Bump golang.org/x/term in /install in the minor-updates group

Bumps the minor-updates group in /install with 1 update: [golang.org/x/term](https://github.com/golang/term).


Updates `golang.org/x/term` from 0.39.0 to 0.40.0
- [Commits](https://github.com/golang/term/compare/v0.39.0...v0.40.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

.dockerignore

@@ -31,5 +31,4 @@ dist
 migrations/
 config/
 build.ts
-tsconfig.json
-migrations/
+tsconfig.json

.github/workflows/cicd.yml

@@ -1,4 +1,4 @@
-name: Public Pipeline
+name: CI/CD Pipeline
 
 # CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
 # Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
@@ -440,10 +440,6 @@ jobs:
                   issuer="https://token.actions.githubusercontent.com"
                   id_regex="^https://github.com/${{ github.repository }}/.+"  # accept this repo (all workflows/refs)
 
-                  # Track failures
-                  FAILED_TAGS=()
-                  SUCCESSFUL_TAGS=()
-
                   # Determine if this is an RC release
                   IS_RC="false"
                   if [[ "$TAG" == *"-rc."* ]]; then
@@ -475,123 +471,94 @@ jobs:
                   for BASE_IMAGE in "${GHCR_IMAGE}" "${DOCKERHUB_IMAGE}"; do
                     for IMAGE_TAG in "${IMAGE_TAGS[@]}"; do
                       echo "Processing ${BASE_IMAGE}:${IMAGE_TAG}"
-                      TAG_FAILED=false
 
-                      # Wrap the entire tag processing in error handling
-                      (
-                        set -e
-                        DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${IMAGE_TAG} | jq -r '.Digest')"
-                        REF="${BASE_IMAGE}@${DIGEST}"
-                        echo "Resolved digest: ${REF}"
+                      DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${IMAGE_TAG} | jq -r '.Digest')"
+                      REF="${BASE_IMAGE}@${DIGEST}"
+                      echo "Resolved digest: ${REF}"
 
-                        echo "==> cosign sign (keyless) --recursive ${REF}"
-                        cosign sign --recursive "${REF}"
+                      echo "==> cosign sign (keyless) --recursive ${REF}"
+                      cosign sign --recursive "${REF}"
 
-                        echo "==> cosign sign (key) --recursive ${REF}"
-                        cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"
+                      echo "==> cosign sign (key) --recursive ${REF}"
+                      cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"
 
-                        # Retry wrapper for verification to handle registry propagation delays
-                        retry_verify() {
-                          local cmd="$1"
-                          local attempts=6
-                          local delay=5
-                          local i=1
-                          until eval "$cmd"; do
-                            if [ $i -ge $attempts ]; then
-                              echo "Verification failed after $attempts attempts"
-                              return 1
-                            fi
-                            echo "Verification not yet available. Retry $i/$attempts after ${delay}s..."
-                            sleep $delay
-                            i=$((i+1))
-                            delay=$((delay*2))
-                            # Cap the delay to avoid very long waits
-                            if [ $delay -gt 60 ]; then delay=60; fi
-                          done
-                          return 0
-                        }
-
-                        echo "==> cosign verify (public key) ${REF}"
-                        if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"; then
-                          VERIFIED_INDEX=true
-                        else
-                          VERIFIED_INDEX=false
-                        fi
-
-                        echo "==> cosign verify (keyless policy) ${REF}"
-                        if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"; then
-                          VERIFIED_INDEX_KEYLESS=true
-                        else
-                          VERIFIED_INDEX_KEYLESS=false
-                        fi
-
-                        # If index verification fails, attempt to verify child platform manifests
-                        if [ "${VERIFIED_INDEX}" != "true" ] || [ "${VERIFIED_INDEX_KEYLESS}" != "true" ]; then
-                          echo "Index verification not available; attempting child manifest verification for ${BASE_IMAGE}:${IMAGE_TAG}"
-                          CHILD_VERIFIED=false
-
-                          for ARCH in arm64 amd64; do
-                            CHILD_TAG="${IMAGE_TAG}-${ARCH}"
-                            echo "Resolving child digest for ${BASE_IMAGE}:${CHILD_TAG}"
-                            CHILD_DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${CHILD_TAG} | jq -r '.Digest' || true)"
-                            if [ -n "${CHILD_DIGEST}" ] && [ "${CHILD_DIGEST}" != "null" ]; then
-                              CHILD_REF="${BASE_IMAGE}@${CHILD_DIGEST}"
-                              echo "==> cosign verify (public key) child ${CHILD_REF}"
-                              if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${CHILD_REF}' -o text"; then
-                                CHILD_VERIFIED=true
-                                echo "Public key verification succeeded for child ${CHILD_REF}"
-                              else
-                                echo "Public key verification failed for child ${CHILD_REF}"
-                              fi
-
-                              echo "==> cosign verify (keyless policy) child ${CHILD_REF}"
-                              if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${CHILD_REF}' -o text"; then
-                                CHILD_VERIFIED=true
-                                echo "Keyless verification succeeded for child ${CHILD_REF}"
-                              else
-                                echo "Keyless verification failed for child ${CHILD_REF}"
-                              fi
-                            else
-                              echo "No child digest found for ${BASE_IMAGE}:${CHILD_TAG}; skipping"
-                            fi
-                          done
-
-                          if [ "${CHILD_VERIFIED}" != "true" ]; then
-                            echo "Failed to verify index and no child manifests verified for ${BASE_IMAGE}:${IMAGE_TAG}"
-                            exit 1
+                      # Retry wrapper for verification to handle registry propagation delays
+                      retry_verify() {
+                        local cmd="$1"
+                        local attempts=6
+                        local delay=5
+                        local i=1
+                        until eval "$cmd"; do
+                          if [ $i -ge $attempts ]; then
+                            echo "Verification failed after $attempts attempts"
+                            return 1
                           fi
-                        fi
-                      ) || TAG_FAILED=true
+                          echo "Verification not yet available. Retry $i/$attempts after ${delay}s..."
+                          sleep $delay
+                          i=$((i+1))
+                          delay=$((delay*2))
+                          # Cap the delay to avoid very long waits
+                          if [ $delay -gt 60 ]; then delay=60; fi
+                        done
+                        return 0
+                      }
 
-                      if [ "$TAG_FAILED" = "true" ]; then
-                        echo "⚠️  WARNING: Failed to sign/verify ${BASE_IMAGE}:${IMAGE_TAG}"
-                        FAILED_TAGS+=("${BASE_IMAGE}:${IMAGE_TAG}")
+                      echo "==> cosign verify (public key) ${REF}"
+                      if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"; then
+                        VERIFIED_INDEX=true
                       else
-                        echo "✓ Successfully signed and verified ${BASE_IMAGE}:${IMAGE_TAG}"
-                        SUCCESSFUL_TAGS+=("${BASE_IMAGE}:${IMAGE_TAG}")
+                        VERIFIED_INDEX=false
                       fi
+
+                      echo "==> cosign verify (keyless policy) ${REF}"
+                      if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"; then
+                        VERIFIED_INDEX_KEYLESS=true
+                      else
+                        VERIFIED_INDEX_KEYLESS=false
+                      fi
+
+                      # If index verification fails, attempt to verify child platform manifests
+                      if [ "${VERIFIED_INDEX}" != "true" ] || [ "${VERIFIED_INDEX_KEYLESS}" != "true" ]; then
+                        echo "Index verification not available; attempting child manifest verification for ${BASE_IMAGE}:${IMAGE_TAG}"
+                        CHILD_VERIFIED=false
+
+                        for ARCH in arm64 amd64; do
+                          CHILD_TAG="${IMAGE_TAG}-${ARCH}"
+                          echo "Resolving child digest for ${BASE_IMAGE}:${CHILD_TAG}"
+                          CHILD_DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${CHILD_TAG} | jq -r '.Digest' || true)"
+                          if [ -n "${CHILD_DIGEST}" ] && [ "${CHILD_DIGEST}" != "null" ]; then
+                            CHILD_REF="${BASE_IMAGE}@${CHILD_DIGEST}"
+                            echo "==> cosign verify (public key) child ${CHILD_REF}"
+                            if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${CHILD_REF}' -o text"; then
+                              CHILD_VERIFIED=true
+                              echo "Public key verification succeeded for child ${CHILD_REF}"
+                            else
+                              echo "Public key verification failed for child ${CHILD_REF}"
+                            fi
+
+                            echo "==> cosign verify (keyless policy) child ${CHILD_REF}"
+                            if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${CHILD_REF}' -o text"; then
+                              CHILD_VERIFIED=true
+                              echo "Keyless verification succeeded for child ${CHILD_REF}"
+                            else
+                              echo "Keyless verification failed for child ${CHILD_REF}"
+                            fi
+                          else
+                            echo "No child digest found for ${BASE_IMAGE}:${CHILD_TAG}; skipping"
+                          fi
+                        done
+
+                        if [ "${CHILD_VERIFIED}" != "true" ]; then
+                          echo "Failed to verify index and no child manifests verified for ${BASE_IMAGE}:${IMAGE_TAG}"
+                          exit 10
+                        fi
+                      fi
+
+                      echo "✓ Successfully signed and verified ${BASE_IMAGE}:${IMAGE_TAG}"
                     done
                   done
 
-                  # Report summary
-                  echo ""
-                  echo "=========================================="
-                  echo "Sign and Verify Summary"
-                  echo "=========================================="
-                  echo "Successful: ${#SUCCESSFUL_TAGS[@]}"
-                  echo "Failed: ${#FAILED_TAGS[@]}"
-                  echo ""
-
-                  if [ ${#FAILED_TAGS[@]} -gt 0 ]; then
-                    echo "Failed tags:"
-                    for tag in "${FAILED_TAGS[@]}"; do
-                      echo "  - $tag"
-                    done
-                    echo ""
-                    echo "⚠️  WARNING: Some tags failed to sign/verify, but continuing anyway"
-                  else
-                    echo "✓ All images signed and verified successfully!"
-                  fi
+                  echo "All images signed and verified successfully!"
               shell: bash
 
     post-run:

.github/workflows/cicd.yml.backup

@@ -0,0 +1,426 @@
+name: CI/CD Pipeline
+
+# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
+# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
+
+permissions:
+  contents: read
+  packages: write      # for GHCR push
+  id-token: write      # for Cosign Keyless (OIDC) Signing
+
+# Required secrets:
+# - DOCKER_HUB_USERNAME / DOCKER_HUB_ACCESS_TOKEN: push to Docker Hub
+# - GITHUB_TOKEN: used for GHCR login and OIDC keyless signing
+# - COSIGN_PRIVATE_KEY / COSIGN_PASSWORD / COSIGN_PUBLIC_KEY: for key-based signing
+
+on:
+    push:
+        tags:
+            - "[0-9]+.[0-9]+.[0-9]+"
+            - "[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+"
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+    pre-run:
+        runs-on: ubuntu-latest
+        permissions: write-all
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v2
+              with:
+                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
+                  role-duration-seconds: 3600
+                  aws-region: ${{ secrets.AWS_REGION }}
+
+            - name: Verify AWS identity
+              run: aws sts get-caller-identity
+
+            - name: Start EC2 instances
+              run: |
+                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
+                  echo "EC2 instances started"
+
+
+    release-arm:
+        name: Build and Release (ARM64)
+        runs-on: [self-hosted, linux, arm64, us-east-1]
+        needs: [pre-run]
+        if: >-
+            ${{
+                needs.pre-run.result == 'success'
+            }}
+        # Job-level timeout to avoid runaway or stuck runs
+        timeout-minutes: 120
+        env:
+          # Target images
+          DOCKERHUB_IMAGE: docker.io/fosrl/${{ github.event.repository.name }}
+          GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+            - name: Monitor storage space
+              run: |
+                  THRESHOLD=75
+                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
+                  echo "Used space: $USED_SPACE%"
+                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
+                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
+                      echo y | docker system prune -a
+                  else
+                      echo "Storage space is above the threshold. No action needed."
+                  fi
+
+            - name: Log in to Docker Hub
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+              with:
+                  registry: docker.io
+                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
+                  password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+            - name: Extract tag name
+              id: get-tag
+              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Update version in package.json
+              run: |
+                  TAG=${{ env.TAG }}
+                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
+                  cat server/lib/consts.ts
+              shell: bash
+
+            - name: Check if release candidate
+              id: check-rc
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [[ "$TAG" == *"-rc."* ]]; then
+                      echo "IS_RC=true" >> $GITHUB_ENV
+                  else
+                      echo "IS_RC=false" >> $GITHUB_ENV
+                  fi
+              shell: bash
+
+            - name: Build and push Docker images (Docker Hub - ARM64)
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [ "$IS_RC" = "true" ]; then
+                      make build-rc-arm tag=$TAG
+                  else
+                      make build-release-arm tag=$TAG
+                  fi
+                  echo "Built & pushed ARM64 images to: ${{ env.DOCKERHUB_IMAGE }}:${TAG}"
+              shell: bash
+
+    release-amd:
+        name: Build and Release (AMD64)
+        runs-on: [self-hosted, linux, x64, us-east-1]
+        needs: [pre-run]
+        if: >-
+            ${{
+                needs.pre-run.result == 'success'
+            }}
+        # Job-level timeout to avoid runaway or stuck runs
+        timeout-minutes: 120
+        env:
+          # Target images
+          DOCKERHUB_IMAGE: docker.io/fosrl/${{ github.event.repository.name }}
+          GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+            - name: Monitor storage space
+              run: |
+                  THRESHOLD=75
+                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
+                  echo "Used space: $USED_SPACE%"
+                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
+                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
+                      echo y | docker system prune -a
+                  else
+                      echo "Storage space is above the threshold. No action needed."
+                  fi
+
+            - name: Log in to Docker Hub
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+              with:
+                  registry: docker.io
+                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
+                  password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+            - name: Extract tag name
+              id: get-tag
+              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Update version in package.json
+              run: |
+                  TAG=${{ env.TAG }}
+                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
+                  cat server/lib/consts.ts
+              shell: bash
+
+            - name: Check if release candidate
+              id: check-rc
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [[ "$TAG" == *"-rc."* ]]; then
+                      echo "IS_RC=true" >> $GITHUB_ENV
+                  else
+                      echo "IS_RC=false" >> $GITHUB_ENV
+                  fi
+              shell: bash
+
+            - name: Build and push Docker images (Docker Hub - AMD64)
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [ "$IS_RC" = "true" ]; then
+                      make build-rc-amd tag=$TAG
+                  else
+                      make build-release-amd tag=$TAG
+                  fi
+                  echo "Built & pushed AMD64 images to: ${{ env.DOCKERHUB_IMAGE }}:${TAG}"
+              shell: bash
+
+    create-manifest:
+        name: Create Multi-Arch Manifests
+        runs-on: [self-hosted, linux, x64, us-east-1]
+        needs: [release-arm, release-amd]
+        if: >-
+            ${{
+                needs.release-arm.result == 'success' &&
+                needs.release-amd.result == 'success'
+            }}
+        timeout-minutes: 30
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+            - name: Log in to Docker Hub
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+              with:
+                  registry: docker.io
+                  username: ${{ secrets.DOCKER_HUB_USERNAME }}
+                  password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+            - name: Extract tag name
+              id: get-tag
+              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Check if release candidate
+              id: check-rc
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [[ "$TAG" == *"-rc."* ]]; then
+                      echo "IS_RC=true" >> $GITHUB_ENV
+                  else
+                      echo "IS_RC=false" >> $GITHUB_ENV
+                  fi
+              shell: bash
+
+            - name: Create multi-arch manifests
+              run: |
+                  TAG=${{ env.TAG }}
+                  if [ "$IS_RC" = "true" ]; then
+                      make create-manifests-rc tag=$TAG
+                  else
+                      make create-manifests tag=$TAG
+                  fi
+                  echo "Created multi-arch manifests for tag: ${TAG}"
+              shell: bash
+
+    sign-and-package:
+        name: Sign and Package
+        runs-on: [self-hosted, linux, x64, us-east-1]
+        needs: [release-arm, release-amd, create-manifest]
+        if: >-
+            ${{
+                needs.release-arm.result == 'success' &&
+                needs.release-amd.result == 'success' &&
+                needs.create-manifest.result == 'success'
+            }}
+        # Job-level timeout to avoid runaway or stuck runs
+        timeout-minutes: 120
+        env:
+          # Target images
+          DOCKERHUB_IMAGE: docker.io/fosrl/${{ github.event.repository.name }}
+          GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+            - name: Extract tag name
+              id: get-tag
+              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Install Go
+              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+              with:
+                  go-version: 1.24
+
+            - name: Update version in package.json
+              run: |
+                  TAG=${{ env.TAG }}
+                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
+                  cat server/lib/consts.ts
+              shell: bash
+
+            - name: Pull latest Gerbil version
+              id: get-gerbil-tag
+              run: |
+                  LATEST_TAG=$(curl -s https://api.github.com/repos/fosrl/gerbil/tags | jq -r '.[0].name')
+                  echo "LATEST_GERBIL_TAG=$LATEST_TAG" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Pull latest Badger version
+              id: get-badger-tag
+              run: |
+                  LATEST_TAG=$(curl -s https://api.github.com/repos/fosrl/badger/tags | jq -r '.[0].name')
+                  echo "LATEST_BADGER_TAG=$LATEST_TAG" >> $GITHUB_ENV
+              shell: bash
+
+            - name: Update install/main.go
+              run: |
+                  PANGOLIN_VERSION=${{ env.TAG }}
+                  GERBIL_VERSION=${{ env.LATEST_GERBIL_TAG }}
+                  BADGER_VERSION=${{ env.LATEST_BADGER_TAG }}
+                  sed -i "s/config.PangolinVersion = \".*\"/config.PangolinVersion = \"$PANGOLIN_VERSION\"/" install/main.go
+                  sed -i "s/config.GerbilVersion = \".*\"/config.GerbilVersion = \"$GERBIL_VERSION\"/" install/main.go
+                  sed -i "s/config.BadgerVersion = \".*\"/config.BadgerVersion = \"$BADGER_VERSION\"/" install/main.go
+                  echo "Updated install/main.go with Pangolin version $PANGOLIN_VERSION, Gerbil version $GERBIL_VERSION, and Badger version $BADGER_VERSION"
+                  cat install/main.go
+              shell: bash
+
+            - name: Build installer
+              working-directory: install
+              run: |
+                  make go-build-release
+
+            - name: Upload artifacts from /install/bin
+              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+              with:
+                  name: install-bin
+                  path: install/bin/
+
+            - name: Install skopeo + jq
+              # skopeo: copy/inspect images between registries
+              # jq: JSON parsing tool used to extract digest values
+              run: |
+                  sudo apt-get update -y
+                  sudo apt-get install -y skopeo jq
+                  skopeo --version
+              shell: bash
+
+            - name: Login to GHCR
+              env:
+                  REGISTRY_AUTH_FILE: ${{ runner.temp }}/containers/auth.json
+              run: |
+                  mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+                  skopeo login ghcr.io -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}"
+              shell: bash
+
+            - name: Copy tag from Docker Hub to GHCR
+              # Mirror the already-built image (all architectures) to GHCR so we can sign it
+              # Wait a bit for both architectures to be available in Docker Hub manifest
+              env:
+                  REGISTRY_AUTH_FILE: ${{ runner.temp }}/containers/auth.json
+              run: |
+                  set -euo pipefail
+                  TAG=${{ env.TAG }}
+                  echo "Waiting for multi-arch manifest to be ready..."
+                  sleep 30
+                  echo "Copying ${{ env.DOCKERHUB_IMAGE }}:${TAG} -> ${{ env.GHCR_IMAGE }}:${TAG}"
+                  skopeo copy --all --retry-times 3 \
+                    docker://$DOCKERHUB_IMAGE:$TAG \
+                    docker://$GHCR_IMAGE:$TAG
+              shell: bash
+
+            - name: Login to GitHub Container Registry (for cosign)
+              uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+              with:
+                registry: ghcr.io
+                username: ${{ github.actor }}
+                password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Install cosign
+              # cosign is used to sign and verify container images (key and keyless)
+              uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+
+            - name: Dual-sign and verify (GHCR & Docker Hub)
+              # Sign each image by digest using keyless (OIDC) and key-based signing,
+              # then verify both the public key signature and the keyless OIDC signature.
+              env:
+                  TAG: ${{ env.TAG }}
+                  COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+                  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+                  COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
+                  COSIGN_YES: "true"
+              run: |
+                  set -euo pipefail
+
+                  issuer="https://token.actions.githubusercontent.com"
+                  id_regex="^https://github.com/${{ github.repository }}/.+"  # accept this repo (all workflows/refs)
+
+                  for IMAGE in "${GHCR_IMAGE}" "${DOCKERHUB_IMAGE}"; do
+                    echo "Processing ${IMAGE}:${TAG}"
+
+                    DIGEST="$(skopeo inspect --retry-times 3 docker://${IMAGE}:${TAG} | jq -r '.Digest')"
+                    REF="${IMAGE}@${DIGEST}"
+                    echo "Resolved digest: ${REF}"
+
+                    echo "==> cosign sign (keyless) --recursive ${REF}"
+                    cosign sign --recursive "${REF}"
+
+                    echo "==> cosign sign (key) --recursive ${REF}"
+                    cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"
+
+                    echo "==> cosign verify (public key) ${REF}"
+                    cosign verify --key env://COSIGN_PUBLIC_KEY "${REF}" -o text
+
+                    echo "==> cosign verify (keyless policy) ${REF}"
+                    cosign verify \
+                      --certificate-oidc-issuer "${issuer}" \
+                      --certificate-identity-regexp "${id_regex}" \
+                      "${REF}" -o text
+                  done
+              shell: bash
+
+    post-run:
+        needs: [pre-run, release-arm, release-amd, create-manifest, sign-and-package]
+        if: >-
+            ${{
+                always() &&
+                needs.pre-run.result == 'success' &&
+                (needs.release-arm.result == 'success' || needs.release-arm.result == 'skipped' || needs.release-arm.result == 'failure') &&
+                (needs.release-amd.result == 'success' || needs.release-amd.result == 'skipped' || needs.release-amd.result == 'failure') &&
+                (needs.create-manifest.result == 'success' || needs.create-manifest.result == 'skipped' || needs.create-manifest.result == 'failure') &&
+                (needs.sign-and-package.result == 'success' || needs.sign-and-package.result == 'skipped' || needs.sign-and-package.result == 'failure')
+            }}
+        runs-on: ubuntu-latest
+        permissions: write-all
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v2
+              with:
+                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
+                  role-duration-seconds: 3600
+                  aws-region: ${{ secrets.AWS_REGION }}
+
+            - name: Verify AWS identity
+              run: aws sts get-caller-identity
+
+            - name: Stop EC2 instances
+              run: |
+                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
+                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
+                  echo "EC2 instances stopped"

.github/workflows/saas.yml

@@ -1,4 +1,4 @@
-name: SAAS Pipeline
+name: CI/CD Pipeline
 
 # CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
 # Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.

install/go.mod

@@ -3,8 +3,8 @@ module installer
 go 1.24.0
 
 require (
-	golang.org/x/term v0.39.0
+	golang.org/x/term v0.40.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require golang.org/x/sys v0.40.0 // indirect
+require golang.org/x/sys v0.41.0 // indirect

install/go.sum

@@ -1,7 +1,7 @@
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

messages/en-US.json

@@ -791,9 +791,6 @@
     "sitestCountIncrease": "Increase site count",
     "idpManage": "Manage Identity Providers",
     "idpManageDescription": "View and manage identity providers in the system",
-    "idpGlobalModeBanner": "Identity providers (IdPs) per organization are disabled on this server. It is using global IdPs (shared across all organizations). Manage global IdPs in the <adminPanelLink>admin panel</adminPanelLink>. To enable IdPs per organization, edit the server config and set IdP mode to org. <configDocsLink>See the docs</configDocsLink>. If you want to continue using global IdPs and make this disappear from the organization settings, explicitly set the mode to global in the config.",
-    "idpGlobalModeBannerUpgradeRequired": "Identity providers (IdPs) per organization are disabled on this server. It is using global IdPs (shared across all organizations). Manage global IdPs in the <adminPanelLink>admin panel</adminPanelLink>. To use identity providers per organization, you must upgrade to the Enterprise edition.",
-    "idpGlobalModeBannerLicenseRequired": "Identity providers (IdPs) per organization are disabled on this server. It is using global IdPs (shared across all organizations). Manage global IdPs in the <adminPanelLink>admin panel</adminPanelLink>. To use identity providers per organization, an Enterprise license is required.",
     "idpDeletedDescription": "Identity provider deleted successfully",
     "idpOidc": "OAuth2/OIDC",
     "idpQuestionRemove": "Are you sure you want to permanently delete the identity provider?",
@@ -2283,8 +2280,8 @@
     "logRetentionEndOfFollowingYear": "End of following year",
     "actionLogsDescription": "View a history of actions performed in this organization",
     "accessLogsDescription": "View access auth requests for resources in this organization",
-    "licenseRequiredToUse": "An <enterpriseLicenseLink>Enterprise Edition</enterpriseLicenseLink> license is required to use this feature. This feature is also available in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
-    "ossEnterpriseEditionRequired": "The <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is required to use this feature. This feature is also available in <pangolinCloudLink>Pangolin Cloud</pangolinCloudLink>.",
+    "licenseRequiredToUse": "An Enterprise license is required to use this feature.",
+    "ossEnterpriseEditionRequired": "The <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is required to use this feature.",
     "certResolver": "Certificate Resolver",
     "certResolverDescription": "Select the certificate resolver to use for this resource.",
     "selectCertResolver": "Select Certificate Resolver",

server/db/sqlite/schema/privateSchema.ts

@@ -79,7 +79,6 @@ export const subscriptionItems = sqliteTable("subscriptionItems", {
     subscriptionItemId: integer("subscriptionItemId").primaryKey({
         autoIncrement: true
     }),
-    stripeSubscriptionItemId: text("stripeSubscriptionItemId"),
     subscriptionId: text("subscriptionId")
         .notNull()
         .references(() => subscriptions.subscriptionId, {

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.15.3";
+export const APP_VERSION = "1.15.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/private/lib/config.ts

