💄 nice little animation on alert rule field

messages/en-US.json

@@ -1695,6 +1695,8 @@
     "alertingRuleSaved": "Alert rule saved",
     "alertingRuleSavedCreatedDescription": "Your new alert rule was created. You can keep editing it on this page.",
     "alertingRuleSavedUpdatedDescription": "Your changes to this alert rule were saved.",
+    "alertingTestAlertSent": "Test alert sent",
+    "alertingTestAlertSentDescription": "A test alert was sent to the actions configured on this rule.",
     "alertingEditRule": "Edit Alert Rule",
     "alertingCreateRule": "Create Alert Rule",
     "alertingRuleCredenzaDescription": "Choose what to watch, when to fire, and how to notify",
@@ -1804,6 +1806,12 @@
     "alertingRulesBannerDescription": "Each rule ties together what to watch (a site, health check, or resource), when to fire (for example offline or unhealthy), and how to notify your team via email, webhooks, or integrations. Use this list to create, enable, and manage those rules.",
     "alertingHealthChecksBannerTitle": "Monitor Health & Resources",
     "alertingHealthChecksBannerDescription": "Health checks are HTTP or TCP monitors you define once. You can then use them as sources in alert rules so you get notified when a target becomes healthy or unhealthy. Health checks on resources also appear here.",
+    "alertingTestRule": "Test Alert Rule",
+    "alertingAddActionHeading": "Add New Action",
+    "alertingSelectActionType": "Choose an action type",
+    "alertingNoActionsTitle": "No actions configured",
+    "alertingNoActionsSaveDescription": "Add at least one action so this rule can notify someone when it fires.",
+    "alertingNoActionsTestDescription": "Add at least one action before you can test this rule.",
     "standaloneHcTableTitle": "Health Checks",
     "standaloneHcSearchPlaceholder": "Search health checks…",
     "standaloneHcAddButton": "Create Health Check",

server/auth/actions.ts

@@ -151,6 +151,7 @@ export enum ActionsEnum {
     createAlertRule = "createAlertRule",
     updateAlertRule = "updateAlertRule",
     deleteAlertRule = "deleteAlertRule",
+    testAlertRule = "testAlertRule",
     listAlertRules = "listAlertRules",
     listOrgLabels = "listOrgLabels",
     createOrgLabel = "createOrgLabel",

server/emails/templates/AlertNotification.tsx

@@ -31,9 +31,24 @@ export type AlertNotificationProps = {
     orgId: string;
     data: Record<string, unknown>;
     dashboardLink: string;
+    isTestAlert?: boolean;
 };
 
-function getEventMeta(eventType: AlertEventType): {
+function getEventMeta(
+    eventType: AlertEventType,
+    isTestAlert: boolean = false
+): {
+    heading: string;
+    previewText: string;
+    summary: string;
+    statusLabel: string | null;
+    statusColor: string | null;
+} {
+    const meta = getBaseEventMeta(eventType);
+    return isTestAlert ? { ...meta, heading: `[TEST] ${meta.heading}` } : meta;
+}
+
+function getBaseEventMeta(eventType: AlertEventType): {
     heading: string;
     previewText: string;
     summary: string;
@@ -180,8 +195,14 @@ function formatDataItems(
 }
 
 export const AlertNotification = (props: AlertNotificationProps) => {
-    const { eventType, orgId, data, dashboardLink } = props;
+    const {
-    const meta = getEventMeta(eventType);
+        eventType,
+        orgId,
+        data,
+        dashboardLink,
+        isTestAlert = false
+    } = props;
+    const meta = getEventMeta(eventType, isTestAlert);
     const dataItems = formatDataItems(data);
 
     const isToggle =
@@ -242,6 +263,12 @@ export const AlertNotification = (props: AlertNotificationProps) => {
                             Open your dashboard to view more details and manage
                             your alert rules.
                         </EmailText>
+                        {isTestAlert && (
+                            <EmailText>
+                                This is a test alert. No action is required,
+                                and no real event has occurred.
+                            </EmailText>
+                        )}
 
