPricingLicenseForm.tsx

@@ -0,0 +1,913 @@
+"use client";
+
+import { Button } from "@app/components/ui/button";
+import {
+    Form,
+    FormControl,
+    FormField,
+    FormItem,
+    FormLabel,
+    FormMessage
+} from "@app/components/ui/form";
+import { Input } from "@app/components/ui/input";
+import { Checkbox } from "@app/components/ui/checkbox";
+import { toast } from "@app/hooks/useToast";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { AxiosResponse } from "axios";
+import { useState } from "react";
+import { useForm, type Resolver } from "react-hook-form";
+import { z } from "zod";
+import CopyTextBox from "@app/components/CopyTextBox";
+import {
+    Credenza,
+    CredenzaBody,
+    CredenzaClose,
+    CredenzaContent,
+    CredenzaDescription,
+    CredenzaFooter,
+    CredenzaHeader,
+    CredenzaTitle
+} from "@app/components/Credenza";
+import { formatAxiosError } from "@app/lib/api";
+import { createApiClient } from "@app/lib/api";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { GenerateNewLicenseResponse } from "@server/routers/generatedLicense/types";
+import { useTranslations } from "next-intl";
+import React from "react";
+import { StrategySelect, StrategyOption } from "./StrategySelect";
+import { Alert, AlertDescription, AlertTitle } from "./ui/alert";
+import { InfoIcon } from "lucide-react";
+import { useUserContext } from "@app/hooks/useUserContext";
+
+const TIER_TO_LICENSE_ID = {
+    starter: "small_license",
+    scale: "big_license"
+} as const;
+
+type FormProps = {
+    open: boolean;
+    setOpen: (open: boolean) => void;
+    orgId: string;
+    onGenerated?: () => void;
+};
+
+export default function NewPricingLicenseForm({
+    open,
+    setOpen,
+    orgId,
+    onGenerated
+}: FormProps) {
+    const t = useTranslations();
+    const { env } = useEnvContext();
+    const api = createApiClient({ env });
+    const { user } = useUserContext();
+
+    const [loading, setLoading] = useState(false);
+    const [generatedKey, setGeneratedKey] = useState<string | null>(null);
+    const [personalUseOnly, setPersonalUseOnly] = useState(false);
+    const [selectedTier, setSelectedTier] = useState<"starter" | "scale">(
+        "starter"
+    );
+
+    const personalFormSchema = z.object({
+        email: z.email(),
+        firstName: z.string().min(1),
+        lastName: z.string().min(1),
+        primaryUse: z.string().min(1),
+        country: z.string().min(1),
+        phoneNumber: z.string().optional(),
+        agreedToTerms: z.boolean().refine((val) => val === true),
+        complianceConfirmed: z.boolean().refine((val) => val === true)
+    });
+
+    const businessFormSchema = z.object({
+        email: z.email(),
+        firstName: z.string().min(1),
+        lastName: z.string().min(1),
+        primaryUse: z.string().min(1),
+        industry: z.string().min(1),
+        companyName: z.string().min(1),
+        companyWebsite: z.string().optional(),
+        companyPhoneNumber: z.string().optional(),
+        agreedToTerms: z.boolean().refine((val) => val === true),
+        complianceConfirmed: z.boolean().refine((val) => val === true)
+    });
+
+    type PersonalFormData = z.infer<typeof personalFormSchema>;
+    type BusinessFormData = z.infer<typeof businessFormSchema>;
+
+    const personalForm = useForm<PersonalFormData>({
+        resolver: zodResolver(personalFormSchema) as Resolver<PersonalFormData>,
+        defaultValues: {
+            email: user?.email || "",
+            firstName: "",
+            lastName: "",
+            primaryUse: "",
+            country: "",
+            phoneNumber: "",
+            agreedToTerms: false,
+            complianceConfirmed: false
+        }
+    });
+
+    const businessForm = useForm<BusinessFormData>({
+        resolver: zodResolver(businessFormSchema) as Resolver<BusinessFormData>,
+        defaultValues: {
+            email: user?.email || "",
+            firstName: "",
+            lastName: "",
+            primaryUse: "",
+            industry: "",
+            companyName: "",
+            companyWebsite: "",
+            companyPhoneNumber: "",
+            agreedToTerms: false,
+            complianceConfirmed: false
+        }
+    });
+
+    React.useEffect(() => {
+        if (open) {
+            resetForm();
+            setGeneratedKey(null);
+            setPersonalUseOnly(false);
+            setSelectedTier("starter");
+        }
+    }, [open]);
+
+    function resetForm() {
+        personalForm.reset({
+            email: user?.email || "",
+            firstName: "",
+            lastName: "",
+            primaryUse: "",
+            country: "",
+            phoneNumber: "",
+            agreedToTerms: false,
+            complianceConfirmed: false
+        });
+        businessForm.reset({
+            email: user?.email || "",
+            firstName: "",
+            lastName: "",
+            primaryUse: "",
+            industry: "",
+            companyName: "",
+            companyWebsite: "",
+            companyPhoneNumber: "",
+            agreedToTerms: false,
+            complianceConfirmed: false
+        });
+    }
+
+    const tierOptions: StrategyOption<"starter" | "scale">[] = [
+        {
+            id: "starter",
+            title: t("newPricingLicenseForm.tiers.starter.title"),
+            description: t("newPricingLicenseForm.tiers.starter.description")
+        },
+        {
+            id: "scale",
+            title: t("newPricingLicenseForm.tiers.scale.title"),
+            description: t("newPricingLicenseForm.tiers.scale.description")
+        }
+    ];
+
+    const submitLicenseRequest = async (
+        payload: Record<string, unknown>
+    ): Promise<void> => {
+        setLoading(true);
+        try {
+            // Check if this is a business/enterprise license request
+            if (!personalUseOnly) {
+                const response = await api.put<AxiosResponse<string>>(
+                    `/org/${orgId}/license/enterprise`,
+                    { ...payload, tier: TIER_TO_LICENSE_ID[selectedTier] }
+                );
+
+                console.log("Checkout session response:", response.data);
+                const checkoutUrl = response.data.data;
+                if (checkoutUrl) {
+                    window.location.href = checkoutUrl;
+                } else {
+                    toast({
+                        title: "Failed to get checkout URL",
+                        description: "Please try again later",
+                        variant: "destructive"
+                    });
+                    setLoading(false);
+                }
+            } else {
+                // Personal license flow
+                const response = await api.put<
+                    AxiosResponse<GenerateNewLicenseResponse>
+                >(`/org/${orgId}/license`, payload);
+
+                if (response.data.data?.licenseKey?.licenseKey) {
+                    setGeneratedKey(response.data.data.licenseKey.licenseKey);
+                    onGenerated?.();
+                    toast({
+                        title: t("generateLicenseKeyForm.toasts.success.title"),
+                        description: t(
+                            "generateLicenseKeyForm.toasts.success.description"
+                        ),
+                        variant: "default"
+                    });
+                }
+            }
+        } catch (e) {
+            console.error(e);
+            toast({
+                title: t("generateLicenseKeyForm.toasts.error.title"),
+                description: formatAxiosError(
+                    e,
+                    t("generateLicenseKeyForm.toasts.error.description")
+                ),
+                variant: "destructive"
+            });
+        }
+        setLoading(false);
+    };
+
+    const onSubmitPersonal = async (values: PersonalFormData) => {
+        await submitLicenseRequest({
+            email: values.email,
+            useCaseType: "personal",
+            personal: {
+                firstName: values.firstName,
+                lastName: values.lastName,
+                aboutYou: { primaryUse: values.primaryUse },
+                personalInfo: {
+                    country: values.country,
+                    phoneNumber: values.phoneNumber || ""
+                }
+            },
+            business: undefined,
+            consent: {
+                agreedToTerms: values.agreedToTerms,
+                acknowledgedPrivacyPolicy: values.agreedToTerms,
+                complianceConfirmed: values.complianceConfirmed
+            }
+        });
+    };
+
+    const onSubmitBusiness = async (values: BusinessFormData) => {
+        const payload = {
+            email: values.email,
