🐛 Fix log retention access pulling from the wrong org settings field

server/private/lib/logAccessAudit.ts

@@ -28,7 +28,7 @@ async function getAccessDays(orgId: string): Promise<number> {
 
     const [org] = await db
         .select({
-            settingsLogRetentionDaysAction: orgs.settingsLogRetentionDaysAction
+            settingsLogRetentionDaysAccess: orgs.settingsLogRetentionDaysAccess
         })
         .from(orgs)
         .where(eq(orgs.orgId, orgId))
@@ -41,11 +41,11 @@ async function getAccessDays(orgId: string): Promise<number> {
     // store the result in cache
     await cache.set(
         `org_${orgId}_accessDays`,
-        org.settingsLogRetentionDaysAction,
+        org.settingsLogRetentionDaysAccess,
         300
     );
 
-    return org.settingsLogRetentionDaysAction;
+    return org.settingsLogRetentionDaysAccess;
 }
 
 export async function cleanUpOldLogs(orgId: string, retentionDays: number) {

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
+import { certificates, db, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,28 +63,14 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .leftJoin(
+        .innerJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .leftJoin(
+        .where(and(inArray(certificates.domain, domainList)));
-            domainNamespaces,
-            eq(domains.domainId, domainNamespaces.domainId)
-        )
-        .where(
-            and(
-                inArray(certificates.domain, domainList),
-                // Namespace domains are shared across all orgs, so they skip
-                // the org-ownership check (mirrors verifyCertificateAccess).
-                or(
-                    isNotNull(orgDomains.orgId),
-                    isNotNull(domainNamespaces.domainNamespaceId)
-                )
-            )
-        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -124,27 +110,19 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .leftJoin(
+            .innerJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
-            .leftJoin(
-                domainNamespaces,
-                eq(domains.domainId, domainNamespaces.domainId)
-            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
-                    ),
-                    or(
-                        isNotNull(orgDomains.orgId),
-                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

server/routers/role/createRole.ts

@@ -34,9 +34,7 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources,
+    ActionsEnum.listResources
-    ActionsEnum.getSiteResource,
-    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,13 +3,11 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
-    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels,
+    labels
-    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -325,48 +323,7 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        let accessibleSiteResourceIds: number[];
+        const conditions = [and(eq(siteResources.orgId, orgId))];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
-        const conditions = [
-            and(
-                eq(siteResources.orgId, orgId),
-                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
-            )
-        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,17 +1,11 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
+import { db, networks, siteNetworks } from "@server/db";
-    db,
-    networks,
-    roleSiteResources,
-    siteNetworks,
-    userSiteResources
-} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -165,47 +159,10 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
-        let accessibleSiteResourceIds: number[];
-        if (req.user) {
-            const accessibleSiteResources = await db
-                .select({
-                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
-                })
-                .from(userSiteResources)
-                .fullJoin(
-                    roleSiteResources,
-                    eq(
-                        userSiteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userSiteResources.userId, req.user.userId),
-                        inArray(
-                            roleSiteResources.roleId,
-                            req.userOrgRoleIds ?? []
-                        )
-                    )
-                );
-            accessibleSiteResourceIds = accessibleSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        } else {
-            const allOrgSiteResources = await db
-                .select({ siteResourceId: siteResources.siteResourceId })
-                .from(siteResources)
-                .where(eq(siteResources.orgId, orgId));
-            accessibleSiteResourceIds = allOrgSiteResources.map(
-                (row) => row.siteResourceId
-            );
-        }
-
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId),
+            eq(siteResources.orgId, orgId)
-            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/setup/migrationsPg.ts

@@ -28,7 +28,6 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
-import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -56,8 +55,7 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 },
+    { version: "1.21.0", run: m22 }
-    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,7 +47,6 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
-import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -92,8 +91,7 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 },
+    { version: "1.21.0", run: m44 }
-    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -1,37 +0,0 @@
-import { db } from "@server/db/pg/driver";
-import { sql } from "drizzle-orm";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    try {
-        await db.execute(sql`BEGIN`);
-
-        for (const actionId of actionsToGrant) {
-            await db.execute(sql`
-                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ${actionId}, r."orgId"
-                FROM "roles" r
-                WHERE COALESCE(r."isAdmin", false) = false
-                  AND NOT EXISTS (
-                    SELECT 1 FROM "roleActions" ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ${actionId}
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-        }
-
-        await db.execute(sql`COMMIT`);
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        await db.execute(sql`ROLLBACK`);
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    }
-}

server/setup/scriptsSqlite/1.21.1.ts

@@ -1,43 +0,0 @@
-import { APP_PATH } from "@server/lib/consts";
-import Database from "better-sqlite3";
-import path from "path";
-
-const version = "1.21.1";
-
-const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
-
-export default async function migration() {
-    console.log(`Running setup script ${version}...`);
-
-    const location = path.join(APP_PATH, "db", "db.sqlite");
-    const db = new Database(location);
-
-    try {
-        db.transaction(() => {
-            const insertRoleAction = db.prepare(`
-                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
-                SELECT r."roleId", ?, r."orgId"
-                FROM 'roles' r
-                WHERE COALESCE(r."isAdmin", 0) = 0
-                  AND NOT EXISTS (
-                    SELECT 1 FROM 'roleActions' ra
-                    WHERE ra."roleId" = r."roleId"
-                      AND ra."actionId" = ?
-                      AND ra."orgId" = r."orgId"
-                  );
-            `);
-
-            for (const actionId of actionsToGrant) {
-                insertRoleAction.run(actionId, actionId);
-            }
-        })();
-
-        console.log(`Finished setup script ${version}`);
-    } catch (e) {
-        console.log("Unable to migrate database");
-        console.log(e);
-        throw e;
-    } finally {
-        db.close();
-    }
-}

src/components/ContactSalesBanner.tsx

@@ -24,7 +24,6 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <span className="whitespace-nowrap">
                         <Link
                             href="https://pangolin.net/contact"
                             target="_blank"
@@ -36,7 +35,6 @@ export function ContactSalesBanner() {
                         </Link>
                         .
                     </span>
-                    </span>
                 </div>
             </div>
         </div>

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
+import { REGEXP_ONLY_DIGITS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,11 +82,9 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="text"
+                                            inputMode="numeric"
                                             autoFocus
-                                            pattern={
+                                            pattern={REGEXP_ONLY_DIGITS}
-                                                REGEXP_ONLY_DIGITS_AND_CHARS
-                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || (!isLoading && data === null)) {
+    } else if (isError || initialCertValue === null) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }