New translations en-us.json (Norwegian Bokmal)

[ci skip]

.claude/skills/crud-endpoints/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: crud-endpoints
+description: Use whenever asked to add, create, or scaffold a CRUD endpoint, router, or entity in this repo's server (create/list/get/update/delete handlers, new `server/routers/<entity>/` or `server/private/routers/<entity>/` folder). Points to the established file layout, middleware, ActionsEnum, and route-registration conventions before writing any code.
+---
+
+Before writing any router/handler/middleware code for a new entity, read
+`docs/crud-endpoints.md` in full. It documents, with real examples from
+`server/routers/aiProvider/` (public) and `server/private/routers/alertRule/`
+(enterprise-only), how this repo structures CRUD endpoints:
+
+- Directory/file layout per entity (`index.ts`, `types.ts`, `validation.ts`,
+  one file per operation).
+- The standard handler anatomy (zod parsing, OpenAPI registry, response
+  envelope, error handling).
+- Where access-control middleware (`verify<Entity>Access`) lives and when
+  it's needed vs. plain `verifyOrgAccess`.
+- How to wire up `ActionsEnum` entries, `verifyUserHasAction`, and
+  `logActionAudit`.
+- Which of the four router files (`server/routers/external.ts`,
+  `server/routers/internal.ts`, `server/private/routers/external.ts`,
+  `server/private/routers/internal.ts`) to register routes in, and the
+  middleware chain template per HTTP verb.
+- The repo's non-standard verb convention: **`PUT` = create, `POST` =
+  update** (backwards from typical REST) — don't "fix" this to standard
+  REST verbs, match the existing convention.
+- The `#dynamic` import alias, for the rare case of a hook needing different
+  implementations in OSS vs. enterprise builds.
+
+Follow that doc's checklist (§8) step by step rather than improvising a
+structure. If the doc and the actual code in `aiProvider`/`alertRule` ever
+disagree, trust the code and flag the doc as stale.

.cursor/rules/Button-loading-state.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When adding submit buttons, don't change the text of the button during the loading state. Text should stay static and you should use the loading prop on the button.

.cursor/rules/Components.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When creating UI for popup dialogs or modals, use the Credenza componennt. This component is mobile responsive and works on desktop and wraps the dialog component and sheet into one.

.cursor/rules/Migrations.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+Don't write or edit migrations in `server/setup` unless specificall instructed to do so.

.cursor/rules/TypeScript-rules.mdc

@@ -0,0 +1,7 @@
+---
+alwaysApply: true
+---
+
+When writing TypeScript:
+
+Prefer to use types instead of interfaces.

.cursor/rules/Use-React-form-and-Zod-schemas.mdc

@@ -0,0 +1,5 @@
+---
+alwaysApply: true
+---
+
+When creating forms, use React form for validation and use Zod schemas.

.dockerignore

@@ -34,3 +34,5 @@ build.ts
 tsconfig.json
 Dockerfile*
 drizzle.config.ts
+allowedDevOrigins.json
+scratch/

.github/FUNDING.yml

@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: [fosrl]

.github/ISSUE_TEMPLATE/1.bug_report.yml

@@ -14,12 +14,13 @@ body:
           label: Environment
           description: Please fill out the relevant details below for your environment.
           value: |
-              - OS Type & Version: (e.g., Ubuntu 22.04)
+              - OS Type & Version:
               - Pangolin Version:
+              - Edition (Community or Enterprise):
               - Gerbil Version:
               - Traefik Version:
               - Newt Version:
-              - Olm Version: (if applicable)
+              - Client Version:
       validations:
           required: true
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,6 +4,10 @@ perpetual license to use, modify, and redistribute these contributions under any
 choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
 represent that I have the right to grant this license for all contributed content.
 
+## AI Disclosure
+
+> Please disclose how AI was used in this pull request. The use of AI does not preclude this from being merged but is an important factor in how we review your request.
+
 ## Description
 
 

.github/dependabot.yml

@@ -1,52 +1,42 @@
 version: 2
+
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      dev-patch-updates:
-        dependency-type: "development"
-        update-types:
-          - "patch"
-      dev-minor-updates:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"
-          
+      npm-dependencies:
+        patterns:
+          - "*"
+
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
-        update-types:
-          - "patch"
-      minor-updates:
-        update-types:
-          - "minor"
+      docker-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "gomod"
     directory: "/install"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 1
     groups:
-      patch-updates:
-        update-types:
-          - "patch"
-      minor-updates:
-        update-types:
-          - "minor"
+      go-install-dependencies:
+        patterns:
+          - "*"

.github/workflows/cicd.yml

@@ -62,7 +62,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Monitor storage space
               run: |
@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -134,7 +134,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Monitor storage space
               run: |
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -201,10 +201,10 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -256,7 +256,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Extract tag name
               id: get-tag
@@ -264,7 +264,7 @@ jobs:
               shell: bash
 
             - name: Install Go
-              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
               with:
                   go-version: 1.25
 
@@ -407,7 +407,7 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}
@@ -415,7 +415,9 @@ jobs:
 
             - name: Install cosign
               # cosign is used to sign container images using keyless (OIDC) signing
-              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+              with:
+                cosign-release: v3.0.6
 
             - name: Sign (GHCR, keyless)
               # Sign each GHCR image by digest using keyless (OIDC) signing via Sigstore/Rekor.

.github/workflows/linting.yml

@@ -21,10 +21,10 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Set up Node.js
-              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                 node-version: '24'
 

.github/workflows/mirror.yaml

@@ -23,7 +23,7 @@ jobs:
           skopeo --version
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Input check
         run: |

.github/workflows/restart-runners.yml

@@ -1,39 +0,0 @@
-name: Restart Runners
-
-on:
-  schedule:
-    - cron: '0 0 */7 * *'
-
-permissions:
-    id-token: write
-    contents: read
-
-jobs:
-  ec2-maintenance-prod:
-    runs-on: ubuntu-latest
-    permissions: write-all
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-          role-duration-seconds: 3600
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Verify AWS identity
-        run: aws sts get-caller-identity
-
-      - name: Start EC2 instance
-        run: |
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances started"
-
-      - name: Wait
-        run: sleep 600
-
-      - name: Stop EC2 instance
-        run: |
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances stopped"

.github/workflows/saas.yml

@@ -1,160 +0,0 @@
-name: SAAS Pipeline
-
-# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
-# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
-
-permissions:
-  contents: read
-  packages: write      # for GHCR push
-  id-token: write      # for Cosign Keyless (OIDC) Signing
-
-on:
-    push:
-        tags:
-            - "[0-9]+.[0-9]+.[0-9]+-s.[0-9]+"
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-    pre-run:
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Start EC2 instances
-              run: |
-                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances started"
-
-
-    release-arm:
-        name: Build and Release (ARM64)
-        runs-on: [self-hosted, linux, arm64, us-east-1]
-        needs: [pre-run]
-        if: >-
-            ${{
-                needs.pre-run.result == 'success'
-            }}
-        # Job-level timeout to avoid runaway or stuck runs
-        timeout-minutes: 120
-        env:
-          # Target images
-          AWS_IMAGE: ${{ secrets.aws_account_id }}.dkr.ecr.us-east-1.amazonaws.com/${{ github.event.repository.name }}
-
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-            - name: Download MaxMind GeoLite2 databases
-              env:
-                MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }}
-              run: |
-                echo "Downloading MaxMind GeoLite2 databases..."
-
-                # Download GeoLite2-Country
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-Country.tar.gz
-
-                # Download GeoLite2-ASN
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-ASN&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-ASN.tar.gz
-
-                # Extract the .mmdb files
-                tar -xzf GeoLite2-Country.tar.gz --strip-components=1 --wildcards '*.mmdb'
-                tar -xzf GeoLite2-ASN.tar.gz --strip-components=1 --wildcards '*.mmdb'
-
-                # Verify files exist
-                if [ ! -f "GeoLite2-Country.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-Country.mmdb"
-                  exit 1
-                fi
-
-                if [ ! -f "GeoLite2-ASN.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-ASN.mmdb"
-                  exit 1
-                fi
-
-                # Clean up tar files
-                rm -f GeoLite2-Country.tar.gz GeoLite2-ASN.tar.gz
-
-                echo "MaxMind databases downloaded successfully"
-                ls -lh GeoLite2-*.mmdb
-
-            - name: Monitor storage space
-              run: |
-                  THRESHOLD=75
-                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
-                  echo "Used space: $USED_SPACE%"
-                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
-                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
-                      echo y | docker system prune -a
-                  else
-                      echo "Storage space is above the threshold. No action needed."
-                  fi
-
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Login to Amazon ECR
-              id: login-ecr
-              uses: aws-actions/amazon-ecr-login@v2
-
-            - name: Extract tag name
-              id: get-tag
-              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-              shell: bash
-
-            - name: Update version in package.json
-              run: |
-                  TAG=${{ env.TAG }}
-                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
-                  cat server/lib/consts.ts
-              shell: bash
-
-            - name: Build and push Docker images (Docker Hub - ARM64)
-              run: |
-                  TAG=${{ env.TAG }}
-                  make build-saas tag=$TAG
-                  echo "Built & pushed ARM64 images to: ${{ env.AWS_IMAGE }}:${TAG}"
-              shell: bash
-
-    post-run:
-        needs: [pre-run, release-arm]
-        if: >-
-            ${{
-                always() &&
-                needs.pre-run.result == 'success' &&
-                (needs.release-arm.result == 'success' || needs.release-arm.result == 'skipped' || needs.release-arm.result == 'failure')
-            }}
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Stop EC2 instances
-              run: |
-                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances stopped"

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-stale: 14
           days-before-close: 14

.github/workflows/test.yml

@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
 
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build Docker image sqlite
         run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build Docker image pg
         run: make dev-build-pg

.gitignore

@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite
+*.sqlite*
 !Dockerfile.sqlite
-*.sqlite3
+*.sqlite3*
 *.log
 .machinelogs*.json
 *-audit.json
@@ -54,3 +54,5 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
+solo.yml
+allowedDevOrigins.json

.vscode/settings.json

@@ -18,5 +18,8 @@
     "[json]": {
         "editor.defaultFormatter": "esbenp.prettier-vscode"
     },
-    "editor.formatOnSave": true
+    "editor.formatOnSave": true,
+    "cSpell.words": [
+        "nessicary"
+    ]
 }

Dockerfile

@@ -1,5 +1,5 @@
-# FROM node:24-slim AS base
-FROM public.ecr.aws/docker/library/node:24-slim AS base
+# FROM node:24.18.1-slim AS base
+FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
 
 WORKDIR /app
 
@@ -32,8 +32,8 @@ FROM base AS builder
 
 RUN npm ci --omit=dev
 
-# FROM node:24-slim AS runner
-FROM public.ecr.aws/docker/library/node:24-slim AS runner
+# FROM node:24.18.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
 
 WORKDIR /app
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:24.18.1-alpine
 
 WORKDIR /app
 

README.md

@@ -41,7 +41,7 @@
     </strong>
 </p>
 
-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.
 
 ## Installation
 
@@ -63,11 +63,26 @@ Pangolin is an open-source, identity-based remote access platform built on WireG
 
 Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.
 
+* Lightweight user-space connector runs anywhere
+* Punches through any firewall
+* Doesn't require open ports or a public IP
+* Strict network segmentation
+* WireGuard-based
+* Get alerts when a device or network resource goes down
+
 <img src="public/screenshots/sites.png" alt="Sites" width="100%" />
 
 ### Browser-based reverse proxy access
 
-Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+
+* Expose a web panel anywhere
+* Access via any web browser
+* Single sign-on across all resources
+* HTTPS resources
+* Remote desktop in the browser with VNC and RDP
+* In-browser SSH terminal with privileged access management (PAM)
+* PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more
 
 <img src="public/clip.gif" alt="Reverse proxy access" width="100%" />
 
@@ -75,14 +90,48 @@ Expose web applications through identity and context-aware tunneled reverse prox
 
 Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.
 
+* Peer-to-peer with intelligent NAT traversal
+* Hosts/IPs and port ranges
+* Network ranges/CIDRs
+* Friendly DNS aliases for network addresses
+* Privileged access management (PAM) with SSH resources
+* Private HTTPS resources only accessible on the private network
+
 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />
 
+### Identity-aware AI gateway
+
+Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.
+
+* Access self-hosted models (vLLM, Ollama, etc) alongside cloud models (OpenAI, Anthropic, etc) in one place
+* Keyless access by authenticating users with the Pangolin desktop client
+* Or, provide users with personal API keys
+* Control costs and token usage by setting budgets
+* Audit with detailed session history and analytics
+* Integrate AI clients and coding agents (Claude Code, Codex, OpenCode, etc)
+
+<img src="public/screenshots/expanded-session-logs.png" alt="AI Session Logs" width="100%" />
+
 ### Give users and roles access to resources
 
-Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+
+* Bring your existing identity provider (IdP) or use Pangolin identities
+* Sync users and roles from your IdP
+* User- and role-based access control
+* Full network audit and access logs
 
 <img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />
 
+### Find and launch resources from a personalized home page
+
+Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.
+
+* Single place for admins and non-admins to see accessible resources
+* Create reusable views for common access patterns
+
+<img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+
 ## Download Clients
 
 Download the Pangolin client for your platform:
@@ -107,7 +156,7 @@ the docs to illustrate some basic ideas.
 
 ## Licensing
 
-Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl.html). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
+Pangolin is dual licensed under the AGPL-3 and the [Fossorial Commercial License](https://pangolin.net/fcl). For inquiries about commercial licensing, please contact us at [contact@pangolin.net](mailto:contact@pangolin.net).
 
 ## Contributions
 

cli/commands/clearCertificates.ts

@@ -0,0 +1,28 @@
+import { CommandModule } from "yargs";
+import { db, certificates } from "@server/db";
+
+type ClearCertificatesArgs = {};
+
+export const clearCertificates: CommandModule<{}, ClearCertificatesArgs> = {
+    command: "clear-certificates",
+    describe: "Delete all entries from the certificates table",
+    builder: (yargs) => {
+        return yargs;
+    },
+    handler: async (argv: {}) => {
+        try {
+            console.log("Clearing all certificates from the database...");
+
+            const deleted = await db.delete(certificates).returning();
+
+            console.log(
+                `Deleted ${deleted.length} certificate(s) from the database`
+            );
+
+            process.exit(0);
+        } catch (error) {
+            console.error("Error:", error);
+            process.exit(1);
+        }
+    }
+};

cli/commands/disableUser2fa.ts

@@ -0,0 +1,60 @@
+import { CommandModule } from "yargs";
+import { db, users } from "@server/db";
+import { eq } from "drizzle-orm";
+
+/**
+ * Disable 2FA for a user by email address.
+ */
+type DisableUser2faArgs = {
+    email: string;
+};
+
+export const disableUser2fa: CommandModule<{}, DisableUser2faArgs> = {
+    command: "disable-user-2fa",
+    describe: "Disable 2FA for a user (sets twoFactorEnabled=false, clears secret)",
+    builder: (yargs) => {
+        return yargs.option("email", {
+            type: "string",
+            demandOption: true,
+            describe: "User email address"
+        });
+    },
+    handler: async (argv: { email: string }) => {
+        try {
+            const { email } = argv;
+            console.log(`Looking for user with email: ${email}`);
+
+            // Find the user by email
+            const [user] = await db
+                .select()
+                .from(users)
+                .where(eq(users.email, email))
+                .limit(1);
+
+            if (!user) {
+                console.error(`User with email '${email}' not found`);
+                process.exit(1);
+            }
+
+            if (!user.twoFactorEnabled) {
+                console.log(`2FA is already disabled for user '${email}'.`);
+                process.exit(0);
+            }
+
+            // Update user: disable 2FA and clear secret
+            await db.update(users)
+                .set({
+                    twoFactorEnabled: false,
+                    twoFactorSecret: null,
+                    twoFactorSetupRequested: false
+                })
+                .where(eq(users.userId, user.userId));
+
+            console.log(`2FA disabled for user '${email}'.`);
+            process.exit(0);
+        } catch (error) {
+            console.error("Error disabling 2FA:", error);
+            process.exit(1);
+        }
+    }
+};

cli/commands/rotateServerSecret.ts

@@ -1,5 +1,5 @@
 import { CommandModule } from "yargs";
-import { db, idpOidcConfig, licenseKey, certificates, eventStreamingDestinations, alertWebhookActions } from "@server/db";
+import { db, idpOidcConfig, licenseKey, certificates, eventStreamingDestinations, alertWebhookActions, aiProviders, virtualApiKeys } from "@server/db";
 import { encrypt, decrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { eq } from "drizzle-orm";
@@ -132,12 +132,16 @@ export const rotateServerSecret: CommandModule<
             const certs = await db.select().from(certificates);
             const streamingDestinations = await db.select().from(eventStreamingDestinations);
             const webhookActions = await db.select().from(alertWebhookActions);
+            const providers = await db.select().from(aiProviders);
+            const virtualKeys = await db.select().from(virtualApiKeys);
 
             console.log(`Found ${idpConfigs.length} OIDC IdP configuration(s)`);
             console.log(`Found ${licenseKeys.length} license key(s)`);
             console.log(`Found ${certs.length} certificate(s)`);
             console.log(`Found ${streamingDestinations.length} event streaming destination(s)`);
             console.log(`Found ${webhookActions.length} alert webhook action(s)`);
+            console.log(`Found ${providers.length} AI provider(s)`);
+            console.log(`Found ${virtualKeys.length} virtual API key(s)`);
 
             // Prepare all decrypted and re-encrypted values
             console.log("\nDecrypting and re-encrypting values...");
@@ -171,11 +175,24 @@ export const rotateServerSecret: CommandModule<
                 encryptedConfig: string;
             };
 
+            type AiProviderUpdate = {
+                providerId: number;
+                encryptedApiKey: string | null;
+                encryptedHeaders: string | null;
+            };
+
+            type VirtualApiKeyUpdate = {
+                virtualApiKeyId: string;
+                encryptedToken: string;
+            };
+
             const idpUpdates: IdpUpdate[] = [];
             const licenseKeyUpdates: LicenseKeyUpdate[] = [];
             const certUpdates: CertUpdate[] = [];
             const streamingDestinationUpdates: StreamingDestinationUpdate[] = [];
             const webhookActionUpdates: WebhookActionUpdate[] = [];
+            const aiProviderUpdates: AiProviderUpdate[] = [];
+            const virtualApiKeyUpdates: VirtualApiKeyUpdate[] = [];
 
             // Process idpOidcConfig entries
             for (const idpConfig of idpConfigs) {
@@ -306,6 +323,60 @@ export const rotateServerSecret: CommandModule<
                 }
             }
 
+            // Process aiProviders entries (apiKey + headers)
+            for (const provider of providers) {
+                try {
+                    if (!provider.apiKey && !provider.headers) {
+                        continue;
+                    }
+
+                    const encryptedApiKey = provider.apiKey
+                        ? encrypt(decrypt(provider.apiKey, oldSecret), newSecret)
+                        : null;
+                    const encryptedHeaders = provider.headers
+                        ? encrypt(
+                              decrypt(provider.headers, oldSecret),
+                              newSecret
+                          )
+                        : null;
+
+                    aiProviderUpdates.push({
+                        providerId: provider.providerId,
+                        encryptedApiKey,
+                        encryptedHeaders
+                    });
+                } catch (error) {
+                    console.error(
+                        `Error processing AI provider ${provider.providerId}:`,
+                        error
+                    );
+                    throw error;
+                }
+            }
+
+            // Process virtualApiKeys entries (token)
+            for (const key of virtualKeys) {
+                try {
+                    if (!key.token) {
+                        continue;
+                    }
+
+                    virtualApiKeyUpdates.push({
+                        virtualApiKeyId: key.virtualApiKeyId,
+                        encryptedToken: encrypt(
+                            decrypt(key.token, oldSecret),
+                            newSecret
+                        )
+                    });
+                } catch (error) {
+                    console.error(
+                        `Error processing virtual API key ${key.virtualApiKeyId}:`,
+                        error
+                    );
+                    throw error;
+                }
+            }
+
             // Perform all database updates in a single transaction
             console.log("\nUpdating database in transaction...");
             await db.transaction(async (trx) => {
@@ -376,6 +447,32 @@ export const rotateServerSecret: CommandModule<
                             )
                         );
                 }
+
+                // Update AI provider entries
+                for (const update of aiProviderUpdates) {
+                    await trx
+                        .update(aiProviders)
+                        .set({
+                            apiKey: update.encryptedApiKey,
+                            headers: update.encryptedHeaders
+                        })
+                        .where(eq(aiProviders.providerId, update.providerId));
+                }
+
+                // Update virtual API key entries
+                for (const update of virtualApiKeyUpdates) {
+                    await trx
+                        .update(virtualApiKeys)
+                        .set({
+                            token: update.encryptedToken
+                        })
+                        .where(
+                            eq(
+                                virtualApiKeys.virtualApiKeyId,
+                                update.virtualApiKeyId
+                            )
+                        );
+                }
             });
 
             console.log(`Rotated ${idpUpdates.length} OIDC IdP configuration(s)`);
@@ -383,6 +480,8 @@ export const rotateServerSecret: CommandModule<
             console.log(`Rotated ${certUpdates.length} certificate(s)`);
             console.log(`Rotated ${streamingDestinationUpdates.length} event streaming destination(s)`);
             console.log(`Rotated ${webhookActionUpdates.length} alert webhook action(s)`);
+            console.log(`Rotated ${aiProviderUpdates.length} AI provider(s)`);
+            console.log(`Rotated ${virtualApiKeyUpdates.length} virtual API key(s)`);
 