+            useCaseType: "business",
+            personal: undefined,
+            business: {
+                firstName: values.firstName,
+                lastName: values.lastName,
+                jobTitle: "N/A",
+                aboutYou: {
+                    primaryUse: values.primaryUse,
+                    industry: values.industry,
+                    prospectiveUsers: 100,
+                    prospectiveSites: 100
+                },
+                companyInfo: {
+                    companyName: values.companyName,
+                    countryOfResidence: "N/A",
+                    stateProvinceRegion: "N/A",
+                    postalZipCode: "N/A",
+                    companyWebsite: values.companyWebsite || "",
+                    companyPhoneNumber: values.companyPhoneNumber || ""
+                }
+            },
+            consent: {
+                agreedToTerms: values.agreedToTerms,
+                acknowledgedPrivacyPolicy: values.agreedToTerms,
+                complianceConfirmed: values.complianceConfirmed
+            }
+        };
+
+        await submitLicenseRequest(payload);
+    };
+
+    const handleClose = () => {
+        setOpen(false);
+        setGeneratedKey(null);
+        resetForm();
+    };
+
+    return (
+        <Credenza open={open} onOpenChange={handleClose}>
+            <CredenzaContent className="max-w-4xl">
+                <CredenzaHeader>
+                    <CredenzaTitle>
+                        {t("newPricingLicenseForm.title")}
+                    </CredenzaTitle>
+                    <CredenzaDescription>
+                        {t("newPricingLicenseForm.description")}
+                    </CredenzaDescription>
+                </CredenzaHeader>
+                <CredenzaBody>
+                    <div className="space-y-6">
+                        {generatedKey ? (
+                            <div className="space-y-4">
+                                <CopyTextBox
+                                    text={generatedKey}
+                                    wrapText={false}
+                                />
+                            </div>
+                        ) : (
+                            <>
+                                {/* Tier selection - required when not personal use */}
+                                {!personalUseOnly && (
+                                    <div className="space-y-2">
+                                        <label className="text-sm font-medium">
+                                            {t(
+                                                "newPricingLicenseForm.chooseTier"
+                                            )}
+                                        </label>
+                                        <StrategySelect
+                                            options={tierOptions}
+                                            defaultValue={selectedTier}
+                                            onChange={(value) =>
+                                                setSelectedTier(value)
+                                            }
+                                            cols={2}
+                                        />
+                                        <a
+                                            href="https://pangolin.net/pricing"
+                                            target="_blank"
+                                            rel="noopener noreferrer"
+                                            className="text-sm text-primary hover:underline"
+                                        >
+                                            {t(
+                                                "newPricingLicenseForm.viewPricingLink"
+                                            )}
+                                        </a>
+                                    </div>
+                                )}
+
+                                {/* Personal use only checkbox at the bottom of options */}
+                                <div className="flex items-center space-x-2">
+                                    <Checkbox
+                                        id="personal-use-only"
+                                        checked={personalUseOnly}
+                                        onCheckedChange={(checked) => {
+                                            setPersonalUseOnly(
+                                                checked === true
+                                            );
+                                            if (checked) {
+                                                businessForm.reset();
+                                            } else {
+                                                personalForm.reset();
+                                            }
+                                        }}
+                                    />
+                                    <label
+                                        htmlFor="personal-use-only"
+                                        className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                                    >
+                                        {t(
+                                            "newPricingLicenseForm.personalUseOnly"
+                                        )}
+                                    </label>
+                                </div>
+
+                                {/* License disclosure - only when personal use */}
+                                {personalUseOnly && (
+                                    <Alert variant="neutral">
+                                        <InfoIcon className="h-4 w-4" />
+                                        <AlertTitle>
+                                            {t(
+                                                "generateLicenseKeyForm.alerts.commercialUseDisclosure.title"
+                                            )}
+                                        </AlertTitle>
+                                        <AlertDescription>
+                                            {t(
+                                                "generateLicenseKeyForm.alerts.commercialUseDisclosure.description"
+                                            )
+                                                .split(
+                                                    "Fossorial Commercial License Terms"
+                                                )
+                                                .map((part, index) => (
+                                                    <span key={index}>
+                                                        {part}
+                                                        {index === 0 && (
+                                                            <a
+                                                                href="https://pangolin.net/fcl.html"
+                                                                target="_blank"
+                                                                rel="noopener noreferrer"
+                                                                className="text-primary hover:underline"
+                                                            >
+                                                                Fossorial
+                                                                Commercial
+                                                                License Terms
+                                                            </a>
+                                                        )}
+                                                    </span>
+                                                ))}
+                                        </AlertDescription>
+                                    </Alert>
+                                )}
+
+                                {/* Personal form: only when personal use only is checked */}
+                                {personalUseOnly && (
+                                    <Form {...personalForm}>
+                                        <form
+                                            onSubmit={personalForm.handleSubmit(
+                                                onSubmitPersonal
+                                            )}
+                                            className="space-y-4"
+                                            id="new-pricing-license-personal-form"
+                                        >
+                                            <div className="grid grid-cols-2 gap-4">
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="firstName"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.firstName"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="lastName"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.lastName"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+
