Bump brace-expansion

Bumps  and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together.

Updates `brace-expansion` from 5.0.6 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.9)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.9)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

messages/en-US.json

@@ -1449,11 +1449,8 @@
     "actionSetResourcePincode": "Set Resource Pincode",
     "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist",
     "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
     "actionGetResourcePolicy": "Get Resource Policy",
     "actionUpdateResourcePolicy": "Update Resource Policy",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
     "actionSetResourcePolicyUsers": "Set Resource Policy Users",
     "actionSetResourcePolicyRoles": "Set Resource Policy Roles",
     "actionSetResourcePolicyPassword": "Set Resource Policy Password",

package-lock.json

@@ -9504,15 +9504,15 @@
             "license": "MIT"
         },
         "node_modules/brace-expansion": {
-            "version": "5.0.6",
+            "version": "5.0.9",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-            "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+            "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^4.0.2"
             },
             "engines": {
-                "node": "18 || 20 || >=22"
+                "node": "20 || >=22"
             }
         },
         "node_modules/braces": {
@@ -11645,9 +11645,9 @@
             "license": "MIT"
         },
         "node_modules/eslint-config-next/node_modules/brace-expansion": {
-            "version": "1.1.14",
+            "version": "1.1.18",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-            "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+            "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {

server/db/pg/schema/privateSchema.ts

@@ -95,8 +95,7 @@ export const subscriptions = pgTable("subscriptions", {
     billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }),
     expiresAt: bigint("expiresAt", { mode: "number" }),
     trial: boolean("trial").default(false),
-    type: varchar("type", { length: 50 }), // tier1, tier2, tier3, or license
+    type: varchar("type", { length: 50 }) // tier1, tier2, tier3, or license
-    override: boolean("override").default(false)
 });
 
 export const subscriptionItems = pgTable("subscriptionItems", {

server/db/sqlite/schema/privateSchema.ts

@@ -89,8 +89,7 @@ export const subscriptions = sqliteTable("subscriptions", {
     expiresAt: integer("expiresAt"),
     trial: integer("trial", { mode: "boolean" }).default(false),
     billingCycleAnchor: integer("billingCycleAnchor"),
-    type: text("type"), // tier1, tier2, tier3, or license
+    type: text("type") // tier1, tier2, tier3, or license
-    override: integer("override", { mode: "boolean" }).default(false)
 });
 
 export const subscriptionItems = sqliteTable("subscriptionItems", {

server/lib/readConfigFile.ts

@@ -266,13 +266,13 @@ export const configSchema = z
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(30),
+                            .default(10),
                         burst: z
                             .number()
                             .positive()
                             .gt(0)
                             .optional()
-                            .default(50)
+                            .default(16)
                     })
                     .optional()
                     .prefault({})

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -53,15 +53,6 @@ export async function handleSubscriptionDeleted(
             return;
         }
 
-        // If the subscription has been manually overridden, we lock it down
-        // so Stripe can no longer change (or delete) its status locally.
-        if (existingSubscription.override === true) {
-            logger.info(
-                `Subscription ${subscription.id} is locked (override=true). Ignoring deletion event from Stripe.`
-            );
-            return;
-        }
-
         await db
             .delete(subscriptions)
             .where(eq(subscriptions.subscriptionId, subscription.id));

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -68,25 +68,11 @@ export async function handleSubscriptionUpdated(
         const type = getSubType(fullSubscription);
         const previousType = existingSubscription.type as SubscriptionType | null;
 
-        // If the subscription has been manually overridden, we lock the
-        // status down so Stripe webhooks can no longer change it.
-        const isLocked = existingSubscription.override === true;
-        if (isLocked) {
-            logger.info(
-                `Subscription ${subscription.id} is locked (override=true). Ignoring status change from Stripe (would have been ${subscription.status}).`
-            );
-        }
-        const effectiveStatus = isLocked
-            ? existingSubscription.status
-            : subscription.status;
-
         await db
             .update(subscriptions)
             .set({
-                status: effectiveStatus,
+                status: subscription.status,
-                canceledAt: isLocked
+                canceledAt: subscription.canceled_at
-                    ? existingSubscription.canceledAt
-                    : subscription.canceled_at
                     ? subscription.canceled_at
                     : null,
                 updatedAt: Math.floor(Date.now() / 1000),
@@ -289,23 +275,23 @@ export async function handleSubscriptionUpdated(
                 // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
                 await handleSubscriptionLifesycle(
                     customer.orgId,
-                    effectiveStatus,
+                    subscription.status,
                     type
                 );
 