             // Update config file with new secret
             console.log("\nUpdating config file...");
@@ -402,6 +501,7 @@ export const rotateServerSecret: CommandModule<
             console.log(`  - Certificates: ${certUpdates.length}`);
             console.log(`  - Event streaming destinations: ${streamingDestinationUpdates.length}`);
             console.log(`  - Alert webhook actions: ${webhookActionUpdates.length}`);
+            console.log(`  - AI providers: ${aiProviderUpdates.length}`);
             console.log(
                 `\n  IMPORTANT: Restart the server for the new secret to take effect.`
             );

cli/commands/setServerAdmin.ts

@@ -0,0 +1,85 @@
+import { CommandModule } from "yargs";
+import { db, users } from "@server/db";
+import { eq } from "drizzle-orm";
+
+type SetServerAdminArgs = {
+    email: string;
+    remove: boolean;
+};
+
+export const setServerAdmin: CommandModule<{}, SetServerAdminArgs> = {
+    command: "set-server-admin",
+    describe: "Add or remove server admin by email address",
+    builder: (yargs) => {
+        return yargs
+            .option("email", {
+                type: "string",
+                demandOption: true,
+                describe: "User email address"
+            })
+            .option("remove", {
+                type: "boolean",
+                default: false,
+                describe: "Remove server admin status from the user"
+            });
+    },
+    handler: async (argv: SetServerAdminArgs) => {
+        try {
+            const email = argv.email.trim().toLowerCase();
+
+            const [user] = await db
+                .select()
+                .from(users)
+                .where(eq(users.email, email))
+                .limit(1);
+
+            if (!user) {
+                console.error(`User with email '${email}' not found`);
+                process.exit(1);
+            }
+
+            if (argv.remove) {
+                if (!user.serverAdmin) {
+                    console.log(`User '${email}' is not a server admin`);
+                    process.exit(0);
+                }
+
+                const serverAdmins = await db
+                    .select()
+                    .from(users)
+                    .where(eq(users.serverAdmin, true));
+
+                if (serverAdmins.length <= 1) {
+                    console.error(
+                        "Cannot remove server admin: at least one server admin must exist"
+                    );
+                    process.exit(1);
+                }
+
+                await db
+                    .update(users)
+                    .set({ serverAdmin: false })
+                    .where(eq(users.userId, user.userId));
+
+                console.log(`Server admin status removed from user '${email}'`);
+                process.exit(0);
+            }
+
+            if (user.serverAdmin) {
+                console.log(`User '${email}' is already a server admin`);
+                process.exit(0);
+            }
+
+            await db
+                .update(users)
+                .set({ serverAdmin: true })
+                .where(eq(users.userId, user.userId));
+
+            console.log(`User '${email}' has been marked as a server admin`);
+            process.exit(0);
+        } catch (error) {
+            console.error("Error:", error);
+            process.exit(1);
+        }
+    }
+};

cli/index.ts

@@ -9,6 +9,9 @@ import { rotateServerSecret } from "./commands/rotateServerSecret";
 import { clearLicenseKeys } from "./commands/clearLicenseKeys";
 import { deleteClient } from "./commands/deleteClient";
 import { generateOrgCaKeys } from "./commands/generateOrgCaKeys";
+import { clearCertificates } from "./commands/clearCertificates";
+import { disableUser2fa } from "./commands/disableUser2fa";
+import { setServerAdmin } from "./commands/setServerAdmin";
 
 yargs(hideBin(process.argv))
     .scriptName("pangctl")
@@ -19,5 +22,8 @@ yargs(hideBin(process.argv))
     .command(clearLicenseKeys)
     .command(deleteClient)
     .command(generateOrgCaKeys)
+    .command(clearCertificates)
+    .command(disableUser2fa)
+    .command(setServerAdmin)
     .demandCommand()
     .help().argv;

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

compose.mailpit.yaml

@@ -0,0 +1,12 @@
+services:
+  mailer:
+    image: axllent/mailpit
+    ports:
+      - 8025:8025
+      - 1025:1025
+    volumes:
+      - mailpit-storage:/data
+    environment:
+      - MP_DATABASE=/data/mailpit.db
+volumes:
+  mailpit-storage:

compose.pgr.yaml

@@ -8,7 +8,7 @@ services:
       POSTGRES_USER: postgres # Default user
       POSTGRES_PASSWORD: password # Default password (change for production!)
     volumes:
-      - ./config/postgres:/var/lib/postgresql/data
+      - ${HOME}/.local/share/pangolin-dev/postgres:/var/lib/postgresql/data
     ports:
       - "5432:5432" # Map host port 5432 to container port 5432
     restart: no

config/traefik/traefik_config.yml

@@ -1,54 +1,47 @@
 api:
   insecure: true
   dashboard: true
-
 providers:
   http:
-    endpoint: "http://pangolin:3001/api/v1/traefik-config"
-    pollInterval: "5s"
+    endpoint: http://pangolin:3001/api/v1/traefik-config
+    pollInterval: 5s
   file:
-    filename: "/etc/traefik/dynamic_config.yml"
-
+    filename: /etc/traefik/dynamic_config.yml
 experimental:
   plugins:
     badger:
-      moduleName: "github.com/fosrl/badger"
-      version: "{{.BadgerVersion}}"
-
+      moduleName: github.com/fosrl/badger
+      version: v1.4.1
 log:
-  level: "INFO"
-  format: "common"
+  level: INFO
+  format: common
   maxSize: 100
   maxBackups: 3
   maxAge: 3
   compress: true
-
 certificatesResolvers:
   letsencrypt:
     acme:
       httpChallenge:
         entryPoint: web
-      email: "{{.LetsEncryptEmail}}"
-      storage: "/letsencrypt/acme.json"
-      caServer: "https://acme-v02.api.letsencrypt.org/directory"
-
+      email: '{{.LetsEncryptEmail}}'
+      storage: /letsencrypt/acme.json
+      caServer: https://acme-v02.api.letsencrypt.org/directory
 entryPoints:
   web:
-    address: ":80"
+    address: ':80'
   websecure:
-    address: ":443"
+    address: ':443'
     transport:
       respondingTimeouts:
-        readTimeout: "30m"
+        readTimeout: 30m
     http:
       tls:
-        certResolver: "letsencrypt"
+        certResolver: letsencrypt
       encodedCharacters:
         allowEncodedSlash: true
         allowEncodedQuestionMark: true
-
 serversTransport:
   insecureSkipVerify: true
-
 ping:
-  entryPoint: "web"
+  entryPoint: web

docs/ai-gateway-provider-selection.md

@@ -0,0 +1,350 @@
+# AI Gateway Provider Selection
+
+How the AI gateway picks which attached provider handles a request when an
+inference resource has more than one AI provider.
+
+**Code:**
+
+- Route → capability binding: `server/routers/aiGateway/createAiGatewayRouter.ts`
+- Request pipeline: `server/routers/aiGateway/pipeline.ts` (`selectProvider`)
+- Model discovery: `server/routers/aiGateway/v1Models.ts` and
+  `server/lib/aiModelDiscovery.ts`
+- Tie-break scoring: `server/lib/aiProviderSelection.ts`
+- Allow/block matching: `server/lib/aiModelKeyMatch.ts`
+- Model catalog: `server/lib/aiModelCatalog.ts`
+- Default capabilities per provider type: `server/lib/aiProviderDefaults.ts`
+
+Overlapping model allows are permitted at save time. Selection happens at
+request time. If the algorithm cannot confidently pick one provider, the
+gateway returns `403` with an ambiguous-provider error.
+
+## Selection Pipeline
+
+Every gateway request runs through these steps in order. Each step narrows
+the candidate set. Later steps only run when more than one provider remains.
+
+```
+1. Capability filter
+2. Allow / block lists
+3. Most specific allow pattern
+4. Catalog ownership
+5. Provider class preference
+6. Ambiguous → error
+```
+
+### 1. Capability Filter
+
+The incoming path selects a capability before any provider logic runs.
+
+| Path | Capability |
+|------|------------|
+| `POST /v1/chat/completions` | `openai_chat` |
+| `POST /v1/responses` | `openai_responses` |
+| `POST /v1/messages` | `anthropic_messages` |
+| `GET /v1/models`, `GET /v1/models/{id}` | `v1_models` |
+| Gemini / Vertex / Bedrock routes | their respective capability ids |
+
+Only attached providers that advertise that capability stay in the candidate
+set. Default capabilities do not overlap for native OpenAI vs Anthropic:
+
+| Provider type | Default capabilities |
+|---------------|----------------------|
+| `openai` | `openai_chat`, `openai_responses` |
+| `anthropic` | `anthropic_messages`, `v1_models` |
+| `openRouter` | `openai_chat` |
+| `vercelAiGateway` | `openai_chat`, `openai_responses` |
+| `microsoftFoundry` | `openai_chat`, `openai_responses`, `anthropic_messages`, `v1_models` |
+| `custom` | whatever was configured |
+
+### 2. Allow / Block Lists
+
+For each remaining provider, the gateway resolves the effective allow and
+block patterns:
+
+- **`inherit`**: use the provider's own model lists
+- **`select`**: use the resource-selected subset of those lists
+
+A candidate is kept only if `isAllowedByLists(requestedModel, allows, blocks)`
+passes:
+
+1. At least one allow pattern must match
+2. No block pattern may match
+
+Patterns support `*` and `?` globs (`gpt-*`, `claude-3-5-sonnet-?`).
+
+### 3. Most Specific Allow Pattern
+
+Among providers that allow the model, keep those whose matching allow
+pattern is most specific:
+
+1. Exact keys beat patterns
+2. Fewer wildcard characters win
+3. Longer literal length wins
+
+Example: `gpt-4o` beats `gpt-*` beats `*`.
+
+### 4. Catalog Ownership
+
+When specificity is tied (common with multiple `*` allows), score each
+provider against the known model catalog:
+
+| Score | Meaning |
+|------:|---------|
+| 2 | Typed provider whose catalog contains the model (`openai` → openai catalog, `anthropic` → anthropic, etc.) |
+| 1 | Aggregator or custom (`openRouter`, `vercelAiGateway`, `custom`) and the model exists somewhere in the catalog |
+| 0 | No ownership signal (typed catalog miss, or unknown model on aggregator/custom) |
+
+Model id lookup tries the raw id, then a stripped `vendor/model` form
+(e.g. `openai/gpt-4o` → also try `gpt-4o`).
+
+Typed providers map to catalog providers as:
+
+| Provider type | Catalog |
+|---------------|---------|
+| `openai` | `openai` |
+| `anthropic` | `anthropic` |
+| `googleGemini` | `gemini` |
+| `vertexAi` | `vertex` |
+| `bedrock` | `bedrock` |
+| `microsoftFoundry` | `azure` |
+| `openRouter` / `vercelAiGateway` / `custom` | none (aggregator/custom path) |
+
+### 5. Provider Class Preference
+
+If catalog ownership is still tied, prefer:
+
+| Rank | Class |
+|-----:|-------|
+| 2 | Native typed provider (`openai`, `anthropic`, `googleGemini`, …) |
+| 1 | Aggregator (`openRouter`, `vercelAiGateway`) |
+| 0 | `custom` |
+
+### 6. Ambiguous Error
+
+If more than one distinct provider remains after all steps, the gateway
+rejects the request:
+
+```
+Model "<id>" is ambiguous across multiple AI providers on this resource
+```
+
+Typical remaining ties: two OpenAI-type providers both with `*`, or two
+customs advertising the same capability for an unknown model.
+
+## Model Discovery Is Not Selection
+
+`GET /v1/models` and `GET /v1/models/{id}` (`v1_models`) skip steps 3-6
+entirely. There is no requested model to disambiguate on, so the gateway does
+not pick one provider - it returns the **union** of what every attached
+provider advertising `v1_models` would accept, deduplicated by model id
+(lowest `providerId` wins a collision).
+
+Discovery is answered from the gateway's own view of the allow/block lists,
+never proxied upstream. Providers that expose no `/v1/models` endpoint of their
+own still get a working listing, and a model an allow/block list forbids is
+never advertised.
+
+Each provider's candidate ids come from two places:
+
+| Source | Contributes |
+|--------|-------------|
+| Exact (non-wildcard) allow entries | the model key itself |
+| The model catalog for the provider's type | every catalog id matching an allow pattern |
+
+Both sources are then filtered through the same
+`isAllowedByLists(id, allows, blocks)` check step 2 applies, so a block pattern
+hides a model from discovery exactly as it would reject it at request time.
+
+The catalog source is what makes a wildcard allow such as `claude-*`
+enumerable. Provider types with no catalog mapping (`openRouter`,
+`vercelAiGateway`, `custom`) have nothing to expand against, so a wildcard
+allow on those types lists nothing - **add exact allow entries to make their
+models discoverable.**
+
+### Where each field comes from
+
+Token limits and capability flags can't be derived from an allow/block list.
+They come from the model catalog (`server/lib/aiModelCatalog.ts`), which the
+Fossorial API builds from LiteLLM:
+
+| Field | Source |
+|-------|--------|
+| `max_input_tokens` | catalog `limits.input` |
+| `max_tokens` | catalog `limits.output` |
+| `capabilities` | catalog flags, mapped to the Models API shape by `capabilitiesFromCatalog` |
+| `display_name` | the configured model row's name, else the model id |
+| `created_at` | the configured model row's timestamp, else the epoch |
+
+A model the catalog doesn't know (an exact allow entry for a fine-tune, say)
+reports `null` for all three metadata fields. The Models API declares them
+nullable, so that is a valid answer rather than a broken one.
+
+The catalog's flags are coarser than the Models API describes: it carries a
+single `reasoning` flag with no way to distinguish adaptive from
+`budget_tokens`-style thinking, and nothing at all for batch, citations, code
+execution, PDF input, or context management. Anything it reports as unknown
+(`null`) is surfaced as unsupported rather than invented, so `capabilities`
+understates rather than overstates what a model can do.
+
+The gateway does **not** query the provider's own `/v1/models`. Discovery is
+answered entirely from local state.
+
+Results are ordered newest-first with the id as tie-break, and paginated with
+Anthropic's `limit` / `after_id` / `before_id` semantics (default 20, max
+1000).
+
+## Examples
+
+Assume each provider below is attached and enabled on the same inference
+resource.
+
+### Example A: OpenAI + Anthropic, Both `*`
+
+| Provider | Allow | Capabilities |
+|----------|-------|--------------|
+| OpenAI | `*` | `openai_chat`, `openai_responses` |
+| Anthropic | `*` | `anthropic_messages` |
+
+**Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
+
+1. Capability → only OpenAI remains
+2. Allow → OpenAI matches `*`
+3. Result → **OpenAI**
+
+Anthropic never reaches pattern or catalog scoring. Capability alone decides.
+
+**Request:** `POST /v1/messages` with `model: "claude-3-5-sonnet-latest"`
+
+1. Capability → only Anthropic remains
+2. Result → **Anthropic**
+
+### Example B: OpenAI + OpenRouter, Both `*`
+
+| Provider | Allow | Capabilities |
+|----------|-------|--------------|
+| OpenAI | `*` | `openai_chat`, … |
+| OpenRouter | `*` | `openai_chat` |
+
+**Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
+
+1. Capability → both remain (`openai_chat`)
+2. Allow → both match `*`
+3. Specificity → tie (`*` vs `*`)
+4. Catalog → OpenAI scores `2` (owns `gpt-4o`); OpenRouter scores `1`
+5. Result → **OpenAI**
+
+### Example C: OpenRouter Only Serving a Claude Model Over OpenAI Chat
+
+| Provider | Allow | Capabilities |
+|----------|-------|--------------|
+| OpenRouter | `*` | `openai_chat` |
+
+**Request:** `POST /v1/chat/completions` with `model: "anthropic/claude-3.5-sonnet"`
+
+1. Capability → OpenRouter remains
+2. Only one candidate → **OpenRouter**
+
+No tie-breaking needed.
+
+### Example D: OpenAI (`gpt-*`) + OpenRouter (`*`)
+
+| Provider | Allow |
+|----------|-------|
+| OpenAI | `gpt-*` |
+| OpenRouter | `*` |
+
+**Request:** `model: "gpt-4o"` on `openai_chat`
+
+1. Capability → both
+2. Allow → both match
+3. Specificity → OpenAI's `gpt-*` beats OpenRouter's `*`
+4. Result → **OpenAI**
+
+Catalog scoring is not needed because specificity already unique'd the set.
+
+### Example E: OpenAI + Anthropic With Overlapping Custom Capabilities
+
+Someone grants Anthropic `openai_chat` as well (non-default).
+
+| Provider | Allow | Capabilities |
+|----------|-------|--------------|
+| OpenAI | `*` | `openai_chat`, … |
+| Anthropic | `*` | `anthropic_messages`, `openai_chat` |
+
+**Request:** `POST /v1/chat/completions` with `model: "gpt-4o"`
+
+1. Capability → both remain
+2. Allow → both match `*`
+3. Specificity → tie
+4. Catalog → OpenAI `2`, Anthropic `0` (`gpt-4o` is not in the anthropic catalog)
+5. Result → **OpenAI**
+
+### Example F: Two Aggregators, Known Model
+
+| Provider | Allow |
+|----------|-------|
+| OpenRouter | `*` |
+| Vercel AI Gateway | `*` |
+
+**Request:** `model: "gpt-4o"` on `openai_chat`
+
+1. Capability → both
+2. Allow / specificity → tie
+3. Catalog → both score `1` (known model, no typed owner in the set)
+4. Class → both aggregators (rank `1`) → still tied
+5. Result → **ambiguous error**
+
+Attach a native OpenAI provider (or narrow one aggregator's allow list) to
+make this determinable.
+
+### Example G: Two OpenAI Providers, Both `*`
+
+| Provider | Type | Allow |
+|----------|------|-------|
+| OpenAI Prod | `openai` | `*` |
+| OpenAI Staging | `openai` | `*` |
+
+**Request:** `model: "gpt-4o"`
+
+1–5 all leave both candidates (same capability, same specificity, same
+catalog ownership, same class).
+
+Result → **ambiguous error**
+
+Disambiguate with different allow patterns, disable one attachment, or
+split across resources.
+
+### Example H: Unknown Model Across Native + Aggregator
+
+| Provider | Allow |
+|----------|-------|
+| OpenAI | `*` |
+| OpenRouter | `*` |
+
+**Request:** `model: "my-fine-tune-v3"` (not in catalog)
+
+1. Capability → both
+2. Allow / specificity → tie
+3. Catalog → both score `0` (typed miss + unknown aggregator model)
+4. Class → OpenAI (`2`) beats OpenRouter (`1`)
+5. Result → **OpenAI**
+
+## Practical Guidance
+
+- Native OpenAI + Anthropic with `*` is safe. Different default APIs never
+  collide.
+- OpenAI + OpenRouter with `*` is usually fine for catalog-known OpenAI
+  models. Native wins.
+- Prefer specific allow patterns (`gpt-4o`, `gpt-*`) when two providers share
+  a capability.
+- Two providers of the same type both using `*` will stay ambiguous. Narrow
+  at least one allow list.
+- Custom providers only win ties when no stronger native/aggregator signal
+  remains.
+
+## Related Behavior
+
+- **Saving providers on a resource does not reject overlapping allows.**
+  Collisions are resolved (or rejected) per request.
+- Budgets, auth, and upstream URL / target routing run after a single
+  provider has been selected.