+                                            <FormField
+                                                control={personalForm.control}
+                                                name="primaryUse"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "generateLicenseKeyForm.form.primaryUseQuestion"
+                                                            )}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input {...field} />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+
+                                            <div className="grid grid-cols-2 gap-4">
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="country"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.country"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="phoneNumber"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.phoneNumberOptional"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+
+                                            <div className="space-y-4 pt-4">
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="agreedToTerms"
+                                                    render={({ field }) => (
+                                                        <FormItem className="flex flex-row items-start space-x-3 space-y-0">
+                                                            <FormControl>
+                                                                <Checkbox
+                                                                    checked={
+                                                                        field.value
+                                                                    }
+                                                                    onCheckedChange={
+                                                                        field.onChange
+                                                                    }
+                                                                />
+                                                            </FormControl>
+                                                            <div className="space-y-1 leading-none">
+                                                                <FormLabel className="text-sm font-normal">
+                                                                    <div>
+                                                                        {t(
+                                                                            "signUpTerms.IAgreeToThe"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/terms-of-service.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            {t(
+                                                                                "signUpTerms.termsOfService"
+                                                                            )}{" "}
+                                                                        </a>
+                                                                        {t(
+                                                                            "signUpTerms.and"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/privacy-policy.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            {t(
+                                                                                "signUpTerms.privacyPolicy"
+                                                                            )}
+                                                                        </a>
+                                                                    </div>
+                                                                </FormLabel>
+                                                                <FormMessage />
+                                                            </div>
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        personalForm.control
+                                                    }
+                                                    name="complianceConfirmed"
+                                                    render={({ field }) => (
+                                                        <FormItem className="flex flex-row items-start space-x-3 space-y-0">
+                                                            <FormControl>
+                                                                <Checkbox
+                                                                    checked={
+                                                                        field.value
+                                                                    }
+                                                                    onCheckedChange={
+                                                                        field.onChange
+                                                                    }
+                                                                />
+                                                            </FormControl>
+                                                            <div className="space-y-1 leading-none">
+                                                                <FormLabel className="text-sm font-normal">
+                                                                    <div>
+                                                                        {t(
+                                                                            "generateLicenseKeyForm.form.complianceConfirmation"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/fcl.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            https://pangolin.net/fcl.html
+                                                                        </a>
+                                                                    </div>
+                                                                </FormLabel>
+                                                                <FormMessage />
+                                                            </div>
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+                                        </form>
+                                    </Form>
+                                )}
+
+                                {/* Business form: when not personal use - enter business info then continue to checkout */}
+                                {!personalUseOnly && (
+                                    <Form {...businessForm}>
+                                        <form
+                                            onSubmit={businessForm.handleSubmit(
+                                                onSubmitBusiness
+                                            )}
+                                            className="space-y-4"
+                                            id="new-pricing-license-business-form"
+                                        >
+                                            <div className="grid grid-cols-2 gap-4">
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="firstName"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.firstName"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="lastName"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.lastName"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+
+                                            <FormField
+                                                control={businessForm.control}
+                                                name="primaryUse"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "generateLicenseKeyForm.form.primaryUseQuestion"
+                                                            )}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input {...field} />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+
+                                            <FormField
+                                                control={businessForm.control}
+                                                name="industry"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "generateLicenseKeyForm.form.industryQuestion"
+                                                            )}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input {...field} />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+
+                                            <FormField
+                                                control={businessForm.control}
+                                                name="companyName"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "generateLicenseKeyForm.form.companyName"
+                                                            )}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input {...field} />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+
