✨ delete org

🚧 wip
♻️ Only show the username instead of the name+username
2026-09-02 01:09:03 +02:00 · 2026-09-02 00:25:49 +02:00 · 2026-08-28 22:49:51 +02:00 · 2026-08-28 22:09:01 +02:00 · 2026-08-28 22:00:06 +02:00 · 2026-08-28 21:42:20 +02:00
59 changed files with 2309 additions and 3642 deletions
@@ -77,7 +77,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                  fi

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Log in to Docker Hub
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                  registry: docker.io
                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
              shell: bash

            - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
@@ -14,7 +14,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 14
          days-before-close: 14
@@ -99,19 +99,6 @@ Access private resources like SSH servers, databases, RDP, and entire network ra

 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />

-### Identity-aware AI gateway
-
-Put an identity-aware proxy in front of public cloud (OpenAI, Anthropic, Gemini, etc.) and self-hosted model servers (Ollama, vLLM, Mistral, etc.) so coding agents and AI clients call a single Pangolin URL. Publish it as a public resource with personal API keys, or keep it private on a client tunnel where the connected client is the credential for keyless access. Budgets, session history, and usage analytics sit in front of every call.
-
-* Access self-hosted models (vLLM, Ollama, etc) alongside cloud models (OpenAI, Anthropic, etc) in one place
-* Keyless access by authenticating users with the Pangolin desktop client
-* Or, provide users with personal API keys
-* Control costs and token usage by setting budgets
-* Audit with detailed session history and analytics
-* Integrate AI clients and coding agents (Claude Code, Codex, OpenCode, etc)
-
-<img src="public/screenshots/expanded-session-logs.png" alt="AI Session Logs" width="100%" />
-
 ### Give users and roles access to resources

 Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
@@ -16,7 +16,7 @@ experimental:
      version: "{{.BadgerVersion}}"
    crowdsec: # CrowdSec plugin configuration added
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.7.1"
+      version: "v1.4.4"

