Bump node in the docker-dependencies group across 1 directory

Bumps the docker-dependencies group with 1 update in the / directory: node.


Updates `node` from 24-alpine to 26-alpine

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:26-alpine
 
 WORKDIR /app
 

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/docker-compose.yml

@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

install/main.go

@@ -76,7 +76,7 @@ var redisFlag *bool
 func main() {
 
 	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
-	redisFlag = flag.Bool("redis", false, "Install Redis as caching solution. Required for HA. Not required for the Enterprise version.")
+	redisFlag = flag.Bool("redis", false, "Install Redis as cacheing solution. Required for HA. Not required for the Enterprise version.")
 	flag.Parse()
 
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking

messages/bg-BG.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Списък с покани",
     "actionExportLogs": "Експортиране на дневници",
     "actionViewLogs": "Преглед на дневници",
-    "actionCreateSiteProvisioningKey": "Създаване на ключ за предоставяне на сайт",
-    "actionListSiteProvisioningKeys": "Списък на ключовете за предоставяне на сайт",
-    "actionUpdateSiteProvisioningKey": "Актуализиране на ключ за предоставяне на сайт",
-    "actionDeleteSiteProvisioningKey": "Изтриване на ключ за предоставяне на сайт",
     "noneSelected": "Нищо не е избрано",
     "orgNotFound2": "Няма намерени организации.",
     "search": "Търси…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Качването неуспешно",
     "rdpUnicodeKeyboardMode": "Режим на unicode клавиатура",
     "sessionToolbarShow": "Показване на лентата с инструменти",
-    "sessionToolbarHide": "Скриване на лентата с инструменти",
+    "sessionToolbarHide": "Скриване на лентата с инструменти"
-    "actionUpdateSiteApprovals": "Обновяване на одобренията на сайта"
 }

messages/cs-CZ.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Seznam pozvánek",
     "actionExportLogs": "Exportovat protokoly",
     "actionViewLogs": "Zobrazit logy",
-    "actionCreateSiteProvisioningKey": "Vytvořit klíč pro zřízení webu",
-    "actionListSiteProvisioningKeys": "Seznam klíčů pro zřízení webu",
-    "actionUpdateSiteProvisioningKey": "Aktualizovat klíč pro zřízení webu",
-    "actionDeleteSiteProvisioningKey": "Smazat klíč pro zřízení webu",
     "noneSelected": "Není vybráno",
     "orgNotFound2": "Nebyly nalezeny žádné organizace.",
     "search": "Vyhledávání…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Nahrání selhalo",
     "rdpUnicodeKeyboardMode": "Režim Unicode klávesnice",
     "sessionToolbarShow": "Zobrazit panel nástrojů",
-    "sessionToolbarHide": "Skrýt panel nástrojů",
+    "sessionToolbarHide": "Skrýt panel nástrojů"
-    "actionUpdateSiteApprovals": "Aktualizovat schválení webu"
 }

messages/da-DK.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Vis invitationer",
     "actionExportLogs": "Eksportér logs",
     "actionViewLogs": "Vis logs",
-    "actionCreateSiteProvisioningKey": "Opret provisioneringsnøgle til site",
-    "actionListSiteProvisioningKeys": "Vis provisioneringsnøgler til site",
-    "actionUpdateSiteProvisioningKey": "Opdater provisioneringsnøgle til site",
-    "actionDeleteSiteProvisioningKey": "Slet provisioneringsnøgle til site",
     "noneSelected": "Ingen valgt",
     "orgNotFound2": "Ingen organisationer fundet.",
     "search": "Søg…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Uploaden mislykkedes",
     "rdpUnicodeKeyboardMode": "Unicode tastaturtilstand",
     "sessionToolbarShow": "Vis værktøjslinje",
-    "sessionToolbarHide": "Skjul værktøjslinje",
+    "sessionToolbarHide": "Skjul værktøjslinje"
-    "actionUpdateSiteApprovals": "Opdater godkendelser på site"
 }

messages/de-DE.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Einladungen auflisten",
     "actionExportLogs": "Logs exportieren",
     "actionViewLogs": "Logs anzeigen",
-    "actionCreateSiteProvisioningKey": "Bereitstellungsschlüssel für Standort erstellen",
-    "actionListSiteProvisioningKeys": "Liste der Bereitstellungsschlüssel für Standorte",
-    "actionUpdateSiteProvisioningKey": "Bereitstellungsschlüssel für Standort aktualisieren",
-    "actionDeleteSiteProvisioningKey": "Bereitstellungsschlüssel für Standort löschen",
     "noneSelected": "Keine ausgewählt",
     "orgNotFound2": "Keine Organisationen gefunden.",
     "search": "Suche…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Upload fehlgeschlagen",
     "rdpUnicodeKeyboardMode": "Unicode-Tastaturmodus",
     "sessionToolbarShow": "Werkzeugleiste zeigen",
-    "sessionToolbarHide": "Werkzeugleiste ausblenden",
+    "sessionToolbarHide": "Werkzeugleiste ausblenden"
-    "actionUpdateSiteApprovals": "Standortgenehmigungen aktualisieren"
 }

messages/en-US.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "List Invitations",
     "actionExportLogs": "Export Logs",
     "actionViewLogs": "View Logs",
-    "actionCreateSiteProvisioningKey": "Create Site Provisioning Key",
-    "actionListSiteProvisioningKeys": "List Site Provisioning Keys",
-    "actionUpdateSiteProvisioningKey": "Update Site Provisioning Key",
-    "actionDeleteSiteProvisioningKey": "Delete Site Provisioning Key",
     "noneSelected": "None selected",
     "orgNotFound2": "No organizations found.",
     "search": "Search…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Upload failed",
     "rdpUnicodeKeyboardMode": "Unicode keyboard mode",
     "sessionToolbarShow": "Show toolbar",
-    "sessionToolbarHide": "Hide toolbar",
+    "sessionToolbarHide": "Hide toolbar"
-    "actionUpdateSiteApprovals": "Update Site Approvals"
 }

messages/es-ES.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Listar invitaciones",
     "actionExportLogs": "Exportar registros",
     "actionViewLogs": "Ver registros",
-    "actionCreateSiteProvisioningKey": "Crear clave de aprovisionamiento del sitio",
-    "actionListSiteProvisioningKeys": "Listado de claves de aprovisionamiento del sitio",
-    "actionUpdateSiteProvisioningKey": "Actualizar clave de aprovisionamiento del sitio",
-    "actionDeleteSiteProvisioningKey": "Eliminar clave de aprovisionamiento del sitio",
     "noneSelected": "Ninguno seleccionado",
     "orgNotFound2": "No se encontraron organizaciones.",
     "search": "Buscar…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Error de subida",
     "rdpUnicodeKeyboardMode": "Modo teclado Unicode",
     "sessionToolbarShow": "Mostrar barra de herramientas",
-    "sessionToolbarHide": "Ocultar barra de herramientas",
+    "sessionToolbarHide": "Ocultar barra de herramientas"
-    "actionUpdateSiteApprovals": "Actualizar aprobaciones del sitio"
 }

messages/fr-FR.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Lister les invitations",
     "actionExportLogs": "Exporter les journaux",
     "actionViewLogs": "Voir les logs",
-    "actionCreateSiteProvisioningKey": "Créer une clé de provisionnement de site",
-    "actionListSiteProvisioningKeys": "Lister les clés de provisionnement de site",
-    "actionUpdateSiteProvisioningKey": "Mettre à jour la clé de provisionnement de site",
-    "actionDeleteSiteProvisioningKey": "Supprimer la clé de provisionnement de site",
     "noneSelected": "Aucune sélection",
     "orgNotFound2": "Aucune organisation trouvée.",
     "search": "Rechercher…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Échec du téléchargement",
     "rdpUnicodeKeyboardMode": "Mode clavier Unicode",
     "sessionToolbarShow": "Afficher la barre d'outils",
-    "sessionToolbarHide": "Masquer la barre d'outils",
+    "sessionToolbarHide": "Masquer la barre d'outils"
-    "actionUpdateSiteApprovals": "Mettre à jour les approbations de site"
 }

messages/it-IT.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Elenco Inviti",
     "actionExportLogs": "Esporta Log",
     "actionViewLogs": "Visualizza Log",
-    "actionCreateSiteProvisioningKey": "Crea Chiave di Provisioning del Sito",
-    "actionListSiteProvisioningKeys": "Elenca Chiavi di Provisioning del Sito",
-    "actionUpdateSiteProvisioningKey": "Aggiorna Chiave di Provisioning del Sito",
-    "actionDeleteSiteProvisioningKey": "Elimina Chiave di Provisioning del Sito",
     "noneSelected": "Nessuna selezione",
     "orgNotFound2": "Nessuna organizzazione trovata.",
     "search": "Cerca…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Caricamento fallito",
     "rdpUnicodeKeyboardMode": "Modalità tastiera Unicode",
     "sessionToolbarShow": "Mostra barra degli strumenti",
-    "sessionToolbarHide": "Nascondi barra degli strumenti",
+    "sessionToolbarHide": "Nascondi barra degli strumenti"
-    "actionUpdateSiteApprovals": "Aggiorna Approvazioni del Sito"
 }

messages/ko-KR.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "초대 목록",
     "actionExportLogs": "로그 내보내기",
     "actionViewLogs": "로그 보기",
-    "actionCreateSiteProvisioningKey": "사이트 프로비저닝 키 생성",
-    "actionListSiteProvisioningKeys": "사이트 프로비저닝 키 목록",
-    "actionUpdateSiteProvisioningKey": "사이트 프로비저닝 키 업데이트",
-    "actionDeleteSiteProvisioningKey": "사이트 프로비저닝 키 삭제",
     "noneSelected": "선택된 항목 없음",
     "orgNotFound2": "조직이 없습니다.",
     "search": "검색…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "업로드 실패",
     "rdpUnicodeKeyboardMode": "유니코드 키보드 모드",
     "sessionToolbarShow": "툴바 보기",
-    "sessionToolbarHide": "툴바 숨기기",
+    "sessionToolbarHide": "툴바 숨기기"
-    "actionUpdateSiteApprovals": "사이트 승인 업데이트"
 }

messages/nb-NO.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Liste invitasjoner",
     "actionExportLogs": "Eksportlogger",
     "actionViewLogs": "Vis logger",
-    "actionCreateSiteProvisioningKey": "Opprett Klargjøringsnøkkel for Sted",
-    "actionListSiteProvisioningKeys": "List Klargjøringsnøkler for Sted",
-    "actionUpdateSiteProvisioningKey": "Oppdater Klargjøringsnøkkel for Sted",
-    "actionDeleteSiteProvisioningKey": "Slett Klargjøringsnøkkel for Sted",
     "noneSelected": "Ingen valgt",
     "orgNotFound2": "Ingen organisasjoner funnet.",
     "search": "Søk…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Opplastningen mislyktes",
     "rdpUnicodeKeyboardMode": "Unicode tastaturmodus",
     "sessionToolbarShow": "Vis verktøylinje",
-    "sessionToolbarHide": "Skjul verktøylinje",
+    "sessionToolbarHide": "Skjul verktøylinje"
-    "actionUpdateSiteApprovals": "Oppdater Stedsgodkjenninger"
 }

messages/nl-NL.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Toon uitnodigingen",
     "actionExportLogs": "Logboeken exporteren",
     "actionViewLogs": "Logboeken bekijken",
-    "actionCreateSiteProvisioningKey": "Een sitevoorzie-ningssleutel aanmaken",
-    "actionListSiteProvisioningKeys": "Sitevoorzie-ningssleutels weergeven",
-    "actionUpdateSiteProvisioningKey": "Sitevoorzie-ningssleutel bijwerken",
-    "actionDeleteSiteProvisioningKey": "Sitevoorzie-ningssleutel verwijderen",
     "noneSelected": "Niet geselecteerd",
     "orgNotFound2": "Geen organisaties gevonden.",
     "search": "Zoeken…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Upload mislukt",
     "rdpUnicodeKeyboardMode": "Unicode toetsenbordmodus",
     "sessionToolbarShow": "Toon werkbalk",
-    "sessionToolbarHide": "Verberg werkbalk",
+    "sessionToolbarHide": "Verberg werkbalk"
-    "actionUpdateSiteApprovals": "Sitegoedkeuringen bijwerken"
 }

messages/pl-PL.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Lista zaproszeń",
     "actionExportLogs": "Eksportuj dzienniki",
     "actionViewLogs": "Zobacz dzienniki",
-    "actionCreateSiteProvisioningKey": "Utwórz klucz konfiguracji strony",
-    "actionListSiteProvisioningKeys": "Lista kluczy konfiguracji strony",
-    "actionUpdateSiteProvisioningKey": "Zaktualizuj klucz konfiguracji strony",
-    "actionDeleteSiteProvisioningKey": "Usuń klucz konfiguracji strony",
     "noneSelected": "Nie wybrano",
     "orgNotFound2": "Nie znaleziono organizacji.",
     "search": "Szukaj…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Niepowodzenie przesyłania",
     "rdpUnicodeKeyboardMode": "Tryb klawiatury Unicode",
     "sessionToolbarShow": "Pokaż pasek narzędzi",
-    "sessionToolbarHide": "Ukryj pasek narzędzi",
+    "sessionToolbarHide": "Ukryj pasek narzędzi"
-    "actionUpdateSiteApprovals": "Zaktualizuj zgody na stronę"
 }

messages/pt-PT.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Listar Convites",
     "actionExportLogs": "Exportar logs",
     "actionViewLogs": "Visualizar registros",
-    "actionCreateSiteProvisioningKey": "Criar Chave de Provisionamento do Site",
-    "actionListSiteProvisioningKeys": "Listar Chaves de Provisionamento do Site",
-    "actionUpdateSiteProvisioningKey": "Atualizar Chave de Provisionamento do Site",
-    "actionDeleteSiteProvisioningKey": "Excluir Chave de Provisionamento do Site",
     "noneSelected": "Nenhum selecionado",
     "orgNotFound2": "Nenhuma organização encontrada.",
     "search": "Pesquisar…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Falha no upload",
     "rdpUnicodeKeyboardMode": "Modo de teclado Unicode",
     "sessionToolbarShow": "Mostrar barra de ferramentas",
-    "sessionToolbarHide": "Ocultar barra de ferramentas",
+    "sessionToolbarHide": "Ocultar barra de ferramentas"
-    "actionUpdateSiteApprovals": "Atualizar Aprovações do Site"
 }