+                                            <div className="grid grid-cols-2 gap-4">
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="companyWebsite"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.companyWebsite"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="companyPhoneNumber"
+                                                    render={({ field }) => (
+                                                        <FormItem>
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "generateLicenseKeyForm.form.companyPhoneNumber"
+                                                                )}
+                                                            </FormLabel>
+                                                            <FormControl>
+                                                                <Input
+                                                                    {...field}
+                                                                />
+                                                            </FormControl>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+
+                                            <div className="space-y-4 pt-4">
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="agreedToTerms"
+                                                    render={({ field }) => (
+                                                        <FormItem className="flex flex-row items-start space-x-3 space-y-0">
+                                                            <FormControl>
+                                                                <Checkbox
+                                                                    checked={
+                                                                        field.value
+                                                                    }
+                                                                    onCheckedChange={
+                                                                        field.onChange
+                                                                    }
+                                                                />
+                                                            </FormControl>
+                                                            <div className="space-y-1 leading-none">
+                                                                <FormLabel className="text-sm font-normal">
+                                                                    <div>
+                                                                        {t(
+                                                                            "signUpTerms.IAgreeToThe"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/terms-of-service.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            {t(
+                                                                                "signUpTerms.termsOfService"
+                                                                            )}{" "}
+                                                                        </a>
+                                                                        {t(
+                                                                            "signUpTerms.and"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/privacy-policy.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            {t(
+                                                                                "signUpTerms.privacyPolicy"
+                                                                            )}
+                                                                        </a>
+                                                                    </div>
+                                                                </FormLabel>
+                                                                <FormMessage />
+                                                            </div>
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                                <FormField
+                                                    control={
+                                                        businessForm.control
+                                                    }
+                                                    name="complianceConfirmed"
+                                                    render={({ field }) => (
+                                                        <FormItem className="flex flex-row items-start space-x-3 space-y-0">
+                                                            <FormControl>
+                                                                <Checkbox
+                                                                    checked={
+                                                                        field.value
+                                                                    }
+                                                                    onCheckedChange={
+                                                                        field.onChange
+                                                                    }
+                                                                />
+                                                            </FormControl>
+                                                            <div className="space-y-1 leading-none">
+                                                                <FormLabel className="text-sm font-normal">
+                                                                    <div>
+                                                                        {t(
+                                                                            "generateLicenseKeyForm.form.complianceConfirmation"
+                                                                        )}{" "}
+                                                                        <a
+                                                                            href="https://pangolin.net/fcl.html"
+                                                                            target="_blank"
+                                                                            rel="noopener noreferrer"
+                                                                            className="text-primary hover:underline"
+                                                                        >
+                                                                            https://pangolin.net/fcl.html
+                                                                        </a>
+                                                                    </div>
+                                                                </FormLabel>
+                                                                <FormMessage />
+                                                            </div>
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </div>
+                                        </form>
+                                    </Form>
+                                )}
+                            </>
+                        )}
+                    </div>
+                </CredenzaBody>
+                <CredenzaFooter>
+                    <CredenzaClose asChild>
+                        <Button variant="outline">
+                            {t("generateLicenseKeyForm.buttons.close")}
+                        </Button>
+                    </CredenzaClose>
+
+                    {!generatedKey && personalUseOnly && (
+                        <Button
+                            type="submit"
+                            form="new-pricing-license-personal-form"
+                            disabled={loading}
+                            loading={loading}
+                        >
+                            {t(
+                                "generateLicenseKeyForm.buttons.generateLicenseKey"
+                            )}
+                        </Button>
+                    )}
+
+                    {!generatedKey && !personalUseOnly && (
+                        <Button
+                            type="submit"
+                            form="new-pricing-license-business-form"
+                            disabled={loading}
+                            loading={loading}
+                        >
+                            {t(
+                                "newPricingLicenseForm.buttons.continueToCheckout"
+                            )}
+                        </Button>
+                    )}
+                </CredenzaFooter>
+            </CredenzaContent>
+        </Credenza>
+    );
+}