 log:
  level: "INFO"
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Научете повече за JMESPath",
    "idpJmespathLabel": "Идентификатор на пътя",
    "idpJmespathLabelDescription": "Пътят към идентификатора на потребителя в ID токена",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Път за имейл (по избор)",
    "idpJmespathEmailPathOptionalDescription": "Пътят до имейла на потребителя в ID токена",
    "idpJmespathNamePathOptional": "Път (по избор) на име",
@@ -1577,8 +1573,6 @@
    "search": "Търси…",
    "searchPlaceholder": "Търсене...",
    "emptySearchOptions": "Няма намерени опции",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Създаване",
    "orgs": "Организации",
    "loginError": "Възникна неочаквана грешка. Моля, опитайте отново.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Тип:",
    "createDomainName": "Име:",
    "createDomainValue": "Стойност:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME записи",
    "createDomainARecords": "A записи",
    "createDomainRecordNumber": "Запис {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавете CIDR диапазон (напр. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Неуспешно зареждане на подмрежи",
    "remoteExitNodeNetworkingLabelsTitle": "Етикети за Предпочитания",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайтове с тези етикети ще бъдат принудени да се свържат чрез този отдалечен край.",
    "remoteExitNodeNetworkingLabelsButtonText": "Изберете етикети...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Търсене на етикети...",
    "remoteExitNodeNetworkingLabelsLoadError": "Неуспешно зареждане на етикети",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Další informace o cestě JMESPath",
    "idpJmespathLabel": "Cesta identifikátoru",
    "idpJmespathLabelDescription": "Cesta k identifikátoru uživatele v tokenu ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Cesta e-mailu (volitelné)",
    "idpJmespathEmailPathOptionalDescription": "Cesta k e-mailu uživatele v ID tokenu",
    "idpJmespathNamePathOptional": "Cesta k názvu (volitelné)",
@@ -1577,8 +1573,6 @@
    "search": "Vyhledávání…",
    "searchPlaceholder": "Hledat...",
    "emptySearchOptions": "Nebyly nalezeny žádné možnosti",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Vytvořit",
    "orgs": "Organizace",
    "loginError": "Došlo k neočekávané chybě. Zkuste to prosím znovu.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Jméno:",
    "createDomainValue": "Hodnota:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Záznamy CNAME",
    "createDomainARecords": "Záznamy",
    "createDomainRecordNumber": "Nahrát {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Přidejte rozsah CIDR (např. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nepodařilo se načíst podsítě",
    "remoteExitNodeNetworkingLabelsTitle": "Názvy preferencí",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Weby s těmito názvy budou nuceny připojit se tímto vzdáleným výstupním uzlem.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vyberte názvy...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Hledat názvy...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nepodařilo se načíst názvy",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Læs mere om JMESPath",
    "idpJmespathLabel": "Identifikatorsti",
    "idpJmespathLabelDescription": "Stien til brugeridentifikatoren i ID-tokenet",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "E-mailsti (Valgfrit)",
    "idpJmespathEmailPathOptionalDescription": "Stien til brugerens e-mailadresse i ID-tokenet",
    "idpJmespathNamePathOptional": "Navn Sti (Valgfrit)",
@@ -1577,8 +1573,6 @@
    "search": "Søg…",
    "searchPlaceholder": "Søg...",
    "emptySearchOptions": "Ingen valg fundet",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Opret",
    "orgs": "Organisationer",
    "loginError": "Der opstod en uventet fejl. Prøv venligst igen.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Værdi:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-poster",
    "createDomainARecords": "A-poster",
    "createDomainRecordNumber": "Post {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Tilføj et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kunne ikke indlæse subnets",
    "remoteExitNodeNetworkingLabelsTitle": "Præference Etiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites med disse etiketter vil blive tvunget til at oprette forbindelse gennem denne fjerne exit-node.",
    "remoteExitNodeNetworkingLabelsButtonText": "Vælg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søg efter etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kunne ikke indlæse etiketter",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Mehr über JMESPath erfahren",
    "idpJmespathLabel": "Identifikationspfad",
    "idpJmespathLabelDescription": "Der JMESPath zum Benutzeridentifikator im ID-Token",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "E-Mail-Pfad (Optional)",
    "idpJmespathEmailPathOptionalDescription": "Der JMESPath zur E-Mail-Adresse des Benutzers im ID-Token",
    "idpJmespathNamePathOptional": "Namenspfad (Optional)",
@@ -1577,8 +1573,6 @@
    "search": "Suche…",
    "searchPlaceholder": "Suche...",
    "emptySearchOptions": "Keine Optionen gefunden",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Erstellen",
    "orgs": "Organisationen",
    "loginError": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Name:",
    "createDomainValue": "Wert:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-Einträge",
    "createDomainARecords": "A-Aufzeichnungen",
    "createDomainRecordNumber": "Eintrag {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Fügen Sie einen CIDR-Bereich hinzu (z.B. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Fehler beim Laden der Subnetze",
    "remoteExitNodeNetworkingLabelsTitle": "Präferenzetiketten",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Standorte mit diesen Etiketten werden gezwungen, über diesen Remote Exit Node zu verbinden.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketten auswählen...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketten suchen...",
    "remoteExitNodeNetworkingLabelsLoadError": "Fehler beim Laden der Etiketten",
@@ -465,6 +465,8 @@
    "apiKeysDelete": "Delete API Key",
    "apiKeysManage": "Manage API Keys",
    "apiKeysDescription": "API keys are used to authenticate with the integration API",
+    "orgsManage": "Manage Organizations",
+    "orgsDescription": "View and manage all organizations on this instance",
    "provisioningKeysTitle": "Provisioning Key",
    "provisioningKeysManage": "Manage Provisioning Keys",
    "provisioningKeysDescription": "Provisioning keys are used to authenticate automated site provisioning for your organization.",
@@ -1573,8 +1575,6 @@
    "search": "Search…",
    "searchPlaceholder": "Search...",
    "emptySearchOptions": "No options found",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Create",
    "orgs": "Organizations",
    "loginError": "An unexpected error occurred. Please try again.",
@@ -2091,6 +2091,7 @@
    "resourceBudgetSettings": "Budget",
    "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
    "sidebarApiKeys": "API Keys",
+    "sidebarOrgs": "Organizations",
    "sidebarProvisioning": "Provisioning",
    "sidebarSettings": "Settings",
    "sidebarAllUsers": "All Users",
@@ -2598,7 +2599,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Name:",
    "createDomainValue": "Value:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Más información sobre JMESPath",
    "idpJmespathLabel": "Ruta del identificador",
    "idpJmespathLabelDescription": "La ruta al identificador de usuario en el token de ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Ruta de correo (opcional)",
    "idpJmespathEmailPathOptionalDescription": "La ruta al correo electrónico del usuario en el token de ID",
    "idpJmespathNamePathOptional": "Ruta del nombre (opcional)",
@@ -1577,8 +1573,6 @@
    "search": "Buscar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "No se encontraron opciones",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Crear",
    "orgs": "Organizaciones",
    "loginError": "Ocurrió un error inesperado. Por favor, inténtelo de nuevo.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nombre:",
    "createDomainValue": "Valor:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registro {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Añadir un rango CIDR (e.g. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Error al cargar las subredes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferencias",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Los sitios con estas etiquetas se verán obligados a conectarse a través de este nodo de salida remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleccionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Buscar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Error al cargar las etiquetas",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "En savoir plus sur JMESPath",
    "idpJmespathLabel": "Chemin d'identification",
    "idpJmespathLabelDescription": "Le JMESPath vers l'identifiant de l'utilisateur dans le jeton ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Chemin de l'email (Optionnel)",
    "idpJmespathEmailPathOptionalDescription": "Le JMESPath vers l'email de l'utilisateur dans le jeton ID",
    "idpJmespathNamePathOptional": "Chemin du nom (Optionnel)",
@@ -1577,8 +1573,6 @@
    "search": "Rechercher…",
    "searchPlaceholder": "Recherche...",
    "emptySearchOptions": "Aucune option trouvée",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Créer",
    "orgs": "Organisations",
    "loginError": "Une erreur inattendue s'est produite. Veuillez réessayer.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Type :",
    "createDomainName": "Nom :",
    "createDomainValue": "Valeur :",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Enregistrements CNAME",
    "createDomainARecords": "Enregistrements A",
    "createDomainRecordNumber": "Enregistrement {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Ajouter une plage CIDR (par exemple 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Échec du chargement des sous-réseaux",
    "remoteExitNodeNetworkingLabelsTitle": "Étiquettes de préférences",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Les sites avec ces étiquettes devront se connecter via ce nœud de sortie distant.",
    "remoteExitNodeNetworkingLabelsButtonText": "Sélectionner des étiquettes...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Chercher des étiquettes...",
    "remoteExitNodeNetworkingLabelsLoadError": "Échec du chargement des étiquettes",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Scopri di più su JMESPath",
    "idpJmespathLabel": "Percorso Identificativo",
    "idpJmespathLabelDescription": "Il JMESPath per l'identificatore dell'utente nel token ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Percorso Email (Opzionale)",
    "idpJmespathEmailPathOptionalDescription": "Il JMESPath per l'email dell'utente nel token ID",
    "idpJmespathNamePathOptional": "Percorso Nome (Opzionale)",
@@ -1577,8 +1573,6 @@
    "search": "Cerca…",
    "searchPlaceholder": "Cerca...",
    "emptySearchOptions": "Nessuna opzione trovata",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Crea",
    "orgs": "Organizzazioni",
    "loginError": "Si è verificato un errore imprevisto. Riprova.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valore:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Record CNAME",
    "createDomainARecords": "Record A",
    "createDomainRecordNumber": "Record {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Aggiungi un intervallo CIDR (ad esempio 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Caricamento sottoreti fallito",
    "remoteExitNodeNetworkingLabelsTitle": "Etichette Preferenze",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "I siti con queste etichette saranno collegati attraverso questo nodo di uscita remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Seleziona etichette...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Cerca etichette...",
    "remoteExitNodeNetworkingLabelsLoadError": "Caricamento etichette fallito",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "JMESPath에 대해 더 알아보기",
    "idpJmespathLabel": "식별자 경로",
    "idpJmespathLabelDescription": "ID 토큰에서 사용자 식별자에 대한 경로",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "이메일 경로 (선택 사항)",
    "idpJmespathEmailPathOptionalDescription": "ID 토큰에서 사용자의 이메일 경로",
    "idpJmespathNamePathOptional": "이름 경로 (선택 사항)",
@@ -1577,8 +1573,6 @@
    "search": "검색…",
    "searchPlaceholder": "검색...",
    "emptySearchOptions": "옵션이 없습니다",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "생성",
    "orgs": "조직",
    "loginError": "예기치 않은 오류가 발생했습니다. 다시 시도해주세요.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "유형:",
    "createDomainName": "이름:",
    "createDomainValue": "값:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME 레코드",
    "createDomainARecords": "A 레코드",
    "createDomainRecordNumber": "레코드 {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "CIDR 범위 추가 (예: 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "서브넷 로드 실패",
    "remoteExitNodeNetworkingLabelsTitle": "우선순위 레이블",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "이 레이블이 있는 사이트는 이 원격 출구 노드를 통해 연결됩니다.",
    "remoteExitNodeNetworkingLabelsButtonText": "레이블 선택...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "레이블 검색...",
    "remoteExitNodeNetworkingLabelsLoadError": "레이블 로드 실패",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Lær mer om JMESPath",
    "idpJmespathLabel": "Identifikatorsti",
    "idpJmespathLabelDescription": "Stien til brukeridentifikatoren i ID-tokenet",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "E-poststi (Valgfritt)",
    "idpJmespathEmailPathOptionalDescription": "Stien til brukerens e-postadresse i ID-tokenet",
    "idpJmespathNamePathOptional": "Navn Sti (Valgfritt)",
@@ -1577,8 +1573,6 @@
    "search": "Søk…",
    "searchPlaceholder": "Søk...",
    "emptySearchOptions": "Ingen valg funnet",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Opprett",
    "orgs": "Organisasjoner",
    "loginError": "En uventet feil oppstod. Vennligst prøv igjen.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Navn:",
    "createDomainValue": "Verdi:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-oppføringer",
    "createDomainARecords": "A-oppføringer",
    "createDomainRecordNumber": "Oppføring {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Legg til et CIDR-område (f.eks. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Feil ved lasting av subnett",
    "remoteExitNodeNetworkingLabelsTitle": "Preferanseetiketter",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Områder med disse etikettene vil bli tvunget til å koble gjennom denne fjerne utgangsnoden.",
    "remoteExitNodeNetworkingLabelsButtonText": "Velg etiketter...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Søk etiketter...",
    "remoteExitNodeNetworkingLabelsLoadError": "Feil ved lasting av etiketter",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Meer informatie over JMESPath",
    "idpJmespathLabel": "ID pad",
    "idpJmespathLabelDescription": "Het pad naar het gebruiker-id in het ID-token",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "E-mail pad (optioneel)",
    "idpJmespathEmailPathOptionalDescription": "Het pad naar het e-mailadres van de gebruiker in het ID-token",
    "idpJmespathNamePathOptional": "Naam pad (optioneel)",
@@ -1577,8 +1573,6 @@
    "search": "Zoeken…",
    "searchPlaceholder": "Zoeken...",
    "emptySearchOptions": "Geen opties gevonden",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Aanmaken",
    "orgs": "Organisaties",
    "loginError": "Er is een onverwachte fout opgetreden. Probeer het opnieuw.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Type:",
    "createDomainName": "Naam:",
    "createDomainValue": "Waarde:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME-records",
    "createDomainARecords": "A Records",
    "createDomainRecordNumber": "Record {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Voeg een CIDR-bereik toe (bijv. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Kon subnets niet laden",
    "remoteExitNodeNetworkingLabelsTitle": "Voorkeurslabels",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Sites met deze labels worden verplicht om verbinding te maken via dit externe exit-knooppunt.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecteer labels...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Labels zoeken...",
    "remoteExitNodeNetworkingLabelsLoadError": "Kon labels niet laden",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Dowiedz się więcej o JMESPath",
    "idpJmespathLabel": "Ścieżka identyfikatora",
    "idpJmespathLabelDescription": "JMESPath do identyfikatora użytkownika w tokenie ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Ścieżka email (Opcjonalnie)",
    "idpJmespathEmailPathOptionalDescription": "JMESPath do emaila użytkownika w tokenie ID",
    "idpJmespathNamePathOptional": "Ścieżka nazwy (Opcjonalnie)",
@@ -1577,8 +1573,6 @@
    "search": "Szukaj…",
    "searchPlaceholder": "Szukaj...",
    "emptySearchOptions": "Nie znaleziono opcji",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Utwórz",
    "orgs": "Organizacje",
    "loginError": "Wystąpił nieoczekiwany błąd. Spróbuj ponownie.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Typ:",
    "createDomainName": "Nazwa:",
    "createDomainValue": "Wartość:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Rekordy CNAME",
    "createDomainARecords": "Rekordy A",
    "createDomainRecordNumber": "Rekord {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Dodaj zakres CIDR (np. 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Nie udało się załadować podsieci",
    "remoteExitNodeNetworkingLabelsTitle": "Etykiety preferencji",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Strony z tymi etykietami będą zmuszone do połączenia się przez ten zdalny węzeł wyjściowy.",
    "remoteExitNodeNetworkingLabelsButtonText": "Wybierz etykiety...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Szukaj etykiet...",
    "remoteExitNodeNetworkingLabelsLoadError": "Nie udało się załadować etykiet",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Saiba mais sobre JMESPath",
    "idpJmespathLabel": "Caminho do Identificador",
    "idpJmespathLabelDescription": "O JMESPath para o identificador do utilizador no token ID",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Caminho do Email (Opcional)",
    "idpJmespathEmailPathOptionalDescription": "O JMESPath para o email do utilizador no token ID",
    "idpJmespathNamePathOptional": "Caminho do Nome (Opcional)",
@@ -1577,8 +1573,6 @@
    "search": "Pesquisar…",
    "searchPlaceholder": "Buscar...",
    "emptySearchOptions": "Nenhuma opção encontrada",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Criar",
    "orgs": "Organizações",
    "loginError": "Ocorreu um erro inesperado. Por favor, tente novamente.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Tipo:",
    "createDomainName": "Nome:",
    "createDomainValue": "Valor:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "Registros CNAME",
    "createDomainARecords": "Registros A",
    "createDomainRecordNumber": "Registrar {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Adicione um intervalo de CIDR (por exemplo, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Falha ao carregar sub-redes",
    "remoteExitNodeNetworkingLabelsTitle": "Etiquetas de Preferência",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Os sites com essas etiquetas serão forçados a se conectar através deste nó de saída remoto.",
    "remoteExitNodeNetworkingLabelsButtonText": "Selecionar etiquetas...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Pesquisar etiquetas...",
    "remoteExitNodeNetworkingLabelsLoadError": "Falha ao carregar etiquetas",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "Узнать больше о JMESPath",
    "idpJmespathLabel": "Путь идентификатора",
    "idpJmespathLabelDescription": "Путь к идентификатору пользователя в ID токене",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "Путь к email (необязательно)",
    "idpJmespathEmailPathOptionalDescription": "Путь к email пользователя в ID токене",
    "idpJmespathNamePathOptional": "Путь к имени (необязательно)",
@@ -1577,8 +1573,6 @@
    "search": "Поиск…",
    "searchPlaceholder": "Поиск...",
    "emptySearchOptions": "Опции не найдены",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Создать",
    "orgs": "Организации",
    "loginError": "Произошла непредвиденная ошибка. Пожалуйста, попробуйте еще раз.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Тип:",
    "createDomainName": "Имя:",
    "createDomainValue": "Значение:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Записи",
    "createDomainARecords": "A Записи",
    "createDomainRecordNumber": "Запись {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Добавить диапазон CIDR (например, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Не удалось загрузить подсети",
    "remoteExitNodeNetworkingLabelsTitle": "Этикетки предпочтений",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Сайты с этими метками будут обязаны подключаться через этот удаленный узел выхода.",
    "remoteExitNodeNetworkingLabelsButtonText": "Выберите метки...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Поиск меток...",
    "remoteExitNodeNetworkingLabelsLoadError": "Не удалось загрузить метки",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "JMESPath hakkında daha fazla bilgi edinin",
    "idpJmespathLabel": "Tanımlayıcı Yolu",
    "idpJmespathLabelDescription": "The JMESPath to the user identifier in the ID token",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "E-posta Yolu (İsteğe Bağlı)",
    "idpJmespathEmailPathOptionalDescription": "The JMESPath to the user's email in the ID token",
    "idpJmespathNamePathOptional": "Ad Yolu (İsteğe Bağlı)",
@@ -1577,8 +1573,6 @@
    "search": "Ara…",
    "searchPlaceholder": "Ara...",
    "emptySearchOptions": "Seçenek bulunamadı",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "Oluştur",
    "orgs": "Organizasyonlar",
    "loginError": "Beklenmeyen bir hata oluştu. Lütfen tekrar deneyin.",
@@ -2602,7 +2596,6 @@
    "createDomainType": "Tür:",
    "createDomainName": "Ad:",
    "createDomainValue": "Değer:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME Kayıtları",
    "createDomainARecords": "A Kayıtları",
    "createDomainRecordNumber": "Kayıt {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "Bir CIDR aralığı ekle (örneğin, 10.0.0.0/8)",
    "remoteExitNodeNetworkingSubnetsLoadError": "Alt ağlar yüklenemedi",
    "remoteExitNodeNetworkingLabelsTitle": "Tercih Etiketleri",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "Bu etiketlere sahip siteler, bu uzak çıkış düğümü üzerinden bağlantı kurmaya zorlanacaktır.",
    "remoteExitNodeNetworkingLabelsButtonText": "Etiketleri seç...",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "Etiketleri ara...",
    "remoteExitNodeNetworkingLabelsLoadError": "Etiketler yüklenemedi",
@@ -1176,10 +1176,6 @@
    "idpJmespathAboutDescriptionLink": "了解更多 JMESPath 信息",
    "idpJmespathLabel": "标识符路径",
    "idpJmespathLabelDescription": "ID 令牌中用户标识符的路径",
-    "idpIdentifierChangeTitle": "Identifier Path Change Warning",
-    "idpIdentifierChangeDescription": "You are about to change the identifier path. This will affect how existing users are mapped. Users who previously signed in through this identity provider may no longer be recognized as the same users.",
-    "idpIdentifierChangeConfirmMessage": "I confirm",
-    "idpIdentifierChangeWarningText": "This will affect how existing users are mapped",
    "idpJmespathEmailPathOptional": "邮箱路径（可选）",
    "idpJmespathEmailPathOptionalDescription": "ID 令牌中用户邮箱的路径",
    "idpJmespathNamePathOptional": "用户名路径（可选）",
@@ -1577,8 +1573,6 @@
    "search": "搜索…",
    "searchPlaceholder": "搜索...",
    "emptySearchOptions": "未找到选项",
-    "ipFilterSearchPlaceholder": "Enter an IP address…",
-    "ipFilterEmptyMessage": "Enter an IP address to filter by",
    "create": "创建",
    "orgs": "组织",
    "loginError": "发生意外错误。请重试。",
@@ -2602,7 +2596,6 @@
    "createDomainType": "类型:",
    "createDomainName": "名称:",
    "createDomainValue": "值:",
-    "multiSelectFilterCount": "{count} selected",
    "createDomainCnameRecords": "CNAME 记录",
    "createDomainARecords": "A记录",
    "createDomainRecordNumber": "记录 {number}",
@@ -3000,7 +2993,7 @@
    "remoteExitNodeNetworkingSubnetsPlaceholder": "添加CIDR范围（例如10.0.0.0/8）",
    "remoteExitNodeNetworkingSubnetsLoadError": "无法加载子网",
    "remoteExitNodeNetworkingLabelsTitle": "首选标签",
-    "remoteExitNodeNetworkingLabelsDescription": "Sites with these labels will prefer to connect through this remote exit node.",
+    "remoteExitNodeNetworkingLabelsDescription": "拥有这些标签的站点将强制通过此远程出口节点连接。",
    "remoteExitNodeNetworkingLabelsButtonText": "选择标签……",
    "remoteExitNodeNetworkingLabelsSearchPlaceholder": "搜索标签……",
    "remoteExitNodeNetworkingLabelsLoadError": "无法加载标签",
@@ -94,12 +94,12 @@
        "input-otp": "1.4.2",
        "ioredis": "5.11.0",
        "jmespath": "0.16.0",
-        "js-yaml": "4.3.1",
+        "js-yaml": "4.3.0",
        "jsonwebtoken": "9.0.3",
        "lucide-react": "1.17.0",
        "maxmind": "5.0.6",
        "moment": "2.30.1",
-        "next": "16.3.1",
+        "next": "16.2.11",
        "next-intl": "4.13.0",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
@@ -139,7 +139,7 @@
    "devDependencies": {
        "@dotenvx/dotenvx": "1.69.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.2",
+        "@react-email/ui": "^6.5.0",
        "@tailwindcss/postcss": "4.3.0",
        "@tanstack/react-query-devtools": "5.100.14",
        "@types/better-sqlite3": "7.6.13",
@@ -170,7 +170,7 @@
        "esbuild-node-externals": "1.22.0",
        "eslint": "10.4.0",
        "eslint-config-next": "16.2.6",
-        "postcss": "8.5.23",
+        "postcss": "8.5.15",
        "prettier": "3.8.3",
        "react-email": "6.5.0",
        "tailwindcss": "4.3.0",
@@ -182,6 +182,6 @@
    "overrides": {
        "esbuild": "0.28.0",
        "dompurify": "3.4.0",
-        "postcss": "8.5.23"
+        "postcss": "8.5.15"
    }
 }
@@ -262,20 +262,16 @@ export const resourceAiModels = pgTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = pgTable(
-    "labels",
-    {
-        labelId: serial("labelId").primaryKey(),
-        name: varchar("name").notNull(),
-        color: varchar("color").notNull(),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [index("idx_labels_orgid").on(t.orgId)]
-);
+export const labels = pgTable("labels", {
+    labelId: serial("labelId").primaryKey(),
+    name: varchar("name").notNull(),
+    color: varchar("color").notNull(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});

 export const launcherViews = pgTable("launcherViews", {
    viewId: serial("viewId").primaryKey(),
@@ -697,19 +693,15 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
    codeHash: varchar("codeHash").notNull()
 });

