Bump the docker-dependencies group across 1 directory with 2 updates

Bumps the docker-dependencies group with 2 updates in the / directory: docker/library/node and node.


Updates `docker/library/node` from 24.18.1-slim to 26.9.0-slim

Updates `node` from 24.18.1-alpine to 26.9.0-alpine

---
updated-dependencies:
- dependency-name: docker/library/node
  dependency-version: 26.9.0-slim
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
- dependency-name: node
  dependency-version: 26.9.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/linting.yml

@@ -3,25 +3,18 @@ name: ESLint
 permissions:
   contents: read
 
-# Disabled from running on PRs: typescript-eslint does not yet support
-# TypeScript 7 (which this repo is on), so eslint currently crashes on
-# every run. Kept as workflow_dispatch so it can still be triggered
-# manually, and re-enabled on pull_request once upstream support lands.
-# https://github.com/typescript-eslint/typescript-eslint/issues/10940
-# on:
-#     pull_request:
-#         paths:
-#             - '**/*.js'
-#             - '**/*.jsx'
-#             - '**/*.ts'
-#             - '**/*.tsx'
-#             - '.eslintrc*'
-#             - 'package.json'
-#             - 'yarn.lock'
-#             - 'pnpm-lock.yaml'
-#             - 'package-lock.json'
 on:
-    workflow_dispatch:
+    pull_request:
+        paths:
+            - '**/*.js'
+            - '**/*.jsx'
+            - '**/*.ts'
+            - '**/*.tsx'
+            - '.eslintrc*'
+            - 'package.json'
+            - 'yarn.lock'
+            - 'pnpm-lock.yaml'
+            - 'package-lock.json'
 
 jobs:
     Linter:

Dockerfile

@@ -1,5 +1,5 @@
 # FROM node:24.18.1-slim AS base
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
+FROM public.ecr.aws/docker/library/node:26.9.0-slim AS base
 
 WORKDIR /app
 
@@ -33,7 +33,7 @@ FROM base AS builder
 RUN npm ci --omit=dev
 
 # FROM node:24.18.1-slim AS runner
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:26.9.0-slim AS runner
 
 WORKDIR /app
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:26.9.0-alpine
 
 WORKDIR /app
 

messages/bg-BG.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Опити за повторно",
     "expectedResponseCodes": "Очаквани кодове за отговор",
     "expectedResponseCodesDescription": "HTTP статус код, указващ здравословно състояние. Ако бъде оставено празно, между 200-300 се счита за здравословно.",
-    "customRequestHeaders": "Персонализирани заглавия на заявката",
-    "customRequestHeadersDescription": "Заглавия на заявката, изпратени до целевите сървъри. По едно на ред: Заглавие-Име: стойност",
-    "customResponseHeaders": "Персонализирани заглавия на отговора",
-    "customResponseHeadersDescription": "Заглавия на отговора, върнати на клиента. По едно на ред: Заглавие-Име: стойност",
+    "customHeaders": "Персонализирани заглавия",
+    "customHeadersDescription": "Add custom headers to be sent when proxying requests. One per line in the format Header-Name: value",
     "headersValidationError": "Заглавията трябва да бъдат във формат: Име на заглавието: стойност.",
     "saveHealthCheck": "Запазване на проверка на здравето",
     "healthCheckSaved": "Проверка на здравето е запазена",

messages/cs-CZ.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Opakovat pokusy",
     "expectedResponseCodes": "Očekávané kódy odezvy",
     "expectedResponseCodesDescription": "HTTP kód stavu, který označuje zdravý stav. Ponecháte-li prázdné, 200-300 je považováno za zdravé.",
-    "customRequestHeaders": "Vlastní záhlaví požadavku",
-    "customRequestHeadersDescription": "Záhlaví požadavku odeslaná do cílů. Jedno na řádek: Název-záhlaví: hodnota",
-    "customResponseHeaders": "Vlastní záhlaví odpovědi",
-    "customResponseHeadersDescription": "Záhlaví odpovědi vrácená klientovi. Jedno na řádek: Název-záhlaví: hodnota",
+    "customHeaders": "Vlastní záhlaví",
+    "customHeadersDescription": "Záhlaví oddělená nová řádka: hodnota",
     "headersValidationError": "Headers must be in the format: Header-Name: value.",
     "saveHealthCheck": "Uložit kontrolu stavu",
     "healthCheckSaved": "Kontrola stavu uložena",

messages/da-DK.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Forsøg igen",
     "expectedResponseCodes": "Forventede svarkoder",
     "expectedResponseCodesDescription": "HTTP-statuskode som indikerer sund status. Hvis den bliver stående tom, regnes 200-300 som sund.",
-    "customRequestHeaders": "Brugerdefinerede anmodnings-headers",
-    "customRequestHeadersDescription": "Anmodnings-headers som sendes til destinationerne. Én pr. linje: Header-navn: værdi",
-    "customResponseHeaders": "Brugerdefinerede svar-headers",
-    "customResponseHeadersDescription": "Svar-headers som sendes tilbage til klienten. Én pr. linje: Header-navn: værdi",
+    "customHeaders": "Brugerdefinerede headers",
+    "customHeadersDescription": "Headers som er adskilt med linje: Overskriftsnavn: værdi",
     "headersValidationError": "Header skal være i formatet: header-navn: værdi.",
     "saveHealthCheck": "Gem Sundhedstjek",
     "healthCheckSaved": "Sundhedstjek Gemt",

messages/de-DE.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Wiederholungsversuche",
     "expectedResponseCodes": "Erwartete Antwortcodes",
     "expectedResponseCodesDescription": "HTTP-Statuscode, der einen gesunden Zustand anzeigt. Wenn leer gelassen, wird 200-300 als gesund angesehen.",
-    "customRequestHeaders": "Eigene Anfrage-Header",
-    "customRequestHeadersDescription": "Anfrage-Header, die an die Ziele gesendet werden. Eine pro Zeile: Header-Name: Wert",
-    "customResponseHeaders": "Eigene Antwort-Header",
-    "customResponseHeadersDescription": "Antwort-Header, die an den Client zurückgesendet werden. Eine pro Zeile: Header-Name: Wert",
+    "customHeaders": "Eigene Kopfzeilen",
+    "customHeadersDescription": "Header neue Zeile getrennt: Header-Name: Wert",
     "headersValidationError": "Header müssen im Format Header-Name: Wert sein.",
     "saveHealthCheck": "Gesundheits-Check speichern",
     "healthCheckSaved": "Gesundheits-Check gespeichert",

messages/en-US.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Are you sure you want to restart the WireGuard tunnel for <b>{name}</b>? The site will briefly lose connectivity.",
     "siteRestartWarning": "The site will briefly disconnect while the tunnel restarts.",
     "siteRestarted": "Site restarted",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "The WireGuard tunnel has been restarted.",
     "siteErrorRestart": "Failed to restart site",
     "siteErrorRestartDescription": "An error occurred while restarting the site.",
     "siteSettingDescription": "Configure the settings on the site",
@@ -834,7 +834,7 @@
     "rulesErrorDuplicatePriorityDescription": "Each rule must have a unique priority number.",
     "rulesErrorValidation": "Invalid rules",
     "rulesErrorValidationRuleDescription": "Rule {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, or ASN).",
     "rulesErrorValueRequired": "Enter a value for this rule.",
     "rulesErrorInvalidCountry": "Invalid country",
     "rulesErrorInvalidCountryDescription": "Select a valid country.",
@@ -2829,10 +2829,8 @@
     "retryAttempts": "Retry Attempts",
     "expectedResponseCodes": "Expected Response Codes",
     "expectedResponseCodesDescription": "HTTP status code that indicates healthy status. If left blank, 200-300 is considered healthy.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Custom Request Headers",
+    "customHeadersDescription": "Request headers sent to the downstream targets. Headers new line separated: Header-Name: value",
     "headersValidationError": "Headers must be in the format: Header-Name: value",
     "saveHealthCheck": "Save Health Check",
     "healthCheckSaved": "Health Check Saved",
@@ -4402,8 +4400,5 @@
     "sessionToolbarShow": "Show toolbar",
     "sessionToolbarHide": "Hide toolbar",
     "actionUpdateSiteApprovals": "Update Site Approvals",
-    "check": "Check",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Check"
 }

messages/es-ES.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Intentos de Reintento",
     "expectedResponseCodes": "Códigos de respuesta esperados",
     "expectedResponseCodesDescription": "Código de estado HTTP que indica un estado saludable. Si se deja en blanco, se considera saludable de 200 a 300.",
-    "customRequestHeaders": "Cabeceras de solicitud personalizadas",
-    "customRequestHeadersDescription": "Cabeceras de solicitud enviadas a los destinos. Una por línea: Nombre-Cabecera: valor",
-    "customResponseHeaders": "Cabeceras de respuesta personalizadas",
-    "customResponseHeadersDescription": "Cabeceras de respuesta devueltas al cliente. Una por línea: Nombre-Cabecera: valor",
+    "customHeaders": "Cabeceras personalizadas",
+    "customHeadersDescription": "Nueva línea de cabeceras separada: Nombre de cabecera: valor",
     "headersValidationError": "Los encabezados deben estar en el formato: Nombre de cabecera: valor.",
     "saveHealthCheck": "Guardar Chequeo de Salud",
     "healthCheckSaved": "Chequeo de Salud Guardado",

messages/fr-FR.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Tentatives de réessai",
     "expectedResponseCodes": "Codes de réponse attendus",
     "expectedResponseCodesDescription": "Code de statut HTTP indiquant un état de santé satisfaisant. Si non renseigné, 200-300 est considéré comme satisfaisant.",
-    "customRequestHeaders": "En-têtes de requête personnalisés",
-    "customRequestHeadersDescription": "En-têtes de requête envoyés aux cibles. Un par ligne : Nom-En-tête : valeur",
-    "customResponseHeaders": "En-têtes de réponse personnalisés",
-    "customResponseHeadersDescription": "En-têtes de réponse renvoyés au client. Un par ligne : Nom-En-tête : valeur",
+    "customHeaders": "En-têtes personnalisés",
+    "customHeadersDescription": "En-têtes séparés par une nouvelle ligne: En-nom: valeur",
     "headersValidationError": "Les entêtes doivent être au format : Header-Name: valeur.",
     "saveHealthCheck": "Sauvegarder la vérification de l'état de santé",
     "healthCheckSaved": "Vérification de l'état de santé enregistrée",