src/components/RedirectToOrg.tsx

@@ -0,0 +1,24 @@
+"use client";
+
+import { useEffect } from "react";
+import { useRouter } from "next/navigation";
+import { getInternalRedirectTarget } from "@app/lib/internalRedirect";
+
+type RedirectToOrgProps = {
+    targetOrgId: string;
+};
+
+export default function RedirectToOrg({ targetOrgId }: RedirectToOrgProps) {
+    const router = useRouter();
+
+    useEffect(() => {
+        try {
+            const target = getInternalRedirectTarget(targetOrgId);
+            router.replace(target);
+        } catch {
+            router.replace(`/${targetOrgId}`);
+        }
+    }, [targetOrgId, router]);
+
+    return null;
+}

src/components/StoreInternalRedirect.tsx

@@ -0,0 +1,27 @@
+"use client";
+
+import { useEffect } from "react";
+import { INTERNAL_REDIRECT_KEY } from "@app/lib/internalRedirect";
+
+const TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+export default function StoreInternalRedirect() {
+    useEffect(() => {
+        if (typeof window === "undefined") return;
+        const params = new URLSearchParams(window.location.search);
+        const value = params.get("internal_redirect");
+        if (value != null && value !== "") {
+            try {
+                const payload = JSON.stringify({
+                    path: value,
+                    expiresAt: Date.now() + TTL_MS
+                });
+                window.localStorage.setItem(INTERNAL_REDIRECT_KEY, payload);
+            } catch {
+                // ignore
+            }
+        }
+    }, []);
+
+    return null;
+}

src/components/SupporterStatus.tsx

@@ -226,6 +226,21 @@ export default function SupporterStatus({
                             </Link>
                         </p>
 
+                        <div className="my-4 p-4 border border-blue-500/50 bg-blue-500/10 rounded-lg">
+                            <p className="text-sm">
+                                <strong>Business & Enterprise Users:</strong> For larger organizations or teams requiring advanced features, consider our self-serve enterprise license and Enterprise Edition.{" "}
+                                <Link
+                                    href="https://pangolin.net/pricing?hosting=self-host"
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    className="underline inline-flex items-center gap-1"
+                                >
+                                    Learn more
+                                    <ExternalLink className="h-3 w-3" />
+                                </Link>
+                            </p>
+                        </div>
+
                         <div className="py-6">
                             <p className="mb-3 text-center">
                                 {t("supportKeyOptions")}

src/components/Toploader.tsx

@@ -1,41 +1,13 @@
 "use client";
-import * as React from "react";
-import * as NProgress from "nprogress";
+
 import NextTopLoader from "nextjs-toploader";
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
 
 export function TopLoader() {
-    return (
-        <>
-            <NextTopLoader showSpinner={false} color="var(--color-primary)" />
-            <FinishingLoader />
-        </>
-    );
-}
-
-function FinishingLoader() {
-    const pathname = usePathname();
-    const router = useRouter();
-    const searchParams = useSearchParams();
-    React.useEffect(() => {
-        NProgress.done();
-    }, [pathname, router, searchParams]);
-    React.useEffect(() => {
-        const linkClickListener = (ev: MouseEvent) => {
-            const element = ev.target as HTMLElement;
-            const closestlink = element.closest("a");
-            const isOpenToNewTabClick =
-                ev.ctrlKey ||
-                ev.shiftKey ||
-                ev.metaKey || // apple
-                (ev.button && ev.button == 1); // middle click, >IE9 + everyone else
-
-            if (closestlink && isOpenToNewTabClick) {
-                NProgress.done();
-            }
-        };
-        window.addEventListener("click", linkClickListener);
-        return () => window.removeEventListener("click", linkClickListener);
-    }, []);
-    return null;
+  return (
+    <NextTopLoader
+      color="var(--color-primary)"
+      showSpinner={false}
+      height={2}
+    />
+  );
 }

src/components/ViewDevicesDialog.tsx

@@ -28,7 +28,6 @@ import {
     TableRow
 } from "@app/components/ui/table";
 import { Tabs, TabsList, TabsTrigger, TabsContent } from "@app/components/ui/tabs";
-import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { Loader2, RefreshCw } from "lucide-react";
 import moment from "moment";
 import { useUserContext } from "@app/hooks/useUserContext";
@@ -59,8 +58,6 @@ export default function ViewDevicesDialog({
 
     const [devices, setDevices] = useState<Device[]>([]);
     const [loading, setLoading] = useState(false);
-    const [isArchiveModalOpen, setIsArchiveModalOpen] = useState(false);
-    const [selectedDevice, setSelectedDevice] = useState<Device | null>(null);
     const [activeTab, setActiveTab] = useState<"available" | "archived">("available");
 
     const fetchDevices = async () => {
@@ -108,8 +105,6 @@ export default function ViewDevicesDialog({
                     d.olmId === olmId ? { ...d, archived: true } : d
                 )
             );
-            setIsArchiveModalOpen(false);
-            setSelectedDevice(null);
         } catch (error: any) {
             console.error("Error archiving device:", error);
             toast({
@@ -153,8 +148,6 @@ export default function ViewDevicesDialog({
 
     function reset() {
         setDevices([]);
-        setSelectedDevice(null);
-        setIsArchiveModalOpen(false);
     }
 
