update readme

New Crowdin updates

README.md

@@ -41,7 +41,7 @@
     </strong>
 </p>
 
-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.
 
 ## Installation
 
@@ -63,11 +63,26 @@ Pangolin is an open-source, identity-based remote access platform built on WireG
 
 Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
 
+* Lightweight user-space connector runs anywhere
+* Punches through any firewall
+* Doesn't require open ports or a public IP
+* Strict network segmentation
+* WireGuard-based
+* Get alerts when a device or network resource goes down
+
 <img src="public/screenshots/sites.png" alt="Sites" width="100%" />
 
 ### Browser-based reverse proxy access
 
-Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+
+* Expose a web panel anywhere
+* Access via any web browser
+* Single sign-on across all resources
+* HTTPS resources
+* Remote desktop in the browser with VNC and RDP
+* In-browser SSH terminal with privileged access management (PAM)
+* PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more
 
 <img src="public/clip.gif" alt="Reverse proxy access" width="100%" />
 
@@ -75,14 +90,35 @@ Expose web applications through identity and context-aware tunneled reverse prox
 
 Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
 
+* Peer-to-peer with intelligent NAT traversal
+* Hosts/IPs and port ranges
+* Network ranges/CIDRs
+* Friendly DNS aliases for network addresses
+* Privileged access management (PAM) with SSH resources
+* Private HTTPS resources only accessible on the private network
+
 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />
 
 ### Give users and roles access to resources
 
-Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+
+* Bring your existing identity provider (IdP) or use Pangolin identities
+* Sync users and roles from your IdP
+* User- and role-based access control
+* Full network audit and access logs
 
 <img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />
 
+### Find and launch resources from a personalized home page
+
+Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.
+
+* Single place for admins and non-admins to see accessible resources
+* Create reusable views for common access patterns
+
+<img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+
 ## Download Clients
 
 Download the Pangolin client for your platform:

messages/bg-BG.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Генериране на токен за достъп",
     "actionDeleteAccessToken": "Изтриване на токен за достъп",
     "actionListAccessTokens": "Изброяване на токени за достъп",
+    "actionCreateResourceSessionToken": "Създаване на токен за сесия на ресурс",
     "actionCreateResourceRule": "Създаване на правило за ресурс",
     "actionDeleteResourceRule": "Изтрийте правило за ресурс",
     "actionListResourceRules": "Изброяване на правила за ресурс",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Затвори",
     "createInternalResourceDialogCreateClientResource": "Създаване на частен ресурс",
     "createInternalResourceDialogCreateClientResourceDescription": "Създайте нов ресурс, който ще бъде достъпен само за клиенти, свързани към организацията",
+    "privateResourceGeneralDescription": "Конфигурирайте името, идентификатора и другите общи настройки на ресурса.",
     "privateResourceCreatePageSeeAll": "Вижте всички частни ресурси",
     "privateResourceAllowIcmpPing": "Разрешете ICMP Ping",
     "privateResourceNetworkAccess": "Достъп до мрежата",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Добавяне на потребители.",
     "editInternalResourceDialogAddClients": "Добавяне на клиенти.",
     "editInternalResourceDialogDestinationLabel": "Дестинация.",
-    "editInternalResourceDialogDestinationDescription": "Изберете къде работи този ресурс и как клиентите го достигат",
+    "editInternalResourceDialogDestinationDescription": "Конфигурирайте как клиентите да достигнат до този ресурс.",
     "internalResourceFormMultiSiteRoutingHelp": "Избирайки няколко сайта, се осигурява сигурен път и пренасочване при висока достъпност.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Научете повече",
     "editInternalResourceDialogPortRestrictionsDescription": "Ограничете достъпа до конкретни TCP/UDP портове или позволете/блокирайте всички портове.",

messages/cs-CZ.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generovat přístupový token",
     "actionDeleteAccessToken": "Odstranit přístupový token",
     "actionListAccessTokens": "Seznam přístupových tokenů",
+    "actionCreateResourceSessionToken": "Vytvořit token relace prostředku",
     "actionCreateResourceRule": "Vytvořit pravidlo pro zdroj",
     "actionDeleteResourceRule": "Odstranit pravidlo pro dokument",
     "actionListResourceRules": "Seznam pravidel zdrojů",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Zavřít",
     "createInternalResourceDialogCreateClientResource": "Vytvořit soukromý zdroj",
     "createInternalResourceDialogCreateClientResourceDescription": "Vytvořte nový zdroj, který bude přístupný pouze klientům připojeným k organizaci",
+    "privateResourceGeneralDescription": "Nastavte název, identifikátor a další obecná nastavení zdroje.",
     "privateResourceCreatePageSeeAll": "Zobrazit všechny privátní zdroje",
     "privateResourceAllowIcmpPing": "Povolit ICMP ping",
     "privateResourceNetworkAccess": "Přístup k síti",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Přidat uživatele",
     "editInternalResourceDialogAddClients": "Přidat klienty",
     "editInternalResourceDialogDestinationLabel": "Cíl",
-    "editInternalResourceDialogDestinationDescription": "Vyberte, kde bude tento zdroj spuštěn a jak ho klienti dosáhnou",
+    "editInternalResourceDialogDestinationDescription": "Nakonfigurujte, jak klienti dosáhnou tohoto zdroje.",
     "internalResourceFormMultiSiteRoutingHelp": "Výběrem více webů se povolí odolné směrování a přepojení pro vysokou dostupnost.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Zjistit více",
     "editInternalResourceDialogPortRestrictionsDescription": "Omezte přístup na specifické TCP/UDP porty nebo povolte/blokujte všechny porty.",