messages/it-IT.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Tentativi di Riprova",
     "expectedResponseCodes": "Codici di Risposta Attesi",
     "expectedResponseCodesDescription": "Codice di stato HTTP che indica lo stato di salute. Se lasciato vuoto, considerato sano è compreso tra 200-300.",
-    "customRequestHeaders": "Intestazioni di richiesta personalizzate",
-    "customRequestHeadersDescription": "Intestazioni di richiesta inviate ai target. Una per riga: Nome-Intestazione: valore",
-    "customResponseHeaders": "Intestazioni di risposta personalizzate",
-    "customResponseHeadersDescription": "Intestazioni di risposta restituite al client. Una per riga: Nome-Intestazione: valore",
+    "customHeaders": "Intestazioni Personalizzate",
+    "customHeadersDescription": "Intestazioni nuova riga separate: Intestazione-Nome: valore",
     "headersValidationError": "Le intestazioni devono essere nel formato: Intestazione-Nome: valore.",
     "saveHealthCheck": "Salva Controllo Salute",
     "healthCheckSaved": "Controllo Salute Salvato",

messages/ko-KR.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "재시도 횟수",
     "expectedResponseCodes": "예상 응답 코드",
     "expectedResponseCodesDescription": "정상 상태를 나타내는 HTTP 상태 코드입니다. 비워 두면 200-300이 정상으로 간주됩니다.",
-    "customRequestHeaders": "사용자 정의 요청 헤더",
-    "customRequestHeadersDescription": "다운스트림 대상으로 전송되는 요청 헤더. 한 줄에 하나씩: 헤더-이름: 값",
-    "customResponseHeaders": "사용자 정의 응답 헤더",
-    "customResponseHeadersDescription": "클라이언트로 반환되는 응답 헤더. 한 줄에 하나씩: 헤더-이름: 값",
+    "customHeaders": "사용자 정의 헤더",
+    "customHeadersDescription": "헤더는 새 줄로 구분됨: Header-Name: value",
     "headersValidationError": "헤더는 형식이어야 합니다: 헤더명: 값.",
     "saveHealthCheck": "상태 확인 저장",
     "healthCheckSaved": "상태 확인이 저장되었습니다.",

messages/nb-NO.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Forsøk på nytt",
     "expectedResponseCodes": "Forventede svarkoder",
     "expectedResponseCodesDescription": "HTTP-statuskode som indikerer sunn status. Hvis den blir stående tom, regnes 200-300 som sunn.",
-    "customRequestHeaders": "Egendefinerte forespørselshoder",
-    "customRequestHeadersDescription": "Forespørselshoder sendt til målene. Én per linje: Header-Navn: verdi",
-    "customResponseHeaders": "Egendefinerte svarhoder",
-    "customResponseHeadersDescription": "Svarhoder sendt tilbake til klienten. Én per linje: Header-Navn: verdi",
+    "customHeaders": "Egendefinerte topptekster",
+    "customHeadersDescription": "Overskrifter som er adskilt med linje: Overskriftsnavn: verdi",
     "headersValidationError": "Topptekst må være i formatet: header-navn: verdi.",
     "saveHealthCheck": "Lagre Helsekontroll",
     "healthCheckSaved": "Helsekontroll Lagret",

messages/nl-NL.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Herhaal Pogingen",
     "expectedResponseCodes": "Verwachte Reactiecodes",
     "expectedResponseCodesDescription": "HTTP-statuscode die gezonde status aangeeft. Indien leeg wordt 200-300 als gezond beschouwd.",
-    "customRequestHeaders": "Aangepaste verzoekheaders",
-    "customRequestHeadersDescription": "Verzoekheaders die worden doorgestuurd naar het doel. Per regel één: Header-Naam: waarde",
-    "customResponseHeaders": "Aangepaste antwoordheaders",
-    "customResponseHeadersDescription": "Antwoordheaders die worden teruggestuurd naar de client. Per regel één: Header-Naam: waarde",
+    "customHeaders": "Aangepaste headers",
+    "customHeadersDescription": "Kopregeleinde: Header-Naam: waarde",
     "headersValidationError": "Headers moeten in het formaat zijn: Header-Naam: waarde.",
     "saveHealthCheck": "Opslaan Gezondheidscontrole",
     "healthCheckSaved": "Gezondheidscontrole Opgeslagen",

messages/pl-PL.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Próby Ponowienia",
     "expectedResponseCodes": "Oczekiwane Kody Odpowiedzi",
     "expectedResponseCodesDescription": "Kod statusu HTTP, który wskazuje zdrowy status. Jeśli pozostanie pusty, uznaje się 200-300 za zdrowy.",
-    "customRequestHeaders": "Niestandardowe nagłówki żądania",
-    "customRequestHeadersDescription": "Nagłówki żądania wysyłane do celów. Jeden w wierszu: Nazwa-Nagłówka: wartość",
-    "customResponseHeaders": "Niestandardowe nagłówki odpowiedzi",
-    "customResponseHeadersDescription": "Nagłówki odpowiedzi zwracane do klienta. Jeden w wierszu: Nazwa-Nagłówka: wartość",
+    "customHeaders": "Niestandardowe nagłówki",
+    "customHeadersDescription": "Nagłówki oddzielone: Nazwa nagłówka: wartość",
     "headersValidationError": "Nagłówki muszą być w formacie: Nazwa nagłówka: wartość.",
     "saveHealthCheck": "Zapisz Kontrolę Zdrowia",
     "healthCheckSaved": "Kontrola Zdrowia Zapisana",

messages/pt-PT.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Tentativas de Repetição",
     "expectedResponseCodes": "Códigos de Resposta Esperados",
     "expectedResponseCodesDescription": "Código de status HTTP que indica estado saudável. Se deixado em branco, 200-300 é considerado saudável.",
-    "customRequestHeaders": "Cabeçalhos de Pedido Personalizados",
-    "customRequestHeadersDescription": "Cabeçalhos de pedido enviados para os destinos. Um por linha: Nome-Cabeçalho: valor",
-    "customResponseHeaders": "Cabeçalhos de Resposta Personalizados",
-    "customResponseHeadersDescription": "Cabeçalhos de resposta enviados de volta ao cliente. Um por linha: Nome-Cabeçalho: valor",
+    "customHeaders": "Cabeçalhos Personalizados",
+    "customHeadersDescription": "Separados por cabeçalhos da nova linha: Nome do Cabeçalho: valor",
     "headersValidationError": "Cabeçalhos devem estar no formato: Nome do Cabeçalho: valor.",
     "saveHealthCheck": "Salvar Verificação de Saúde",
     "healthCheckSaved": "Verificação de Saúde Salva",

messages/ru-RU.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Количество попыток повторного запроса",
     "expectedResponseCodes": "Ожидаемые коды ответов",
     "expectedResponseCodesDescription": "HTTP-код состояния, указывающий на здоровое состояние. Если оставить пустым, 200-300 считается здоровым.",
-    "customRequestHeaders": "Пользовательские заголовки запроса",
-    "customRequestHeadersDescription": "Заголовки запроса, отправляемые целевым серверам. По одному в строке: Имя-Заголовка: значение",
-    "customResponseHeaders": "Пользовательские заголовки ответа",
-    "customResponseHeadersDescription": "Заголовки ответа, возвращаемые клиенту. По одному в строке: Имя-Заголовка: значение",
+    "customHeaders": "Пользовательские заголовки",
+    "customHeadersDescription": "Заголовки новой строки, разделённые: название заголовка: значение",
     "headersValidationError": "Заголовки должны быть в формате: Название заголовка: значение.",
     "saveHealthCheck": "Сохранить проверку здоровья",
     "healthCheckSaved": "Проверка здоровья сохранена",

messages/tr-TR.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "Tekrar Deneme Girişimleri",
     "expectedResponseCodes": "Beklenen Yanıt Kodları",
     "expectedResponseCodesDescription": "Sağlıklı durumu gösteren HTTP durum kodu. Boş bırakılırsa, 200-300 arası sağlıklı kabul edilir.",
-    "customRequestHeaders": "Özel İstek Başlıkları",
-    "customRequestHeadersDescription": "Hedeflere gönderilen istek başlıkları. Satır başına bir tane: Başlık-Adı: değer",
-    "customResponseHeaders": "Özel Yanıt Başlıkları",
-    "customResponseHeadersDescription": "İstemciye geri gönderilen yanıt başlıkları. Satır başına bir tane: Başlık-Adı: değer",
+    "customHeaders": "Özel Başlıklar",
+    "customHeadersDescription": "Başlıklar yeni satırla ayrılmış: Başlık-Adı: değer",
     "headersValidationError": "Başlıklar şu formatta olmalıdır: Başlık-Adı: değer.",
     "saveHealthCheck": "Sağlık Kontrolünü Kaydet",
     "healthCheckSaved": "Sağlık Kontrolü Kaydedildi",

messages/zh-CN.json

@@ -2826,10 +2826,8 @@
     "retryAttempts": "重试次数",
     "expectedResponseCodes": "期望响应代码",
     "expectedResponseCodesDescription": "HTTP 状态码表示健康状态。如留空，200-300 被视为健康。",
-    "customRequestHeaders": "自定义请求标头",
-    "customRequestHeadersDescription": "转发到目标的请求标头。每行一个：标头名称：值",
-    "customResponseHeaders": "自定义响应标头",
-    "customResponseHeadersDescription": "返回给客户端的响应标头。每行一个：标头名称：值",
+    "customHeaders": "自定义标题",
+    "customHeadersDescription": "头部新行分隔：头部名称：值",
     "headersValidationError": "头部必须是格式：头部名称：值。",
     "saveHealthCheck": "保存健康检查",
     "healthCheckSaved": "健康检查已保存",

