Bump brace-expansion

Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 5.0.6 to 5.0.9 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.9) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.9) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2026-08-10 22:48:14 +02:00 · 2026-08-04 05:33:39 +00:00
33 changed files with 45 additions and 342 deletions
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Задайте ПИН код на ресурса",
    "actionSetResourceEmailWhitelist": "Задайте списък на одобрените имейл адреси за ресурса",
    "actionGetResourceEmailWhitelist": "Вземете списък на одобрените имейл адреси за ресурса",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Получете политика за ресурси",
    "actionUpdateResourcePolicy": "Актуализирайте политика за ресурси",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Задайте потребители на ресурсна политика",
    "actionSetResourcePolicyRoles": "Задайте роли на ресурсна политика",
    "actionSetResourcePolicyPassword": "Задайте парола на ресурсна политика",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Nastavit zdrojový kód",
    "actionSetResourceEmailWhitelist": "Nastavit seznam povolených dokumentů",
    "actionGetResourceEmailWhitelist": "Získat seznam povolených dokumentů",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Získat zásady zdroje",
    "actionUpdateResourcePolicy": "Aktualizovat zásady zdroje",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Nastavte uživatele pro zásady zdroje",
    "actionSetResourcePolicyRoles": "Nastavte role pro zásady zdroje",
    "actionSetResourcePolicyPassword": "Nastavte heslo pro zásady zdroje",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Angiv ressource-PIN-kode",
    "actionSetResourceEmailWhitelist": "Angiv e-mailwhitelist for ressource",
    "actionGetResourceEmailWhitelist": "Hent e-mailwhitelist for ressource",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Få ressourceretningslinjen",
    "actionUpdateResourcePolicy": "Opdater ressourceretningslinjen",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Angiv ressourceretningslinjens brugere",
    "actionSetResourcePolicyRoles": "Angiv ressourceretningslinjens roller",
    "actionSetResourcePolicyPassword": "Angiv ressourceretningslinjen for adgangskode",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Ressourcen-PIN festlegen",
    "actionSetResourceEmailWhitelist": "Ressourcen-E-Mail-Whitelist festlegen",
    "actionGetResourceEmailWhitelist": "Ressourcen-E-Mail-Whitelist abrufen",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Ressourcenrichtlinie abrufen",
    "actionUpdateResourcePolicy": "Ressourcenrichtlinie aktualisieren",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Ressourcenrichtlinienbenutzer festlegen",
    "actionSetResourcePolicyRoles": "Rollen der Ressourcenrichtlinie festlegen",
    "actionSetResourcePolicyPassword": "Passwort der Ressourcenrichtlinie festlegen",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Set Resource Pincode",
    "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist",
    "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Get Resource Policy",
    "actionUpdateResourcePolicy": "Update Resource Policy",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Set Resource Policy Users",
    "actionSetResourcePolicyRoles": "Set Resource Policy Roles",
    "actionSetResourcePolicyPassword": "Set Resource Policy Password",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Establecer Pincode del recurso",
    "actionSetResourceEmailWhitelist": "Establecer lista blanca de correo de recursos",
    "actionGetResourceEmailWhitelist": "Obtener correo electrónico de recursos",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Obtener política de recursos",
    "actionUpdateResourcePolicy": "Actualizar política de recursos",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Definir política de recursos para usuarios",
    "actionSetResourcePolicyRoles": "Definir roles de política de recursos",
    "actionSetResourcePolicyPassword": "Definir contraseña de política de recursos",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Définir le code PIN de la ressource",
    "actionSetResourceEmailWhitelist": "Définir la liste blanche des emails de la ressource",
    "actionGetResourceEmailWhitelist": "Obtenir la liste blanche des emails de la ressource",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Obtenir une politique de ressources",
    "actionUpdateResourcePolicy": "Mettre à jour la politique de ressources",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Définir les utilisateurs de la politique de ressources",
    "actionSetResourcePolicyRoles": "Définir les rôles de la politique de ressources",
    "actionSetResourcePolicyPassword": "Définir le mot de passe de la politique de ressources",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Imposta Codice PIN Risorsa",
    "actionSetResourceEmailWhitelist": "Imposta Lista Autorizzazioni Email Risorsa",
    "actionGetResourceEmailWhitelist": "Ottieni Lista Autorizzazioni Email Risorsa",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Ottieni la Politica della Risorsa",
    "actionUpdateResourcePolicy": "Aggiorna la Politica della Risorsa",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Imposta Utenti della Politica Risorsa",
    "actionSetResourcePolicyRoles": "Imposta Ruoli della Politica Risorsa",
    "actionSetResourcePolicyPassword": "Imposta Password della Politica Risorsa",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "리소스 핀코드 설정",
    "actionSetResourceEmailWhitelist": "리소스 이메일 화이트리스트 설정",
    "actionGetResourceEmailWhitelist": "리소스 이메일 화이트리스트 가져오기",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "리소스 정책 가져오기",
    "actionUpdateResourcePolicy": "리소스 정책 업데이트",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "리소스 정책 사용자 설정",
    "actionSetResourcePolicyRoles": "리소스 정책 역할 설정",
    "actionSetResourcePolicyPassword": "리소스 정책 비밀번호 설정",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Angi ressurspinkode",
    "actionSetResourceEmailWhitelist": "Angi e-post-hviteliste for ressurs",
    "actionGetResourceEmailWhitelist": "Hent e-post-hviteliste for ressurs",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Hent ressursregel",
    "actionUpdateResourcePolicy": "Oppdater ressursregel",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Sett ressursregel for brukere",
    "actionSetResourcePolicyRoles": "Sett ressursregel for roller",
    "actionSetResourcePolicyPassword": "Sett ressursregel for passord",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Stel Resource Pincode in",