-export const sessions = pgTable(
-    "session",
-    {
-        sessionId: varchar("id").primaryKey(),
-        userId: varchar("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
-        issuedAt: bigint("issuedAt", { mode: "number" }),
-        deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-    },
-    (t) => [index("idx_sessions_userid").on(t.userId)]
-);
+export const sessions = pgTable("session", {
+    sessionId: varchar("id").primaryKey(),
+    userId: varchar("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
+    issuedAt: bigint("issuedAt", { mode: "number" }),
+    deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
+});

 export const newtSessions = pgTable("newtSession", {
    sessionId: varchar("id").primaryKey(),
@@ -719,26 +711,19 @@ export const newtSessions = pgTable("newtSession", {
    expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });

-export const userOrgs = pgTable(
-    "userOrgs",
-    {
-        userId: varchar("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isOwner: boolean("isOwner").notNull().default(false),
-        autoProvisioned: boolean("autoProvisioned").default(false),
-        pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-    },
-    (t) => [
-        index("idx_userOrgs_userid").on(t.userId),
-        index("idx_userOrgs_orgid").on(t.orgId)
-    ]
-);
+export const userOrgs = pgTable("userOrgs", {
+    userId: varchar("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isOwner: boolean("isOwner").notNull().default(false),
+    autoProvisioned: boolean("autoProvisioned").default(false),
+    pamUsername: varchar("pamUsername") // cleaned username for ssh and such
+});

 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
    codeId: serial("id").primaryKey(),
@@ -766,26 +751,22 @@ export const actions = pgTable("actions", {
    description: varchar("description")
 });

-export const roles = pgTable(
-    "roles",
-    {
-        roleId: serial("roleId").primaryKey(),
-        orgId: varchar("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isAdmin: boolean("isAdmin"),
-        name: varchar("name").notNull(),
-        description: varchar("description"),
-        requireDeviceApproval: boolean("requireDeviceApproval").default(false),
-        sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
-        sshSudoCommands: text("sshSudoCommands").default("[]"),
-        sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
-        sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
-    (t) => [index("idx_roles_orgid").on(t.orgId)]
-);
+export const roles = pgTable("roles", {
+    roleId: serial("roleId").primaryKey(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isAdmin: boolean("isAdmin"),
+    name: varchar("name").notNull(),
+    description: varchar("description"),
+    requireDeviceApproval: boolean("requireDeviceApproval").default(false),
+    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
+    sshSudoCommands: text("sshSudoCommands").default("[]"),
+    sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
+    sshUnixGroups: text("sshUnixGroups").default("[]")
+});

 export const userOrgRoles = pgTable(
    "userOrgRoles",
@@ -1428,10 +1409,7 @@ export const olms = pgTable(
        }),
        archived: boolean("archived").notNull().default(false)
    },
-    (t) => [
-        index("idx_olms_clientid").on(t.clientId),
-        index("idx_olms_userid").on(t.userId)
-    ]
+    (t) => [index("idx_olms_clientid").on(t.clientId)]
 );

 export const currentFingerprint = pgTable("currentFingerprint", {
@@ -99,147 +99,131 @@ export const orgDomains = sqliteTable("orgDomains", {
        .references(() => domains.domainId, { onDelete: "cascade" })
 });

-export const sites = sqliteTable(
-    "sites",
-    {
-        siteId: integer("siteId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        niceId: text("niceId").notNull(),
-        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-            onDelete: "set null"
-        }),
-        networkId: integer("networkId").references(() => networks.networkId, {
-            onDelete: "set null"
-        }),
-        name: text("name").notNull(),
-        pubKey: text("pubKey"),
-        exitNodeSubnet: text("exitNodeSubnet"),
-        megabytesIn: integer("bytesIn").default(0),
-        megabytesOut: integer("bytesOut").default(0),
-        lastBandwidthUpdate: text("lastBandwidthUpdate"),
-        type: text("type").notNull(), // "newt" or "wireguard"
-        online: integer("online", { mode: "boolean" }).notNull().default(false),
-        lastPing: integer("lastPing"),
-
-        // exit node stuff that is how to connect to the site when it has a wg server
-        address: text("address"), // this is the address of the wireguard interface in newt
-        endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
-        localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
-        publicKey: text("publicKey"), // TODO: Fix typo in publicKey
-        lastHolePunch: integer("lastHolePunch"),
-        listenPort: integer("listenPort"),
-        dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
-            .notNull()
-            .default(true),
-        autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-            mode: "boolean"
+export const sites = sqliteTable("sites", {
+    siteId: integer("siteId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
        })
-            .notNull()
-            .default(false),
-        status: text("status")
-            .$type<"pending" | "approved">()
-            .default("approved")
-    },
-    (table) => [
-        index("idx_sites_orgId").on(table.orgId)
-    ]
-);
+        .notNull(),
+    niceId: text("niceId").notNull(),
+    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+        onDelete: "set null"
+    }),
+    networkId: integer("networkId").references(() => networks.networkId, {
+        onDelete: "set null"
+    }),
+    name: text("name").notNull(),
+    pubKey: text("pubKey"),
+    exitNodeSubnet: text("exitNodeSubnet"),
+    megabytesIn: integer("bytesIn").default(0),
+    megabytesOut: integer("bytesOut").default(0),
+    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+    type: text("type").notNull(), // "newt" or "wireguard"
+    online: integer("online", { mode: "boolean" }).notNull().default(false),
+    lastPing: integer("lastPing"),

-export const resources = sqliteTable(
-    "resources",
-    {
-        resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-        resourcePolicyId: integer("resourcePolicyId").references(
-            () => resourcePolicies.resourcePolicyId,
-            { onDelete: "set null" }
-        ),
-        defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-            () => resourcePolicies.resourcePolicyId,
-            {
-                onDelete: "restrict"
-            }
-        ),
-        resourceGuid: text("resourceGuid", { length: 36 })
-            .unique()
-            .notNull()
-            .$defaultFn(() => randomUUID()),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        niceId: text("niceId").notNull(),
-        name: text("name").notNull(),
-        subdomain: text("subdomain"),
-        fullDomain: text("fullDomain"),
-        domainId: text("domainId").references(() => domains.domainId, {
-            onDelete: "set null"
-        }),
-        ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-        blockAccess: integer("blockAccess", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        proxyPort: integer("proxyPort"),
-        sso: integer("sso", { mode: "boolean" }),
-        emailWhitelistEnabled: integer("emailWhitelistEnabled", {
-            mode: "boolean"
-        }),
-        applyRules: integer("applyRules", { mode: "boolean" }),
-        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-        stickySession: integer("stickySession", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        tlsServerName: text("tlsServerName"),
-        setHostHeader: text("setHostHeader"),
-        enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
-        skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
-            onDelete: "set null"
-        }),
-        headers: text("headers"), // comma-separated list of headers to add to the request
-        proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
-            .notNull()
-            .default(false),
-        proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-        maintenanceModeEnabled: integer("maintenanceModeEnabled", {
-            mode: "boolean"
+    // exit node stuff that is how to connect to the site when it has a wg server
+    address: text("address"), // this is the address of the wireguard interface in newt
+    endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
+    publicKey: text("publicKey"), // TODO: Fix typo in publicKey
+    lastHolePunch: integer("lastHolePunch"),
+    listenPort: integer("listenPort"),
+    dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
+        .notNull()
+        .default(true),
+    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
+        mode: "boolean"
+    })
+        .notNull()
+        .default(false),
+    status: text("status").$type<"pending" | "approved">().default("approved")
+});
+
+export const resources = sqliteTable("resources", {
+    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
+    resourcePolicyId: integer("resourcePolicyId").references(
+        () => resourcePolicies.resourcePolicyId,
+        { onDelete: "set null" }
+    ),
+    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
+        () => resourcePolicies.resourcePolicyId,
+        {
+            onDelete: "restrict"
+        }
+    ),
+    resourceGuid: text("resourceGuid", { length: 36 })
+        .unique()
+        .notNull()
+        .$defaultFn(() => randomUUID()),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
        })
-            .notNull()
-            .default(false),
-        maintenanceModeType: text("maintenanceModeType", {
-            enum: ["forced", "automatic"]
-        }).default("forced"), // "forced" = always show, "automatic" = only when down
-        maintenanceTitle: text("maintenanceTitle"),
-        maintenanceMessage: text("maintenanceMessage"),
-        maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
-        postAuthPath: text("postAuthPath"),
-        health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-        wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-        mode: text("mode")
-            .default("http")
-            .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
-            .notNull(), // rdp, ssh, http, vnc, inference
-        pamMode: text("pamMode")
-            .$type<"passthrough" | "push">()
-            .default("passthrough"),
-        authDaemonMode: text("authDaemonMode")
-            .$type<"site" | "remote" | "native">()
-            .default("site"),
-        authDaemonPort: integer("authDaemonPort").default(22123),
-        status: text("status")
-            .$type<"pending" | "approved">()
-            .default("approved")
-    },
-    (table) => [
-        index("idx_resources_orgId").on(table.orgId)
-    ]
-);
+        .notNull(),
+    niceId: text("niceId").notNull(),
+    name: text("name").notNull(),
+    subdomain: text("subdomain"),
+    fullDomain: text("fullDomain"),
+    domainId: text("domainId").references(() => domains.domainId, {
+        onDelete: "set null"
+    }),
+    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
+    blockAccess: integer("blockAccess", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    proxyPort: integer("proxyPort"),
+    sso: integer("sso", { mode: "boolean" }),
+    emailWhitelistEnabled: integer("emailWhitelistEnabled", {
+        mode: "boolean"
+    }),
+    applyRules: integer("applyRules", { mode: "boolean" }),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    stickySession: integer("stickySession", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    tlsServerName: text("tlsServerName"),
+    setHostHeader: text("setHostHeader"),
+    enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
+    skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
+        onDelete: "set null"
+    }),
+    headers: text("headers"), // comma-separated list of headers to add to the request
+    proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
+        mode: "boolean"
+    })
+        .notNull()
+        .default(false),
+    maintenanceModeType: text("maintenanceModeType", {
+        enum: ["forced", "automatic"]
+    }).default("forced"), // "forced" = always show, "automatic" = only when down
+    maintenanceTitle: text("maintenanceTitle"),
+    maintenanceMessage: text("maintenanceMessage"),
+    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+    postAuthPath: text("postAuthPath"),
+    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
+    mode: text("mode")
+        .default("http")
+        .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
+        .notNull(), // rdp, ssh, http, vnc, inference
+    pamMode: text("pamMode")
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
+    authDaemonMode: text("authDaemonMode")
+        .$type<"site" | "remote" | "native">()
+        .default("site"),
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
+});

 export const resourceAiProviders = sqliteTable(
    "resourceAiProviders",
@@ -276,22 +260,16 @@ export const resourceAiModels = sqliteTable(
    (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );

-export const labels = sqliteTable(
-    "labels",
-    {
-        labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-        name: text("name").notNull(),
-        color: text("color").notNull(),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (table) => [
-        index("idx_labels_orgId").on(table.orgId)
-    ]
-);
+export const labels = sqliteTable("labels", {
+    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
+    name: text("name").notNull(),
+    color: text("color").notNull(),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});

 export const launcherViews = sqliteTable("launcherViews", {
    viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -388,44 +366,35 @@ export const clientLabels = sqliteTable(
    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );

-export const targets = sqliteTable(
-    "targets",
-    {
-        targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-        resourceId: integer("resourceId").references(
-            () => resources.resourceId,
-            { onDelete: "cascade" }
-        ),
-        providerId: integer("providerId").references(
-            () => aiProviders.providerId,
-            { onDelete: "cascade" }
-        ),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        ip: text("ip").notNull(),
-        method: text("method"),
-        port: integer("port").notNull(),
-        internalPort: integer("internalPort"),
-        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-        path: text("path"),
-        pathMatchType: text("pathMatchType"), // exact, prefix, regex
-        rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
-        rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-        priority: integer("priority").notNull().default(100),
-        mode: text("mode")
-            .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
-            .notNull()
-            .default("http"),
-        authToken: text("authToken")
-    },
-    (table) => [
-        index("idx_targets_resourceId").on(table.resourceId),
-        index("idx_targets_siteId").on(table.siteId)
-    ]
-);
+export const targets = sqliteTable("targets", {
+    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
+    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        onDelete: "cascade"
+    }),
+    providerId: integer("providerId").references(() => aiProviders.providerId, {
+        onDelete: "cascade"
+    }),
+    siteId: integer("siteId")
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    ip: text("ip").notNull(),
+    method: text("method"),
+    port: integer("port").notNull(),
+    internalPort: integer("internalPort"),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    path: text("path"),
+    pathMatchType: text("pathMatchType"), // exact, prefix, regex
+    rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
+    rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
+    priority: integer("priority").notNull().default(100),
+    mode: text("mode")
+        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+        .notNull()
+        .default("http"),
+    authToken: text("authToken")
+});

 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
    targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -694,63 +663,50 @@ export const setupTokens = sqliteTable("setupTokens", {
    dateUsed: text("dateUsed")
 });

-export const newts = sqliteTable(
-    "newt",
-    {
-        newtId: text("id").primaryKey(),
-        secretHash: text("secretHash").notNull(),
-        dateCreated: text("dateCreated").notNull(),
-        version: text("version"),
-        siteId: integer("siteId").references(() => sites.siteId, {
+export const newts = sqliteTable("newt", {
+    newtId: text("id").primaryKey(),
+    secretHash: text("secretHash").notNull(),
+    dateCreated: text("dateCreated").notNull(),
+    version: text("version"),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    })
+});
+
+export const clients = sqliteTable("clients", {
+    clientId: integer("clientId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
            onDelete: "cascade"
        })
-    },
-    (table) => [
-        index("idx_newts_siteId").on(table.siteId)
-    ]
-);
-
-export const clients = sqliteTable(
-    "clients",
-    {
-        clientId: integer("clientId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-            onDelete: "set null"
-        }),
-        userId: text("userId").references(() => users.userId, {
-            // optionally tied to a user and in this case delete when the user deletes
-            onDelete: "cascade"
-        }),
-        niceId: text("niceId").notNull(),
-        name: text("name").notNull(),
-        pubKey: text("pubKey"),
-        olmId: text("olmId"), // to lock it to a specific olm optionally
-        subnet: text("subnet").notNull(),
-        exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
-        megabytesIn: integer("bytesIn"),
-        megabytesOut: integer("bytesOut"),
-        lastBandwidthUpdate: text("lastBandwidthUpdate"),
-        lastPing: integer("lastPing"),
-        type: text("type").notNull(), // "olm"
-        online: integer("online", { mode: "boolean" }).notNull().default(false),
-        // endpoint: text("endpoint"),
-        lastHolePunch: integer("lastHolePunch"),
-        archived: integer("archived", { mode: "boolean" }).notNull().default(false),
-        blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
-        approvalState: text("approvalState").$type<
-            "pending" | "approved" | "denied"
-        >()
-    },
-    (table) => [
-        index("idx_clients_orgId").on(table.orgId),
-        index("idx_clients_userId").on(table.userId)
-    ]
-);
+        .notNull(),
+    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+        onDelete: "set null"
+    }),
+    userId: text("userId").references(() => users.userId, {
+        // optionally tied to a user and in this case delete when the user deletes
+        onDelete: "cascade"
+    }),
+    niceId: text("niceId").notNull(),
+    name: text("name").notNull(),
+    pubKey: text("pubKey"),
+    olmId: text("olmId"), // to lock it to a specific olm optionally
+    subnet: text("subnet").notNull(),
+    exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
+    megabytesIn: integer("bytesIn"),
+    megabytesOut: integer("bytesOut"),
+    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+    lastPing: integer("lastPing"),
+    type: text("type").notNull(), // "olm"
+    online: integer("online", { mode: "boolean" }).notNull().default(false),
+    // endpoint: text("endpoint"),
+    lastHolePunch: integer("lastHolePunch"),
+    archived: integer("archived", { mode: "boolean" }).notNull().default(false),
+    blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
+    approvalState: text("approvalState").$type<
+        "pending" | "approved" | "denied"
+    >()
+});

 export const clientSitesAssociationsCache = sqliteTable(
    "clientSitesAssociationsCache",
@@ -778,29 +734,23 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
    }
 );

-export const olms = sqliteTable(
-    "olms",
-    {
-        olmId: text("id").primaryKey(),
-        secretHash: text("secretHash").notNull(),
-        dateCreated: text("dateCreated").notNull(),
-        version: text("version"),
-        agent: text("agent"),
-        name: text("name"),
-        clientId: integer("clientId").references(() => clients.clientId, {
-            // we will switch this depending on the current org it wants to connect to
-            onDelete: "set null"
-        }),
-        userId: text("userId").references(() => users.userId, {
-            // optionally tied to a user and in this case delete when the user deletes
-            onDelete: "cascade"
-        }),
-        archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-    },
-    (table) => [
-        index("idx_olms_userId").on(table.userId)
-    ]
-);
+export const olms = sqliteTable("olms", {
+    olmId: text("id").primaryKey(),
+    secretHash: text("secretHash").notNull(),
+    dateCreated: text("dateCreated").notNull(),
+    version: text("version"),
+    agent: text("agent"),
+    name: text("name"),
+    clientId: integer("clientId").references(() => clients.clientId, {
+        // we will switch this depending on the current org it wants to connect to
+        onDelete: "set null"
+    }),
+    userId: text("userId").references(() => users.userId, {
+        // optionally tied to a user and in this case delete when the user deletes
+        onDelete: "cascade"
+    }),
+    archived: integer("archived", { mode: "boolean" }).notNull().default(false)
+});

 export const currentFingerprint = sqliteTable("currentFingerprint", {
    fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -962,23 +912,17 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
    codeHash: text("codeHash").notNull()
 });

-export const sessions = sqliteTable(
-    "session",
-    {
-        sessionId: text("id").primaryKey(),
-        userId: text("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        expiresAt: integer("expiresAt").notNull(),
-        issuedAt: integer("issuedAt"),
-        deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
-            .notNull()
-            .default(false)
-    },
-    (table) => [
-        index("idx_sessions_userId").on(table.userId)
-    ]
-);
+export const sessions = sqliteTable("session", {
+    sessionId: text("id").primaryKey(),
+    userId: text("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    expiresAt: integer("expiresAt").notNull(),
+    issuedAt: integer("issuedAt"),
+    deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
+        .notNull()
+        .default(false)
+});

 export const newtSessions = sqliteTable("newtSession", {
    sessionId: text("id").primaryKey(),
@@ -996,28 +940,21 @@ export const olmSessions = sqliteTable("clientSession", {
    expiresAt: integer("expiresAt").notNull()
 });

-export const userOrgs = sqliteTable(
-    "userOrgs",
-    {
-        userId: text("userId")
-            .notNull()
-            .references(() => users.userId, { onDelete: "cascade" }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
-        autoProvisioned: integer("autoProvisioned", {
-            mode: "boolean"
-        }).default(false),
-        pamUsername: text("pamUsername") // cleaned username for ssh and such
-    },
-    (table) => [
-        index("idx_userOrgs_userId").on(table.userId),
-        index("idx_userOrgs_orgId").on(table.orgId)
-    ]
-);
+export const userOrgs = sqliteTable("userOrgs", {
+    userId: text("userId")
+        .notNull()
+        .references(() => users.userId, { onDelete: "cascade" }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
+    autoProvisioned: integer("autoProvisioned", {
+        mode: "boolean"
+    }).default(false),
+    pamUsername: text("pamUsername") // cleaned username for ssh and such
+});

 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
    codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -1045,32 +982,26 @@ export const actions = sqliteTable("actions", {
    description: text("description")
 });

-export const roles = sqliteTable(
-    "roles",
-    {
-        roleId: integer("roleId").primaryKey({ autoIncrement: true }),
-        orgId: text("orgId")
-            .references(() => orgs.orgId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        isAdmin: integer("isAdmin", { mode: "boolean" }),
-        name: text("name").notNull(),
-        description: text("description"),
-        requireDeviceApproval: integer("requireDeviceApproval", {
-            mode: "boolean"
-        }).default(false),
-        sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
-        sshSudoCommands: text("sshSudoCommands").default("[]"),
-        sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
-            true
-        ),
-        sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
-    (table) => [
-        index("idx_roles_orgId").on(table.orgId)
-    ]
-);
+export const roles = sqliteTable("roles", {
+    roleId: integer("roleId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    isAdmin: integer("isAdmin", { mode: "boolean" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    requireDeviceApproval: integer("requireDeviceApproval", {
+        mode: "boolean"
+    }).default(false),
+    sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
+    sshSudoCommands: text("sshSudoCommands").default("[]"),
+    sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
+        true
+    ),
+    sshUnixGroups: text("sshUnixGroups").default("[]")
+});

 export const userOrgRoles = sqliteTable(
    "userOrgRoles",
@@ -101,7 +101,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
    .object({
        action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
+        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
        value: z.coerce.string(),
        priority: z.int().optional(),
        enabled: z.boolean().optional().default(true)
@@ -136,7 +136,7 @@ export const RuleSchema = z
    )
    .refine(
        (rule) => {
-            if (rule.match === "country" || rule.match === "country_is_not") {
+            if (rule.match === "country") {
                if (!hasMaxmindCountryDb) {
                    return false;
                }
@@ -31,6 +31,7 @@ export async function validateAndConstructDomain(
    subdomain?: string | null
 ): Promise<DomainValidationResult> {
    try {
+        // Query domain with organization access check
        const [domainRes] = await db
            .select()
            .from(domains)
@@ -41,10 +42,6 @@ export async function validateAndConstructDomain(
                    eq(orgDomains.orgId, orgId),
                    eq(orgDomains.domainId, domainId)
                )
-            )
-            .leftJoin(
-                domainNamespaces,
-                eq(domainNamespaces.domainId, domainId)
            );

        // Check if domain exists
@@ -55,7 +52,7 @@ export async function validateAndConstructDomain(
            };
        }

-        if (!domainRes.orgDomains && !domainRes.domainNamespaces) {
+        if (!domainRes.orgDomains) {
            return {
                success: false,
                error: `Organization does not have access to domain with ID ${domainId}`
@@ -86,11 +83,19 @@ export async function validateAndConstructDomain(
        }

        // Wildcard subdomains are not allowed on namespace (provided/free) domains
-        if (isWildcard && domainRes.domainNamespaces) {
-            return {
-                success: false,
-                error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
-            };
+        if (isWildcard) {
+            const [namespaceDomain] = await db
+                .select()
+                .from(domainNamespaces)
+                .where(eq(domainNamespaces.domainId, domainId))
+                .limit(1);
+
+            if (namespaceDomain) {
+                return {
+                    success: false,
+                    error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
+                };
+            }
        }

        if (
@@ -3,8 +3,6 @@ import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
 import {
-    aiProviders,
-    aiUsageRecords,
    alertRules,
    apiKeys,
    blueprints,
@@ -13,16 +11,7 @@ import {
    siteResources
 } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
-import {
-    eq,
-    count,
-    countDistinct,
-    notInArray,
-    and,
-    isNotNull,
-    isNull,
-    gte
-} from "drizzle-orm";
+import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
 import { APP_VERSION } from "./consts";
 import crypto from "crypto";
 import { UserType } from "@server/types/UserTypes";
@@ -183,25 +172,6 @@ class TelemetryClient {
                .select({ count: count() })
                .from(blueprints);

