dont use strict query params in list alises

z#

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.7
+    image: traefik:v3.6
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/docker-compose.yml

@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.7
+    image: docker.io/traefik:v3.6
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

messages/bg-BG.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Генериране на токен за достъп",
     "actionDeleteAccessToken": "Изтриване на токен за достъп",
     "actionListAccessTokens": "Изброяване на токени за достъп",
+    "actionCreateResourceSessionToken": "Създаване на токен за сесия на ресурс",
     "actionCreateResourceRule": "Създаване на правило за ресурс",
     "actionDeleteResourceRule": "Изтрийте правило за ресурс",
     "actionListResourceRules": "Изброяване на правила за ресурс",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Затвори",
     "createInternalResourceDialogCreateClientResource": "Създаване на частен ресурс",
     "createInternalResourceDialogCreateClientResourceDescription": "Създайте нов ресурс, който ще бъде достъпен само за клиенти, свързани към организацията",
+    "privateResourceGeneralDescription": "Конфигурирайте името, идентификатора и другите общи настройки на ресурса.",
     "privateResourceCreatePageSeeAll": "Вижте всички частни ресурси",
     "privateResourceAllowIcmpPing": "Разрешете ICMP Ping",
     "privateResourceNetworkAccess": "Достъп до мрежата",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Добавяне на потребители.",
     "editInternalResourceDialogAddClients": "Добавяне на клиенти.",
     "editInternalResourceDialogDestinationLabel": "Дестинация.",
-    "editInternalResourceDialogDestinationDescription": "Изберете къде работи този ресурс и как клиентите го достигат",
+    "editInternalResourceDialogDestinationDescription": "Конфигурирайте как клиентите да достигнат до този ресурс.",
     "internalResourceFormMultiSiteRoutingHelp": "Избирайки няколко сайта, се осигурява сигурен път и пренасочване при висока достъпност.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Научете повече",
     "editInternalResourceDialogPortRestrictionsDescription": "Ограничете достъпа до конкретни TCP/UDP портове или позволете/блокирайте всички портове.",

messages/cs-CZ.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generovat přístupový token",
     "actionDeleteAccessToken": "Odstranit přístupový token",
     "actionListAccessTokens": "Seznam přístupových tokenů",
+    "actionCreateResourceSessionToken": "Vytvořit token relace prostředku",
     "actionCreateResourceRule": "Vytvořit pravidlo pro zdroj",
     "actionDeleteResourceRule": "Odstranit pravidlo pro dokument",
     "actionListResourceRules": "Seznam pravidel zdrojů",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Zavřít",
     "createInternalResourceDialogCreateClientResource": "Vytvořit soukromý zdroj",
     "createInternalResourceDialogCreateClientResourceDescription": "Vytvořte nový zdroj, který bude přístupný pouze klientům připojeným k organizaci",
+    "privateResourceGeneralDescription": "Nastavte název, identifikátor a další obecná nastavení zdroje.",
     "privateResourceCreatePageSeeAll": "Zobrazit všechny privátní zdroje",
     "privateResourceAllowIcmpPing": "Povolit ICMP ping",
     "privateResourceNetworkAccess": "Přístup k síti",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Přidat uživatele",
     "editInternalResourceDialogAddClients": "Přidat klienty",
     "editInternalResourceDialogDestinationLabel": "Cíl",
-    "editInternalResourceDialogDestinationDescription": "Vyberte, kde bude tento zdroj spuštěn a jak ho klienti dosáhnou",
+    "editInternalResourceDialogDestinationDescription": "Nakonfigurujte, jak klienti dosáhnou tohoto zdroje.",
     "internalResourceFormMultiSiteRoutingHelp": "Výběrem více webů se povolí odolné směrování a přepojení pro vysokou dostupnost.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Zjistit více",
     "editInternalResourceDialogPortRestrictionsDescription": "Omezte přístup na specifické TCP/UDP porty nebo povolte/blokujte všechny porty.",

messages/da-DK.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generer adgangstoken",
     "actionDeleteAccessToken": "Slet adgangstoken",
     "actionListAccessTokens": "Vis adgangstokens",
+    "actionCreateResourceSessionToken": "Opret ressourcessession token",
     "actionCreateResourceRule": "Opret ressourceregel",
     "actionDeleteResourceRule": "Slet ressourceregel",
     "actionListResourceRules": "Vis ressourceregler",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Luk",
     "createInternalResourceDialogCreateClientResource": "Opret privat ressource",
     "createInternalResourceDialogCreateClientResourceDescription": "Opret en ny ressource som kun vil være tilgængelig for kunder som er forbundet til organisationen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren, og andre generelle indstillinger for ressourcen.",
     "privateResourceCreatePageSeeAll": "Se alle private ressourcer",
     "privateResourceAllowIcmpPing": "Tillad ICMP-ping",
     "privateResourceNetworkAccess": "Netværksadgang",
@@ -2546,7 +2548,7 @@
     "noRemoteExitNodesAvailableDescription": "Ingen noder er tilgængelige for denne organisation. Opret en node først for at bruge lokale sites.",
     "exitNode": "Exitnode",
     "country": "Land",
-    "countryIsNot": "Country Is Not",
+    "countryIsNot": "Land er ikke",
     "rulesMatchCountry": "I øjeblikket baseret på kilde-IP",
     "region": "Fylke",
     "selectRegion": "Vælg region",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Tilføj brugere",
     "editInternalResourceDialogAddClients": "Tilføj klienter",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får adgang til denne ressource.",
     "internalResourceFormMultiSiteRoutingHelp": "Valg af flere sites muliggør robust routing og failover for høj tilgængelighed.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Læs mere",
     "editInternalResourceDialogPortRestrictionsDescription": "Begrens adgang til specifikke TCP/UDP-porte eller tillade/blokere alle porte.",

messages/de-DE.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Zugriffstoken generieren",
     "actionDeleteAccessToken": "Zugriffstoken löschen",
     "actionListAccessTokens": "Zugriffstoken auflisten",
+    "actionCreateResourceSessionToken": "Ressourcensitzungstoken erstellen",
     "actionCreateResourceRule": "Ressourcenregel erstellen",
     "actionDeleteResourceRule": "Ressourcenregel löschen",
     "actionListResourceRules": "Ressourcenregeln auflisten",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Schließen",
     "createInternalResourceDialogCreateClientResource": "Private Ressource erstellen",
     "createInternalResourceDialogCreateClientResourceDescription": "Erstelle eine neue Ressource, die nur für Clients zugänglich ist, die mit der Organisation verbunden sind",
+    "privateResourceGeneralDescription": "Konfigurieren Sie den Namen, die Kennung und andere allgemeine Ressourceneinstellungen.",
     "privateResourceCreatePageSeeAll": "Alle privaten Ressourcen anzeigen",
     "privateResourceAllowIcmpPing": "ICMP-Ping zulassen",
     "privateResourceNetworkAccess": "Netzwerkzugriff",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Nutzer hinzufügen",
     "editInternalResourceDialogAddClients": "Clients hinzufügen",
     "editInternalResourceDialogDestinationLabel": "Ziel",
-    "editInternalResourceDialogDestinationDescription": "Wählen Sie aus, wo diese Ressource läuft und wie Clients darauf zugreifen können",
+    "editInternalResourceDialogDestinationDescription": "Konfigurieren Sie, wie Clients diese Ressource erreichen.",
     "internalResourceFormMultiSiteRoutingHelp": "Durch die Auswahl mehrerer Seiten wird ein ausfallsicheres Routing und Failover für hohe Verfügbarkeit ermöglicht.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Mehr erfahren",
     "editInternalResourceDialogPortRestrictionsDescription": "Den Zugriff auf bestimmte TCP/UDP-Ports beschränken oder alle Ports erlauben/blockieren.",
@@ -3679,7 +3681,7 @@
     "resourceLauncherSaveForEveryoneDescription": "Teilen Sie diese Ansicht mit allen Organisationsmitgliedern. Wenn nicht aktiviert, ist die Ansicht nur für Sie sichtbar.",
     "resourceLauncherMakePersonal": "Persönlich machen",
     "resourceLauncherFilter": "Filter",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Filter, {count} angewendet",
     "resourceLauncherSort": "Sortieren",
     "resourceLauncherSortAscending": "Aufsteigend sortieren",
     "resourceLauncherSortDescending": "Absteigend sortieren",

messages/en-US.json

@@ -1397,6 +1397,7 @@
     "createOrgUser": "Create Org User",
     "actionUpdateOrg": "Update Organization",
     "actionRemoveInvitation": "Remove Invitation",
+    "actionRemoveUserRole": "Remove User Role",
     "actionUpdateUser": "Update User",
     "actionGetUser": "Get User",
     "actionGetOrgUser": "Get Organization User",
@@ -1462,6 +1463,7 @@
     "actionGenerateAccessToken": "Generate Access Token",
     "actionDeleteAccessToken": "Delete Access Token",
     "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
     "actionCreateResourceRule": "Create Resource Rule",
     "actionDeleteResourceRule": "Delete Resource Rule",
     "actionListResourceRules": "List Resource Rules",
@@ -2392,6 +2394,7 @@
     "createInternalResourceDialogClose": "Close",
     "createInternalResourceDialogCreateClientResource": "Create Private Resource",
     "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
+    "privateResourceGeneralDescription": "Configure the name, identifier, and other general resource settings.",
     "privateResourceCreatePageSeeAll": "See All Private Resources",
     "privateResourceAllowIcmpPing": "Allow ICMP Ping",
     "privateResourceNetworkAccess": "Network Access",
@@ -3268,7 +3271,7 @@
     "editInternalResourceDialogAddUsers": "Add Users",
     "editInternalResourceDialogAddClients": "Add Clients",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Configure how clients reach this resource.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecting multiple sites enables resilient routing and failover for high availability.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Learn more",
     "editInternalResourceDialogPortRestrictionsDescription": "Restrict access to specific TCP/UDP ports or allow/block all ports.",