                 // Handle feature lifecycle when subscription is canceled or becomes unpaid
                 if (
-                    effectiveStatus === "canceled" ||
+                    subscription.status === "canceled" ||
-                    effectiveStatus === "unpaid" ||
+                    subscription.status === "unpaid" ||
-                    effectiveStatus === "incomplete_expired"
+                    subscription.status === "incomplete_expired"
                 ) {
                     logger.info(
-                        `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
+                        `Subscription ${subscription.id} for org ${customer.orgId} is ${subscription.status}, disabling paid features`
                     );
                     await handleTierChange(customer.orgId, null, previousType ?? undefined);
                 }
             } else if (type === "license") {
-                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
+                if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") {
                     try {
                         // WARNING:
                         // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
+import { certificates, db, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,28 +63,14 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .leftJoin(
+        .innerJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .leftJoin(
+        .where(and(inArray(certificates.domain, domainList)));
-            domainNamespaces,
-            eq(domains.domainId, domainNamespaces.domainId)
-        )
-        .where(
-            and(
-                inArray(certificates.domain, domainList),
-                // Namespace domains are shared across all orgs, so they skip
-                // the org-ownership check (mirrors verifyCertificateAccess).
-                or(
-                    isNotNull(orgDomains.orgId),
-                    isNotNull(domainNamespaces.domainNamespaceId)
-                )
-            )
-        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -124,27 +110,19 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .leftJoin(
+            .innerJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
-            .leftJoin(
-                domainNamespaces,
-                eq(domains.domainId, domainNamespaces.domainId)
-            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
-                    ),
-                    or(
-                        isNotNull(orgDomains.orgId),
-                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

server/routers/badger/verifySession.ts

@@ -127,9 +127,6 @@ export async function verifyResourceSession(
         // Extract HTTP Basic Auth credentials if present
         const clientHeaderAuth = extractBasicAuth(headers);
 
-        const clientUserAgent = headers?.["user-agent"] || headers?.["User-Agent"];
-        const clientIsBrowser = isBrowserUserAgent(clientUserAgent);
-
         const clientIp = requestIp
             ? stripPortFromHost(requestIp, badgerVersion)
             : undefined;
@@ -316,14 +313,9 @@ export async function verifyResourceSession(
             return allowed(res, undefined, dontStripSession);
         }
 
-        // Only offer a browser redirect to clients that can actually follow one and log in
+        const redirectPath = `/auth/resource/${encodeURIComponent(
-        // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
-        // an unauthorized response from Badger instead of a login redirect URL.
-        const redirectPath = clientIsBrowser
-            ? `/auth/resource/${encodeURIComponent(
             resource.resourceGuid
-              )}?redirect=${encodeURIComponent(originalRequestURL)}`
+        )}?redirect=${encodeURIComponent(originalRequestURL)}`;
-            : undefined;
 
         // check for access token in headers
         if (
@@ -1484,46 +1476,6 @@ async function getCountryCodeFromIp(ip: string): Promise<string | undefined> {
     return cachedCountryCode;
 }
 
-// Permissive by default: only reject known non-browser clients or a missing
-// User-Agent (real browsers always send one). This avoids blocking real
-// browsers whose UA string doesn't match a hardcoded allow-list.
-const NON_BROWSER_USER_AGENT_PATTERNS = [
-    /curl/,
-    /wget/,
-    /python-requests/,
-    /python-urllib/,
-    /go-http-client/,
-    /okhttp/,
-    /axios/,
-    /node-fetch/,
-    /postmanruntime/,
-    /insomnia/,
-    /libwww-perl/,
-    /java\//,
-    /ruby/,
-    /php/,
-    /bot/,
-    /spider/,
-    /crawler/,
-    /headlesschrome/,
-    /phantomjs/,
-    /httpclient/,
-    /prometheus/,
-    /go-resty/,
-    /apache-httpclient/,
-    /scrapy/
-];
-
-function isBrowserUserAgent(userAgent: string | undefined): boolean {
-    if (!userAgent) {
-        return false;
-    }
-
-    const ua = userAgent.toLowerCase();
-
-    return !NON_BROWSER_USER_AGENT_PATTERNS.some((pattern) => pattern.test(ua));
-}
-
 function extractBasicAuth(
     headers: Record<string, string> | undefined
 ): string | undefined {

server/routers/integration.ts

@@ -726,8 +726,8 @@ authenticated.post(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl
@@ -742,8 +742,8 @@ authenticated.put(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl

server/routers/role/createRole.ts

@@ -34,9 +34,7 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources,
+    ActionsEnum.listResources
-    ActionsEnum.getSiteResource,
-    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,13 +3,11 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
-    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels,
+    labels
-    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -325,48 +323,7 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        let accessibleSiteResourceIds: number[];
+        const conditions = [and(eq(siteResources.orgId, orgId))];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
-        const conditions = [
-            and(
-                eq(siteResources.orgId, orgId),
-                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
-            )
-        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,17 +1,11 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
+import { db, networks, siteNetworks } from "@server/db";
-    db,
-    networks,
-    roleSiteResources,
-    siteNetworks,
-    userSiteResources
-} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -165,47 +159,10 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
-        let accessibleSiteResourceIds: number[];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId),
+            eq(siteResources.orgId, orgId)
-            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/setup/migrationsPg.ts