-            const [aiProvidersCount] = await db
-                .select({ count: count() })
-                .from(aiProviders);
-            const [orgsWithAiProviders] = await db
-                .select({ count: countDistinct(aiProviders.orgId) })
-                .from(aiProviders);
-
-            const usageWindowStart =
-                Math.floor(Date.now() / 1000) -
-                this.collectionIntervalDays * 24 * 60 * 60;
-            const [aiUsageRecordsRecent] = await db
-                .select({ count: count() })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-            const [orgsWithRecentAiUsage] = await db
-                .select({ count: countDistinct(aiUsageRecords.orgId) })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-
            const supporterKey = config.getSupporterData();

            const allPrivateResources = await db.select().from(siteResources);
@@ -212,7 +182,6 @@ class TelemetryClient {
            let numPrivResourceCidr = 0;
            let numPrivResourceHttp = 0;
            let numPrivResourceSsh = 0;
-            let numPrivResourceInference = 0;
            for (const res of allPrivateResources) {
                if (res.mode === "host") {
                    numPrivResourceHosts += 1;
@@ -222,8 +191,6 @@ class TelemetryClient {
                    numPrivResourceHttp += 1;
                } else if (res.mode === "ssh") {
                    numPrivResourceSsh += 1;
-                } else if (res.mode === "inference") {
-                    numPrivResourceInference += 1;
                }

                if (res.alias) {
@@ -244,11 +211,6 @@ class TelemetryClient {
                numPrivateResourceCidr: numPrivResourceCidr,
                numPrivateResourceHttp: numPrivResourceHttp,
                numPrivateResourceSsh: numPrivResourceSsh,
-                numPrivateResourceInference: numPrivResourceInference,
-                numAiProviders: aiProvidersCount.count,
-                numOrgsWithAiProviders: orgsWithAiProviders.count,
-                numAiUsageRecordsRecent: aiUsageRecordsRecent.count,
-                numOrgsWithRecentAiUsage: orgsWithRecentAiUsage.count,
                numAlertRules: numAlertRules.count,
                numUserDevices: userDevicesCount.count,
                numMachineClients: machineClients.count,
@@ -361,17 +323,6 @@ class TelemetryClient {
                    num_resources_non_http: stats.resources.filter(
                        (r) => r.mode !== "http"
                    ).length,
-                    num_resources_ai_gateway: stats.resources.filter(
-                        (r) => r.mode === "inference"
-                    ).length,
-                    num_private_resources_ai_gateway:
-                        stats.numPrivateResourceInference,
-                    num_ai_providers: stats.numAiProviders,
-                    num_orgs_with_ai_providers: stats.numOrgsWithAiProviders,
-                    num_ai_usage_records_recent:
-                        stats.numAiUsageRecordsRecent,
-                    num_orgs_with_recent_ai_usage:
-                        stats.numOrgsWithRecentAiUsage,
                    num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                        .length,
                    num_local_sites: stats.sites.filter(
@@ -68,11 +68,6 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

-        if (apiKey.isRoot) {
-            // Root keys can access any access token in any org
-            return next();
-        }
-
        if (!resource.orgId) {
            return next(
                createHttpError(
@@ -149,8 +149,12 @@ LQIDAQAB
        }

        // Count used sites and users for license comparison
-        const [siteCountRes] = await db.select({ value: count() }).from(sites);
-        const [userCountRes] = await db.select({ value: count() }).from(users);
+        const [siteCountRes] = await db
+            .select({ value: count() })
+            .from(sites);
+        const [userCountRes] = await db
+            .select({ value: count() })
+            .from(users);

        const status: LicenseStatus = {
            hostId: this.hostMeta.hostMetaId,
@@ -272,13 +276,10 @@ LQIDAQAB
                        logger.error(
                            `Allowing failure. Will retry one more time at next run interval.`
                        );
-                        // Fall back to last known good status if we have
-                        // one cached; otherwise return the freshly built
-                        // status (with defaults) rather than undefined.
-                        const lastKnownStatus = this.statusCache.get(
+                        // return last known good status
+                        return this.statusCache.get(
                            this.statusKey
-                        ) as LicenseStatus | undefined;
-                        return lastKnownStatus ?? status;
+                        ) as LicenseStatus;
                    } else {
                        // Subsequent failures: fail abruptly
                        throw e;
@@ -367,7 +368,10 @@ LQIDAQAB
                }

                // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
+                if (
+                    cached.quantity_2 !== undefined &&
+                    cached.quantity_2 >= 0
+                ) {
                    status.maxSites =
                        (status.maxSites ?? 0) + cached.quantity_2;
                }
@@ -557,7 +561,7 @@ LQIDAQAB
                    // Calculate exponential backoff delay
                    const retryDelay = Math.floor(
                        initialRetryDelay *
-                            Math.pow(exponentialFactor, attempt - 1)
+                        Math.pow(exponentialFactor, attempt - 1)
                    );

                    logger.debug(
@@ -88,27 +88,7 @@ export const queryAccessAuditLogsQuery = z.object({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    ip: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by IP adresses"
-        })
+        .pipe(z.int().nonnegative())
 });

 export const queryAccessAuditLogsParams = z.object({
@@ -154,9 +134,6 @@ function getWhere(data: Q) {
        data.type ? eq(accessAuditLog.type, data.type) : undefined,
        data.action !== undefined
            ? eq(accessAuditLog.action, data.action)
-            : undefined,
-        data.ip && data.ip.length > 0
-            ? inArray(accessAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -16,10 +16,12 @@ import {
    handleRemoteExitNodePingMessage
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
-import { handleConnectionLogMessage } from "#private/routers/newt";
+import {
+    handleConnectionLogMessage,
+} from "#private/routers/newt";

 export const messageHandlers: Record<string, MessageHandler> = {
    "remoteExitNode/register": handleRemoteExitNodeRegisterMessage,
    "remoteExitNode/ping": handleRemoteExitNodePingMessage,
-    "newt/access-log": handleConnectionLogMessage
+    "newt/access-log": handleConnectionLogMessage,
 };
@@ -81,27 +81,7 @@ export const queryAccessAuditLogsQuery = z.strictObject({
        .optional()
        .default("0")
        .transform(Number)
-        .pipe(z.int().nonnegative()),
-    ip: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by IP adresses"
-        })
+        .pipe(z.int().nonnegative())
 });

 export const queryRequestAuditLogsParams = z.object({
@@ -146,9 +126,6 @@ function getWhere(data: Q) {
        data.path ? eq(requestAuditLog.path, data.path) : undefined,
        data.action !== undefined
            ? eq(requestAuditLog.action, data.action)
-            : undefined,
-        data.ip && data.ip.length > 0
-            ? inArray(requestAuditLog.ip, data.ip)
            : undefined
    );
 }
@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib/response";
 import { db } from "@server/db";
 import { passwordResetTokens, users } from "@server/db";
-import { eq, and } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
 import { createDate } from "oslo";
 import logger from "@server/logger";
@@ -49,12 +49,7 @@ export async function requestPasswordReset(
        const existingUser = await db
            .select()
            .from(users)
-            .where(
-                and(
-                    eq(users.email, email),
-                    eq(users.type, UserType.Internal)
-                )
-            );
+            .where(eq(users.email, email));

        if (!existingUser || !existingUser.length) {
            await randomDelay(2000);
@@ -533,23 +533,18 @@ export async function startAuthentication(

        // If email is provided, get security keys for that specific user
        if (email) {
-            const matchingUsers = await db
+            const [user] = await db
                .select()
                .from(users)
-                .where(
-                    and(
-                        eq(users.email, email.toLowerCase()),
-                        eq(users.type, UserType.Internal)
-                    )
-                );
+                .where(eq(users.email, email))
+                .limit(1);

-            if (matchingUsers.length !== 1) {
+            if (!user || user.type !== UserType.Internal) {
                return next(
                    createHttpError(HttpCode.BAD_REQUEST, "Invalid credentials")
                );
            }

-            const user = matchingUsers[0];
            userId = user.userId;

            const userSecurityKeys = await db
@@ -42,62 +42,54 @@ export async function setServerAdmin(

        const { email, password, setupToken } = parsedBody.data;

+        // Validate setup token
+        const [validToken] = await db
+            .select()
+            .from(setupTokens)
+            .where(
+                and(
+                    eq(setupTokens.token, setupToken),
+                    eq(setupTokens.used, false)
+                )
+            );
+
+        if (!validToken) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Invalid or expired setup token"
+                )
+            );
+        }
+
+        const [existing] = await db
+            .select()
+            .from(users)
+            .where(eq(users.serverAdmin, true));
+
+        if (existing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Server admin already exists"
+                )
+            );
+        }
+
        const passwordHash = await hashPassword(password);
        const userId = generateId(15);

        await db.transaction(async (trx) => {
-            const consumed = await trx
+            // Mark the token as used
+            await trx
                .update(setupTokens)
                .set({
                    used: true,
                    dateUsed: moment().toISOString()
                })
-                .where(
-                    and(
-                        eq(setupTokens.token, setupToken),
-                        eq(setupTokens.used, false)
-                    )
-                )
-                .returning({ tokenId: setupTokens.tokenId });
-
-            if (!consumed.length) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Invalid setup token"
-                );
-            }
-
-            const [existingAdmin] = await trx
-                .select({ userId: users.userId })
-                .from(users)
-                .where(eq(users.serverAdmin, true))
-                .limit(1);
-
-            if (existingAdmin) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Server admin already exists"
-                );
-            }
-
-            const [existingUser] = await trx
-                .select({ userId: users.userId })
-                .from(users)
-                .where(
-                    and(
-                        eq(users.email, email),
-                        eq(users.type, UserType.Internal)
-                    )
-                )
-                .limit(1);
-
-            if (existingUser) {
-                throw createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "A user with that email address already exists"
-                );
-            }
+                .where(eq(setupTokens.tokenId, validToken.tokenId));

+            // Create the server admin user
            await trx.insert(users).values({
                userId: userId,
                email: email,
@@ -119,9 +111,6 @@ export async function setServerAdmin(
            status: HttpCode.OK
        });
    } catch (e) {
-        if (createHttpError.isHttpError(e)) {
-            return next(e);
-        }
        logger.error(e);
        return next(
            createHttpError(
@@ -48,7 +48,7 @@ export async function validateSetupToken(
            return response<ValidateSetupTokenResponse>(res, {
                data: {
                    valid: false,
-                    message: "Invalid setup token"
+                    message: "Invalid or expired setup token"
                },
                success: true,
                error: false,
@@ -87,6 +87,12 @@ authenticated.get("/org/checkId", org.checkId);
 authenticated.put("/org", getUserOrgs, org.createOrg);

 authenticated.get("/orgs", verifyUserIsServerAdmin, org.listOrgs);
+authenticated.get("/admin/orgs", verifyUserIsServerAdmin, org.adminListOrgs);
+authenticated.delete(
+    "/admin/org/:orgId",
+    verifyUserIsServerAdmin,
+    org.adminDeleteOrg
+);
 authenticated.get("/user/:userId/orgs", verifyIsLoggedInUser, org.listUserOrgs);