messages/zh-TW.json

@@ -1551,10 +1551,8 @@
     "retryAttempts": "重試次數",
     "expectedResponseCodes": "期望響應代碼",
     "expectedResponseCodesDescription": "HTTP 狀態碼表示健康狀態。如留空，200-300 被視為健康。",
-    "customRequestHeaders": "自訂請求 Headers",
-    "customRequestHeadersDescription": "轉發至目標的請求標頭。每行一個：Header-名稱：值",
-    "customResponseHeaders": "自訂回應 Headers",
-    "customResponseHeadersDescription": "回傳給客戶端的回應標頭。每行一個：Header-名稱：值",
+    "customHeaders": "自訂 Headers",
+    "customHeadersDescription": "Header 斷行分隔：Header 名稱：值",
     "headersValidationError": "Header 必須是格式：Header 名稱：值。",
     "saveHealthCheck": "保存健康檢查",
     "healthCheckSaved": "健康檢查已保存",

server/db/ios_models.json

@@ -4,18 +4,42 @@
   "iPad2,2": "iPad 2",
   "iPad2,3": "iPad 2",
   "iPad2,4": "iPad 2",
-  "iPad2,5": "iPad mini",
-  "iPad2,6": "iPad mini",
-  "iPad2,7": "iPad mini",
   "iPad3,1": "iPad 3rd Gen",
-  "iPad3,2": "iPad 3rd Gen",
   "iPad3,3": "iPad 3rd Gen",
+  "iPad3,2": "iPad 3rd Gen",
   "iPad3,4": "iPad 4th Gen",
   "iPad3,5": "iPad 4th Gen",
   "iPad3,6": "iPad 4th Gen",
+  "iPad6,11": "iPad 9.7 5th Gen",
+  "iPad6,12": "iPad 9.7 5th Gen",
+  "iPad7,5": "iPad 9.7 6th Gen",
+  "iPad7,6": "iPad 9.7 6th Gen",
+  "iPad7,11": "iPad 10.2 7th Gen",
+  "iPad7,12": "iPad 10.2 7th Gen",
+  "iPad11,6": "iPad 10.2 8th Gen",
+  "iPad11,7": "iPad 10.2 8th Gen",
+  "iPad12,1": "iPad 10.2 9th Gen",
+  "iPad12,2": "iPad 10.2 9th Gen",
+  "iPad13,18": "iPad 10.9 10th Gen",
+  "iPad13,19": "iPad 10.9 10th Gen",
   "iPad4,1": "iPad Air",
   "iPad4,2": "iPad Air",
   "iPad4,3": "iPad Air",
+  "iPad5,3": "iPad Air 2",
+  "iPad5,4": "iPad Air 2",
+  "iPad11,3": "iPad Air 3rd Gen",
+  "iPad11,4": "iPad Air 3rd Gen",
+  "iPad13,1": "iPad Air 4th Gen",
+  "iPad13,2": "iPad Air 4th Gen",
+  "iPad13,16": "iPad Air 5th Gen",
+  "iPad13,17": "iPad Air 5th Gen",
+  "iPad14,8": "iPad Air M2 11",
+  "iPad14,9": "iPad Air M2 11",
+  "iPad14,10": "iPad Air M2 13",
+  "iPad14,11": "iPad Air M2 13",
+  "iPad2,5": "iPad mini",
+  "iPad2,6": "iPad mini",
+  "iPad2,7": "iPad mini",
   "iPad4,4": "iPad mini 2",
   "iPad4,5": "iPad mini 2",
   "iPad4,6": "iPad mini 2",
@@ -24,22 +48,18 @@
   "iPad4,9": "iPad mini 3",
   "iPad5,1": "iPad mini 4",
   "iPad5,2": "iPad mini 4",
-  "iPad5,3": "iPad Air 2",
-  "iPad5,4": "iPad Air 2",
-  "iPad6,3": "iPad Pro 9.7",
-  "iPad6,4": "iPad Pro 9.7",
+  "iPad11,1": "iPad mini 5th Gen",
+  "iPad11,2": "iPad mini 5th Gen",
+  "iPad14,1": "iPad mini 6th Gen",
+  "iPad14,2": "iPad mini 6th Gen",
   "iPad6,7": "iPad Pro 12.9",
   "iPad6,8": "iPad Pro 12.9",
-  "iPad6,11": "iPad 9.7 5th Gen",
-  "iPad6,12": "iPad 9.7 5th Gen",
-  "iPad7,1": "iPad Pro 12.9",
-  "iPad7,2": "iPad Pro 12.9",
+  "iPad6,3": "iPad Pro 9.7",
+  "iPad6,4": "iPad Pro 9.7",
   "iPad7,3": "iPad Pro 10.5",
   "iPad7,4": "iPad Pro 10.5",
-  "iPad7,5": "iPad 9.7 6th Gen",
-  "iPad7,6": "iPad 9.7 6th Gen",
-  "iPad7,11": "iPad 10.2 7th Gen",
-  "iPad7,12": "iPad 10.2 7th Gen",
+  "iPad7,1": "iPad Pro 12.9",
+  "iPad7,2": "iPad Pro 12.9",
   "iPad8,1": "iPad Pro 11",
   "iPad8,2": "iPad Pro 11",
   "iPad8,3": "iPad Pro 11",
@@ -52,16 +72,6 @@
   "iPad8,10": "iPad Pro 11",
   "iPad8,11": "iPad Pro 12.9",
   "iPad8,12": "iPad Pro 12.9",
-  "iPad11,1": "iPad mini 5th Gen",
-  "iPad11,2": "iPad mini 5th Gen",
-  "iPad11,3": "iPad Air 3rd Gen",
-  "iPad11,4": "iPad Air 3rd Gen",
-  "iPad11,6": "iPad 10.2 8th Gen",
-  "iPad11,7": "iPad 10.2 8th Gen",
-  "iPad12,1": "iPad 10.2 9th Gen",
-  "iPad12,2": "iPad 10.2 9th Gen",
-  "iPad13,1": "iPad Air 4th Gen",
-  "iPad13,2": "iPad Air 4th Gen",
   "iPad13,4": "iPad Pro 11",
   "iPad13,5": "iPad Pro 11",
   "iPad13,6": "iPad Pro 11",
@@ -70,40 +80,14 @@
   "iPad13,9": "iPad Pro 12.9",
   "iPad13,10": "iPad Pro 12.9",
   "iPad13,11": "iPad Pro 12.9",
-  "iPad13,16": "iPad Air M1 5th Gen",
-  "iPad13,17": "iPad Air M1 5th Gen",
-  "iPad13,18": "iPad 10.9 10th Gen",
-  "iPad13,19": "iPad 10.9 10th Gen",
-  "iPad14,1": "iPad mini 6th Gen",
-  "iPad14,2": "iPad mini 6th Gen",
   "iPad14,3": "iPad Pro 11",
   "iPad14,4": "iPad Pro 11",
   "iPad14,5": "iPad Pro 12.9",
   "iPad14,6": "iPad Pro 12.9",
-  "iPad14,8": "iPad Air M2 11",
-  "iPad14,9": "iPad Air M2 11",
-  "iPad14,10": "iPad Air M2 13",
-  "iPad14,11": "iPad Air M2 13",
-  "iPad15,3": "iPad Air M3 11",
-  "iPad15,4": "iPad Air M3 11",
-  "iPad15,5": "iPad Air M3 13",
-  "iPad15,6": "iPad Air M3 13",
-  "iPad15,7": "iPad A16 - 11th Gen",
-  "iPad15,8": "iPad A16 - 11th Gen",
-  "iPad16,1": "iPad mini A17 Pro - 7th Gen",
-  "iPad16,2": "iPad mini A17 Pro - 7th Gen",
   "iPad16,3": "iPad Pro M4 11",
   "iPad16,4": "iPad Pro M4 11",
   "iPad16,5": "iPad Pro M4 13",
   "iPad16,6": "iPad Pro M4 13",
-  "iPad16,8": "iPad Air M4 11",
-  "iPad16,9": "iPad Air M4 11",
-  "iPad16,10": "iPad Air M4 13",
-  "iPad16,11": "iPad Air M4 13",
-  "iPad17,1": "iPad Pro M5 11",
-  "iPad17,2": "iPad Pro M5 11",
-  "iPad17,3": "iPad Pro M5 13",
-  "iPad17,4": "iPad Pro M5 13",
   "iPhone1,1": "iPhone",
   "iPhone1,2": "iPhone 3G",
   "iPhone2,1": "iPhone 3GS",
@@ -117,20 +101,20 @@
   "iPhone5,4": "iPhone 5c",
   "iPhone6,1": "iPhone 5s",
   "iPhone6,2": "iPhone 5s",
-  "iPhone7,1": "iPhone 6 Plus",
   "iPhone7,2": "iPhone 6",
+  "iPhone7,1": "iPhone 6 Plus",
   "iPhone8,1": "iPhone 6s",
   "iPhone8,2": "iPhone 6s Plus",
   "iPhone8,4": "iPhone SE",
   "iPhone9,1": "iPhone 7",
-  "iPhone9,2": "iPhone 7 Plus",
   "iPhone9,3": "iPhone 7",
+  "iPhone9,2": "iPhone 7 Plus",
   "iPhone9,4": "iPhone 7 Plus",
   "iPhone10,1": "iPhone 8",
-  "iPhone10,2": "iPhone 8 Plus",
-  "iPhone10,3": "iPhone X",
   "iPhone10,4": "iPhone 8",
+  "iPhone10,2": "iPhone 8 Plus",
   "iPhone10,5": "iPhone 8 Plus",
+  "iPhone10,3": "iPhone X",
   "iPhone10,6": "iPhone X",
   "iPhone11,2": "iPhone Xs",
   "iPhone11,6": "iPhone Xs Max",
@@ -143,10 +127,10 @@
   "iPhone13,2": "iPhone 12",
   "iPhone13,3": "iPhone 12 Pro",
   "iPhone13,4": "iPhone 12 Pro Max",
-  "iPhone14,2": "iPhone 13 Pro",
-  "iPhone14,3": "iPhone 13 Pro Max",
   "iPhone14,4": "iPhone 13 mini",
   "iPhone14,5": "iPhone 13",
+  "iPhone14,2": "iPhone 13 Pro",
+  "iPhone14,3": "iPhone 13 Pro Max",
   "iPhone14,6": "iPhone SE",
   "iPhone14,7": "iPhone 14",
   "iPhone14,8": "iPhone 14 Plus",
@@ -156,19 +140,6 @@
   "iPhone15,5": "iPhone 15 Plus",
   "iPhone16,1": "iPhone 15 Pro",
   "iPhone16,2": "iPhone 15 Pro Max",
-  "iPhone17,1": "iPhone 16 Pro",
-  "iPhone17,2": "iPhone 16 Pro Max",
-  "iPhone17,3": "iPhone 16",
-  "iPhone17,4": "iPhone 16 Plus",
-  "iPhone17,5": "iPhone 16e",
-  "iPhone18,1": "iPhone 17 Pro",
-  "iPhone18,2": "iPhone 17 Pro Max",
-  "iPhone18,3": "iPhone 17",
-  "iPhone18,4": "iPhone Air",
-  "iPhone18,5": "iPhone 17e",
-  "iPhone19,2": "iPhone 18 Pro",
-  "iPhone19,3": "iPhone 18 Pro Max",
-  "iPhone19,7": "iPhone 18 Pro Max",
   "iPod1,1": "iPod touch Original",
   "iPod2,1": "iPod touch 2nd",
   "iPod3,1": "iPod touch 3rd Gen",
@@ -176,4 +147,4 @@
   "iPod5,1": "iPod touch 5th",
   "iPod7,1": "iPod touch 6th Gen",
   "iPod9,1": "iPod touch 7th Gen"
-}
+}