messages/es-ES.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generar token de acceso",
     "actionDeleteAccessToken": "Eliminar token de acceso",
     "actionListAccessTokens": "Lista de Tokens de Acceso",
+    "actionCreateResourceSessionToken": "Crear Token de Sesión de Recurso",
     "actionCreateResourceRule": "Crear Regla de Recursos",
     "actionDeleteResourceRule": "Eliminar Regla de Recurso",
     "actionListResourceRules": "Lista de Reglas de Recursos",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Cerrar",
     "createInternalResourceDialogCreateClientResource": "Crear recurso privado",
     "createInternalResourceDialogCreateClientResourceDescription": "Crear un nuevo recurso que sólo será accesible a los clientes conectados a la organización",
+    "privateResourceGeneralDescription": "Configura el nombre, identificador y otros ajustes generales del recurso.",
     "privateResourceCreatePageSeeAll": "Ver todos los recursos privados",
     "privateResourceAllowIcmpPing": "Permitir ping ICMP",
     "privateResourceNetworkAccess": "Acceso de red",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Agregar usuarios",
     "editInternalResourceDialogAddClients": "Agregar clientes",
     "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Elija dónde se ejecuta este recurso y cómo lo alcanzan los clientes",
+    "editInternalResourceDialogDestinationDescription": "Configura cómo los clientes acceden a este recurso.",
     "internalResourceFormMultiSiteRoutingHelp": "Seleccionar múltiples sitios habilita el enrutamiento resistente y la conmutación por error para alta disponibilidad.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Más información",
     "editInternalResourceDialogPortRestrictionsDescription": "Restringir el acceso a puertos TCP/UDP específicos o permitir/bloquear todos los puertos.",

messages/fr-FR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Générer un jeton d'accès",
     "actionDeleteAccessToken": "Supprimer un jeton d'accès",
     "actionListAccessTokens": "Lister les jetons d'accès",
+    "actionCreateResourceSessionToken": "Créer un jeton de session de ressource",
     "actionCreateResourceRule": "Créer une règle de ressource",
     "actionDeleteResourceRule": "Supprimer une règle de ressource",
     "actionListResourceRules": "Lister les règles de ressource",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Fermer",
     "createInternalResourceDialogCreateClientResource": "Créer une ressource privée",
     "createInternalResourceDialogCreateClientResourceDescription": "Créer une nouvelle ressource qui ne sera accessible qu'aux clients connectés à l'organisation",
+    "privateResourceGeneralDescription": "Configurez le nom, l'identifiant et d'autres paramètres généraux de la ressource.",
     "privateResourceCreatePageSeeAll": "Voir toutes les ressources privées",
     "privateResourceAllowIcmpPing": "Autoriser le ping ICMP",
     "privateResourceNetworkAccess": "Accès au réseau",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Ajouter des utilisateurs",
     "editInternalResourceDialogAddClients": "Ajouter des clients",
     "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choisissez où cette ressource fonctionne et comment les clients l'atteignent",
+    "editInternalResourceDialogDestinationDescription": "Configurez comment les clients accèdent à cette ressource.",
     "internalResourceFormMultiSiteRoutingHelp": "La sélection de plusieurs sites permet un routage résilient et un basculement pour une haute disponibilité.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "En savoir plus",
     "editInternalResourceDialogPortRestrictionsDescription": "Restreindre l'accès à des ports TCP/UDP spécifiques ou autoriser/bloquer tous les ports.",

messages/it-IT.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Genera Token di Accesso",
     "actionDeleteAccessToken": "Elimina Token di Accesso",
     "actionListAccessTokens": "Elenca Token di Accesso",
+    "actionCreateResourceSessionToken": "Crea Token di Sessione della Risorsa",
     "actionCreateResourceRule": "Crea Regola Risorsa",
     "actionDeleteResourceRule": "Elimina Regola Risorsa",
     "actionListResourceRules": "Elenca Regole Risorsa",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Chiudi",
     "createInternalResourceDialogCreateClientResource": "Crea Risorsa Privata",
     "createInternalResourceDialogCreateClientResourceDescription": "Crea una nuova risorsa che sarà accessibile solo ai client connessi all'organizzazione",
+    "privateResourceGeneralDescription": "Configura il nome, l'identificativo e altre impostazioni generali delle risorse.",
     "privateResourceCreatePageSeeAll": "Vedi Tutte le Risorse Private",
     "privateResourceAllowIcmpPing": "Consenti ICMP Ping",
     "privateResourceNetworkAccess": "Accesso alla Rete",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Aggiungi Utenti",
     "editInternalResourceDialogAddClients": "Aggiungi Clienti",
     "editInternalResourceDialogDestinationLabel": "Destinazione",
-    "editInternalResourceDialogDestinationDescription": "Scegli dove eseguire questa risorsa e come i client lo raggiungono",
+    "editInternalResourceDialogDestinationDescription": "Configura come i client raggiungono questa risorsa.",
     "internalResourceFormMultiSiteRoutingHelp": "Selezionare più siti consente un routing resiliente e Failover per alta disponibilità.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Scopri di più",
     "editInternalResourceDialogPortRestrictionsDescription": "Limita l'accesso a porte TCP/UDP specifiche o consenti/blocca tutte le porte.",

messages/ko-KR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "액세스 토큰 생성",
     "actionDeleteAccessToken": "액세스 토큰 삭제",
     "actionListAccessTokens": "액세스 토큰 목록",
+    "actionCreateResourceSessionToken": "리소스 세션 토큰 생성",
     "actionCreateResourceRule": "리소스 규칙 생성",
     "actionDeleteResourceRule": "리소스 규칙 삭제",
     "actionListResourceRules": "리소스 규칙 목록",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "닫기",
     "createInternalResourceDialogCreateClientResource": "사이트 리소스 생성",
     "createInternalResourceDialogCreateClientResourceDescription": "선택한 사이트에 연결된 클라이언트에 접근할 새 리소스를 생성합니다",
+    "privateResourceGeneralDescription": "이름, 식별자, 기타 일반 리소스 설정을 구성합니다.",
     "privateResourceCreatePageSeeAll": "모든 개인 리소스 보기",
     "privateResourceAllowIcmpPing": "ICMP 핑 허용",
     "privateResourceNetworkAccess": "네트워크 접근",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "사용자 추가",
     "editInternalResourceDialogAddClients": "클라이언트 추가",
     "editInternalResourceDialogDestinationLabel": "대상지",
-    "editInternalResourceDialogDestinationDescription": "이 리소스가 실행되는 위치와 고객이 도달하는 방법 선택",
+    "editInternalResourceDialogDestinationDescription": "클라이언트가 이 리소스에 어떻게 도달하는지 구성합니다.",
     "internalResourceFormMultiSiteRoutingHelp": "다중 사이트를 선택하면 높은 가용성을 위해 회복력 있는 라우팅 및 페일오버가 가능해집니다.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "자세히 알아보기",
     "editInternalResourceDialogPortRestrictionsDescription": "특정 TCP/UDP 포트에 대한 접근을 제한하거나 모든 포트를 허용/차단하십시오.",

messages/nb-NO.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Generer tilgangstoken",
     "actionDeleteAccessToken": "Slett tilgangstoken",
     "actionListAccessTokens": "List opp tilgangstokener",
+    "actionCreateResourceSessionToken": "Opprett ressurs økt-token",
     "actionCreateResourceRule": "Opprett ressursregel",
     "actionDeleteResourceRule": "Slett ressursregel",
     "actionListResourceRules": "List opp ressursregler",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Lukk",
     "createInternalResourceDialogCreateClientResource": "Opprett privat ressurs",
     "createInternalResourceDialogCreateClientResourceDescription": "Opprett en ny ressurs som bare vil være tilgjengelig for kunder som er koblet til organisasjonen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren og andre generelle ressursinnstillinger.",
     "privateResourceCreatePageSeeAll": "Se alle private ressurser",
     "privateResourceAllowIcmpPing": "Tillat ICMP Ping",
     "privateResourceNetworkAccess": "Nettverkstilgang",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Legg til brukere",
     "editInternalResourceDialogAddClients": "Legg til klienter",
     "editInternalResourceDialogDestinationLabel": "Destinasjon",
-    "editInternalResourceDialogDestinationDescription": "Velg hvor denne ressursen kjører og hvordan klienter når den",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får tilgang til denne ressursen.",
     "internalResourceFormMultiSiteRoutingHelp": "Valg av flere nettsteder muliggjør motstandskraftig ruting og failover for høy tilgjengelighet.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Lær mer",
     "editInternalResourceDialogPortRestrictionsDescription": "Begrens tilgang til spesifikke TCP/UDP-porter eller tillate/blokkere alle porter.",

messages/nl-NL.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Genereer Toegangstoken",
     "actionDeleteAccessToken": "Verwijder toegangstoken",
     "actionListAccessTokens": "Lijst toegangstokens",
+    "actionCreateResourceSessionToken": "Maak Resource Sessie Token",
     "actionCreateResourceRule": "Bronregel aanmaken",
     "actionDeleteResourceRule": "Verwijder Resource Regel",
     "actionListResourceRules": "Bron regels weergeven",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Sluiten",
     "createInternalResourceDialogCreateClientResource": "Privé bron maken",
     "createInternalResourceDialogCreateClientResourceDescription": "Maak een nieuwe bron aan die alleen toegankelijk is voor klanten die verbonden zijn met de organisatie",
+    "privateResourceGeneralDescription": "Configureer de naam, identificatie en andere algemene resource-instellingen.",
     "privateResourceCreatePageSeeAll": "Bekijk Alle Privébronnen",
     "privateResourceAllowIcmpPing": "Sta ICMP Ping toe",
     "privateResourceNetworkAccess": "Netwerktoegang",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Gebruikers toevoegen",
     "editInternalResourceDialogAddClients": "Clienten toevoegen",
     "editInternalResourceDialogDestinationLabel": "Bestemming",
-    "editInternalResourceDialogDestinationDescription": "Kies waar deze bron draait en hoe clients deze bereiken",
+    "editInternalResourceDialogDestinationDescription": "Configureer hoe klanten toegang krijgen tot deze resource.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecteren van meerdere sites maakt veerkrachtige routing en failover mogelijk voor hoge beschikbaarheid.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Meer informatie",
     "editInternalResourceDialogPortRestrictionsDescription": "Beperk toegang tot specifieke TCP/UDP-poorten of sta alle poorten toe/blokkeer.",

messages/pl-PL.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Wygeneruj token dostępu",
     "actionDeleteAccessToken": "Usuń token dostępu",
     "actionListAccessTokens": "Lista tokenów dostępu",
+    "actionCreateResourceSessionToken": "Utwórz token sesji zasobu",
     "actionCreateResourceRule": "Utwórz regułę zasobu",
     "actionDeleteResourceRule": "Usuń regułę zasobu",
     "actionListResourceRules": "Lista reguł zasobu",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Zamknij",
     "createInternalResourceDialogCreateClientResource": "Utwórz zasób prywatny",
     "createInternalResourceDialogCreateClientResourceDescription": "Utwórz nowy zasób, który będzie dostępny tylko dla klientów podłączonych do organizacji",
+    "privateResourceGeneralDescription": "Skonfiguruj nazwę, identyfikator i inne ogólne ustawienia zasobów.",
     "privateResourceCreatePageSeeAll": "Zobacz wszystkie zasoby prywatne",
     "privateResourceAllowIcmpPing": "Zezwalaj na ping ICMP",
     "privateResourceNetworkAccess": "Dostęp do sieci",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Dodaj użytkowników",
     "editInternalResourceDialogAddClients": "Dodaj klientów",
     "editInternalResourceDialogDestinationLabel": "Miejsce docelowe",
-    "editInternalResourceDialogDestinationDescription": "Wybierz, gdzie ten zasób działa i jak klienci go osiągają",
+    "editInternalResourceDialogDestinationDescription": "Skonfiguruj sposób, w jaki klienci docierają do tego zasobu.",
     "internalResourceFormMultiSiteRoutingHelp": "Wybór wielu stron umożliwia odporne trasowanie i awarię dla wysokiej dostępności.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Dowiedz się więcej",
     "editInternalResourceDialogPortRestrictionsDescription": "Ogranicz dostęp do konkretnych portów TCP/UDP lub zezwól/zablokuj wszystkie porty.",

messages/pt-PT.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Gerar Token de Acesso",
     "actionDeleteAccessToken": "Eliminar Token de Acesso",
     "actionListAccessTokens": "Listar Tokens de Acesso",
+    "actionCreateResourceSessionToken": "Criar Token de Sessão de Recurso",
     "actionCreateResourceRule": "Criar Regra de Recurso",
     "actionDeleteResourceRule": "Eliminar Regra de Recurso",
     "actionListResourceRules": "Listar Regras de Recurso",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Fechar",
     "createInternalResourceDialogCreateClientResource": "Criar Recurso Privado",
     "createInternalResourceDialogCreateClientResourceDescription": "Criar um novo recurso que só será acessível para clientes conectados à organização",
+    "privateResourceGeneralDescription": "Configure o nome, identificador e outras configurações gerais de recursos.",
     "privateResourceCreatePageSeeAll": "Ver Todos os Recursos Privados",
     "privateResourceAllowIcmpPing": "Permitir ICMP Ping",
     "privateResourceNetworkAccess": "Acesso à Rede",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Adicionar Usuários",
     "editInternalResourceDialogAddClients": "Adicionar Clientes",
     "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Escolha onde este recurso é executado e como os clientes o acessam",
+    "editInternalResourceDialogDestinationDescription": "Configure como os clientes acessam este recurso.",
     "internalResourceFormMultiSiteRoutingHelp": "Selecionar múltiplos sites permite roteamento resiliente e failover para alta disponibilidade.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Saiba mais",
     "editInternalResourceDialogPortRestrictionsDescription": "Restrinja o acesso a portas TCP/UDP específicas ou permita/bloqueie todas as portas.",

messages/ru-RU.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Сгенерировать токен доступа",
     "actionDeleteAccessToken": "Удалить токен доступа",
     "actionListAccessTokens": "Список токенов доступа",
+    "actionCreateResourceSessionToken": "Создать токен сеанса ресурса",
     "actionCreateResourceRule": "Создать правило ресурса",
     "actionDeleteResourceRule": "Удалить правило ресурса",
     "actionListResourceRules": "Список правил ресурса",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Закрыть",
     "createInternalResourceDialogCreateClientResource": "Создать приватный ресурс",
     "createInternalResourceDialogCreateClientResourceDescription": "Создать новый ресурс, который будет доступен только клиентам, подключенным к организации",
+    "privateResourceGeneralDescription": "Настройте имя, идентификатор и другие общие параметры ресурса.",
     "privateResourceCreatePageSeeAll": "Посмотреть все частные ресурсы",
     "privateResourceAllowIcmpPing": "Разрешить ICMP Ping",
     "privateResourceNetworkAccess": "Сетевой доступ",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Добавить пользователей",
     "editInternalResourceDialogAddClients": "Добавить клиентов",
     "editInternalResourceDialogDestinationLabel": "Пункт назначения",
-    "editInternalResourceDialogDestinationDescription": "Выберите, где этот ресурс работает и как к нему получают доступ клиенты",
+    "editInternalResourceDialogDestinationDescription": "Настройте, как клиенты получают доступ к этому ресурсу.",
     "internalResourceFormMultiSiteRoutingHelp": "Выбор нескольких сайтов позволяет обеспечить отказоустойчивую маршрутизацию и фейловер для высокой доступности.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Узнать больше",
     "editInternalResourceDialogPortRestrictionsDescription": "Ограничьте доступ к определенным TCP/UDP-портам или разрешите/заблокируйте все порты.",
@@ -3679,7 +3681,7 @@
     "resourceLauncherSaveForEveryoneDescription": "Поделитесь этим видом со всеми членами организации. Если не отмечено, видимость только для вас.",
     "resourceLauncherMakePersonal": "Сделать личным",
     "resourceLauncherFilter": "Фильтр",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Фильтр, применено {count}",
     "resourceLauncherSort": "Сортировать",
     "resourceLauncherSortAscending": "Сортировать по возрастанию",
     "resourceLauncherSortDescending": "Сортировать по убыванию",

messages/tr-TR.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "Erişim Jetonu Oluştur",
     "actionDeleteAccessToken": "Erişim Jetonunu Sil",
     "actionListAccessTokens": "Erişim Jetonlarını Listele",
+    "actionCreateResourceSessionToken": "Kaynak Oturum Otomasyonu Oluştur",
     "actionCreateResourceRule": "Kaynak Kuralı Oluştur",
     "actionDeleteResourceRule": "Kaynak Kuralını Sil",
     "actionListResourceRules": "Kaynak Kurallarını Listele",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "Kapat",
     "createInternalResourceDialogCreateClientResource": "Özel Kaynak Oluştur",
     "createInternalResourceDialogCreateClientResourceDescription": "Seçilen siteye bağlı istemcilere erişilebilir olacak yeni bir kaynak oluşturun",
+    "privateResourceGeneralDescription": "Kaynağın adı, tanımlayıcı ve diğer genel ayarlarını yapılandırın.",
     "privateResourceCreatePageSeeAll": "Tüm Özel Kaynakları Gör",
     "privateResourceAllowIcmpPing": "ICMP Ping İzne Ver",
     "privateResourceNetworkAccess": "Ağ Erişimi",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "Kullanıcılar Ekle",
     "editInternalResourceDialogAddClients": "Müşteriler Ekle",
     "editInternalResourceDialogDestinationLabel": "Hedef",
-    "editInternalResourceDialogDestinationDescription": "Bu kaynağın nerede çalıştığını ve istemcilerin ona nasıl eriştiğini seçin",
+    "editInternalResourceDialogDestinationDescription": "Bu kaynağa müşterilerin nasıl erişeceğini yapılandırın.",
     "internalResourceFormMultiSiteRoutingHelp": "Birden fazla site seçmek, yüksek kullanılabilirlik için dirençli yönlendirme ve yedeklik sağlar.",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "Daha fazla bilgi",
     "editInternalResourceDialogPortRestrictionsDescription": "Belirtilen TCP/UDP portlarına erişimi kısıtlayın veya tüm portlara izin/engelleme verin.",