 authenticated.get(
@@ -0,0 +1,98 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
+import { db, orgs } from "@server/db";
+import { eq } from "drizzle-orm";
+
+const adminDeleteOrgSchema = z.strictObject({
+    orgId: z.string()
+});
+
+export type AdminDeleteOrgResponse = {};
+
+registry.registerPath({
+    method: "delete",
+    path: "/admin/org/{orgId}",
+    description: "Delete any organization in the system (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: adminDeleteOrgSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function adminDeleteOrg(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = adminDeleteOrgSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (!org) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Organization with ID ${orgId} not found`
+                )
+            );
+        }
+
+        const result = await deleteOrgById(orgId);
+        sendTerminationMessages(result);
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Organization deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}
@@ -0,0 +1,241 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, users } from "@server/db";
+import { orgs, resources, sites, userOrgs } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { and, asc, desc, eq, like, or, sql, type SQL } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+const adminListOrgsSchema = z.strictObject({
+    pageSize: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional(),
+    sort_by: z
+        .enum(["name", "createdAt"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["name", "createdAt"],
+            description: "Field to sort by"
+        }),
+    order: z
+        .enum(["asc", "desc"])
+        .optional()
+        .default("asc")
+        .catch("asc")
+        .openapi({
+            type: "string",
+            enum: ["asc", "desc"],
+            default: "asc",
+            description: "Sort order"
+        })
+});
+
+export type AdminOrgRow = {
+    orgId: string;
+    name: string;
+    subnet: string | null;
+    utilitySubnet: string | null;
+    createdAt: string | null;
+    userCount: number;
+    siteCount: number;
+    resourceCount: number;
+    owner: {
+        userId: string;
+        username: string;
+    } | null;
+};
+
+export type AdminListOrgsResponse = PaginatedResponse<{
+    orgs: AdminOrgRow[];
+}>;
+
+const AdminListOrgsResponseDataSchema = z.object({
+    orgs: z.array(
+        z.object({
+            orgId: z.string(),
+            name: z.string(),
+            subnet: z.string().nullable(),
+            createdAt: z.string().nullable(),
+            userCount: z.number(),
+            siteCount: z.number(),
+            resourceCount: z.number()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        page: z.number(),
+        pageSize: z.number()
+    })
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/admin/orgs",
+    description:
+        "List all organizations in the system with usage counts (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        query: adminListOrgsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        AdminListOrgsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
+export async function adminListOrgs(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = adminListOrgsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const { pageSize, page, query, sort_by, order } = parsedQuery.data;
+
+        let conditions: (SQL<unknown> | undefined)[] = [];
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            conditions.push(
+                or(
+                    like(sql`LOWER(${orgs.name})`, q),
+                    like(sql`LOWER(${orgs.orgId})`, q),
+                    like(sql`LOWER(${orgs.subnet})`, q)
+                )
+            );
+        }
+
+        const sortColumns = {
+            name: orgs.name,
+            createdAt: orgs.createdAt
+        } as const;
+
+        const orderBy = sort_by
+            ? order === "asc"
+                ? asc(sortColumns[sort_by])
+                : desc(sortColumns[sort_by])
+            : asc(orgs.name);
+
+        // Drizzle renders bare column references in the select list without their
+        // table prefix, which would make a correlated subquery compare a column to
+        // itself, so the outer `orgs` side is qualified explicitly.
+        const orgIdRef = sql`${sql.identifier("orgs")}.${sql.identifier("orgId")}`;
+
+        const [countRows, rows] = await Promise.all([
+            db
+                .select({ count: sql<number>`count(*)` })
+                .from(orgs)
+                .where(and(...conditions)),
+            db
+                .selectDistinct({
+                    orgId: orgs.orgId,
+                    name: orgs.name,
+                    subnet: orgs.subnet,
+                    utilitySubnet: orgs.utilitySubnet,
+                    createdAt: orgs.createdAt,
+                    userCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${userOrgs}
+                        WHERE ${userOrgs.orgId} = ${orgIdRef}
+                    )`.as("userCount"),
+                    siteCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${sites}
+                        WHERE ${sites.orgId} = ${orgIdRef}
+                    )`.as("siteCount"),
+                    resourceCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${resources}
+                        WHERE ${resources.orgId} = ${orgIdRef}
+                    )`.as("resourceCount"),
+                    owner: {
+                        userId: users.userId,
+                        username: users.username
+                    }
+                })
+                .from(orgs)
+                .where(and(...conditions, eq(userOrgs.isOwner, true)))
+                .leftJoin(userOrgs, eq(userOrgs.orgId, orgs.orgId))
+                .leftJoin(users, eq(userOrgs.userId, users.userId))
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(orderBy)
+        ]);
+
+        const totalCount = Number(countRows[0]?.count ?? 0);
+
+        return response<AdminListOrgsResponse>(res, {
+            data: {
+                orgs: rows.map((row) => ({
+                    ...row,
+                    userCount: Number(row.userCount ?? 0),
+                    siteCount: Number(row.siteCount ?? 0),
+                    resourceCount: Number(row.resourceCount ?? 0)
+                })),
+                pagination: {
+                    total: totalCount,
+                    page,
+                    pageSize
+                }
+            },
+            success: true,
+            error: false,
+            message: "Organizations retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}
@@ -9,3 +9,5 @@ export * from "./listOrgs";
 export * from "./pickOrgDefaults";
 export * from "./checkOrgUserAccess";
 export * from "./resetOrgBandwidth";
+export * from "./adminListOrgs";
+export * from "./adminDeleteOrg";
@@ -454,14 +454,14 @@ export default async function migration() {
            throw new Error(fromZodError(parsedConfig.error).toString());
        }

-        traefikConfig.experimental.plugins.badger.version = "v1.7.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";

        const updatedTraefikYaml = yaml.dump(traefikConfig);

        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");

        console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.7.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
        );
    } catch (e) {
        console.log(
@@ -459,14 +459,14 @@ export default async function migration() {
            throw new Error(fromZodError(parsedConfig.error).toString());
        }

-        traefikConfig.experimental.plugins.badger.version = "v1.7.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";

        const updatedTraefikYaml = yaml.dump(traefikConfig);

        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");

        console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.7.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
        );
    } catch (e) {
        console.log(
@@ -12,7 +12,6 @@ import { DateTimeValue } from "@app/components/DateTimePicker";
 import { ArrowUpRight, Key, User } from "lucide-react";
 import Link from "next/link";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
-import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { build } from "@server/build";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
@@ -27,7 +26,6 @@ import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { logQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import type { QueryAccessAuditLogResponse } from "@server/routers/auditLogs/types";
-import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";

 export default function GeneralPage() {
    const router = useRouter();
@@ -47,14 +45,12 @@ export default function GeneralPage() {
        resourceId?: string;
        location?: string;
        actor?: string;
-        ip?: string[];
    }>({
        action: searchParams.get("action") || undefined,
        type: searchParams.get("type") || undefined,
        resourceId: searchParams.get("resourceId") || undefined,
        location: searchParams.get("location") || undefined,
-        actor: searchParams.get("actor") || undefined,
-        ip: searchParams.getAll("ip") || undefined
+        actor: searchParams.get("actor") || undefined
    });

    const [currentPage, setCurrentPage] = useState<number>(0);
@@ -180,7 +176,7 @@ export default function GeneralPage() {

    const handleFilterChange = (
        filterType: keyof typeof filters,
-        value: string | string[] | undefined
+        value: string | undefined
    ) => {
        const newFilters = { ...filters, [filterType]: value };
        setFilters(newFilters);
@@ -198,13 +194,10 @@ export default function GeneralPage() {
    ) => {
        const params = new URLSearchParams(searchParams);
        Object.entries(newFilters).forEach(([key, value]) => {
-            params.delete(key);
-            if (typeof value === "string") {
+            if (value) {
                params.set(key, value);
-            } else if (typeof value !== "undefined" && "length" in value) {
-                for (const element of value) {
-                    params.append(key, element);
-                }
+            } else {
+                params.delete(key);
            }
        });
        router.replace(`?${params.toString()}`, { scroll: false });
@@ -212,7 +205,6 @@ export default function GeneralPage() {

    const exportData = async () => {
        try {
-            const { ip, ...restFilters } = filters;
            const params: any = {
                timeStart: dateRange.startDate?.date
                    ? new Date(dateRange.startDate.date).toISOString()
@@ -220,20 +212,13 @@ export default function GeneralPage() {
                timeEnd: dateRange.endDate?.date
                    ? new Date(dateRange.endDate.date).toISOString()
                    : undefined,
-                ...restFilters
+                ...filters
            };

-            // axios serializes arrays as `ip[]=…`, which express's query
-            // parser does not read back as `ip`, so pass them in the URL
-            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
-
-            const response = await api.get(
-                `/org/${orgId}/logs/access/export?${sp.toString()}`,
-                {
-                    responseType: "blob",
-                    params
-                }
-            );
+            const response = await api.get(`/org/${orgId}/logs/access/export`, {
+                responseType: "blob",
+                params
+            });

            const url = window.URL.createObjectURL(new Blob([response.data]));
            const link = document.createElement("a");
@@ -312,24 +297,7 @@ export default function GeneralPage() {
        },
        {
            accessorKey: "ip",
-            header: () => (
-                <span className="px-2">
-                    <ColumnMultiFilterButton
-                        options={(filters.ip ?? []).map((ip) => ({
-                            label: ip,
-                            value: ip
-                        }))}
-                        label={t("ip")}
-                        allowArbitraryValues
-                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
-                        emptyMessage={t("ipFilterEmptyMessage")}
-                        selectedValues={filters.ip ?? []}
-                        onSelectedValuesChange={(value) =>
-                            handleFilterChange("ip", value)
-                        }
-                    />
-                </span>
-            ),
+            header: () => <span className="px-2">{t("ip")}</span>,
            cell: ({ row }) => {
                return row.original.ip ? (
                    row.original.ip
@@ -347,7 +315,7 @@ export default function GeneralPage() {
                            options={filterAttributes.locations.map(
                                (location) => ({
                                    value: location,
-                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
+                                    label: location
                                })
                            )}
                            label={t("location")}
@@ -366,8 +334,7 @@ export default function GeneralPage() {
                    <span className="flex items-center gap-1">
                        {row.original.location ? (
                            <span className="text-muted-foreground text-xs">
-                                {row.original.location}{" "}
-                                {countryCodeToFlagEmoji(row.original.location)}
+                                {row.original.location}
                            </span>
                        ) : (
                            <span className="text-muted-foreground text-xs">
@@ -276,9 +276,7 @@ export default function AiSessionLogsPage() {
            cell: ({ row }) => {
                return (
                    <div className="whitespace-nowrap">
-                        {new Date(
-                            row.original.createdAt * 1000
-                        ).toLocaleString()}
+                        {new Date(row.original.createdAt).toLocaleString()}
                    </div>
                );
            }
@@ -717,8 +715,8 @@ function generateSampleAiSessionLogs(): QueryAiSessionLogResponse["log"] {
        null
    ];

-    const now = Math.floor(Date.now() / 1000);
-    const sevenDaysAgoMs = now - 7 * 24 * 60 * 60;
+    const now = Date.now();
+    const sevenDaysAgoMs = now - 7 * 24 * 60 * 60 * 1000;

    return Array.from({ length: 10 }, (_, i) => {
        const provider =
@@ -23,8 +23,6 @@ import { useMemo, useState, useTransition } from "react";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import type { QueryRequestAuditLogResponse } from "@server/routers/auditLogs/types";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
-import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";
-import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";

 export default function GeneralPage() {
    const router = useRouter();
@@ -49,7 +47,6 @@ export default function GeneralPage() {
        method?: string;
        reason?: string;
        path?: string;
-        ip?: string[];
    }>({
        action: searchParams.get("action") || undefined,
        host: searchParams.get("host") || undefined,
@@ -58,8 +55,7 @@ export default function GeneralPage() {
        actor: searchParams.get("actor") || undefined,
        method: searchParams.get("method") || undefined,
        reason: searchParams.get("reason") || undefined,
-        path: searchParams.get("path") || undefined,
-        ip: searchParams.getAll("ip") || undefined
+        path: searchParams.get("path") || undefined
    });

    const getDefaultDateRange = () => {
@@ -183,7 +179,7 @@ export default function GeneralPage() {

    const handleFilterChange = (
        filterType: keyof typeof filters,
-        value: string | string[] | undefined
+        value: string | undefined
    ) => {
        const newFilters = { ...filters, [filterType]: value };
        setFilters(newFilters);
@@ -201,13 +197,10 @@ export default function GeneralPage() {
    ) => {
        const params = new URLSearchParams(searchParams);
        Object.entries(newFilters).forEach(([key, value]) => {
-            params.delete(key);
-            if (typeof value === "string") {
+            if (value) {
                params.set(key, value);
-            } else if (typeof value !== "undefined" && "length" in value) {
-                for (const element of value) {
-                    params.append(key, element);
-                }
+            } else {
+                params.delete(key);
            }
        });
        router.replace(`?${params.toString()}`, { scroll: false });
@@ -216,7 +209,6 @@ export default function GeneralPage() {
    const exportData = async () => {
        try {
            // Prepare query params for export
-            const { ip, ...restFilters } = filters;
            const params: any = {
                timeStart: dateRange.startDate?.date
                    ? new Date(dateRange.startDate.date).toISOString()
@@ -224,15 +216,11 @@ export default function GeneralPage() {
                timeEnd: dateRange.endDate?.date
                    ? new Date(dateRange.endDate.date).toISOString()
                    : undefined,
-                ...restFilters
+                ...filters
            };