@@ -65,11 +65,6 @@ export class PrivateConfig {
                 this.rawPrivateConfig.branding?.logo?.dark_path || undefined;
         }
 
-        if (this.rawPrivateConfig.app.identity_provider_mode) {
-            process.env.IDENTITY_PROVIDER_MODE =
-                this.rawPrivateConfig.app.identity_provider_mode;
-        }
-
         process.env.BRANDING_LOGO_AUTH_WIDTH = this.rawPrivateConfig.branding
             ?.logo?.auth_page?.width
             ? this.rawPrivateConfig.branding?.logo?.auth_page?.width.toString()
@@ -134,6 +129,10 @@ export class PrivateConfig {
             process.env.USE_PANGOLIN_DNS =
                 this.rawPrivateConfig.flags.use_pangolin_dns.toString();
         }
+        if (this.rawPrivateConfig.flags.use_org_only_idp) {
+            process.env.USE_ORG_ONLY_IDP =
+                this.rawPrivateConfig.flags.use_org_only_idp.toString();
+        }
     }
 
     public getRawPrivateConfig() {

server/private/lib/readConfigFile.ts

@@ -25,8 +25,7 @@ export const privateConfigSchema = z.object({
     app: z
         .object({
             region: z.string().optional().default("default"),
-            base_domain: z.string().optional(),
-            identity_provider_mode: z.enum(["global", "org"]).optional()
+            base_domain: z.string().optional()
         })
         .optional()
         .default({
@@ -96,7 +95,7 @@ export const privateConfigSchema = z.object({
         .object({
             enable_redis: z.boolean().optional().default(false),
             use_pangolin_dns: z.boolean().optional().default(false),
-            use_org_only_idp: z.boolean().optional()
+            use_org_only_idp: z.boolean().optional().default(false),
         })
         .optional()
         .prefault({}),
@@ -182,29 +181,7 @@ export const privateConfigSchema = z.object({
             // localFilePath: z.string().optional()
         })
         .optional()
-})
-    .transform((data) => {
-        // this to maintain backwards compatibility with the old config file
-        const identityProviderMode = data.app?.identity_provider_mode;
-        const useOrgOnlyIdp = data.flags?.use_org_only_idp;
-
-        if (identityProviderMode !== undefined) {
-            return data;
-        }
-        if (useOrgOnlyIdp === true) {
-            return {
-                ...data,
-                app: { ...data.app, identity_provider_mode: "org" as const }
-            };
-        }
-        if (useOrgOnlyIdp === false) {
-            return {
-                ...data,
-                app: { ...data.app, identity_provider_mode: "global" as const }
-            };
-        }
-        return data;
-    });
+});
 
 export function readPrivateConfigFile() {
     if (build == "oss") {

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -27,7 +27,6 @@ import config from "@server/lib/config";
 import { CreateOrgIdpResponse } from "@server/routers/orgIdp/types";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import privateConfig from "#private/lib/config";
 
 const paramsSchema = z.strictObject({ orgId: z.string().nonempty() });
 
@@ -93,18 +92,6 @@ export async function createOrgOidcIdp(
             );
         }
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         const {
             clientId,
             clientSecret,

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -22,7 +22,6 @@ import { fromError } from "zod-validation-error";
 import { idp, idpOidcConfig, idpOrg } from "@server/db";
 import { eq } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
-import privateConfig from "#private/lib/config";
 
 const paramsSchema = z
     .object({
@@ -60,18 +59,6 @@ export async function deleteOrgIdp(
 
         const { idpId } = parsedParams.data;
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         // Check if IDP exists
         const [existingIdp] = await db
             .select()

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -26,7 +26,6 @@ import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import privateConfig from "#private/lib/config";
 
 const paramsSchema = z
     .object({
@@ -98,18 +97,6 @@ export async function updateOrgOidcIdp(
             );
         }
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         const { idpId, orgId } = parsedParams.data;
         const {
             clientId,

server/routers/client/createClient.ts

@@ -26,7 +26,6 @@ import { generateId } from "@server/auth/sessions/app";
 import { OpenAPITags, registry } from "@server/openApi";
 import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
 import { getUniqueClientName } from "@server/db/names";
-import { build } from "@server/build";
 
 const createClientParamsSchema = z.strictObject({
     orgId: z.string()
@@ -196,12 +195,6 @@ export async function createClient(
             const randomExitNode =
                 exitNodesList[Math.floor(Math.random() * exitNodesList.length)];
 
-            if (!randomExitNode) {
-                return next(
-                    createHttpError(HttpCode.NOT_FOUND, `No exit nodes available. ${build == "saas" ? "Please contact support." : "You need to install gerbil to use the clients."}`)
-                );
-            }
-
             const [adminRole] = await trx
                 .select()
                 .from(roles)

server/setup/scriptsSqlite/1.15.3.ts

@@ -14,7 +14,6 @@ export default async function migration() {
         db.transaction(() => {
             db.prepare(`ALTER TABLE 'limits' ADD 'override' integer DEFAULT false;`).run();
             db.prepare(`ALTER TABLE 'subscriptionItems' ADD 'featureId' text;`).run();
-            db.prepare(`ALTER TABLE 'subscriptionItems' ADD 'stripeSubscriptionItemId' text;`).run();
             db.prepare(`ALTER TABLE 'subscriptions' ADD 'version' integer;`).run();
             db.prepare(`ALTER TABLE 'subscriptions' ADD 'type' text;`).run();
         })();

src/app/[orgId]/settings/(private)/idp/page.tsx

@@ -5,7 +5,6 @@ import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import IdpTable, { IdpRow } from "@app/components/OrgIdpTable";
 import { getTranslations } from "next-intl/server";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
-import { IdpGlobalModeBanner } from "@app/components/IdpGlobalModeBanner";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 type OrgIdpPageProps = {
@@ -37,8 +36,6 @@ export default async function OrgIdpPage(props: OrgIdpPageProps) {
                 description={t("idpManageDescription")}
             />
 
-            <IdpGlobalModeBanner />
-
             <PaidFeaturesAlert tiers={tierMatrix.orgOidc} />
 
             <IdpTable idps={idps} orgId={params.orgId} />

src/app/[orgId]/settings/general/security/page.tsx

@@ -44,6 +44,7 @@ import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import type { OrgContextType } from "@app/contexts/orgContext";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { isAppPageRouteDefinition } from "next/dist/server/route-definitions/app-page-route-definition";
 
 // Session length options in hours
 const SESSION_LENGTH_OPTIONS = [
@@ -218,10 +219,6 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
                                                 <SelectContent>
                                                     {LOG_RETENTION_OPTIONS.filter(
                                                         (option) => {
-                                                            if (build != "saas") {
-                                                                return true;
-                                                            }
-
                                                             let maxDays: number;
 
                                                             if (!subscriptionTier) {
@@ -317,10 +314,6 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
                                                             <SelectContent>
                                                                 {LOG_RETENTION_OPTIONS.filter(
                                                                     (option) => {
-                                                                        if (build != "saas") {
-                                                                            return true;
-                                                                        }
-
                                                                         let maxDays: number;
 
                                                                         if (!subscriptionTier) {
@@ -418,10 +411,6 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
                                                             <SelectContent>
                                                                 {LOG_RETENTION_OPTIONS.filter(
                                                                     (option) => {
-                                                                        if (build != "saas") {
-                                                                            return true;
-                                                                        }
-
                                                                         let maxDays: number;
 
                                                                         if (!subscriptionTier) {

src/app/[orgId]/settings/resources/proxy/[niceId]/authentication/page.tsx

@@ -132,7 +132,7 @@ export default function ResourceAuthenticationPage() {
     const { data: orgIdps = [], isLoading: isLoadingOrgIdps } = useQuery(
         orgQueries.identityProviders({
             orgId: org.org.orgId,
-            useOrgOnlyIdp: env.app.identityProviderMode === "org"
+            useOrgOnlyIdp: env.flags.useOrgOnlyIdp
         })
     );
 

src/app/admin/users/page.tsx

@@ -50,7 +50,7 @@ export default async function UsersPage(props: PageProps) {
                 title={t("userTitle")}
                 description={t("userDescription")}
             />
-            <Alert className="mb-6">
+            <Alert variant="neutral" className="mb-6">
                 <InfoIcon className="h-4 w-4" />
                 <AlertTitle className="font-semibold">
                     {t("userAbount")}

src/app/auth/login/page.tsx

@@ -76,13 +76,12 @@ export default async function Page(props: {
 
     // Only use SmartLoginForm if NOT (OSS build OR org-only IdP enabled)
     const useSmartLogin =
-        build === "saas" ||
-        (build === "enterprise" && env.app.identityProviderMode === "org");
+        build === "saas" || (build === "enterprise" && env.flags.useOrgOnlyIdp);
 
     let loginIdps: LoginFormIDP[] = [];
     if (!useSmartLogin) {
         // Load IdPs for DashboardLoginForm (OSS or org-only IdP mode)
-        if (build === "oss" || env.app.identityProviderMode !== "org") {
+        if (build === "oss" || !env.flags.useOrgOnlyIdp) {
             const idpsRes = await cache(
                 async () =>
                     await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
@@ -166,8 +165,7 @@ export default async function Page(props: {
                     forceLogin={forceLogin}
                     showOrgLogin={
                         !isInvite &&
-                        (build === "saas" ||
-                            env.app.identityProviderMode === "org")
+                        (build === "saas" || env.flags.useOrgOnlyIdp)
                     }
                     searchParams={searchParams}
                     defaultUser={defaultUser}
@@ -190,8 +188,7 @@ export default async function Page(props: {
                 </p>
             )}
 