    "actionSetResourceEmailWhitelist": "Stel Resource e-mail whitelist in",
    "actionGetResourceEmailWhitelist": "Verkrijg Resource E-mail Whitelist",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Haal Bronbeleid op",
    "actionUpdateResourcePolicy": "Werk Bronbeleid bij",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Stel gebruikers van bronbeleid in",
    "actionSetResourcePolicyRoles": "Stel rollen van bronbeleid in",
    "actionSetResourcePolicyPassword": "Stel wachtwoord van bronbeleid in",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Ustaw kod PIN zasobu",
    "actionSetResourceEmailWhitelist": "Ustaw białą listę email zasobu",
    "actionGetResourceEmailWhitelist": "Pobierz białą listę email zasobu",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Pobierz politykę zasobów",
    "actionUpdateResourcePolicy": "Zaktualizuj politykę zasobów",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Ustaw użytkowników polityki zasobów",
    "actionSetResourcePolicyRoles": "Ustaw role polityki zasobów",
    "actionSetResourcePolicyPassword": "Ustaw hasło polityki zasobów",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Definir Código PIN do Recurso",
    "actionSetResourceEmailWhitelist": "Definir Lista Permitida de Emails do Recurso",
    "actionGetResourceEmailWhitelist": "Obter Lista Permitida de Emails do Recurso",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Obter Política de Recurso",
    "actionUpdateResourcePolicy": "Atualizar Política de Recurso",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Definir Utilizadores da Política de Recurso",
    "actionSetResourcePolicyRoles": "Definir Papéis da Política de Recurso",
    "actionSetResourcePolicyPassword": "Definir Palavra-passe da Política de Recurso",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Установить ПИН-код ресурса",
    "actionSetResourceEmailWhitelist": "Настроить белый список ресурсов email",
    "actionGetResourceEmailWhitelist": "Получить белый список ресурсов email",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Получить политику ресурса",
    "actionUpdateResourcePolicy": "Обновить политику ресурса",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Установить пользователей политики ресурса",
    "actionSetResourcePolicyRoles": "Установить роли политики ресурса",
    "actionSetResourcePolicyPassword": "Установить пароль политики ресурса",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "Kaynak PIN Kodunu Ayarla",
    "actionSetResourceEmailWhitelist": "Kaynak E-posta Beyaz Listesi Ayarla",
    "actionGetResourceEmailWhitelist": "Kaynak E-posta Beyaz Listesini Al",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "Kaynak Politikasını Al",
    "actionUpdateResourcePolicy": "Kaynak Politikasını Güncelle",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "Kaynak Politika Kullanıcılarını Ayarla",
    "actionSetResourcePolicyRoles": "Kaynak Politika Rolleri Ayarla",
    "actionSetResourcePolicyPassword": "Kaynak Politika Şifresini Ayarla",
@@ -1449,11 +1449,8 @@
    "actionSetResourcePincode": "设置资源粉码",
    "actionSetResourceEmailWhitelist": "设置资源电子邮件白名单",
    "actionGetResourceEmailWhitelist": "获取资源电子邮件白名单",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
    "actionGetResourcePolicy": "获取资源策略",
    "actionUpdateResourcePolicy": "更新资源策略",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
    "actionSetResourcePolicyUsers": "设置资源策略用户",
    "actionSetResourcePolicyRoles": "设置资源策略角色",
    "actionSetResourcePolicyPassword": "设置资源策略密码",
@@ -9504,15 +9504,15 @@
            "license": "MIT"
        },
        "node_modules/brace-expansion": {
-            "version": "5.0.6",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-            "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+            "version": "5.0.9",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+            "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
            "license": "MIT",
            "dependencies": {
                "balanced-match": "^4.0.2"
            },
            "engines": {
-                "node": "18 || 20 || >=22"
+                "node": "20 || >=22"
            }
        },
        "node_modules/braces": {
@@ -11645,9 +11645,9 @@
            "license": "MIT"
        },
        "node_modules/eslint-config-next/node_modules/brace-expansion": {
-            "version": "1.1.14",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-            "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+            "version": "1.1.18",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+            "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -266,13 +266,13 @@ export const configSchema = z
                            .positive()
                            .gt(0)
                            .optional()
-                            .default(30),
+                            .default(10),
                        burst: z
                            .number()
                            .positive()
                            .gt(0)
                            .optional()
-                            .default(50)
+                            .default(16)
                    })
                    .optional()
                    .prefault({})
@@ -10,12 +10,12 @@
 *
 * This file is not licensed under the AGPLv3.
 */
-import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
+import { certificates, db, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,28 +63,14 @@ async function query(orgId: string, domainList: string[]) {
        })
        .from(certificates)
        .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .leftJoin(
+        .innerJoin(
            orgDomains,
            and(
                eq(domains.domainId, orgDomains.domainId),
                eq(orgDomains.orgId, orgId)
            )
        )
-        .leftJoin(
-            domainNamespaces,
-            eq(domains.domainId, domainNamespaces.domainId)
-        )
-        .where(
-            and(
-                inArray(certificates.domain, domainList),
-                // Namespace domains are shared across all orgs, so they skip
-                // the org-ownership check (mirrors verifyCertificateAccess).
-                or(
-                    isNotNull(orgDomains.orgId),
-                    isNotNull(domainNamespaces.domainNamespaceId)
-                )
-            )
-        );
+        .where(and(inArray(certificates.domain, domainList)));