messages/ru-RU.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Список приглашений",
     "actionExportLogs": "Экспорт журналов",
     "actionViewLogs": "Просмотр журналов",
-    "actionCreateSiteProvisioningKey": "Создать ключ конфигурации сайта",
-    "actionListSiteProvisioningKeys": "Список ключей конфигурации сайтов",
-    "actionUpdateSiteProvisioningKey": "Обновить ключ конфигурации сайта",
-    "actionDeleteSiteProvisioningKey": "Удалить ключ конфигурации сайта",
     "noneSelected": "Ничего не выбрано",
     "orgNotFound2": "Организации не найдены.",
     "search": "Поиск…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Ошибка загрузки",
     "rdpUnicodeKeyboardMode": "Режим клавиатуры Unicode",
     "sessionToolbarShow": "Показать панель инструментов",
-    "sessionToolbarHide": "Скрыть панель инструментов",
+    "sessionToolbarHide": "Скрыть панель инструментов"
-    "actionUpdateSiteApprovals": "Обновить утверждения сайта"
 }

messages/tr-TR.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "Davetiyeleri Listele",
     "actionExportLogs": "Kayıtları Dışa Aktar",
     "actionViewLogs": "Kayıtları Görüntüle",
-    "actionCreateSiteProvisioningKey": "Site Sağlama Anahtarı Oluştur",
-    "actionListSiteProvisioningKeys": "Site Sağlama Anahtarlarını Listele",
-    "actionUpdateSiteProvisioningKey": "Site Sağlama Anahtarını Güncelle",
-    "actionDeleteSiteProvisioningKey": "Site Sağlama Anahtarını Sil",
     "noneSelected": "Hiçbiri seçili değil",
     "orgNotFound2": "Hiçbir organizasyon bulunamadı.",
     "search": "Ara…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "Yükleme başarısız",
     "rdpUnicodeKeyboardMode": "Unicode klavye modu",
     "sessionToolbarShow": "Araç çubuğunu göster",
-    "sessionToolbarHide": "Araç çubuğunu gizle",
+    "sessionToolbarHide": "Araç çubuğunu gizle"
-    "actionUpdateSiteApprovals": "Site Onaylarını Güncelle"
 }

messages/zh-CN.json

@@ -1511,10 +1511,6 @@
     "actionListInvitations": "邀请列表",
     "actionExportLogs": "导出日志",
     "actionViewLogs": "查看日志",
-    "actionCreateSiteProvisioningKey": "创建站点预配密钥",
-    "actionListSiteProvisioningKeys": "列出站点预配密钥",
-    "actionUpdateSiteProvisioningKey": "更新站点预配密钥",
-    "actionDeleteSiteProvisioningKey": "删除站点预配密钥",
     "noneSelected": "未选择",
     "orgNotFound2": "未找到组织。",
     "search": "搜索…",
@@ -3815,6 +3811,5 @@
     "rdpUploadFailed": "上传失败",
     "rdpUnicodeKeyboardMode": "Unicode 键盘模式",
     "sessionToolbarShow": "显示工具栏",
-    "sessionToolbarHide": "隐藏工具栏",
+    "sessionToolbarHide": "隐藏工具栏"
-    "actionUpdateSiteApprovals": "更新站点审批"
 }

server/db/pg/schema/schema.ts

@@ -107,7 +107,6 @@ export const sites = pgTable(
         lastPing: integer("lastPing"),
         address: varchar("address"),
         endpoint: varchar("endpoint"),
-        localEndpoints: varchar("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
         publicKey: varchar("publicKey"),
         lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
         listenPort: integer("listenPort"),

server/db/sqlite/schema/schema.ts

@@ -118,7 +118,6 @@ export const sites = sqliteTable("sites", {
     // exit node stuff that is how to connect to the site when it has a wg server
     address: text("address"), // this is the address of the wireguard interface in newt
     endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
-    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
     publicKey: text("publicKey"), // TODO: Fix typo in publicKey
     lastHolePunch: integer("lastHolePunch"),
     listenPort: integer("listenPort"),

server/lib/blueprints/privateResources.ts

@@ -239,31 +239,6 @@ export async function updatePrivateResources(
                 );
             }
 
-            if (resourceData.alias) {
-                const [aliasConflict] = await trx
-                    .select({
-                        siteResourceId: siteResources.siteResourceId
-                    })
-                    .from(siteResources)
-                    .where(
-                        and(
-                            eq(siteResources.orgId, orgId),
-                            eq(siteResources.alias, resourceData.alias),
-                            ne(
-                                siteResources.siteResourceId,
-                                existingResource.siteResourceId
-                            )
-                        )
-                    )
-                    .limit(1);
-
-                if (aliasConflict) {
-                    throw new Error(
-                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
-                    );
-                }
-            }
-
             // Update existing resource
             const [updatedResource] = await trx
                 .update(siteResources)
@@ -505,27 +480,6 @@ export async function updatePrivateResources(
                 );
             }
 
-            if (resourceData.alias) {
-                const [aliasConflict] = await trx
-                    .select({
-                        siteResourceId: siteResources.siteResourceId
-                    })
-                    .from(siteResources)
-                    .where(
-                        and(
-                            eq(siteResources.orgId, orgId),
-                            eq(siteResources.alias, resourceData.alias)
-                        )
-                    )
-                    .limit(1);
-
-                if (aliasConflict) {
-                    throw new Error(
-                        `Alias ${resourceData.alias} already in use by another site resource in org ${orgId}`
-                    );
-                }
-            }
-
             const [network] = await trx
                 .insert(networks)
                 .values({

server/lib/statusHistory.ts

@@ -8,42 +8,26 @@ const STATUS_HISTORY_CACHE_TTL = 60; // seconds
 function statusHistoryCacheKey(
     entityType: string,
     entityId: number,
-    days: number,
+    days: number
-    tzOffsetMinutes: number
 ): string {
-    return `statusHistory:${entityType}:${entityId}:${days}:${tzOffsetMinutes}`;
+    return `statusHistory:${entityType}:${entityId}:${days}`;
-}
-
-// Returns the epoch seconds of the most recent local-calendar-day midnight,
-// where "local" is defined by tzOffsetMinutes (minutes to ADD to UTC to get
-// local time, e.g. Australia/Sydney standard time is 600). Defaults to 0
-// (UTC) so callers that don't pass a timezone keep the original behavior.
-function localMidnightSec(tzOffsetMinutes: number): number {
-    const localNow = new Date(Date.now() + tzOffsetMinutes * 60_000);
-    localNow.setUTCHours(0, 0, 0, 0);
-    return Math.floor(localNow.getTime() / 1000) - tzOffsetMinutes * 60;
 }
 
 export async function getCachedStatusHistory(
     entityType: string,
     entityId: number,
-    days: number,
+    days: number
-    tzOffsetMinutes: number = 0
 ): Promise<StatusHistoryResponse> {
-    const cacheKey = statusHistoryCacheKey(
+    const cacheKey = statusHistoryCacheKey(entityType, entityId, days);
-        entityType,
-        entityId,
-        days,
-        tzOffsetMinutes
-    );
     const cached = await cache.get<StatusHistoryResponse>(cacheKey);
     if (cached !== undefined) {
         return cached;
     }
 