-            {!isInvite &&
-            (build === "saas" || env.app.identityProviderMode === "org") ? (
+            {!isInvite && (build === "saas" || env.flags.useOrgOnlyIdp) ? (
                 <OrgSignInLink
                     href={`/auth/org${buildQueryString(searchParams)}`}
                     linkText={t("orgAuthSignInToOrg")}

src/app/auth/org/[orgId]/page.tsx

@@ -24,7 +24,7 @@ export default async function OrgAuthPage(props: {
 
     const env = pullEnv();
 
-    if (build !== "saas" && env.app.identityProviderMode !== "org") {
+    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
         const queryString = new URLSearchParams(searchParams as any).toString();
         redirect(`/auth/login${queryString ? `?${queryString}` : ""}`);
     }

src/app/auth/org/page.tsx

@@ -35,7 +35,7 @@ export default async function OrgAuthPage(props: {
 
     const env = pullEnv();
 
-    if (build !== "saas" && env.app.identityProviderMode !== "org") {
+    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
         redirect("/");
     }
 

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -202,7 +202,7 @@ export default async function ResourceAuthPage(props: {
     }
 
     let loginIdps: LoginFormIDP[] = [];
-    if (build === "saas" || env.app.identityProviderMode === "org") {
+    if (build === "saas" || env.flags.useOrgOnlyIdp) {
         if (subscribed) {
             const idpsRes = await cache(
                 async () =>

src/app/navigation.tsx

@@ -124,8 +124,7 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
             // PaidFeaturesAlert
             ...((build === "oss" && !env?.flags.disableEnterpriseFeatures) ||
             build === "saas" ||
-            env?.app.identityProviderMode === "org" ||
-            (env?.app.identityProviderMode === undefined && build !== "oss")
+            env?.flags.useOrgOnlyIdp
                 ? [
                       {
                           title: "sidebarIdentityProviders",
@@ -252,9 +251,7 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/admin/api-keys",
                 icon: <KeyRound className="size-4 flex-none" />
             },
-            ...(build === "oss" ||
-            env?.app.identityProviderMode === "global" ||
-            env?.app.identityProviderMode === undefined
+            ...(build === "oss" || !env?.flags.useOrgOnlyIdp
                 ? [
                       {
                           title: "sidebarIdentityProviders",

src/components/AuthPageBrandingForm.tsx

@@ -322,7 +322,7 @@ export default function AuthPageBrandingForm({
                                 </div>
 
                                 {build === "saas" ||
-                                env.env.app.identityProviderMode === "org" ? (
+                                env.env.flags.useOrgOnlyIdp ? (
                                     <>
                                         <div className="mt-3 mb-6">
                                             <SettingsSectionTitle>

src/components/IdpGlobalModeBanner.tsx

@@ -1,65 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useTranslations } from "next-intl";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { Info } from "lucide-react";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import { build } from "@server/build";
-
-export function IdpGlobalModeBanner() {
-    const t = useTranslations();
-    const { env } = useEnvContext();
-    const { isPaidUser, hasEnterpriseLicense } = usePaidStatus();
-
-    const identityProviderModeUndefined =
-        env.app.identityProviderMode === undefined;
-    const paidUserForOrgOidc = isPaidUser(tierMatrix.orgOidc);
-    const enterpriseUnlicensed =
-        build === "enterprise" && !hasEnterpriseLicense;
-
-    if (build === "saas") {
-        return null;
-    }
-
-    if (!identityProviderModeUndefined) {
-        return null;
-    }
-
-    const adminPanelLinkRenderer = (chunks: React.ReactNode) => (
-        <Link href="/admin/idp" className="font-medium underline">
-            {chunks}
-        </Link>
-    );
-
-    return (
-        <Alert className="mb-6">
-            <Info className="h-4 w-4" />
-            <AlertDescription>
-                {paidUserForOrgOidc
-                    ? t.rich("idpGlobalModeBanner", {
-                          adminPanelLink: adminPanelLinkRenderer,
-                          configDocsLink: (chunks) => (
-                              <Link
-                                  href="https://docs.pangolin.net/manage/identity-providers/add-an-idp#organization-identity-providers"
-                                  target="_blank"
-                                  rel="noopener noreferrer"
-                                  className="font-medium underline"
-                              >
-                                  {chunks}
-                              </Link>
-                          )
-                      })
-                    : enterpriseUnlicensed
-                      ? t.rich("idpGlobalModeBannerLicenseRequired", {
-                            adminPanelLink: adminPanelLinkRenderer
-                        })
-                      : t.rich("idpGlobalModeBannerUpgradeRequired", {
-                            adminPanelLink: adminPanelLinkRenderer
-                        })}
-            </AlertDescription>
-        </Alert>
-    );
-}

src/components/PaidFeaturesAlert.tsx

@@ -38,49 +38,15 @@ const bannerContentClassName = "py-3 px-4";
 const bannerRowClassName =
     "flex items-center gap-2.5 text-sm text-muted-foreground";
 const bannerIconClassName = "size-4 shrink-0 text-purple-500";
-const docsLinkClassName =
-    "inline-flex items-center gap-1 font-medium text-purple-600 underline";
-const PANGOLIN_CLOUD_SIGNUP_URL = "https://app.pangolin.net/auth/signup/";
-const ENTERPRISE_DOCS_URL =
-    "https://docs.pangolin.net/self-host/enterprise-edition";
 
 function getTierLinkRenderer(billingHref: string) {
     return function tierLinkRenderer(chunks: React.ReactNode) {
-        return (
-            <Link href={billingHref} className={docsLinkClassName}>
-                {chunks}
-            </Link>
-        );
-    };
-}
-
-function getPangolinCloudLinkRenderer() {
-    return function pangolinCloudLinkRenderer(chunks: React.ReactNode) {
         return (
             <Link
-                href={PANGOLIN_CLOUD_SIGNUP_URL}
-                target="_blank"
-                rel="noopener noreferrer"
-                className={docsLinkClassName}
+                href={billingHref}
+                className="inline-flex items-center gap-1 font-medium text-purple-600 underline"
             >
                 {chunks}
-                <ExternalLink className="size-3.5 shrink-0" />
-            </Link>
-        );
-    };
-}
-
-function getDocsLinkRenderer(href: string) {
-    return function docsLinkRenderer(chunks: React.ReactNode) {
-        return (
-            <Link
-                href={href}
-                target="_blank"
-                rel="noopener noreferrer"
-                className={docsLinkClassName}
-            >
-                {chunks}
-                <ExternalLink className="size-3.5 shrink-0" />
             </Link>
         );
     };
@@ -100,8 +66,6 @@ export function PaidFeaturesAlert({ tiers }: Props) {
     const requiredTierName = requiredTier ? t(TIER_TRANSLATION_KEYS[requiredTier]) : null;
     const billingHref = orgId ? `/${orgId}/settings/billing` : "https://pangolin.net/pricing";
     const tierLinkRenderer = getTierLinkRenderer(billingHref);
-    const pangolinCloudLinkRenderer = getPangolinCloudLinkRenderer();
-    const enterpriseDocsLinkRenderer = getDocsLinkRenderer(ENTERPRISE_DOCS_URL);
 
     if (env.flags.disableEnterpriseFeatures) {
         return null;
@@ -139,12 +103,7 @@ export function PaidFeaturesAlert({ tiers }: Props) {
                     <CardContent className={bannerContentClassName}>
                         <div className={bannerRowClassName}>
                             <KeyRound className={bannerIconClassName} />
-                            <span>
-                                {t.rich("licenseRequiredToUse", {
-                                    enterpriseLicenseLink: enterpriseDocsLinkRenderer,
-                                    pangolinCloudLink: pangolinCloudLinkRenderer
-                                })}
-                            </span>
+                            <span>{t("licenseRequiredToUse")}</span>
                         </div>
                     </CardContent>
                 </Card>
@@ -157,8 +116,17 @@ export function PaidFeaturesAlert({ tiers }: Props) {
                             <KeyRound className={bannerIconClassName} />
                             <span>
                                 {t.rich("ossEnterpriseEditionRequired", {
-                                    enterpriseEditionLink: enterpriseDocsLinkRenderer,
-                                    pangolinCloudLink: pangolinCloudLinkRenderer
+                                    enterpriseEditionLink: (chunks) => (
+                                        <Link
+                                            href="https://docs.pangolin.net/self-host/enterprise-edition"
+                                            target="_blank"
+                                            rel="noopener noreferrer"
+                                            className="inline-flex items-center gap-1 font-medium text-purple-600 underline"
+                                        >
+                                            {chunks}
+                                            <ExternalLink className="size-3.5 shrink-0" />
+                                        </Link>
+                                    )
                                 })}
                             </span>
                         </div>

src/components/PermissionsSelectBox.tsx

@@ -118,7 +118,7 @@ function getActionsCategories(root: boolean) {
         }
     };
 