-            // axios serializes arrays as `ip[]=…`, which express's query
-            // parser does not read back as `ip`, so pass them in the URL
-            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
-
            const response = await api.get(
-                `/org/${orgId}/logs/request/export?${sp.toString()}`,
+                `/org/${orgId}/logs/request/export`,
                {
                    responseType: "blob",
                    params
@@ -363,24 +351,7 @@ export default function GeneralPage() {
        },
        {
            accessorKey: "ip",
-            header: ({ column }) => (
-                <span className="px-2">
-                    <ColumnMultiFilterButton
-                        options={(filters.ip ?? []).map((ip) => ({
-                            label: ip,
-                            value: ip
-                        }))}
-                        label={t("ip")}
-                        allowArbitraryValues
-                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
-                        emptyMessage={t("ipFilterEmptyMessage")}
-                        selectedValues={filters.ip ?? []}
-                        onSelectedValuesChange={(value) =>
-                            handleFilterChange("ip", value)
-                        }
-                    />
-                </span>
-            ),
+            header: ({ column }) => <span className="px-2">{t("ip")}</span>,
            cell: ({ row }) => {
                return row.original.ip ? (
                    row.original.ip
@@ -398,7 +369,7 @@ export default function GeneralPage() {
                            options={filterAttributes.locations.map(
                                (location) => ({
                                    value: location,
-                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
+                                    label: location
                                })
                            )}
                            selectedValue={filters.location}
@@ -418,8 +389,7 @@ export default function GeneralPage() {
                    <span className="flex items-center gap-1">
                        {row.original.location ? (
                            <span className="text-muted-foreground text-xs">
-                                {row.original.location}{" "}
-                                {countryCodeToFlagEmoji(row.original.location)}
+                                {row.original.location}
                            </span>
                        ) : (
                            <span className="text-muted-foreground text-xs">
@@ -50,6 +50,8 @@ import {
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { tierMatrix, TierFeature } from "@server/lib/billing/tierMatrix";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import {
    createBrowserGatewayTargetFormSchema,
@@ -57,6 +59,7 @@ import {
    selectedSiteSchema,
    type SshSettingsFormValues
 } from "@app/lib/browserGatewayTargetFormSchema";
+import { DockerManager, DockerState } from "@app/lib/docker";
 import { orgQueries } from "@app/lib/queries";
 import { finalizeSubdomainSanitize } from "@app/lib/subdomain-utils";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -325,20 +328,19 @@ export default function Page() {
    const rawResourcesAllowed =
        env.flags.allowRawResources &&
        (build !== "saas" || remoteExitNodes.length > 0);
+    const enterpriseModesAllowed =
+        !env.flags.disableEnterpriseFeatures;

    const availableTypes = useMemo((): NewResourceType[] => {
-        const base: NewResourceType[] = [
-            "http",
-            "inference",
-            "ssh",
-            "rdp",
-            "vnc"
-        ];
+        const base: NewResourceType[] = ["http", "inference"];
+        if (enterpriseModesAllowed) {
+            base.push("ssh", "rdp", "vnc");
+        }
        if (rawResourcesAllowed) {
            base.push("tcp", "udp");
        }
        return base;
-    }, [rawResourcesAllowed]);
+    }, [enterpriseModesAllowed, rawResourcesAllowed]);

    useEffect(() => {
        if (!availableTypes.includes(resourceType)) {
@@ -0,0 +1,59 @@
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import OrgsTable from "@app/components/OrgsTable";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { AdminListOrgsResponse } from "@server/routers/org";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Organizations"
+};
+
+export const dynamic = "force-dynamic";
+
+type OrganizationsPageProps = {
+    searchParams: Promise<Record<string, string>>;
+};
+
+export default async function OrganizationsPage(props: OrganizationsPageProps) {
+    const searchParams = new URLSearchParams(await props.searchParams);
+
+    let orgs: AdminListOrgsResponse["orgs"] = [];
+    let pagination: AdminListOrgsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<AdminListOrgsResponse>>(
+            `/admin/orgs?${searchParams.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        orgs = responseData.orgs;
+        pagination = responseData.pagination;
+    } catch (e) {}
+
+    const t = await getTranslations();
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("orgsManage")}
+                description={t("orgsDescription")}
+            />
+
+            <OrgsTable
+                orgs={orgs}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}
@@ -6,6 +6,7 @@ import {
    Bot,
    Boxes,
    Building2,
+    Building2Icon,
    Cable,
    ChartLine,
    Coins,
@@ -377,6 +378,11 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                href: "/admin/api-keys",
                icon: <KeyRound className="size-4 flex-none" />
            },
+            {
+                title: "sidebarOrgs",
+                href: "/admin/organizations",
+                icon: <Building2Icon className="size-4 flex-none" />
+            },
            ...(build === "oss" ||
            env?.app.identityProviderMode === "global" ||
            env?.app.identityProviderMode === undefined
@@ -388,7 +394,7 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                      }
                  ]
                : []),
-            ...(build == "enterprise"
+            ...(build === "enterprise"
                ? [
                      {
                          title: "sidebarLicense",
@@ -21,7 +21,7 @@ import { useTranslations } from "next-intl";

 interface FilterOption {
    value: string;
-    label: React.ReactNode;
+    label: string;
 }

 interface ColumnFilterButtonProps {
@@ -32,7 +32,6 @@ interface ColumnFilterButtonProps {
    emptyMessage?: string;
    className?: string;
    label: string;
-    allowArbitraryValues?: boolean;
 }

 export function ColumnFilterButton({
@@ -42,8 +41,7 @@ export function ColumnFilterButton({
    searchPlaceholder = "Search...",
    emptyMessage = "No options found",
    className,
-    label,
-    allowArbitraryValues
+    label
 }: ColumnFilterButtonProps) {
    const [open, setOpen] = useState(false);

@@ -103,7 +101,7 @@ export function ColumnFilterButton({
                            {options.map((option) => (
                                <CommandItem
                                    key={option.value}
-                                    value={option.value}
+                                    value={option.label}
                                    onSelect={() => {
                                        onValueChange(
                                            selectedValue === option.value
@@ -35,7 +35,6 @@ type ColumnMultiFilterButtonProps = {
    emptyMessage?: string;
    className?: string;
    label: string;
-    allowArbitraryValues?: boolean;
 };

 export function ColumnMultiFilterButton({
@@ -45,26 +44,11 @@ export function ColumnMultiFilterButton({
    searchPlaceholder = "Search...",
    emptyMessage = "No options found",
    className,
-    label,
-    allowArbitraryValues
+    label
 }: ColumnMultiFilterButtonProps) {
    const [open, setOpen] = useState(false);
-    const [searchQuery, setSearchQuery] = useState("");
    const t = useTranslations();

-    const visibleOptions = useMemo<FilterOption[]>(() => {
-        const newOptions = [...options];
-
-        if (allowArbitraryValues && searchQuery.trim().length > 0) {
-            newOptions.push({
-                label: searchQuery,
-                value: searchQuery
-            });
-        }
-
-        return newOptions;
-    }, [options, allowArbitraryValues, searchQuery]);
-
    const selectedSet = useMemo(
        () => new Set(selectedValues),
        [selectedValues]
@@ -80,7 +64,7 @@ export function ColumnMultiFilterButton({
                selectedValues[0]
            );
        }
-        return t("multiSelectFilterCount", {
+        return t("accessUsersRoleFilterCount", {
            count: selectedValues.length
        });
    }, [selectedValues, options, t]);
@@ -124,11 +108,7 @@ export function ColumnMultiFilterButton({
                align="start"
            >
                <Command>
-                    <CommandInput
-                        placeholder={searchPlaceholder}
-                        value={searchQuery}
-                        onValueChange={setSearchQuery}
-                    />
+                    <CommandInput placeholder={searchPlaceholder} />
                    <CommandList>
                        <CommandEmpty>{emptyMessage}</CommandEmpty>
                        <CommandGroup>
@@ -143,7 +123,7 @@ export function ColumnMultiFilterButton({
                                    {t("accessFilterClear")}
                                </CommandItem>
                            )}
-                            {visibleOptions.map((option) => (
+                            {options.map((option) => (
                                <CommandItem
                                    key={option.value}
                                    value={option.label}
@@ -0,0 +1,300 @@
+"use client";
+
+import { Button } from "@app/components/ui/button";
+import {
+    ControlledDataTable,
+    type ExtendedColumnDef
+} from "@app/components/ui/controlled-data-table";
+import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { toast } from "@app/hooks/useToast";
+import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
+import type { AdminOrgRow } from "@server/routers/org";
+
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { type PaginationState } from "@tanstack/react-table";
+import {
+    ArrowDown01Icon,
+    ArrowUp10Icon,
+    ArrowUpRight,
+    ChevronsUpDownIcon
+} from "lucide-react";
+import moment from "moment";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useMemo, useState, useTransition } from "react";
+import { useDebouncedCallback } from "use-debounce";
+import ConfirmDeleteDialog from "./ConfirmDeleteDialog";
+
+type OrgTableProps = {
+    orgs: AdminOrgRow[];
+    pagination: PaginationState;
+    rowCount: number;
+};
+
+export default function OrgsTable({
+    orgs,
+    pagination,
+    rowCount
+}: OrgTableProps) {
+    const router = useRouter();
+    const t = useTranslations();
+    const {
+        navigate: filter,
+        isNavigating: isFiltering,
+        searchParams
+    } = useNavigationContext();
+
+    const [isRefreshing, startTransition] = useTransition();
+
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [selectedOrg, setSelectedOrg] = useState<AdminOrgRow | null>();
+    const api = createApiClient(useEnvContext());
+
+    function refreshData() {
+        startTransition(async () => {
+            try {
+                router.refresh();
+            } catch (error) {
+                toast({
+                    title: t("error"),
+                    description: t("refreshError"),
+                    variant: "destructive"
+                });
+            }
+        });
+    }
+
+    function toggleSort(column: string) {
+        const newSearch = getNextSortOrder(column, searchParams);
+
+        filter({
+            searchParams: newSearch
+        });
+    }
+
+    function sortableHeader(column: string, label: string) {
+        const sortOrder = getSortDirection(column, searchParams);
+        const Icon =
+            sortOrder === "asc"
+                ? ArrowDown01Icon
+                : sortOrder === "desc"
+                  ? ArrowUp10Icon
+                  : ChevronsUpDownIcon;
+
+        return (
+            <Button
+                variant="ghost"
+                className="p-3"
+                onClick={() => toggleSort(column)}
+            >
+                {label}
+                <Icon className="ml-2 h-4 w-4" />
+            </Button>
+        );
+    }
+
+    const columns = useMemo<ExtendedColumnDef<AdminOrgRow>[]>(() => {
+        return [
+            {
+                accessorKey: "name",
+                friendlyName: t("name"),
+                enableHiding: false,
+                header: () => sortableHeader("name", t("name"))
+            },
+            {
+                accessorKey: "createdAt",
+                friendlyName: t("createdAt"),
+                header: () => sortableHeader("createdAt", t("createdAt")),
+                cell: ({ row }) => {
+                    const createdAt = row.original.createdAt;
+                    return (
+                        <span>
+                            {createdAt ? moment(createdAt).format("lll") : "-"}
+                        </span>
+                    );
+                }
+            },
+            {
+                accessorKey: "owner",
+                friendlyName: t("accessRoleOwner"),
+                header: () => (
+                    <span className="p-3">{t("accessRoleOwner")}</span>
+                ),
+                cell: ({ row }) => {
+                    const owner = row.original.owner;
+                    return owner ? (
+                        <Button
+                            className="tabular-nums"
+                            asChild
+                            variant="outline"
+                            size="sm"
+                        >
+                            <Link href={`/admin/users/${owner.userId}`}>
+                                {owner.username}
+                                <ArrowUpRight className="ml-2 h-3 w-3" />
+                            </Link>
+                        </Button>
+                    ) : (
+                        <code>-</code>
+                    );
+                }
+            },
+            {
+                accessorKey: "orgId",
+                friendlyName: t("orgId"),
+                header: () => <span className="p-3">{t("orgId")}</span>
+            },
+            {
+                accessorKey: "subnet",
+                friendlyName: t("subnet"),
+                header: () => <span className="p-3">{t("subnet")}</span>,
+                cell: ({ row }) => <span>{row.original.subnet || "-"}</span>
+            },
+            {
+                accessorKey: "utilitySubnet",
+                friendlyName: t("utilitySubnet"),
+                header: () => <span className="p-3">{t("utilitySubnet")}</span>,
+                cell: ({ row }) => (
+                    <span>{row.original.utilitySubnet || "-"}</span>
+                )
+            },
+            {
+                accessorKey: "userCount",
+                friendlyName: t("users"),
+                header: () => <span className="p-3">{t("users")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.userCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "siteCount",
+                friendlyName: t("sites"),
+                header: () => <span className="p-3">{t("sites")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.siteCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "resourceCount",
+                friendlyName: t("resources"),
+                header: () => <span className="p-3">{t("resources")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.resourceCount}
+                    </span>
+                )
+            },
+
+            {
+                id: "actions",
+                enableHiding: false,
+                header: () => <span className="p-3"></span>,
+                cell: ({ row }) => {
+                    const orgRow = row.original;
+                    return (
+                        <div className="flex items-center gap-2 justify-end">
+                            <Button
+                                onClick={() => {
+                                    setSelectedOrg(orgRow);
+                                    setIsDeleteModalOpen(true);
+                                }}
+                                variant="outline"
+                                className="text-red-400 focus:text-destructive "
+                            >
+                                {t("delete")}
+                            </Button>
+                        </div>
+                    );
+                }
+            }
+        ];
+    }, [t, searchParams]);
+
+    const handlePaginationChange = (newPage: PaginationState) => {
+        searchParams.set("page", (newPage.pageIndex + 1).toString());
+        searchParams.set("pageSize", newPage.pageSize.toString());
+        filter({
+            searchParams
+        });
+    };
+
+    const handleSearchChange = useDebouncedCallback((query: string) => {
+        searchParams.set("query", query);
+        searchParams.delete("page");
+        filter({
+            searchParams
+        });
+    }, 300);
+
+    async function deleteOrg(orgId: string) {
+        try {
+            const res = await api.delete(`/admin/org/${orgId}`);
+            toast({
+                title: t("orgDeleted"),
+                description: t("orgDeletedMessage")
+            });
+        } catch (err) {
+            console.error(err);
+            toast({
+                variant: "destructive",
+                title: t("orgErrorDelete"),
+                description: formatAxiosError(err, t("orgErrorDeleteMessage"))
+            });
+        } finally {
+            router.refresh();
+        }
+    }
+
+    return (
+        <>
+            {selectedOrg && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={(val) => {
+                        setIsDeleteModalOpen(val);
+                        setSelectedOrg(null);
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("orgQuestionRemove")}</p>
+                            <p>{t("orgMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("orgDeleteConfirm")}
+                    onConfirm={async () => {
+                        startTransition(() => deleteOrg(selectedOrg.orgId));
+                    }}
+                    string={selectedOrg.name}
+                    title={t("orgDelete")}
+                />
+            )}
+            <ControlledDataTable
+                columns={columns}
+                rows={orgs}
+                tableId="admin-orgs-table"
+                searchPlaceholder={t("orgSearch")}
+                pagination={pagination}
+                onPaginationChange={handlePaginationChange}
+                searchQuery={searchParams.get("query")?.toString()}
+                onSearch={handleSearchChange}
+                onRefresh={refreshData}
+                isRefreshing={isRefreshing || isFiltering}
+                rowCount={rowCount}
+                columnVisibility={{
+                    subnet: false,
+                    utilitySubnet: false,
+                    orgId: false
+                }}
+                enableColumnVisibility
+                stickyLeftColumn="name"
+                stickyRightColumn="actions"
+            />
+        </>
+    );
+}
@@ -21,14 +21,12 @@ import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
-import { build } from "@server/build";
-import { UpdateResourceResponse } from "@server/routers/resource";
 import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
+import { UpdateResourceResponse } from "@server/routers/resource";
 import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";
@@ -52,7 +52,6 @@ import {
 } from "./ui/controlled-data-table";