     return (
@@ -263,12 +256,7 @@ export default function ViewDevicesDialog({
                                                     <Button
                                                         variant="outline"
                                                         onClick={() => {
-                                                            setSelectedDevice(
-                                                                device
-                                                            );
-                                                                            setIsArchiveModalOpen(
-                                                                true
-                                                            );
+                                                            archiveDevice(device.olmId);
                                                         }}
                                                     >
                                                                         {t(
@@ -361,34 +349,6 @@ export default function ViewDevicesDialog({
                     </CredenzaFooter>
                 </CredenzaContent>
             </Credenza>
-
-            {selectedDevice && (
-                <ConfirmDeleteDialog
-                    open={isArchiveModalOpen}
-                    setOpen={(val) => {
-                        setIsArchiveModalOpen(val);
-                        if (!val) {
-                            setSelectedDevice(null);
-                        }
-                    }}
-                    dialog={
-                        <div className="space-y-2">
-                            <p>
-                                {t("deviceQuestionArchive") ||
-                                    "Are you sure you want to archive this device?"}
-                            </p>
-                            <p>
-                                {t("deviceMessageArchive") ||
-                                    "The device will be archived and removed from your active devices list."}
-                            </p>
-                        </div>
-                    }
-                    buttonText={t("deviceArchiveConfirm") || "Archive Device"}
-                    onConfirm={async () => archiveDevice(selectedDevice.olmId)}
-                    string={selectedDevice.name || selectedDevice.olmId}
-                    title={t("archiveDevice") || "Archive Device"}
-                />
-            )}
         </>
     );
 }

src/components/newt-install-commands.tsx

@@ -91,7 +91,7 @@ export function NewtSiteInstallCommands({
       - NEWT_SECRET=${secret}${acceptClientsEnv}`
             ],
             "Docker Run": [
-                `docker run -dit fosrl/newt --id ${id} --secret ${secret} --endpoint ${endpoint}${acceptClientsFlag}`
+                `docker run -dit --network host fosrl/newt --id ${id} --secret ${secret} --endpoint ${endpoint}${acceptClientsFlag}`
             ]
         },
         kubernetes: {

src/contexts/subscriptionStatusContext.ts

@@ -5,7 +5,7 @@ type SubscriptionStatusContextType = {
     subscriptionStatus: GetOrgSubscriptionResponse | null;
     updateSubscriptionStatus: (updatedSite: GetOrgSubscriptionResponse) => void;
     isActive: () => boolean;
-    getTier: () => string | null;
+    getTier: () => { tier: string | null; active: boolean };
     isSubscribed: () => boolean;
     subscribed: boolean;
 };

src/lib/api/isOrgSubscribed.ts

@@ -1,5 +1,4 @@
 import { build } from "@server/build";
-import { TierId } from "@server/lib/billing/tiers";
 import { cache } from "react";
 import { getCachedSubscription } from "./getCachedSubscription";
 import { priv } from ".";
@@ -21,7 +20,7 @@ export const isOrgSubscribed = cache(async (orgId: string) => {
         try {
             const subRes = await getCachedSubscription(orgId);
             subscribed =
-                subRes.data.data.tier === TierId.STANDARD &&
+                (subRes.data.data.tier == "home_lab" || subRes.data.data.tier == "starter" || subRes.data.data.tier == "scale") &&
                 subRes.data.data.active;
         } catch {}
     }

src/lib/cleanRedirect.ts

@@ -1,6 +1,8 @@
 type CleanRedirectOptions = {
     fallback?: string;
     maxRedirectDepth?: number;
+    /** When true, preserve all query params on the path (for internal redirects). Default false. */
+    allowAllQueryParams?: boolean;
 };
 
 const ALLOWED_QUERY_PARAMS = new Set([
@@ -16,14 +18,18 @@ export function cleanRedirect(
     input: string,
     options: CleanRedirectOptions = {}
 ): string {
-    const { fallback = "/", maxRedirectDepth = 2 } = options;
+    const {
+        fallback = "/",
+        maxRedirectDepth = 2,
+        allowAllQueryParams = false
+    } = options;
 
     if (!input || typeof input !== "string") {
         return fallback;
     }
 
     try {
-        return sanitizeUrl(input, fallback, maxRedirectDepth);
+        return sanitizeUrl(input, fallback, maxRedirectDepth, allowAllQueryParams);
     } catch {
         return fallback;
     }
@@ -32,7 +38,8 @@ export function cleanRedirect(
 function sanitizeUrl(
     input: string,
     fallback: string,
-    remainingRedirectDepth: number
+    remainingRedirectDepth: number,
+    allowAllQueryParams: boolean = false
 ): string {
     if (
         input.startsWith("javascript:") ||
@@ -56,7 +63,7 @@ function sanitizeUrl(
     const cleanParams = new URLSearchParams();
 
     for (const [key, value] of url.searchParams.entries()) {
-        if (!ALLOWED_QUERY_PARAMS.has(key)) {
+        if (!allowAllQueryParams && !ALLOWED_QUERY_PARAMS.has(key)) {
             continue;
         }
 
@@ -68,7 +75,8 @@ function sanitizeUrl(
             const cleanedRedirect = sanitizeUrl(
                 value,
                 "",
-                remainingRedirectDepth - 1
+                remainingRedirectDepth - 1,
+                allowAllQueryParams
             );
 
             if (cleanedRedirect) {

src/lib/internalRedirect.ts

@@ -0,0 +1,51 @@
+import { cleanRedirect } from "@app/lib/cleanRedirect";
+
+export const INTERNAL_REDIRECT_KEY = "internal_redirect";
+
+/**
+ * Consumes the internal_redirect value from localStorage if present and valid
+ * (within TTL). Removes it from storage. Returns the path segment (with leading
+ * slash) to append to an orgId, or null if none/expired/invalid.
+ */
+export function consumeInternalRedirectPath(): string | null {
+    if (typeof window === "undefined") return null;
+    try {
+        const raw = window.localStorage.getItem(INTERNAL_REDIRECT_KEY);
+        if (raw == null || raw === "") return null;
+
+        window.localStorage.removeItem(INTERNAL_REDIRECT_KEY);
+
+        const { path: storedPath, expiresAt } = JSON.parse(raw) as {
+            path?: string;
+            expiresAt?: number;
+        };
+        if (
+            typeof storedPath !== "string" ||
+            storedPath === "" ||
+            typeof expiresAt !== "number" ||
+            Date.now() > expiresAt
+        ) {
+            return null;
+        }
+
+        const cleaned = cleanRedirect(storedPath, {
+            fallback: "",
+            allowAllQueryParams: true
+        });
+        if (!cleaned) return null;
+
+        return cleaned.startsWith("/") ? cleaned : `/${cleaned}`;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Returns the full redirect target for an org: either `/${orgId}` or
+ * `/${orgId}${path}` if a valid internal_redirect was stored. Consumes the
+ * stored value.
+ */
+export function getInternalRedirectTarget(orgId: string): string {
+    const path = consumeInternalRedirectPath();
+    return path ? `/${orgId}${path}` : `/${orgId}`;
+}

src/providers/SubscriptionStatusProvider.tsx

@@ -1,7 +1,6 @@
 "use client";
 
 import SubscriptionStatusContext from "@app/contexts/subscriptionStatusContext";
-import { getTierPriceSet, TierId } from "@server/lib/billing/tiers";
 import { GetOrgSubscriptionResponse } from "@server/routers/billing/types";
 import { useState } from "react";
 import { build } from "@server/build";
@@ -33,36 +32,47 @@ export function SubscriptionStatusProvider({
     };
 
     const isActive = () => {
-        if (subscriptionStatus?.subscription?.status === "active") {
-            return true;
+        if (subscriptionStatus?.subscriptions) {
+            // Check if any subscription is active
+            return subscriptionStatus.subscriptions.some(
+                (sub) => sub.subscription?.status === "active"
+            );
         }
         return false;
     };
 
     const getTier = () => {
-        const tierPriceSet = getTierPriceSet(env, sandbox_mode);
-
-        if (subscriptionStatus?.items && subscriptionStatus.items.length > 0) {
-            // Iterate through tiers in order (earlier keys are higher tiers)
-            for (const [tierId, priceId] of Object.entries(tierPriceSet)) {
-                // Check if any subscription item matches this tier's price ID
-                const matchingItem = subscriptionStatus.items.find(
-                    (item) => item.priceId === priceId
-                );
-                if (matchingItem) {
-                    return tierId;
+        if (subscriptionStatus?.subscriptions) {
+            // Iterate through all subscriptions
+            for (const { subscription } of subscriptionStatus.subscriptions) {
+                if (
+                    subscription.type == "home_lab" ||
+                    subscription.type == "starter" ||
+                    subscription.type == "scale"
+                ) {
+                    return {
+                        tier: subscription.type,
+                        active: subscription.status === "active"
+                    };
                 }
             }
         }
 
-        return null;
+        return {
+            tier: null,
+            active: false
+        };
     };
 
     const isSubscribed = () => {
         if (build === "enterprise") {
             return true;
         }
-        return getTier() === TierId.STANDARD;
+        const { tier, active } = getTier();
+        return (
+            (tier == "home_lab" || tier == "starter" || tier == "scale") &&
+            active
+        );
     };
 
     const [subscribed, setSubscribed] = useState<boolean>(isSubscribed());