messages/zh-CN.json

@@ -1462,6 +1462,7 @@
     "actionGenerateAccessToken": "生成访问令牌",
     "actionDeleteAccessToken": "删除访问令牌",
     "actionListAccessTokens": "访问令牌",
+    "actionCreateResourceSessionToken": "创建资源会话令牌",
     "actionCreateResourceRule": "创建资源规则",
     "actionDeleteResourceRule": "删除资源规则",
     "actionListResourceRules": "列出资源规则",
@@ -2392,6 +2393,7 @@
     "createInternalResourceDialogClose": "关闭",
     "createInternalResourceDialogCreateClientResource": "创建私有资源",
     "createInternalResourceDialogCreateClientResourceDescription": "创建一个新资源只能为连接到组织的客户端访问",
+    "privateResourceGeneralDescription": "配置名称、标识符和其他一般资源设置。",
     "privateResourceCreatePageSeeAll": "查看所有私人资源",
     "privateResourceAllowIcmpPing": "允许 ICMP Ping",
     "privateResourceNetworkAccess": "网络访问",
@@ -3268,7 +3270,7 @@
     "editInternalResourceDialogAddUsers": "添加用户",
     "editInternalResourceDialogAddClients": "添加客户端",
     "editInternalResourceDialogDestinationLabel": "目标",
-    "editInternalResourceDialogDestinationDescription": "选择该资源运行位置及客户端访问方式",
+    "editInternalResourceDialogDestinationDescription": "配置客户端如何访问此资源。",
     "internalResourceFormMultiSiteRoutingHelp": "选择多个站点可以实现高可用性的弹性路由和故障转移。",
     "internalResourceFormMultiSiteRoutingHelpLearnMore": "了解更多",
     "editInternalResourceDialogPortRestrictionsDescription": "限制访问特定的TCP/UDP端口或允许/阻止所有端口。",

messages/zh-TW.json

@@ -1099,6 +1099,7 @@
     "actionGenerateAccessToken": "生成訪問令牌",
     "actionDeleteAccessToken": "刪除訪問令牌",
     "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
     "actionCreateResourceRule": "創建資源規則",
     "actionDeleteResourceRule": "刪除資源規則",
     "actionListResourceRules": "列出資源規則",

package-lock.json

@@ -12,7 +12,7 @@
                 "@asteasolutions/zod-to-openapi": "8.5.0",
                 "@aws-sdk/client-s3": "3.1056.0",
                 "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                 "@headlessui/react": "2.2.10",
                 "@hookform/resolvers": "5.4.0",
                 "@monaco-editor/react": "4.7.0",
@@ -1124,9 +1124,9 @@
             "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
         },
         "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
+            "version": "0.0.1",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
         },
         "node_modules/@dotenvx/dotenvx": {
             "version": "1.69.1",

package.json

@@ -34,7 +34,7 @@
     "dependencies": {
         "@asteasolutions/zod-to-openapi": "8.5.0",
         "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
         "@aws-sdk/client-s3": "3.1056.0",
         "@headlessui/react": "2.2.10",
         "@hookform/resolvers": "5.4.0",

server/auth/actions.ts

@@ -71,6 +71,7 @@ export enum ActionsEnum {
     setResourceWhitelist = "setResourceWhitelist",
     getResourceWhitelist = "getResourceWhitelist",
     generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
     deleteAcessToken = "deleteAcessToken",
     listAccessTokens = "listAccessTokens",
     createResourceRule = "createResourceRule",

server/db/pg/schema/schema.ts

@@ -200,7 +200,10 @@ export const resources = pgTable(
         authDaemonMode: varchar("authDaemonMode", { length: 32 })
             .$type<"site" | "remote" | "native">()
             .default("site"),
-        authDaemonPort: integer("authDaemonPort").default(22123)
+        authDaemonPort: integer("authDaemonPort").default(22123),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
     },
     (t) => [
         index("idx_resources_fulldomain")
@@ -451,7 +454,10 @@ export const siteResources = pgTable(
             onDelete: "set null"
         }),
         subdomain: varchar("subdomain"),
-        fullDomain: varchar("fullDomain")
+        fullDomain: varchar("fullDomain"),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
     },
     (t) => [index("idx_siteresources_orgid_niceid").on(t.orgId, t.niceId)]
 );

server/db/sqlite/schema/schema.ts

@@ -209,7 +209,8 @@ export const resources = sqliteTable("resources", {
     authDaemonMode: text("authDaemonMode")
         .$type<"site" | "remote" | "native">()
         .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const labels = sqliteTable("labels", {
@@ -447,7 +448,8 @@ export const siteResources = sqliteTable("siteResources", {
         onDelete: "set null"
     }),
     subdomain: text("subdomain"),
-    fullDomain: text("fullDomain")
+    fullDomain: text("fullDomain"),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const networks = sqliteTable("networks", {

server/lib/blueprints/applyBlueprint.ts

@@ -34,12 +34,6 @@ import {
     rebuildClientAssociationsFromSiteResource,
     waitForSiteResourceRebuildIdle
 } from "../rebuildClientAssociations";
-import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
-import { LimitId } from "../billing";
-import { usageService } from "../billing/usageService";
 
 type ApplyBlueprintArgs = {
     orgId: string;

server/lib/blueprints/privateResources.ts

@@ -26,9 +26,6 @@ import { createCertificate } from "#dynamic/routers/certificates/createCertifica
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
 import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
 import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 
@@ -201,17 +198,19 @@ export async function updatePrivateResources(
             }
         }
 
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
         if (siteId && allSites.length === 0) {
             // only add if there are not provided sites
             // Use the provided siteId directly, but verify it belongs to the org
             const [siteSingle] = await trx
-                .select({ siteId: sites.siteId })
+                .select({ siteId: sites.siteId, status: sites.status })
                 .from(sites)
                 .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
                 .limit(1);
             if (siteSingle) {
                 allSites.push(siteSingle);
             }
+            resourceStatusFromSite = siteSingle.status ?? "approved";
         }
 
         if (allSites.length === 0) {
@@ -220,6 +219,13 @@ export async function updatePrivateResources(
             );
         }
 
+        const resourceEnabled =
+            resourceData.enabled == undefined || resourceData.enabled == null
+                ? true
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         if (existingResource) {
             let domainInfo:
                 | { subdomain: string | null; domainId: string }
@@ -243,8 +249,7 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
+                    enabled: resourceEnabled,
-                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     disableIcmp:
                         resourceData["disable-icmp"] ||
@@ -263,7 +268,8 @@ export async function updatePrivateResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .where(
                     eq(
@@ -496,8 +502,7 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
+                    enabled: resourceEnabled,
-                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
                     disableIcmp:
@@ -517,7 +522,8 @@ export async function updatePrivateResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .returning();
 

server/lib/blueprints/publicResources.ts

@@ -25,6 +25,7 @@ import {
     rolePolicies,
     roleResources,
     roles,
+    Site,
     sites,
     Target,
     TargetHealthCheck,
@@ -74,19 +75,40 @@ export async function updatePublicResources(
     )) {
         const targetsToUpdate: Target[] = [];
         const healthchecksToUpdate: TargetHealthCheck[] = [];
+
         let resource: Resource;
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
+        let providedSite: Partial<Site> | undefined;
+        if (siteId) {
+            // Use the provided siteId directly, but verify it belongs to the org
+            [providedSite] = await trx
+                .select({
+                    siteId: sites.siteId,
+                    type: sites.type,
+                    status: sites.status
+                })
+                .from(sites)
+                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+                .limit(1);
+
+            resourceStatusFromSite = providedSite?.status ?? "approved";
+        }
 
         async function createTarget( // reusable function to create a target
             resourceId: number,
             targetData: TargetData
         ) {
             const targetSiteId = targetData.site;
-            let site;
+            let site: Partial<Site> | undefined;
 
             if (targetSiteId) {
                 // Look up site by niceId
                 [site] = await trx
-                    .select({ siteId: sites.siteId, type: sites.type })
+                    .select({
+                        siteId: sites.siteId,
+                        type: sites.type,
+                        status: sites.status
+                    })
                     .from(sites)
                     .where(
                         and(
@@ -95,15 +117,9 @@ export async function updatePublicResources(
                         )
                     )
                     .limit(1);
-            } else if (siteId) {
+            } else if (siteId && providedSite) {
                 // Use the provided siteId directly, but verify it belongs to the org
-                [site] = await trx
+                site = providedSite;
-                    .select({ siteId: sites.siteId, type: sites.type })
-                    .from(sites)
-                    .where(
-                        and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-                    )
-                    .limit(1);
             } else {
                 throw new Error(`Target site is required`);
             }
@@ -139,7 +155,7 @@ export async function updatePublicResources(
                 .insert(targets)
                 .values({
                     resourceId: resourceId,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     ip: targetData.hostname,
                     mode: resourceData.mode as Target["mode"],
                     method: targetData.method,
@@ -172,7 +188,7 @@ export async function updatePublicResources(
                 .insert(targetHealthCheck)
                 .values({
                     name: `${targetData.hostname}:${targetData.port}`,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     targetId: newTarget.targetId,
                     orgId: orgId,
                     hcEnabled: healthcheckData?.enabled || false,
@@ -230,7 +246,10 @@ export async function updatePublicResources(
         const resourceEnabled =
             resourceData.enabled == undefined || resourceData.enabled == null
                 ? true
-                : resourceData.enabled;
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         const resourceSsl =
             resourceData.ssl == undefined || resourceData.ssl == null
                 ? true
@@ -406,7 +425,8 @@ export async function updatePublicResources(
                                     ? (resourceData["proxy-protocol-version"] ??
                                       1)
                                     : 1,
-                            resourcePolicyId: sharedPolicy.resourcePolicyId
+                            resourcePolicyId: sharedPolicy.resourcePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -590,7 +610,8 @@ export async function updatePublicResources(
                             authDaemonPort:
                                 resourceData["auth-daemon"]?.port || 22123,
                             resourcePolicyId: null,
-                            defaultResourcePolicyId: inlinePolicyId
+                            defaultResourcePolicyId: inlinePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -1131,6 +1152,7 @@ export async function updatePublicResources(
                 .values({
                     orgId,
                     niceId: resourceNiceId,
+                    status: resourceStatusFromSite,
                     name: resourceData.name || "Unnamed Resource",
                     mode: resourceData.mode,
                     proxyPort: ["http", "ssh", "rdp", "vnc"].includes(