                         <EmailSection>
                             <ButtonLink href={dashboardLink}>

server/lib/readConfigFile.ts

@@ -266,13 +266,13 @@ export const configSchema = z
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(10),
+                            .default(30),
                         burst: z
                             .number()
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(16)
+                            .default(50)
                     })
                     .optional()
                     .prefault({})

server/private/lib/alerts/processTestAlerts.ts

@@ -0,0 +1,105 @@
+import { db, userOrgRoles, users } from "@server/db";
+import logger from "@server/logger";
+import type {
+    EmailAlertAction,
+    TestAlertContext,
+    WebhookAlertConfig
+} from "@server/routers/alertRule/types";
+import { eq, inArray } from "drizzle-orm";
+import { sendAlertEmail } from "./sendAlertEmail";
+import { sendAlertWebhook } from "./sendAlertWebhook";
+
+export async function processTestAlerts(context: TestAlertContext) {
+    // Process email actions
+    const emailActions = context.actions.filter(
+        (action) => action.type === "email"
+    );
+    for (const action of emailActions) {
+        try {
+            const recipients = await resolveEmailRecipients(action);
+            if (recipients.length > 0) {
+                await sendAlertEmail(recipients, {
+                    ...context,
+                    isTest: true
+                });
+            }
+        } catch (err) {
+            logger.error(`processTestAlerts: failed to send alert email`, err);
+        }
+    }
+
+    // Process webhook actions
+    const webhookActions = context.actions.filter(
+        (action) => action.type === "webhook"
+    );
+
+    for (const action of webhookActions) {
+        try {
+            let webhookConfig: WebhookAlertConfig = { authType: "none" };
+
+            if (action.config) {
+                try {
+                    webhookConfig = JSON.parse(
+                        action.config
+                    ) as WebhookAlertConfig;
+                } catch (err) {
+                    logger.error(
+                        `processTestAlerts: failed to decrypt webhook`,
+                        err
+                    );
+                    continue;
+                }
+            }
+
+            await sendAlertWebhook(action.webhookUrl, webhookConfig, {
+                ...context,
+                isTest: true
+            });
+        } catch (err) {
+            logger.error(
+                `processTestAlerts: failed to send alert webhook `,
+                err
+            );
+        }
+    }
+}
+
+/**
+ * Resolves all email addresses for a given `emailActionId`.
+ *
+ * Recipients may be:
+ * - Direct users (by `userId`)
+ * - All users in a role (by `roleId`, resolved via `userOrgRoles`)
+ * - Direct external email addresses
+ */
+async function resolveEmailRecipients(
+    action: EmailAlertAction
+): Promise<string[]> {
+    const emailList: string[] = [];
+
+    emailList.push(...(action.emails ?? []));
+
+    if (action.userIds && action.userIds?.length > 0) {
+        const userList = await db
+            .select({ email: users.email })
+            .from(users)
+            .where(inArray(users.userId, action.userIds));
+
+        emailList.push(
+            ...userList.filter((u) => u.email !== null).map((u) => u.email!)
+        );
+    }
+    if (action.roleIds && action.roleIds?.length > 0) {
+        const userList = await db
+            .select({ email: users.email })
+            .from(userOrgRoles)
+            .innerJoin(users, eq(userOrgRoles.userId, users.userId))
+            .where(inArray(userOrgRoles.roleId, action.roleIds.map(Number)));
+
+        emailList.push(
+            ...userList.filter((u) => u.email !== null).map((u) => u.email!)
+        );
+    }
+
+    return [...new Set(emailList)];
+}

server/private/lib/alerts/sendAlertEmail.ts

@@ -15,7 +15,21 @@ import { sendEmail } from "@server/emails";
 import AlertNotification from "@server/emails/templates/AlertNotification";
 import config from "@server/lib/config";
 import logger from "@server/logger";
-import { AlertContext } from "@server/routers/alertRule/types";
+import { type AlertEventType } from "@server/routers/alertRule/types";
+
+type EmailAlertContext = {
+    eventType: AlertEventType;
+    orgId: string;
+    /** Set for site_online / site_offline events */
+    siteId?: number;
+    /** Set for health_check_* events */
+    healthCheckId?: number;
+    /** Set for resource_* events */
+    resourceId?: number;
+    /** Human-readable context data included in emails and webhook payloads */
+    data: Record<string, unknown>;
+    isTest?: boolean;
+};
 
 /**
  * Sends an alert notification email to every address in `recipients`.
@@ -27,7 +41,7 @@ import { AlertContext } from "@server/routers/alertRule/types";
  */
 export async function sendAlertEmail(
     recipients: string[],
-    context: AlertContext
+    context: EmailAlertContext
 ): Promise<void> {
     if (recipients.length === 0) {
         return;
@@ -46,7 +60,8 @@ export async function sendAlertEmail(
                     eventType: context.eventType,
                     orgId: context.orgId,
                     data: context.data,
-                    dashboardLink
+                    dashboardLink,
+                    isTestAlert: context.isTest
                 }),
                 {
                     from,
@@ -70,34 +85,35 @@ export async function sendAlertEmail(
 // Helpers
 // ---------------------------------------------------------------------------
 
-function buildSubject(context: AlertContext): string {
+function buildSubject(context: EmailAlertContext): string {
+    const prefix = context.isTest ? "[Test Alert]" : "[Alert]";
     switch (context.eventType) {
         case "site_online":
-            return "[Alert] Site Back Online";
+            return `${prefix} Site Back Online`;
         case "site_offline":
-            return "[Alert] Site Offline";
+            return `${prefix} Site Offline`;
         case "site_toggle":
-            return "[Alert] Site Status Changed";
+            return `${prefix} Site Status Changed`;
         case "health_check_healthy":
-            return "[Alert] Health Check Recovered";
+            return `${prefix} Health Check Recovered`;
         case "health_check_unhealthy":
-            return "[Alert] Health Check Failing";
+            return `${prefix} Health Check Failing`;
         case "health_check_toggle":
-            return "[Alert] Health Check Status Changed";
+            return `${prefix} Health Check Status Changed`;
         case "resource_healthy":
-            return "[Alert] Resource Healthy";
+            return `${prefix} Resource Healthy`;
         case "resource_unhealthy":
-            return "[Alert] Resource Unhealthy";
+            return `${prefix} Resource Unhealthy`;
         case "resource_degraded":
-            return "[Alert] Resource Degraded";
+            return `${prefix} Resource Degraded`;
         case "resource_toggle":
-            return "[Alert] Resource Status Changed";
+            return `${prefix} Resource Status Changed`;
         default: {
             // Exhaustiveness fallback – should never be reached with a
             // well-typed caller, but keeps runtime behaviour predictable.
             const _exhaustive: never = context.eventType;
             void _exhaustive;
-            return "[Alert] Event Notification";
+            return `${prefix} Event Notification`;
         }
     }
 }

server/private/lib/alerts/sendAlertWebhook.ts

@@ -14,13 +14,28 @@
 import logger from "@server/logger";
 import {
     AlertContext,
-    WebhookAlertConfig
+    WebhookAlertConfig,
+    type AlertEventType
 } from "@server/routers/alertRule/types";
 
 const REQUEST_TIMEOUT_MS = 15_000;
 const MAX_RETRIES = 3;
 const RETRY_BASE_DELAY_MS = 500;
 
+type WebhookAlertContext = {
+    eventType: AlertEventType;
+    orgId: string;
+    /** Set for site_online / site_offline events */
+    siteId?: number;
+    /** Set for health_check_* events */
+    healthCheckId?: number;
+    /** Set for resource_* events */
+    resourceId?: number;
+    /** Human-readable context data included in emails and webhook payloads */
+    data: Record<string, unknown>;
+    isTest?: boolean;
+};
+
 /**
  * Sends a single webhook POST for an alert event.
  *
@@ -40,14 +55,14 @@ const RETRY_BASE_DELAY_MS = 500;
 export async function sendAlertWebhook(
     url: string,
     webhookConfig: WebhookAlertConfig,
-    context: AlertContext
+    context: WebhookAlertContext
 ): Promise<void> {
     const eventType = context.eventType;
     const timestamp = new Date().toISOString();
     const status = deriveStatus(eventType, context.data);
     const data = { orgId: context.orgId, ...context.data };
 
-    let body: string;
+    let body: Record<string, any>;
     if (webhookConfig.useBodyTemplate && webhookConfig.bodyTemplate?.trim()) {
         body = renderTemplate(webhookConfig.bodyTemplate, {
             event: eventType,
@@ -56,7 +71,11 @@ export async function sendAlertWebhook(
             data
         });
     } else {
-        body = JSON.stringify({ event: eventType, timestamp, status, data });
+        body = { event: eventType, timestamp, status, data };
+    }
+
+    if (body.data && context.isTest) {
+        body.data.test = true;
     }
 