-    if (root || build === "saas" || env.app.identityProviderMode === "org") {
+    if (root || build === "saas" || env.flags.useOrgOnlyIdp) {
         actionsByCategory["Identity Provider (IDP)"] = {
             [t("actionCreateIdp")]: "createIdp",
             [t("actionUpdateIdp")]: "updateIdp",

src/components/SignupForm.tsx

@@ -204,9 +204,7 @@ export default function SignupForm({
         ? env.branding.logo?.authPage?.height || 44
         : 44;
 
-    const showOrgBanner =
-        fromSmartLogin &&
-        (build === "saas" || env.app.identityProviderMode === "org");
+    const showOrgBanner = fromSmartLogin && (build === "saas" || env.flags.useOrgOnlyIdp);
     const orgBannerHref = redirect
         ? `/auth/org?redirect=${encodeURIComponent(redirect)}`
         : "/auth/org";
@@ -228,398 +226,388 @@ export default function SignupForm({
                 </Alert>
             )}
             <Card className="w-full max-w-md">
-                <CardHeader className="border-b">
-                    <div className="flex flex-row items-center justify-center">
-                        <BrandingLogo height={logoHeight} width={logoWidth} />
-                    </div>
-                    <div className="text-center space-y-1 pt-3">
-                        <p className="text-muted-foreground">{getSubtitle()}</p>
-                    </div>
-                </CardHeader>
-                <CardContent className="pt-6">
-                    <Form {...form}>
-                        <form
-                            onSubmit={form.handleSubmit(onSubmit)}
-                            className="space-y-4"
-                        >
-                            <FormField
-                                control={form.control}
-                                name="email"
-                                render={({ field }) => (
-                                    <FormItem>
-                                        <FormLabel>{t("email")}</FormLabel>
-                                        <FormControl>
+            <CardHeader className="border-b">
+                <div className="flex flex-row items-center justify-center">
+                    <BrandingLogo height={logoHeight} width={logoWidth} />
+                </div>
+                <div className="text-center space-y-1 pt-3">
+                    <p className="text-muted-foreground">{getSubtitle()}</p>
+                </div>
+            </CardHeader>
+            <CardContent className="pt-6">
+                <Form {...form}>
+                    <form
+                        onSubmit={form.handleSubmit(onSubmit)}
+                        className="space-y-4"
+                    >
+                        <FormField
+                            control={form.control}
+                            name="email"
+                            render={({ field }) => (
+                                <FormItem>
+                                    <FormLabel>{t("email")}</FormLabel>
+                                    <FormControl>
+                                        <Input
+                                            {...field}
+                                            disabled={!!emailParam}
+                                        />
+                                    </FormControl>
+                                    <FormMessage />
+                                </FormItem>
+                            )}
+                        />
+                        <FormField
+                            control={form.control}
+                            name="password"
+                            render={({ field }) => (
+                                <FormItem>
+                                    <div className="flex items-center gap-2">
+                                        <FormLabel>{t("password")}</FormLabel>
+                                        {passwordStrength.strength ===
+                                            "strong" && (
+                                            <Check className="h-4 w-4 text-green-500" />
+                                        )}
+                                    </div>
+                                    <FormControl>
+                                        <div className="relative">
                                             <Input
+                                                type="password"
                                                 {...field}
-                                                disabled={!!emailParam}
+                                                onChange={(e) => {
+                                                    field.onChange(e);
+                                                    setPasswordValue(
+                                                        e.target.value
+                                                    );
+                                                }}
+                                                className={cn(
+                                                    passwordStrength.strength ===
+                                                        "strong" &&
+                                                        "border-green-500 focus-visible:ring-green-500",
+                                                    passwordStrength.strength ===
+                                                        "medium" &&
+                                                        "border-yellow-500 focus-visible:ring-yellow-500",
+                                                    passwordStrength.strength ===
+                                                        "weak" &&
+                                                        passwordValue.length >
+                                                            0 &&
+                                                        "border-red-500 focus-visible:ring-red-500"
+                                                )}
+                                                autoComplete="new-password"
                                             />
-                                        </FormControl>
-                                        <FormMessage />
-                                    </FormItem>
-                                )}
-                            />
-                            <FormField
-                                control={form.control}
-                                name="password"
-                                render={({ field }) => (
-                                    <FormItem>
-                                        <div className="flex items-center gap-2">
-                                            <FormLabel>
-                                                {t("password")}
-                                            </FormLabel>
-                                            {passwordStrength.strength ===
-                                                "strong" && (
-                                                <Check className="h-4 w-4 text-green-500" />
-                                            )}
                                         </div>
-                                        <FormControl>
-                                            <div className="relative">
-                                                <Input
-                                                    type="password"
-                                                    {...field}
-                                                    onChange={(e) => {
-                                                        field.onChange(e);
-                                                        setPasswordValue(
-                                                            e.target.value
-                                                        );
-                                                    }}
-                                                    className={cn(
-                                                        passwordStrength.strength ===
-                                                            "strong" &&
-                                                            "border-green-500 focus-visible:ring-green-500",
-                                                        passwordStrength.strength ===
-                                                            "medium" &&
-                                                            "border-yellow-500 focus-visible:ring-yellow-500",
-                                                        passwordStrength.strength ===
-                                                            "weak" &&
-                                                            passwordValue.length >
-                                                                0 &&
-                                                            "border-red-500 focus-visible:ring-red-500"
-                                                    )}
-                                                    autoComplete="new-password"
+                                    </FormControl>
+
+                                    {passwordValue.length > 0 && (
+                                        <div className="space-y-3 mt-2">
+                                            {/* Password Strength Meter */}
+                                            <div className="space-y-2">
+                                                <div className="flex justify-between items-center">
+                                                    <span className="text-sm font-medium text-foreground">
+                                                        {t("passwordStrength")}
+                                                    </span>
+                                                    <span
+                                                        className={cn(
+                                                            "text-sm font-semibold",
+                                                            passwordStrength.strength ===
+                                                                "strong" &&
+                                                                "text-green-600 dark:text-green-400",
+                                                            passwordStrength.strength ===
+                                                                "medium" &&
+                                                                "text-yellow-600 dark:text-yellow-400",
+                                                            passwordStrength.strength ===
+                                                                "weak" &&
+                                                                "text-red-600 dark:text-red-400"
+                                                        )}
+                                                    >
+                                                        {t(
+                                                            `passwordStrength${passwordStrength.strength.charAt(0).toUpperCase() + passwordStrength.strength.slice(1)}`
+                                                        )}
+                                                    </span>
+                                                </div>
+                                                <Progress
+                                                    value={
+                                                        passwordStrength.percentage
+                                                    }
+                                                    className="h-2"
                                                 />
                                             </div>
-                                        </FormControl>
 