 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { durationToMs } from "@app/lib/durationToMs";
 import { orgQueries, productUpdatesQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import semver from "semver";
@@ -1,74 +0,0 @@
-import { assertEquals } from "@test/assert";
-import { detectLocale } from "./detectLocale";
-
-function runTests() {
-    assertEquals(
-        detectLocale("zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6"),
-        "zh-TW",
-        "An exact regional match should take precedence over a language fallback"
-    );
-    assertEquals(
-        detectLocale("ZH-tw"),
-        "zh-TW",
-        "Locale matching should be case-insensitive"
-    );
-    assertEquals(
-        detectLocale("  zh-TW ; q=1 , zh-CN;q=0.8 "),
-        "zh-TW",
-        "Whitespace and quality parameters should not prevent an exact match"
-    );
-    assertEquals(
-        detectLocale("zh-CN,zh-TW;q=0.9"),
-        "zh-CN",
-        "Simplified Chinese should still match exactly"
-    );
-    assertEquals(
-        detectLocale("zh"),
-        "zh-CN",
-        "A generic Chinese preference should retain the existing fallback"
-    );
-    assertEquals(
-        detectLocale("en-GB,en;q=0.9"),
-        "en-US",
-        "An unsupported region should fall back to a supported locale for the language"
-    );
-    assertEquals(
-        detectLocale("ja-JP,zh-TW;q=0.9"),
-        "zh-TW",
-        "The next preference should be used when a language is unsupported"
-    );
-    assertEquals(
-        detectLocale("zh-CN;q=0.5,zh-TW;q=0.9"),
-        "zh-TW",
-        "Preferences should be evaluated by quality"
-    );
-    assertEquals(
-        detectLocale("zh-TW;q=0,fr-FR;q=0.8"),
-        "fr-FR",
-        "Locales with zero quality should be excluded"
-    );
-    assertEquals(
-        detectLocale("*,de-DE;q=0.8"),
-        "de-DE",
-        "A wildcard should not obscure a supported preference"
-    );
-    assertEquals(
-        detectLocale("ja-JP"),
-        undefined,
-        "An unsupported language should not match"
-    );
-    assertEquals(
-        detectLocale(""),
-        undefined,
-        "An empty Accept-Language header should not match"
-    );
-
-    console.log("All locale detection tests passed!");
-}
-
-try {
-    runTests();
-} catch (error) {
-    console.error("Locale detection test failed:", error);
-    process.exit(1);
-}
@@ -1,48 +0,0 @@
-import { Locale, locales } from "./config";
-
-export function detectLocale(acceptLanguage: string): Locale | undefined {
-    const browserLocales = acceptLanguage
-        .split(",")
-        .map((entry, index) => {
-            const [locale, ...parameters] = entry.trim().split(";");
-            const qualityParameter = parameters.find((parameter) =>
-                parameter.trim().toLowerCase().startsWith("q=")
-            );
-            const quality = qualityParameter
-                ? Number(qualityParameter.trim().slice(2))
-                : 1;
-
-            return {
-                locale: locale.trim().toLowerCase(),
-                quality,
-                index
-            };
-        })
-        .filter(
-            ({ locale, quality }) =>
-                locale && locale !== "*" && quality > 0 && quality <= 1
-        )
-        .sort(
-            (left, right) =>
-                right.quality - left.quality || left.index - right.index
-        );
-
-    for (const { locale: browserLocale } of browserLocales) {
-        const exactMatch = locales.find(
-            (locale) => locale.toLowerCase() === browserLocale
-        );
-        if (exactMatch) {
-            return exactMatch;
-        }
-
-        const browserLanguage = browserLocale.split("-")[0];
-        const languageMatch = locales.find(
-            (locale) => locale.split("-")[0].toLowerCase() === browserLanguage
-        );
-        if (languageMatch) {
-            return languageMatch;
-        }
-    }
-
-    return undefined;
-}
@@ -1,8 +1,3 @@
-import {
-    getAiBudgetScopeListPath,
-    type AiBudgetScope
-} from "@app/lib/aiBudgetScope";
-import type { AiProviderType } from "@app/lib/aiProviderDefaults";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 import { build } from "@server/build";
@@ -10,21 +5,15 @@ import {
    StatusHistoryResponse,
    type BatchedStatusHistoryResponse
 } from "@server/lib/statusHistory";
-import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
-import type {
-    ListAiModelsResponse,
-    ListAiProvidersResponse,
-    ListCatalogModelsResponse
-} from "@server/routers/aiProvider/types";
 import type { ListAlertRulesResponse } from "@server/routers/alertRule/types";
 import type {
+    QueryRequestAnalyticsResponse,
    QueryAiUsageFilterOptionsResponse,
    QueryAiUsageOverviewResponse,
    QueryAiUsageProvidersResponse,
    QueryAiUsageResourcesResponse,
    QueryAiUsageUsersRolesResponse,
-    QueryAiUsageVirtualApiKeysResponse,
-    QueryRequestAnalyticsResponse
+    QueryAiUsageVirtualApiKeysResponse
 } from "@server/routers/auditLogs";
 import type {
    QueryAccessAuditLogResponse,
@@ -45,7 +34,6 @@ import type {
 import type { GetDomainResponse } from "@server/routers/domain/getDomain";
 import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
-import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
 import type {
    LauncherResource,
    ListLauncherGroupsResponse,
@@ -55,8 +43,9 @@ import type {
    ListLauncherSitesResponse,
    ListLauncherViewsResponse
 } from "@server/routers/launcher/types";
+import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
+import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type { GetResourcePolicyResponse } from "@server/routers/policy";
-import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type {
    GetResourcePoliciesResponse,
    GetResourceWhitelistResponse,
@@ -70,6 +59,7 @@ import type {
 import type { GetResourceResponse } from "@server/routers/resource/getResource";
 import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
 import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
+import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type { ListRolesResponse } from "@server/routers/role";
 import type { ListSitesResponse } from "@server/routers/site";
 import type {
@@ -81,8 +71,18 @@ import type {
 } from "@server/routers/siteResource";
 import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { ListTargetsResponse } from "@server/routers/target";
+import type {
+    ListAiModelsResponse,
+    ListAiProvidersResponse,
+    ListCatalogModelsResponse
+} from "@server/routers/aiProvider/types";
+import type { AiProviderType } from "@app/lib/aiProviderDefaults";
+import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
+import {
+    getAiBudgetScopeListPath,
+    type AiBudgetScope
+} from "@app/lib/aiBudgetScope";
 import type { ListUsersResponse } from "@server/routers/user";
-import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type ResponseT from "@server/types/Response";
 import {
    infiniteQueryOptions,
@@ -1000,8 +1000,7 @@ export const httpLogsFiltersSchema = z.object({
    actor: z.string().optional().catch(undefined),
    method: z.string().optional().catch(undefined),
    reason: z.string().optional().catch(undefined),
-    path: z.string().optional().catch(undefined),
-    ip: z.array(z.string()).optional().catch(undefined)
+    path: z.string().optional().catch(undefined)
 });

 export type HttpLogFilters = z.output<typeof httpLogsFiltersSchema>;
@@ -1027,8 +1026,7 @@ export const accessLogsFiltersSchema = z.object({
    action: z.string().optional().catch(undefined),
    location: z.string().optional().catch(undefined),
    actor: z.string().optional().catch(undefined),
-    type: z.string().optional().catch(undefined),
-    ip: z.array(z.string()).optional().catch(undefined)
+    type: z.string().optional().catch(undefined)
 });

 export type AccessLogFilters = z.output<typeof accessLogsFiltersSchema>;
@@ -1141,13 +1139,10 @@ export const logQueries = {
        queryOptions({
            queryKey: ["REQUEST_LOGS", orgId, "ALL", filters] as const,
            queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ip, ...rest } = filters;
-                const sp = new URLSearchParams(
-                    (ip ?? []).map((ip) => ["ip", ip])
-                );
+                const { page, pageSize, ...rest } = filters;
                const res = await meta!.api.get<
                    AxiosResponse<QueryRequestAuditLogResponse>
-                >(`/org/${orgId}/logs/request?${sp.toString()}`, {
+                >(`/org/${orgId}/logs/request`, {
                    params: {
                        ...rest,
                        limit: pageSize,
@@ -1169,13 +1164,10 @@ export const logQueries = {
        queryOptions({
            queryKey: ["ACCESS_LOGS", orgId, "ALL", filters] as const,
            queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ip, ...rest } = filters;
-                const sp = new URLSearchParams(
-                    (ip ?? []).map((ip) => ["ip", ip])
-                );
+                const { page, pageSize, ...rest } = filters;
                const res = await meta!.api.get<
                    AxiosResponse<QueryAccessAuditLogResponse>
-                >(`/org/${orgId}/logs/access?${sp.toString()}`, {
+                >(`/org/${orgId}/logs/access`, {
                    params: {
                        ...rest,
                        limit: pageSize,
@@ -2,7 +2,6 @@

 import { cookies, headers } from "next/headers";
 import { Locale, defaultLocale, locales } from "@/i18n/config";
-import { detectLocale } from "@/i18n/detectLocale";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";

@@ -48,7 +47,12 @@ export async function getUserLocale(): Promise<Locale> {
    const acceptLang = headerList.get("accept-language");

    if (acceptLang) {
-        const matched = detectLocale(acceptLang);
+        const browserLang = acceptLang.split(",")[0];
+        const matched = locales.find((locale) =>
+            browserLang
+                .toLowerCase()
+                .startsWith(locale.split("-")[0].toLowerCase())
+        );
        if (matched) {
            return matched;
        }
Author	SHA1	Message	Date
Fred KISSIE	9853122a51	✨ delete org	2026-09-02 00:25:49 +02:00
Fred KISSIE	c411a1a5b9	🚧 wip	2026-08-28 22:49:51 +02:00
Fred KISSIE	a4d9365563	♻️ Only show the username instead of the `name+username`	2026-08-28 22:09:01 +02:00
Fred KISSIE	e9f7678b90	✨ List of orgs, with all columns	2026-08-28 22:00:06 +02:00
Fred KISSIE	a904c915d8	✨ List orgs in server	2026-08-28 21:42:20 +02:00
Fred KISSIE	cb84c2954b	🚧 WIP	2026-08-27 00:03:56 +02:00