     const headers = buildHeaders(webhookConfig);
@@ -75,7 +94,7 @@ export async function sendAlertWebhook(
             response = await fetch(url, {
                 method: webhookConfig.method ?? "POST",
                 headers,
-                body,
+                body: JSON.stringify(body),
                 signal: controller.signal
             });
         } catch (err: unknown) {
@@ -247,7 +266,10 @@ interface TemplateContext {
  *      left untouched.
  *   3. The fixed top-level keys: event, timestamp, status.
  */
-function renderTemplate(template: string, ctx: TemplateContext): string {
+function renderTemplate(
+    template: string,
+    ctx: TemplateContext
+): Record<string, any> {
     // Step 1 – expand {{data}} first so its contents are already serialised
     // and won't be touched by later passes.
     let rendered = template.replace(/\{\{data\}\}/g, JSON.stringify(ctx.data));
@@ -280,20 +302,19 @@ function renderTemplate(template: string, ctx: TemplateContext): string {
     // Validate the rendered result is valid JSON; if not, log a warning and
     // fall back to the default payload so the webhook still fires.
     try {
-        JSON.parse(rendered);
+        return JSON.parse(rendered);
-        return rendered;
     } catch {
         logger.warn(
             `sendAlertWebhook: body template produced invalid JSON for event ` +
                 `"${ctx.event}" destined for a webhook. Falling back to default ` +
                 `payload. Check that {{data}} is NOT wrapped in quotes in your template.`
         );
-        return JSON.stringify({
+        return {
             event: ctx.event,
             timestamp: ctx.timestamp,
             status: ctx.status,
             data: ctx.data
-        });
+        };
     }
 }
 

server/private/routers/alertRule/index.ts

@@ -15,4 +15,5 @@ export * from "./createAlertRule";
 export * from "./updateAlertRule";
 export * from "./deleteAlertRule";
 export * from "./listAlertRules";
-export * from "./getAlertRule";
+export * from "./getAlertRule";
+export * from "./testAlertRule";

server/private/routers/alertRule/testAlertRule.ts

@@ -0,0 +1,196 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { getRandomItemInArray } from "@app/lib/getRandomItemInArray";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { processTestAlerts } from "@server/private/lib/alerts/processTestAlerts";
+import { type AlertAction } from "@server/routers/alertRule/types";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import type { TriggerSiteAlertResponse } from "../alertEvents";
+import {
+    HC_EVENT_TYPES,
+    SITE_EVENT_TYPES,
+    RESOURCE_EVENT_TYPES
+} from "./createAlertRule";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const webhookActionSchema = z.strictObject({
+    webhookUrl: z.url(),
+    config: z.string().optional(),
+    enabled: z.boolean().optional().default(true)
+});
+
+const bodySchema = z.object({
+    eventType: z.enum([
+        ...HC_EVENT_TYPES,
+        ...SITE_EVENT_TYPES,
+        ...RESOURCE_EVENT_TYPES
+    ]),
+    // Email recipients (flat)
+    userIds: z.array(z.string().nonempty()).optional().default([]),
+    roleIds: z.array(z.number()).optional().default([]),
+    emails: z.array(z.email()).optional().default([]),
+    // Webhook actions
+    webhookActions: z.array(webhookActionSchema).optional().default([])
+});
+
+export async function testAlertRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const body = parsedBody.data;
+        const collectedActions: AlertAction[] = [];
+        if (
+            body.emails.length > 0 ||
+            body.roleIds.length > 0 ||
+            body.userIds.length > 0
+        ) {
+            collectedActions.push({
+                type: "email",
+                emails: body.emails,
+                roleIds: body.roleIds,
+                userIds: body.userIds
+            });
+        }
+
+        for (const action of body.webhookActions) {
+            collectedActions.push({
+                type: "webhook",
+                ...action
+            });
+        }
+
+        let data: Record<string, any> = {};
+        switch (body.eventType) {
+            case "site_toggle":
+                data = {
+                    status: getRandomItemInArray(["online", "offline"]),
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "site_offline":
+                data = {
+                    status: "offline",
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "site_online":
+                data = {
+                    status: "online",
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "resource_toggle":
+                data = {
+                    status: getRandomItemInArray([
+                        "healthy",
+                        "unhealthy",
+                        "degraded"
+                    ]),
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_healthy":
+                data = {
+                    status: "healthy",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_unhealthy":
+                data = {
+                    status: "unhealthy",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_degraded":
+                data = {
+                    status: "degraded",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "health_check_toggle":
+                data = {
+                    status: getRandomItemInArray(["healthy", "unhealthy"]),
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+            case "health_check_healthy":
+                data = {
+                    status: "healthy",
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+            case "health_check_unhealthy":
+                data = {
+                    status: "unhealthy",
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+
+            default:
+                break;
+        }
+
+        // TODO: process alert rule
+        await processTestAlerts({
+            eventType: body.eventType,
+            orgId,
+            actions: collectedActions,
+            data
+        });
+
+        return response<TriggerSiteAlertResponse>(res, {
+            data: { success: true },
+            success: true,
+            error: false,
+            message: "Alert triggered successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domains, orgDomains } from "@server/db";
+import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,14 +63,28 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .innerJoin(
+        .leftJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .where(and(inArray(certificates.domain, domainList)));
+        .leftJoin(
+            domainNamespaces,
+            eq(domains.domainId, domainNamespaces.domainId)
+        )
+        .where(
+            and(
+                inArray(certificates.domain, domainList),
+                // Namespace domains are shared across all orgs, so they skip
+                // the org-ownership check (mirrors verifyCertificateAccess).
+                or(
+                    isNotNull(orgDomains.orgId),
+                    isNotNull(domainNamespaces.domainNamespaceId)
+                )
+            )
+        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -110,19 +124,27 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .innerJoin(
+            .leftJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
+            .leftJoin(
+                domainNamespaces,
+                eq(domains.domainId, domainNamespaces.domainId)
+            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
+                    ),
+                    or(
+                        isNotNull(orgDomains.orgId),
+                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

server/private/routers/external.ts

@@ -808,6 +808,14 @@ authenticated.get(
     alertRule.listAlertRules
 );
 
+authenticated.post(
+    "/org/:orgId/test-alert-rule",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.testAlertRule),
+    alertRule.testAlertRule
+);
+
 authenticated.get(
     "/org/:orgId/alert-rule/:alertRuleId",
     verifyValidLicense,

server/routers/alertRule/types.ts

@@ -124,3 +124,26 @@ export interface AlertContext {
     /** Human-readable context data included in emails and webhook payloads */
     data: Record<string, unknown>;
 }
+
+export type EmailAlertAction = {
+    type: "email";
+    userIds?: string[];
+    roleIds?: number[];
+    emails?: string[];
+};
+
+export type WebhookAlertAction = {
+    type: "webhook";
+    webhookUrl: string;
+    enabled: boolean;
+    config?: string | undefined;
+};
+
+export type AlertAction = EmailAlertAction | WebhookAlertAction;
+export interface TestAlertContext {
+    eventType: AlertEventType;
+    actions: AlertAction[];
+    orgId: string;
+    /** Human-readable context data included in emails and webhook payloads */
+    data: Record<string, unknown>;
+}

server/routers/badger/verifySession.ts

@@ -127,6 +127,9 @@ export async function verifyResourceSession(
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
+        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
+        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
+
         const clientIp = requestIp
             ? stripPortFromHost(requestIp, badgerVersion)
             : undefined;
@@ -313,9 +316,14 @@ export async function verifyResourceSession(
             return allowed(res, undefined, dontStripSession);
         }
 
-        const redirectPath = `/auth/resource/${encodeURIComponent(
+        // Only offer a browser redirect to clients that can actually follow one and log in
-            resource.resourceGuid
+        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
-        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
+        // an unauthorized response from Badger instead of a login redirect URL.
+        const redirectPath = clientIsBrowser
+            ? `/auth/resource/${encodeURIComponent(
+                  resource.resourceGuid
+              )}?redirect=${encodeURIComponent(originalRequestURL)}`
+            : undefined;
 
         // check for access token in headers
         if (
@@ -1476,6 +1484,46 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
     return cachedCountryCode;
 }
 
+// Permissive by default: only reject known non-browser clients or a missing
+// User-Agent (real browsers always send one). This avoids blocking real
+// browsers whose UA string doesn't match a hardcoded allow-list.
+const NON_BROWSER_USER_AGENT_PATTERNS = [
+    /curl/,
+    /wget/,
+    /python-requests/,
+    /python-urllib/,
+    /go-http-client/,
+    /okhttp/,
+    /axios/,
+    /node-fetch/,
+    /postmanruntime/,
+    /insomnia/,
+    /libwww-perl/,
+    /java\//,
+    /ruby/,
+    /php/,
+    /bot/,
+    /spider/,
+    /crawler/,
+    /headlesschrome/,
+    /phantomjs/,
+    /httpclient/,
+    /prometheus/,
+    /go-resty/,
+    /apache-httpclient/,
+    /scrapy/
+];
+
+function isBrowserUserAgent(userAgent: string | undefined): boolean {
+    if (!userAgent) {
+        return false;
+    }
+
+    const ua = userAgent.toLowerCase();
+
+    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
+}
+
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