server/lib/blueprints/types.ts

@@ -470,7 +470,7 @@ export const PrivateResourceSchema = z
         // proxyPort: z.int().positive().optional(),
         "destination-port": z.int().positive().optional(),
         destination: z.string().min(1).optional(),
-        // enabled: z.boolean().default(true),
+        enabled: z.boolean().default(true),
         "tcp-ports": portRangeStringSchema.optional().default("*"),
         "udp-ports": portRangeStringSchema.optional().default("*"),
         "disable-icmp": z.boolean().optional().default(false),

server/lib/ip.ts

@@ -496,6 +496,7 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
+            if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
             if (sr.mode === "cidr") {
@@ -530,6 +531,7 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
     return allSiteResources
         .filter(
             (sr) =>
+                sr.enabled &&
                 sr.aliasAddress &&
                 ((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
                     (sr.fullDomain && sr.mode == "http"))
@@ -662,6 +664,13 @@ export async function generateSubnetProxyTargetV2(
         subnet: string | null;
     }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
+    if (!siteResource.enabled) {
+        logger.debug(
+            `Site resource ${siteResource.siteResourceId} is disabled, skipping target generation.`
+        );
+        return;
+    }
+
     if (clients.length === 0) {
         logger.debug(
             `No clients have access to site resource ${siteResource.siteResourceId}, skipping target generation.`

server/lib/rebuildClientAssociations.ts

@@ -1561,9 +1561,19 @@ export async function handleMessagingForUpdatedSiteResource(
                 updatedSiteResource.udpPortRangeString ||
             existingSiteResource.disableIcmp !==
                 updatedSiteResource.disableIcmp);
+    // Toggling enabled on/off doesn't change any of the fields above, but it
+    // does change whether targets/peer data should exist at all, so it needs
+    // to drive the same old->new diff machinery: going enabled->disabled
+    // diffs "real data" against "nothing" (a remove), and disabled->enabled
+    // diffs "nothing" against "real data" (an add). generateSubnetProxyTargetV2/
+    // generateRemoteSubnets/generateAliasConfig already return nothing for a
+    // disabled resource, so no other changes are needed here.
+    const enabledChanged =
+        existingSiteResource &&
+        existingSiteResource.enabled !== updatedSiteResource.enabled;
 
     logger.debug(
-        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)}`
+        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)} enabledChanged=${Boolean(enabledChanged)}`
     );
 
     // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all
@@ -1574,14 +1584,16 @@ export async function handleMessagingForUpdatedSiteResource(
         fullDomainChanged ||
         sslChanged ||
         portRangesChanged ||
-        destinationPortChanged
+        destinationPortChanged ||
+        enabledChanged
     ) {
         const shouldUpdateTargets =
             destinationChanged ||
             sslChanged ||
             portRangesChanged ||
             fullDomainChanged ||
-            destinationPortChanged;
+            destinationPortChanged ||
+            enabledChanged;
 
         logger.debug(
             `handleMessagingForUpdatedSiteResource: entering unchanged-site update path shouldUpdateTargets=${shouldUpdateTargets}`
@@ -1657,20 +1669,22 @@ export async function handleMessagingForUpdatedSiteResource(
                 peerDataUpdateBatch.push({
                     clientId: client.clientId,
                     siteId,
-                    remoteSubnets: destinationChanged
+                    remoteSubnets:
-                        ? {
+                        destinationChanged || enabledChanged
-                              oldRemoteSubnets: !oldDestinationStillInUseBySite
+                            ? {
-                                  ? generateRemoteSubnets([
+                                  oldRemoteSubnets:
-                                        existingSiteResource
+                                      !oldDestinationStillInUseBySite
-                                    ])
+                                          ? generateRemoteSubnets([
-                                  : [],
+                                                existingSiteResource
-                              newRemoteSubnets: generateRemoteSubnets([
+                                            ])
-                                  updatedSiteResource
+                                          : [],
-                              ])
+                                  newRemoteSubnets: generateRemoteSubnets([
-                          }
+                                      updatedSiteResource
-                        : undefined,
+                                  ])
+                              }
+                            : undefined,
                     aliases:
-                        aliasChanged || fullDomainChanged // the full domain is sent down as an alias
+                        aliasChanged || fullDomainChanged || enabledChanged // the full domain is sent down as an alias
                             ? {
                                   oldAliases: generateAliasConfig([
                                       existingSiteResource

server/routers/badger/verifySession.ts

@@ -736,11 +736,14 @@ export async function verifyResourceSession(
             }
         }
 
-        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge
+        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge.
+        // Skip the challenge when SSO is also enabled so browsers get the SSO redirect instead of a native Basic
+        // Auth dialog; clients that proactively send Authorization: Basic are still accepted above.
         if (
             headerAuthExtendedCompatibility &&
             headerAuthExtendedCompatibility.extendedCompatibilityIsActivated &&
-            !clientHeaderAuth
+            !clientHeaderAuth &&
+            !sso
         ) {
             return headerAuthChallenged(res, redirectPath, resource.orgId);
         }

server/routers/integration.ts

@@ -808,6 +808,16 @@ authenticated.post(
     accessToken.generateAccessToken
 );
 
+authenticated.post(
+    `/resource/:resourceId/session-token`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyUserAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceSessionToken),
+    logActionAudit(ActionsEnum.createResourceSessionToken),
+    resource.createResourceSessionToken
+);
+
 authenticated.delete(
     `/access-token/:accessTokenId`,
     verifyApiKeyAccessTokenAccess,

server/routers/launcher/launcherResourceAccess.ts

@@ -157,7 +157,8 @@ async function resolveAccessibleIdsUncached(
             .where(
                 and(
                     eq(userResources.userId, userId),
-                    eq(resources.orgId, orgId)
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
                 )
             ),
         userRoleIds.length > 0
@@ -171,7 +172,8 @@ async function resolveAccessibleIdsUncached(
                   .where(
                       and(
                           inArray(roleResources.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                       )
                   )
             : Promise.resolve([]),
@@ -183,7 +185,11 @@ async function resolveAccessibleIdsUncached(
                 eq(effectiveResourcePolicyId, userPolicies.resourcePolicyId)
             )
             .where(
-                and(eq(userPolicies.userId, userId), eq(resources.orgId, orgId))
+                and(
+                    eq(userPolicies.userId, userId),
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
+                )
             ),
         userRoleIds.length > 0
             ? db
@@ -199,21 +205,48 @@ async function resolveAccessibleIdsUncached(
                   .where(
                       and(
                           inArray(rolePolicies.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                       )
                   )
             : Promise.resolve([]),
         db
             .select({ siteResourceId: userSiteResources.siteResourceId })
             .from(userSiteResources)
-            .where(eq(userSiteResources.userId, userId)),
+            .innerJoin(
+                siteResources,
+                eq(
+                    userSiteResources.siteResourceId,
+                    siteResources.siteResourceId
+                )
+            )
+            .where(
+                and(
+                    eq(userSiteResources.userId, userId),
+                    eq(siteResources.orgId, orgId),
+                    eq(siteResources.status, "approved")
+                )
+            ),
         userRoleIds.length > 0
             ? db
                   .select({
                       siteResourceId: roleSiteResources.siteResourceId
                   })
                   .from(roleSiteResources)
-                  .where(inArray(roleSiteResources.roleId, userRoleIds))
+                  .innerJoin(
+                      siteResources,
+                      eq(
+                          roleSiteResources.siteResourceId,
+                          siteResources.siteResourceId
+                      )
+                  )
+                  .where(
+                      and(
+                          inArray(roleSiteResources.roleId, userRoleIds),
+                          eq(siteResources.orgId, orgId),
+                          eq(siteResources.status, "approved")
+                      )
+                  )
             : Promise.resolve([])
     ]);
 
@@ -365,6 +398,7 @@ async function filterPublicResourceIdsByTextSearch(
                 inArray(resources.resourceId, resourceIds),
                 eq(resources.orgId, orgId),
                 eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                 textMatch
             )
         );
@@ -402,6 +436,7 @@ async function filterSiteResourceIdsByTextSearch(
                 inArray(siteResources.siteResourceId, siteResourceIds),
                 eq(siteResources.orgId, orgId),
                 eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                 textMatch
             )
         );
@@ -503,7 +538,8 @@ async function listSiteGroups(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (searchPublic) {
             publicConditions.push(searchPublic);
@@ -558,7 +594,8 @@ async function listSiteGroups(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (searchSite) {
             siteConditions.push(searchSite);
@@ -621,7 +658,8 @@ async function listSiteGroups(
         const noSitePublicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (searchPublic) {
             noSitePublicConditions.push(searchPublic);
@@ -655,7 +693,8 @@ async function listSiteGroups(
         const noSiteSiteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (searchSite) {
             noSiteSiteConditions.push(searchSite);
@@ -746,7 +785,8 @@ async function listLabelGroups(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         const searchPublic = buildSearchConditionForPublic(query.query);
         if (searchPublic) {
@@ -810,7 +850,8 @@ async function listLabelGroups(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         const searchSite = buildSearchConditionForSiteResource(query.query);
         if (searchSite) {
@@ -997,6 +1038,7 @@ async function mapPublicResources(
                 inArray(resources.resourceId, resourceIds),
                 eq(resources.orgId, orgId),
                 eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                 siteIdFilter != null
                     ? eq(sites.siteId, siteIdFilter)
                     : undefined
@@ -1088,6 +1130,7 @@ async function mapSiteResources(
                 inArray(siteResources.siteResourceId, siteResourceIds),
                 eq(siteResources.orgId, orgId),
                 eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                 siteIdFilter != null
                     ? eq(sites.siteId, siteIdFilter)
                     : undefined
@@ -1382,7 +1425,8 @@ async function collectAccessibleSites(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (siteNameSearch) {
             publicConditions.push(siteNameSearch);
@@ -1422,7 +1466,8 @@ async function collectAccessibleSites(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (siteNameSearch) {
             siteConditions.push(siteNameSearch);
@@ -1476,6 +1521,7 @@ async function collectAccessibleLabels(
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
             eq(resources.enabled, true),
+            eq(resources.status, "approved"),
             eq(labels.orgId, orgId)
         ];
         if (labelNameSearch) {
@@ -1511,6 +1557,7 @@ async function collectAccessibleLabels(
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
             eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved"),
             eq(labels.orgId, orgId)
         ];
         if (labelNameSearch) {