-    // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
+    // Anchor to UTC midnight so the query window aligns with stable calendar days
-    // window aligns with stable calendar days for the requesting client
+    const utcToday = new Date();
-    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
+    utcToday.setUTCHours(0, 0, 0, 0);
+    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
     const startSec = todayMidnightSec - days * 86400;
 
     const events = await logsDb
@@ -79,8 +63,7 @@ export async function getCachedStatusHistory(
     const { buckets, totalDowntime } = computeBuckets(
         events,
         days,
-        priorStatus,
+        priorStatus
-        tzOffsetMinutes
     );
     const totalWindow = days * 86400;
     const overallUptime =
@@ -116,19 +99,11 @@ export const statusHistoryQuerySchema = z
         days: z
             .string()
             .optional()
-            .transform((v) => (v ? parseInt(v, 10) : 90)),
+            .transform((v) => (v ? parseInt(v, 10) : 90))
-        // Minutes to add to UTC to get the requesting client's local time
-        // (e.g. Australia/Sydney standard time is 600). Optional and
-        // defaults to 0 (UTC) so older clients keep the prior behavior.
-        tzOffsetMinutes: z
-            .string()
-            .optional()
-            .transform((v) => (v ? parseInt(v, 10) : 0))
     })
     .pipe(
         z.object({
-            days: z.number().int().min(1).max(365),
+            days: z.number().int().min(1).max(365)
-            tzOffsetMinutes: z.number().int().min(-720).max(840)
         })
     );
 
@@ -158,15 +133,15 @@ export function computeBuckets(
         id: number;
     }[],
     days: number,
-    priorStatus: string | null = null,
+    priorStatus: string | null = null
-    tzOffsetMinutes: number = 0
 ): { buckets: StatusHistoryDayBucket[]; totalDowntime: number } {
     const nowSec = Math.floor(Date.now() / 1000);
 
-    // Anchor bucket boundaries to local midnight (UTC when tzOffsetMinutes is
+    // Anchor bucket boundaries to UTC midnight so dates are stable calendar days
-    // 0) so dates are stable calendar days for the requesting client and
+    // and don't drift as the cache expires and is recomputed
-    // don't drift as the cache expires and is recomputed
+    const utcToday = new Date();
-    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
+    utcToday.setUTCHours(0, 0, 0, 0);
+    const todayMidnightSec = Math.floor(utcToday.getTime() / 1000);
 
     const buckets: StatusHistoryDayBucket[] = [];
     let totalDowntime = 0;
@@ -262,13 +237,7 @@ export function computeBuckets(
                   )
                 : 100;
 
-        // Shift by the client's offset before formatting so the label reflects
+        const dateStr = new Date(dayStartSec * 1000).toISOString().slice(0, 10);
-        // their local calendar date rather than the UTC date of dayStartSec
-        const dateStr = new Date(
-            (dayStartSec + tzOffsetMinutes * 60) * 1000
-        )
-            .toISOString()
-            .slice(0, 10);
 
         const hasAnyData = currentStatus !== null || dayEvents.length > 0;
 

server/middlewares/integration/index.ts

@@ -17,4 +17,3 @@ export * from "./verifyApiKeySiteResourceAccess";
 export * from "./verifyApiKeyIdpAccess";
 export * from "./verifyApiKeyDomainAccess";
 export * from "./verifyApiKeyResourcePolicyAccess";
-export * from "./verifyApiKeySiteProvisioningKeyAccess";

server/middlewares/integration/verifyApiKeySiteProvisioningKeyAccess.ts

@@ -1,111 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import {
-    db,
-    siteProvisioningKeys,
-    siteProvisioningKeyOrg,
-    apiKeyOrg
-} from "@server/db";
-import { and, eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";
-
-export async function verifyApiKeySiteProvisioningKeyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const apiKey = req.apiKey;
-        const siteProvisioningKeyId =
-            getFirstString(req.params.siteProvisioningKeyId) ||
-            getFirstString(req.body.siteProvisioningKeyId) ||
-            getFirstString(req.query.siteProvisioningKeyId);
-        const orgId = getFirstString(req.params.orgId);
-
-        if (!apiKey) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
-            );
-        }
-
-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
-        if (!siteProvisioningKeyId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
-            );
-        }
-
-        if (apiKey.isRoot) {
-            // Root keys can access any site provisioning key in any org
-            return next();
-        }
-
-        const [row] = await db
-            .select()
-            .from(siteProvisioningKeys)
-            .innerJoin(
-                siteProvisioningKeyOrg,
-                and(
-                    eq(
-                        siteProvisioningKeys.siteProvisioningKeyId,
-                        siteProvisioningKeyOrg.siteProvisioningKeyId
-                    ),
-                    eq(siteProvisioningKeyOrg.orgId, orgId)
-                )
-            )
-            .where(
-                eq(
-                    siteProvisioningKeys.siteProvisioningKeyId,
-                    siteProvisioningKeyId
-                )
-            )
-            .limit(1);
-
-        if (!row?.siteProvisioningKeys || !row.siteProvisioningKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Site provisioning key with ID ${siteProvisioningKeyId} not found for organization ${orgId}`
-                )
-            );
-        }
-
-        if (!req.apiKeyOrg) {
-            const apiKeyOrgRes = await db
-                .select()
-                .from(apiKeyOrg)
-                .where(
-                    and(
-                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
-                        eq(apiKeyOrg.orgId, row.siteProvisioningKeyOrg.orgId)
-                    )
-                )
-                .limit(1);
-            req.apiKeyOrg = apiKeyOrgRes[0];
-        }
-
-        if (!req.apiKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Key does not have access to this organization"
-                )
-            );
-        }
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying site provisioning key access"
-            )
-        );
-    }
-}

server/openApi.ts

@@ -18,7 +18,6 @@ export enum OpenAPITags {
     OrgIdp = "Identity Provider (Organization Only)",
     Client = "Client",
     ApiKey = "API Key",
-    SiteProvisioningKey = "Site Provisioning Key",
     Domain = "Domain",
     Blueprint = "Blueprint",
     Ssh = "SSH",

server/private/routers/healthChecks/getStatusHistory.ts

@@ -55,14 +55,9 @@ export async function getHealthCheckStatusHistory(
 
         const entityType = "health_check";
         const entityId = parsedParams.data.healthCheckId;
-        const { days, tzOffsetMinutes } = parsedQuery.data;
+        const { days } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(
+        const data = await getCachedStatusHistory(entityType, entityId, days);
-            entityType,
-            entityId,
-            days,
-            tzOffsetMinutes
-        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/private/routers/integration.ts

@@ -16,7 +16,6 @@ import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
-import * as siteProvisioning from "#private/routers/siteProvisioning";
 
 import {
     verifyApiKeyHasAction,
@@ -25,7 +24,6 @@ import {
     verifyApiKeyIdpAccess,
     verifyApiKeyRoleAccess,
     verifyApiKeyUserAccess,
-    verifyApiKeySiteProvisioningKeyAccess,
     verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
@@ -217,45 +215,3 @@ authenticated.delete(
     logActionAudit(ActionsEnum.removeUserRole),
     user.removeUserRole
 );
-
-authenticated.put(
-    "/org/:orgId/site-provisioning-key",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createSiteProvisioningKey),
-    logActionAudit(ActionsEnum.createSiteProvisioningKey),
-    siteProvisioning.createSiteProvisioningKey
-);
-
-authenticated.get(
-    "/org/:orgId/site-provisioning-keys",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listSiteProvisioningKeys),
-    siteProvisioning.listSiteProvisioningKeys
-);
-
-authenticated.delete(
-    "/org/:orgId/site-provisioning-key/:siteProvisioningKeyId",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
-    verifyApiKeyOrgAccess,
-    verifyApiKeySiteProvisioningKeyAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteSiteProvisioningKey),
-    logActionAudit(ActionsEnum.deleteSiteProvisioningKey),
-    siteProvisioning.deleteSiteProvisioningKey
-);
-
-authenticated.patch(
-    "/org/:orgId/site-provisioning-key/:siteProvisioningKeyId",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
-    verifyApiKeyOrgAccess,
-    verifyApiKeySiteProvisioningKeyAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateSiteProvisioningKey),
-    logActionAudit(ActionsEnum.updateSiteProvisioningKey),
-    siteProvisioning.updateSiteProvisioningKey
-);

server/private/routers/siteProvisioning/createSiteProvisioningKey.ts

@@ -26,8 +26,6 @@ import {
 import logger from "@server/logger";
 import { hashPassword } from "@server/auth/password";
 import type { CreateSiteProvisioningKeyResponse } from "@server/routers/siteProvisioning/types";
-import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
-import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     orgId: z.string().nonempty()
@@ -36,17 +34,10 @@ const paramsSchema = z.object({
 const bodySchema = z
     .strictObject({
         name: z.string().min(1).max(255),
-        maxBatchSize: z
+        maxBatchSize: z.union([
-            .union([
+            z.null(),
-                z.null(),
+            z.coerce.number().int().positive().max(1_000_000)
-                z.coerce.number().int().positive().max(1_000_000)
+        ]),
-            ])
-            .openapi({
-                type: "number",
-                default: null,
-                description:
-                    "Maximum number of sites that can be provisioned in a single batch. If null, there is no limit."
-            }),
         validUntil: z.string().max(255).optional(),
         approveNewSites: z.boolean().optional().default(true)
     })
@@ -66,49 +57,6 @@ const bodySchema = z
 
 export type CreateSiteProvisioningKeyBody = z.infer<typeof bodySchema>;
 
-const CreateSiteProvisioningKeyResponseDataSchema = z.object({
-    siteProvisioningKeyId: z.string(),
-    orgId: z.string(),
-    name: z.string(),
-    siteProvisioningKey: z.string(),
-    lastChars: z.string(),
-    createdAt: z.string(),
-    lastUsed: z.string().nullable(),
-    maxBatchSize: z.number().nullable(),
-    numUsed: z.number(),
-    validUntil: z.string().nullable(),
-    approveNewSites: z.boolean()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/site-provisioning-key",
-    description: "Create a new site provisioning key for the organization.",
-    tags: [OpenAPITags.SiteProvisioningKey],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        201: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: createApiResponseSchema(
-                        CreateSiteProvisioningKeyResponseDataSchema
-                    )
-                }
-            }
-        }
-    }
-});
-
 export async function createSiteProvisioningKey(
     req: Request,
     res: Response,

server/private/routers/siteProvisioning/deleteSiteProvisioningKey.ts

@@ -13,46 +13,23 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
+import {
+    db,
+    siteProvisioningKeyOrg,
+    siteProvisioningKeys
+} from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     siteProvisioningKeyId: z.string().nonempty(),
     orgId: z.string().nonempty()
 });
 
-registry.registerPath({
-    method: "delete",
-    path: "/org/{orgId}/site-provisioning-key/{siteProvisioningKeyId}",
-    description: "Delete a site provisioning key.",
-    tags: [OpenAPITags.SiteProvisioningKey],
-    request: {
-        params: paramsSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
 export async function deleteSiteProvisioningKey(
     req: Request,
     res: Response,

server/private/routers/siteProvisioning/listSiteProvisioningKeys.ts

@@ -11,7 +11,11 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
+import {
+    db,
+    siteProvisioningKeyOrg,
+    siteProvisioningKeys
+} from "@server/db";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
@@ -21,8 +25,6 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
 import type { ListSiteProvisioningKeysResponse } from "@server/routers/siteProvisioning/types";
-import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
-import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     orgId: z.string().nonempty()
@@ -43,55 +45,11 @@ const querySchema = z.object({
         .pipe(z.int().nonnegative())
 });
 
-const ListSiteProvisioningKeysResponseDataSchema = z.object({
-    siteProvisioningKeys: z.array(
-        z.object({
-            siteProvisioningKeyId: z.string(),
-            orgId: z.string(),
-            lastChars: z.string(),
-            createdAt: z.string(),
-            name: z.string(),
-            lastUsed: z.string().nullable(),
-            maxBatchSize: z.number().nullable(),
-            numUsed: z.number(),
-            validUntil: z.string().nullable(),
-            approveNewSites: z.boolean()
-        })
-    ),
-    pagination: z.object({
-        total: z.number(),
-        limit: z.number(),
-        offset: z.number()
-    })
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/site-provisioning-keys",
-    description: "List all site provisioning keys for an organization.",
-    tags: [OpenAPITags.SiteProvisioningKey],
-    request: {
-        params: paramsSchema,
-        query: querySchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: createApiResponseSchema(
-                        ListSiteProvisioningKeysResponseDataSchema
-                    )
-                }
-            }
-        }
-    }
-});
-
 function querySiteProvisioningKeys(orgId: string) {
     return db
         .select({
-            siteProvisioningKeyId: siteProvisioningKeys.siteProvisioningKeyId,
+            siteProvisioningKeyId:
+                siteProvisioningKeys.siteProvisioningKeyId,
             orgId: siteProvisioningKeyOrg.orgId,
             lastChars: siteProvisioningKeys.lastChars,
             createdAt: siteProvisioningKeys.createdAt,

server/private/routers/siteProvisioning/updateSiteProvisioningKey.ts

@@ -13,7 +13,11 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
+import {
+    db,
+    siteProvisioningKeyOrg,
+    siteProvisioningKeys
+} from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -21,8 +25,6 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import type { UpdateSiteProvisioningKeyResponse } from "@server/routers/siteProvisioning/types";
-import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
-import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     siteProvisioningKeyId: z.string().nonempty(),
@@ -36,13 +38,7 @@ const bodySchema = z
                 z.null(),
                 z.coerce.number().int().positive().max(1_000_000)
             ])
-            .optional()
+            .optional(),
-            .openapi({
-                type: "number",
-                default: null,
-                description:
-                    "Maximum number of sites that can be provisioned in a single batch. If null, there is no limit."
-            }),
         validUntil: z.string().max(255).optional(),
         approveNewSites: z.boolean().optional()
     })
@@ -54,8 +50,7 @@ const bodySchema = z
         ) {
             ctx.addIssue({
                 code: "custom",
-                message:
+                message: "Provide maxBatchSize and/or validUntil and/or approveNewSites",
-                    "Provide maxBatchSize and/or validUntil and/or approveNewSites",
                 path: ["maxBatchSize"]
             });
         }
@@ -74,48 +69,6 @@ const bodySchema = z
 
 export type UpdateSiteProvisioningKeyBody = z.infer<typeof bodySchema>;
 
-const UpdateSiteProvisioningKeyResponseDataSchema = z.object({
-    siteProvisioningKeyId: z.string(),
-    orgId: z.string(),
-    name: z.string(),
-    lastChars: z.string(),
-    createdAt: z.string(),
-    lastUsed: z.string().nullable(),
-    maxBatchSize: z.number().nullable(),
-    numUsed: z.number(),
-    validUntil: z.string().nullable(),
-    approveNewSites: z.boolean()
-});
-
-registry.registerPath({
-    method: "patch",
-    path: "/org/{orgId}/site-provisioning-key/{siteProvisioningKeyId}",
-    description: "Update a site provisioning key.",
-    tags: [OpenAPITags.SiteProvisioningKey],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: createApiResponseSchema(
-                        UpdateSiteProvisioningKeyResponseDataSchema
-                    )
-                }
-            }
-        }
-    }
-});
-
 export async function updateSiteProvisioningKey(
     req: Request,
     res: Response,

server/routers/auth/logout.ts

@@ -16,26 +16,18 @@ export async function logout(
     next: NextFunction
 ): Promise<any> {
     const { user, session } = await verifySession(req);
-    const isSecure = req.protocol === "https";
-
-    // Always clear the session cookie so logout is idempotent, even when
-    // the session is already missing or invalid
-    res.setHeader("Set-Cookie", createBlankSessionTokenCookie(isSecure));
-
     if (!user || !session) {
         if (config.getRawConfig().app.log_failed_attempts) {
             logger.info(
-                `Log out with missing or invalid session. IP: ${req.ip}.`
+                `Log out failed because missing or invalid session. IP: ${req.ip}.`
             );
         }
-
+        return next(
-        return response<null>(res, {
+            createHttpError(
-            data: null,
+                HttpCode.BAD_REQUEST,
-            success: true,
+                "You must be logged in to sign out"
-            error: false,
+            )
-            message: "Logged out successfully",
+        );
-            status: HttpCode.OK
-        });
     }
 
     try {
@@ -45,6 +37,9 @@ export async function logout(
             logger.error("Failed to invalidate session", error);
         }
 
+        const isSecure = req.protocol === "https";
+        res.setHeader("Set-Cookie", createBlankSessionTokenCookie(isSecure));
+
         return response<null>(res, {
             data: null,
             success: true,

server/routers/auth/requestPasswordReset.ts

@@ -99,7 +99,7 @@ export async function requestPasswordReset(
             });
         });
 
-        const url = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?email=${encodeURIComponent(email)}&token=${token}`;
+        const url = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?email=${email}&token=${token}`;
 
         if (!config.getRawConfig().email) {
             logger.info(

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -29,7 +29,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { publicKey, port, localEndpoints, chainId } = message.data;
+    const { publicKey, port, chainId } = message.data;
     const siteId = newt.siteId;
 
     // Get the current site data
@@ -69,10 +69,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         .update(sites)
         .set({
             publicKey,
-            listenPort: port,
+            listenPort: port
-            localEndpoints: localEndpoints
-                ? JSON.stringify(localEndpoints)
-                : null
         })
         .where(eq(sites.siteId, siteId))
         .returning();

server/routers/olm/buildConfiguration.ts

@@ -30,7 +30,6 @@ export async function buildSiteConfigurationForOlmClient(
         siteId: number;
         name?: string;
         endpoint?: string;
-        localEndpoints?: string[];
         publicKey?: string;
         serverIP?: string | null;
         serverPort?: number | null;
@@ -207,9 +206,6 @@ export async function buildSiteConfigurationForOlmClient(
             name: site.name,
             // relayEndpoint: relayEndpoint, // this can be undefined now if not relayed // lets not do this for now because it would conflict with the hole punch testing
             endpoint: site.endpoint,
-            localEndpoints: site.localEndpoints
-                ? JSON.parse(site.localEndpoints)
-                : undefined,
             publicKey: site.publicKey,
             serverIP: site.address,
             serverPort: site.listenPort,

server/routers/olm/handleOlmLocalMessage.ts

@@ -1,74 +0,0 @@
-import { db, sites } from "@server/db";
-import { MessageHandler } from "@server/routers/ws";
-import { clients, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
-import logger from "@server/logger";
-
-export const handleOlmLocalMessage: MessageHandler = async (context) => {
-    const { message, client: c, sendToClient } = context;
-    const olm = c as Olm;
-
-    logger.info("Handling local olm message!");
-
-    if (!olm) {
-        logger.warn("Olm not found");
-        return;
-    }
-
-    if (!olm.clientId) {
-        logger.warn("Olm has no client!");
-        return;
-    }
-
-    const clientId = olm.clientId;
-
-    const [client] = await db
-        .select()
-        .from(clients)
-        .where(eq(clients.clientId, clientId))
-        .limit(1);
-
-    if (!client) {
-        logger.warn("Client not found");
-        return;
-    }
-
-    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
-    if (!client.pubKey) {
-        logger.warn("Client has no endpoint or listen port");
-        return;
-    }
-
-    const { siteId, chainId } = message.data;
-
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site || !site.exitNodeId) {
-        logger.warn("Site not found or has no exit node");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to accept local
-    });
-
-    // Just ack the message, we don't keep sending it
-    return {
-        message: {
-            type: "olm/wg/peer/local",
-            data: {
-                siteId: siteId,
-                chainId
-            }
-        },
-        broadcast: false,
-        excludeSender: false
-    };
-};

server/routers/olm/handleOlmRelayMessage.ts

@@ -79,9 +79,9 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
             )
         );
 
-    // update the peer on the newt
+    // update the peer on the exit node
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the newt knows to relay
+        endpoint: "" // this removes the endpoint so the exit node knows to relay
     });
 
     return {

server/routers/olm/handleOlmServerPeerAddMessage.ts

@@ -3,15 +3,24 @@ import {
     db,
     networks,
     siteNetworks,
-    siteResources
+    siteResources,
 } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
-import { clients, clientSitesAssociationsCache, Olm, sites } from "@server/db";
+import {
+    clients,
+    clientSitesAssociationsCache,
+    Olm,
+    sites
+} from "@server/db";
 import { and, eq, inArray, isNotNull, isNull } from "drizzle-orm";
 import logger from "@server/logger";
-import { generateAliasConfig } from "@server/lib/ip";
+import {
+    generateAliasConfig,
+} from "@server/lib/ip";
 import { generateRemoteSubnets } from "@server/lib/ip";
-import { addPeer as newtAddPeer } from "@server/routers/newt/peers";
+import {
+    addPeer as newtAddPeer,
+} from "@server/routers/newt/peers";
 
 export const handleOlmServerPeerAddMessage: MessageHandler = async (
     context
@@ -126,7 +135,10 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 clientSiteResourcesAssociationsCache.siteResourceId
             )
         )
-        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
+        .innerJoin(
+            networks,
+            eq(siteResources.networkId, networks.networkId)
+        )
         .innerJoin(
             siteNetworks,
             and(
@@ -135,7 +147,10 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
             )
         )
         .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
+            eq(
+                clientSiteResourcesAssociationsCache.clientId,
+                client.clientId
+            )
         );
 
     // Return connect message with all site configurations
@@ -146,9 +161,6 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 siteId: site.siteId,
                 name: site.name,
                 endpoint: site.endpoint,
-                localEndpoints: site.localEndpoints
-                    ? JSON.parse(site.localEndpoints)
-                    : undefined,
                 publicKey: site.publicKey,
                 serverIP: site.address,
                 serverPort: site.listenPort,
@@ -158,7 +170,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 aliases: generateAliasConfig(
                     allSiteResources.map(({ siteResources }) => siteResources)
                 ),
-                chainId: chainId
+                chainId: chainId,
             }
         },
         broadcast: false,

server/routers/olm/handleOlmUnLocalMessage.ts

@@ -1,95 +0,0 @@
-import { db, exitNodes, sites } from "@server/db";
-import { MessageHandler } from "@server/routers/ws";
-import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import { updatePeer as newtUpdatePeer } from "../newt/peers";
-import logger from "@server/logger";
-
-export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
-    const { message, client: c, sendToClient } = context;
-    const olm = c as Olm;
-
-    logger.info("Handling unlocal olm message!");
-
-    if (!olm) {
-        logger.warn("Olm not found");
-        return;
-    }
-
-    if (!olm.clientId) {
-        logger.warn("Olm has no client!");
-        return;
-    }
-
-    const clientId = olm.clientId;
-
-    const [client] = await db
-        .select()
-        .from(clients)
-        .where(eq(clients.clientId, clientId))
-        .limit(1);
-
-    if (!client) {
-        logger.warn("Client not found");
-        return;
-    }
-
-    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
-    if (!client.pubKey) {
-        logger.warn("Client has no endpoint or listen port");
-        return;
-    }
-
-    const { siteId, chainId } = message.data;
-
-    // Get the site
-    const [site] = await db
-        .select()
-        .from(sites)
-        .where(eq(sites.siteId, siteId))
-        .limit(1);
-
-    if (!site) {
-        logger.warn("Site not found or has no exit node");
-        return;
-    }
-
-    const [clientSiteAssociation] = await db
-        .select()
-        .from(clientSitesAssociationsCache)
-        .where(
-            and(
-                eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                eq(clientSitesAssociationsCache.siteId, siteId)
-            )
-        );
-
-    if (!clientSiteAssociation) {
-        logger.warn("Client-Site association not found");
-        return;
-    }
-
-    if (!clientSiteAssociation.endpoint) {
-        logger.warn("Client-Site association has no endpoint, cannot unrelay");
-        return;
-    }
-
-    // update the peer on the newt
-    await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.isRelayed
-            ? ""
-            : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
-    });
-
-    return {
-        message: {
-            type: "olm/wg/peer/unlocal",
-            data: {
-                siteId: siteId,
-                chainId
-            }
-        },
-        broadcast: false,
-        excludeSender: false
-    };
-};

server/routers/olm/handleOlmUnRelayMessage.ts

@@ -77,9 +77,9 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    // update the peer on the newt
+    // update the peer on the exit node
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the exit node
     });
 
     return {

server/routers/olm/index.ts

@@ -13,5 +13,3 @@ export * from "./recoverOlmWithFingerprint";
 export * from "./handleOlmDisconnectingMessage";
 export * from "./handleOlmServerInitAddPeerHandshake";
 export * from "./offlineChecker";
-export * from "./handleOlmUnLocalMessage";
-export * from "./handleOlmLocalMessage";

server/routers/olm/peers.ts

@@ -18,7 +18,6 @@ export async function addPeer(
         serverPort: number | null;
         remoteSubnets: string[] | null; // optional, comma-separated list of subnets that this site can access
         aliases: Alias[];
-        localEndpoints?: string[]; // optional, list of local endpoints for the peer
     },
     olmId?: string,
     version?: string | null
@@ -45,7 +44,6 @@ export async function addPeer(
                 name: peer.name,
                 publicKey: peer.publicKey,
                 endpoint: peer.endpoint,
-                localEndpoints: peer.localEndpoints,
                 relayEndpoint: peer.relayEndpoint,
                 serverIP: peer.serverIP,
                 serverPort: peer.serverPort,

server/routers/resource/getStatusHistory.ts

@@ -42,14 +42,9 @@ export async function getResourceStatusHistory(
 
         const entityType = "resource";
         const entityId = parsedParams.data.resourceId;
-        const { days, tzOffsetMinutes } = parsedQuery.data;
+        const { days } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(
+        const data = await getCachedStatusHistory(entityType, entityId, days);
-            entityType,
-            entityId,
-            days,
-            tzOffsetMinutes
-        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/routers/site/getStatusHistory.ts

@@ -42,14 +42,9 @@ export async function getSiteStatusHistory(
 
         const entityType = "site";
         const entityId = parsedParams.data.siteId;
-        const { days, tzOffsetMinutes } = parsedQuery.data;
+        const { days } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(
+        const data = await getCachedStatusHistory(entityType, entityId, days);
-            entityType,
-            entityId,
-            days,
-            tzOffsetMinutes
-        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/routers/user/adminGeneratePasswordResetCode.ts

@@ -94,7 +94,7 @@ export async function adminGeneratePasswordResetCode(
             });
         });
 
-        const url = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?email=${encodeURIComponent(existingUser[0].email!)}&token=${token}`;
+        const url = `${config.getRawConfig().app.dashboard_url}/auth/reset-password?email=${existingUser[0].email}&token=${token}`;
 
         logger.info(
             `Admin generated password reset code for user ${existingUser[0].email} (${userId})`

server/routers/user/inviteUser.ts

@@ -287,7 +287,7 @@ export async function inviteUser(
                     )
                 );
 
-            const inviteLink = `${config.getRawConfig().app.dashboard_url}/invite?token=${inviteId}-${token}&email=${encodeURIComponent(email)}`;
+            const inviteLink = `${config.getRawConfig().app.dashboard_url}/invite?token=${inviteId}-${token}&email=${email}`;
 
             if (doEmail) {
                 await sendEmail(
@@ -341,7 +341,7 @@ export async function inviteUser(
                 .values(uniqueRoleIds.map((roleId) => ({ inviteId, roleId })));
         });
 
-        const inviteLink = `${config.getRawConfig().app.dashboard_url}/invite?token=${inviteId}-${token}&email=${encodeURIComponent(email)}`;
+        const inviteLink = `${config.getRawConfig().app.dashboard_url}/invite?token=${inviteId}-${token}&email=${email}`;
 
         if (doEmail) {
             await sendEmail(

server/routers/ws/messageHandlers.ts

@@ -20,9 +20,7 @@ import {
     handleOlmServerPeerAddMessage,
     handleOlmUnRelayMessage,
     handleOlmDisconnectingMessage,
-    handleOlmServerInitAddPeerHandshake,
+    handleOlmServerInitAddPeerHandshake
-    handleOlmLocalMessage,
-    handleOlmUnLocalMessage
 } from "../olm";
 import { handleHealthcheckStatusMessage } from "../target";
 import { handleRoundTripMessage } from "./handleRoundTripMessage";
@@ -34,8 +32,6 @@ export const messageHandlers: Record<string, MessageHandler> = {
     "olm/wg/register": handleOlmRegisterMessage,
     "olm/wg/relay": handleOlmRelayMessage,
     "olm/wg/unrelay": handleOlmUnRelayMessage,
-    "olm/wg/local": handleOlmLocalMessage,
-    "olm/wg/unlocal": handleOlmUnLocalMessage,
     "olm/ping": handleOlmPingMessage,
     "olm/disconnecting": handleOlmDisconnectingMessage,
     "newt/disconnecting": handleNewtDisconnectingMessage,

src/actions/server.ts

@@ -248,39 +248,6 @@ export async function loginProxy(
     return await makeApiRequest<LoginResponse>(url, "POST", request);
 }
 
-export async function logoutProxy(): Promise<ResponseT<null>> {
-    const env = pullEnv();
-    const serverPort = process.env.SERVER_EXTERNAL_PORT;
-    const url = `http://localhost:${serverPort}/api/v1/auth/logout`;
-
-    const result = await makeApiRequest<null>(url, "POST");
-
-    try {
-        const headersList = await reqHeaders();
-        const host = headersList.get("host")?.split(":")[0];
-        const allCookies = await cookies();
-        const clearOptions = {
-            httpOnly: true,
-            secure: true,
-            sameSite: "lax" as const,
-            path: "/",
-            maxAge: 0
-        };
-        // Clear both host-only and domain-scoped variants.
-        allCookies.set(env.server.sessionCookieName, "", clearOptions);
-        if (host) {
-            allCookies.set(env.server.sessionCookieName, "", {
-                ...clearOptions,
-                domain: host
-            });
-        }
-    } catch (cookieError) {
-        console.error("Failed to clear session cookie:", cookieError);
-    }
-
-    return result;
-}
-
 export async function securityKeyStartProxy(
     request: SecurityKeyStartRequest,
     forceLogin?: boolean

src/components/InviteStatusCard.tsx

@@ -93,20 +93,14 @@ export default function InviteStatusCard({
             setType(type);
 
             if (!user && type === "user_does_not_exist") {
-                const inviteRedirect = encodeURIComponent(
-                    `/invite?token=${tokenParam}`
-                );
                 const redirectUrl = email
-                    ? `/auth/signup?redirect=${inviteRedirect}&email=${encodeURIComponent(email)}`
+                    ? `/auth/signup?redirect=/invite?token=${tokenParam}&email=${email}`
-                    : `/auth/signup?redirect=${inviteRedirect}`;
+                    : `/auth/signup?redirect=/invite?token=${tokenParam}`;
                 router.push(redirectUrl);
             } else if (!user && type === "not_logged_in") {
-                const inviteRedirect = encodeURIComponent(
-                    `/invite?token=${tokenParam}`
-                );
                 const redirectUrl = email
-                    ? `/auth/login?redirect=${inviteRedirect}&user=${encodeURIComponent(email)}`
+                    ? `/auth/login?redirect=/invite?token=${tokenParam}&user=${email}`
-                    : `/auth/login?redirect=${inviteRedirect}`;
+                    : `/auth/login?redirect=/invite?token=${tokenParam}`;
                 router.push(redirectUrl);
             } else {
                 setLoading(false);
@@ -118,23 +112,17 @@ export default function InviteStatusCard({
 
     async function goToLogin() {
         await api.post("/auth/logout", {});
-        const inviteRedirect = encodeURIComponent(
-            `/invite?token=${tokenParam}`
-        );
         const redirectUrl = email
-            ? `/auth/login?redirect=${inviteRedirect}&user=${encodeURIComponent(email)}`
+            ? `/auth/login?redirect=/invite?token=${tokenParam}&user=${email}`
-            : `/auth/login?redirect=${inviteRedirect}`;
+            : `/auth/login?redirect=/invite?token=${tokenParam}`;
         router.push(redirectUrl);
     }
 
     async function goToSignup() {
         await api.post("/auth/logout", {});
-        const inviteRedirect = encodeURIComponent(
-            `/invite?token=${tokenParam}`
-        );
         const redirectUrl = email
-            ? `/auth/signup?redirect=${inviteRedirect}&email=${encodeURIComponent(email)}`
+            ? `/auth/signup?redirect=/invite?token=${tokenParam}&email=${email}`
-            : `/auth/signup?redirect=${inviteRedirect}`;
+            : `/auth/signup?redirect=/invite?token=${tokenParam}`;
         router.push(redirectUrl);
     }
 

src/components/OrgPolicyRequired.tsx

@@ -12,8 +12,8 @@ import { Shield, ArrowRight } from "lucide-react";
 import Link from "next/link";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
-import { useState } from "react";
+import { createApiClient } from "@app/lib/api";
-import { logoutProxy } from "@app/actions/server";
+import { useEnvContext } from "@app/hooks/useEnvContext";
 
 type OrgPolicyRequiredProps = {
     orgId: string;
@@ -40,23 +40,21 @@ export default function OrgPolicyRequired({
 }: OrgPolicyRequiredProps) {
     const t = useTranslations();
     const router = useRouter();
-    const [loading, setLoading] = useState(false);
+
+    const api = createApiClient(useEnvContext());
 
     const sessionExpired =
         policies?.maxSessionLength &&
         policies.maxSessionLength.compliant === false;
 
-    async function reauthenticate() {
+    function reauthenticate() {
-        setLoading(true);
+        api.post("/auth/logout")
-        try {
+            .catch(() => {})
-            await logoutProxy();
+            .then(() => {
-        } catch (error) {
+                const destination = redirectAfterAuth ?? `/${orgId}`;
-            console.error("Error during logout:", error);
+                router.push(destination);
-        } finally {
+                router.refresh();
-            const destination = redirectAfterAuth ?? `/${orgId}`;
+            });
-            router.push(destination);
-            router.refresh();
-        }
     }
 
     if (sessionExpired) {
@@ -78,7 +76,6 @@ export default function OrgPolicyRequired({
                         <Button
                             className="w-full"
                             onClick={reauthenticate}
-                            loading={loading}
                         >
                             {t("reauthenticate")}
                             <ArrowRight className="ml-2 h-4 w-4" />

src/components/PermissionsSelectBox.tsx

@@ -143,13 +143,6 @@ function getActionsCategories(root: boolean) {
         Logs: {
             [t("actionExportLogs")]: "exportLogs",
             [t("actionViewLogs")]: "viewLogs"
-        },
-
-        "Site Provisioning Key": {
-            [t("actionCreateSiteProvisioningKey")]: "createSiteProvisioningKey",
-            [t("actionListSiteProvisioningKeys")]: "listSiteProvisioningKeys",
-            [t("actionUpdateSiteProvisioningKey")]: "updateSiteProvisioningKey",
-            [t("actionDeleteSiteProvisioningKey")]: "deleteSiteProvisioningKey"
         }
     };
 

src/lib/queries.ts

@@ -650,13 +650,9 @@ export const orgQueries = {
         queryOptions({
             queryKey: ["SITE_STATUS_HISTORY", siteId, days] as const,
             queryFn: async ({ signal, meta }) => {
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
-                >(
+                >(`/site/${siteId}/status-history?days=${days}`, { signal });
-                    `/site/${siteId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
-                    { signal }
-                );
                 return res.data.data;
             }
         }),
@@ -671,13 +667,11 @@ export const orgQueries = {
         queryOptions({
             queryKey: ["RESOURCE_STATUS_HISTORY", resourceId, days] as const,
             queryFn: async ({ signal, meta }) => {
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
-                >(
+                >(`/resource/${resourceId}/status-history?days=${days}`, {
-                    `/resource/${resourceId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
+                    signal
-                    { signal }
+                });
-                );
                 return res.data.data;
             }
         }),
@@ -699,11 +693,10 @@ export const orgQueries = {
                 days
             ] as const,
             queryFn: async ({ signal, meta }) => {
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
                     AxiosResponse<StatusHistoryResponse>
                 >(
-                    `/org/${orgId}/health-check/${healthCheckId}/status-history?days=${days}&tzOffsetMinutes=${tzOffsetMinutes}`,
+                    `/org/${orgId}/health-check/${healthCheckId}/status-history?days=${days}`,
                     { signal }
                 );
                 return res.data.data;