@@ -28,7 +28,6 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
-import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -56,8 +55,7 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 },
+    { version: "1.21.0", run: m22 }
-    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,7 +47,6 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
-import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -92,8 +91,7 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 },
+    { version: "1.21.0", run: m44 }
-    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -1,37 +0,0 @@
-import { db } from "@server/db/pg/driver";
-import { sql } from "drizzle-orm";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    try {
-        await db.execute(sql`BEGIN`);
-
-        for (const actionId of actionsToGrant) {
-            await db.execute(sql`
-                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ${actionId}, r."orgId"
-                FROM "roles" r
-                WHERE COALESCE(r."isAdmin", false) = false
-                  AND NOT EXISTS (
-                    SELECT 1 FROM "roleActions" ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ${actionId}
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-        }
-
-        await db.execute(sql`COMMIT`);
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        await db.execute(sql`ROLLBACK`);
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    }
-}

server/setup/scriptsSqlite/1.21.1.ts

@@ -1,43 +0,0 @@
-import { APP_PATH } from "@server/lib/consts";
-import Database from "better-sqlite3";
-import path from "path";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    const location = path.join(APP_PATH, "db", "db.sqlite");
-    const db = new Database(location);
-
-    try {
-        db.transaction(() => {
-            const insertRoleAction = db.prepare(`
-                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ?, r."orgId"
-                FROM 'roles' r
-                WHERE COALESCE(r."isAdmin", 0) = 0
-                  AND NOT EXISTS (
-                    SELECT 1 FROM 'roleActions' ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ?
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-
-            for (const actionId of actionsToGrant) {
-                insertRoleAction.run(actionId, actionId);
-            }
-        })();
-
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    } finally {
-        db.close();
-    }
-}

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx

@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                     <SettingsSectionDescription>
                         {t("remoteExitNodeNetworkingDescription")}
                         <a
-                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
+                            href="https://docs.pangolin.net/placeholder"
                             target="_blank"
                             rel="noopener noreferrer"
                             className="text-primary hover:underline inline-flex items-center gap-1"

src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx

@@ -38,6 +38,18 @@ import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
+const accessControlsFormSchema = z.object({
+    username: z.string(),
+    autoProvisioned: z.boolean(),
+    roles: z.array(
+        z.object({
+            id: z.string(),
+            text: z.string(),
+            isAdmin: z.boolean().optional()
+        })
+    )
+});
+
 export default function AccessControlsPage() {
     const { orgUser: user, updateOrgUser } = userOrgUserContext();
     const { user: sessionUser } = useUserContext();
@@ -57,20 +69,6 @@ export default function AccessControlsPage() {
             (build === "enterprise" && !isPaid) ||
             (build === "oss" && !isPaid));
 
-    const accessControlsFormSchema = z.object({
-        username: z.string(),
-        autoProvisioned: z.boolean(),
-        roles: z
-            .array(
-                z.object({
-                    id: z.string(),
-                    text: z.string(),
-                    isAdmin: z.boolean().optional()
-                })
-            )
-            .min(1, { message: t("accessRoleSelectPlease") })
-    });
-
     const form = useForm({
         resolver: zodResolver(accessControlsFormSchema),
         defaultValues: {
@@ -110,6 +108,15 @@ export default function AccessControlsPage() {
     async function executeSave() {
         const values = form.getValues();
 
+        if (values.roles.length === 0) {
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return;
+        }
+
         setIsSaving(true);
         try {
             const roleIds = values.roles.map((r) => parseInt(r.id, 10));
@@ -163,6 +170,15 @@ export default function AccessControlsPage() {
 
         const values = form.getValues();
 
+        if (values.roles.length === 0) {
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return;
+        }
+
         const willHaveAdminRole = values.roles.some((r) => r.isAdmin === true);
 
         const isRemovingOwnAdmin =

src/components/ContactSalesBanner.tsx

@@ -24,7 +24,6 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <span className="whitespace-nowrap">
                         <Link
                             href="https://pangolin.net/contact"
                             target="_blank"
@@ -36,7 +35,6 @@ export function ContactSalesBanner() {
                         </Link>
                         .
                     </span>
-                    </span>
                 </div>
             </div>
         </div>