server/routers/newt/buildConfiguration.ts

@@ -148,7 +148,12 @@ export async function buildClientConfigurationForNewtClient(
         .from(siteResources)
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
-        .where(eq(siteNetworks.siteId, siteId))
+        .where(
+            and(
+                eq(siteNetworks.siteId, siteId),
+                eq(siteResources.enabled, true)
+            )
+        )
         .then((rows) => rows.map((r) => r.siteResources));
 
     const targetsToSend: SubnetProxyTargetV2[] = [];

server/routers/newt/pingAccumulator.ts

@@ -94,7 +94,13 @@ async function flushSitePingsToDb(): Promise<void> {
     const pingsToFlush = new Map(pendingSitePings);
     pendingSitePings.clear();
 
-    const entries = Array.from(pingsToFlush.entries());
+    // Sort by id ascending so concurrent writers (other app replicas, or
+    // unrelated single-row updates elsewhere in the app) always acquire row
+    // locks in the same order. Without this, overlapping batches/updates
+    // that touch the same rows in different orders can deadlock each other.
+    const entries = Array.from(pingsToFlush.entries()).sort(
+        ([a], [b]) => a - b
+    );
 
     const BATCH_SIZE = 50;
     for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -193,7 +199,11 @@ async function flushClientPingsToDb(): Promise<void> {
 
     // ── Flush client pings ─────────────────────────────────────────────
     if (pingsToFlush.size > 0) {
-        const entries = Array.from(pingsToFlush.entries());
+        // Sort ascending for consistent lock ordering (see note in
+        // flushSitePingsToDb).
+        const entries = Array.from(pingsToFlush.entries()).sort(
+            ([a], [b]) => a - b
+        );
 
         const BATCH_SIZE = 50;
         for (let i = 0; i < entries.length; i += BATCH_SIZE) {

server/routers/olm/buildConfiguration.ts

@@ -16,7 +16,7 @@ import {
     generateRemoteSubnets
 } from "@server/lib/ip";
 import logger from "@server/logger";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
 import config from "@server/lib/config";
 
@@ -70,7 +70,13 @@ export async function buildSiteConfigurationForOlmClient(
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
         .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
+            and(
+                eq(
+                    clientSiteResourcesAssociationsCache.clientId,
+                    client.clientId
+                ),
+                eq(siteResources.enabled, true)
+            )
         );
 
     const siteResourcesBySiteId = new Map<number, SiteResource[]>();

server/routers/resource/createResourceSessionToken.ts

@@ -0,0 +1,133 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, users, userOrgs } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { createResourceSession } from "@server/auth/sessions/resource";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createSession, generateSessionToken } from "@server/auth/sessions/app";
+import { response } from "@server/lib/response";
+
+const createResourceSessionTokenParams = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceSessionTokenBody = z.strictObject({
+    userId: z.string().nonempty(),
+    idpId: z.coerce.number().int().positive().optional()
+});
+
+export type CreateResourceSessionTokenResponse = {
+    requestToken: string;
+};
+
+export async function createResourceSessionToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = createResourceSessionTokenParams.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceSessionTokenBody.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { userId, idpId } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const candidates = await db
+            .select({ userId: users.userId })
+            .from(userOrgs)
+            .innerJoin(users, eq(userOrgs.userId, users.userId))
+            .where(
+                and(
+                    eq(users.userId, userId),
+                    eq(userOrgs.orgId, resource.orgId)
+                )
+            );
+
+        if (candidates.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `User not found in the organization that owns this resource`
+                )
+            );
+        }
+
+        if (candidates.length > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Multiple users match this username (external users from different identity providers). Specify idpId to disambiguate."
+                )
+            );
+        }
+
+        const targetUserId = candidates[0].userId;
+
+        const appSessionToken = generateSessionToken();
+        const appSession = await createSession(appSessionToken, targetUserId);
+
+        const requestToken = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token: requestToken,
+            userSessionId: appSession.sessionId,
+            isRequestToken: true,
+            expiresAt: Date.now() + 1000 * 30, // 30 seconds
+            sessionLength: 1000 * 30,
+            doNotExtend: true
+        });
+
+        logger.debug("Resource session token created successfully");
+
+        return response<CreateResourceSessionTokenResponse>(res, {
+            data: { requestToken },
+            success: true,
+            error: false,
+            message: "Resource session token created successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/index.ts

@@ -17,6 +17,7 @@ export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./getExchangeToken";
+export * from "./createResourceSessionToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";

server/routers/resource/listResources.ts

@@ -138,6 +138,15 @@ const listResourcesSchema = z.strictObject({
         description:
             "When set, only resources that have at least one target on this site are returned"
     }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by resource status"
+        }),
     labels: z
         .preprocess((val) => {
             if (val === undefined || val === null || val === "") {
@@ -451,6 +460,7 @@ export async function listResources(
             sort_by,
             order,
             siteId,
+            status,
             labels: labelFilter
         } = parsedQuery.data;
 
@@ -660,6 +670,10 @@ export async function listResources(
             }
         }
 
+        if (typeof status !== "undefined") {
+            conditions.push(eq(resources.status, status));
+        }
+
         if (siteId != null) {
             const resourcesWithSite = db
                 .select({ resourceId: targets.resourceId })

server/routers/resource/listUserResourceAliases.ts

@@ -45,18 +45,19 @@ function userResourceAliasesCacheKey(
     page: number,
     pageSize: number,
     includeLabels: boolean,
-    labelFilter: string[]
+    labelFilter: string[],
+    status?: "pending" | "approved"
 ) {
     const labelsKey =
         labelFilter.length > 0 ? labelFilter.slice().sort().join(",") : "all";
-    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}`;
+    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}:${status ?? "all"}`;
 }
 
 const listUserResourceAliasesParamsSchema = z.strictObject({
     orgId: z.string()
 });
 
-const listUserResourceAliasesQuerySchema = z.strictObject({
+const listUserResourceAliasesQuerySchema = z.object({
     pageSize: z.coerce
         .number<string>()
         .int()
@@ -96,7 +97,16 @@ const listUserResourceAliasesQuerySchema = z.strictObject({
         type: "array",
         description:
             "Filter by resource labels. A resource matches when it has any of the given labels (OR)."
-    })
+    }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        })
 });
 
 export type UserResourceAliasItem = {
@@ -130,7 +140,8 @@ export async function listUserResourceAliases(
             page,
             pageSize,
             includeLabels,
-            labels: labelFilter
+            labels: labelFilter,
+            status
         } = parsedQuery.data;
 
         const parsedParams = listUserResourceAliasesParamsSchema.safeParse(
@@ -172,7 +183,8 @@ export async function listUserResourceAliases(
             page,
             pageSize,
             includeLabels,
-            labelFilter ?? []
+            labelFilter ?? [],
+            status
         );
         const cachedData: ListUserResourceAliasesResponse | undefined =
             await cache.get(cacheKey);
@@ -257,6 +269,10 @@ export async function listUserResourceAliases(
             inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
+        if (typeof status !== "undefined") {
+            whereConditions.push(eq(siteResources.status, status));
+        }
+
         if (labelFilter && labelFilter.length > 0) {
             whereConditions.push(
                 inArray(

server/routers/siteResource/createSiteResource.ts

@@ -56,7 +56,6 @@ const createSiteResourceSchema = z
         siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
         destinationPort: z.int().positive().optional(),
         destination: z.string().min(1).nullish(),
-        enabled: z.boolean().default(true),
         alias: z
             .string()
             .regex(
@@ -275,7 +274,6 @@ export async function createSiteResource(
             scheme,
             destinationPort,
             destination,
-            enabled,
             ssl,
             alias,
             userIds,
@@ -539,7 +537,6 @@ export async function createSiteResource(
                     destination: destination, // the ssh can be null
                     scheme,
                     destinationPort,
-                    enabled,
                     alias: alias ? alias.trim() : null,
                     aliasAddress,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -86,6 +86,15 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
         description:
             "When set, only site resources associated with this site (via network) are returned"
     }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        }),
     labels: z
         .preprocess((val) => {
             if (val === undefined || val === null || val === "") {
@@ -283,6 +292,7 @@ export async function listAllSiteResourcesByOrg(
             sort_by,
             order,
             siteId,
+            status,
             labels: labelFilter
         } = parsedQuery.data;
 
@@ -315,6 +325,10 @@ export async function listAllSiteResourcesByOrg(
             conditions.push(eq(siteResources.mode, mode));
         }
 
+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
         if (labelFilter && labelFilter.length > 0) {
             conditions.push(
                 inArray(

server/routers/siteResource/listSiteResources.ts

@@ -47,6 +47,15 @@ const listSiteResourcesQuerySchema = z.strictObject({
             enum: ["asc", "desc"],
             default: "asc",
             description: "Sort order"
+        }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
         })
 });
 