server/routers/role/createRole.ts

@@ -34,7 +34,9 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources
+    ActionsEnum.listResources,
+    ActionsEnum.getSiteResource,
+    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,11 +3,13 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
+    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels
+    labels,
+    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        const conditions = [and(eq(siteResources.orgId, orgId))];
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
+        const conditions = [
+            and(
+                eq(siteResources.orgId, orgId),
+                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
+            )
+        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,11 +1,17 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, networks, siteNetworks } from "@server/db";
+import {
+    db,
+    networks,
+    roleSiteResources,
+    siteNetworks,
+    userSiteResources
+} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq } from "drizzle-orm";
+import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -159,10 +165,47 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId)
+            eq(siteResources.orgId, orgId),
+            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/setup/migrationsPg.ts

@@ -28,6 +28,7 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
+import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -55,7 +56,8 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 }
+    { version: "1.21.0", run: m22 },
+    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,6 +47,7 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
+import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -91,7 +92,8 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 }
+    { version: "1.21.0", run: m44 },
+    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -0,0 +1,37 @@
+import { db } from "@server/db/pg/driver";
+import { sql } from "drizzle-orm";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        for (const actionId of actionsToGrant) {
+            await db.execute(sql`
+                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ${actionId}, r."orgId"
+                FROM "roles" r
+                WHERE COALESCE(r."isAdmin", false) = false
+                  AND NOT EXISTS (
+                    SELECT 1 FROM "roleActions" ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ${actionId}
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+        }
+
+        await db.execute(sql`COMMIT`);
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+}

server/setup/scriptsSqlite/1.21.1.ts

@@ -0,0 +1,43 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import path from "path";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.transaction(() => {
+            const insertRoleAction = db.prepare(`
+                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ?, r."orgId"
+                FROM 'roles' r
+                WHERE COALESCE(r."isAdmin", 0) = 0
+                  AND NOT EXISTS (
+                    SELECT 1 FROM 'roleActions' ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ?
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+
+            for (const actionId of actionsToGrant) {
+                insertRoleAction.run(actionId, actionId);
+            }
+        })();
+
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    } finally {
+        db.close();
+    }
+}

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx

@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                     <SettingsSectionDescription>
                         {t("remoteExitNodeNetworkingDescription")}
                         <a
-                            href="https://docs.pangolin.net/placeholder"
+                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
                             target="_blank"
                             rel="noopener noreferrer"
                             className="text-primary hover:underline inline-flex items-center gap-1"

src/components/ContactSalesBanner.tsx

@@ -24,19 +24,21 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <Link
+                        <span className="whitespace-nowrap">
-                            href="https://pangolin.net/contact"
+                            <Link
-                            target="_blank"
+                                href="https://pangolin.net/contact"
-                            rel="noopener noreferrer"
+                                target="_blank"
-                            className="inline-flex items-center gap-1 font-medium text-black-600 underline"
+                                rel="noopener noreferrer"
-                        >
+                                className="inline-flex items-center gap-1 font-medium text-black-600 underline"
-                            {t("contactSalesContactUs")}
+                            >
-                            <ExternalLink className="size-3.5 shrink-0" />
+                                {t("contactSalesContactUs")}
-                        </Link>
+                                <ExternalLink className="size-3.5 shrink-0" />
-                        .
+                            </Link>
+                            .
+                        </span>
                     </span>
                 </div>
             </div>
         </div>
     );
-}
+}

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS } from "input-otp";
+import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,9 +82,11 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="numeric"
+                                            inputMode="text"
                                             autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS}
+                                            pattern={
+                                                REGEXP_ONLY_DIGITS_AND_CHARS
+                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {

src/components/alert-rule-editor/AlertRuleFields.tsx

@@ -45,7 +45,14 @@ import {
 import { getUserDisplayName } from "@app/lib/getUserDisplayName";
 import { orgQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
-import { Bell, ChevronsUpDown, Globe, Plus, Trash2 } from "lucide-react";
+import {
+    Bell,
+    ChevronRightIcon,
+    ChevronsUpDown,
+    Globe,
+    Plus,
+    Trash2
+} from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useEffect, useMemo, useRef, useState } from "react";
 import type { Control, UseFormReturn } from "react-hook-form";
@@ -53,6 +60,7 @@ import { useFormContext, useWatch } from "react-hook-form";
 import { useDebounce } from "use-debounce";
 import { RolesSelector } from "../roles-selector";
 import { UsersSelector } from "../users-selector";
+import { cn } from "@app/lib/cn";
 
 export function AddActionPanel({
     onAdd
@@ -95,6 +103,7 @@ export function AddActionPanel({
     const EXTERNAL_IDS = EXTERNAL_INTEGRATIONS.map((i) => i.id);
 
     const [selected, setSelected] = useState<string | null>("notify");
+    const [isPopoverOpen, setPopoverOpen] = useState(false);
 
     const isPremiumSelected =
         selected !== null && EXTERNAL_IDS.includes(selected as any);
@@ -131,27 +140,46 @@ export function AddActionPanel({
         if (!isBuiltInSelected) return;
         onAdd(selected as AlertRuleFormAction["type"]);
         setSelected(null);
+        setPopoverOpen(false);
     };
 
     return (
-        <div className="space-y-3">
+        <div className="flex flex-col gap-3 items-start">
-            <StrategySelect
+            <h3 className="font-medium">{t("alertingAddActionHeading")}</h3>
-                options={actionTypeOptions}
+            <Popover open={isPopoverOpen} onOpenChange={setPopoverOpen}>
-                value={selected}
+                <PopoverTrigger asChild>
-                cols={2}
+                    <Button type="button" variant="outline">
-                onChange={(v) => setSelected(v)}
+                        {t("alertingSelectActionType")}
-            />
+                        <ChevronRightIcon
-            {isPremiumSelected && <ContactSalesBanner />}
+                            className={cn(
-            {!isPremiumSelected && (
+                                "size-4 transition-transform duration-150",
-                <Button
+                                isPopoverOpen && "rotate-90"
-                    type="button"
+                            )}
-                    disabled={!isBuiltInSelected}
+                        />
-                    onClick={handleAdd}
+                    </Button>
-                >
+                </PopoverTrigger>
-                    <Plus className="h-4 w-4 mr-1" />
+                <PopoverContent className="shadow-md flex flex-col gap-3 w-150">
-                    {t("alertingAddAction")}
+                    <StrategySelect
-                </Button>
+                        options={actionTypeOptions}
-            )}
+                        value={selected}
+                        cols={2}
+                        onChange={(v) => setSelected(v)}
+                    />
+
+                    {isPremiumSelected ? (
+                        <ContactSalesBanner />
+                    ) : (
+                        <Button
+                            type="button"
+                            disabled={!isBuiltInSelected}
+                            onClick={handleAdd}
+                        >
+                            <Plus className="h-4 w-4 mr-1" />
+                            {t("alertingAddAction")}
+                        </Button>
+                    )}
+                </PopoverContent>
+            </Popover>
         </div>
     );
 }

src/components/alert-rule-editor/AlertRuleGraphEditor.tsx

@@ -6,7 +6,9 @@ import {
     AlertRuleSourceFields,
     AlertRuleTriggerFields
 } from "@app/components/alert-rule-editor/AlertRuleFields";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { SettingsContainer } from "@app/components/Settings";
+import { SwitchInput } from "@app/components/SwitchInput";
 import { Button } from "@app/components/ui/button";
 import { Card, CardContent } from "@app/components/ui/card";
 import {
@@ -19,6 +21,7 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
+import { useEnvContext } from "@app/hooks/useEnvContext";
 import { toast } from "@app/hooks/useToast";
 import {
     buildFormSchema,
@@ -27,19 +30,15 @@ import {
     type AlertRuleFormValues
 } from "@app/lib/alertRuleForm";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { useEnvContext } from "@app/hooks/useEnvContext";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type { CreateAlertRuleResponse } from "@server/routers/alertRule/types";
 import type { AxiosResponse } from "axios";
-import { zodResolver } from "@hookform/resolvers/zod";
+import { Cog, Flag, Zap, ZapIcon } from "lucide-react";
-import { ChevronLeft, Cog, Flag, Zap } from "lucide-react";
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { useMemo, useState, type ReactNode } from "react";
-import { useFieldArray, useForm, type Resolver } from "react-hook-form";
 import { useTranslations } from "next-intl";
-import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { useRouter } from "next/navigation";
-import { SwitchInput } from "@app/components/SwitchInput";
+import { useActionState, useMemo, useTransition, type ReactNode } from "react";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { useFieldArray, useForm, type Resolver } from "react-hook-form";
 import { Badge } from "../ui/badge";
 
 const FORM_ID = "alert-rule-form";
@@ -115,7 +114,6 @@ export default function AlertRuleGraphEditor({
     const t = useTranslations();
     const router = useRouter();
     const api = createApiClient(useEnvContext());
-    const [isSaving, setIsSaving] = useState(false);
     const schema = useMemo(() => buildFormSchema(t), [t]);
     const form = useForm<AlertRuleFormValues>({
         resolver: zodResolver(schema) as Resolver<AlertRuleFormValues>,
@@ -127,8 +125,22 @@ export default function AlertRuleGraphEditor({
         name: "actions"
     });
 