server/db/pg/schema/schema.ts

@@ -186,8 +186,7 @@ export const resources = pgTable(
         skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
             onDelete: "set null"
         }),
-        requestHeaders: text("requestHeaders"),
-        responseHeaders: text("responseHeaders"),
+        headers: text("headers"), // comma-separated list of headers to add to the request
         proxyProtocol: boolean("proxyProtocol").notNull().default(false),
         proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
         maintenanceModeEnabled: boolean("maintenanceModeEnabled")
@@ -1138,7 +1137,6 @@ export const resourceRules = pgTable("resourceRules", {
             | "COUNTRY_IS_NOT"
             | "ASN"
             | "REGION"
-            | "METHOD"
         >()
         .notNull(), // CIDR, PATH, IP
     value: varchar("value").notNull()
@@ -1163,7 +1161,6 @@ export const resourcePolicyRules = pgTable("resourcePolicyRules", {
             | "COUNTRY_IS_NOT"
             | "ASN"
             | "REGION"
-            | "METHOD"
         >()
         .notNull(),
     value: varchar("value").notNull()

server/db/sqlite/schema/schema.ts

@@ -202,8 +202,7 @@ export const resources = sqliteTable(
         skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
             onDelete: "set null"
         }),
-        requestHeaders: text("requestHeaders"),
-        responseHeaders: text("responseHeaders"),
+        headers: text("headers"), // comma-separated list of headers to add to the request
         proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
             .notNull()
             .default(false),
@@ -1410,7 +1409,6 @@ export const resourceRules = sqliteTable("resourceRules", {
             | "COUNTRY_IS_NOT"
             | "ASN"
             | "REGION"
-            | "METHOD"
         >()
         .notNull(), // CIDR, PATH, IP
     value: text("value").notNull()
@@ -1467,7 +1465,6 @@ export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
             | "COUNTRY_IS_NOT"
             | "ASN"
             | "REGION"
-            | "METHOD"
         >()
         .notNull(),
     value: text("value").notNull()

server/emails/templates/AlertNotification.tsx

@@ -235,7 +235,7 @@ export const AlertNotification = (props: AlertNotificationProps) => {
                   }
               ]
             : []),
-        { label: "Time (UTC)", value: new Date().toUTCString() },
+        { label: "Time", value: new Date().toUTCString() },
         ...dataItems
     ];
 
@@ -265,8 +265,8 @@ export const AlertNotification = (props: AlertNotificationProps) => {
                         </EmailText>
                         {isTestAlert && (
                             <EmailText>
-                                This is a test alert. No action is required, and
-                                no real event has occurred.
+                                This is a test alert. No action is required,
+                                and no real event has occurred.
                             </EmailText>
                         )}
 

server/lib/billing/index.ts

@@ -3,4 +3,3 @@ export * from "./features";
 export * from "./limitsService";
 export * from "./getOrgTierData";
 export * from "./createCustomer";
-export * from "./linkEmailOrg";

server/lib/billing/linkEmailOrg.ts

@@ -1,6 +0,0 @@
-export async function linkEmailOrg(
-    orgId: string,
-    email: string | null | undefined
-): Promise<void> {
-    return;
-}

server/lib/blueprints/publicResources.ts

@@ -48,13 +48,7 @@ import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
 import { pickPort } from "@server/routers/target/helpers";
 import { and, asc, eq, isNotNull, ne } from "drizzle-orm";
 import { tierMatrix } from "../billing/tierMatrix";
-import {
-    isValidCIDR,
-    isValidHttpMethodList,
-    isValidIP,
-    isValidUrlGlobPattern,
-    parseHttpMethodList
-} from "../validators";
+import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
 import { Config, isTargetsOnlyResource, TargetData } from "./types";
 import { getOrCreateLabelIds, syncResourceLabels } from "./labels";
 import { findOrgUsersByIdentifier } from "./findOrgUser";
@@ -261,18 +255,10 @@ export async function updatePublicResources(
             resourceData.ssl == undefined || resourceData.ssl == null
                 ? true
                 : resourceData.ssl;
-        // `headers` is a deprecated alias for `requestHeaders`
-        const mergedRequestHeaders = [
-            ...(resourceData.headers ?? []),
-            ...(resourceData.requestHeaders ?? [])
-        ];
-        const requestHeaders =
-            mergedRequestHeaders.length > 0
-                ? JSON.stringify(mergedRequestHeaders)
-                : null;
-        const responseHeaders = resourceData.responseHeaders?.length
-            ? JSON.stringify(resourceData.responseHeaders)
-            : null;
+        let headers = "";
+        if (resourceData.headers) {
+            headers = JSON.stringify(resourceData.headers);
+        }
 
         if (resourceData.policy) {
             const isLicensed = await isLicensedOrSubscribed(
@@ -411,8 +397,7 @@ export async function updatePublicResources(
                                 ? resourceData.auth["whitelist-users"].length >
                                   0
                                 : false,
-                            requestHeaders,
-                            responseHeaders,
+                            headers: headers || null,
                             applyRules:
                                 resourceData.rules &&
                                 resourceData.rules.length > 0,
@@ -608,8 +593,7 @@ export async function updatePublicResources(
                             setHostHeader: resourceData["host-header"] || null,
                             tlsServerName:
                                 resourceData["tls-server-name"] || null,
-                            requestHeaders,
-                            responseHeaders,
+                            headers: headers || null,
                             maintenanceModeEnabled:
                                 resourceData.maintenance?.enabled,
                             maintenanceModeType: resourceData.maintenance?.type,
@@ -1232,8 +1216,7 @@ export async function updatePublicResources(
                     setHostHeader: resourceData["host-header"] || null,
                     tlsServerName: resourceData["tls-server-name"] || null,
                     ssl: resourceSsl,
-                    requestHeaders,
-                    responseHeaders,
+                    headers: headers || null,
                     applyRules:
                         resourceData.rules && resourceData.rules.length > 0,
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
@@ -1470,10 +1453,6 @@ function getRuleValue(match: string, value: string) {
     if (match === "COUNTRY" || match === "COUNTRY_IS_NOT") {
         return value.toUpperCase();
     }
-    // normalize the method list so it is stored as "POST,PUT"
-    if (match === "METHOD") {
-        return parseHttpMethodList(value).join(",");
-    }
     return value;
 }
 
@@ -1494,10 +1473,6 @@ function validateRule(rule: any) {
         if (!isValidRegionId(rule.value)) {
             throw new Error(`Invalid region ID provided: ${rule.value}`);
         }
-    } else if (rule.match === "method") {
-        if (!isValidHttpMethodList(rule.value)) {
-            throw new Error(`Invalid HTTP method provided: ${rule.value}`);
-        }
     }
 }
 

server/lib/blueprints/resourcePolicies.ts

@@ -19,13 +19,7 @@ import logger from "@server/logger";
 import { getUniqueResourcePolicyName } from "@server/db/names";
 import { hashPassword } from "@server/auth/password";
 import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
-import {
-    isValidCIDR,
-    isValidHttpMethodList,
-    isValidIP,
-    isValidUrlGlobPattern,
-    ResourceRuleMatchType
-} from "../validators";
+import { isValidCIDR, isValidIP, isValidUrlGlobPattern } from "../validators";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
 import { findOrgUsersByIdentifier } from "./findOrgUser";
@@ -72,13 +66,6 @@ export async function updateResourcePolicies(
                 throw new Error(
                     `Invalid URL glob pattern provided in resource policy '${policyNiceId}': ${rule.value}`
                 );
-            } else if (
-                rule.match === "method" &&
-                !isValidHttpMethodList(rule.value)
-            ) {
-                throw new Error(
-                    `Invalid HTTP method provided in resource policy '${policyNiceId}': ${rule.value}`
-                );
             }
         }
 
@@ -352,8 +339,17 @@ function getRuleAction(input: string): "ACCEPT" | "DROP" | "PASS" {
     return "PASS";
 }
 