@@ -110,7 +119,7 @@ export async function listSiteResources(
         }
 
         const { siteId, orgId } = parsedParams.data;
-        const { limit, offset, sort_by, order } = parsedQuery.data;
+        const { limit, offset, sort_by, order, status } = parsedQuery.data;
 
         // Verify the site exists and belongs to the org
         const site = await db
@@ -124,6 +133,15 @@ export async function listSiteResources(
         }
 
         // Get site resources by joining networks to siteResources via siteNetworks
+        const conditions = [
+            eq(siteNetworks.siteId, siteId),
+            eq(siteResources.orgId, orgId)
+        ];
+
+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
         const siteResourcesList = await db
             .select()
             .from(siteNetworks)
@@ -132,12 +150,7 @@ export async function listSiteResources(
                 siteResources,
                 eq(siteResources.networkId, networks.networkId)
             )
-            .where(
+            .where(and(...conditions))
-                and(
-                    eq(siteNetworks.siteId, siteId),
-                    eq(siteResources.orgId, orgId)
-                )
-            )
             .orderBy(
                 sort_by
                     ? order === "asc"

server/routers/siteResource/updateSiteResource.ts

@@ -152,6 +152,11 @@ const updateSiteResourceSchema = z
     )
     .refine(
         (data) => {
+            // this is a partial update; only enforce destination when the
+            // caller is actually changing mode or destination
+            if (data.mode === undefined && data.destination === undefined) {
+                return true;
+            }
             // destination is only optional for ssh mode with native authDaemonMode
             if (data.mode === "ssh" && data.authDaemonMode === "native") {
                 return true;
@@ -411,8 +416,10 @@ export async function updateSiteResource(
             : [];
         const existingSiteIds = existingSiteNetworks.map((sn) => sn.siteId);
 
-        let fullDomain: string | null = null;
+        // undefined means "leave unchanged" (partial update); only nulled out
-        let finalSubdomain: string | null = null;
+        // when the mode is explicitly being changed away from http
+        let fullDomain: string | null | undefined = undefined;
+        let finalSubdomain: string | null | undefined = undefined;
         if (domainId) {
             // Validate domain and construct full domain
             const domainResult = await validateAndConstructDomain(
@@ -448,6 +455,11 @@ export async function updateSiteResource(
                     )
                 );
             }
+        } else if (mode !== undefined && mode !== "http") {
+            // mode is explicitly changing away from http, so the resource
+            // can no longer have a domain associated with it
+            fullDomain = null;
+            finalSubdomain = null;
         }
 
         // make sure the alias is unique within the org if provided
@@ -516,15 +528,28 @@ export async function updateSiteResource(
                     destination: destination,
                     destinationPort: destinationPort,
                     enabled: enabled,
-                    alias: alias ? alias.trim() : null,
+                    alias:
+                        alias !== undefined
+                            ? alias
+                                ? alias.trim()
+                                : null
+                            : mode !== undefined &&
+                                mode !== "host" &&
+                                mode !== "ssh"
+                              ? null
+                              : undefined,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
                     udpPortRangeString:
                         mode == "http" || mode == "ssh"
                             ? ""
                             : udpPortRangeString,
                     disableIcmp:
-                        disableIcmp ||
+                        mode !== undefined
-                        (mode == "http" || mode == "ssh" ? true : false),
+                            ? disableIcmp ||
+                              (mode == "http" || mode == "ssh"
+                                  ? true
+                                  : false)
+                            : disableIcmp,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

src/app/[orgId]/settings/resources/private/[niceId]/access/page.tsx

@@ -29,7 +29,7 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
 import { useActionState, useEffect } from "react";
 import { useForm } from "react-hook-form";
-import { PrivateResourceAccessFields } from "../../PrivateResourceAccessFields";
+import { PrivateResourceAccessFields } from "@app/components/PrivateResourceAccessFields";
 
 export default function PrivateResourceAccessPage() {
     const t = useTranslations();

src/app/[orgId]/settings/resources/private/[niceId]/cidr/page.tsx

@@ -20,12 +20,12 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
-import { PrivateResourceCidrDestinationField } from "../../PrivateResourceDestinationFields";
+import { PrivateResourceCidrDestinationField } from "@app/components/PrivateResourceDestinationFields";
-import { PrivateResourcePortRanges } from "../../PrivateResourcePortRanges";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
-import { asAnyControl, asAnySetValue } from "../../formControlUtils";
+import { asAnyControl, asAnySetValue } from "@app/lib/formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";
 
 export default function PrivateResourceCidrPage() {
     const t = useTranslations();

src/app/[orgId]/settings/resources/private/[niceId]/general/page.tsx

@@ -16,19 +16,21 @@ import { Button } from "@app/components/ui/button";
 import {
     Form,
     FormControl,
+    FormDescription,
     FormField,
     FormItem,
     FormLabel,
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
+import { SwitchInput } from "@app/components/SwitchInput";
 import { createGeneralFormSchema } from "@app/lib/privateResourceForm";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useTranslations } from "next-intl";
 import { useActionState, useMemo } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 
 export default function PrivateResourceGeneralPage() {
     const t = useTranslations();
@@ -41,7 +43,8 @@ export default function PrivateResourceGeneralPage() {
         resolver: zodResolver(formSchema),
         defaultValues: {
             name: siteResource.name,
-            niceId: siteResource.niceId
+            niceId: siteResource.niceId,
+            enabled: siteResource.enabled
         }
     });
 
@@ -52,7 +55,8 @@ export default function PrivateResourceGeneralPage() {
         const data = form.getValues();
         await save({
             name: data.name,
-            niceId: data.niceId
+            niceId: data.niceId,
+            enabled: data.enabled
         });
     }, null);
 
@@ -64,7 +68,7 @@ export default function PrivateResourceGeneralPage() {
                         {t("resourceGeneral")}
                     </SettingsSectionTitle>
                     <SettingsSectionDescription>
-                        {t("resourceGeneralDescription")}
+                        {t("privateResourceGeneralDescription")}
                     </SettingsSectionDescription>
                 </SettingsSectionHeader>
 
@@ -76,6 +80,42 @@ export default function PrivateResourceGeneralPage() {
                                 id="private-resource-general-form"
                             >
                                 <SettingsFormGrid>
+                                    <SettingsFormCell span="full">
+                                        <FormField
+                                            control={form.control}
+                                            name="enabled"
+                                            render={() => (
+                                                <FormItem>
+                                                    <FormControl>
+                                                        <SwitchInput
+                                                            id="enable-resource"
+                                                            defaultChecked={
+                                                                siteResource.enabled
+                                                            }
+                                                            label={t(
+                                                                "resourceEnable"
+                                                            )}
+                                                            onCheckedChange={(
+                                                                val
+                                                            ) =>
+                                                                form.setValue(
+                                                                    "enabled",
+                                                                    val
+                                                                )
+                                                            }
+                                                        />
+                                                    </FormControl>
+                                                    <FormDescription>
+                                                        {t(
+                                                            "disabledResourceDescription"
+                                                        )}
+                                                    </FormDescription>
+                                                    <FormMessage />
+                                                </FormItem>
+                                            )}
+                                        />
+                                    </SettingsFormCell>
+
                                     <SettingsFormCell span="half">
                                         <FormField
                                             control={form.control}

src/app/[orgId]/settings/resources/private/[niceId]/host/page.tsx

@@ -20,16 +20,16 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
-import { PrivateResourceHostDestinationFields } from "../../PrivateResourceDestinationFields";
+import { PrivateResourceHostDestinationFields } from "@app/components/PrivateResourceDestinationFields";
-import { PrivateResourcePortRanges } from "../../PrivateResourcePortRanges";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
     asAnyControl,
     asAnySetValue,
     asAnyWatch
-} from "../../formControlUtils";
+} from "@app/lib/formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";
 
 export default function PrivateResourceHostPage() {
     const t = useTranslations();

src/app/[orgId]/settings/resources/private/[niceId]/http/page.tsx

@@ -22,15 +22,15 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
-import { PrivateResourceHttpFields } from "../../PrivateResourceHttpFields";
+import { PrivateResourceHttpFields } from "@app/components/PrivateResourceHttpFields";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
     asAnyControl,
     asAnySetValue,
     asAnyWatch
-} from "../../formControlUtils";
+} from "@app/lib/formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";
 
 export default function PrivateResourceHttpPage() {
     const t = useTranslations();

src/app/[orgId]/settings/resources/private/[niceId]/ssh/page.tsx

@@ -26,15 +26,15 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSshFields } from "../../PrivateResourceSshFields";
+import { PrivateResourceSshFields } from "@app/components/PrivateResourceSshFields";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import type { Selectedsite } from "@app/components/site-selector";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
     asAnyControl,
     asAnySetValue,
     asAnyWatch
-} from "../../formControlUtils";
+} from "@app/lib/formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";
-import type { Selectedsite } from "@app/components/site-selector";
 
 export default function PrivateResourceSshPage() {
     const t = useTranslations();

src/app/[orgId]/settings/resources/private/create/page.tsx

@@ -50,16 +50,20 @@ import { useParams, useRouter, useSearchParams } from "next/navigation";
 import { useEffect, useMemo, useState, useTransition } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../PrivateResourceSitesField";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
-import { PrivateResourceHttpFields } from "../PrivateResourceHttpFields";
+import { PrivateResourceHttpFields } from "@app/components/PrivateResourceHttpFields";
-import { PrivateResourceSshFields } from "../PrivateResourceSshFields";
+import { PrivateResourceSshFields } from "@app/components/PrivateResourceSshFields";
-import { PrivateResourcePortRanges } from "../PrivateResourcePortRanges";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
 import {
     PrivateResourceAliasField,
     PrivateResourceCidrDestinationField,
     PrivateResourceHostDestinationFields
-} from "../PrivateResourceDestinationFields";
+} from "@app/components/PrivateResourceDestinationFields";
-import { asAnyControl, asAnySetValue, asAnyWatch } from "../formControlUtils";
+import {
+    asAnyControl,
+    asAnySetValue,
+    asAnyWatch
+} from "@app/lib/formControlUtils";
 