-                                        {passwordValue.length > 0 && (
-                                            <div className="space-y-3 mt-2">
-                                                {/* Password Strength Meter */}
-                                                <div className="space-y-2">
-                                                    <div className="flex justify-between items-center">
-                                                        <span className="text-sm font-medium text-foreground">
-                                                            {t(
-                                                                "passwordStrength"
-                                                            )}
-                                                        </span>
+                                            {/* Requirements Checklist */}
+                                            <div className="bg-muted rounded-lg p-3 space-y-2">
+                                                <div className="text-sm font-medium text-foreground mb-2">
+                                                    {t("passwordRequirements")}
+                                                </div>
+                                                <div className="grid grid-cols-1 gap-1.5">
+                                                    <div className="flex items-center gap-2">
+                                                        {passwordStrength
+                                                            .requirements
+                                                            .length ? (
+                                                            <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
+                                                        ) : (
+                                                            <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        )}
                                                         <span
                                                             className={cn(
-                                                                "text-sm font-semibold",
-                                                                passwordStrength.strength ===
-                                                                    "strong" &&
-                                                                    "text-green-600 dark:text-green-400",
-                                                                passwordStrength.strength ===
-                                                                    "medium" &&
-                                                                    "text-yellow-600 dark:text-yellow-400",
-                                                                passwordStrength.strength ===
-                                                                    "weak" &&
-                                                                    "text-red-600 dark:text-red-400"
+                                                                "text-sm",
+                                                                passwordStrength
+                                                                    .requirements
+                                                                    .length
+                                                                    ? "text-green-600 dark:text-green-400"
+                                                                    : "text-muted-foreground"
                                                             )}
                                                         >
                                                             {t(
-                                                                `passwordStrength${passwordStrength.strength.charAt(0).toUpperCase() + passwordStrength.strength.slice(1)}`
+                                                                "passwordRequirementLengthText"
                                                             )}
                                                         </span>
                                                     </div>
-                                                    <Progress
-                                                        value={
-                                                            passwordStrength.percentage
-                                                        }
-                                                        className="h-2"
-                                                    />
-                                                </div>
-
-                                                {/* Requirements Checklist */}
-                                                <div className="bg-muted rounded-lg p-3 space-y-2">
-                                                    <div className="text-sm font-medium text-foreground mb-2">
-                                                        {t(
-                                                            "passwordRequirements"
+                                                    <div className="flex items-center gap-2">
+                                                        {passwordStrength
+                                                            .requirements
+                                                            .uppercase ? (
+                                                            <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
+                                                        ) : (
+                                                            <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
                                                         )}
+                                                        <span
+                                                            className={cn(
+                                                                "text-sm",
+                                                                passwordStrength
+                                                                    .requirements
+                                                                    .uppercase
+                                                                    ? "text-green-600 dark:text-green-400"
+                                                                    : "text-muted-foreground"
+                                                            )}
+                                                        >
+                                                            {t(
+                                                                "passwordRequirementUppercaseText"
+                                                            )}
+                                                        </span>
                                                     </div>
-                                                    <div className="grid grid-cols-1 gap-1.5">
-                                                        <div className="flex items-center gap-2">
-                                                            {passwordStrength
-                                                                .requirements
-                                                                .length ? (
-                                                                <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
-                                                            ) : (
-                                                                <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                    <div className="flex items-center gap-2">
+                                                        {passwordStrength
+                                                            .requirements
+                                                            .lowercase ? (
+                                                            <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
+                                                        ) : (
+                                                            <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        )}
+                                                        <span
+                                                            className={cn(
+                                                                "text-sm",
+                                                                passwordStrength
+                                                                    .requirements
+                                                                    .lowercase
+                                                                    ? "text-green-600 dark:text-green-400"
+                                                                    : "text-muted-foreground"
                                                             )}
-                                                            <span
-                                                                className={cn(
-                                                                    "text-sm",
-                                                                    passwordStrength
-                                                                        .requirements
-                                                                        .length
-                                                                        ? "text-green-600 dark:text-green-400"
-                                                                        : "text-muted-foreground"
-                                                                )}
-                                                            >
-                                                                {t(
-                                                                    "passwordRequirementLengthText"
-                                                                )}
-                                                            </span>
-                                                        </div>
-                                                        <div className="flex items-center gap-2">
-                                                            {passwordStrength
-                                                                .requirements
-                                                                .uppercase ? (
-                                                                <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
-                                                            ) : (
-                                                                <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        >
+                                                            {t(
+                                                                "passwordRequirementLowercaseText"
                                                             )}
-                                                            <span
-                                                                className={cn(
-                                                                    "text-sm",
-                                                                    passwordStrength
-                                                                        .requirements
-                                                                        .uppercase
-                                                                        ? "text-green-600 dark:text-green-400"
-                                                                        : "text-muted-foreground"
-                                                                )}
-                                                            >
-                                                                {t(
-                                                                    "passwordRequirementUppercaseText"
-                                                                )}
-                                                            </span>
-                                                        </div>
-                                                        <div className="flex items-center gap-2">
-                                                            {passwordStrength
-                                                                .requirements
-                                                                .lowercase ? (
-                                                                <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
-                                                            ) : (
-                                                                <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        </span>
+                                                    </div>
+                                                    <div className="flex items-center gap-2">
+                                                        {passwordStrength
+                                                            .requirements
+                                                            .number ? (
+                                                            <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
+                                                        ) : (
+                                                            <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        )}
+                                                        <span
+                                                            className={cn(
+                                                                "text-sm",
+                                                                passwordStrength
+                                                                    .requirements
+                                                                    .number
+                                                                    ? "text-green-600 dark:text-green-400"
+                                                                    : "text-muted-foreground"
                                                             )}
-                                                            <span
-                                                                className={cn(
-                                                                    "text-sm",
-                                                                    passwordStrength
-                                                                        .requirements
-                                                                        .lowercase
-                                                                        ? "text-green-600 dark:text-green-400"
-                                                                        : "text-muted-foreground"
-                                                                )}
-                                                            >
-                                                                {t(
-                                                                    "passwordRequirementLowercaseText"
-                                                                )}
-                                                            </span>
-                                                        </div>
-                                                        <div className="flex items-center gap-2">
-                                                            {passwordStrength
-                                                                .requirements
-                                                                .number ? (
-                                                                <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
-                                                            ) : (
-                                                                <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        >
+                                                            {t(
+                                                                "passwordRequirementNumberText"
                                                             )}
-                                                            <span
-                                                                className={cn(
-                                                                    "text-sm",
-                                                                    passwordStrength
-                                                                        .requirements
-                                                                        .number
-                                                                        ? "text-green-600 dark:text-green-400"
-                                                                        : "text-muted-foreground"
-                                                                )}
-                                                            >
-                                                                {t(
-                                                                    "passwordRequirementNumberText"
-                                                                )}
-                                                            </span>
-                                                        </div>
-                                                        <div className="flex items-center gap-2">
-                                                            {passwordStrength
-                                                                .requirements
-                                                                .special ? (
-                                                                <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
-                                                            ) : (
-                                                                <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        </span>
+                                                    </div>
+                                                    <div className="flex items-center gap-2">
+                                                        {passwordStrength
+                                                            .requirements
+                                                            .special ? (
+                                                            <Check className="h-3.5 w-3.5 text-green-500 flex-shrink-0" />
+                                                        ) : (
+                                                            <X className="h-3.5 w-3.5 text-muted-foreground flex-shrink-0" />
+                                                        )}
+                                                        <span
+                                                            className={cn(
+                                                                "text-sm",
+                                                                passwordStrength
+                                                                    .requirements
+                                                                    .special
+                                                                    ? "text-green-600 dark:text-green-400"
+                                                                    : "text-muted-foreground"
                                                             )}
-                                                            <span
-                                                                className={cn(
-                                                                    "text-sm",
-                                                                    passwordStrength
-                                                                        .requirements
-                                                                        .special
-                                                                        ? "text-green-600 dark:text-green-400"
-                                                                        : "text-muted-foreground"
-                                                                )}
-                                                            >
-                                                                {t(
-                                                                    "passwordRequirementSpecialText"
-                                                                )}
-                                                            </span>
-                                                        </div>
+                                                        >
+                                                            {t(
+                                                                "passwordRequirementSpecialText"
+                                                            )}
+                                                        </span>
                                                     </div>
                                                 </div>
                                             </div>
-                                        )}
-
-                                        {/* Only show FormMessage when not showing our custom requirements */}
-                                        {passwordValue.length === 0 && (
-                                            <FormMessage />
-                                        )}
-                                    </FormItem>
-                                )}
-                            />
-                            <FormField
-                                control={form.control}
-                                name="confirmPassword"
-                                render={({ field }) => (
-                                    <FormItem>
-                                        <div className="flex items-center gap-2">
-                                            <FormLabel>
-                                                {t("confirmPassword")}
-                                            </FormLabel>
-                                            {doPasswordsMatch && (
-                                                <Check className="h-4 w-4 text-green-500" />
-                                            )}
                                         </div>
-                                        <FormControl>
-                                            <div className="relative">
-                                                <Input
-                                                    type="password"
-                                                    {...field}
-                                                    onChange={(e) => {
-                                                        field.onChange(e);
-                                                        setConfirmPasswordValue(
-                                                            e.target.value
+                                    )}
+
+                                    {/* Only show FormMessage when not showing our custom requirements */}
+                                    {passwordValue.length === 0 && (
+                                        <FormMessage />
+                                    )}
+                                </FormItem>
+                            )}
+                        />
+                        <FormField
+                            control={form.control}
+                            name="confirmPassword"
+                            render={({ field }) => (
+                                <FormItem>
+                                    <div className="flex items-center gap-2">
+                                        <FormLabel>
+                                            {t("confirmPassword")}
+                                        </FormLabel>
+                                        {doPasswordsMatch && (
+                                            <Check className="h-4 w-4 text-green-500" />
+                                        )}
+                                    </div>
+                                    <FormControl>
+                                        <div className="relative">
+                                            <Input
+                                                type="password"
+                                                {...field}
+                                                onChange={(e) => {
+                                                    field.onChange(e);
+                                                    setConfirmPasswordValue(
+                                                        e.target.value
+                                                    );
+                                                }}
+                                                className={cn(
+                                                    doPasswordsMatch &&
+                                                        "border-green-500 focus-visible:ring-green-500",
+                                                    confirmPasswordValue.length >
+                                                        0 &&
+                                                        !doPasswordsMatch &&
+                                                        "border-red-500 focus-visible:ring-red-500"
+                                                )}
+                                                autoComplete="new-password"
+                                            />
+                                        </div>
+                                    </FormControl>
+                                    {confirmPasswordValue.length > 0 &&
+                                        !doPasswordsMatch && (
+                                            <p className="text-sm text-red-600 mt-1">
+                                                {t("passwordsDoNotMatch")}
+                                            </p>
+                                        )}
+                                    {/* Only show FormMessage when field is empty */}
+                                    {confirmPasswordValue.length === 0 && (
+                                        <FormMessage />
+                                    )}
+                                </FormItem>
+                            )}
+                        />
+                        {build === "saas" && (
+                            <>
+                                <FormField
+                                    control={form.control}
+                                    name="agreeToTerms"
+                                    render={({ field }) => (
+                                        <FormItem className="flex flex-row items-center">
+                                            <FormControl>
+                                                <Checkbox
+                                                    checked={field.value}
+                                                    onCheckedChange={(
+                                                        checked
+                                                    ) => {
+                                                        field.onChange(checked);
+                                                        handleTermsChange(
+                                                            checked as boolean
                                                         );
                                                     }}
-                                                    className={cn(
-                                                        doPasswordsMatch &&
-                                                            "border-green-500 focus-visible:ring-green-500",
-                                                        confirmPasswordValue.length >
-                                                            0 &&
-                                                            !doPasswordsMatch &&
-                                                            "border-red-500 focus-visible:ring-red-500"
-                                                    )}
-                                                    autoComplete="new-password"
                                                 />
-                                            </div>
-                                        </FormControl>
-                                        {confirmPasswordValue.length > 0 &&
-                                            !doPasswordsMatch && (
-                                                <p className="text-sm text-red-600 mt-1">
-                                                    {t("passwordsDoNotMatch")}
-                                                </p>
-                                            )}
-                                        {/* Only show FormMessage when field is empty */}
-                                        {confirmPasswordValue.length === 0 && (
-                                            <FormMessage />
-                                        )}
-                                    </FormItem>
-                                )}
-                            />
-                            {build === "saas" && (
-                                <>
-                                    <FormField
-                                        control={form.control}
-                                        name="agreeToTerms"
-                                        render={({ field }) => (
-                                            <FormItem className="flex flex-row items-center">
-                                                <FormControl>
-                                                    <Checkbox
-                                                        checked={field.value}
-                                                        onCheckedChange={(
-                                                            checked
-                                                        ) => {
-                                                            field.onChange(
-                                                                checked
-                                                            );
-                                                            handleTermsChange(
-                                                                checked as boolean
-                                                            );
-                                                        }}
-                                                    />
-                                                </FormControl>
-                                                <div className="leading-none">
-                                                    <FormLabel className="text-sm font-normal">
-                                                        <div>
-                                                            {t(
-                                                                "signUpTerms.IAgreeToThe"
-                                                            )}{" "}
-                                                            <a
-                                                                href="https://pangolin.net/terms-of-service.html"
-                                                                target="_blank"
-                                                                rel="noopener noreferrer"
-                                                                className="text-primary hover:underline"
-                                                            >
-                                                                {t(
-                                                                    "signUpTerms.termsOfService"
-                                                                )}{" "}
-                                                            </a>
-                                                            {t(
-                                                                "signUpTerms.and"
-                                                            )}{" "}
-                                                            <a
-                                                                href="https://pangolin.net/privacy-policy.html"
-                                                                target="_blank"
-                                                                rel="noopener noreferrer"
-                                                                className="text-primary hover:underline"
-                                                            >
-                                                                {t(
-                                                                    "signUpTerms.privacyPolicy"
-                                                                )}
-                                                            </a>
-                                                        </div>
-                                                    </FormLabel>
-                                                    <FormMessage />
-                                                </div>
-                                            </FormItem>
-                                        )}
-                                    />
-                                    <FormField
-                                        control={form.control}
-                                        name="marketingEmailConsent"
-                                        render={({ field }) => (
-                                            <FormItem className="flex flex-row items-start">
-                                                <FormControl>
-                                                    <Checkbox
-                                                        checked={field.value}
-                                                        onCheckedChange={
-                                                            field.onChange
-                                                        }
-                                                    />
-                                                </FormControl>
-                                                <div className="leading-none">
-                                                    <FormLabel className="text-sm font-normal">
+                                            </FormControl>
+                                            <div className="leading-none">
+                                                <FormLabel className="text-sm font-normal">
+                                                    <div>
                                                         {t(
-                                                            "signUpMarketing.keepMeInTheLoop"
-                                                        )}
-                                                    </FormLabel>
-                                                    <FormMessage />
-                                                </div>
-                                            </FormItem>
-                                        )}
-                                    />
-                                </>
-                            )}
+                                                            "signUpTerms.IAgreeToThe"
+                                                        )}{" "}
+                                                        <a
+                                                            href="https://pangolin.net/terms-of-service.html"
+                                                            target="_blank"
+                                                            rel="noopener noreferrer"
+                                                            className="text-primary hover:underline"
+                                                        >
+                                                            {t(
+                                                                "signUpTerms.termsOfService"
+                                                            )}{" "}
+                                                        </a>
+                                                        {t("signUpTerms.and")}{" "}
+                                                        <a
+                                                            href="https://pangolin.net/privacy-policy.html"
+                                                            target="_blank"
+                                                            rel="noopener noreferrer"
+                                                            className="text-primary hover:underline"
+                                                        >
+                                                            {t(
+                                                                "signUpTerms.privacyPolicy"
+                                                            )}
+                                                        </a>
+                                                    </div>
+                                                </FormLabel>
+                                                <FormMessage />
+                                            </div>
+                                        </FormItem>
+                                    )}
+                                />
+                                <FormField
+                                    control={form.control}
+                                    name="marketingEmailConsent"
+                                    render={({ field }) => (
+                                        <FormItem className="flex flex-row items-start">
+                                            <FormControl>
+                                                <Checkbox
+                                                    checked={field.value}
+                                                    onCheckedChange={
+                                                        field.onChange
+                                                    }
+                                                />
+                                            </FormControl>
+                                            <div className="leading-none">
+                                                <FormLabel className="text-sm font-normal">
+                                                    {t(
+                                                        "signUpMarketing.keepMeInTheLoop"
+                                                    )}
+                                                </FormLabel>
+                                                <FormMessage />
+                                            </div>
+                                        </FormItem>
+                                    )}
+                                />
+                            </>
+                        )}
 