-function getRuleMatch(input: string): ResourceRuleMatchType {
-    return input.toUpperCase() as ResourceRuleMatchType;
+function getRuleMatch(
+    input: string
+): "CIDR" | "IP" | "PATH" | "COUNTRY" | "COUNTRY_IS_NOT" | "ASN" | "REGION" {
+    return input.toUpperCase() as
+        | "CIDR"
+        | "IP"
+        | "PATH"
+        | "COUNTRY"
+        | "COUNTRY_IS_NOT"
+        | "ASN"
+        | "REGION";
 }
 
 async function syncRolePolicies(

server/lib/blueprints/types.ts

@@ -3,7 +3,6 @@ import { existsSync } from "node:fs";
 import { portRangeStringSchema } from "@server/lib/ip";
 import { MaintenanceSchema } from "#dynamic/lib/blueprints/MaintenanceSchema";
 import { isValidRegionId } from "@server/db/regions";
-import { isValidHttpMethodList } from "@server/lib/validators";
 import { wildcardSubdomainSchema } from "@server/lib/schemas";
 import config from "@server/lib/config";
 import {
@@ -128,16 +127,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
     .object({
         action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum([
-            "cidr",
-            "path",
-            "ip",
-            "country",
-            "country_is_not",
-            "asn",
-            "region",
-            "method"
-        ]),
+        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
         value: z.coerce.string(),
         priority: z.int().optional(),
         enabled: z.boolean().optional().default(true)
@@ -217,19 +207,6 @@ export const RuleSchema = z
             message:
                 "Value must be a valid UN M.49 region or subregion ID when match is 'region'"
         }
-    )
-    .refine(
-        (rule) => {
-            if (rule.match === "method") {
-                return isValidHttpMethodList(rule.value);
-            }
-            return true;
-        },
-        {
-            path: ["value"],
-            message:
-                "Value must be a comma-separated list of HTTP methods when match is 'method', e.g. 'POST,PUT'"
-        }
     );
 
 export const HeaderSchema = z.object({
@@ -326,9 +303,7 @@ export const PublicResourceSchema = z
         auth: AuthSchema.optional(),
         "host-header": z.string().optional(),
         "tls-server-name": z.string().optional(),
-        headers: z.array(HeaderSchema).optional(), // deprecated alias for requestHeaders
-        requestHeaders: z.array(HeaderSchema).optional(),
-        responseHeaders: z.array(HeaderSchema).optional(),
+        headers: z.array(HeaderSchema).optional(),
         rules: z.array(RuleSchema).optional(),
         maintenance: MaintenanceSchema.optional(),
         "auth-daemon": AuthDaemonSchema.optional(),

server/lib/traefik/getTraefikConfig.ts

@@ -96,8 +96,7 @@ export async function getTraefikConfig(
             tlsServerName: resources.tlsServerName,
             setHostHeader: resources.setHostHeader,
             enableProxy: resources.enableProxy,
-            requestHeaders: resources.requestHeaders,
-            responseHeaders: resources.responseHeaders,
+            headers: resources.headers,
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
             wildcard: resources.wildcard,
@@ -226,8 +225,7 @@ export async function getTraefikConfig(
                 setHostHeader: row.setHostHeader,
                 enableProxy: row.enableProxy,
                 targets: [],
-                requestHeaders: row.requestHeaders,
-                responseHeaders: row.responseHeaders,
+                headers: row.headers,
                 proxyProtocol: row.proxyProtocol,
                 proxyProtocolVersion: row.proxyProtocolVersion ?? 1,
                 path: row.path, // the targets will all have the same path
@@ -407,8 +405,7 @@ export async function getTraefikConfig(
 
             // Handle custom headers middleware
             const customHeadersMiddleware = buildCustomHeadersMiddleware(
-                resource.requestHeaders,
-                resource.responseHeaders,
+                resource.headers,
                 resource.setHostHeader,
                 resource.resourceId
             );

server/lib/traefik/headersMiddleware.ts

@@ -1,78 +1,46 @@
 import logger from "@server/logger";
 
-function parseHeaders(
-    headers: string,
-    label: string,
-    resourceId: number
-): { name: string; value: string }[] {
-    try {
-        return JSON.parse(headers) as {
-            name: string;
-            value: string;
-        }[];
-    } catch (e) {
-        logger.warn(
-            `Failed to parse ${label} for resource ${resourceId}: ${e}`
-        );
-        return [];
-    }
-}
-
 /**
- * Build the custom headers middleware definition for a resource's
- * custom request/response headers + setHostHeader config. Returns null when
- * there are no headers to set, so the caller can skip attaching the
- * middleware.
+ * Build the customRequestHeaders middleware definition for a resource's
+ * custom headers + setHostHeader config. Returns null when there are no
+ * headers to set, so the caller can skip attaching the middleware.
  */
 export function buildCustomHeadersMiddleware(
-    requestHeaders: string | null | undefined,
-    responseHeaders: string | null | undefined,
+    headers: string | null | undefined,
     setHostHeader: string | null | undefined,
     resourceId: number
-): {
-    headers: {
-        customRequestHeaders?: { [key: string]: string };
-        customResponseHeaders?: { [key: string]: string };
-    };
-} | null {
-    const requestHeadersObj: { [key: string]: string } = {};
-    const responseHeadersObj: { [key: string]: string } = {};
+): { headers: { customRequestHeaders: { [key: string]: string } } } | null {
+    const headersObj: { [key: string]: string } = {};
 
-    if (requestHeaders) {
-        parseHeaders(requestHeaders, "requestHeaders", resourceId).forEach(
-            (header) => {
-                requestHeadersObj[header.name] = header.value;
-            }
-        );
+    if (headers) {
+        let headersArr: { name: string; value: string }[] = [];
+        try {
+            headersArr = JSON.parse(headers) as {
+                name: string;
+                value: string;
+            }[];
+        } catch (e) {
+            logger.warn(
+                `Failed to parse headers for resource ${resourceId}: ${e}`
+            );
+        }
+
+        headersArr.forEach((header) => {
+            headersObj[header.name] = header.value;
+        });
     }
 
     if (setHostHeader) {
-        requestHeadersObj["Host"] = setHostHeader;
+        headersObj["Host"] = setHostHeader;
     }
 
-    if (responseHeaders) {
-        parseHeaders(responseHeaders, "responseHeaders", resourceId).forEach(
-            (header) => {
-                responseHeadersObj[header.name] = header.value;
-            }
-        );
-    }
-
-    const hasRequestHeaders = Object.keys(requestHeadersObj).length > 0;
-    const hasResponseHeaders = Object.keys(responseHeadersObj).length > 0;
-
-    if (!hasRequestHeaders && !hasResponseHeaders) {
+    if (Object.keys(headersObj).length === 0) {
         return null;
     }
 
     return {
         headers: {
-            ...(hasRequestHeaders && {
-                customRequestHeaders: requestHeadersObj
-            }),
-            ...(hasResponseHeaders && {
-                customResponseHeaders: responseHeadersObj
-            })
+            customRequestHeaders: headersObj
         }
     };
 }

server/lib/validators.test.ts

@@ -1,10 +1,9 @@
 import {
     getResourceRuleValueValidationError,
     isValidDomain,
-    isValidUrlGlobPattern,
-    parseHttpMethodList
+    isValidUrlGlobPattern
 } from "./validators";
-import { assertEquals, assertEqualsObj } from "@test/assert";
+import { assertEquals } from "@test/assert";
 
 function runTests() {
     console.log("Running domain validation tests...");
@@ -296,44 +295,6 @@ function runTests() {
         "Invalid ASN should return an error"
     );
 
-    // HTTP method validation tests
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", "POST"),
-        null,
-        "Single HTTP method should be valid"
-    );
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", " post , Put "),
-        null,
-        "Method list should be valid with mixed case and whitespace"
-    );
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", "PROPFIND"),
-        null,
-        "Extension methods such as the WebDAV verbs should be valid"
-    );
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", ""),
-        "Invalid HTTP method provided",
-        "Empty method list should return an error"
-    );
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", ",,"),
-        "Invalid HTTP method provided",
-        "Method list of only separators should return an error"
-    );
-    assertEquals(
-        getResourceRuleValueValidationError("METHOD", "GET POST"),
-        "Invalid HTTP method provided",
-        "Space separated methods should return an error"
-    );
-
-    assertEqualsObj(
-        parseHttpMethodList(" get ,post, "),
-        ["GET", "POST"],
-        "Method list should be normalized to uppercase without empty entries"
-    );
-
     console.log("All tests passed!");
 }
 

server/lib/validators.ts

@@ -76,46 +76,9 @@ export const RESOURCE_RULE_MATCH_TYPES = [
     "COUNTRY",
     "COUNTRY_IS_NOT",
     "ASN",
-    "REGION",
-    "METHOD"
+    "REGION"
 ] as const;
 