 export default function CreatePrivateResourcePage() {
     const params = useParams();

src/app/[orgId]/settings/resources/private/page.tsx

@@ -27,6 +27,7 @@ export default async function ClientResourcesPage(
     const params = await props.params;
     const t = await getTranslations();
     const searchParams = new URLSearchParams(await props.searchParams);
+    searchParams.set("status", "approved");
 
     let siteResources: ListAllSiteResourcesByOrgResponse["siteResources"] = [];
     let pagination: ListAllSiteResourcesByOrgResponse["pagination"] = {

src/app/[orgId]/settings/resources/public/page.tsx

@@ -38,6 +38,7 @@ export default async function ProxyResourcesPage(
     const params = await props.params;
     const t = await getTranslations();
     const searchParams = new URLSearchParams(await props.searchParams);
+    searchParams.set("status", "approved");
 
     let resources: ListResourcesResponse["resources"] = [];
     let pagination: ListResourcesResponse["pagination"] = {

src/components/PermissionsSelectBox.tsx

@@ -77,7 +77,8 @@ function getActionsCategories(root: boolean) {
             [t("actionDeleteSiteResource")]: "deleteSiteResource",
             [t("actionGetSiteResource")]: "getSiteResource",
             [t("actionListSiteResources")]: "listSiteResources",
-            [t("actionUpdateSiteResource")]: "updateSiteResource"
+            [t("actionUpdateSiteResource")]: "updateSiteResource",
+            [t("actionCreateResourceSessionToken")]: "createResourceSessionToken"
         },
 
         Target: {

src/components/PrivateResourcePortRanges.tsx

@@ -106,17 +106,23 @@ export function PrivateResourceNetworkAccessFields({
     embedInParentGrid = false
 }: PrivateResourceNetworkAccessFieldsProps) {
     const t = useTranslations();
+    const resolvedInitialTcp = initialTcp !== undefined ? initialTcp : "*";
+    const resolvedInitialUdp = initialUdp !== undefined ? initialUdp : "*";
     const [tcpPortMode, setTcpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialTcp)
+        getPortModeFromString(resolvedInitialTcp)
     );
     const [udpPortMode, setUdpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialUdp)
+        getPortModeFromString(resolvedInitialUdp)
     );
     const [tcpCustomPorts, setTcpCustomPorts] = useState(() =>
-        initialTcp && initialTcp !== "*" ? initialTcp : ""
+        resolvedInitialTcp && resolvedInitialTcp !== "*"
+            ? resolvedInitialTcp
+            : ""
     );
     const [udpCustomPorts, setUdpCustomPorts] = useState(() =>
-        initialUdp && initialUdp !== "*" ? initialUdp : ""
+        resolvedInitialUdp && resolvedInitialUdp !== "*"
+            ? resolvedInitialUdp
+            : ""
     );
 
     useEffect(() => {

src/components/PrivateResourceSitesField.tsx

@@ -23,7 +23,7 @@ import {
 import { ChevronsUpDown } from "lucide-react";
 import { useTranslations } from "next-intl";
 import type { Control, FieldPath, FieldValues } from "react-hook-form";
-import { PrivateResourceMultiSiteRoutingHelp } from "./PrivateResourceMultiSiteRoutingHelp";
+import { PrivateResourceMultiSiteRoutingHelp } from "@app/components/PrivateResourceMultiSiteRoutingHelp";
 
 type PrivateResourceSitesFieldProps<T extends FieldValues> = {
     control: Control<T>;

src/components/PrivateResourceSshFields.tsx

@@ -9,10 +9,10 @@ import {
 } from "@app/components/Settings";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { SshServerSettingsFields } from "@app/components/SshServerSettingsFields";
-import { PrivateResourceAliasField } from "./PrivateResourceDestinationFields";
+import { PrivateResourceAliasField } from "@app/components/PrivateResourceDestinationFields";
-import { PrivateResourceSitesField } from "./PrivateResourceSitesField";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
-import { getSshUseMultiSiteTargetForm } from "./privateResourceUtils";
 import { inferSshPamMode } from "@app/lib/privateResourceForm";
+import { getSshUseMultiSiteTargetForm } from "@app/lib/privateResourceUtils";
 import {
     FormControl,
     FormField,

src/components/PrivateResourcesTable.tsx

@@ -23,6 +23,7 @@ import {
     PopoverContent,
     PopoverTrigger
 } from "@app/components/ui/popover";
+import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
@@ -36,7 +37,9 @@ import { getPrivateResourceSettingsHref } from "@app/lib/launcherResourceAdminHr
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { UpdateSiteResourceResponse } from "@server/routers/siteResource";
 import type { PaginationState } from "@tanstack/react-table";
+import { AxiosResponse } from "axios";
 import {
     ArrowDown01Icon,
     ArrowRight,
@@ -49,8 +52,17 @@ import {
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
-import { startTransition, useMemo, useState, useTransition } from "react";
+import {
+    startTransition,
+    useMemo,
+    useOptimistic,
+    useRef,
+    useState,
+    useTransition,
+    type ComponentRef
+} from "react";
 import { useDebouncedCallback } from "use-debounce";
+import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
@@ -114,6 +126,11 @@ function isSafeUrlForLink(href: string): boolean {
     }
 }
 
+const booleanSearchFilterSchema = z
+    .enum(["true", "false"])
+    .optional()
+    .catch(undefined);
+
 type ClientResourcesTableProps = {
     internalResources: InternalResourceRow[];
     orgId: string;
@@ -174,6 +191,30 @@ export default function PrivateResourcesTable({
         });
     };
 
+    async function toggleInternalResourceEnabled(
+        val: boolean,
+        resourceId: number
+    ) {
+        try {
+            await api.post<AxiosResponse<UpdateSiteResourceResponse>>(
+                `site-resource/${resourceId}`,
+                {
+                    enabled: val
+                }
+            );
+            router.refresh();
+        } catch (e) {
+            toast({
+                variant: "destructive",
+                title: t("resourcesErrorUpdate"),
+                description: formatAxiosError(
+                    e,
+                    t("resourcesErrorUpdateDescription")
+                )
+            });
+        }
+    }
+
     const deleteInternalResource = async (
         resourceId: number,
         siteId: number
@@ -429,6 +470,36 @@ export default function PrivateResourcesTable({
                     );
                 }
             },
+            {
+                accessorKey: "enabled",
+                friendlyName: t("enabled"),
+                header: () => (
+                    <ColumnFilterButton
+                        options={[
+                            { value: "true", label: t("enabled") },
+                            { value: "false", label: t("disabled") }
+                        ]}
+                        selectedValue={booleanSearchFilterSchema.parse(
+                            searchParams.get("enabled")
+                        )}
+                        onValueChange={(value) =>
+                            handleFilterChange("enabled", value)
+                        }
+                        searchPlaceholder={t("searchPlaceholder")}
+                        emptyMessage={t("emptySearchOptions")}
+                        label={t("enabled")}
+                        className="p-3"
+                    />
+                ),
+                cell: ({ row }) => (
+                    <InternalResourceEnabledForm
+                        resource={row.original}
+                        onToggleInternalResourceEnabled={
+                            toggleInternalResourceEnabled
+                        }
+                    />
+                )
+            },
             {
                 id: "labels",
                 accessorKey: "labels",
@@ -643,3 +714,39 @@ function ClientResourceLabelCell({
         />
     );
 }
+
+type InternalResourceEnabledFormProps = {
+    resource: InternalResourceRow;
+    onToggleInternalResourceEnabled: (
+        val: boolean,
+        resourceId: number
+    ) => Promise<void>;
+};
+
+function InternalResourceEnabledForm({
+    resource,
+    onToggleInternalResourceEnabled
+}: InternalResourceEnabledFormProps) {
+    const [optimisticEnabled, setOptimisticEnabled] = useOptimistic(
+        resource.enabled
+    );
+
+    const formRef = useRef<ComponentRef<"form">>(null);
+
+    async function submitAction(formData: FormData) {
+        const newEnabled = !(formData.get("enabled") === "on");
+        setOptimisticEnabled(newEnabled);
+        await onToggleInternalResourceEnabled(newEnabled, resource.id);
+    }
+
+    return (
+        <form action={submitAction} ref={formRef}>
+            <Switch
+                checked={optimisticEnabled}
+                disabled={optimisticEnabled !== resource.enabled}
+                name="enabled"
+                onCheckedChange={() => formRef.current?.requestSubmit()}
+            />
+        </form>
+    );
+}

src/lib/privateResourceForm.ts

@@ -165,7 +165,6 @@ export function buildCreateSiteResourcePayload(
         siteIds: data.siteIds,
         mode: data.mode,
         destination: isNativeSsh ? undefined : (data.destination ?? undefined),
-        enabled: true,
         ...(data.mode === "http" && {
             scheme: data.scheme,
             ssl: data.ssl ?? false,
@@ -342,7 +341,8 @@ export function createGeneralFormSchema(t: TranslateFn) {
             .string()
             .min(1)
             .max(255)
-            .regex(/^[a-zA-Z0-9-]+$/)
+            .regex(/^[a-zA-Z0-9-]+$/),
+        enabled: z.boolean()
     });
 }