docs/crud-endpoints.md

@@ -0,0 +1,347 @@
+# How to build a CRUD endpoint in this repo
+
+Reference for adding a new CRUD entity to the server. Based on two real
+examples already in the codebase — read them side by side with this doc:
+
+- **Public / open-source (Community Edition) pattern**: `server/routers/aiProvider/`
+- **Enterprise-only pattern**: `server/private/routers/alertRule/`
+
+The two are structurally identical. The only difference is *where the files
+live* and *which router they get wired into*.
+
+## 1. Decide: public or private?
+
+- `server/routers/<entity>/` — ships in the open-source Community Edition.
+  Anyone running Pangolin gets this.
+- `server/private/routers/<entity>/` — Enterprise/SaaS only. Gated behind
+  `verifyValidLicense` (and often `verifyValidSubscription(tierMatrix.x)`).
+  Every file here starts with the Fossorial Commercial License header block
+  (copy it verbatim from an existing private file).
+
+Everything below applies to both — swap `@server/...` for `#private/...`
+import paths and add license headers when building the private version.
+
+## 2. Directory layout
+
+One folder per entity, one file per operation, a barrel `index.ts`:
+
+```
+server/routers/<entity>/
+  index.ts          # export * from each operation file + ./types
+  types.ts          # response payload types + row->public mapper
+  validation.ts      # zod schemas/refinements shared by create + update (optional)
+  create<Entity>.ts
+  list<Entities>.ts
+  get<Entity>.ts
+  update<Entity>.ts
+  delete<Entity>.ts
+```
+
+`index.ts` is a flat barrel:
+
+```ts
+export * from "./createAiProvider";
+export * from "./listAiProviders";
+export * from "./getAiProvider";
+export * from "./updateAiProvider";
+export * from "./deleteAiProvider";
+export * from "./types";
+```
+
+## 3. Anatomy of a single handler
+
+Every handler file (`create<Entity>.ts`, etc.) follows the same shape:
+
+```ts
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { <table>, db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { eq } from "drizzle-orm";
+import type { GetXResponse } from "@server/routers/<entity>/types";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()          // or entityId: z.coerce.number().int().positive()
+});
+
+const bodySchema = z.strictObject({ /* ... */ }); // create/update only
+
+registry.registerPath({
+    method: "get", // put | post | delete
+    path: "/org/{orgId}/x",
+    description: "...",
+    tags: [OpenAPITags.<Entity>],
+    request: { params: paramsSchema, /* body: {...} for write ops, query: for list */ },
+    responses: { 200: { description: "Successful response" } }
+});
+
+export async function getX(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, fromError(parsedParams.error).toString()));
+        }
+        // parse body too, if present, same pattern
+
+        // ...business logic against db...
+
+        if (!row) {
+            return next(createHttpError(HttpCode.NOT_FOUND, `X with ID ${id} not found`));
+        }
+
+        return response<GetXResponse>(res, {
+            data: { /* ... */ },
+            success: true,
+            error: false,
+            message: "X retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred"));
+    }
+}
+```
+
+Rules to keep consistent with the rest of the codebase:
+
+- `z.strictObject` for params/body — rejects unknown keys.
+- Params parsed first, then body; each on its own `safeParse` + early
+  `next(createHttpError(...))` — never throw raw errors.
+- Every handler registers itself with the OpenAPI `registry` even if nobody
+  reads the spec directly — it's how `/api/v1/docs` stays accurate.
+- Catch-all `try/catch` at the bottom: `logger.error(error)` +
+  generic `500` message. Never leak internal error details to the client.
+- Use `response<T>(res, { data, success, error, message, status })` from
+  `@server/lib/response` for every response, success or otherwise (errors go
+  through `next(createHttpError(...))` instead, not through `response`).
+- If the route already ran an access-control middleware that fetched the row
+  (see §5), reuse it instead of re-querying:
+  `req.aiProvider && req.aiProvider.providerId === providerId ? [req.aiProvider] : await db.select()...`
+
+### List handler specifics
+
+Pagination is a fixed shape (`page`, `pageSize`, optional `query` for
+search). See `listAiProviders.ts`:
+
+```ts
+const listSchema = z.object({
+    pageSize: z.coerce.number<string>().int().positive().optional().catch(20).default(20),
+    page: z.coerce.number<string>().int().min(0).optional().catch(1).default(1),
+    query: z.string().optional()
+});
+```
+
+Run the count query and the page query in `Promise.all`, and return
+`PaginatedResponse<{ items: T[] }>` (`@server/types/Pagination`) with
+`{ total, pageSize, page }`.
+
+### types.ts specifics
+
+- Define one response type per operation: `List<Entities>Response`,
+  `Get<Entity>Response`, `CreateOrEdit<Entity>Response` (create and update
+  commonly share a response shape).
+- If the raw DB row needs to be shaped for clients (decrypting secrets,
+  parsing a serialized column, hiding a column), put a `toPublic<Entity>()`
+  mapper here — see `toPublicAiProvider` for the pattern of stripping
+  `apiKey`/serialized columns and re-adding decrypted/parsed versions.
+
+### validation.ts specifics
+
+Only needed when create and update share non-trivial zod pieces (enums,
+`superRefine` cross-field rules). Export the raw schemas (`z.enum([...])`)
+and refinement functions, and import them into both `createX.ts` and
+`updateX.ts` — see `aiProvider/validation.ts`'s
+`refineProviderUpstreamFields`.
+
+## 4. Wire up an access-control middleware (for id-scoped routes)
+
+For routes scoped to a single row (`/x/:xId`, as opposed to
+`/org/:orgId/x` create/list), add a `verify<Entity>Access` middleware in
+`server/middlewares/` (or `server/private/middlewares/` for enterprise-only
+entities) and export it from that directory's `index.ts`.
+
+Pattern (`verifyAiProviderAccess.ts`):
+
+1. Read the id param, `Number.parseInt`/validate it.
+2. Load the row by id.
+3. `404` if it doesn't exist.
+4. Resolve the row's `orgId`, then check/attach `req.userOrg` (query
+   `userOrgs` if not already on the request), `403` if the user isn't in
+   that org.
+5. Run `checkOrgAccessPolicy` if `req.orgPolicyAllowed` hasn't been resolved
+   yet.
+6. Set `req.userOrgId`, `req.userOrgRoleIds`, and stash the row on the
+   request (e.g. `req.aiProvider = provider`) so downstream handlers and
+   `verifyUserHasAction` don't have to refetch it.
+
+Org-scoped create/list routes (`/org/:orgId/x`) don't need a bespoke
+middleware — they use the existing generic `verifyOrgAccess` from
+`@server/middlewares`.
+
+## 5. Register an action + permission check
+
+Add one `ActionsEnum` entry per operation in `server/auth/actions.ts`,
+grouped near the entity's other actions, named `create<Entity>`,
+`get<Entity>`, `update<Entity>`, `delete<Entity>`, `list<Entities>`:
+
+```ts
+createAiProvider = "createAiProvider",
+deleteAiProvider = "deleteAiProvider",
+getAiProvider = "getAiProvider",
+listAiProviders = "listAiProviders",
+updateAiProvider = "updateAiProvider",
+```
+
+Every route uses `verifyUserHasAction(ActionsEnum.x)` to check the caller's
+role/permissions for that action, and mutating routes (create/update/delete)
+follow it with `logActionAudit(ActionsEnum.x)` to record the action in the
+audit log.
+
+## 6. Register the routes
+
+There are four router files; which one(s) you touch depends on public vs.
+private and user-facing vs. service-to-service:
+
+| File | Purpose |
+|---|---|
+| `server/routers/external.ts` | Public, user-facing API. Exports `authenticated`, `unauthenticated`, `authRouter` Express routers. |
+| `server/routers/internal.ts` | Public, internal service-to-service API (gerbil, badger, traefik-config) — no user auth, exports `internalRouter`. |
+| `server/private/routers/external.ts` | Enterprise-only, user-facing. Imports `authenticated`/`unauthenticated`/`authRouter` **from the public `external.ts`** and re-exports them, then adds more routes on top. |
+| `server/private/routers/internal.ts` | Enterprise-only, service-to-service. Same re-export trick with `internalRouter`. |
+
+Private router files always start:
+
+```ts
+import {
+    unauthenticated as ua,
+    authenticated as a,
+    authRouter as aa
+} from "@server/routers/external";
+
+export const authenticated = a;
+export const unauthenticated = ua;
+export const authRouter = aa;
+```
+
+...and then call `authenticated.get/put/post/delete(...)` to bolt on
+additional, enterprise-only routes on the *same* router instances the public
+build uses. This is why the private build has strictly more routes than the
+public build, not a divergent copy.
+
+### Route registration order (mutating vs read)
+
+Standard middleware chain per verb, using `alertRule`'s registrations as the
+template:
+
+```ts
+// Create — org-scoped, no row exists yet
+authenticated.put(
+    "/org/:orgId/x",
+    verifyValidLicense,              // private/enterprise routes only
+    verifyOrgAccess,
+    verifyLimits,                    // if the entity counts against a plan limit
+    verifyUserHasAction(ActionsEnum.createX),
+    logActionAudit(ActionsEnum.createX),
+    x.createX
+);
+
+// Update — row-scoped
+authenticated.post(
+    "/org/:orgId/x/:xId",            // or "/x/:xId" if id is globally unique
+    verifyValidLicense,
+    verifyOrgAccess,                 // or verifyXAccess if globally-keyed
+    verifyUserHasAction(ActionsEnum.updateX),
+    logActionAudit(ActionsEnum.updateX),
+    x.updateX
+);
+
+// Delete — row-scoped
+authenticated.delete(
+    "/org/:orgId/x/:xId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.deleteX),
+    logActionAudit(ActionsEnum.deleteX),
+    x.deleteX
+);
+
+// List — org-scoped, read-only, no audit log
+authenticated.get(
+    "/org/:orgId/xs",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listXs),
+    x.listXs
+);
+
+// Get one — row-scoped, read-only, no audit log
+authenticated.get(
+    "/org/:orgId/x/:xId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getX),
+    x.getX
+);
+```
+
+Notes:
+
+- HTTP verbs: `PUT` = create, `POST` = update, `GET` = read, `DELETE` =
+  delete. This repo does not use `PATCH` for entity updates (site
+  provisioning keys are the one exception, using `PATCH`).
+- `verifyValidLicense` is only needed on private/enterprise routes; public
+  OSS routes skip it.
+- Use `verifyValidSubscription(tierMatrix.someFeature)` right after
+  `verifyValidLicense` when a feature is gated to specific SaaS tiers (see
+  `tierMatrix` usages in `server/private/routers/external.ts`).
+- `verifyLimits` goes on create routes for entities that count against a
+  plan/seat limit.
+- For entities keyed by a globally-unique id (not nested under `/org/:orgId`),
+  use the dedicated `verify<Entity>Access` middleware from §4 instead of
+  `verifyOrgAccess` on the row-scoped routes (see how `/ai-provider/:providerId`
+  uses `verifyAiProviderAccess`, while `/org/:orgId/ai-provider` create/list
+  use plain `verifyOrgAccess`).
+- Read-only routes (`get`, `list`) skip `logActionAudit` — only mutations are
+  audited.
+- `internal*.ts` routes are for trusted internal callers (gerbil/badger
+  sidecars) and generally skip user-facing auth entirely, using
+  `verifySessionUserMiddleware` / `verifyUserFromResourceSessionMiddleware`
+  instead of `verifyOrgAccess`/`verifyUserHasAction`. CRUD entities almost
+  never need internal router entries — only add one if a sidecar process
+  needs direct access to the resource.
+
+## 7. The `#dynamic` alias (advanced — most CRUD work can ignore this)
+
+Some middleware (e.g. `logActionAudit`) needs a real implementation in the
+enterprise/SaaS build but a no-op stub in the open-source build, while
+being imported by identical code in `server/routers/external.ts` in both
+builds. That's done via the `#dynamic/*` import alias, which
+`tsconfig.oss.json` points at `./server/*` and `tsconfig.enterprise.json` /
+`tsconfig.saas.json` point at `./server/private/*`. You only need this
+pattern if you're adding a genuinely dual-implementation hook; a normal
+private-only CRUD entity (like `alertRule`) never touches `#dynamic` — it
+just lives entirely under `server/private/` and is imported with `#private/*`
+directly from `server/private/routers/external.ts`.
+
+## 8. Checklist for a new entity
+
+1. Add the DB table to `server/db/pg/schema/schema.ts` (and sqlite schema if
+   applicable).
+2. Add `ActionsEnum` entries in `server/auth/actions.ts`.
+3. Create `server/routers/<entity>/` (or `server/private/routers/<entity>/`):
+   `types.ts`, optional `validation.ts`, one file per operation, `index.ts`
+   barrel.
+4. If routes are row-scoped by a global id, add
+   `verify<Entity>Access.ts` to `server/middlewares/` or
+   `server/private/middlewares/`, and export it from that directory's
+   `index.ts`.
+5. Wire routes into `external.ts` (public or private) following the verb/
+   middleware table in §6. Add to `internal.ts` only if a sidecar needs
+   direct access.
+6. Add license header block to every new file if it's under `server/private/`.

drizzle.sqlite.config.ts

@@ -1,4 +1,4 @@
-import { APP_PATH } from "@server/lib/consts";
+import { APP_PATH } from "./server/lib/consts";
 import { defineConfig } from "drizzle-kit";
 import path from "path";
 

install/config/config.yml

@@ -22,7 +22,8 @@ server:
         methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
         allowed_headers: ["X-CSRF-Token", "Content-Type"]
         credentials: false
-    {{if .EnableGeoblocking}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
+    {{if .EnableMaxMind}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
+    {{if .EnableMaxMind}}maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"{{end}}
 {{if .EnableEmail}}
 email:
     smtp_host: "{{.EmailSMTPHost}}"
@@ -36,3 +37,6 @@ flags:
     disable_signup_without_invite: true
     disable_user_create_org: false
     allow_raw_resources: true
+
+{{if .IsPostgreSQL}}postgres:
+    connection_string: postgresql://pangolin:{{.IsPostgreSQLPass}}@postgres:5432/pangolin{{end}}

install/config/crowdsec/traefik_config.yml

@@ -16,7 +16,7 @@ experimental:
       version: "{{.BadgerVersion}}"
     crowdsec: # CrowdSec plugin configuration added
       moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.4.4"
+      version: "v1.7.1"
 
 log:
   level: "INFO"

install/config/docker-compose.yml

@@ -1,15 +1,23 @@
 name: pangolin
 services:
   pangolin:
-    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{.PangolinVersion}}
+    image: docker.io/fosrl/pangolin:{{if .IsEnterprise}}ee-{{end}}{{if .IsPostgreSQL}}postgresql-{{end}}{{.PangolinVersion}}
     container_name: pangolin
     restart: unless-stopped
     deploy:
       resources:
         limits:
-          memory: 1g
+          memory: 2g
         reservations:
-          memory: 256m
+          memory: 512m
+    {{if or .IsPostgreSQL .IsRedis}}depends_on:
+      {{if .IsPostgreSQL}}postgres:
+          condition: service_healthy{{end}}
+      {{if .IsRedis}}redis:
+          condition: service_healthy{{end}}
+    networks:
+      - default
+      - backend{{end}}
     volumes:
       - ./config:/app/config
     healthcheck:
@@ -17,8 +25,8 @@ services:
       interval: "10s"
       timeout: "10s"
       retries: 15
-{{if .InstallGerbil}}
-  gerbil:
+
+  {{if .InstallGerbil}}gerbil:
     image: docker.io/fosrl/gerbil:{{.GerbilVersion}}
     container_name: gerbil
     restart: unless-stopped
@@ -39,17 +47,16 @@ services:
       - 21820:21820/udp
       - 443:443
       - 443:443/udp # For http3 QUIC if desired
-      - 80:80
-{{end}}
+      - 80:80{{end}}
+
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
-{{if .InstallGerbil}}    network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
+    {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}
     ports:
       - 443:443
-      - 80:80
-{{end}}
+      - 80:80{{end}}
     depends_on:
       pangolin:
         condition: service_healthy
@@ -60,8 +67,50 @@ services:
       - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
       - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
 
+  {{if .IsPostgreSQL}}postgres:
+    image: postgres:18
+    container_name: postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: pangolin
+      POSTGRES_PASSWORD: {{.IsPostgreSQLPass}}
+      POSTGRES_DB: pangolin
+    volumes:
+      - ./postgres18:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U pangolin"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - backend{{end}}
+
+  {{if .IsRedis}}redis:
+    image: redis:8-trixie
+    container_name: redis
+    restart: unless-stopped
+    command: >
+      redis-server
+      --save 3600 1000
+      --appendonly yes
+      --requirepass {{.IsRedisPass}}
+    volumes:
+      - ./redis8:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "{{.IsRedisPass}}", "ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+    networks:
+      - backend{{end}}
+
 networks:
   default:
     driver: bridge
-    name: pangolin
+    name: pangolin_frontend
 {{if .EnableIPv6}}    enable_ipv6: true{{end}}
+{{if or .IsPostgreSQL .IsRedis}}  backend:
+    driver: bridge
+    name: pangolin_backend
+    internal: true{{end}}

install/config/privateConfig.yml

@@ -0,0 +1,4 @@
+{{if .IsRedis}}redis:
+  host: "redis"
+  port: 6379
+  password: "{{.IsRedisPass}}"{{end}}

install/go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.42.0
+	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )

install/go.sum

@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

install/main.go

@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"embed"
 	"encoding/base64"
+	"flag"
 	"fmt"
 	"io"
 	"io/fs"
@@ -53,9 +54,13 @@ type Config struct {
 	InstallGerbil             bool
 	TraefikBouncerKey         string
 	DoCrowdsecInstall         bool
-	EnableGeoblocking         bool
+	EnableMaxMind             bool
 	Secret                    string
 	IsEnterprise              bool
+    IsPostgreSQL              bool
+	IsPostgreSQLPass          string
+    IsRedis                   bool
+	IsRedisPass               string
 }
 
 type SupportedContainer string
@@ -66,8 +71,14 @@ const (
 	Undefined SupportedContainer = "undefined"
 )
 
+var redisFlag *bool
+
 func main() {
 
+	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
+	redisFlag = flag.Bool("redis", false, "Install Redis as caching solution. Required for HA. Not required for the Enterprise version.")
+	flag.Parse()
+
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking
 
 	fmt.Println("Welcome to the Pangolin installer!")
@@ -119,11 +130,11 @@ func main() {
 
 		fmt.Println("\nConfiguration files created successfully!")
 
-		// Download MaxMind database if requested
-		if config.EnableGeoblocking {
-			fmt.Println("\n=== Downloading MaxMind Database ===")
+		// Download MaxMind Country / ASN database if requested
+		if config.EnableMaxMind {
+			fmt.Println("\n=== Downloading MaxMind Country and ASN Databases ===")
 			if err := downloadMaxMindDatabase(); err != nil {
-				fmt.Printf("Error downloading MaxMind database: %v\n", err)
+				fmt.Printf("Error downloading MaxMind databases: %v\n", err)
 				fmt.Println("You can download it manually later if needed.")
 			}
 		}
@@ -184,15 +195,15 @@ func main() {
 		fmt.Println("\n=== MaxMind Database Update ===")
 		if _, err := os.Stat("config/GeoLite2-Country.mmdb"); err == nil {
 			fmt.Println("MaxMind GeoLite2 Country database found.")
-			if readBool("Would you like to update the MaxMind database to the latest version?", false) {
+			if readBool("Would you like to update the MaxMind databases (Country and ASN) to the latest version?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error updating MaxMind database: %v\n", err)
 					fmt.Println("You can try updating it manually later if needed.")
 				}
 			}
 		} else {
-			fmt.Println("MaxMind GeoLite2 Country database not found.")
-			if readBool("Would you like to download the MaxMind GeoLite2 database for geoblocking functionality?", false) {
+			fmt.Println("MaxMind GeoLite2 Country and ASN databases not found.")
+			if readBool("Would you like to download the MaxMind GeoLite2 databases for blocking functionality?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error downloading MaxMind database: %v\n", err)
 					fmt.Println("You can try downloading it manually later if needed.")
@@ -200,13 +211,15 @@ func main() {
 				// Now you need to update your config file accordingly to enable geoblocking
 				fmt.Print("Please remember to update your config/config.yml file to enable geoblocking! \n\n")
 				// add   maxmind_db_path: "./config/GeoLite2-Country.mmdb" under server
-				fmt.Println("Add the following line under the 'server' section:")
+				// add   maxmind_asn_path: "./config/GeoLite2-ASN.mmdb" under server
+				fmt.Println("Add the following lines under the 'server' section:")
 				fmt.Println("  maxmind_db_path: \"./config/GeoLite2-Country.mmdb\"")
+				fmt.Println("  maxmind_asn_path: \"./config/GeoLite2-ASN.mmdb\"")
 			}
 		}
 	}
 
-	if !checkIsCrowdsecInstalledInCompose() {
+	if *crowdsecFlag && !checkIsCrowdsecInstalledInCompose() {
 		fmt.Println("\n=== CrowdSec Install ===")
 		// check if crowdsec is installed
 		if readBool("Would you like to install CrowdSec?", false) {
@@ -480,6 +493,17 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Basic Configuration ===")
 
 	config.IsEnterprise = readBoolNoDefault("Do you want to install the Enterprise version of Pangolin? The EE is free for personal use or for businesses making less than 100k USD annually.")
+    if config.IsEnterprise {
+        if *redisFlag {
+			config.IsRedis = true
+            config.IsRedisPass = readPassword("Enter a unique password for the Redis service.")
+        }
+    }
+
+    config.IsPostgreSQL = readBool("Do you want to use PostgreSQL (not recommended for most users)?", false)
+	if config.IsPostgreSQL {
+		config.IsPostgreSQLPass = readPassword("Enter a unique password for the PostgreSQL pangolin user.")
+	}
 
 	config.BaseDomain = readString("Enter your base domain (no subdomain e.g. example.com)", "")
 
@@ -523,7 +547,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")
 
 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableGeoblocking = readBool("Do you want to download the MaxMind GeoLite2 database for geoblocking functionality?", true)
+	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ASN databases for blocking functionality?", true)
 
 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
@@ -776,29 +800,42 @@ func checkPortsAvailable(port int) error {
 }
 
 func downloadMaxMindDatabase() error {
-	fmt.Println("Downloading MaxMind GeoLite2 Country database...")
+	fmt.Println("Downloading MaxMind GeoLite2 Country and ASN databases...")
 
-	// Download the GeoLite2 Country database
+	// Download the GeoLite2 Country databases
 	if err := run("curl", "-L", "-o", "GeoLite2-Country.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 database: %v", err)
+		return fmt.Errorf("failed to download GeoLite2 Country database: %v", err)
+	}
+	if err := run("curl", "-L", "-o", "GeoLite2-ASN.tar.gz",
+		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-ASN.tar.gz"); err != nil {
+		return fmt.Errorf("failed to download GeoLite2 ASN database: %v", err)
 	}
 
-	// Extract the database
+	// Extract the Country database
 	if err := run("tar", "-xzf", "GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 database: %v", err)
+		return fmt.Errorf("failed to extract GeoLite2 Country database: %v", err)
+	}
+	if err := run("tar", "-xzf", "GeoLite2-ASN.tar.gz"); err != nil {
+		return fmt.Errorf("failed to extract GeoLite2 ASN database: %v", err)
 	}
 
 	// Find the .mmdb file and move it to the config directory
 	if err := run("bash", "-c", "mv GeoLite2-Country_*/GeoLite2-Country.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 database to config directory: %v", err)
+		return fmt.Errorf("failed to move GeoLite2 Country database to config directory: %v", err)
+	}
+	if err := run("bash", "-c", "mv GeoLite2-ASN_*/GeoLite2-ASN.mmdb config/"); err != nil {
+		return fmt.Errorf("failed to move GeoLite2 ASN database to config directory: %v", err)
 	}
 
 	// Clean up the downloaded files
-	if err := run("rm", "-rf", "GeoLite2-Country.tar.gz", "GeoLite2-Country_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary files: %v\n", err)
+	if err := run("sh", "-c", "rm -rf GeoLite2-Country.tar.gz GeoLite2-Country_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary country files: %v\n", err)
+	}
+	if err := run("sh", "-c", "rm -rf GeoLite2-ASN.tar.gz GeoLite2-ASN_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary ASN files: %v\n", err)
 	}
 
-	fmt.Println("MaxMind GeoLite2 Country database downloaded successfully!")
+	fmt.Println("MaxMind GeoLite2 Country and ASN database downloaded successfully!")
 	return nil
 }

next.config.ts

@@ -1,17 +1,42 @@
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";
+import fs from "fs";
+import path from "path";
 
 const withNextIntl = createNextIntlPlugin();
+// read allowedDevOrigins.json if it exists
+let allowedDevOrigins: string[] = [];
+const allowedDevOriginsPath = path.join(
+    process.cwd(),
+    "allowedDevOrigins.json"
+);
+if (fs.existsSync(allowedDevOriginsPath)) {
+    try {
+        const data = fs.readFileSync(allowedDevOriginsPath, "utf-8");
+        allowedDevOrigins = JSON.parse(data);
+    } catch {}
+}
 
 const nextConfig: NextConfig = {
     reactStrictMode: false,
-    eslint: {
-        ignoreDuringBuilds: true
-    },
-    experimental: {
-        reactCompiler: true
-    },
-    output: "standalone"
+    reactCompiler: true,
+    transpilePackages: ["@novnc/novnc"],
+    output: "standalone",
+    allowedDevOrigins,
+    async redirects() {
+        return [
+            {
+                source: "/:orgId/settings/resources/proxy/:path*",
+                destination: "/:orgId/settings/resources/public/:path*",
+                permanent: true
+            },
+            {
+                source: "/:orgId/settings/resources/client/:path*",
+                destination: "/:orgId/settings/resources/private/:path*",
+                permanent: true
+            }
+        ];
+    }
 };
 
 export default withNextIntl(nextConfig);

package.json

@@ -32,13 +32,15 @@
         "format": "prettier --write ."
     },
     "dependencies": {
-        "@asteasolutions/zod-to-openapi": "8.4.1",
-        "@aws-sdk/client-s3": "3.1011.0",
-        "@faker-js/faker": "10.3.0",
-        "@headlessui/react": "2.2.9",
-        "@hookform/resolvers": "5.2.2",
+        "@asteasolutions/zod-to-openapi": "8.5.0",
+        "@aws-sdk/client-s3": "3.1056.0",
+        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
+        "@headlessui/react": "2.2.10",
+        "@hookform/resolvers": "5.4.0",
         "@monaco-editor/react": "4.7.0",
         "@node-rs/argon2": "2.0.2",
+        "@novnc/novnc": "^1.7.0",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
         "@radix-ui/react-avatar": "1.1.11",
@@ -59,16 +61,20 @@
         "@radix-ui/react-tabs": "1.1.13",
         "@radix-ui/react-toast": "1.2.15",
         "@radix-ui/react-tooltip": "1.2.8",
-        "@react-email/components": "1.0.8",
-        "@react-email/render": "2.0.4",
-        "@react-email/tailwind": "2.0.5",
+        "@react-email/body": "0.3.0",
+        "@react-email/components": "1.0.12",
+        "@react-email/render": "2.0.8",
+        "@react-email/tailwind": "2.0.7",
         "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.0",
+        "@simplewebauthn/server": "13.3.1",
         "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.90.21",
+        "@tanstack/react-query": "5.100.14",
         "@tanstack/react-table": "8.21.3",
+        "@xterm/addon-fit": "^0.11.0",
+        "@xterm/addon-web-links": "^0.12.0",
+        "@xterm/xterm": "^6.0.0",
         "arctic": "3.7.0",
-        "axios": "1.15.0",
+        "axios": "1.18.0",
         "better-sqlite3": "11.9.1",
         "canvas-confetti": "1.9.4",
         "class-variance-authority": "0.7.1",
@@ -80,77 +86,77 @@
         "d3": "7.9.0",
         "drizzle-orm": "0.45.2",
         "express": "5.2.1",
-        "express-rate-limit": "8.3.0",
+        "express-rate-limit": "8.5.2",
         "glob": "13.0.6",
-        "helmet": "8.1.0",
+        "gpt-tokenizer": "^3.4.0",
+        "helmet": "8.2.0",
         "http-errors": "2.0.1",
         "input-otp": "1.4.2",
-        "ioredis": "5.10.0",
+        "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "4.1.1",
+        "js-yaml": "4.3.1",
         "jsonwebtoken": "9.0.3",
-        "lucide-react": "0.577.0",
-        "maxmind": "5.0.5",
+        "lucide-react": "1.17.0",
+        "maxmind": "5.0.6",
         "moment": "2.30.1",
-        "next": "15.5.15",
-        "next-intl": "4.8.3",
+        "next": "16.3.1",
+        "next-intl": "4.13.0",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "8.0.5",
+        "nodemailer": "9.0.1",
         "oslo": "1.2.1",
-        "pg": "8.20.0",
-        "posthog-node": "5.28.0",
+        "pg": "8.21.0",
+        "posthog-node": "5.35.6",
         "qrcode.react": "4.2.0",
-        "react": "19.2.4",
+        "react": "19.2.6",
         "react-day-picker": "9.14.0",
-        "react-dom": "19.2.4",
+        "react-dom": "19.2.6",
         "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.71.2",
+        "react-hook-form": "7.76.1",
         "react-icons": "5.6.0",
-        "recharts": "2.15.4",
+        "recharts": "3.8.1",
         "reodotdev": "1.1.0",
-        "resend": "6.9.2",
-        "semver": "7.7.4",
+        "semver": "7.8.1",
         "sshpk": "1.18.0",
-        "stripe": "20.4.1",
+        "stripe": "22.2.0",
         "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.5.0",
+        "tailwind-merge": "3.6.0",
         "topojson-client": "3.1.0",
         "tw-animate-css": "1.4.0",
-        "use-debounce": "10.1.0",
-        "uuid": "13.0.0",
+        "use-debounce": "10.1.1",
+        "uuid": "14.0.0",
         "vaul": "1.1.2",
         "visionscarto-world-atlas": "1.0.0",
         "winston": "3.19.0",
         "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.19.0",
-        "yaml": "2.8.3",
+        "ws": "8.21.0",
+        "yaml": "2.9.0",
         "yargs": "18.0.0",
-        "zod": "4.3.6",
+        "zod": "4.4.3",
         "zod-validation-error": "5.0.0"
     },
     "devDependencies": {
-        "@dotenvx/dotenvx": "1.54.1",
+        "@dotenvx/dotenvx": "1.69.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/preview-server": "5.2.10",
-        "@tailwindcss/postcss": "4.2.2",
-        "@tanstack/react-query-devtools": "5.91.3",
+        "@react-email/ui": "^6.9.2",
+        "@tailwindcss/postcss": "4.3.0",
+        "@tanstack/react-query-devtools": "5.100.14",
         "@types/better-sqlite3": "7.6.13",
         "@types/cookie-parser": "1.4.10",
         "@types/cors": "2.8.19",
         "@types/crypto-js": "4.2.2",
         "@types/d3": "7.4.3",
         "@types/express": "5.0.6",
-        "@types/express-session": "1.18.2",
+        "@types/express-session": "1.19.0",
         "@types/jmespath": "0.15.2",
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.3.5",
-        "@types/nodemailer": "7.0.11",
+        "@types/node": "25.9.1",
+        "@types/nodemailer": "8.0.0",
         "@types/nprogress": "0.2.3",
-        "@types/pg": "8.18.0",
-        "@types/react": "19.2.14",
+        "@types/pg": "8.20.0",
+        "@types/react": "19.2.15",
         "@types/react-dom": "19.2.3",
         "@types/semver": "7.7.1",
         "@types/sshpk": "1.17.4",
@@ -160,21 +166,22 @@
         "@types/yargs": "17.0.35",
         "babel-plugin-react-compiler": "1.0.0",
         "drizzle-kit": "0.31.10",
-        "esbuild": "0.27.4",
-        "esbuild-node-externals": "1.20.1",
-        "eslint": "10.0.3",
-        "eslint-config-next": "16.1.7",
-        "postcss": "8.5.8",
-        "prettier": "3.8.1",
-        "react-email": "5.2.10",
-        "tailwindcss": "4.2.2",
-        "tsc-alias": "1.8.16",
-        "tsx": "4.21.0",
-        "typescript": "5.9.3",
-        "typescript-eslint": "8.56.1"
+        "esbuild": "0.28.0",
+        "esbuild-node-externals": "1.22.0",
+        "eslint": "10.4.0",
+        "eslint-config-next": "16.2.6",
+        "postcss": "8.5.23",
+        "prettier": "3.8.3",
+        "react-email": "6.5.0",
+        "tailwindcss": "4.3.0",
+        "tsc-alias": "1.8.17",
+        "tsx": "4.22.3",
+        "typescript": "6.0.3",
+        "typescript-eslint": "8.60.0"
     },
     "overrides": {
-        "esbuild": "0.27.4",
-        "dompurify": "3.3.2"
+        "esbuild": "0.28.0",
+        "dompurify": "3.4.0",
+        "postcss": "8.5.23"
     }
 }

public/third-party/claude-dark.svg

@@ -0,0 +1,10 @@
+<svg width="256" height="257" viewBox="0 0 256 257" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_29_2)">
+<path d="M50.2278 170.321L100.585 142.064L101.428 139.601L100.585 138.24H98.1225L89.6972 137.722L60.9215 136.944L35.9696 135.907L11.7954 134.611L5.70329 133.314L0 125.796L0.583291 122.037L5.70329 118.603L13.0268 119.251L29.2294 120.352L53.5332 122.037L71.1615 123.074L97.28 125.796H101.428L102.011 124.111L100.585 123.074L99.4835 122.037L74.3372 104.992L47.117 86.9752L32.8587 76.6056L25.1463 71.3559L21.2577 66.4304L19.5727 55.6719L26.5722 47.9595L35.9696 48.6076L38.3676 49.2557L47.8947 56.5792L68.2451 72.3281L94.8172 91.9008L98.7058 95.1413L100.261 94.0395L100.456 93.2618L98.7058 90.3453L84.2532 64.2268L68.8284 37.6547L61.9585 26.637L60.1438 20.0263C59.4957 17.3043 59.042 15.0359 59.042 12.2491L67.0137 1.42582L71.4208 0L82.0496 1.42582L86.5215 5.31443L93.1321 20.4152L103.826 44.2005L120.417 76.5408L125.278 86.1327L127.87 95.0116L128.843 97.7337H130.528V96.1782L131.889 77.9666L134.416 55.6071L136.879 26.8314L137.722 18.7301L141.74 9.00861L149.711 3.75899L155.933 6.74025L161.053 14.0638L160.34 18.7949L157.294 38.562L151.332 69.5413L147.443 90.2805H149.711L152.304 87.6881L162.803 73.7539L180.431 51.7185L188.209 42.9691L197.282 33.3124L203.115 28.7109H214.133L222.234 40.7656L218.605 53.2091L207.263 67.597L197.865 79.7813L184.385 97.9281L175.959 112.446L176.737 113.612L178.746 113.418L209.207 106.937L225.669 103.955L245.306 100.585L254.185 104.733L255.157 108.946L251.658 117.566L230.659 122.75L206.031 127.676L169.349 136.361L168.895 136.685L169.414 137.333L185.94 138.888L193.005 139.277H210.309L242.52 141.675L250.945 147.249L256 154.054L255.157 159.238L242.195 165.849L224.697 161.701L183.866 151.98L169.867 148.48H167.923V149.647L179.589 161.053L200.976 180.367L227.743 205.254L229.104 211.411L225.669 216.271L222.039 215.753L198.513 198.06L189.44 190.088L168.895 172.784H167.534V174.598L172.265 181.533L197.282 219.123L198.578 230.659L196.764 234.418L190.283 236.687L183.153 235.39L168.506 214.846L153.406 191.708L141.221 170.969L139.731 171.812L132.537 249.26L129.167 253.213L121.389 256.194L114.908 251.269L111.473 243.297L114.908 227.548L119.056 207.004L122.426 190.671L125.472 170.386L127.287 163.646L127.157 163.192L125.667 163.386L110.372 184.385L87.1048 215.818L68.6987 235.52L64.2916 237.27L56.6441 233.316L57.357 226.252L61.6344 219.966L87.1048 187.561L102.465 167.469L112.381 155.868L112.316 154.183H111.733L44.0709 198.125L32.0162 199.68L26.8314 194.819L27.4795 186.848L29.9423 184.255L50.2927 170.256L50.2278 170.321Z" fill="#0B0B0B"/>
+</g>
+<defs>
+<clipPath id="clip0_29_2">
+<rect width="256" height="257" fill="white"/>
+</clipPath>
+</defs>
+</svg>

public/third-party/claude-light.svg

@@ -0,0 +1,10 @@
+<svg width="256" height="257" viewBox="0 0 256 257" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_29_2)">
+<path d="M50.2278 170.321L100.585 142.064L101.428 139.601L100.585 138.24H98.1225L89.6972 137.722L60.9215 136.944L35.9696 135.907L11.7954 134.611L5.70329 133.314L0 125.796L0.583291 122.037L5.70329 118.603L13.0268 119.251L29.2294 120.352L53.5332 122.037L71.1615 123.074L97.28 125.796H101.428L102.011 124.111L100.585 123.074L99.4835 122.037L74.3372 104.992L47.117 86.9752L32.8587 76.6056L25.1463 71.3559L21.2577 66.4304L19.5727 55.6719L26.5722 47.9595L35.9696 48.6076L38.3676 49.2557L47.8947 56.5792L68.2451 72.3281L94.8172 91.9008L98.7058 95.1413L100.261 94.0395L100.456 93.2618L98.7058 90.3453L84.2532 64.2268L68.8284 37.6547L61.9585 26.637L60.1438 20.0263C59.4957 17.3043 59.042 15.0359 59.042 12.2491L67.0137 1.42582L71.4208 0L82.0496 1.42582L86.5215 5.31443L93.1321 20.4152L103.826 44.2005L120.417 76.5408L125.278 86.1327L127.87 95.0116L128.843 97.7337H130.528V96.1782L131.889 77.9666L134.416 55.6071L136.879 26.8314L137.722 18.7301L141.74 9.00861L149.711 3.75899L155.933 6.74025L161.053 14.0638L160.34 18.7949L157.294 38.562L151.332 69.5413L147.443 90.2805H149.711L152.304 87.6881L162.803 73.7539L180.431 51.7185L188.209 42.9691L197.282 33.3124L203.115 28.7109H214.133L222.234 40.7656L218.605 53.2091L207.263 67.597L197.865 79.7813L184.385 97.9281L175.959 112.446L176.737 113.612L178.746 113.418L209.207 106.937L225.669 103.955L245.306 100.585L254.185 104.733L255.157 108.946L251.658 117.566L230.659 122.75L206.031 127.676L169.349 136.361L168.895 136.685L169.414 137.333L185.94 138.888L193.005 139.277H210.309L242.52 141.675L250.945 147.249L256 154.054L255.157 159.238L242.195 165.849L224.697 161.701L183.866 151.98L169.867 148.48H167.923V149.647L179.589 161.053L200.976 180.367L227.743 205.254L229.104 211.411L225.669 216.271L222.039 215.753L198.513 198.06L189.44 190.088L168.895 172.784H167.534V174.598L172.265 181.533L197.282 219.123L198.578 230.659L196.764 234.418L190.283 236.687L183.153 235.39L168.506 214.846L153.406 191.708L141.221 170.969L139.731 171.812L132.537 249.26L129.167 253.213L121.389 256.194L114.908 251.269L111.473 243.297L114.908 227.548L119.056 207.004L122.426 190.671L125.472 170.386L127.287 163.646L127.157 163.192L125.667 163.386L110.372 184.385L87.1048 215.818L68.6987 235.52L64.2916 237.27L56.6441 233.316L57.357 226.252L61.6344 219.966L87.1048 187.561L102.465 167.469L112.381 155.868L112.316 154.183H111.733L44.0709 198.125L32.0162 199.68L26.8314 194.819L27.4795 186.848L29.9423 184.255L50.2927 170.256L50.2278 170.321Z" fill="#F0EFEC"/>
+</g>
+<defs>
+<clipPath id="clip0_29_2">
+<rect width="256" height="257" fill="white"/>
+</clipPath>
+</defs>
+</svg>

public/third-party/gemini-dark.svg

@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="black"/>
+</svg>

public/third-party/gemini-light.svg

@@ -0,0 +1,3 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81" fill="white"/>
+</svg>

public/third-party/openai-dark.svg

@@ -0,0 +1,3 @@
+<svg width="716" height="716" viewBox="157 157 402 402" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M508.749 317.399C516.777 287.314 508.991 253.884 485.389 230.282C461.788 206.681 428.36 198.895 398.273 206.923C376.231 184.928 343.39 174.956 311.148 183.596C278.906 192.234 255.45 217.292 247.36 247.361C217.291 255.451 192.233 278.91 183.595 311.149C174.957 343.391 184.927 376.232 206.924 398.274C198.896 428.359 206.683 461.789 230.284 485.391C253.885 508.992 287.313 516.779 317.401 508.75C339.442 530.745 372.286 540.717 404.525 532.079C436.767 523.441 460.223 498.384 468.313 468.315C498.383 460.224 523.44 436.766 532.078 404.526C540.716 372.285 530.747 339.443 508.749 317.402V317.399ZM470.899 244.776C486.892 260.77 493.488 282.601 490.687 303.412L415.577 260.046C412.411 258.218 408.509 258.218 405.345 260.046L317.401 310.82V277.526C317.401 275.191 318.652 273.005 320.676 271.837L387.644 233.174C414.178 218.353 448.346 222.223 470.901 244.776H470.899ZM357.837 311.144L398.275 334.491V381.185L357.837 404.532L317.398 381.185V334.491L357.837 311.144ZM264.776 269.693C265.207 239.305 285.644 211.649 316.453 203.393C338.3 197.54 360.505 202.744 377.127 215.573L302.014 258.937C298.848 260.764 296.898 264.144 296.898 267.798V369.346L268.065 352.699C266.043 351.531 264.776 349.353 264.776 347.017V269.691V269.693ZM203.391 316.454C209.244 294.608 224.854 277.978 244.276 269.999V356.73C244.276 360.384 246.226 363.763 249.392 365.591L337.337 416.365L308.503 433.013C306.481 434.181 303.961 434.188 301.939 433.02L234.971 394.357C208.868 378.789 195.138 347.261 203.391 316.454ZM244.775 470.9C228.781 454.906 222.186 433.075 224.986 412.264L300.096 455.63C303.263 457.457 307.164 457.457 310.328 455.63L398.273 404.856V438.149C398.273 440.485 397.022 442.671 394.997 443.839L328.029 482.502C301.495 497.322 267.327 493.452 244.772 470.9H244.775ZM450.897 445.982C450.466 476.371 430.029 504.027 399.22 512.283C377.373 518.136 355.168 512.932 338.547 500.102L413.659 456.738C416.826 454.911 418.775 451.532 418.775 447.877V346.329L447.609 362.977C449.631 364.145 450.897 366.323 450.897 368.659V445.985V445.982ZM512.282 399.221C506.429 421.068 490.819 437.697 471.397 445.676V358.946C471.397 355.292 469.448 351.912 466.281 350.085L378.336 299.311L407.17 282.663C409.192 281.495 411.712 281.487 413.734 282.655L480.702 321.318C506.805 336.887 520.536 368.415 512.282 399.221Z" fill="black"/>
+</svg>