-    const onSubmit = form.handleSubmit(async (values) => {
+    const saveAlert = async () => {
-        setIsSaving(true);
+        const isValid = await form.trigger();
+        if (!isValid) {
+            const values = form.getValues();
+            if (values.actions.length === 0) {
+                toast({
+                    variant: "warning",
+                    title: t("alertingNoActionsTitle"),
+                    description: t("alertingNoActionsSaveDescription")
+                });
+            }
+            return;
+        }
+
+        const values = form.getValues();
+
         try {
             const payload = formValuesToApiPayload(values);
             if (isNew) {
@@ -158,14 +170,48 @@ export default function AlertRuleGraphEditor({
                 description: formatAxiosError(e),
                 variant: "destructive"
             });
-        } finally {
-            setIsSaving(false);
         }
-    });
+    };
+
+    const testAlert = async () => {
+        const isValid = await form.trigger("actions");
+        const values = form.getValues();
+
+        if (!isValid) {
+            if (values.actions.length === 0) {
+                toast({
+                    variant: "warning",
+                    title: t("alertingNoActionsTitle"),
+                    description: t("alertingNoActionsTestDescription")
+                });
+            }
+
+            return;
+        }
+
+        try {
+            const payload = formValuesToApiPayload(values);
+            await api.post(`/org/${orgId}/test-alert-rule`, payload);
+
+            toast({
+                title: t("alertingTestAlertSent"),
+                description: t("alertingTestAlertSentDescription")
+            });
+        } catch (e) {
+            toast({
+                title: t("error"),
+                description: formatAxiosError(e),
+                variant: "destructive"
+            });
+        }
+    };
+
+    const [, formAction, isSaving] = useActionState(saveAlert, null);
+    const [isTestingAlert, startTransition] = useTransition();
 
     return (
         <Form {...form}>
-            <form id={FORM_ID} onSubmit={onSubmit}>
+            <form id={FORM_ID} action={formAction}>
                 <SettingsContainer>
                     <PaidFeaturesAlert tiers={tierMatrix.alertingRules} />
                     <div className="flex flex-col lg:flex-row gap-6 lg:gap-8 items-start">
@@ -263,14 +309,29 @@ export default function AlertRuleGraphEditor({
                                                 </FormItem>
                                             )}
                                         />
-                                        <Button
+                                        <div className="flex flex-col items-center w-full gap-3">
-                                            type="submit"
+                                            <Button
-                                            className="w-full"
+                                                type="submit"
-                                            disabled={isSaving}
+                                                className="w-full"
-                                            loading={isSaving}
+                                                disabled={isSaving}
-                                        >
+                                                loading={isSaving}
-                                            {t("save")}
+                                            >
-                                        </Button>
+                                                {t("save")}
+                                            </Button>
+
+                                            <Button
+                                                type="button"
+                                                variant="outline"
+                                                className="w-full gap-1.5"
+                                                onClick={() =>
+                                                    startTransition(testAlert)
+                                                }
+                                                loading={isTestingAlert}
+                                            >
+                                                {t("alertingTestRule")}
+                                                <ZapIcon className="size-3.5 flex-none" />
+                                            </Button>
+                                        </div>
                                     </fieldset>
                                 </CardContent>
                             </Card>

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || initialCertValue === null) {
+    } else if (isError || (!isLoading && data === null)) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }

src/lib/getRandomItemInArray.ts

@@ -0,0 +1,5 @@
+export function getRandomItemInArray<T>(array: T[]) {
+    // Source - https://stackoverflow.com/a/4550514
+    const randomElement = array[Math.floor(Math.random() * array.length)];
+    return randomElement;
+}

src/lib/queries.ts

@@ -1371,7 +1371,7 @@ export const approvalQueries = {
             },
             refetchInterval: (query) => {
                 if (query.state.data) {
-                    return durationToMs(30, "seconds");
+                    return durationToMs(1.5, "minutes");
                 }
                 return false;
             }