messages/da-DK.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generer adgangstoken",
     "actionDeleteAccessToken": "Slet adgangstoken",
     "actionListAccessTokens": "Vis adgangstokens",
+    "actionCreateResourceSessionToken": "Opret ressourcessession token",
     "actionCreateResourceRule": "Opret ressourceregel",
     "actionDeleteResourceRule": "Slet ressourceregel",
     "actionListResourceRules": "Vis ressourceregler",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Luk",
     "createInternalResourceDialogCreateClientResource": "Opret privat ressource",
     "createInternalResourceDialogCreateClientResourceDescription": "Opret en ny ressource som kun vil være tilgængelig for kunder som er forbundet til organisationen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren, og andre generelle indstillinger for ressourcen.",
     "privateResourceCreatePageSeeAll": "Se alle private ressourcer",
     "privateResourceAllowIcmpPing": "Tillad ICMP-ping",
     "privateResourceNetworkAccess": "Netværksadgang",
@@ -2546,7 +2548,7 @@
     "noRemoteExitNodesAvailableDescription": "Ingen noder er tilgængelige for denne organisation. Opret en node først for at bruge lokale sites.",
     "exitNode": "Exitnode",
     "country": "Land",
-    "countryIsNot": "Country Is Not",
+    "countryIsNot": "Land er ikke",
     "rulesMatchCountry": "I øjeblikket baseret på kilde-IP",
     "region": "Fylke",
     "selectRegion": "Vælg region",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Tilføj brugere",
     "editInternalResourceDialogAddClients": "Tilføj klienter",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får adgang til denne ressource.",
     "internalResourceFormMultiSiteRoutingHelp": "Valg af flere sites muliggør robust routing og failover for høj tilgængelighed.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Læs mere",
     "editInternalResourceDialogPortRestrictionsDescription": "Begrens adgang til specifikke TCP/UDP-porte eller tillade/blokere alle porte.",

messages/de-DE.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Zugriffstoken generieren",
     "actionDeleteAccessToken": "Zugriffstoken löschen",
     "actionListAccessTokens": "Zugriffstoken auflisten",
+    "actionCreateResourceSessionToken": "Ressourcensitzungstoken erstellen",
     "actionCreateResourceRule": "Ressourcenregel erstellen",
     "actionDeleteResourceRule": "Ressourcenregel löschen",
     "actionListResourceRules": "Ressourcenregeln auflisten",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Schließen",
     "createInternalResourceDialogCreateClientResource": "Private Ressource erstellen",
     "createInternalResourceDialogCreateClientResourceDescription": "Erstelle eine neue Ressource, die nur für Clients zugänglich ist, die mit der Organisation verbunden sind",
+    "privateResourceGeneralDescription": "Konfigurieren Sie den Namen, die Kennung und andere allgemeine Ressourceneinstellungen.",
     "privateResourceCreatePageSeeAll": "Alle privaten Ressourcen anzeigen",
     "privateResourceAllowIcmpPing": "ICMP-Ping zulassen",
     "privateResourceNetworkAccess": "Netzwerkzugriff",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Nutzer hinzufügen",
     "editInternalResourceDialogAddClients": "Clients hinzufügen",
     "editInternalResourceDialogDestinationLabel": "Ziel",
-    "editInternalResourceDialogDestinationDescription": "Wählen Sie aus, wo diese Ressource läuft und wie Clients darauf zugreifen können",
+    "editInternalResourceDialogDestinationDescription": "Konfigurieren Sie, wie Clients diese Ressource erreichen.",
     "internalResourceFormMultiSiteRoutingHelp": "Durch die Auswahl mehrerer Seiten wird ein ausfallsicheres Routing und Failover für hohe Verfügbarkeit ermöglicht.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Mehr erfahren",
     "editInternalResourceDialogPortRestrictionsDescription": "Den Zugriff auf bestimmte TCP/UDP-Ports beschränken oder alle Ports erlauben/blockieren.",
@@ -3679,7 +3681,7 @@
     "resourceLauncherSaveForEveryoneDescription": "Teilen Sie diese Ansicht mit allen Organisationsmitgliedern. Wenn nicht aktiviert, ist die Ansicht nur für Sie sichtbar.",
     "resourceLauncherMakePersonal": "Persönlich machen",
     "resourceLauncherFilter": "Filter",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Filter, {count} angewendet",
     "resourceLauncherSort": "Sortieren",
     "resourceLauncherSortAscending": "Aufsteigend sortieren",
     "resourceLauncherSortDescending": "Absteigend sortieren",

messages/en-US.json

@@ -1397,6 +1397,7 @@
     "createOrgUser": "Create Org User",
     "actionUpdateOrg": "Update Organization",
     "actionRemoveInvitation": "Remove Invitation",
+    "actionRemoveUserRole": "Remove User Role",
     "actionUpdateUser": "Update User",
     "actionGetUser": "Get User",
     "actionGetOrgUser": "Get Organization User",
@@ -1462,6 +1463,7 @@
     "actionGenerateAccessToken": "Generate Access Token",
     "actionDeleteAccessToken": "Delete Access Token",
     "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
     "actionCreateResourceRule": "Create Resource Rule",
     "actionDeleteResourceRule": "Delete Resource Rule",
     "actionListResourceRules": "List Resource Rules",
@@ -2392,6 +2394,7 @@
     "createInternalResourceDialogClose": "Close",
     "createInternalResourceDialogCreateClientResource": "Create Private Resource",
     "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
+    "privateResourceGeneralDescription": "Configure the name, identifier, and other general resource settings.",
     "privateResourceCreatePageSeeAll": "See All Private Resources",
     "privateResourceAllowIcmpPing": "Allow ICMP Ping",
     "privateResourceNetworkAccess": "Network Access",
@@ -3268,7 +3271,7 @@
     "editInternalResourceDialogAddUsers": "Add Users",
     "editInternalResourceDialogAddClients": "Add Clients",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Configure how clients reach this resource.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Learn more",
     "editInternalResourceDialogPortRestrictionsDescription": "Restrict access to specific TCP/UDP ports or allow/block all ports.",

messages/es-ES.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generar token de acceso",
     "actionDeleteAccessToken": "Eliminar token de acceso",
     "actionListAccessTokens": "Lista de Tokens de Acceso",
+    "actionCreateResourceSessionToken": "Crear Token de Sesión de Recurso",
     "actionCreateResourceRule": "Crear Regla de Recursos",
     "actionDeleteResourceRule": "Eliminar Regla de Recurso",
     "actionListResourceRules": "Lista de Reglas de Recursos",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Cerrar",
     "createInternalResourceDialogCreateClientResource": "Crear recurso privado",
     "createInternalResourceDialogCreateClientResourceDescription": "Crear un nuevo recurso que sólo será accesible a los clientes conectados a la organización",
+    "privateResourceGeneralDescription": "Configura el nombre, identificador y otros ajustes generales del recurso.",
     "privateResourceCreatePageSeeAll": "Ver todos los recursos privados",
     "privateResourceAllowIcmpPing": "Permitir ping ICMP",
     "privateResourceNetworkAccess": "Acceso de red",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Agregar usuarios",
     "editInternalResourceDialogAddClients": "Agregar clientes",
     "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Elija dónde se ejecuta este recurso y cómo lo alcanzan los clientes",
+    "editInternalResourceDialogDestinationDescription": "Configura cómo los clientes acceden a este recurso.",
     "internalResourceFormMultiSiteRoutingHelp": "Seleccionar múltiples sitios habilita el enrutamiento resistente y la conmutación por error para alta disponibilidad.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Más información",
     "editInternalResourceDialogPortRestrictionsDescription": "Restringir el acceso a puertos TCP/UDP específicos o permitir/bloquear todos los puertos.",

messages/fr-FR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Générer un jeton d'accès",
     "actionDeleteAccessToken": "Supprimer un jeton d'accès",
     "actionListAccessTokens": "Lister les jetons d'accès",
+    "actionCreateResourceSessionToken": "Créer un jeton de session de ressource",
     "actionCreateResourceRule": "Créer une règle de ressource",
     "actionDeleteResourceRule": "Supprimer une règle de ressource",
     "actionListResourceRules": "Lister les règles de ressource",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Fermer",
     "createInternalResourceDialogCreateClientResource": "Créer une ressource privée",
     "createInternalResourceDialogCreateClientResourceDescription": "Créer une nouvelle ressource qui ne sera accessible qu'aux clients connectés à l'organisation",
+    "privateResourceGeneralDescription": "Configurez le nom, l'identifiant et d'autres paramètres généraux de la ressource.",
     "privateResourceCreatePageSeeAll": "Voir toutes les ressources privées",
     "privateResourceAllowIcmpPing": "Autoriser le ping ICMP",
     "privateResourceNetworkAccess": "Accès au réseau",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Ajouter des utilisateurs",
     "editInternalResourceDialogAddClients": "Ajouter des clients",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choisissez où cette ressource fonctionne et comment les clients l'atteignent",
+    "editInternalResourceDialogDestinationDescription": "Configurez comment les clients accèdent à cette ressource.",
     "internalResourceFormMultiSiteRoutingHelp": "La sélection de plusieurs sites permet un routage résilient et un basculement pour une haute disponibilité.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "En savoir plus",
     "editInternalResourceDialogPortRestrictionsDescription": "Restreindre l'accès à des ports TCP/UDP spécifiques ou autoriser/bloquer tous les ports.",