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
+import { REGEXP_ONLY_DIGITS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,11 +82,9 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="text"
+                                            inputMode="numeric"
                                             autoFocus
-                                            pattern={
+                                            pattern={REGEXP_ONLY_DIGITS}
-                                                REGEXP_ONLY_DIGITS_AND_CHARS
-                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {

src/components/OrgInfoCard.tsx

@@ -8,7 +8,6 @@ import {
     InfoSections,
     InfoSectionTitle
 } from "@app/components/InfoSection";
-import CopyToClipboard from "@app/components/CopyToClipboard";
 import { useTranslations } from "next-intl";
 
 type OrgInfoCardProps = {};
@@ -27,9 +26,7 @@ export default function OrgInfoCard({}: OrgInfoCardProps) {
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("orgId")}</InfoSectionTitle>
-                        <InfoSectionContent>
+                        <InfoSectionContent>{org.org.orgId}</InfoSectionContent>
-                            <CopyToClipboard text={org.org.orgId} />
-                        </InfoSectionContent>
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("subnet")}</InfoSectionTitle>

src/components/OrgRolesTagField.tsx

@@ -9,15 +9,17 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 
+import { toast } from "@app/hooks/useToast";
 import { useTranslations } from "next-intl";
 
+import { useRef } from "react";
 import type { FieldValues, Path, UseFormReturn } from "react-hook-form";
 import { RolesSelector, type SelectedRole } from "./roles-selector";
 
 type OrgRolesTagFieldProps<TFieldValues extends FieldValues> = {
     form: Pick<
         UseFormReturn<TFieldValues>,
-        "control" | "getValues" | "setValue" | "clearErrors"
+        "control" | "getValues" | "setValue"
     >;
     orgId: string;
     /** Field in the form that holds Tag[] (role tags). Default: `"roles"`. */
@@ -40,6 +42,46 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
     disabled
 }: OrgRolesTagFieldProps<TFieldValues>) {
     const t = useTranslations();
+    const isPopoverOpenRef = useRef(false);
+    const lastValidRolesRef = useRef<SelectedRole[]>(
+        (form.getValues(name) as SelectedRole[]) ?? []
+    );
+
+    function validateRolesSelection() {
+        const current = form.getValues(name) as SelectedRole[];
+
+        if (current.length === 0 && lastValidRolesRef.current.length > 0) {
+            form.setValue(name, lastValidRolesRef.current as never, {
+                shouldDirty: true
+            });
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return false;
+        }
+
+        if (current.length > 0) {
+            lastValidRolesRef.current = current;
+        }
+
+        return true;
+    }
+
+    function handlePopoverOpenChange(open: boolean) {
+        isPopoverOpenRef.current = open;
+
+        if (open) {
+            const current = form.getValues(name) as SelectedRole[];
+            if (current.length > 0) {
+                lastValidRolesRef.current = current;
+            }
+            return;
+        }
+
+        validateRolesSelection();
+    }
 
     function setRoleTags(nextValue: SelectedRole[]) {
         const prev = form.getValues(name) as SelectedRole[];
@@ -57,14 +99,15 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             form.setValue(name, [prev[prev.length - 1]] as never, {
                 shouldDirty: true
             });
-            form.clearErrors(name);
             return;
         }
 
         form.setValue(name, next as never, { shouldDirty: true });
 
-        if (next.length > 0) {
+        if (next.length > 0 && !isPopoverOpenRef.current) {
-            form.clearErrors(name);
+            lastValidRolesRef.current = next;
+        } else if (!isPopoverOpenRef.current) {
+            validateRolesSelection();
         }
     }
 
@@ -74,6 +117,9 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             name={name}
             render={({ field }) => {
                 const selectedRoles = (field.value ?? []) as SelectedRole[];
+                if (!isPopoverOpenRef.current && selectedRoles.length > 0) {
+                    lastValidRolesRef.current = selectedRoles;
+                }
 
                 return (
                     <FormItem className="flex flex-col items-start">
@@ -83,6 +129,7 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
                                 orgId={orgId}
                                 selectedRoles={selectedRoles}
                                 onSelectRoles={setRoleTags}
+                                onPopoverOpenChange={handlePopoverOpenChange}
                                 disabled={disabled}
                             />
                         </FormControl>

src/components/PermissionsSelectBox.tsx

@@ -115,11 +115,8 @@ function getActionsCategories(root: boolean) {
         },
 
         "Resource Policy": {
-            [t("actionListResourcePolicies")]: "listResourcePolicies",
-            [t("actionCreateResourcePolicy")]: "createResourcePolicy",
             [t("actionGetResourcePolicy")]: "getResourcePolicy",
             [t("actionUpdateResourcePolicy")]: "updateResourcePolicy",
-            [t("actionDeleteResourcePolicy")]: "deleteResourcePolicy",
             [t("actionSetResourcePolicyUsers")]: "setResourcePolicyUsers",
             [t("actionSetResourcePolicyRoles")]: "setResourcePolicyRoles",
             [t("actionSetResourcePolicyPassword")]: "setResourcePolicyPassword",

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || (!isLoading && data === null)) {
+    } else if (isError || initialCertValue === null) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }