✨ delete org

Fix: Use variant instead of type only for the Org login IDPs

messages/en-US.json

@@ -465,6 +465,8 @@
     "apiKeysDelete": "Delete API Key",
     "apiKeysManage": "Manage API Keys",
     "apiKeysDescription": "API keys are used to authenticate with the integration API",
+    "orgsManage": "Manage Organizations",
+    "orgsDescription": "View and manage all organizations on this instance",
     "provisioningKeysTitle": "Provisioning Key",
     "provisioningKeysManage": "Manage Provisioning Keys",
     "provisioningKeysDescription": "Provisioning keys are used to authenticate automated site provisioning for your organization.",
@@ -2089,6 +2091,7 @@
     "resourceBudgetSettings": "Budget",
     "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
     "sidebarApiKeys": "API Keys",
+    "sidebarOrgs": "Organizations",
     "sidebarProvisioning": "Provisioning",
     "sidebarSettings": "Settings",
     "sidebarAllUsers": "All Users",

server/db/pg/schema/schema.ts

@@ -1984,7 +1984,7 @@ export const aiSessionLog = pgTable(
         // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
         truncated: boolean("truncated").notNull().default(false),
         statusCode: integer("statusCode"),
-        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch ms
+        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch seconds
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/db/sqlite/schema/schema.ts

@@ -1980,7 +1980,7 @@ export const aiSessionLog = sqliteTable(
             .notNull()
             .default(false),
         statusCode: integer("statusCode"),
-        createdAt: integer("createdAt").notNull() // epoch ms
+        createdAt: integer("createdAt").notNull() // epoch seconds
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/lib/aiBudgetEnforcement.ts

@@ -580,6 +580,8 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             );
         }
 
+        const timestamp = Math.floor(Date.now() / 1000);
+
         usageRecordBuffer.push({
             orgId: input.orgId,
             providerId: input.providerId,
@@ -597,7 +599,7 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             totalTokens,
             costUsd: input.costUsd,
             estimated: usage.estimated,
-            createdAt: input.createdAt ?? Date.now()
+            createdAt: input.createdAt ?? timestamp
         });
 
         // Flush immediately if buffer is full, otherwise schedule a flush

server/lib/blueprints/applyBlueprint.ts

@@ -1,5 +1,6 @@
 import {
     db,
+    primaryDb,
     newts,
     blueprints,
     Blueprint,
@@ -80,93 +81,103 @@ export async function applyBlueprint({
                 trx,
                 siteId
             );
+        });
 
-            // We need to update the targets on the newts from the successfully updated information
-            for (const result of publicResourcesResults) {
-                for (const target of result.targetsToUpdate) {
-                    const [site] = await trx
-                        .select()
-                        .from(sites)
-                        .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                        .where(
-                            and(
-                                eq(sites.siteId, target.siteId),
-                                eq(sites.orgId, orgId),
-                                eq(sites.type, "newt"),
-                                isNotNull(sites.pubKey)
-                            )
+        // Push updates to newts/clients only after the transaction has
+        // committed. Doing this while the transaction is still open can
+        // race with the writes (e.g. newts requesting config before the
+        // new targets/resources are actually visible), leaving them out
+        // of sync until manually toggled.
+
+        // We need to update the targets on the newts from the successfully updated information
+        for (const result of publicResourcesResults) {
+            for (const target of result.targetsToUpdate) {
+                // read from the primary: this determines whether/how we push
+                // the just-created target to the newt, so a lagging replica
+                // returning stale or missing data here would silently skip
+                // the push
+                const [site] = await primaryDb
+                    .select()
+                    .from(sites)
+                    .innerJoin(newts, eq(sites.siteId, newts.siteId))
+                    .where(
+                        and(
+                            eq(sites.siteId, target.siteId),
+                            eq(sites.orgId, orgId),
+                            eq(sites.type, "newt"),
+                            isNotNull(sites.pubKey)
                         )
-                        .limit(1);
+                    )
+                    .limit(1);
 
-                    if (site) {
-                        logger.debug(
-                            `Updating target ${target.targetId} on site ${site.sites.siteId}`
+                if (site) {
+                    logger.debug(
+                        `Updating target ${target.targetId} on site ${site.sites.siteId}`
+                    );
+
+                    // see if you can find a matching target health check from the healthchecksToUpdate array
+                    const matchingHealthcheck =
+                        result.healthchecksToUpdate.find(
+                            (hc) => hc.targetId === target.targetId
                         );
 
-                        // see if you can find a matching target health check from the healthchecksToUpdate array
-                        const matchingHealthcheck =
-                            result.healthchecksToUpdate.find(
-                                (hc) => hc.targetId === target.targetId
-                            );
-
-                        if (["http", "tcp", "udp"].includes(target.mode)) {
-                            await addProxyTargets(
-                                site.newt.newtId,
-                                [target],
-                                matchingHealthcheck
-                                    ? [matchingHealthcheck]
-                                    : [],
-                                result.proxyResource.mode === "udp"
-                                    ? "udp"
-                                    : "tcp",
-                                site.newt.version
-                            );
-                        } else if (
-                            ["ssh", "rdp", "vnc"].includes(target.mode)
-                        ) {
-                            await sendBrowserGatewayTargets(
-                                site.newt.newtId,
-                                [target],
-                                site.newt.version
-                            );
-                        }
+                    if (["http", "tcp", "udp"].includes(target.mode)) {
+                        await addProxyTargets(
+                            site.newt.newtId,
+                            [target],
+                            matchingHealthcheck
+                                ? [matchingHealthcheck]
+                                : [],
+                            result.proxyResource.mode === "udp"
+                                ? "udp"
+                                : "tcp",
+                            site.newt.version
+                        );
+                    } else if (
+                        ["ssh", "rdp", "vnc"].includes(target.mode)
+                    ) {
+                        await sendBrowserGatewayTargets(
+                            site.newt.newtId,
+                            [target],
+                            site.newt.version
+                        );
                     }
                 }
             }
+        }
 
-            logger.debug(
-                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
-            );
+        logger.debug(
+            `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
+        );
 
-            // We need to update the targets on the newts from the successfully updated information
-            for (const result of privateResourcesResults) {
-                rebuildClientAssociationsFromSiteResource(
-                    result.newSiteResource
+        // We need to update the targets on the newts from the successfully updated information
+        for (const result of privateResourcesResults) {
+            rebuildClientAssociationsFromSiteResource(
+                result.newSiteResource
+            )
+                .then(() =>
+                    waitForSiteResourceRebuildIdle(
+                        result.newSiteResource.siteResourceId
+                    )
                 )
-                    .then(() =>
-                        waitForSiteResourceRebuildIdle(
-                            result.newSiteResource.siteResourceId
-                        )
+                .then(() =>
+                    handleMessagingForUpdatedSiteResource(
+                        result.oldSiteResource,
+                        result.newSiteResource,
+                        result.oldSites.map((s) => s.siteId),
+                        result.newSites.map((s) => s.siteId)
                     )
-                    .then(() =>
-                        handleMessagingForUpdatedSiteResource(
-                            result.oldSiteResource,
-                            result.newSiteResource,
-                            result.oldSites.map((s) => s.siteId),
-                            result.newSites.map((s) => s.siteId)
-                        )
-                    )
-                    .catch((e) => {
-                        logger.error(
-                            `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
-                        );
-                    });
-            }
+                )
+                .catch((e) => {
+                    logger.error(
+                        `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
+                    );
+                });
+        }
 
-            logger.debug(
-                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
-            );
-        });
+        logger.debug(
+            `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+        );
 
         blueprintSucceeded = true;
         blueprintMessage = "Blueprint applied successfully";

server/lib/domainUtils.ts

@@ -52,8 +52,7 @@ export async function validateAndConstructDomain(
             };
         }
 
-        // Check if organization has access to domain
-        if (domainRes.orgDomains && domainRes.orgDomains.orgId !== orgId) {
+        if (!domainRes.orgDomains) {
             return {
                 success: false,
                 error: `Organization does not have access to domain with ID ${domainId}`

server/lib/textCompression.ts

@@ -0,0 +1,15 @@
+import { gzipSync, gunzipSync } from "zlib";
+
+/**
+ * Gzip a string and return it as base64 so it can be stored in a TEXT column.
+ */
+export function compressText(value: string): string {
+    return gzipSync(Buffer.from(value, "utf8")).toString("base64");
+}
+
+/**
+ * Reverse of compressText - base64-decode and gunzip back to the original string.
+ */
+export function decompressText(value: string): string {
+    return gunzipSync(Buffer.from(value, "base64")).toString("utf8");
+}

server/private/lib/logStreaming/LogStreamingManager.ts

@@ -25,6 +25,7 @@ import {
 import logger from "@server/logger";
 import { and, eq, gt, desc, max, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
+import { decompressText } from "@server/lib/textCompression";
 import config from "@server/lib/config";
 import {
     LogType,
@@ -680,8 +681,8 @@ export class LogStreamingManager {
                     Record<string, unknown> & { id: number }
                 >;
 
-            case "aiSession":
-                return (await logsDb
+            case "aiSession": {
+                const rows = (await logsDb
                     .select()
                     .from(aiSessionLog)
                     .where(
@@ -694,6 +695,33 @@ export class LogStreamingManager {
                     .limit(limit)) as Array<
                     Record<string, unknown> & { id: number }
                 >;
+
+                const compressedFields = [
+                    "requestBody",
+                    "responseBody",
+                    "normalizedRequest",
+                    "normalizedResponse"
+                ] as const;
+
+                for (const row of rows) {
+                    for (const field of compressedFields) {
+                        const value = row[field];
+                        if (typeof value !== "string") {
+                            continue;
+                        }
+                        try {
+                            row[field] = decompressText(value);
+                        } catch (error) {
+                            logger.error(
+                                `Failed to decompress AI session log field ${field}`,
+                                { error }
+                            );
+                        }
+                    }
+                }
+
+                return rows;
+            }
         }
     }
 

server/private/routers/aiGateway/logAiSession.ts

@@ -18,6 +18,7 @@ import { and, eq, lt } from "drizzle-orm";
 import cache from "#private/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { sanitizeString } from "@server/lib/sanitize";
+import { compressText } from "@server/lib/textCompression";
 import type { AiCapability } from "@server/lib/aiCapabilities";
 import {
     normalizeAiRequest,
@@ -151,17 +152,14 @@ async function getRetentionDays(orgId: string): Promise<number> {
 }
 
 export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
-    // calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
-    // requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
-    // match aiUsageRecords - convert before comparing.
-    const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
+    const cutoffTimestamp = calculateCutoffTimestamp(retentionDays);
 
     try {
         await logsDb
             .delete(aiSessionLog)
             .where(
                 and(
-                    lt(aiSessionLog.createdAt, cutoffTimestampMs),
+                    lt(aiSessionLog.createdAt, cutoffTimestamp),
                     eq(aiSessionLog.orgId, orgId)
                 )
             );
@@ -243,6 +241,8 @@ export function logAiSession(data: {
                 );
             }
 
+            const timestamp = Math.floor(Date.now() / 1000);
+
             sessionLogBuffer.push({
                 sessionId: data.sessionId,
                 orgId: sanitizeString(data.orgId),
@@ -256,13 +256,19 @@ export function logAiSession(data: {
                 ),
                 requestedModel: sanitizeString(data.requestedModel),
                 isStream: data.isStream,
-                requestBody: sanitizeString(requestBodyText.value),
-                responseBody: sanitizeString(responseBodyText.value),
+                requestBody: compressText(
+                    sanitizeString(requestBodyText.value)
+                ),
+                responseBody: compressText(
+                    sanitizeString(responseBodyText.value)
+                ),
                 normalizedRequest: normalizedRequestText
-                    ? sanitizeString(normalizedRequestText.value)
+                    ? compressText(sanitizeString(normalizedRequestText.value))
                     : undefined,
                 normalizedResponse: normalizedResponseText
-                    ? sanitizeString(normalizedResponseText.value)
+                    ? compressText(
+                          sanitizeString(normalizedResponseText.value)
+                      )
                     : undefined,
                 truncated:
                     requestBodyText.truncated ||
@@ -270,7 +276,7 @@ export function logAiSession(data: {
                     (normalizedRequestText?.truncated ?? false) ||
                     (normalizedResponseText?.truncated ?? false),
                 statusCode: data.statusCode,
-                createdAt: Date.now()
+                createdAt: timestamp
             });
 
             // Flush immediately if buffer is full, otherwise schedule a flush

server/routers/auditLogs/aiUsageAnalyticsShared.ts

@@ -18,7 +18,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -31,7 +31,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",
@@ -122,12 +122,12 @@ export function buildAiUsageWhere(
     );
 }
 
-// Buckets createdAt (epoch ms) down to a per-day string, dialect-aware, same
-// approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
+// Buckets createdAt (epoch seconds) down to a per-day string, dialect-aware,
+// same approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
 export function dayBucketExpr() {
     return driver === "pg"
-        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt} / 1000.0))`
-        : sql<string>`DATE(${aiUsageRecords.createdAt} / 1000, 'unixepoch')`;
+        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt}))`
+        : sql<string>`DATE(${aiUsageRecords.createdAt}, 'unixepoch')`;
 }
 
 export type DailyMetricRow<K extends string> = {

server/routers/auditLogs/exportAiSessionLog.ts

@@ -11,7 +11,8 @@ import {
     queryAiSessionLogsQuery,
     queryAiSessionLogsParams,
     queryAiSession,
-    countAiSessionQuery
+    countAiSessionQuery,
+    decompressAiSessionLogRow
 } from "./queryAiSessionLog";
 import { generateCSV } from "./generateCSV";
 
@@ -87,7 +88,9 @@ export async function exportAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);
+        const log = (await baseQuery.limit(MAX_EXPORT_LIMIT)).map(
+            decompressAiSessionLogRow
+        );
 
         const csvData = generateCSV(log);
 

server/routers/auditLogs/queryAiSessionLog.ts

@@ -24,6 +24,7 @@ import { AI_CAPABILITIES } from "@server/lib/aiCapabilities";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
+import { decompressText } from "@server/lib/textCompression";
 
 export const queryAiSessionLogsQuery = z.strictObject({
     // iso string just validate its a parseable date
@@ -32,7 +33,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -45,7 +46,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
@@ -166,6 +167,35 @@ export function queryAiSession(data: Q) {
         .orderBy(desc(aiSessionLog.createdAt));
 }
 
+function decompressField(value: string | null): string | null {
+    if (value == null) {
+        return value;
+    }
+    try {
+        return decompressText(value);
+    } catch (error) {
+        logger.error("Failed to decompress AI session log field", { error });
+        return value;
+    }
+}
+
+export function decompressAiSessionLogRow<
+    T extends {
+        requestBody: string | null;
+        responseBody: string | null;
+        normalizedRequest: string | null;
+        normalizedResponse: string | null;
+    }
+>(row: T): T {
+    return {
+        ...row,
+        requestBody: decompressField(row.requestBody),
+        responseBody: decompressField(row.responseBody),
+        normalizedRequest: decompressField(row.normalizedRequest),
+        normalizedResponse: decompressField(row.normalizedResponse)
+    };
+}
+
 async function enrichWithDetails(
     logs: Awaited<ReturnType<typeof queryAiSession>>
 ) {
@@ -620,7 +650,9 @@ export async function queryAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const logsRaw = await baseQuery.limit(data.limit).offset(data.offset);
+        const logsRaw = (
+            await baseQuery.limit(data.limit).offset(data.offset)
+        ).map(decompressAiSessionLogRow);
 
         const log = await enrichWithDetails(logsRaw);
 

server/routers/auditLogs/queryAiUsageFilterOptions.ts

@@ -30,14 +30,14 @@ const queryAiUsageFilterOptionsQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .prefault(() => getSevenDaysAgo().toISOString()),
     timeEnd: z
         .string()
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => new Date(val).getTime())
+        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
         .prefault(() => new Date().toISOString())
 });
 

server/routers/external.ts

@@ -66,6 +66,10 @@ import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";
 
+function rateLimitIdentityKey(value: unknown): string {
+    return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
 // Root routes
 export const unauthenticated = Router();
 
@@ -83,6 +87,12 @@ authenticated.get("/org/checkId", org.checkId);
 authenticated.put("/org", getUserOrgs, org.createOrg);
 
 authenticated.get("/orgs", verifyUserIsServerAdmin, org.listOrgs);
+authenticated.get("/admin/orgs", verifyUserIsServerAdmin, org.adminListOrgs);
+authenticated.delete(
+    "/admin/org/:orgId",
+    verifyUserIsServerAdmin,
+    org.adminDeleteOrg
+);
 authenticated.get("/user/:userId/orgs", verifyIsLoggedInUser, org.listUserOrgs);
 
 authenticated.get(
@@ -1927,7 +1937,7 @@ authRouter.put(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${ipKeyGenerator(req.ip || "")}:${req.body.email}`,
+            `signup:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1942,7 +1952,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `login:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `login:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only log in ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1959,7 +1969,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
+            `lookupUser:${rateLimitIdentityKey(req.body.identifier) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2037,7 +2047,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only enable 2FA ${15} times every ${15} minutes. Please try again later.`;
@@ -2053,7 +2063,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only request a 2FA code ${15} times every ${15} minutes. Please try again later.`;
@@ -2085,7 +2095,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `signup:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2103,7 +2113,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestEmailVerificationCode:${req.user?.email || ipKeyGenerator(req.ip || "")}`,
+            `requestEmailVerificationCode:${rateLimitIdentityKey(req.user?.email) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request an email verification code ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2125,7 +2135,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestPasswordReset:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `requestPasswordReset:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2141,7 +2151,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `resetPassword:${req.body.email || ipKeyGenerator(req.ip || "")}`,
+            `resetPassword:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2188,7 +2198,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${req.body.email}:${req.params.resourceId}`,
+            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}:${req.params.resourceId}`,
         handler: (req, res, next) => {
             const message = `You can only request an email OTP ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2240,7 +2250,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000, // 15 minutes
         max: 10, // Allow 10 authentication attempts per 15 minutes per IP
         keyGenerator: (req) => {
-            return `securityKeyAuth:${req.body.email || ipKeyGenerator(req.ip || "")}`;
+            return `securityKeyAuth:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only attempt security key authentication ${10} times every ${15} minutes. Please try again later.`;

server/routers/org/adminDeleteOrg.ts

@@ -0,0 +1,98 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
+import { db, orgs } from "@server/db";
+import { eq } from "drizzle-orm";
+
+const adminDeleteOrgSchema = z.strictObject({
+    orgId: z.string()
+});
+
+export type AdminDeleteOrgResponse = {};
+
+registry.registerPath({
+    method: "delete",
+    path: "/admin/org/{orgId}",
+    description: "Delete any organization in the system (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: adminDeleteOrgSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function adminDeleteOrg(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = adminDeleteOrgSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (!org) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Organization with ID ${orgId} not found`
+                )
+            );
+        }
+
+        const result = await deleteOrgById(orgId);
+        sendTerminationMessages(result);
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Organization deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}

server/routers/org/adminListOrgs.ts

@@ -0,0 +1,241 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, users } from "@server/db";
+import { orgs, resources, sites, userOrgs } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { and, asc, desc, eq, like, or, sql, type SQL } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+const adminListOrgsSchema = z.strictObject({
+    pageSize: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional(),
+    sort_by: z
+        .enum(["name", "createdAt"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["name", "createdAt"],
+            description: "Field to sort by"
+        }),
+    order: z
+        .enum(["asc", "desc"])
+        .optional()
+        .default("asc")
+        .catch("asc")
+        .openapi({
+            type: "string",
+            enum: ["asc", "desc"],
+            default: "asc",
+            description: "Sort order"
+        })
+});
+
+export type AdminOrgRow = {
+    orgId: string;
+    name: string;
+    subnet: string | null;
+    utilitySubnet: string | null;
+    createdAt: string | null;
+    userCount: number;
+    siteCount: number;
+    resourceCount: number;
+    owner: {
+        userId: string;
+        username: string;
+    } | null;
+};
+
+export type AdminListOrgsResponse = PaginatedResponse<{
+    orgs: AdminOrgRow[];
+}>;
+
+const AdminListOrgsResponseDataSchema = z.object({
+    orgs: z.array(
+        z.object({
+            orgId: z.string(),
+            name: z.string(),
+            subnet: z.string().nullable(),
+            createdAt: z.string().nullable(),
+            userCount: z.number(),
+            siteCount: z.number(),
+            resourceCount: z.number()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        page: z.number(),
+        pageSize: z.number()
+    })
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/admin/orgs",
+    description:
+        "List all organizations in the system with usage counts (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        query: adminListOrgsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        AdminListOrgsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
+export async function adminListOrgs(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = adminListOrgsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const { pageSize, page, query, sort_by, order } = parsedQuery.data;
+
+        let conditions: (SQL<unknown> | undefined)[] = [];
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            conditions.push(
+                or(
+                    like(sql`LOWER(${orgs.name})`, q),
+                    like(sql`LOWER(${orgs.orgId})`, q),
+                    like(sql`LOWER(${orgs.subnet})`, q)
+                )
+            );
+        }
+
+        const sortColumns = {
+            name: orgs.name,
+            createdAt: orgs.createdAt
+        } as const;
+
+        const orderBy = sort_by
+            ? order === "asc"
+                ? asc(sortColumns[sort_by])
+                : desc(sortColumns[sort_by])
+            : asc(orgs.name);
+
+        // Drizzle renders bare column references in the select list without their
+        // table prefix, which would make a correlated subquery compare a column to
+        // itself, so the outer `orgs` side is qualified explicitly.
+        const orgIdRef = sql`${sql.identifier("orgs")}.${sql.identifier("orgId")}`;
+
+        const [countRows, rows] = await Promise.all([
+            db
+                .select({ count: sql<number>`count(*)` })
+                .from(orgs)
+                .where(and(...conditions)),
+            db
+                .selectDistinct({
+                    orgId: orgs.orgId,
+                    name: orgs.name,
+                    subnet: orgs.subnet,
+                    utilitySubnet: orgs.utilitySubnet,
+                    createdAt: orgs.createdAt,
+                    userCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${userOrgs}
+                        WHERE ${userOrgs.orgId} = ${orgIdRef}
+                    )`.as("userCount"),
+                    siteCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${sites}
+                        WHERE ${sites.orgId} = ${orgIdRef}
+                    )`.as("siteCount"),
+                    resourceCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${resources}
+                        WHERE ${resources.orgId} = ${orgIdRef}
+                    )`.as("resourceCount"),
+                    owner: {
+                        userId: users.userId,
+                        username: users.username
+                    }
+                })
+                .from(orgs)
+                .where(and(...conditions, eq(userOrgs.isOwner, true)))
+                .leftJoin(userOrgs, eq(userOrgs.orgId, orgs.orgId))
+                .leftJoin(users, eq(userOrgs.userId, users.userId))
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(orderBy)
+        ]);
+
+        const totalCount = Number(countRows[0]?.count ?? 0);
+
+        return response<AdminListOrgsResponse>(res, {
+            data: {
+                orgs: rows.map((row) => ({
+                    ...row,
+                    userCount: Number(row.userCount ?? 0),
+                    siteCount: Number(row.siteCount ?? 0),
+                    resourceCount: Number(row.resourceCount ?? 0)
+                })),
+                pagination: {
+                    total: totalCount,
+                    page,
+                    pageSize
+                }
+            },
+            success: true,
+            error: false,
+            message: "Organizations retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}

server/routers/org/getOrg.ts

@@ -16,13 +16,12 @@ const getOrgSchema = z.strictObject({
 });
 
 export type GetOrgResponse = {
-    org: Org;
+    org: Omit<Org, "sshCaPrivateKey">;
 };
 const GetOrgResponseDataSchema = z.object({
     org: z.object({}).passthrough()
 });
 
-
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}",
@@ -76,9 +75,12 @@ export async function getOrg(
             );
         }
 
+        // sshCaPrivateKey is encrypted anyway but just to be safe
+        const { sshCaPrivateKey: _, ...orgWithoutPrivateKey } = org;
+
         return response<GetOrgResponse>(res, {
             data: {
-                org
+                org: orgWithoutPrivateKey
             },
             success: true,
             error: false,

server/routers/org/index.ts

@@ -9,3 +9,5 @@ export * from "./listOrgs";
 export * from "./pickOrgDefaults";
 export * from "./checkOrgUserAccess";
 export * from "./resetOrgBandwidth";
+export * from "./adminListOrgs";
+export * from "./adminDeleteOrg";

server/routers/siteResource/getSiteResource.ts

@@ -18,7 +18,7 @@ const getSiteResourceParamsSchema = z.strictObject({
         .pipe(z.int().positive().optional())
         .optional(),
     niceId: z.string().optional(),
-    orgId: z.string()
+    orgId: z.string().optional()
 });
 
 async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
@@ -34,6 +34,13 @@ async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
             )
             .limit(1);
         return siteResource;
+    } else if (siteResourceId) {
+        const [siteResource] = await db
+            .select()
+            .from(siteResources)
+            .where(eq(siteResources.siteResourceId, siteResourceId))
+            .limit(1);
+        return siteResource;
     } else if (niceId && orgId) {
         const [siteResource] = await db
             .select()
@@ -60,9 +67,7 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResourceLegacy],
     request: {
         params: z.object({
-            siteResourceId: z.number(),
-            siteId: z.number(),
-            orgId: z.string()
+            siteResourceId: z.number()
         })
     },
     responses: {
@@ -90,9 +95,7 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: z.object({
-            siteResourceId: z.number(),
-            siteId: z.number(),
-            orgId: z.string()
+            siteResourceId: z.number()
         })
     },
     responses: {

server/setup/scriptsPg/1.22.0.ts

@@ -223,7 +223,7 @@ export default async function migration() {
             sql`ALTER TABLE "subscriptions" ADD COLUMN "override" boolean DEFAULT false;`
         );
         await db.execute(
-            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 7 NOT NULL;`
+            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 0 NOT NULL;`
         );
         await db.execute(
             sql`ALTER TABLE "siteResources" ADD COLUMN "requiresExitNodeConnection" boolean DEFAULT false NOT NULL;`
@@ -345,6 +345,9 @@ export default async function migration() {
         await db.execute(
             sql`ALTER TABLE "virtualApiKeys" ADD CONSTRAINT "virtualApiKeys_createdByUserId_user_id_fk" FOREIGN KEY ("createdByUserId") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;`
         );
+        await db.execute(
+            sql`ALTER TABLE "eventStreamingDestinations" ADD "sendAISessionLogs" boolean DEFAULT false NOT NULL;`
+        );
         await db.execute(
             sql`CREATE INDEX "idx_ai_budget_breach_events_budget_created" ON "aiBudgetBreachEvents" USING btree ("budgetId","createdAt");`
         );

server/setup/scriptsSqlite/1.22.0.ts

@@ -397,11 +397,14 @@ export default async function migration() {
                 `ALTER TABLE 'clients' ADD 'exitNodeSubnet' text;`
             ).run();
             db.prepare(
-                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 7 NOT NULL;`
+                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 0 NOT NULL;`
             ).run();
             db.prepare(
                 `ALTER TABLE 'siteResources' ADD 'requiresExitNodeConnection' integer DEFAULT false NOT NULL;`
             ).run();
+            db.prepare(
+                `ALTER TABLE 'eventStreamingDestinations' ADD 'sendAISessionLogs' integer DEFAULT false NOT NULL;`
+            ).run();
 
             const insertRoleAction = db.prepare(`
                 INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")

src/app/admin/organizations/page.tsx

@@ -0,0 +1,59 @@
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import OrgsTable from "@app/components/OrgsTable";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { AdminListOrgsResponse } from "@server/routers/org";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Organizations"
+};
+
+export const dynamic = "force-dynamic";
+
+type OrganizationsPageProps = {
+    searchParams: Promise<Record<string, string>>;
+};
+
+export default async function OrganizationsPage(props: OrganizationsPageProps) {
+    const searchParams = new URLSearchParams(await props.searchParams);
+
+    let orgs: AdminListOrgsResponse["orgs"] = [];
+    let pagination: AdminListOrgsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<AdminListOrgsResponse>>(
+            `/admin/orgs?${searchParams.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        orgs = responseData.orgs;
+        pagination = responseData.pagination;
+    } catch (e) {}
+
+    const t = await getTranslations();
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("orgsManage")}
+                description={t("orgsDescription")}
+            />
+
+            <OrgsTable
+                orgs={orgs}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}

src/app/navigation.tsx

@@ -6,6 +6,7 @@ import {
     Bot,
     Boxes,
     Building2,
+    Building2Icon,
     Cable,
     ChartLine,
     Coins,
@@ -377,6 +378,11 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/admin/api-keys",
                 icon: <KeyRound className="size-4 flex-none" />
             },
+            {
+                title: "sidebarOrgs",
+                href: "/admin/organizations",
+                icon: <Building2Icon className="size-4 flex-none" />
+            },
             ...(build === "oss" ||
             env?.app.identityProviderMode === "global" ||
             env?.app.identityProviderMode === undefined
@@ -388,7 +394,7 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                       }
                   ]
                 : []),
-            ...(build == "enterprise"
+            ...(build === "enterprise"
                 ? [
                       {
                           title: "sidebarLicense",

src/components/OrgsTable.tsx

@@ -0,0 +1,300 @@
+"use client";
+
+import { Button } from "@app/components/ui/button";
+import {
+    ControlledDataTable,
+    type ExtendedColumnDef
+} from "@app/components/ui/controlled-data-table";
+import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { toast } from "@app/hooks/useToast";
+import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
+import type { AdminOrgRow } from "@server/routers/org";
+
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { type PaginationState } from "@tanstack/react-table";
+import {
+    ArrowDown01Icon,
+    ArrowUp10Icon,
+    ArrowUpRight,
+    ChevronsUpDownIcon
+} from "lucide-react";
+import moment from "moment";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useMemo, useState, useTransition } from "react";
+import { useDebouncedCallback } from "use-debounce";
+import ConfirmDeleteDialog from "./ConfirmDeleteDialog";
+
+type OrgTableProps = {
+    orgs: AdminOrgRow[];
+    pagination: PaginationState;
+    rowCount: number;
+};
+
+export default function OrgsTable({
+    orgs,
+    pagination,
+    rowCount
+}: OrgTableProps) {
+    const router = useRouter();
+    const t = useTranslations();
+    const {
+        navigate: filter,
+        isNavigating: isFiltering,
+        searchParams
+    } = useNavigationContext();
+
+    const [isRefreshing, startTransition] = useTransition();
+
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [selectedOrg, setSelectedOrg] = useState<AdminOrgRow | null>();
+    const api = createApiClient(useEnvContext());
+
+    function refreshData() {
+        startTransition(async () => {
+            try {
+                router.refresh();
+            } catch (error) {
+                toast({
+                    title: t("error"),
+                    description: t("refreshError"),
+                    variant: "destructive"
+                });
+            }
+        });
+    }
+
+    function toggleSort(column: string) {
+        const newSearch = getNextSortOrder(column, searchParams);
+
+        filter({
+            searchParams: newSearch
+        });
+    }
+
+    function sortableHeader(column: string, label: string) {
+        const sortOrder = getSortDirection(column, searchParams);
+        const Icon =
+            sortOrder === "asc"
+                ? ArrowDown01Icon
+                : sortOrder === "desc"
+                  ? ArrowUp10Icon
+                  : ChevronsUpDownIcon;
+
+        return (
+            <Button
+                variant="ghost"
+                className="p-3"
+                onClick={() => toggleSort(column)}
+            >
+                {label}
+                <Icon className="ml-2 h-4 w-4" />
+            </Button>
+        );
+    }
+
+    const columns = useMemo<ExtendedColumnDef<AdminOrgRow>[]>(() => {
+        return [
+            {
+                accessorKey: "name",
+                friendlyName: t("name"),
+                enableHiding: false,
+                header: () => sortableHeader("name", t("name"))
+            },
+            {
+                accessorKey: "createdAt",
+                friendlyName: t("createdAt"),
+                header: () => sortableHeader("createdAt", t("createdAt")),
+                cell: ({ row }) => {
+                    const createdAt = row.original.createdAt;
+                    return (
+                        <span>
+                            {createdAt ? moment(createdAt).format("lll") : "-"}
+                        </span>
+                    );
+                }
+            },
+            {
+                accessorKey: "owner",
+                friendlyName: t("accessRoleOwner"),
+                header: () => (
+                    <span className="p-3">{t("accessRoleOwner")}</span>
+                ),
+                cell: ({ row }) => {
+                    const owner = row.original.owner;
+                    return owner ? (
+                        <Button
+                            className="tabular-nums"
+                            asChild
+                            variant="outline"
+                            size="sm"
+                        >
+                            <Link href={`/admin/users/${owner.userId}`}>
+                                {owner.username}
+                                <ArrowUpRight className="ml-2 h-3 w-3" />
+                            </Link>
+                        </Button>
+                    ) : (
+                        <code>-</code>
+                    );
+                }
+            },
+            {
+                accessorKey: "orgId",
+                friendlyName: t("orgId"),
+                header: () => <span className="p-3">{t("orgId")}</span>
+            },
+            {
+                accessorKey: "subnet",
+                friendlyName: t("subnet"),