messages/it-IT.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Genera Token di Accesso",
     "actionDeleteAccessToken": "Elimina Token di Accesso",
     "actionListAccessTokens": "Elenca Token di Accesso",
+    "actionCreateResourceSessionToken": "Crea Token di Sessione della Risorsa",
     "actionCreateResourceRule": "Crea Regola Risorsa",
     "actionDeleteResourceRule": "Elimina Regola Risorsa",
     "actionListResourceRules": "Elenca Regole Risorsa",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Chiudi",
     "createInternalResourceDialogCreateClientResource": "Crea Risorsa Privata",
     "createInternalResourceDialogCreateClientResourceDescription": "Crea una nuova risorsa che sarà accessibile solo ai client connessi all'organizzazione",
+    "privateResourceGeneralDescription": "Configura il nome, l'identificativo e altre impostazioni generali delle risorse.",
     "privateResourceCreatePageSeeAll": "Vedi Tutte le Risorse Private",
     "privateResourceAllowIcmpPing": "Consenti ICMP Ping",
     "privateResourceNetworkAccess": "Accesso alla Rete",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Aggiungi Utenti",
     "editInternalResourceDialogAddClients": "Aggiungi Clienti",
     "editInternalResourceDialogDestinationLabel": "Destinazione",
-    "editInternalResourceDialogDestinationDescription": "Scegli dove eseguire questa risorsa e come i client lo raggiungono",
+    "editInternalResourceDialogDestinationDescription": "Configura come i client raggiungono questa risorsa.",
     "internalResourceFormMultiSiteRoutingHelp": "Selezionare più siti consente un routing resiliente e Failover per alta disponibilità.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Scopri di più",
     "editInternalResourceDialogPortRestrictionsDescription": "Limita l'accesso a porte TCP/UDP specifiche o consenti/blocca tutte le porte.",

messages/ko-KR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "액세스 토큰 생성",
     "actionDeleteAccessToken": "액세스 토큰 삭제",
     "actionListAccessTokens": "액세스 토큰 목록",
+    "actionCreateResourceSessionToken": "리소스 세션 토큰 생성",
     "actionCreateResourceRule": "리소스 규칙 생성",
     "actionDeleteResourceRule": "리소스 규칙 삭제",
     "actionListResourceRules": "리소스 규칙 목록",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "닫기",
     "createInternalResourceDialogCreateClientResource": "사이트 리소스 생성",
     "createInternalResourceDialogCreateClientResourceDescription": "선택한 사이트에 연결된 클라이언트에 접근할 새 리소스를 생성합니다",
+    "privateResourceGeneralDescription": "이름, 식별자, 기타 일반 리소스 설정을 구성합니다.",
     "privateResourceCreatePageSeeAll": "모든 개인 리소스 보기",
     "privateResourceAllowIcmpPing": "ICMP 핑 허용",
     "privateResourceNetworkAccess": "네트워크 접근",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "사용자 추가",
     "editInternalResourceDialogAddClients": "클라이언트 추가",
     "editInternalResourceDialogDestinationLabel": "대상지",
-    "editInternalResourceDialogDestinationDescription": "이 리소스가 실행되는 위치와 고객이 도달하는 방법 선택",
+    "editInternalResourceDialogDestinationDescription": "클라이언트가 이 리소스에 어떻게 도달하는지 구성합니다.",
     "internalResourceFormMultiSiteRoutingHelp": "다중 사이트를 선택하면 높은 가용성을 위해 회복력 있는 라우팅 및 페일오버가 가능해집니다.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "자세히 알아보기",
     "editInternalResourceDialogPortRestrictionsDescription": "특정 TCP/UDP 포트에 대한 접근을 제한하거나 모든 포트를 허용/차단하십시오.",

messages/nb-NO.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generer tilgangstoken",
     "actionDeleteAccessToken": "Slett tilgangstoken",
     "actionListAccessTokens": "List opp tilgangstokener",
+    "actionCreateResourceSessionToken": "Opprett ressurs økt-token",
     "actionCreateResourceRule": "Opprett ressursregel",
     "actionDeleteResourceRule": "Slett ressursregel",
     "actionListResourceRules": "List opp ressursregler",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Lukk",
     "createInternalResourceDialogCreateClientResource": "Opprett privat ressurs",
     "createInternalResourceDialogCreateClientResourceDescription": "Opprett en ny ressurs som bare vil være tilgjengelig for kunder som er koblet til organisasjonen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren og andre generelle ressursinnstillinger.",
     "privateResourceCreatePageSeeAll": "Se alle private ressurser",
     "privateResourceAllowIcmpPing": "Tillat ICMP Ping",
     "privateResourceNetworkAccess": "Nettverkstilgang",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Legg til brukere",
     "editInternalResourceDialogAddClients": "Legg til klienter",
     "editInternalResourceDialogDestinationLabel": "Destinasjon",
-    "editInternalResourceDialogDestinationDescription": "Velg hvor denne ressursen kjører og hvordan klienter når den",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får tilgang til denne ressursen.",
     "internalResourceFormMultiSiteRoutingHelp": "Valg av flere nettsteder muliggjør motstandskraftig ruting og failover for høy tilgjengelighet.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Lær mer",
     "editInternalResourceDialogPortRestrictionsDescription": "Begrens tilgang til spesifikke TCP/UDP-porter eller tillate/blokkere alle porter.",

messages/nl-NL.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Genereer Toegangstoken",
     "actionDeleteAccessToken": "Verwijder toegangstoken",
     "actionListAccessTokens": "Lijst toegangstokens",
+    "actionCreateResourceSessionToken": "Maak Resource Sessie Token",
     "actionCreateResourceRule": "Bronregel aanmaken",
     "actionDeleteResourceRule": "Verwijder Resource Regel",
     "actionListResourceRules": "Bron regels weergeven",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Sluiten",
     "createInternalResourceDialogCreateClientResource": "Privé bron maken",
     "createInternalResourceDialogCreateClientResourceDescription": "Maak een nieuwe bron aan die alleen toegankelijk is voor klanten die verbonden zijn met de organisatie",
+    "privateResourceGeneralDescription": "Configureer de naam, identificatie en andere algemene resource-instellingen.",
     "privateResourceCreatePageSeeAll": "Bekijk Alle Privébronnen",
     "privateResourceAllowIcmpPing": "Sta ICMP Ping toe",
     "privateResourceNetworkAccess": "Netwerktoegang",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Gebruikers toevoegen",
     "editInternalResourceDialogAddClients": "Clienten toevoegen",
     "editInternalResourceDialogDestinationLabel": "Bestemming",
-    "editInternalResourceDialogDestinationDescription": "Kies waar deze bron draait en hoe clients deze bereiken",
+    "editInternalResourceDialogDestinationDescription": "Configureer hoe klanten toegang krijgen tot deze resource.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecteren van meerdere sites maakt veerkrachtige routing en failover mogelijk voor hoge beschikbaarheid.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Meer informatie",
     "editInternalResourceDialogPortRestrictionsDescription": "Beperk toegang tot specifieke TCP/UDP-poorten of sta alle poorten toe/blokkeer.",

messages/pl-PL.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Wygeneruj token dostępu",
     "actionDeleteAccessToken": "Usuń token dostępu",
     "actionListAccessTokens": "Lista tokenów dostępu",
+    "actionCreateResourceSessionToken": "Utwórz token sesji zasobu",
     "actionCreateResourceRule": "Utwórz regułę zasobu",
     "actionDeleteResourceRule": "Usuń regułę zasobu",
     "actionListResourceRules": "Lista reguł zasobu",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Zamknij",
     "createInternalResourceDialogCreateClientResource": "Utwórz zasób prywatny",
     "createInternalResourceDialogCreateClientResourceDescription": "Utwórz nowy zasób, który będzie dostępny tylko dla klientów podłączonych do organizacji",
+    "privateResourceGeneralDescription": "Skonfiguruj nazwę, identyfikator i inne ogólne ustawienia zasobów.",
     "privateResourceCreatePageSeeAll": "Zobacz wszystkie zasoby prywatne",
     "privateResourceAllowIcmpPing": "Zezwalaj na ping ICMP",
     "privateResourceNetworkAccess": "Dostęp do sieci",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Dodaj użytkowników",
     "editInternalResourceDialogAddClients": "Dodaj klientów",
     "editInternalResourceDialogDestinationLabel": "Miejsce docelowe",
-    "editInternalResourceDialogDestinationDescription": "Wybierz, gdzie ten zasób działa i jak klienci go osiągają",
+    "editInternalResourceDialogDestinationDescription": "Skonfiguruj sposób, w jaki klienci docierają do tego zasobu.",
     "internalResourceFormMultiSiteRoutingHelp": "Wybór wielu stron umożliwia odporne trasowanie i awarię dla wysokiej dostępności.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Dowiedz się więcej",
     "editInternalResourceDialogPortRestrictionsDescription": "Ogranicz dostęp do konkretnych portów TCP/UDP lub zezwól/zablokuj wszystkie porty.",

messages/pt-PT.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Gerar Token de Acesso",
     "actionDeleteAccessToken": "Eliminar Token de Acesso",
     "actionListAccessTokens": "Listar Tokens de Acesso",
+    "actionCreateResourceSessionToken": "Criar Token de Sessão de Recurso",
     "actionCreateResourceRule": "Criar Regra de Recurso",
     "actionDeleteResourceRule": "Eliminar Regra de Recurso",
     "actionListResourceRules": "Listar Regras de Recurso",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Fechar",
     "createInternalResourceDialogCreateClientResource": "Criar Recurso Privado",
     "createInternalResourceDialogCreateClientResourceDescription": "Criar um novo recurso que só será acessível para clientes conectados à organização",
+    "privateResourceGeneralDescription": "Configure o nome, identificador e outras configurações gerais de recursos.",
     "privateResourceCreatePageSeeAll": "Ver Todos os Recursos Privados",
     "privateResourceAllowIcmpPing": "Permitir ICMP Ping",
     "privateResourceNetworkAccess": "Acesso à Rede",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Adicionar Usuários",
     "editInternalResourceDialogAddClients": "Adicionar Clientes",
     "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Escolha onde este recurso é executado e como os clientes o acessam",
+    "editInternalResourceDialogDestinationDescription": "Configure como os clientes acessam este recurso.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecionar múltiplos sites permite roteamento resiliente e failover para alta disponibilidade.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Saiba mais",
     "editInternalResourceDialogPortRestrictionsDescription": "Restrinja o acesso a portas TCP/UDP específicas ou permita/bloqueie todas as portas.",

messages/ru-RU.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Сгенерировать токен доступа",
     "actionDeleteAccessToken": "Удалить токен доступа",
     "actionListAccessTokens": "Список токенов доступа",
+    "actionCreateResourceSessionToken": "Создать токен сеанса ресурса",
     "actionCreateResourceRule": "Создать правило ресурса",
     "actionDeleteResourceRule": "Удалить правило ресурса",
     "actionListResourceRules": "Список правил ресурса",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Закрыть",
     "createInternalResourceDialogCreateClientResource": "Создать приватный ресурс",
     "createInternalResourceDialogCreateClientResourceDescription": "Создать новый ресурс, который будет доступен только клиентам, подключенным к организации",
+    "privateResourceGeneralDescription": "Настройте имя, идентификатор и другие общие параметры ресурса.",
     "privateResourceCreatePageSeeAll": "Посмотреть все частные ресурсы",
     "privateResourceAllowIcmpPing": "Разрешить ICMP Ping",
     "privateResourceNetworkAccess": "Сетевой доступ",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Добавить пользователей",
     "editInternalResourceDialogAddClients": "Добавить клиентов",
     "editInternalResourceDialogDestinationLabel": "Пункт назначения",
-    "editInternalResourceDialogDestinationDescription": "Выберите, где этот ресурс работает и как к нему получают доступ клиенты",
+    "editInternalResourceDialogDestinationDescription": "Настройте, как клиенты получают доступ к этому ресурсу.",
     "internalResourceFormMultiSiteRoutingHelp": "Выбор нескольких сайтов позволяет обеспечить отказоустойчивую маршрутизацию и фейловер для высокой доступности.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Узнать больше",
     "editInternalResourceDialogPortRestrictionsDescription": "Ограничьте доступ к определенным TCP/UDP-портам или разрешите/заблокируйте все порты.",
@@ -3679,7 +3681,7 @@
     "resourceLauncherSaveForEveryoneDescription": "Поделитесь этим видом со всеми членами организации. Если не отмечено, видимость только для вас.",
     "resourceLauncherMakePersonal": "Сделать личным",
     "resourceLauncherFilter": "Фильтр",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Фильтр, применено {count}",
     "resourceLauncherSort": "Сортировать",
     "resourceLauncherSortAscending": "Сортировать по возрастанию",
     "resourceLauncherSortDescending": "Сортировать по убыванию",

messages/tr-TR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Erişim Jetonu Oluştur",
     "actionDeleteAccessToken": "Erişim Jetonunu Sil",
     "actionListAccessTokens": "Erişim Jetonlarını Listele",
+    "actionCreateResourceSessionToken": "Kaynak Oturum Otomasyonu Oluştur",
     "actionCreateResourceRule": "Kaynak Kuralı Oluştur",
     "actionDeleteResourceRule": "Kaynak Kuralını Sil",
     "actionListResourceRules": "Kaynak Kurallarını Listele",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Kapat",
     "createInternalResourceDialogCreateClientResource": "Özel Kaynak Oluştur",
     "createInternalResourceDialogCreateClientResourceDescription": "Seçilen siteye bağlı istemcilere erişilebilir olacak yeni bir kaynak oluşturun",
+    "privateResourceGeneralDescription": "Kaynağın adı, tanımlayıcı ve diğer genel ayarlarını yapılandırın.",
     "privateResourceCreatePageSeeAll": "Tüm Özel Kaynakları Gör",
     "privateResourceAllowIcmpPing": "ICMP Ping İzne Ver",
     "privateResourceNetworkAccess": "Ağ Erişimi",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Kullanıcılar Ekle",
     "editInternalResourceDialogAddClients": "Müşteriler Ekle",
     "editInternalResourceDialogDestinationLabel": "Hedef",
-    "editInternalResourceDialogDestinationDescription": "Bu kaynağın nerede çalıştığını ve istemcilerin ona nasıl eriştiğini seçin",
+    "editInternalResourceDialogDestinationDescription": "Bu kaynağa müşterilerin nasıl erişeceğini yapılandırın.",
     "internalResourceFormMultiSiteRoutingHelp": "Birden fazla site seçmek, yüksek kullanılabilirlik için dirençli yönlendirme ve yedeklik sağlar.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Daha fazla bilgi",
     "editInternalResourceDialogPortRestrictionsDescription": "Belirtilen TCP/UDP portlarına erişimi kısıtlayın veya tüm portlara izin/engelleme verin.",

messages/zh-CN.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "生成访问令牌",
     "actionDeleteAccessToken": "删除访问令牌",
     "actionListAccessTokens": "访问令牌",
+    "actionCreateResourceSessionToken": "创建资源会话令牌",
     "actionCreateResourceRule": "创建资源规则",
     "actionDeleteResourceRule": "删除资源规则",
     "actionListResourceRules": "列出资源规则",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "关闭",
     "createInternalResourceDialogCreateClientResource": "创建私有资源",
     "createInternalResourceDialogCreateClientResourceDescription": "创建一个新资源只能为连接到组织的客户端访问",
+    "privateResourceGeneralDescription": "配置名称、标识符和其他一般资源设置。",
     "privateResourceCreatePageSeeAll": "查看所有私人资源",
     "privateResourceAllowIcmpPing": "允许 ICMP Ping",
     "privateResourceNetworkAccess": "网络访问",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "添加用户",
     "editInternalResourceDialogAddClients": "添加客户端",
     "editInternalResourceDialogDestinationLabel": "目标",
-    "editInternalResourceDialogDestinationDescription": "选择该资源运行位置及客户端访问方式",
+    "editInternalResourceDialogDestinationDescription": "配置客户端如何访问此资源。",
     "internalResourceFormMultiSiteRoutingHelp": "选择多个站点可以实现高可用性的弹性路由和故障转移。",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "了解更多",
     "editInternalResourceDialogPortRestrictionsDescription": "限制访问特定的TCP/UDP端口或允许/阻止所有端口。",

messages/zh-TW.json

@@ -1099,6 +1099,7 @@
     "actionGenerateAccessToken": "生成訪問令牌",
     "actionDeleteAccessToken": "刪除訪問令牌",
     "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
     "actionCreateResourceRule": "創建資源規則",
     "actionDeleteResourceRule": "刪除資源規則",
     "actionListResourceRules": "列出資源規則",

package-lock.json

@@ -12,7 +12,7 @@
                 "@asteasolutions/zod-to-openapi": "8.5.0",
                 "@aws-sdk/client-s3": "3.1056.0",
                 "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                 "@headlessui/react": "2.2.10",
                 "@hookform/resolvers": "5.4.0",
                 "@monaco-editor/react": "4.7.0",
@@ -1124,9 +1124,9 @@
             "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
         },
         "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
+            "version": "0.0.1",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
         },
         "node_modules/@dotenvx/dotenvx": {
             "version": "1.69.1",

package.json

@@ -34,7 +34,7 @@
     "dependencies": {
         "@asteasolutions/zod-to-openapi": "8.5.0",
         "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
         "@aws-sdk/client-s3": "3.1056.0",
         "@headlessui/react": "2.2.10",
         "@hookform/resolvers": "5.4.0",

server/auth/actions.ts

@@ -71,6 +71,7 @@ export enum ActionsEnum {
     setResourceWhitelist = "setResourceWhitelist",
     getResourceWhitelist = "getResourceWhitelist",
     generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
     deleteAcessToken = "deleteAcessToken",
     listAccessTokens = "listAccessTokens",
     createResourceRule = "createResourceRule",

server/routers/badger/verifySession.ts

@@ -736,11 +736,14 @@ export async function verifyResourceSession(
             }
         }
 
-        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge
+        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge.
+        // Skip the challenge when SSO is also enabled so browsers get the SSO redirect instead of a native Basic
+        // Auth dialog; clients that proactively send Authorization: Basic are still accepted above.
         if (
             headerAuthExtendedCompatibility &&
             headerAuthExtendedCompatibility.extendedCompatibilityIsActivated &&
-            !clientHeaderAuth
+            !clientHeaderAuth &&
+            !sso
         ) {
             return headerAuthChallenged(res, redirectPath, resource.orgId);
         }

server/routers/integration.ts

@@ -808,6 +808,16 @@ authenticated.post(
     accessToken.generateAccessToken
 );
 
+authenticated.post(
+    `/resource/:resourceId/session-token`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyUserAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceSessionToken),
+    logActionAudit(ActionsEnum.createResourceSessionToken),
+    resource.createResourceSessionToken
+);
+
 authenticated.delete(
     `/access-token/:accessTokenId`,
     verifyApiKeyAccessTokenAccess,

server/routers/newt/pingAccumulator.ts

@@ -94,7 +94,13 @@ async function flushSitePingsToDb(): Promise<void> {
     const pingsToFlush = new Map(pendingSitePings);
     pendingSitePings.clear();
 
-    const entries = Array.from(pingsToFlush.entries());
+    // Sort by id ascending so concurrent writers (other app replicas, or
+    // unrelated single-row updates elsewhere in the app) always acquire row
+    // locks in the same order. Without this, overlapping batches/updates
+    // that touch the same rows in different orders can deadlock each other.
+    const entries = Array.from(pingsToFlush.entries()).sort(
+        ([a], [b]) => a - b
+    );
 
     const BATCH_SIZE = 50;
     for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -193,7 +199,11 @@ async function flushClientPingsToDb(): Promise<void> {
 
     // ── Flush client pings ─────────────────────────────────────────────
     if (pingsToFlush.size > 0) {
-        const entries = Array.from(pingsToFlush.entries());
+        // Sort ascending for consistent lock ordering (see note in
+        // flushSitePingsToDb).
+        const entries = Array.from(pingsToFlush.entries()).sort(
+            ([a], [b]) => a - b
+        );
 
         const BATCH_SIZE = 50;
         for (let i = 0; i < entries.length; i += BATCH_SIZE) {

server/routers/resource/createResourceSessionToken.ts

@@ -0,0 +1,133 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, users, userOrgs } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { createResourceSession } from "@server/auth/sessions/resource";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createSession, generateSessionToken } from "@server/auth/sessions/app";
+import { response } from "@server/lib/response";
+
+const createResourceSessionTokenParams = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceSessionTokenBody = z.strictObject({
+    userId: z.string().nonempty(),
+    idpId: z.coerce.number().int().positive().optional()
+});
+
+export type CreateResourceSessionTokenResponse = {
+    requestToken: string;
+};
+
+export async function createResourceSessionToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = createResourceSessionTokenParams.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceSessionTokenBody.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { userId, idpId } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const candidates = await db
+            .select({ userId: users.userId })
+            .from(userOrgs)
+            .innerJoin(users, eq(userOrgs.userId, users.userId))
+            .where(
+                and(
+                    eq(users.userId, userId),
+                    eq(userOrgs.orgId, resource.orgId)
+                )
+            );
+
+        if (candidates.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `User not found in the organization that owns this resource`
+                )
+            );
+        }
+
+        if (candidates.length > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Multiple users match this username (external users from different identity providers). Specify idpId to disambiguate."
+                )
+            );
+        }
+
+        const targetUserId = candidates[0].userId;
+
+        const appSessionToken = generateSessionToken();
+        const appSession = await createSession(appSessionToken, targetUserId);
+
+        const requestToken = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token: requestToken,
+            userSessionId: appSession.sessionId,
+            isRequestToken: true,
+            expiresAt: Date.now() + 1000 * 30, // 30 seconds
+            sessionLength: 1000 * 30,
+            doNotExtend: true
+        });
+
+        logger.debug("Resource session token created successfully");
+
+        return response<CreateResourceSessionTokenResponse>(res, {
+            data: { requestToken },
+            success: true,
+            error: false,
+            message: "Resource session token created successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/index.ts

@@ -17,6 +17,7 @@ export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./getExchangeToken";
+export * from "./createResourceSessionToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";

src/app/[orgId]/settings/resources/private/PrivateResourcePortRanges.tsx

@@ -106,17 +106,23 @@ export function PrivateResourceNetworkAccessFields({
     embedInParentGrid = false
 }: PrivateResourceNetworkAccessFieldsProps) {
     const t = useTranslations();
+    const resolvedInitialTcp = initialTcp !== undefined ? initialTcp : "*";
+    const resolvedInitialUdp = initialUdp !== undefined ? initialUdp : "*";
     const [tcpPortMode, setTcpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialTcp)
+        getPortModeFromString(resolvedInitialTcp)
     );
     const [udpPortMode, setUdpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialUdp)
+        getPortModeFromString(resolvedInitialUdp)
     );
     const [tcpCustomPorts, setTcpCustomPorts] = useState(() =>
-        initialTcp && initialTcp !== "*" ? initialTcp : ""
+        resolvedInitialTcp && resolvedInitialTcp !== "*"
+            ? resolvedInitialTcp
+            : ""
     );
     const [udpCustomPorts, setUdpCustomPorts] = useState(() =>
-        initialUdp && initialUdp !== "*" ? initialUdp : ""
+        resolvedInitialUdp && resolvedInitialUdp !== "*"
+            ? resolvedInitialUdp
+            : ""
     );
 
     useEffect(() => {

src/app/[orgId]/settings/resources/private/[niceId]/general/page.tsx

@@ -64,7 +64,7 @@ export default function PrivateResourceGeneralPage() {
                         {t("resourceGeneral")}
                     </SettingsSectionTitle>
                     <SettingsSectionDescription>
-                        {t("resourceGeneralDescription")}
+                        {t("privateResourceGeneralDescription")}
                     </SettingsSectionDescription>
                 </SettingsSectionHeader>
 

src/components/PermissionsSelectBox.tsx

@@ -77,7 +77,8 @@ function getActionsCategories(root: boolean) {
             [t("actionDeleteSiteResource")]: "deleteSiteResource",
             [t("actionGetSiteResource")]: "getSiteResource",
             [t("actionListSiteResources")]: "listSiteResources",
-            [t("actionUpdateSiteResource")]: "updateSiteResource"
+            [t("actionUpdateSiteResource")]: "updateSiteResource",
+            [t("actionCreateResourceSessionToken")]: "createResourceSessionToken"
         },
 
         Target: {