-                            {error && (
-                                <Alert variant="destructive">
-                                    <AlertDescription>{error}</AlertDescription>
-                                </Alert>
-                            )}
+                        {error && (
+                            <Alert variant="destructive">
+                                <AlertDescription>{error}</AlertDescription>
+                            </Alert>
+                        )}
 
-                            <Button type="submit" className="w-full">
-                                {t("createAccount")}
-                            </Button>
-                        </form>
-                    </Form>
-                </CardContent>
-            </Card>
+                        <Button type="submit" className="w-full">
+                            {t("createAccount")}
+                        </Button>
+                </form>
+            </Form>
+        </CardContent>
+    </Card>
         </>
     );
 }

src/lib/pullEnv.ts

@@ -32,11 +32,7 @@ export function pullEnv(): Env {
                     process.env.NEW_RELEASES_NOTIFICATION_ENABLED === "true"
                         ? true
                         : false
-            },
-            identityProviderMode: process.env.IDENTITY_PROVIDER_MODE as
-                | "org"
-                | "global"
-                | undefined
+            }
         },
         email: {
             emailEnabled: process.env.EMAIL_ENABLED === "true" ? true : false
@@ -68,6 +64,8 @@ export function pullEnv(): Env {
                 process.env.FLAGS_DISABLE_PRODUCT_HELP_BANNERS === "true"
                     ? true
                     : false,
+            useOrgOnlyIdp:
+                process.env.USE_ORG_ONLY_IDP === "true" ? true : false,
             disableEnterpriseFeatures:
                 process.env.DISABLE_ENTERPRISE_FEATURES === "true"
                     ? true

src/lib/types/env.ts

@@ -8,7 +8,6 @@ export type Env = {
             product_updates: boolean;
             new_releases: boolean;
         };
-        identityProviderMode?: "global" | "org";
     };
     server: {
         externalPort: string;
@@ -35,6 +34,7 @@ export type Env = {
         hideSupporterKey: boolean;
         usePangolinDns: boolean;
         disableProductHelpBanners: boolean;
+        useOrgOnlyIdp: boolean;
         disableEnterpriseFeatures: boolean;
     };
     branding: {