public/third-party/openai-light.svg

@@ -0,0 +1,3 @@
+<svg width="716" height="716" viewBox="157 157 402 402" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M508.749 317.399C516.777 287.314 508.991 253.884 485.389 230.282C461.788 206.681 428.36 198.895 398.273 206.923C376.231 184.928 343.39 174.956 311.148 183.596C278.906 192.234 255.45 217.292 247.36 247.361C217.291 255.451 192.233 278.91 183.595 311.149C174.957 343.391 184.927 376.232 206.924 398.274C198.896 428.359 206.683 461.789 230.284 485.391C253.885 508.992 287.313 516.779 317.401 508.75C339.442 530.745 372.286 540.717 404.525 532.079C436.767 523.441 460.223 498.384 468.313 468.315C498.383 460.224 523.44 436.766 532.078 404.526C540.716 372.285 530.747 339.443 508.749 317.402V317.399ZM470.899 244.776C486.892 260.77 493.488 282.601 490.687 303.412L415.577 260.046C412.411 258.218 408.509 258.218 405.345 260.046L317.401 310.82V277.526C317.401 275.191 318.652 273.005 320.676 271.837L387.644 233.174C414.178 218.353 448.346 222.223 470.901 244.776H470.899ZM357.837 311.144L398.275 334.491V381.185L357.837 404.532L317.398 381.185V334.491L357.837 311.144ZM264.776 269.693C265.207 239.305 285.644 211.649 316.453 203.393C338.3 197.54 360.505 202.744 377.127 215.573L302.014 258.937C298.848 260.764 296.898 264.144 296.898 267.798V369.346L268.065 352.699C266.043 351.531 264.776 349.353 264.776 347.017V269.691V269.693ZM203.391 316.454C209.244 294.608 224.854 277.978 244.276 269.999V356.73C244.276 360.384 246.226 363.763 249.392 365.591L337.337 416.365L308.503 433.013C306.481 434.181 303.961 434.188 301.939 433.02L234.971 394.357C208.868 378.789 195.138 347.261 203.391 316.454ZM244.775 470.9C228.781 454.906 222.186 433.075 224.986 412.264L300.096 455.63C303.263 457.457 307.164 457.457 310.328 455.63L398.273 404.856V438.149C398.273 440.485 397.022 442.671 394.997 443.839L328.029 482.502C301.495 497.322 267.327 493.452 244.772 470.9H244.775ZM450.897 445.982C450.466 476.371 430.029 504.027 399.22 512.283C377.373 518.136 355.168 512.932 338.547 500.102L413.659 456.738C416.826 454.911 418.775 451.532 418.775 447.877V346.329L447.609 362.977C449.631 364.145 450.897 366.323 450.897 368.659V445.985V445.982ZM512.282 399.221C506.429 421.068 490.819 437.697 471.397 445.676V358.946C471.397 355.292 469.448 351.912 466.281 350.085L378.336 299.311L407.17 282.663C409.192 281.495 411.712 281.487 413.734 282.655L480.702 321.318C506.805 336.887 520.536 368.415 512.282 399.221Z" fill="white"/>
+</svg>

public/third-party/opencode-dark.svg

@@ -0,0 +1 @@
+<svg width='240' height='300' viewBox='0 0 240 300' fill='none' xmlns='http://www.w3.org/2000/svg'><g clip-path='url(#clip0_1401_86274)'><mask id='mask0_1401_86274' style='mask-type:luminance' maskUnits='userSpaceOnUse' x='0' y='0' width='240' height='300'><path d='M240 0H0V300H240V0Z' fill='white'/></mask><g mask='url(#mask0_1401_86274)'><path d='M180 240H60V120H180V240Z' fill='#CFCECD'/><path d='M180 60H60V240H180V60ZM240 300H0V0H240V300Z' fill='#211E1E'/></g></g><defs><clipPath id='clip0_1401_86274'><rect width='240' height='300' fill='white'/></clipPath></defs></svg>

public/third-party/opencode-light.svg

@@ -0,0 +1 @@
+<svg width='240' height='300' viewBox='0 0 240 300' fill='none' xmlns='http://www.w3.org/2000/svg'><g clip-path='url(#clip0_1401_86283)'><mask id='mask0_1401_86283' style='mask-type:luminance' maskUnits='userSpaceOnUse' x='0' y='0' width='240' height='300'><path d='M240 0H0V300H240V0Z' fill='white'/></mask><g mask='url(#mask0_1401_86283)'><path d='M180 240H60V120H180V240Z' fill='#4B4646'/><path d='M180 60H60V240H180V60ZM240 300H0V0H240V300Z' fill='#F1ECEC'/></g></g><defs><clipPath id='clip0_1401_86283'><rect width='240' height='300' fill='white'/></clipPath></defs></svg>

server/aiGatewayServer.ts

@@ -0,0 +1,41 @@
+import express from "express";
+import helmet from "helmet";
+import cors from "cors";
+import config from "@server/lib/config";
+import logger from "@server/logger";
+import {
+    errorHandlerMiddleware,
+    notFoundMiddleware
+} from "@server/middlewares";
+import { createAiGatewayRouter } from "@server/routers/aiGateway";
+
+const aiGatewayPort = config.getRawConfig().server.ai_gateway_port;
+
+export function createAiGatewayServer() {
+    const aiGatewayServer = express();
+
+    const trustProxy = config.getRawConfig().server.trust_proxy;
+    if (trustProxy) {
+        aiGatewayServer.set("trust proxy", trustProxy);
+    }
+
+    aiGatewayServer.use(helmet());
+    aiGatewayServer.use(cors());
+    // AI requests can carry large payloads (long conversation history, tool
+    // results, embedded documents), well beyond express.json()'s 100kb default.
+    aiGatewayServer.use(express.json({ limit: "50mb" }));
+
+    aiGatewayServer.use(createAiGatewayRouter());
+
+    aiGatewayServer.use(notFoundMiddleware);
+    aiGatewayServer.use(errorHandlerMiddleware);
+
+    aiGatewayServer.listen(aiGatewayPort, (err?: any) => {
+        if (err) throw err;
+        logger.info(
+            `AI gateway server is running on http://localhost:${aiGatewayPort}`
+        );
+    });
+
+    return aiGatewayServer;
+}

server/auth/actions.ts

@@ -5,6 +5,7 @@ import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
+import logger from "@server/logger";
 
 export enum ActionsEnum {
     createOrgUser = "createOrgUser",
@@ -20,6 +21,8 @@ export enum ActionsEnum {
     getSite = "getSite",
     listSites = "listSites",
     updateSite = "updateSite",
+    updateSiteApprovals = "updateSiteApprovals",
+    restartSite = "restartSite",
     resetSiteBandwidth = "resetSiteBandwidth",
     reGenerateSecret = "reGenerateSecret",
     createResource = "createResource",
@@ -47,6 +50,8 @@ export enum ActionsEnum {
     setResourceUsers = "setResourceUsers",
     setResourceRoles = "setResourceRoles",
     listResourceUsers = "listResourceUsers",
+    listResourceAiModels = "listResourceAiModels",
+    setResourceAiModels = "setResourceAiModels",
     // removeRoleSite = "removeRoleSite",
     // addRoleAction = "addRoleAction",
     // removeRoleAction = "removeRoleAction",
@@ -69,6 +74,7 @@ export enum ActionsEnum {
     setResourceWhitelist = "setResourceWhitelist",
     getResourceWhitelist = "getResourceWhitelist",
     generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
     deleteAcessToken = "deleteAcessToken",
     listAccessTokens = "listAccessTokens",
     createResourceRule = "createResourceRule",
@@ -147,12 +153,59 @@ export enum ActionsEnum {
     createAlertRule = "createAlertRule",
     updateAlertRule = "updateAlertRule",
     deleteAlertRule = "deleteAlertRule",
+    testAlertRule = "testAlertRule",
     listAlertRules = "listAlertRules",
+    listOrgLabels = "listOrgLabels",
+    createOrgLabel = "createOrgLabel",
+    updateOrgLabel = "updateOrgLabel",
+    deleteOrgLabel = "deleteOrgLabel",
+    attachLabelToItem = "attachLabelToItem",
+    detachLabelFromItem = "detachLabelFromItem",
     getAlertRule = "getAlertRule",
     createHealthCheck = "createHealthCheck",
     updateHealthCheck = "updateHealthCheck",
     deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks"
+    listHealthChecks = "listHealthChecks",
+    createBrowserGatewayTarget = "createBrowserGatewayTarget",
+    updateBrowserGatewayTarget = "updateBrowserGatewayTarget",
+    deleteBrowserGatewayTarget = "deleteBrowserGatewayTarget",
+    getBrowserGatewayTarget = "getBrowserGatewayTarget",
+    listBrowserGatewayTargets = "listBrowserGatewayTargets",
+    listResourcePolicies = "listResourcePolicies",
+    getResourcePolicy = "getResourcePolicy",
+    createResourcePolicy = "createResourcePolicy",
+    updateResourcePolicy = "updateResourcePolicy",
+    deleteResourcePolicy = "deleteResourcePolicy",
+    listResourcePolicyRoles = "listResourcePolicyRoles",
+    setResourcePolicyRoles = "setResourcePolicyRoles",
+    listResourcePolicyUsers = "listResourcePolicyUsers",
+    setResourcePolicyUsers = "setResourcePolicyUsers",
+    setResourcePolicyPassword = "setResourcePolicyPassword",
+    setResourcePolicyPincode = "setResourcePolicyPincode",
+    setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
+    setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
+    setResourcePolicyRules = "setResourcePolicyRules",
+    createOrgWideLauncherView = "createOrgWideLauncherView",
+    createAiProvider = "createAiProvider",
+    deleteAiProvider = "deleteAiProvider",
+    getAiProvider = "getAiProvider",
+    listAiProviders = "listAiProviders",
+    updateAiProvider = "updateAiProvider",
+    createAiModel = "createAiModel",
+    deleteAiModel = "deleteAiModel",
+    getAiModel = "getAiModel",
+    listAiModels = "listAiModels",
+    updateAiModel = "updateAiModel",
+    createAiBudget = "createAiBudget",
+    deleteAiBudget = "deleteAiBudget",
+    getAiBudget = "getAiBudget",
+    listAiBudgets = "listAiBudgets",
+    updateAiBudget = "updateAiBudget",
+    createVirtualApiKey = "createVirtualApiKey",
+    deleteVirtualApiKey = "deleteVirtualApiKey",
+    getVirtualApiKey = "getVirtualApiKey",
+    listVirtualApiKeys = "listVirtualApiKeys",
+    updateVirtualApiKey = "updateVirtualApiKey"
 }
 
 export async function checkUserActionPermission(
@@ -185,6 +238,23 @@ export async function checkUserActionPermission(
             }
         }
 
+        // If no direct permission, check role-based permission (any of user's roles)
+        const roleActionPermission = await db
+            .select()
+            .from(roleActions)
+            .where(
+                and(
+                    eq(roleActions.actionId, actionId),
+                    inArray(roleActions.roleId, userOrgRoleIds),
+                    eq(roleActions.orgId, req.userOrgId!)
+                )
+            )
+            .limit(1);
+
+        if (roleActionPermission.length > 0) {
+            return true;
+        }
+
         // Check if the user has direct permission for the action in the current org
         const userActionPermission = await db
             .select()
@@ -202,20 +272,7 @@ export async function checkUserActionPermission(
             return true;
         }
 
-        // If no direct permission, check role-based permission (any of user's roles)
-        const roleActionPermission = await db
-            .select()
-            .from(roleActions)
-            .where(
-                and(
-                    eq(roleActions.actionId, actionId),
-                    inArray(roleActions.roleId, userOrgRoleIds),
-                    eq(roleActions.orgId, req.userOrgId!)
-                )
-            )
-            .limit(1);
-
-        return roleActionPermission.length > 0;
+        return false;
     } catch (error) {
         console.error("Error checking user action permission:", error);
         throw createHttpError(

server/auth/canUserAccessResource.ts

@@ -1,6 +1,12 @@
 import { db } from "@server/db";
-import { and, eq, inArray } from "drizzle-orm";
-import { roleResources, userResources } from "@server/db";
+import { and, eq, inArray, isNull, or } from "drizzle-orm";
+import {
+    rolePolicies,
+    roleResources,
+    resources,
+    userPolicies,
+    userResources
+} from "@server/db";
 
 export async function canUserAccessResource({
     userId,
@@ -11,9 +17,14 @@ export async function canUserAccessResource({
     resourceId: number;
     roleIds: number[];
 }): Promise<boolean> {
-    const roleResourceAccess =
+    const [
+        roleResourceAccess,
+        rolePolicyAccess,
+        userResourceAccess,
+        userPolicyAccess
+    ] = await Promise.all([
         roleIds.length > 0
-            ? await db
+            ? db
                   .select()
                   .from(roleResources)
                   .where(
@@ -23,26 +34,87 @@ export async function canUserAccessResource({
                       )
                   )
                   .limit(1)
-            : [];
-
-    if (roleResourceAccess.length > 0) {
-        return true;
-    }
-
-    const userResourceAccess = await db
-        .select()
-        .from(userResources)
-        .where(
-            and(
-                eq(userResources.userId, userId),
-                eq(userResources.resourceId, resourceId)
+            : [],
+        roleIds.length > 0
+            ? db
+                  .select({
+                      roleId: rolePolicies.roleId,
+                      resourcePolicyId: rolePolicies.resourcePolicyId
+                  })
+                  .from(rolePolicies)
+                  .innerJoin(
+                      resources,
+                      // Shared policy wins; only use default policy when no shared
+                      // policy is assigned to the resource.
+                      or(
+                          eq(
+                              resources.resourcePolicyId,
+                              rolePolicies.resourcePolicyId
+                          ),
+                          and(
+                              isNull(resources.resourcePolicyId),
+                              eq(
+                                  resources.defaultResourcePolicyId,
+                                  rolePolicies.resourcePolicyId
+                              )
+                          )
+                      )
+                  )
+                  .where(
+                      and(
+                          eq(resources.resourceId, resourceId),
+                          inArray(rolePolicies.roleId, roleIds)
+                      )
+                  )
+                  .limit(1)
+            : [],
+        db
+            .select()
+            .from(userResources)
+            .where(
+                and(
+                    eq(userResources.userId, userId),
+                    eq(userResources.resourceId, resourceId)
+                )
             )
-        )
-        .limit(1);
+            .limit(1),
+        db
+            .select({
+                userId: userPolicies.userId,
+                resourcePolicyId: userPolicies.resourcePolicyId
+            })
+            .from(userPolicies)
+            .innerJoin(
+                resources,
+                // Shared policy wins; only use default policy when no shared
+                // policy is assigned to the resource.
+                or(
+                    eq(
+                        resources.resourcePolicyId,
+                        userPolicies.resourcePolicyId
+                    ),
+                    and(
+                        isNull(resources.resourcePolicyId),
+                        eq(
+                            resources.defaultResourcePolicyId,
+                            userPolicies.resourcePolicyId
+                        )
+                    )
+                )
+            )
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(userPolicies.userId, userId)
+                )
+            )
+            .limit(1)
+    ]);
 
-    if (userResourceAccess.length > 0) {
-        return true;
-    }
-
-    return false;
+    return (
+        roleResourceAccess.length > 0 ||
+        rolePolicyAccess.length > 0 ||
+        userResourceAccess.length > 0 ||
+        userPolicyAccess.length > 0
+    );
 }

server/auth/sessions/app.ts

@@ -12,7 +12,7 @@ import {
     users
 } from "@server/db";
 import { db } from "@server/db";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";
 import config from "@server/lib/config";
 import type { RandomReader } from "@oslojs/crypto/random";
 import { generateRandomString } from "@oslojs/crypto/random";
@@ -136,6 +136,45 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
     }
 }
 
+export async function invalidateAllSessionsExceptCurrent(
+    userId: string,
+    currentSessionId: string
+): Promise<void> {
+    try {
+        await db.transaction(async (trx) => {
+            const userSessions = await trx
+                .select()
+                .from(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+
+            if (userSessions.length > 0) {
+                await trx.delete(resourceSessions).where(
+                    inArray(
+                        resourceSessions.userSessionId,
+                        userSessions.map((s) => s.sessionId)
+                    )
+                );
+            }
+
+            await trx
+                .delete(sessions)
+                .where(
+                    and(
+                        eq(sessions.userId, userId),
+                        ne(sessions.sessionId, currentSessionId)
+                    )
+                );
+        });
+    } catch (e) {
+        logger.error("Failed to invalidate user sessions except current", e);
+    }
+}
+
 export function serializeSessionCookie(
     token: string,
     isSecure: boolean,

server/auth/sessions/resource.ts

@@ -19,6 +19,9 @@ export async function createResourceSession(opts: {
     userSessionId?: string | null;
     whitelistId?: number | null;
     accessTokenId?: string | null;
+    policyPasswordId?: number | null;
+    policyPincodeId?: number | null;
+    policyWhitelistId?: number | null;
     doNotExtend?: boolean;
     expiresAt?: number | null;
     sessionLength?: number | null;
@@ -28,7 +31,10 @@ export async function createResourceSession(opts: {
         !opts.pincodeId &&
         !opts.whitelistId &&
         !opts.accessTokenId &&
-        !opts.userSessionId
+        !opts.userSessionId &&
+        !opts.policyPasswordId &&
+        !opts.policyPincodeId &&
+        !opts.policyWhitelistId
     ) {
         throw new Error("Auth method must be provided");
     }
@@ -49,6 +55,9 @@ export async function createResourceSession(opts: {
         whitelistId: opts.whitelistId || null,
         doNotExtend: opts.doNotExtend || false,
         accessTokenId: opts.accessTokenId || null,
+        policyPasswordId: opts.policyPasswordId || null,
+        policyPincodeId: opts.policyPincodeId || null,
+        policyWhitelistId: opts.policyWhitelistId || null,
         isRequestToken: opts.isRequestToken || false,
         userSessionId: opts.userSessionId || null,
         issuedAt: new Date().getTime()

server/auth/verifyVirtualApiKey.ts

@@ -0,0 +1,311 @@
+import { canUserAccessResource } from "@server/auth/canUserAccessResource";
+import {
+    db,
+    users,
+    virtualApiKeyResources,
+    virtualApiKeys,
+    type VirtualApiKey
+} from "@server/db";
+import config from "@server/lib/config";
+import {
+    decryptVirtualApiKeyToken,
+    VIRTUAL_API_KEY_PREFIX,
+    looksLikeVirtualApiKeyCredential
+} from "@server/lib/virtualApiKey";
+import { getUserOrgRoles } from "@server/lib/userOrgRoles";
+import { and, eq } from "drizzle-orm";
+import { isWithinExpirationDate } from "oslo";
+
+export type VirtualApiKeyCredential = {
+    virtualApiKeyId: string;
+    secret: string;
+};
+
+export type VirtualApiKeyUserData = {
+    userId: string;
+    username: string;
+    email: string | null;
+    name: string | null;
+    role: string | null;
+};
+
+function getHeader(
+    headers: Record<string, string> | undefined,
+    name: string
+): string | undefined {
+    if (!headers) {
+        return undefined;
+    }
+    if (headers[name] !== undefined) {
+        return headers[name];
+    }
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lower) {
+            return value;
+        }
+    }
+    return undefined;
+}
+
+function parseVkCredential(
+    raw: string | undefined
+): VirtualApiKeyCredential | null {
+    if (!raw || !looksLikeVirtualApiKeyCredential(raw)) {
+        return null;
+    }
+    const withoutPrefix = raw.trim().slice(VIRTUAL_API_KEY_PREFIX.length);
+    const dot = withoutPrefix.indexOf(".");
+    return {
+        virtualApiKeyId: withoutPrefix.slice(0, dot),
+        secret: withoutPrefix.slice(dot + 1)
+    };
+}
+
+export function extractVirtualApiKeyCredential(
+    headers: Record<string, string> | undefined
+): VirtualApiKeyCredential | null {
+    if (!headers) {
+        return null;
+    }
+
+    const authorization = getHeader(headers, "authorization");
+    if (authorization) {
+        const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
+        if (bearerMatch) {
+            const credential = parseVkCredential(bearerMatch[1]);
+            if (credential) {
+                return credential;
+            }
+        }
+        const splunkMatch = authorization.match(/^Splunk\s+(.+)$/i);
+        if (splunkMatch) {
+            const credential = parseVkCredential(splunkMatch[1]);
+            if (credential) {
+                return credential;
+            }
+        }
+    }
+
+    const cfAig = getHeader(headers, "cf-aig-authorization");
+    if (cfAig) {
+        const bearerMatch = cfAig.match(/^Bearer\s+(.+)$/i);
+        const credential = parseVkCredential(
+            bearerMatch ? bearerMatch[1] : cfAig
+        );
+        if (credential) {
+            return credential;
+        }
+    }
+
+    for (const name of ["x-api-key", "x-goog-api-key"] as const) {
+        const credential = parseVkCredential(getHeader(headers, name));
+        if (credential) {
+            return credential;
+        }
+    }
+
+    return null;
+}
+
+async function buildUserData(
+    userId: string,
+    orgId: string
+): Promise<VirtualApiKeyUserData | undefined> {
+    const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.userId, userId))
+        .limit(1);
+
+    if (!user) {
+        return undefined;
+    }
+
+    if (
+        config.getRawConfig().flags?.require_email_verification &&
+        !user.emailVerified
+    ) {
+        return undefined;
+    }
+
+    const userOrgRoles = await getUserOrgRoles(user.userId, orgId);
+    if (userOrgRoles.length === 0) {
+        return undefined;
+    }
+
+    return {
+        userId: user.userId,
+        username: user.username,
+        email: user.email,
+        name: user.name,
+        role: userOrgRoles.map((r) => r.roleName).join(", ") || null
+    };
+}
+
+async function userHasResourceAccess(
+    userId: string,
+    resourceId: number,
+    orgId: string
+): Promise<{ allowed: boolean; userData?: VirtualApiKeyUserData }> {
+    const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.userId, userId))
+        .limit(1);
+
+    if (!user) {
+        return { allowed: false };
+    }
+
+    if (
+        config.getRawConfig().flags?.require_email_verification &&
+        !user.emailVerified
+    ) {
+        return { allowed: false };
+    }
+
+    const userOrgRoles = await getUserOrgRoles(user.userId, orgId);
+    if (userOrgRoles.length === 0) {
+        return { allowed: false };
+    }
+
+    const allowed = await canUserAccessResource({
+        userId,
+        resourceId,
+        roleIds: userOrgRoles.map((r) => r.roleId)
+    });
+
+    if (!allowed) {
+        return { allowed: false };
+    }
+
+    return {
+        allowed: true,
+        userData: {
+            userId: user.userId,
+            username: user.username,
+            email: user.email,
+            name: user.name,
+            role: userOrgRoles.map((r) => r.roleName).join(", ") || null
+        }
+    };
+}
+
+async function manualKeyHasResourceAccess(
+    key: VirtualApiKey,
+    resourceId: number
+): Promise<boolean> {
+    if (key.allResources) {
+        return true;
+    }
+
+    const [row] = await db
+        .select({ resourceId: virtualApiKeyResources.resourceId })
+        .from(virtualApiKeyResources)
+        .where(
+            and(
+                eq(virtualApiKeyResources.virtualApiKeyId, key.virtualApiKeyId),
+                eq(virtualApiKeyResources.resourceId, resourceId)
+            )
+        )
+        .limit(1);
+
+    return Boolean(row);
+}
+
+async function touchLastUsedAt(virtualApiKeyId: string): Promise<void> {
+    try {
+        await db
+            .update(virtualApiKeys)
+            .set({ lastUsedAt: Date.now() })
+            .where(eq(virtualApiKeys.virtualApiKeyId, virtualApiKeyId));
+    } catch {
+        // Best-effort; do not fail auth on audit timestamp updates.
+    }
+}
+
+export async function verifyVirtualApiKey({
+    credential,
+    resourceId,
+    orgId
+}: {
+    credential: VirtualApiKeyCredential;
+    resourceId: number;
+    orgId: string;
+}): Promise<{
+    valid: boolean;
+    error?: string;
+    key?: VirtualApiKey;
+    userData?: VirtualApiKeyUserData;
+}> {
+    const [key] = await db
+        .select()
+        .from(virtualApiKeys)
+        .where(eq(virtualApiKeys.virtualApiKeyId, credential.virtualApiKeyId))
+        .limit(1);
+
+    if (!key) {
+        return { valid: false, error: "Virtual API key not found" };
+    }
+
+    if (key.orgId !== orgId) {
+        return { valid: false, error: "Virtual API key org mismatch" };
+    }
+
+    let plaintext: string;
+    try {
+        plaintext = decryptVirtualApiKeyToken(key.token);
+    } catch {
+        return { valid: false, error: "Virtual API key secret is invalid" };
+    }
+
+    if (plaintext !== credential.secret) {
+        return { valid: false, error: "Invalid virtual API key secret" };
+    }
+
+    if (key.expiresAt && !isWithinExpirationDate(new Date(key.expiresAt))) {
+        return { valid: false, error: "Virtual API key has expired" };
+    }
+
+    if (key.kind === "manual") {
+        const scoped = await manualKeyHasResourceAccess(key, resourceId);
+        if (!scoped) {
+            return {
+                valid: false,
+                error: "Virtual API key is not scoped to this resource"
+            };
+        }
+
+        let userData: VirtualApiKeyUserData | undefined;
+        if (key.userId) {
+            userData = await buildUserData(key.userId, orgId);
+        }
+
+        await touchLastUsedAt(key.virtualApiKeyId);
+        return { valid: true, key, userData };
+    }
+
+    if (key.kind === "user") {
+        if (!key.userId) {
+            return { valid: false, error: "User virtual API key has no user" };
+        }
+
+        const access = await userHasResourceAccess(
+            key.userId,
+            resourceId,
+            orgId
+        );
+        if (!access.allowed || !access.userData) {
+            return {
+                valid: false,
+                error: "User is not allowed to access this resource"
+            };
+        }
+
+        await touchLastUsedAt(key.virtualApiKeyId);
+        return { valid: true, key, userData: access.userData };
+    }
+
+    return { valid: false, error: "Unknown virtual API key kind" };
+}