+                header: () => <span className="p-3">{t("subnet")}</span>,
+                cell: ({ row }) => <span>{row.original.subnet || "-"}</span>
+            },
+            {
+                accessorKey: "utilitySubnet",
+                friendlyName: t("utilitySubnet"),
+                header: () => <span className="p-3">{t("utilitySubnet")}</span>,
+                cell: ({ row }) => (
+                    <span>{row.original.utilitySubnet || "-"}</span>
+                )
+            },
+            {
+                accessorKey: "userCount",
+                friendlyName: t("users"),
+                header: () => <span className="p-3">{t("users")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.userCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "siteCount",
+                friendlyName: t("sites"),
+                header: () => <span className="p-3">{t("sites")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.siteCount}
+                    </span>
+                )
+            },
+            {
+                accessorKey: "resourceCount",
+                friendlyName: t("resources"),
+                header: () => <span className="p-3">{t("resources")}</span>,
+                cell: ({ row }) => (
+                    <span className="tabular-nums">
+                        {row.original.resourceCount}
+                    </span>
+                )
+            },
+
+            {
+                id: "actions",
+                enableHiding: false,
+                header: () => <span className="p-3"></span>,
+                cell: ({ row }) => {
+                    const orgRow = row.original;
+                    return (
+                        <div className="flex items-center gap-2 justify-end">
+                            <Button
+                                onClick={() => {
+                                    setSelectedOrg(orgRow);
+                                    setIsDeleteModalOpen(true);
+                                }}
+                                variant="outline"
+                                className="text-red-400 focus:text-destructive "
+                            >
+                                {t("delete")}
+                            </Button>
+                        </div>
+                    );
+                }
+            }
+        ];
+    }, [t, searchParams]);
+
+    const handlePaginationChange = (newPage: PaginationState) => {
+        searchParams.set("page", (newPage.pageIndex + 1).toString());
+        searchParams.set("pageSize", newPage.pageSize.toString());
+        filter({
+            searchParams
+        });
+    };
+
+    const handleSearchChange = useDebouncedCallback((query: string) => {
+        searchParams.set("query", query);
+        searchParams.delete("page");
+        filter({
+            searchParams
+        });
+    }, 300);
+
+    async function deleteOrg(orgId: string) {
+        try {
+            const res = await api.delete(`/admin/org/${orgId}`);
+            toast({
+                title: t("orgDeleted"),
+                description: t("orgDeletedMessage")
+            });
+        } catch (err) {
+            console.error(err);
+            toast({
+                variant: "destructive",
+                title: t("orgErrorDelete"),
+                description: formatAxiosError(err, t("orgErrorDeleteMessage"))
+            });
+        } finally {
+            router.refresh();
+        }
+    }
+
+    return (
+        <>
+            {selectedOrg && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={(val) => {
+                        setIsDeleteModalOpen(val);
+                        setSelectedOrg(null);
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("orgQuestionRemove")}</p>
+                            <p>{t("orgMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("orgDeleteConfirm")}
+                    onConfirm={async () => {
+                        startTransition(() => deleteOrg(selectedOrg.orgId));
+                    }}
+                    string={selectedOrg.name}
+                    title={t("orgDelete")}
+                />
+            )}
+            <ControlledDataTable
+                columns={columns}
+                rows={orgs}
+                tableId="admin-orgs-table"
+                searchPlaceholder={t("orgSearch")}
+                pagination={pagination}
+                onPaginationChange={handlePaginationChange}
+                searchQuery={searchParams.get("query")?.toString()}
+                onSearch={handleSearchChange}
+                onRefresh={refreshData}
+                isRefreshing={isRefreshing || isFiltering}
+                rowCount={rowCount}
+                columnVisibility={{
+                    subnet: false,
+                    utilitySubnet: false,
+                    orgId: false
+                }}
+                enableColumnVisibility
+                stickyLeftColumn="name"
+                stickyRightColumn="actions"
+            />
+        </>
+    );
+}

src/components/PublicResourcesTable.tsx

@@ -21,14 +21,12 @@ import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
-import { build } from "@server/build";
-import { UpdateResourceResponse } from "@server/routers/resource";
 import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
+import { UpdateResourceResponse } from "@server/routers/resource";
 import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";

src/components/SitesTable.tsx

@@ -52,7 +52,6 @@ import {
 } from "./ui/controlled-data-table";
 
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { durationToMs } from "@app/lib/durationToMs";
 import { orgQueries, productUpdatesQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import semver from "semver";