-// The methods offered in the UI: the eight from RFC 9110 plus PATCH (RFC 5789)
-// and QUERY (RFC 10008). A METHOD rule is not limited to these, since
-// isValidHttpMethodList accepts any method token, so blueprints and the API can
-// also target extension methods such as the WebDAV verbs.
-export const HTTP_METHODS = [
-    "GET",
-    "HEAD",
-    "POST",
-    "PUT",
-    "PATCH",
-    "DELETE",
-    "OPTIONS",
-    "TRACE",
-    "CONNECT",
-    "QUERY"
-] as const;
-
-// RFC 9110 token, minus the characters that would collide with the
-// comma-separated list encoding.
-const HTTP_METHOD_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-
-export function parseHttpMethodList(value: string): string[] {
-    return value
-        .split(",")
-        .map((method) => method.trim().toUpperCase())
-        .filter((method) => method.length > 0);
-}
-
-export function isValidHttpMethodList(value: string): boolean {
-    const methods = parseHttpMethodList(value);
-    return (
-        methods.length > 0 &&
-        methods.every((method) => HTTP_METHOD_REGEX.test(method))
-    );
-}
-
 export type ResourceRuleMatchType = (typeof RESOURCE_RULE_MATCH_TYPES)[number];
 
 export function getResourceRuleValueValidationError(
@@ -138,10 +101,6 @@ export function getResourceRuleValueValidationError(
             return COUNTRIES.some((country) => country.code === value)
                 ? null
                 : "Invalid country code provided";
-        case "METHOD":
-            return isValidHttpMethodList(value)
-                ? null
-                : "Invalid HTTP method provided";
         case "ASN":
             const normalizedValue = value.trim().toUpperCase();
             return /^AS\d+$/.test(normalizedValue) ||

server/private/lib/billing/index.ts

@@ -13,4 +13,3 @@
 
 export * from "./getOrgTierData";
 export * from "./createCustomer";
-export * from "./linkEmailOrg";

server/private/lib/billing/linkEmailOrg.ts

@@ -1,56 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import logger from "@server/logger";
-import privateConfig from "#private/lib/config";
-import { build } from "@server/build";
-
-export async function linkEmailOrg(
-    orgId: string,
-    email: string | null | undefined
-): Promise<void> {
-    if (build !== "saas") {
-        return;
-    }
-
-    if (!email) {
-        return;
-    }
-
-    try {
-        const response = await fetch(
-            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/link-email-org`,
-            {
-                method: "POST",
-                headers: {
-                    "api-key":
-                        privateConfig.getRawPrivateConfig().server
-                            .fossorial_api_key!,
-                    "Content-Type": "application/json"
-                },
-                body: JSON.stringify({ email, orgId })
-            }
-        );
-
-        if (!response.ok && response.status !== 404) {
-            logger.error(
-                `Fossorial API returned ${response.status} when linking email ${email} to orgId ${orgId}: ${await response.text()}`
-            );
-        }
-    } catch (error) {
-        logger.error(
-            `Error notifying Fossorial API of email/org link for orgId ${orgId}:`,
-            error
-        );
-    }
-}

server/private/lib/traefik/getTraefikConfig.ts

@@ -133,8 +133,7 @@ export async function getTraefikConfig(
             tlsServerName: resources.tlsServerName,
             setHostHeader: resources.setHostHeader,
             enableProxy: resources.enableProxy,
-            requestHeaders: resources.requestHeaders,
-            responseHeaders: resources.responseHeaders,
+            headers: resources.headers,
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
             wildcard: resources.wildcard,
@@ -276,8 +275,7 @@ export async function getTraefikConfig(
                 setHostHeader: row.setHostHeader,
                 enableProxy: row.enableProxy,
                 targets: [],
-                requestHeaders: row.requestHeaders,
-                responseHeaders: row.responseHeaders,
+                headers: row.headers,
                 proxyProtocol: row.proxyProtocol,
                 proxyProtocolVersion: row.proxyProtocolVersion ?? 1,
                 path: row.path, // the targets will all have the same path
@@ -714,8 +712,7 @@ export async function getTraefikConfig(
             );
 
             const customHeadersMiddleware = buildCustomHeadersMiddleware(
-                resource.requestHeaders,
-                resource.responseHeaders,
+                resource.headers,
                 resource.setHostHeader,
                 resource.resourceId
             );

server/routers/badger/verifySession.ts

@@ -40,7 +40,6 @@ import {
 import config from "@server/lib/config";
 import { isIpInCidr, stripPortFromHost } from "@server/lib/ip";
 import { isPathAllowed } from "@server/lib/pathMatch";
-import { parseHttpMethodList } from "@server/lib/validators";
 import { response } from "@server/lib/response";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
@@ -164,7 +163,6 @@ export async function verifyResourceSession(
             path,
             headers,
             query,
-            method,
             badgerVersion
         } = parsedBody.data;
 
@@ -295,8 +293,7 @@ export async function verifyResourceSession(
                 clientIp,
                 path,
                 ipCC,
-                ipAsn,
-                method
+                ipAsn
             );
 
             if (action == "ACCEPT") {
@@ -1432,8 +1429,7 @@ async function checkRules(
     clientIp: string | undefined,
     path: string | undefined,
     ipCC?: string,
-    ipAsn?: number,
-    method?: string
+    ipAsn?: number
 ): Promise<"ACCEPT" | "DROP" | "PASS" | undefined> {
     const ruleCacheKey = `rules:${resourceId}`;
 
@@ -1508,24 +1504,12 @@ async function checkRules(
             (await isIpInRegion(ipCC, rule.value))
         ) {
             return rule.action as any;
-        } else if (
-            method &&
-            rule.match == "METHOD" &&
-            isMethodAllowed(rule.value, method)
-        ) {
-            return rule.action as any;
         }
     }
 
     return;
 }
 
-// rule.value holds a comma-separated list of HTTP methods, e.g. "POST,PUT".
-function isMethodAllowed(ruleValue: string, method: string): boolean {
-    const requestMethod = method.toUpperCase();
-    return parseHttpMethodList(ruleValue).includes(requestMethod);
-}
-
 export { isPathAllowed };
 
 async function isIpInGeoIP(

server/routers/newt/error.ts

@@ -1,24 +0,0 @@
-import { sendToClient } from "#dynamic/routers/ws";
-
-// Error codes for registration failures
-export const NewtErrorCodes = {
-    NO_AVAILABLE_SUBNET: {
-        code: "NO_AVAILABLE_SUBNET",
-        message:
-            "No available subnet could be assigned to this site on its exit node. Please contact your administrator to increase the available address space for this exit node's subnet."
-    }
-} as const;
-
-// Helper function to send registration error
-export async function sendNewtError(
-    error: (typeof NewtErrorCodes)[keyof typeof NewtErrorCodes],
-    newtId: string
-) {
-    sendToClient(newtId, {
-        type: "newt/error",
-        data: {
-            code: error.code,
-            message: error.message
-        }
-    });
-}

server/routers/newt/handleNewtRegisterMessage.ts

@@ -14,7 +14,6 @@ import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes";
 import { fetchContainers } from "./dockerSocket";
 import { buildTargetConfigurationForNewtClient } from "./buildConfiguration";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import { NewtErrorCodes, sendNewtError } from "./error";
 
 export const handleNewtRegisterMessage: MessageHandler = async (context) => {
     const { message, client, sendToClient } = context;
@@ -117,7 +116,6 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
             logger.error(
                 `No available subnets found for the new exit node id ${exitNodeId} and site id ${siteId}`
             );
-            sendNewtError(NewtErrorCodes.NO_AVAILABLE_SUBNET, newt.newtId);
             return;
         }
 

server/routers/olm/error.ts

@@ -94,11 +94,6 @@ export const OlmErrorCodes = {
     HOLEPUNCH_MISSING: {
         code: "HOLEPUNCH_MISSING",
         message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port ${udpPort} and try registering again.`
-    },
-    NO_AVAILABLE_SUBNET: {
-        code: "NO_AVAILABLE_SUBNET",
-        message:
-            "No available subnet could be assigned to this client on the selected exit node. Please contact your administrator to increase the available address space for this exit node's subnet."
     }
 } as const;
 

server/routers/olm/handleOlmRegisterMessage.ts

@@ -347,7 +347,6 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                 `[handleOlmRegisterMessage] No available subnets found for exit node id ${exitNodeId} and client id ${client.clientId}`,
                 { orgId: client.orgId, clientId: client.clientId }
             );
-            sendOlmError(OlmErrorCodes.NO_AVAILABLE_SUBNET, olm.olmId);
             return;
         }
 

server/routers/org/createOrg.ts

@@ -25,7 +25,7 @@ import { fromError } from "zod-validation-error";
 import { defaultRoleAllowedActions } from "../role";
 import { OpenAPITags, registry } from "@server/openApi";
 import { isValidCIDR } from "@server/lib/validators";
-import { createCustomer, linkEmailOrg } from "#dynamic/lib/billing";
+import { createCustomer } from "#dynamic/lib/billing";
 import { usageService } from "@server/lib/billing/usageService";
 import { LimitId, limitsService, freeLimitSet } from "@server/lib/billing";
 import { build } from "@server/build";
@@ -425,7 +425,6 @@ export async function createOrg(
                     customerId
                 ); // Only 1 because we are creating the org
             }
-            await linkEmailOrg(orgId, req.user?.email);
         }
 
         if (numOrgs) {

server/routers/resource/getResource.ts

@@ -53,10 +53,9 @@ async function queryInlinePolicy(resourcePolicyId: number) {
 
 export type GetResourceResponse = Omit<
     NonNullable<Awaited<ReturnType<typeof query>>>,
-    "requestHeaders" | "responseHeaders"
+    "headers"
 > & {
-    requestHeaders: { name: string; value: string }[] | null;
-    responseHeaders: { name: string; value: string }[] | null;
+    headers: { name: string; value: string }[] | null;
 };
 
 registry.registerPath({
@@ -187,12 +186,9 @@ export async function getResource(
         return response<GetResourceResponse>(res, {
             data: {
                 ...returnData,
-                requestHeaders: returnData.requestHeaders
-                    ? JSON.parse(returnData.requestHeaders)
-                    : returnData.requestHeaders,
-                responseHeaders: returnData.responseHeaders
-                    ? JSON.parse(returnData.responseHeaders)
-                    : returnData.responseHeaders
+                headers: returnData.headers
+                    ? JSON.parse(returnData.headers)
+                    : returnData.headers
             },
             success: true,
             error: false,

server/routers/resource/updateResource.ts

@@ -100,14 +100,6 @@ const updateHttpResourceBodySchema = z
                 "When no shared resource policy is assigned (resourcePolicyId is null), updates the resource's inline policy. When a shared policy is assigned, this value overrides the shared policy for this resource."
             ),
         headers: z
-            .array(z.strictObject({ name: z.string(), value: z.string() }))
-            .nullable()
-            .optional(), // deprecated alias for requestHeaders
-        requestHeaders: z
-            .array(z.strictObject({ name: z.string(), value: z.string() }))
-            .nullable()
-            .optional(),
-        responseHeaders: z
             .array(z.strictObject({ name: z.string(), value: z.string() }))
             .nullable()
             .optional(),
@@ -171,13 +163,12 @@ const updateHttpResourceBodySchema = z
     )
     .refine(
         (data) => {
-            const validHeaderName = /^[a-zA-Z0-9!#$%&'*+\-.^_`|~]+$/;
-            const allHeaders = [
-                ...(data.headers ?? []),
-                ...(data.requestHeaders ?? []),
-                ...(data.responseHeaders ?? [])
-            ];
-            return allHeaders.every((h) => validHeaderName.test(h.name));
+            if (data.headers) {
+                // HTTP header names must be valid token characters (RFC 7230)
+                const validHeaderName = /^[a-zA-Z0-9!#$%&'*+\-.^_`|~]+$/;
+                return data.headers.every((h) => validHeaderName.test(h.name));
+            }
+            return true;
         },
         {
             error: "Header names may only contain valid HTTP token characters (letters, digits, and !#$%&'*+-.^_`|~)."
@@ -185,13 +176,14 @@ const updateHttpResourceBodySchema = z
     )
     .refine(
         (data) => {
-            const validHeaderValue = /^[\t\x20-\x7E]*$/;
-            const allHeaders = [
-                ...(data.headers ?? []),
-                ...(data.requestHeaders ?? []),
-                ...(data.responseHeaders ?? [])
-            ];
-            return allHeaders.every((h) => validHeaderValue.test(h.value));
+            if (data.headers) {
+                // HTTP header values must be visible ASCII or horizontal whitespace, no control chars (RFC 7230)
+                const validHeaderValue = /^[\t\x20-\x7E]*$/;
+                return data.headers.every((h) =>
+                    validHeaderValue.test(h.value)
+                );
+            }
+            return true;
         },
         {
             error: "Header values may only contain printable ASCII characters and horizontal whitespace."
@@ -199,17 +191,16 @@ const updateHttpResourceBodySchema = z
     )
     .refine(
         (data) => {
-            const templatePattern = /\{\{[^}]+\}\}/;
-            const allHeaders = [
-                ...(data.headers ?? []),
-                ...(data.requestHeaders ?? []),
-                ...(data.responseHeaders ?? [])
-            ];
-            return allHeaders.every(
-                (h) =>
-                    !templatePattern.test(h.name) &&
-                    !templatePattern.test(h.value)
-            );
+            if (data.headers) {
+                // Reject Traefik template syntax {{word}} in names or values
+                const templatePattern = /\{\{[^}]+\}\}/;
+                return data.headers.every(
+                    (h) =>
+                        !templatePattern.test(h.name) &&
+                        !templatePattern.test(h.value)
+                );
+            }
+            return true;
         },
         {
             error: "Header names and values must not contain template expressions such as {{value}}."
@@ -705,32 +696,13 @@ async function updateHttpResource(
         await createCertificate(domainId, fullDomain, db);
     }
 
-    let requestHeaders = undefined;
-    const mergedRequestHeaders = [
-        ...(updateData.headers ?? []),
-        ...(updateData.requestHeaders ?? [])
-    ];
-    if (
-        updateData.headers !== undefined ||
-        updateData.requestHeaders !== undefined
-    ) {
-        requestHeaders =
-            mergedRequestHeaders.length > 0
-                ? JSON.stringify(mergedRequestHeaders)
-                : null;
+    let headers = undefined;
+    if (updateData.headers) {
+        headers = JSON.stringify(updateData.headers);
+    } else if (updateData.headers === null) {
+        headers = null;
     }
 
-    let responseHeaders = undefined;
-    if (updateData.responseHeaders) {
-        responseHeaders = JSON.stringify(updateData.responseHeaders);
-    } else if (updateData.responseHeaders === null) {
-        responseHeaders = null;
-    }
-
-    updateData.headers = undefined;
-    updateData.requestHeaders = undefined;
-    updateData.responseHeaders = undefined;
-
     if (!isLicensed) {
         updateData.maintenanceModeEnabled = undefined;
         updateData.maintenanceModeType = undefined;
@@ -783,7 +755,7 @@ async function updateHttpResource(
 
         const updatedResource = await db
             .update(resources)
-            .set({ ...resourceOnlyData, requestHeaders, responseHeaders })
+            .set({ ...resourceOnlyData, headers })
             .where(eq(resources.resourceId, resource.resourceId))
             .returning();
 
@@ -807,7 +779,7 @@ async function updateHttpResource(
 
     const updatedResource = await db
         .update(resources)
-        .set({ ...updateData, requestHeaders, responseHeaders })
+        .set({ ...updateData, headers })
         .where(eq(resources.resourceId, resource.resourceId))
         .returning();
 

src/app/[orgId]/settings/resources/public/[niceId]/http/page.tsx

@@ -119,10 +119,7 @@ function ProxyResourceHttpForm({
                     message: t("proxyErrorInvalidHeader")
                 }
             ),
-        requestHeaders: z
-            .array(z.object({ name: z.string(), value: z.string() }))
-            .nullable(),
-        responseHeaders: z
+        headers: z
             .array(z.object({ name: z.string(), value: z.string() }))
             .nullable()
     });
@@ -134,21 +131,19 @@ function ProxyResourceHttpForm({
             ssl: resource.ssl,
             tlsServerName: resource.tlsServerName || "",
             setHostHeader: resource.setHostHeader || "",
-            requestHeaders: resource.requestHeaders,
-            responseHeaders: resource.responseHeaders
+            headers: resource.headers
         },
         mode: "onChange"
     });
 
     const [, formAction, saveLoading] = useActionState(onSubmit, null);
-    const [requestHeadersValid, setRequestHeadersValid] = useState(true);
-    const [responseHeadersValid, setResponseHeadersValid] = useState(true);
+    const [headersValid, setHeadersValid] = useState(true);
 
     async function onSubmit() {
         const isValid = await form.trigger();
         if (!isValid) return;
 
-        if (!requestHeadersValid || !responseHeadersValid) {
+        if (!headersValid) {
             toast({
                 variant: "destructive",
                 title: t("settingsErrorUpdate"),
@@ -167,8 +162,7 @@ function ProxyResourceHttpForm({
                     ssl: data.ssl,
                     tlsServerName: data.tlsServerName || null,
                     setHostHeader: data.setHostHeader || null,
-                    requestHeaders: data.requestHeaders || null,
-                    responseHeaders: data.responseHeaders || null
+                    headers: data.headers || null
                 }
             )
             .catch((err) => {
@@ -189,8 +183,7 @@ function ProxyResourceHttpForm({
                 ssl: data.ssl,
                 tlsServerName: data.tlsServerName || null,
                 setHostHeader: data.setHostHeader || null,
-                requestHeaders: data.requestHeaders || null,
-                responseHeaders: data.responseHeaders || null
+                headers: data.headers || null
             });
 
             toast({
@@ -331,11 +324,11 @@ function ProxyResourceHttpForm({
                                 <SettingsFormCell span="full">
                                     <FormField
                                         control={form.control}
-                                        name="requestHeaders"
+                                        name="headers"
                                         render={({ field }) => (
                                             <FormItem>
                                                 <FormLabel>
-                                                    {t("customRequestHeaders")}
+                                                    {t("customHeaders")}
                                                 </FormLabel>
                                                 <FormControl>
                                                     <HeadersInput
@@ -344,46 +337,14 @@ function ProxyResourceHttpForm({
                                                             field.onChange
                                                         }
                                                         onValidityChange={
-                                                            setRequestHeadersValid
+                                                            setHeadersValid
                                                         }
                                                         rows={4}
                                                     />
                                                 </FormControl>
                                                 <FormDescription>
                                                     {t(
-                                                        "customRequestHeadersDescription"
-                                                    )}
-                                                </FormDescription>
-                                                <FormMessage />
-                                            </FormItem>
-                                        )}
-                                    />
-                                </SettingsFormCell>
-
-                                <SettingsFormCell span="full">
-                                    <FormField
-                                        control={form.control}
-                                        name="responseHeaders"
-                                        render={({ field }) => (
-                                            <FormItem>
-                                                <FormLabel>
-                                                    {t("customResponseHeaders")}
-                                                </FormLabel>
-                                                <FormControl>
-                                                    <HeadersInput
-                                                        value={field.value}
-                                                        onChange={
-                                                            field.onChange
-                                                        }
-                                                        onValidityChange={
-                                                            setResponseHeadersValid
-                                                        }
-                                                        rows={4}
-                                                    />
-                                                </FormControl>
-                                                <FormDescription>
-                                                    {t(
-                                                        "customResponseHeadersDescription"
+                                                        "customHeadersDescription"
                                                     )}
                                                 </FormDescription>
                                                 <FormMessage />
@@ -401,11 +362,7 @@ function ProxyResourceHttpForm({
                 <Button
                     type="submit"
                     loading={saveLoading}
-                    disabled={
-                        saveLoading ||
-                        !requestHeadersValid ||
-                        !responseHeadersValid
-                    }
+                    disabled={saveLoading || !headersValid}
                     form="http-settings-form"
                 >
                     {t("saveSettings")}

src/app/[orgId]/settings/resources/public/[niceId]/tcp/page.tsx

@@ -113,7 +113,7 @@ function ProxyResourceProtocolForm({
                     message: t("proxyErrorInvalidHeader")
                 }
             ),
-        requestHeaders: z
+        headers: z
             .array(z.object({ name: z.string(), value: z.string() }))
             .nullable(),
         proxyProtocol: z.boolean().optional(),
@@ -124,7 +124,7 @@ function ProxyResourceProtocolForm({
         resolver: zodResolver(proxySettingsSchema),
         defaultValues: {
             setHostHeader: resource.setHostHeader || "",
-            requestHeaders: resource.requestHeaders,
+            headers: resource.headers,
             proxyProtocol: resource.proxyProtocol || false,
             proxyProtocolVersion: resource.proxyProtocolVersion || 1
         }

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -122,20 +122,11 @@ export default async function ResourceAuthPage(props: {
 
     if (searchParams.redirect) {
         try {
-            const redirectTarget = new URL(searchParams.redirect);
             const serverResourceHost = new URL(authInfo.url).host;
-            const redirectHost = redirectTarget.host;
-            const redirectPort = redirectTarget.port;
+            const redirectHost = new URL(searchParams.redirect).host;
+            const redirectPort = new URL(searchParams.redirect).port;
             const serverResourceHostWithPort = `${serverResourceHost}:${redirectPort}`;
 
-            // URL parses a host out of any scheme that uses "//", so a target
-            // like javascript://resource-host/... matches the comparisons
-            // below. The target is later assigned to window.location, so only
-            // http(s) is accepted here.
-            const isHttpTarget =
-                redirectTarget.protocol === "http:" ||
-                redirectTarget.protocol === "https:";
-
             const wildcardMatchesRedirect = (
                 wildcardDomain: string,
                 host: string
@@ -145,16 +136,14 @@ export default async function ResourceAuthPage(props: {
                 return host.endsWith(suffix) && host.length > suffix.length;
             };
 
-            if (
-                isHttpTarget &&
-                (serverResourceHost === redirectHost ||
-                    serverResourceHostWithPort === redirectHost ||
-                    (authInfo.wildcard &&
-                        authInfo.fullDomain &&
-                        wildcardMatchesRedirect(
-                            authInfo.fullDomain,
-                            redirectHost
-                        )))
+            if (serverResourceHost === redirectHost) {
+                redirectUrl = searchParams.redirect;
+            } else if (serverResourceHostWithPort === redirectHost) {
+                redirectUrl = searchParams.redirect;
+            } else if (
+                authInfo.wildcard &&
+                authInfo.fullDomain &&
+                wildcardMatchesRedirect(authInfo.fullDomain, redirectHost)
             ) {
                 redirectUrl = searchParams.redirect;
             }
@@ -294,7 +283,7 @@ export default async function ResourceAuthPage(props: {
         loginIdps = idpsRes.data.data.idps.map((idp) => ({
             idpId: idp.idpId,
             name: idp.name,
-            variant: idp.variant ?? idp.type
+            variant: idp.type
         })) as LoginFormIDP[];
     }
 

src/components/HealthCheckCredenza.tsx

@@ -1355,7 +1355,7 @@ export function HealthCheckCredenza(props: HealthCheckCredenzaProps) {
                                                                     <FormItem>
                                                                         <FormLabel>
                                                                             {t(
-                                                                                "customRequestHeaders"
+                                                                                "customHeaders"
                                                                             )}
                                                                         </FormLabel>
                                                                         <FormControl>
@@ -1379,7 +1379,7 @@ export function HealthCheckCredenza(props: HealthCheckCredenzaProps) {
                                                                         </FormControl>
                                                                         <FormDescription>
                                                                             {t(
-                                                                                "customRequestHeadersDescription"
+                                                                                "customHeadersDescription"
                                                                             )}
                                                                         </FormDescription>
                                                                         <FormMessage />

src/components/HealthCheckFormFields.tsx

@@ -733,7 +733,7 @@ export function HealthCheckFormFields({
                                         render={({ field }) => (
                                             <FormItem>
                                                 <FormLabel>
-                                                    {t("customRequestHeaders")}
+                                                    {t("customHeaders")}
                                                 </FormLabel>
                                                 <FormControl>
                                                     <HeadersInput
@@ -750,7 +750,7 @@ export function HealthCheckFormFields({
                                                 </FormControl>
                                                 <FormDescription>
                                                     {t(
-                                                        "customRequestHeadersDescription"
+                                                        "customHeadersDescription"
                                                     )}
                                                 </FormDescription>
                                                 <FormMessage />

src/components/resource-policy/PolicyAccessRulesTable.tsx

@@ -37,7 +37,6 @@ import { cn } from "@app/lib/cn";
 import { MAJOR_ASNS } from "@server/db/asns";
 import { COUNTRIES } from "@server/db/countries";
 import { REGIONS, getRegionNameById } from "@server/db/regions";
-import { HTTP_METHODS, parseHttpMethodList } from "@server/lib/validators";
 import {
     ColumnDef,
     flexRender,
@@ -64,8 +63,7 @@ import {
 } from "react";
 import {
     validatePolicyRulePriority,
-    validatePolicyRuleValue,
-    type PolicyRuleMatchType
+    validatePolicyRuleValue
 } from "./policy-access-rule-validation";
 import {
     buildDisplayPrioritiesForResourceOverlay,
@@ -114,80 +112,6 @@ function getColumnClassName(columnId: string) {
     return "";
 }
 
-// A METHOD rule stores its methods as a comma-separated list in rule.value,
-// e.g. "POST,PUT". Only the common methods are offered here; a value set
-// through a blueprint or the API may contain other methods (the WebDAV verbs,
-// for instance), so those are kept and shown rather than dropped on edit.
-function RuleMethodSelect({
-    value,
-    disabled,
-    placeholder,
-    onChange
-}: {
-    value: string;
-    disabled: boolean;
-    placeholder: string;
-    onChange: (value: string) => void;
-}) {
-    const selected = parseHttpMethodList(value);
-    const knownMethods: readonly string[] = HTTP_METHODS;
-    const options = [
-        ...knownMethods,
-        ...selected.filter((method) => !knownMethods.includes(method))
-    ];
-
-    function toggle(method: string) {
-        const next = selected.includes(method)
-            ? selected.filter((m) => m !== method)
-            : [...selected, method];
-
-        // keep a stable order so the stored value does not churn on every edit
-        onChange(options.filter((m) => next.includes(m)).join(","));
-    }
-
-    return (
-        <Popover>
-            <PopoverTrigger asChild>
-                <Button
-                    variant="outline"
-                    role="combobox"
-                    disabled={disabled}
-                    className="w-full min-w-0 justify-between"
-                >
-                    <span className="truncate">
-                        {selected.length > 0 ? selected.join(", ") : placeholder}
-                    </span>
-                    <ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
-                </Button>
-            </PopoverTrigger>
-            <PopoverContent className="min-w-50 p-0">
-                <Command>
-                    <CommandList>
-                        <CommandGroup>
-                            {options.map((method) => (
-                                <CommandItem
-                                    key={method}
-                                    value={method}
-                                    onSelect={() => toggle(method)}
-                                >
-                                    <Check
-                                        className={`mr-2 h-4 w-4 ${
-                                            selected.includes(method)
-                                                ? "opacity-100"
-                                                : "opacity-0"
-                                        }`}
-                                    />
-                                    {method}
-                                </CommandItem>
-                            ))}
-                        </CommandGroup>
-                    </CommandList>
-                </Command>
-            </PopoverContent>
-        </Popover>
-    );
-}
-
 export function PolicyAccessRulesTable({
     rules,
     onRulesChange,
@@ -309,8 +233,7 @@ export function PolicyAccessRulesTable({
             COUNTRY: t("country"),
             COUNTRY_IS_NOT: t("countryIsNot"),
             ASN: "ASN",
-            REGION: t("region"),
-            METHOD: t("method")
+            REGION: t("region")
         }),
         [t]
     );
@@ -515,7 +438,16 @@ export function PolicyAccessRulesTable({
                     <Select
                         defaultValue={row.original.match}
                         disabled={readonly || isRuleLocked(row.original)}
-                        onValueChange={(value: PolicyRuleMatchType) =>
+                        onValueChange={(
+                            value:
+                                | "CIDR"
+                                | "IP"
+                                | "PATH"
+                                | "COUNTRY"
+                                | "COUNTRY_IS_NOT"
+                                | "ASN"
+                                | "REGION"
+                        ) =>
                             updateRule(row.original.ruleId, {
                                 match: value,
                                 value:
@@ -526,9 +458,7 @@ export function PolicyAccessRulesTable({
                                           ? "AS15169"
                                           : value === "REGION"
                                             ? "021"
-                                            : value === "METHOD"
-                                              ? "GET"
-                                              : row.original.value
+                                            : row.original.value
                             })
                         }
                     >
@@ -543,9 +473,6 @@ export function PolicyAccessRulesTable({
                             <SelectItem value="CIDR">
                                 {RuleMatch.CIDR}
                             </SelectItem>
-                            <SelectItem value="METHOD">
-                                {RuleMatch.METHOD}
-                            </SelectItem>
                             {isMaxmindAvailable && (
                                 <>
                                     <SelectItem value="COUNTRY">
@@ -852,15 +779,6 @@ export function PolicyAccessRulesTable({
                                 </Command>
                             </PopoverContent>
                         </Popover>
-                    ) : row.original.match === "METHOD" ? (
-                        <RuleMethodSelect
-                            value={row.original.value}
-                            disabled={readonly || isRuleLocked(row.original)}
-                            placeholder={t("rulesSelectMethods")}
-                            onChange={(value) =>
-                                updateRule(row.original.ruleId, { value })
-                            }
-                        />
                     ) : (
                         <Input
                             defaultValue={row.original.value}

src/components/resource-policy/policy-access-rule-validation.ts

@@ -2,7 +2,6 @@ import { COUNTRIES } from "@server/db/countries";
 import { isValidRegionId } from "@server/db/regions";
 import {
     isValidCIDR,
-    isValidHttpMethodList,
     isValidIP,
     isValidUrlGlobPattern
 } from "@server/lib/validators";
@@ -20,8 +19,7 @@ export const POLICY_RULE_MATCH_TYPES = [
     "COUNTRY",
     "COUNTRY_IS_NOT",
     "ASN",
-    "REGION",
-    "METHOD"
+    "REGION"
 ] as const;
 
 export type PolicyRuleMatchType = (typeof POLICY_RULE_MATCH_TYPES)[number];
@@ -86,10 +84,6 @@ export function createPolicyRuleValueSchema(t: TranslateFn, match: string) {
                 (value) => COUNTRIES.some((country) => country.code === value),
                 { message: t("rulesErrorInvalidCountryDescription") }
             );
-        case "METHOD":
-            return required.refine(isValidHttpMethodList, {
-                message: t("rulesErrorInvalidMethodDescription")
-            });
         case "ASN":
             return required.refine(
                 (value) => {