server/cleanup.ts

@@ -3,12 +3,16 @@ import { flushConnectionLogToDb } from "#dynamic/routers/newt";
 import { flushSiteBandwidthToDb } from "@server/routers/gerbil/receiveBandwidth";
 import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { cleanup as wsCleanup } from "#dynamic/routers/ws";
+import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
+import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
 
 async function cleanup() {
     await stopPingAccumulator();
     await flushBandwidthToDb();
     await flushConnectionLogToDb();
     await flushSiteBandwidthToDb();
+    await shutdownUsageRecorder();
+    await shutdownAiSessionLogger();
     await wsCleanup();
 
     process.exit(0);

server/db/countries.ts

@@ -795,10 +795,13 @@ export const COUNTRIES = [
         name: "Serbia",
         code: "RS"
     },
-    {
-        name: "Serbia and Montenegro",
-        code: "CS"
-    },
+    // Removed as this is a deprecated ISO country code, not supported anymore
+    // Also the individual flags for Serbia & Montenegro are already included in the list
+    // more details: https://en.wikipedia.org/wiki/ISO_3166-2:CS
+    // {
+    //     name: "Serbia and Montenegro",
+    //     code: "CS"
+    // },
     {
         name: "Seychelles",
         code: "SC"

server/db/mac_models.json

@@ -1,94 +1,53 @@
 {
-  "PowerMac4,4": "eMac",
-  "PowerMac6,4": "eMac",
-  "PowerBook2,1": "iBook",
-  "PowerBook2,2": "iBook",
-  "PowerBook4,1": "iBook",
-  "PowerBook4,2": "iBook",
-  "PowerBook4,3": "iBook",
-  "PowerBook6,3": "iBook",
-  "PowerBook6,5": "iBook",
-  "PowerBook6,7": "iBook",
-  "iMac,1": "iMac",
-  "PowerMac2,1": "iMac",
-  "PowerMac2,2": "iMac",
-  "PowerMac4,1": "iMac",
-  "PowerMac4,2": "iMac",
-  "PowerMac4,5": "iMac",
-  "PowerMac6,1": "iMac",
-  "PowerMac6,3*": "iMac",
-  "PowerMac6,3": "iMac",
-  "PowerMac8,1": "iMac",
-  "PowerMac8,2": "iMac",
-  "PowerMac12,1": "iMac",
-  "iMac4,1": "iMac",
-  "iMac4,2": "iMac",
-  "iMac5,2": "iMac",
-  "iMac5,1": "iMac",
-  "iMac6,1": "iMac",
-  "iMac7,1": "iMac",
-  "iMac8,1": "iMac",
-  "iMac9,1": "iMac",
-  "iMac10,1": "iMac",
-  "iMac11,1": "iMac",
-  "iMac11,2": "iMac",
-  "iMac11,3": "iMac",
-  "iMac12,1": "iMac",
-  "iMac12,2": "iMac",
-  "iMac13,1": "iMac",
-  "iMac13,2": "iMac",
-  "iMac14,1": "iMac",
-  "iMac14,3": "iMac",
-  "iMac14,2": "iMac",
-  "iMac14,4": "iMac",
-  "iMac15,1": "iMac",
-  "iMac16,1": "iMac",
-  "iMac16,2": "iMac",
-  "iMac17,1": "iMac",
-  "iMac18,1": "iMac",
-  "iMac18,2": "iMac",
-  "iMac18,3": "iMac",
-  "iMac19,2": "iMac",
-  "iMac19,1": "iMac",
-  "iMac20,1": "iMac",
-  "iMac20,2": "iMac",
-  "iMac21,2": "iMac",
-  "iMac21,1": "iMac",
-  "iMacPro1,1": "iMac Pro",
-  "PowerMac10,1": "Mac mini",
-  "PowerMac10,2": "Mac mini",
-  "Macmini1,1": "Mac mini",
-  "Macmini2,1": "Mac mini",
-  "Macmini3,1": "Mac mini",
-  "Macmini4,1": "Mac mini",
-  "Macmini5,1": "Mac mini",
-  "Macmini5,2": "Mac mini",
-  "Macmini5,3": "Mac mini",
-  "Macmini6,1": "Mac mini",
-  "Macmini6,2": "Mac mini",
-  "Macmini7,1": "Mac mini",
-  "Macmini8,1": "Mac mini",
   "ADP3,2": "Mac mini",
-  "Macmini9,1": "Mac mini",
-  "Mac14,3": "Mac mini",
-  "Mac14,12": "Mac mini",
-  "MacPro1,1*": "Mac Pro",
-  "MacPro2,1": "Mac Pro",
-  "MacPro3,1": "Mac Pro",
-  "MacPro4,1": "Mac Pro",
-  "MacPro5,1": "Mac Pro",
-  "MacPro6,1": "Mac Pro",
-  "MacPro7,1": "Mac Pro",
-  "N/A*": "Power Macintosh",
-  "PowerMac1,1": "Power Macintosh",
-  "PowerMac3,1": "Power Macintosh",
-  "PowerMac3,3": "Power Macintosh",
-  "PowerMac3,4": "Power Macintosh",
-  "PowerMac3,5": "Power Macintosh",
-  "PowerMac3,6": "Power Macintosh",
   "Mac13,1": "Mac Studio",
   "Mac13,2": "Mac Studio",
+  "Mac14,10": "MacBook Pro",
+  "Mac14,12": "Mac mini",
+  "Mac14,13": "Mac Studio",
+  "Mac14,14": "Mac Studio",
+  "Mac14,15": "MacBook Air",
+  "Mac14,2": "MacBook Air",
+  "Mac14,3": "Mac mini",
+  "Mac14,5": "MacBook Pro",
+  "Mac14,6": "MacBook Pro",
+  "Mac14,7": "MacBook Pro",
+  "Mac14,8": "Mac Pro",
+  "Mac14,9": "MacBook Pro",
+  "Mac15,10": "MacBook Pro",
+  "Mac15,11": "MacBook Pro",
+  "Mac15,12": "MacBook Air",
+  "Mac15,13": "MacBook Air",
+  "Mac15,14": "Mac Studio",
+  "Mac15,3": "MacBook Pro",
+  "Mac15,4": "iMac",
+  "Mac15,5": "iMac",
+  "Mac15,6": "MacBook Pro",
+  "Mac15,7": "MacBook Pro",
+  "Mac15,8": "MacBook Pro",
+  "Mac15,9": "MacBook Pro",
+  "Mac16,1": "MacBook Pro",
+  "Mac16,10": "Mac mini",
+  "Mac16,11": "Mac mini",
+  "Mac16,12": "MacBook Air",
+  "Mac16,13": "MacBook Air",
+  "Mac16,2": "iMac",
+  "Mac16,3": "iMac",
+  "Mac16,5": "MacBook Pro",
+  "Mac16,6": "MacBook Pro",
+  "Mac16,7": "MacBook Pro",
+  "Mac16,8": "MacBook Pro",
+  "Mac16,9": "Mac Studio",
+  "Mac17,2": "MacBook Pro",
+  "Mac17,3": "MacBook Air",
+  "Mac17,4": "MacBook Air",
+  "Mac17,5": "MacBook Neo",
+  "Mac17,6": "MacBook Pro",
+  "Mac17,7": "MacBook Pro",
+  "Mac17,8": "MacBook Pro",
+  "Mac17,9": "MacBook Pro",
   "MacBook1,1": "MacBook",
+  "MacBook10,1": "MacBook",
   "MacBook2,1": "MacBook",
   "MacBook3,1": "MacBook",
   "MacBook4,1": "MacBook",
@@ -98,8 +57,8 @@
   "MacBook7,1": "MacBook",
   "MacBook8,1": "MacBook",
   "MacBook9,1": "MacBook",
-  "MacBook10,1": "MacBook",
   "MacBookAir1,1": "MacBook Air",
+  "MacBookAir10,1": "MacBook Air",
   "MacBookAir2,1": "MacBook Air",
   "MacBookAir3,1": "MacBook Air",
   "MacBookAir3,2": "MacBook Air",
@@ -114,88 +73,163 @@
   "MacBookAir8,1": "MacBook Air",
   "MacBookAir8,2": "MacBook Air",
   "MacBookAir9,1": "MacBook Air",
-  "MacBookAir10,1": "MacBook Air",
-  "Mac14,2": "MacBook Air",
   "MacBookPro1,1": "MacBook Pro",
   "MacBookPro1,2": "MacBook Pro",
-  "MacBookPro2,2": "MacBook Pro",
-  "MacBookPro2,1": "MacBook Pro",
-  "MacBookPro3,1": "MacBook Pro",
-  "MacBookPro4,1": "MacBook Pro",
-  "MacBookPro5,1": "MacBook Pro",
-  "MacBookPro5,2": "MacBook Pro",
-  "MacBookPro5,5": "MacBook Pro",
-  "MacBookPro5,4": "MacBook Pro",
-  "MacBookPro5,3": "MacBook Pro",
-  "MacBookPro7,1": "MacBook Pro",
-  "MacBookPro6,2": "MacBook Pro",
-  "MacBookPro6,1": "MacBook Pro",
-  "MacBookPro8,1": "MacBook Pro",
-  "MacBookPro8,2": "MacBook Pro",
-  "MacBookPro8,3": "MacBook Pro",
-  "MacBookPro9,2": "MacBook Pro",
-  "MacBookPro9,1": "MacBook Pro",
   "MacBookPro10,1": "MacBook Pro",
   "MacBookPro10,2": "MacBook Pro",
   "MacBookPro11,1": "MacBook Pro",
   "MacBookPro11,2": "MacBook Pro",
   "MacBookPro11,3": "MacBook Pro",
-  "MacBookPro12,1": "MacBook Pro",
   "MacBookPro11,4": "MacBook Pro",
   "MacBookPro11,5": "MacBook Pro",
+  "MacBookPro12,1": "MacBook Pro",
   "MacBookPro13,1": "MacBook Pro",
   "MacBookPro13,2": "MacBook Pro",
   "MacBookPro13,3": "MacBook Pro",
   "MacBookPro14,1": "MacBook Pro",
   "MacBookPro14,2": "MacBook Pro",
   "MacBookPro14,3": "MacBook Pro",
-  "MacBookPro15,2": "MacBook Pro",
   "MacBookPro15,1": "MacBook Pro",
+  "MacBookPro15,2": "MacBook Pro",
   "MacBookPro15,3": "MacBook Pro",
   "MacBookPro15,4": "MacBook Pro",
   "MacBookPro16,1": "MacBook Pro",
-  "MacBookPro16,3": "MacBook Pro",
   "MacBookPro16,2": "MacBook Pro",
+  "MacBookPro16,3": "MacBook Pro",
   "MacBookPro16,4": "MacBook Pro",
   "MacBookPro17,1": "MacBook Pro",
-  "MacBookPro18,3": "MacBook Pro",
-  "MacBookPro18,4": "MacBook Pro",
   "MacBookPro18,1": "MacBook Pro",
   "MacBookPro18,2": "MacBook Pro",
-  "Mac14,7": "MacBook Pro",
-  "Mac14,9": "MacBook Pro",
-  "Mac14,5": "MacBook Pro",
-  "Mac14,10": "MacBook Pro",
-  "Mac14,6": "MacBook Pro",
-  "PowerMac1,2": "Power Macintosh",
-  "PowerMac5,1": "Power Macintosh",
-  "PowerMac7,2": "Power Macintosh",
-  "PowerMac7,3": "Power Macintosh",
-  "PowerMac9,1": "Power Macintosh",
-  "PowerMac11,2": "Power Macintosh",
+  "MacBookPro18,3": "MacBook Pro",
+  "MacBookPro18,4": "MacBook Pro",
+  "MacBookPro2,1": "MacBook Pro",
+  "MacBookPro2,2": "MacBook Pro",
+  "MacBookPro3,1": "MacBook Pro",
+  "MacBookPro4,1": "MacBook Pro",
+  "MacBookPro5,1": "MacBook Pro",
+  "MacBookPro5,2": "MacBook Pro",
+  "MacBookPro5,3": "MacBook Pro",
+  "MacBookPro5,4": "MacBook Pro",
+  "MacBookPro5,5": "MacBook Pro",
+  "MacBookPro6,1": "MacBook Pro",
+  "MacBookPro6,2": "MacBook Pro",
+  "MacBookPro7,1": "MacBook Pro",
+  "MacBookPro8,1": "MacBook Pro",
+  "MacBookPro8,2": "MacBook Pro",
+  "MacBookPro8,3": "MacBook Pro",
+  "MacBookPro9,1": "MacBook Pro",
+  "MacBookPro9,2": "MacBook Pro",
+  "MacPro1,1": "Mac Pro",
+  "MacPro2,1": "Mac Pro",
+  "MacPro3,1": "Mac Pro",
+  "MacPro4,1": "Mac Pro",
+  "MacPro5,1": "Mac Pro",
+  "MacPro6,1": "Mac Pro",
+  "MacPro7,1": "Mac Pro",
+  "Macmini1,1": "Mac mini",
+  "Macmini2,1": "Mac mini",
+  "Macmini3,1": "Mac mini",
+  "Macmini4,1": "Mac mini",
+  "Macmini5,1": "Mac mini",
+  "Macmini5,2": "Mac mini",
+  "Macmini5,3": "Mac mini",
+  "Macmini6,1": "Mac mini",
+  "Macmini6,2": "Mac mini",
+  "Macmini7,1": "Mac mini",
+  "Macmini8,1": "Mac mini",
+  "Macmini9,1": "Mac mini",
   "PowerBook1,1": "PowerBook",
+  "PowerBook2,1": "iBook",
+  "PowerBook2,2": "iBook",
   "PowerBook3,1": "PowerBook",
   "PowerBook3,2": "PowerBook",
   "PowerBook3,3": "PowerBook",
   "PowerBook3,4": "PowerBook",
   "PowerBook3,5": "PowerBook",
-  "PowerBook6,1": "PowerBook",
+  "PowerBook4,1": "iBook",
+  "PowerBook4,2": "iBook",
+  "PowerBook4,3": "iBook",
   "PowerBook5,1": "PowerBook",
-  "PowerBook6,2": "PowerBook",
   "PowerBook5,2": "PowerBook",
   "PowerBook5,3": "PowerBook",
-  "PowerBook6,4": "PowerBook",
   "PowerBook5,4": "PowerBook",
   "PowerBook5,5": "PowerBook",
-  "PowerBook6,8": "PowerBook",
   "PowerBook5,6": "PowerBook",
   "PowerBook5,7": "PowerBook",
   "PowerBook5,8": "PowerBook",
   "PowerBook5,9": "PowerBook",
+  "PowerBook6,1": "PowerBook",
+  "PowerBook6,2": "PowerBook",
+  "PowerBook6,3": "iBook",
+  "PowerBook6,4": "PowerBook",
+  "PowerBook6,5": "iBook",
+  "PowerBook6,7": "iBook",
+  "PowerBook6,8": "PowerBook",
+  "PowerMac1,1": "Power Macintosh",
+  "PowerMac1,2": "Power Macintosh",
+  "PowerMac10,1": "Mac mini",
+  "PowerMac10,2": "Mac mini",
+  "PowerMac11,2": "Power Macintosh",
+  "PowerMac12,1": "iMac",
+  "PowerMac2,1": "iMac",
+  "PowerMac2,2": "iMac",
+  "PowerMac3,1": "Mac Server",
+  "PowerMac3,3": "Power Macintosh",
+  "PowerMac3,4": "Power Macintosh",
+  "PowerMac3,5": "Power Macintosh",
+  "PowerMac3,6": "Power Macintosh",
+  "PowerMac4,1": "iMac",
+  "PowerMac4,2": "iMac",
+  "PowerMac4,4": "eMac",
+  "PowerMac4,5": "iMac",
+  "PowerMac5,1": "Power Macintosh",
+  "PowerMac6,1": "iMac",
+  "PowerMac6,3": "iMac",
+  "PowerMac6,4": "eMac",
+  "PowerMac7,2": "Power Macintosh",
+  "PowerMac7,3": "Power Macintosh",
+  "PowerMac8,1": "iMac",
+  "PowerMac8,2": "iMac",
+  "PowerMac9,1": "Power Macintosh",
   "RackMac1,1": "Xserve",
   "RackMac1,2": "Xserve",
   "RackMac3,1": "Xserve",
   "Xserve1,1": "Xserve",
   "Xserve2,1": "Xserve",
-  "Xserve3,1": "Xserve"
-}
+  "Xserve3,1": "Xserve",
+  "iMac,1": "iMac",
+  "iMac10,1": "iMac",
+  "iMac11,1": "iMac",
+  "iMac11,2": "iMac",
+  "iMac11,3": "iMac",
+  "iMac12,1": "iMac",
+  "iMac12,2": "iMac",
+  "iMac13,1": "iMac",
+  "iMac13,2": "iMac",
+  "iMac14,1": "iMac",
+  "iMac14,2": "iMac",
+  "iMac14,3": "iMac",
+  "iMac14,4": "iMac",
+  "iMac15,1": "iMac",
+  "iMac16,1": "iMac",
+  "iMac16,2": "iMac",
+  "iMac17,1": "iMac",
+  "iMac18,1": "iMac",
+  "iMac18,2": "iMac",
+  "iMac18,3": "iMac",
+  "iMac19,1": "iMac",
+  "iMac19,2": "iMac",
+  "iMac20,1": "iMac",
+  "iMac20,2": "iMac",
+  "iMac21,1": "iMac",
+  "iMac21,2": "iMac",
+  "iMac4,1": "iMac",
+  "iMac4,2": "iMac",
+  "iMac5,1": "iMac",
+  "iMac5,2": "iMac",
+  "iMac6,1": "iMac",
+  "iMac7,1": "iMac",
+  "iMac8,1": "iMac",
+  "iMac9,1": "iMac",
+  "iMacPro1,1": "iMac Pro"
+}

server/db/names.ts

@@ -1,6 +1,13 @@
 import { join } from "path";
 import { readFileSync } from "fs";
-import { clients, db, resources, siteResources } from "@server/db";
+import {
+    aiProviders,
+    clients,
+    db,
+    resourcePolicies,
+    resources,
+    siteResources
+} from "@server/db";
 import { randomInt } from "crypto";
 import { exitNodes, sites } from "@server/db";
 import { eq, and } from "drizzle-orm";
@@ -107,6 +114,61 @@ export async function getUniqueResourceName(orgId: string): Promise<string> {
     }
 }
 
+export async function getUniqueProviderName(orgId: string): Promise<string> {
+    let loops = 0;
+    while (true) {
+        if (loops > 100) {
+            throw new Error("Could not generate a unique name");
+        }
+
+        const name = generateName();
+
+        const aiProviderCount = await db
+            .select({
+                niceId: aiProviders.niceId,
+                orgId: aiProviders.orgId
+            })
+            .from(aiProviders)
+            .where(
+                and(eq(aiProviders.niceId, name), eq(aiProviders.orgId, orgId))
+            );
+
+        if (aiProviderCount.length === 0) {
+            return name;
+        }
+        loops++;
+    }
+}
+
+export async function getUniqueResourcePolicyName(
+    orgId: string
+): Promise<string> {
+    let loops = 0;
+    while (true) {
+        if (loops > 100) {
+            throw new Error("Could not generate a unique name");
+        }
+
+        const name = generateName();
+        const policyCount = await db
+            .select({
+                niceId: resourcePolicies.niceId,
+                orgId: resourcePolicies.orgId
+            })
+            .from(resourcePolicies)
+            .where(
+                and(
+                    eq(resourcePolicies.niceId, name),
+                    eq(resourcePolicies.orgId, orgId)
+                )
+            );
+        if (policyCount.length === 0) {
+            return name;
+        }
+        loops++;
+    }
+}
+
 export async function getUniqueSiteResourceName(
     orgId: string
 ): Promise<string> {

server/db/pg/driver.ts

@@ -87,7 +87,7 @@ function createDb() {
 
 export const db = createDb();
 export default db;
-export const primaryDb = db.$primary;
+export const primaryDb = db.$primary as typeof db; // is this typeof a problem - technically they are different types
 export type Transaction = Parameters<
     Parameters<(typeof db)["transaction"]>[0]
 >[0];

server/db/pg/index.ts

@@ -4,3 +4,4 @@ export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
+export { alias } from "drizzle-orm/pg-core";

server/db/pg/logsDriver.ts

@@ -2,7 +2,7 @@ import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { build } from "@server/build";
-import { db as mainDb, primaryDb as mainPrimaryDb } from "./driver";
+import { db as mainDb } from "./driver";
 import { createPool } from "./poolConfig";
 
 function createLogsDb() {
@@ -63,8 +63,7 @@ function createLogsDb() {
             })
         );
     } else {
-        const maxReplicaConnections =
-            poolConfig?.max_replica_connections || 20;
+        const maxReplicaConnections = poolConfig?.max_replica_connections || 20;
         for (const conn of replicaConnections) {
             const replicaPool = createPool(
                 conn.connection_string,
@@ -91,4 +90,4 @@ function createLogsDb() {
 
 export const logsDb = createLogsDb();
 export default logsDb;
-export const primaryLogsDb = logsDb.$primary;
+export const primaryLogsDb = logsDb.$primary;

server/db/pg/poolConfig.ts

@@ -1,5 +1,5 @@
+import config from "@server/lib/config";
 import { Pool, PoolConfig } from "pg";
-import logger from "@server/logger";
 
 export function createPoolConfig(
     connectionString: string,
@@ -27,7 +27,7 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
     pool.on("error", (err) => {
         // This catches errors on idle clients in the pool. Without this
         // handler an unexpected disconnect would crash the process.
-        logger.error(
+        console.error(
             `Unexpected error on idle ${label} database client: ${err.message}`
         );
     });
@@ -36,10 +36,32 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
         // Set a statement timeout on every new connection so a single slow
         // query can't block the pool forever
         client.query("SET statement_timeout = '30s'").catch((err: Error) => {
-            logger.warn(
+            console.warn(
                 `Failed to set statement_timeout on ${label} client: ${err.message}`
             );
         });
+
+        // Disable JIT compilation for this connection. Our hot-path queries
+        // (e.g. resource-by-domain lookups) join many tables but only ever
+        // return a handful of rows. When planner row estimates drift (e.g.
+        // due to autovacuum lag under write-heavy load), Postgres decides
+        // these plans are expensive enough to JIT-compile, which can add
+        // multiple seconds of pure compilation overhead per query and
+        // saturate the connection pool. JIT never pays off for these
+        // short-lived OLTP queries, so it's disabled outright rather than
+        // relying on statistics staying fresh.
+        //
+        // Set via a runtime SET command rather than the `options: "-c
+        // jit=off"` startup parameter: connections in SaaS mode go through
+        // a pooler (e.g. PgBouncer) that rejects arbitrary startup packet
+        // options with a protocol_violation (08P01) error.
+        if (config.getRawConfig().postgres?.pool.jit_mode == false) {
+            client.query("SET jit = off").catch((err: Error) => {
+                console.warn(
+                    `Failed to set jit=off on ${label} client: ${err.message}`
+                );
+            });
+        }
     });
 }
 
@@ -60,4 +82,4 @@ export function createPool(
     );
     attachPoolErrorHandlers(pool, label);
     return pool;
-}
+}

server/db/pg/schema/privateSchema.ts

@@ -2,6 +2,7 @@ import {
     pgTable,
     serial,
     varchar,
+    unique,
     boolean,
     integer,
     bigint,
@@ -11,7 +12,7 @@ import {
     primaryKey,
     uniqueIndex
 } from "drizzle-orm/pg-core";
-import { InferSelectModel } from "drizzle-orm";
+import { InferSelectModel, sql } from "drizzle-orm";
 import {
     domains,
     orgs,
@@ -19,33 +20,15 @@ import {
     roles,
     users,
     exitNodes,
-    sessions,
-    clients,
     resources,
     siteResources,
     targetHealthCheck,
-    sites
+    sites,
+    clients,
+    sessions,
+    labels
 } from "./schema";
 
-export const certificates = pgTable("certificates", {
-    certId: serial("certId").primaryKey(),
-    domain: varchar("domain", { length: 255 }).notNull().unique(),
-    domainId: varchar("domainId").references(() => domains.domainId, {
-        onDelete: "cascade"
-    }),
-    wildcard: boolean("wildcard").default(false),
-    status: varchar("status", { length: 50 }).notNull().default("pending"), // pending, requested, valid, expired, failed
-    expiresAt: bigint("expiresAt", { mode: "number" }),
-    lastRenewalAttempt: bigint("lastRenewalAttempt", { mode: "number" }),
-    createdAt: bigint("createdAt", { mode: "number" }).notNull(),
-    updatedAt: bigint("updatedAt", { mode: "number" }).notNull(),
-    orderId: varchar("orderId", { length: 500 }),
-    errorMessage: text("errorMessage"),
-    renewalCount: integer("renewalCount").default(0),
-    certFile: text("certFile"),
-    keyFile: text("keyFile")
-});
-
 export const dnsChallenge = pgTable("dnsChallenges", {
     dnsChallengeId: serial("dnsChallengeId").primaryKey(),
     domain: varchar("domain", { length: 255 }).notNull(),
@@ -93,7 +76,8 @@ export const subscriptions = pgTable("subscriptions", {
     billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }),
     expiresAt: bigint("expiresAt", { mode: "number" }),
     trial: boolean("trial").default(false),
-    type: varchar("type", { length: 50 }) // tier1, tier2, tier3, or license
+    type: varchar("type", { length: 50 }), // tier1, tier2, tier3, or license
+    override: boolean("override").default(false)
 });
 
 export const subscriptionItems = pgTable("subscriptionItems", {
@@ -197,6 +181,42 @@ export const remoteExitNodes = pgTable("remoteExitNode", {
     })
 });
 
+export const remoteExitNodeResources = pgTable("remoteExitNodeResources", {
+    remoteExitNodeResourceId: serial("remoteExitNodeResourceId").primaryKey(),
+    remoteExitNodeId: varchar("remoteExitNodeId")
+        .notNull()
+        .references(() => remoteExitNodes.remoteExitNodeId, {
+            onDelete: "cascade"
+        }),
+    destination: varchar("destination").notNull() // a cidr range
+});
+
+export const remoteExitNodePreferenceLabels = pgTable(
+    // this controls what sites are enforced to connect to this node
+    "remoteExitNodePreferenceLabels",
+    {
+        remoteExitNodePreferenceLabelId: serial(
+            "remoteExitNodePreferenceLabelId"
+        ).primaryKey(),
+        remoteExitNodeId: varchar("remoteExitNodeId")
+            .references(() => remoteExitNodes.remoteExitNodeId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [
+        unique("remote_exit_node_preference_label_uniq").on(
+            t.remoteExitNodeId,
+            t.labelId
+        )
+    ]
+);
+
 export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
     sessionId: varchar("id").primaryKey(),
     remoteExitNodeId: varchar("remoteExitNodeId")
@@ -207,17 +227,28 @@ export const remoteExitNodeSessions = pgTable("remoteExitNodeSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const loginPage = pgTable("loginPage", {
-    loginPageId: serial("loginPageId").primaryKey(),
-    subdomain: varchar("subdomain"),
-    fullDomain: varchar("fullDomain"),
-    exitNodeId: integer("exitNodeId").references(() => exitNodes.exitNodeId, {
-        onDelete: "set null"
-    }),
-    domainId: varchar("domainId").references(() => domains.domainId, {
-        onDelete: "set null"
-    })
-});
+export const loginPage = pgTable(
+    "loginPage",
+    {
+        loginPageId: serial("loginPageId").primaryKey(),
+        subdomain: varchar("subdomain"),
+        fullDomain: varchar("fullDomain"),
+        exitNodeId: integer("exitNodeId").references(
+            () => exitNodes.exitNodeId,
+            {
+                onDelete: "set null"
+            }
+        ),
+        domainId: varchar("domainId").references(() => domains.domainId, {
+            onDelete: "set null"
+        })
+    },
+    (t) => [
+        index("idx_loginpage_fulldomain")
+            .on(t.fullDomain)
+            .where(sql`${t.fullDomain} IS NOT NULL`)
+    ]
+);
 
 export const loginPageOrg = pgTable("loginPageOrg", {
     loginPageId: integer("loginPageId")
@@ -332,6 +363,7 @@ export const connectionAuditLog = pgTable(
         clientId: integer("clientId").references(() => clients.clientId, {
             onDelete: "cascade"
         }),
+        clientEndpoint: text("clientEndpoint"),
         userId: text("userId").references(() => users.userId, {
             onDelete: "cascade"
         }),
@@ -436,9 +468,14 @@ export const eventStreamingDestinations = pgTable(
         sendRequestLogs: boolean("sendRequestLogs").notNull().default(false),
         sendActionLogs: boolean("sendActionLogs").notNull().default(false),
         sendAccessLogs: boolean("sendAccessLogs").notNull().default(false),
+        sendAISessionLogs: boolean("sendAISessionLogs")
+            .notNull()
+            .default(false),
         type: varchar("type", { length: 50 }).notNull(), // e.g. "http", "kafka", etc.
         config: text("config").notNull(), // JSON string with the configuration for the destination
         enabled: boolean("enabled").notNull().default(true),
+        lastError: text("lastError"), // last send error message, null if healthy
+        lastErrorAt: bigint("lastErrorAt", { mode: "number" }), // epoch ms of last error, null if healthy
         createdAt: bigint("createdAt", { mode: "number" }).notNull(),
         updatedAt: bigint("updatedAt", { mode: "number" }).notNull()
     }
@@ -580,7 +617,6 @@ export const trialNotifications = pgTable("trialNotifications", {
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
-export type Certificate = InferSelectModel<typeof certificates>;
 export type DnsChallenge = InferSelectModel<typeof dnsChallenge>;
 export type Customer = InferSelectModel<typeof customers>;
 export type Subscription = InferSelectModel<typeof subscriptions>;

server/db/queries/verifySessionQueries.ts

@@ -17,22 +17,39 @@ import {
     resourceHeaderAuth,
     ResourceHeaderAuth,
     resourceRules,
+    resourcePolicyRules,
     resources,
     roleResources,
+    rolePolicies,
     sessions,
     userResources,
+    userPolicies,
     users,
     ResourceHeaderAuthExtendedCompatibility,
-    resourceHeaderAuthExtendedCompatibility
+    resourceHeaderAuthExtendedCompatibility,
+    resourcePolicies,
+    resourcePolicyPincode,
+    ResourcePolicyPincode,
+    resourcePolicyPassword,
+    ResourcePolicyPassword,
+    resourcePolicyHeaderAuth,
+    ResourcePolicyHeaderAuth,
+    resourceWhitelist,
+    resourcePolicyWhiteList
 } from "@server/db";
-import { and, eq, inArray, or, sql } from "drizzle-orm";
+import { alias } from "@server/db";
+import { and, eq, inArray, isNull, or, sql } from "drizzle-orm";
+import logger from "@server/logger";
 
 export type ResourceWithAuth = {
     resource: Resource | null;
-    pincode: ResourcePincode | null;
-    password: ResourcePassword | null;
-    headerAuth: ResourceHeaderAuth | null;
+    pincode: ResourcePincode | ResourcePolicyPincode | null;
+    password: ResourcePassword | ResourcePolicyPassword | null;
+    headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
     headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
+    applyRules: boolean | null;
+    sso: boolean | null;
+    emailWhitelistEnabled: boolean | null;
     org: Org;
 };
 
@@ -57,6 +74,33 @@ export async function getResourceByDomain(
         wildcardCandidates.push(`*.${parts.slice(i).join(".")}`);
     }
 
+    const sharedPolicy = alias(resourcePolicies, "sharedPolicy");
+    const defaultPolicy = alias(resourcePolicies, "defaultPolicy");
+    const sharedPolicyPincode = alias(
+        resourcePolicyPincode,
+        "sharedPolicyPincode"
+    );
+    const defaultPolicyPincode = alias(
+        resourcePolicyPincode,
+        "defaultPolicyPincode"
+    );
+    const sharedPolicyPassword = alias(
+        resourcePolicyPassword,
+        "sharedPolicyPassword"
+    );
+    const defaultPolicyPassword = alias(
+        resourcePolicyPassword,
+        "defaultPolicyPassword"
+    );
+    const sharedPolicyHeaderAuth = alias(
+        resourcePolicyHeaderAuth,
+        "sharedPolicyHeaderAuth"
+    );
+    const defaultPolicyHeaderAuth = alias(
+        resourcePolicyHeaderAuth,
+        "defaultPolicyHeaderAuth"
+    );
+
     const potentialResults = await db
         .select()
         .from(resources)
@@ -79,6 +123,59 @@ export async function getResourceByDomain(
                 resources.resourceId
             )
         )
+        .leftJoin(
+            sharedPolicy,
+            eq(sharedPolicy.resourcePolicyId, resources.resourcePolicyId)
+        )
+        .leftJoin(
+            sharedPolicyPincode,
+            eq(
+                sharedPolicyPincode.resourcePolicyId,
+                sharedPolicy.resourcePolicyId
+            )
+        )
+        .leftJoin(
+            sharedPolicyPassword,
+            eq(
+                sharedPolicyPassword.resourcePolicyId,
+                sharedPolicy.resourcePolicyId
+            )
+        )
+        .leftJoin(
+            sharedPolicyHeaderAuth,
+            eq(
+                sharedPolicyHeaderAuth.resourcePolicyId,
+                sharedPolicy.resourcePolicyId
+            )
+        )
+        .leftJoin(
+            defaultPolicy,
+            eq(
+                defaultPolicy.resourcePolicyId,
+                resources.defaultResourcePolicyId
+            )
+        )
+        .leftJoin(
+            defaultPolicyPincode,
+            eq(
+                defaultPolicyPincode.resourcePolicyId,
+                defaultPolicy.resourcePolicyId
+            )
+        )
+        .leftJoin(
+            defaultPolicyPassword,
+            eq(
+                defaultPolicyPassword.resourcePolicyId,
+                defaultPolicy.resourcePolicyId
+            )
+        )
+        .leftJoin(
+            defaultPolicyHeaderAuth,
+            eq(
+                defaultPolicyHeaderAuth.resourcePolicyId,
+                defaultPolicy.resourcePolicyId
+            )
+        )
         .innerJoin(orgs, eq(orgs.orgId, resources.orgId))
         .where(
             or(
@@ -108,13 +205,51 @@ export async function getResourceByDomain(
         return null;
     }
 
+    // If a shared (custom) policy is assigned to the resource, use ONLY
+    // its values — do not fall back to the default policy. The default
+    // policy is only consulted when no shared policy is assigned at all.
+    const hasSharedPolicy = result.sharedPolicy !== null;
+
+    const effectivePolicyPincode = hasSharedPolicy
+        ? result.sharedPolicyPincode
+        : (result.defaultPolicyPincode ?? null);
+    const effectivePolicyPassword = hasSharedPolicy
+        ? result.sharedPolicyPassword
+        : (result.defaultPolicyPassword ?? null);
+    const effectivePolicyHeaderAuth = hasSharedPolicy
+        ? result.sharedPolicyHeaderAuth
+        : (result.defaultPolicyHeaderAuth ?? null);
+    const selectedPolicy = hasSharedPolicy
+        ? result.sharedPolicy
+        : result.defaultPolicy;
+    const effectiveApplyRules =
+        selectedPolicy?.applyRules ?? result.resources.applyRules;
+    const effectiveSSO = selectedPolicy?.sso ?? result.resources.sso;
+    const effectiveEmailWhitelistEnabled =
+        selectedPolicy?.emailWhitelistEnabled ??
+        result.resources.emailWhitelistEnabled;
+
     return {
-        resource: result.resources,
-        pincode: result.resourcePincode,
-        password: result.resourcePassword,
-        headerAuth: result.resourceHeaderAuth,
-        headerAuthExtendedCompatibility:
-            result.resourceHeaderAuthExtendedCompatibility,
+        resource: {
+            ...result.resources,
+            applyRules: effectiveApplyRules,
+            sso: effectiveSSO,
+            emailWhitelistEnabled: effectiveEmailWhitelistEnabled
+        }, // doing this for backward compatability so the remote nodes get the value as part of the resource struct
+        pincode: effectivePolicyPincode ?? result.resourcePincode,
+        password: effectivePolicyPassword ?? result.resourcePassword,
+        headerAuth: effectivePolicyHeaderAuth ?? result.resourceHeaderAuth,
+        headerAuthExtendedCompatibility: effectivePolicyHeaderAuth
+            ? ({
+                  headerAuthExtendedCompatibilityId: 0,
+                  resourceId: result.resources.resourceId,
+                  extendedCompatibilityIsActivated:
+                      effectivePolicyHeaderAuth.extendedCompatibility
+              } as ResourceHeaderAuthExtendedCompatibility)
+            : result.resourceHeaderAuthExtendedCompatibility,
+        applyRules: effectiveApplyRules,
+        sso: effectiveSSO,
+        emailWhitelistEnabled: effectiveEmailWhitelistEnabled,
         org: result.orgs
     };
 }
@@ -154,58 +289,195 @@ export async function getRoleName(roleId: number): Promise<string | null> {
 }
 
 /**
- * Check if role has access to resource
+ * Check if role has access to resource (direct or via resource policy)
  */
 export async function getRoleResourceAccess(
     resourceId: number,
     roleIds: number[]
 ) {
-    const roleResourceAccess = await db
-        .select()
-        .from(roleResources)
-        .where(
-            and(
-                eq(roleResources.resourceId, resourceId),
-                inArray(roleResources.roleId, roleIds)
+    const [direct, viaPolicies] = await Promise.all([
+        db
+            .select()
+            .from(roleResources)
+            .where(
+                and(
+                    eq(roleResources.resourceId, resourceId),
+                    inArray(roleResources.roleId, roleIds)
+                )
+            ),
+        db
+            .select({
+                roleId: rolePolicies.roleId,
+                resourcePolicyId: rolePolicies.resourcePolicyId
+            })
+            .from(rolePolicies)
+            .innerJoin(
+                resources,
+                // Shared policy wins; only use default policy when no shared
+                // policy is assigned to the resource.
+                or(
+                    eq(
+                        resources.resourcePolicyId,
+                        rolePolicies.resourcePolicyId
+                    ),
+                    and(
+                        isNull(resources.resourcePolicyId),
+                        eq(
+                            resources.defaultResourcePolicyId,
+                            rolePolicies.resourcePolicyId
+                        )
+                    )
+                )
             )
-        );
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    inArray(rolePolicies.roleId, roleIds)
+                )
+            )
+    ]);
 
-    return roleResourceAccess.length > 0 ? roleResourceAccess : null;
+    const combined = [...direct, ...viaPolicies];
+    return combined.length > 0 ? combined : null;
 }
 
 /**
- * Check if user has direct access to resource
+ * Check if user has access to resource (direct or via resource policy)
  */
 export async function getUserResourceAccess(
     userId: string,
     resourceId: number
 ) {
-    const userResourceAccess = await db
-        .select()
-        .from(userResources)
-        .where(
-            and(
-                eq(userResources.userId, userId),
-                eq(userResources.resourceId, resourceId)
+    const [direct, viaPolicies] = await Promise.all([
+        db
+            .select()
+            .from(userResources)
+            .where(
+                and(
+                    eq(userResources.userId, userId),
+                    eq(userResources.resourceId, resourceId)
+                )
             )
-        )
-        .limit(1);
+            .limit(1),
+        db
+            .select({
+                userId: userPolicies.userId,
+                resourcePolicyId: userPolicies.resourcePolicyId
+            })
+            .from(userPolicies)
+            .innerJoin(
+                resources,
+                // Shared policy wins; only use default policy when no shared
+                // policy is assigned to the resource.
+                or(
+                    eq(
+                        resources.resourcePolicyId,
+                        userPolicies.resourcePolicyId
+                    ),
+                    and(
+                        isNull(resources.resourcePolicyId),
+                        eq(
+                            resources.defaultResourcePolicyId,
+                            userPolicies.resourcePolicyId
+                        )
+                    )
+                )
+            )
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(userPolicies.userId, userId)
+                )
+            )
+            .limit(1)
+    ]);
 
-    return userResourceAccess.length > 0 ? userResourceAccess[0] : null;
+    return direct[0] ?? viaPolicies[0] ?? null;
 }
 
 /**
- * Get resource rules for a given resource
+ * Get resource rules for a given resource (direct and via resource policy)
  */
 export async function getResourceRules(
     resourceId: number
 ): Promise<ResourceRule[]> {
-    const rules = await db
-        .select()
-        .from(resourceRules)
-        .where(eq(resourceRules.resourceId, resourceId));
+    const [directRules, policyRules] = await Promise.all([
+        db
+            .select()
+            .from(resourceRules)
+            .where(eq(resourceRules.resourceId, resourceId)),
+        db
+            .select({
+                ruleId: resourcePolicyRules.ruleId,
+                resourceId: sql<number>`${resourceId}`,
+                enabled: resourcePolicyRules.enabled,
+                priority: resourcePolicyRules.priority,
+                action: resourcePolicyRules.action,
+                match: resourcePolicyRules.match,
+                value: resourcePolicyRules.value
+            })
+            .from(resourcePolicyRules)
+            .innerJoin(
+                resources,
+                // Shared policy wins; only use default policy when no shared
+                // policy is assigned to the resource.
+                or(
+                    eq(
+                        resources.resourcePolicyId,
+                        resourcePolicyRules.resourcePolicyId
+                    ),
+                    and(
+                        isNull(resources.resourcePolicyId),
+                        eq(
+                            resources.defaultResourcePolicyId,
+                            resourcePolicyRules.resourcePolicyId
+                        )
+                    )
+                )
+            )
+            .where(eq(resources.resourceId, resourceId))
+    ]);
 
-    return rules;
+    const maxDirectPriority = directRules.reduce(
+        (max, r) => Math.max(max, r.priority),
+        0
+    );
+    const offsetPolicyRules = policyRules.map((r) => ({
+        ...r,
+        priority: maxDirectPriority + r.priority
+    }));
+
+    return [...directRules, ...offsetPolicyRules] as ResourceRule[];
+}
+
+/**
+ * Get the whitelisted email associated with a resource session's whitelist
+ * match (either a direct resource whitelist entry or a resource policy
+ * whitelist entry).
+ */
+export async function getWhitelistEmail(
+    whitelistId?: number | null,
+    policyWhitelistId?: number | null
+): Promise<string | null> {
+    if (whitelistId) {
+        const [row] = await db
+            .select({ email: resourceWhitelist.email })
+            .from(resourceWhitelist)
+            .where(eq(resourceWhitelist.whitelistId, whitelistId))
+            .limit(1);
+        return row?.email ?? null;
+    }
+
+    if (policyWhitelistId) {
+        const [row] = await db
+            .select({ email: resourcePolicyWhiteList.email })
+            .from(resourcePolicyWhiteList)
+            .where(eq(resourcePolicyWhiteList.whitelistId, policyWhitelistId))
+            .limit(1);
+        return row?.email ?? null;
+    }
+
+    return null;
 }
 
 /**

server/db/sqlite/driver.ts

@@ -5,6 +5,7 @@ import path from "path";
 import fs from "fs";
 import { APP_PATH } from "@server/lib/consts";
 import { existsSync, mkdirSync } from "fs";
+import logger from "@server/logger";
 
 export const location = path.join(APP_PATH, "db", "db.sqlite");
 export const exists = checkFileExists(location);
@@ -12,7 +13,35 @@ export const exists = checkFileExists(location);
 bootstrapVolume();
 
 function createDb() {
-    const sqlite = new Database(location);
+    const verbose =
+        process.env.QUERY_LOGGING == "true"
+            ? (message: unknown) => logger.debug(String(message))
+            : undefined;
+    const sqlite = new Database(location, { verbose });
+
+    if (process.env.ENABLE_SQLITE_WAL_MODE == "true") {
+        // Enable WAL mode — allows concurrent readers + single writer, preventing
+        // contention across subsystems (verifySession, Traefik, audit, ping).
+        // NOTE: journal_mode persists in the DB file once set; unsetting this
+        // env var does NOT revert an existing WAL database.
+        sqlite.pragma("journal_mode = WAL");
+        // NORMAL sync mode: safe with WAL, reduces write lock hold time.
+        sqlite.pragma("synchronous = NORMAL");
+    }
+
+    // No busy_timeout pragma: better-sqlite3 already arms
+    // sqlite3_busy_timeout(db, 5000) via its default `timeout` option
+    // (lib/database.js), so an explicit pragma is redundant.
+
+    // Intentionally NOT setting cache_size or mmap_size: a large page cache plus
+    // a multi-hundred-MB mmap region inflate RSS and cause page-cache thrashing
+    // on small (~1 GB) instances. Leave SQLite on its conservative defaults.
+
+    // Intentionally NOT wrapping prepare()/statements: better-sqlite3 finalizes
+    // sqlite3_stmt in the Statement destructor at GC, and drizzle-orm prepares a
+    // fresh statement per query (no statement cache), so statements cannot
+    // accumulate. better-sqlite3 11.x exposes no Statement.finalize() at all.
+
     return DrizzleSqlite(sqlite, {
         schema
     });
@@ -23,7 +52,7 @@ export default db;
 export const primaryDb = db;
 export type Transaction = Parameters<
     Parameters<(typeof db)["transaction"]>[0]
-    >[0];
+>[0];
 export const DB_TYPE: "pg" | "sqlite" = "sqlite";
 
 function checkFileExists(filePath: string): boolean {

server/db/sqlite/index.ts

@@ -4,3 +4,4 @@ export * from "./safeRead";
 export * from "./schema/schema";
 export * from "./schema/privateSchema";
 export * from "./migrate";
+export { alias } from "drizzle-orm/sqlite-core";

server/db/sqlite/schema/privateSchema.ts

@@ -12,6 +12,7 @@ import {
     clients,
     domains,
     exitNodes,
+    labels,
     orgs,
     resources,
     roles,
@@ -21,28 +22,6 @@ import {
     targetHealthCheck,
     users
 } from "./schema";
-import { serial, varchar } from "drizzle-orm/mysql-core";
-import { pgTable } from "drizzle-orm/pg-core";
-import { bigint } from "zod";
-
-export const certificates = sqliteTable("certificates", {
-    certId: integer("certId").primaryKey({ autoIncrement: true }),
-    domain: text("domain").notNull().unique(),
-    domainId: text("domainId").references(() => domains.domainId, {
-        onDelete: "cascade"
-    }),
-    wildcard: integer("wildcard", { mode: "boolean" }).default(false),
-    status: text("status").notNull().default("pending"), // pending, requested, valid, expired, failed
-    expiresAt: integer("expiresAt"),
-    lastRenewalAttempt: integer("lastRenewalAttempt"),
-    createdAt: integer("createdAt").notNull(),
-    updatedAt: integer("updatedAt").notNull(),
-    orderId: text("orderId"),
-    errorMessage: text("errorMessage"),
-    renewalCount: integer("renewalCount").default(0),
-    certFile: text("certFile"),
-    keyFile: text("keyFile")
-});
 
 export const dnsChallenge = sqliteTable("dnsChallenges", {
     dnsChallengeId: integer("dnsChallengeId").primaryKey({
@@ -91,7 +70,8 @@ export const subscriptions = sqliteTable("subscriptions", {
     expiresAt: integer("expiresAt"),
     trial: integer("trial", { mode: "boolean" }).default(false),
     billingCycleAnchor: integer("billingCycleAnchor"),
-    type: text("type") // tier1, tier2, tier3, or license
+    type: text("type"), // tier1, tier2, tier3, or license
+    override: integer("override", { mode: "boolean" }).default(false)
 });
 
 export const subscriptionItems = sqliteTable("subscriptionItems", {
@@ -195,6 +175,44 @@ export const remoteExitNodes = sqliteTable("remoteExitNode", {
     })
 });
 
+export const remoteExitNodeResources = sqliteTable("remoteExitNodeResources", {
+    remoteExitNodeResourceId: integer("remoteExitNodeResourceId").primaryKey({
+        autoIncrement: true
+    }),
+    remoteExitNodeId: text("remoteExitNodeId")
+        .notNull()
+        .references(() => remoteExitNodes.remoteExitNodeId, {
+            onDelete: "cascade"
+        }),
+    destination: text("destination").notNull() // a cidr range
+});
+
+export const remoteExitNodePreferenceLabels = sqliteTable(
+    // this controls what sites are enforced to connect to this node
+    "remoteExitNodePreferenceLabels",
+    {
+        remoteExitNodePreferenceLabelId: integer(
+            "remoteExitNodePreferenceLabelId"
+        ).primaryKey({ autoIncrement: true }),
+        remoteExitNodeId: text("remoteExitNodeId")
+            .references(() => remoteExitNodes.remoteExitNodeId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [
+        uniqueIndex("remote_exit_node_preference_label_uniq").on(
+            t.remoteExitNodeId,
+            t.labelId
+        )
+    ]
+);
+
 export const remoteExitNodeSessions = sqliteTable("remoteExitNodeSession", {
     sessionId: text("id").primaryKey(),
     remoteExitNodeId: text("remoteExitNodeId")
@@ -332,6 +350,7 @@ export const connectionAuditLog = sqliteTable(
         clientId: integer("clientId").references(() => clients.clientId, {
             onDelete: "cascade"
         }),
+        clientEndpoint: text("clientEndpoint"),
         userId: text("userId").references(() => users.userId, {
             onDelete: "cascade"
         }),
@@ -440,11 +459,16 @@ export const eventStreamingDestinations = sqliteTable(
         sendAccessLogs: integer("sendAccessLogs", { mode: "boolean" })
             .notNull()
             .default(false),
+        sendAISessionLogs: integer("sendAISessionLogs", { mode: "boolean" })
+            .notNull()
+            .default(false),
         type: text("type").notNull(), // e.g. "http", "kafka", etc.
         config: text("config").notNull(), // JSON string with the configuration for the destination
         enabled: integer("enabled", { mode: "boolean" })
             .notNull()
             .default(true),
+        lastError: text("lastError"), // last send error message, null if healthy
+        lastErrorAt: integer("lastErrorAt"), // epoch ms of last error, null if healthy
         createdAt: integer("createdAt").notNull(),
         updatedAt: integer("updatedAt").notNull()
     }
@@ -588,7 +612,6 @@ export const trialNotifications = sqliteTable("trialNotifications", {
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
-export type Certificate = InferSelectModel<typeof certificates>;
 export type DnsChallenge = InferSelectModel<typeof dnsChallenge>;
 export type Customer = InferSelectModel<typeof customers>;
 export type Subscription = InferSelectModel<typeof subscriptions>;

server/emails/templates/AlertNotification.tsx

@@ -31,9 +31,24 @@ export type AlertNotificationProps = {
     orgId: string;
     data: Record<string, unknown>;
     dashboardLink: string;
+    isTestAlert?: boolean;
 };
 
-function getEventMeta(eventType: AlertEventType): {
+function getEventMeta(
+    eventType: AlertEventType,
+    isTestAlert: boolean = false
+): {
+    heading: string;
+    previewText: string;
+    summary: string;
+    statusLabel: string | null;
+    statusColor: string | null;
+} {
+    const meta = getBaseEventMeta(eventType);
+    return isTestAlert ? { ...meta, heading: `[TEST] ${meta.heading}` } : meta;
+}
+
+function getBaseEventMeta(eventType: AlertEventType): {
     heading: string;
     previewText: string;
     summary: string;
@@ -180,8 +195,14 @@ function formatDataItems(
 }
 
 export const AlertNotification = (props: AlertNotificationProps) => {
-    const { eventType, orgId, data, dashboardLink } = props;
-    const meta = getEventMeta(eventType);
+    const {
+        eventType,
+        orgId,
+        data,
+        dashboardLink,
+        isTestAlert = false
+    } = props;
+    const meta = getEventMeta(eventType, isTestAlert);
     const dataItems = formatDataItems(data);
 
     const isToggle =
@@ -242,6 +263,12 @@ export const AlertNotification = (props: AlertNotificationProps) => {
                             Open your dashboard to view more details and manage
                             your alert rules.
                         </EmailText>
+                        {isTestAlert && (
+                            <EmailText>
+                                This is a test alert. No action is required,
+                                and no real event has occurred.
+                            </EmailText>
+                        )}
 
                         <EmailSection>
                             <ButtonLink href={dashboardLink}>

server/emails/templates/IdentityApiKeyGenerated.tsx

@@ -0,0 +1,78 @@
+import React from "react";
+import { Body, Head, Html, Preview, Tailwind } from "@react-email/components";
+import { themeColors } from "./lib/theme";
+import {
+    EmailContainer,
+    EmailFooter,
+    EmailGreeting,
+    EmailHeading,
+    EmailInfoSection,
+    EmailLetterHead,
+    EmailSection,
+    EmailSignature,
+    EmailText
+} from "./components/Email";
+
+type IdentityApiKeyGeneratedProps = {
+    orgName: string;
+    accountLabel?: string | null;
+    credential: string;
+    resourceUrls: string[];
+    hasMoreResources: boolean;
+};
+
+export const IdentityApiKeyGenerated = ({
+    orgName,
+    accountLabel,
+    credential,
+    resourceUrls,
+    hasMoreResources
+}: IdentityApiKeyGeneratedProps) => {
+    const previewText = `Your personal identity key for ${orgName}`;
+
+    return (
+        <Html>
+            <Head />
+            <Preview>{previewText}</Preview>
+            <Tailwind config={themeColors}>
+                <Body className="font-sans bg-gray-50">
+                    <EmailContainer>
+                        <EmailLetterHead />
+
+                        <EmailGreeting>Hi there,</EmailGreeting>
+
+                        <EmailText>
+                            This is your personal identity key for{" "}
+                            <strong>{orgName}</strong>. It belongs to your
+                            account and identifies you when you use public AI
+                            gateways.
+                        </EmailText>
+
+                        <EmailText>
+                            Use it with resources your administrator has granted
+                            you, or that your role has access to. Treat this key
+                            like a password and do not share it.
+                        </EmailText>
+
+                        <EmailSection>
+                            <EmailText>Your identity key:</EmailText>
+                            <div className="inline-block max-w-full">
+                                <div className="bg-gray-50 border border-gray-200 rounded-lg px-4 py-3 mx-auto text-left">
+                                    <span className="text-sm font-mono text-gray-900 break-all">
+                                        {credential}
+                                    </span>
+                                </div>
+                            </div>
+                        </EmailSection>
+
+                        <EmailFooter>
+                            <EmailSignature />
+                        </EmailFooter>
+                    </EmailContainer>
+                </Body>
+            </Tailwind>
+        </Html>
+    );
+};
+
+export default IdentityApiKeyGenerated;

server/emails/templates/NotifyTrialExpiring.tsx

@@ -30,14 +30,14 @@ export const NotifyTrialExpiring = ({
     const isLastDay = daysRemaining === 1;
 
     const previewText = hasEnded
-        ? `Your trial for ${orgName} has ended.`
+        ? `Your cloud trial for ${orgName} has ended.`
         : isLastDay
-          ? `Your trial for ${orgName} ends tomorrow.`
-          : `Your trial for ${orgName} ends in ${daysRemaining} days.`;
+          ? `Your cloud trial for ${orgName} ends tomorrow.`
+          : `Your cloud trial for ${orgName} ends in ${daysRemaining} days.`;
 
     const heading = hasEnded
-        ? "Your Trial Ended"
-        : "Your Trial is Ending Soon";
+        ? "Your Cloud Trial Ended"
+        : "Your Cloud Trial is Ending Soon";
 
     return (
         <Html>
@@ -55,7 +55,7 @@ export const NotifyTrialExpiring = ({
                         {hasEnded ? (
                             <>
                                 <EmailText>
-                                    Your free trial for{" "}
+                                    Your cloud free trial for{" "}
                                     <strong>{orgName}</strong> ended on{" "}
                                     <strong>{trialEndsAt}</strong>. Your account
                                     has been moved to the free plan, which
@@ -64,10 +64,11 @@ export const NotifyTrialExpiring = ({
 
                                 <EmailText>
                                     Some features and resources may now be
-                                    restricted. To restore full
-                                    access and continue using all the features
-                                    you had during your trial, please upgrade to
-                                    a paid plan.
+                                    restricted. To restore full access and
+                                    continue using all the features you had
+                                    during your trial, please upgrade to a paid
+                                    plan. This does not effect any self hosted
+                                    licenses.
                                 </EmailText>
 
                                 <EmailText>
@@ -93,7 +94,8 @@ export const NotifyTrialExpiring = ({
                                 <EmailText>
                                     After your trial ends, your account will be
                                     moved to the free plan and some
-                                    functionality may be restricted.
+                                    functionality may be restricted. This does
+                                    not effect any self hosted licenses.
                                 </EmailText>
 
                                 <EmailText>

server/emails/templates/VirtualApiKeyGenerated.tsx

@@ -0,0 +1,119 @@
+import React from "react";
+import { Body, Head, Html, Preview, Tailwind } from "@react-email/components";
+import { themeColors } from "./lib/theme";
+import {
+    EmailContainer,
+    EmailFooter,
+    EmailGreeting,
+    EmailInfoSection,
+    EmailLetterHead,
+    EmailSection,
+    EmailSignature,
+    EmailText
+} from "./components/Email";
+
+type VirtualApiKeyGeneratedProps = {
+    orgName: string;
+    keyName: string | null;
+    credential: string;
+    resourceUrls: string[];
+    hasMoreResources: boolean;
+};
+
+export const VirtualApiKeyGenerated = ({
+    orgName,
+    keyName,
+    credential,
+    resourceUrls,
+    hasMoreResources
+}: VirtualApiKeyGeneratedProps) => {
+    const previewText = `A virtual API key for ${orgName} has been shared with you`;
+
+    return (
+        <Html>
+            <Head />
+            <Preview>{previewText}</Preview>
+            <Tailwind config={themeColors}>
+                <Body className="font-sans bg-gray-50">
+                    <EmailContainer>
+                        <EmailLetterHead />
+
+                        <EmailGreeting>Hi there,</EmailGreeting>
+
+                        <EmailText>
+                            A virtual API key for <strong>{orgName}</strong> has
+                            been shared with you. This key grants access to the
+                            public AI gateways it was created for. Treat this
+                            key like a password and do not share it.
+                        </EmailText>
+
+                        <EmailSection>
+                            <EmailText>Your virtual API key:</EmailText>
+                            <div className="inline-block max-w-full">
+                                <div className="bg-gray-50 border border-gray-200 rounded-lg px-4 py-3 mx-auto text-left">
+                                    <span className="text-sm font-mono text-gray-900 break-all">
+                                        {credential}
+                                    </span>
+                                </div>
+                            </div>
+                        </EmailSection>
+
+                        <EmailInfoSection
+                            title="Key details"
+                            items={[
+                                {
+                                    label: "Organization",
+                                    value: orgName
+                                },
+                                ...(keyName
+                                    ? [
+                                          {
+                                              label: "Name",
+                                              value: keyName
+                                          }
+                                      ]
+                                    : [])
+                            ]}
+                        />
+
+                        {resourceUrls.length > 0 && (
+                            <>
+                                <EmailText>
+                                    This key can be used to authenticate to the
+                                    following AI gateway resources:
+                                </EmailText>
+                                <div className="px-6 pb-2">
+                                    {resourceUrls.map((url) => (
+                                        <p
+                                            key={url}
+                                            className="text-base text-gray-700 leading-relaxed"
+                                        >
+                                            <a
+                                                href={url}
+                                                className="text-primary font-medium break-all"
+                                            >
+                                                {url}
+                                            </a>
+                                        </p>
+                                    ))}
+                                </div>
+                                {hasMoreResources && (
+                                    <EmailText>
+                                        Contact your administrator to get the
+                                        full list.
+                                    </EmailText>
+                                )}
+                            </>
+                        )}
+
+                        <EmailFooter>
+                            <EmailSignature />
+                        </EmailFooter>
+                    </EmailContainer>
+                </Body>
+            </Tailwind>
+        </Html>
+    );
+};
+
+export default VirtualApiKeyGenerated;