    // All non resolved domain certificates might be `ns` or `wildcard`,
    // which means exact domain certificates do not exist
@@ -124,27 +110,19 @@ async function query(orgId: string, domainList: string[]) {
            })
            .from(certificates)
            .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .leftJoin(
+            .innerJoin(
                orgDomains,
                and(
                    eq(domains.domainId, orgDomains.domainId),
                    eq(orgDomains.orgId, orgId)
                )
            )
-            .leftJoin(
-                domainNamespaces,
-                eq(domains.domainId, domainNamespaces.domainId)
-            )
            .where(
                and(
                    eq(certificates.wildcard, true),
                    or(
                        inArray(certificates.domain, [...domainLevelDownSet]),
                        inArray(certificates.domain, [...wildcardDomainSet])
-                    ),
-                    or(
-                        isNotNull(orgDomains.orgId),
-                        isNotNull(domainNamespaces.domainNamespaceId)
                    )
                )
            );
@@ -127,9 +127,6 @@ export async function verifyResourceSession(
        // Extract HTTP Basic Auth credentials if present
        const clientHeaderAuth = extractBasicAuth(headers);

-        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
-        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
-
        const clientIp = requestIp
            ? stripPortFromHost(requestIp, badgerVersion)
            : undefined;
@@ -316,14 +313,9 @@ export async function verifyResourceSession(
            return allowed(res, undefined, dontStripSession);
        }

-        // Only offer a browser redirect to clients that can actually follow one and log in
-        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
-        // an unauthorized response from Badger instead of a login redirect URL.
-        const redirectPath = clientIsBrowser
-            ? `/auth/resource/${encodeURIComponent(
-                  resource.resourceGuid
-              )}?redirect=${encodeURIComponent(originalRequestURL)}`
-            : undefined;
+        const redirectPath = `/auth/resource/${encodeURIComponent(
+            resource.resourceGuid
+        )}?redirect=${encodeURIComponent(originalRequestURL)}`;

        // check for access token in headers
        if (
@@ -1484,46 +1476,6 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
    return cachedCountryCode;
 }

-// Permissive by default: only reject known non-browser clients or a missing
-// User-Agent (real browsers always send one). This avoids blocking real
-// browsers whose UA string doesn't match a hardcoded allow-list.
-const NON_BROWSER_USER_AGENT_PATTERNS = [
-    /curl/,
-    /wget/,
-    /python-requests/,
-    /python-urllib/,
-    /go-http-client/,
-    /okhttp/,
-    /axios/,
-    /node-fetch/,
-    /postmanruntime/,
-    /insomnia/,
-    /libwww-perl/,
-    /java\//,
-    /ruby/,
-    /php/,
-    /bot/,
-    /spider/,
-    /crawler/,
-    /headlesschrome/,
-    /phantomjs/,
-    /httpclient/,
-    /prometheus/,
-    /go-resty/,
-    /apache-httpclient/,
-    /scrapy/
-];
-
-function isBrowserUserAgent(userAgent: string | undefined): boolean {
-    if (!userAgent) {
-        return false;
-    }
-
-    const ua = userAgent.toLowerCase();
-
-    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
-}
-
 function extractBasicAuth(
    headers: Record<string, string> | undefined
 ): string | undefined {
@@ -726,8 +726,8 @@ authenticated.post(
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
    logActionAudit(ActionsEnum.setResourcePolicyUsers),
    logActionAudit(ActionsEnum.setResourcePolicyRoles),
    policy.setResourcePolicyAccessControl
@@ -742,8 +742,8 @@ authenticated.put(
    verifyApiKeyResourcePolicyAccess,
    verifyApiKeyRoleAccess,
    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
    logActionAudit(ActionsEnum.setResourcePolicyUsers),
    logActionAudit(ActionsEnum.setResourcePolicyRoles),
    policy.setResourcePolicyAccessControl
@@ -34,9 +34,7 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
    ActionsEnum.getOrg,
    ActionsEnum.getResource,
-    ActionsEnum.listResources,
-    ActionsEnum.getSiteResource,
-    ActionsEnum.listSiteResources
+    ActionsEnum.listResources
 ];

 export type CreateRoleBody = z.infer<typeof createRoleSchema>;
@@ -3,13 +3,11 @@ import {
    DB_TYPE,
    Label,
    SiteResource,
-    roleSiteResources,
    siteNetworks,
    siteResourceLabels,
    siteResources,
    sites,
-    labels,
-    userSiteResources
+    labels
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -325,48 +323,7 @@ export async function listAllSiteResourcesByOrg(
            labels: labelFilter
        } = parsedQuery.data;

-        let accessibleSiteResourceIds: number[];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
-        const conditions = [
-            and(
-                eq(siteResources.orgId, orgId),
-                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
-            )
-        ];
+        const conditions = [and(eq(siteResources.orgId, orgId))];

        if (siteId != null) {
            // Keep inner joins here: filtering by a specific site implies the
@@ -1,17 +1,11 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
-    db,
-    networks,
-    roleSiteResources,
-    siteNetworks,
-    userSiteResources
-} from "@server/db";
+import { db, networks, siteNetworks } from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -165,47 +159,10 @@ export async function listSiteResources(
            return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
        }

-        let accessibleSiteResourceIds: number[];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
        // Get site resources by joining networks to siteResources via siteNetworks
        const conditions = [
            eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId),
-            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
+            eq(siteResources.orgId, orgId)
        ];

        if (typeof status !== "undefined") {
@@ -28,7 +28,6 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
-import m23 from "./scriptsPg/1.21.1";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -56,8 +55,7 @@ const migrations = [
    { version: "1.18.4", run: m19 },
    { version: "1.19.0", run: m20 },
    { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 },
-    { version: "1.21.1", run: m23 }
+    { version: "1.21.0", run: m22 }
    // Add new migrations here as they are created
 ] as {
    version: string;
@@ -47,7 +47,6 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
-import m45 from "./scriptsSqlite/1.21.1";

 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -92,8 +91,7 @@ const migrations = [
    { version: "1.19.0", run: m41 },
    { version: "1.19.1", run: m42 },
    { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 },
-    { version: "1.21.1", run: m45 }
+    { version: "1.21.0", run: m44 }
    // Add new migrations here as they are created
 ] as const;

@@ -1,37 +0,0 @@
-import { db } from "@server/db/pg/driver";
-import { sql } from "drizzle-orm";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    try {
-        await db.execute(sql`BEGIN`);
-
-        for (const actionId of actionsToGrant) {
-            await db.execute(sql`
-                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ${actionId}, r."orgId"
-                FROM "roles" r
-                WHERE COALESCE(r."isAdmin", false) = false
-                  AND NOT EXISTS (
-                    SELECT 1 FROM "roleActions" ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ${actionId}
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-        }
-
-        await db.execute(sql`COMMIT`);
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        await db.execute(sql`ROLLBACK`);
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    }
-}
@@ -1,43 +0,0 @@
-import { APP_PATH } from "@server/lib/consts";
-import Database from "better-sqlite3";
-import path from "path";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    const location = path.join(APP_PATH, "db", "db.sqlite");
-    const db = new Database(location);
-
-    try {
-        db.transaction(() => {
-            const insertRoleAction = db.prepare(`
-                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ?, r."orgId"
-                FROM 'roles' r
-                WHERE COALESCE(r."isAdmin", 0) = 0
-                  AND NOT EXISTS (
-                    SELECT 1 FROM 'roleActions' ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ?
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-
-            for (const actionId of actionsToGrant) {
-                insertRoleAction.run(actionId, actionId);
-            }
-        })();
-
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    } finally {
-        db.close();
-    }
-}
@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                    <SettingsSectionDescription>
                        {t("remoteExitNodeNetworkingDescription")}
                        <a
-                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
+                            href="https://docs.pangolin.net/placeholder"
                            target="_blank"
                            rel="noopener noreferrer"
                            className="text-primary hover:underline inline-flex items-center gap-1"
@@ -24,21 +24,19 @@ export function ContactSalesBanner() {
                            <ExternalLink className="size-3.5 shrink-0" />
                        </Link>
                        {" " + t("contactSalesOr") + " "}
-                        <span className="whitespace-nowrap">
-                            <Link
-                                href="https://pangolin.net/contact"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                className="inline-flex items-center gap-1 font-medium text-black-600 underline"
-                            >
-                                {t("contactSalesContactUs")}
-                                <ExternalLink className="size-3.5 shrink-0" />
-                            </Link>
-                            .
-                        </span>
+                        <Link
+                            href="https://pangolin.net/contact"
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            className="inline-flex items-center gap-1 font-medium text-black-600 underline"
+                        >
+                            {t("contactSalesContactUs")}
+                            <ExternalLink className="size-3.5 shrink-0" />
+                        </Link>
+                        .
                    </span>
                </div>
            </div>
        </div>
    );
-}
+}
@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
+import { REGEXP_ONLY_DIGITS } from "input-otp";

 const MFA_OTP_INPUT_ID = "mfa-otp-code";

@@ -82,11 +82,9 @@ export default function MfaInputForm({
                                            maxLength={6}
                                            {...field}
                                            autoComplete="one-time-code"
-                                            inputMode="text"
+                                            inputMode="numeric"
                                            autoFocus
-                                            pattern={
-                                                REGEXP_ONLY_DIGITS_AND_CHARS
-                                            }
+                                            pattern={REGEXP_ONLY_DIGITS}
                                            onChange={(value: string) => {
                                                field.onChange(value);
                                                if (value.length === 6) {
@@ -115,11 +115,8 @@ function getActionsCategories(root: boolean) {
        },

        "Resource Policy": {
-            [t("actionListResourcePolicies")]: "listResourcePolicies",
-            [t("actionCreateResourcePolicy")]: "createResourcePolicy",
            [t("actionGetResourcePolicy")]: "getResourcePolicy",
            [t("actionUpdateResourcePolicy")]: "updateResourcePolicy",
-            [t("actionDeleteResourcePolicy")]: "deleteResourcePolicy",
            [t("actionSetResourcePolicyUsers")]: "setResourcePolicyUsers",
            [t("actionSetResourcePolicyRoles")]: "setResourcePolicyRoles",
            [t("actionSetResourcePolicyPassword")]: "setResourcePolicyPassword",
@@ -111,7 +111,7 @@ export function useCertificate({
    let certError: string | null = null;
    if (restartCert.isError) {
        certError = "Failed to restart";
-    } else if (isError || (!isLoading && data === null)) {
+    } else if (isError || initialCertValue === null) {
        // Null value means failed to get the certificate
        certError = "Failed";
    }