Bump the docker-dependencies group across 1 directory with 2 updates

Bumps the docker-dependencies group with 2 updates in the / directory: docker/library/node and node.


Updates `docker/library/node` from 24.18.1-slim to 26.8.1-slim

Updates `node` from 24.18.1-alpine to 26.8.1-alpine

---
updated-dependencies:
- dependency-name: docker/library/node
  dependency-version: 26.8.1-slim
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
- dependency-name: node
  dependency-version: 26.8.1-alpine
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile

@@ -1,5 +1,5 @@
 # FROM node:24.18.1-slim AS base
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
+FROM public.ecr.aws/docker/library/node:26.8.1-slim AS base
 
 WORKDIR /app
 
@@ -33,7 +33,7 @@ FROM base AS builder
 RUN npm ci --omit=dev
 
 # FROM node:24.18.1-slim AS runner
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:26.8.1-slim AS runner
 
 WORKDIR /app
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:26.8.1-alpine
 
 WORKDIR /app
 

server/db/pg/schema/schema.ts

@@ -262,9 +262,7 @@ export const resourceAiModels = pgTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = pgTable(
+export const labels = pgTable("labels", {
-    "labels",
-    {
     labelId: serial("labelId").primaryKey(),
     name: varchar("name").notNull(),
     color: varchar("color").notNull(),
@@ -273,9 +271,7 @@ export const labels = pgTable(
             onDelete: "cascade"
         })
         .notNull()
-    },
+});
-    (t) => [index("idx_labels_orgid").on(t.orgId)]
-);
 
 export const launcherViews = pgTable("launcherViews", {
     viewId: serial("viewId").primaryKey(),
@@ -697,9 +693,7 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
     codeHash: varchar("codeHash").notNull()
 });
 
-export const sessions = pgTable(
+export const sessions = pgTable("session", {
-    "session",
-    {
     sessionId: varchar("id").primaryKey(),
     userId: varchar("userId")
         .notNull()
@@ -707,9 +701,7 @@ export const sessions = pgTable(
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
     issuedAt: bigint("issuedAt", { mode: "number" }),
     deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-    },
+});
-    (t) => [index("idx_sessions_userid").on(t.userId)]
-);
 
 export const newtSessions = pgTable("newtSession", {
     sessionId: varchar("id").primaryKey(),
@@ -719,9 +711,7 @@ export const newtSessions = pgTable("newtSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const userOrgs = pgTable(
+export const userOrgs = pgTable("userOrgs", {
-    "userOrgs",
-    {
     userId: varchar("userId")
         .notNull()
         .references(() => users.userId, { onDelete: "cascade" }),
@@ -733,12 +723,7 @@ export const userOrgs = pgTable(
     isOwner: boolean("isOwner").notNull().default(false),
     autoProvisioned: boolean("autoProvisioned").default(false),
     pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-    },
+});
-    (t) => [
-        index("idx_userOrgs_userid").on(t.userId),
-        index("idx_userOrgs_orgid").on(t.orgId)
-    ]
-);
 
 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
     codeId: serial("id").primaryKey(),
@@ -766,9 +751,7 @@ export const actions = pgTable("actions", {
     description: varchar("description")
 });
 
-export const roles = pgTable(
+export const roles = pgTable("roles", {
-    "roles",
-    {
     roleId: serial("roleId").primaryKey(),
     orgId: varchar("orgId")
         .references(() => orgs.orgId, {
@@ -783,9 +766,7 @@ export const roles = pgTable(
     sshSudoCommands: text("sshSudoCommands").default("[]"),
     sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
     sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
+});
-    (t) => [index("idx_roles_orgid").on(t.orgId)]
-);
 
 export const userOrgRoles = pgTable(
     "userOrgRoles",
@@ -1428,10 +1409,7 @@ export const olms = pgTable(
         }),
         archived: boolean("archived").notNull().default(false)
     },
-    (t) => [
+    (t) => [index("idx_olms_clientid").on(t.clientId)]
-        index("idx_olms_clientid").on(t.clientId),
-        index("idx_olms_userid").on(t.userId)
-    ]
 );
 
 export const currentFingerprint = pgTable("currentFingerprint", {

server/db/sqlite/schema/schema.ts

@@ -99,9 +99,7 @@ export const orgDomains = sqliteTable("orgDomains", {
         .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
-export const sites = sqliteTable(
+export const sites = sqliteTable("sites", {
-    "sites",
-    {
     siteId: integer("siteId").primaryKey({ autoIncrement: true }),
     orgId: text("orgId")
         .references(() => orgs.orgId, {
@@ -143,18 +141,10 @@ export const sites = sqliteTable(
     })
         .notNull()
         .default(false),
-        status: text("status")
+    status: text("status").$type<"pending" | "approved">().default("approved")
-            .$type<"pending" | "approved">()
+});
-            .default("approved")
-    },
-    (table) => [
-        index("idx_sites_orgId").on(table.orgId)
-    ]
-);
 
-export const resources = sqliteTable(
+export const resources = sqliteTable("resources", {
-    "resources",
-    {
     resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
     resourcePolicyId: integer("resourcePolicyId").references(
         () => resourcePolicies.resourcePolicyId,
@@ -232,14 +222,8 @@ export const resources = sqliteTable(
         .$type<"site" | "remote" | "native">()
         .default("site"),
     authDaemonPort: integer("authDaemonPort").default(22123),
-        status: text("status")
+    status: text("status").$type<"pending" | "approved">().default("approved")
-            .$type<"pending" | "approved">()
+});
-            .default("approved")
-    },
-    (table) => [
-        index("idx_resources_orgId").on(table.orgId)
-    ]
-);
 
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
@@ -276,9 +260,7 @@ export const resourceAiModels = sqliteTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = sqliteTable(
+export const labels = sqliteTable("labels", {
-    "labels",
-    {
     labelId: integer("labelId").primaryKey({ autoIncrement: true }),
     name: text("name").notNull(),
     color: text("color").notNull(),
@@ -287,11 +269,7 @@ export const labels = sqliteTable(
             onDelete: "cascade"
         })
         .notNull()
-    },
+});
-    (table) => [
-        index("idx_labels_orgId").on(table.orgId)
-    ]
-);
 
 export const launcherViews = sqliteTable("launcherViews", {
     viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -388,18 +366,14 @@ export const clientLabels = sqliteTable(
     (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );
 
-export const targets = sqliteTable(
+export const targets = sqliteTable("targets", {
-    "targets",
-    {
     targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-        resourceId: integer("resourceId").references(
+    resourceId: integer("resourceId").references(() => resources.resourceId, {
-            () => resources.resourceId,
+        onDelete: "cascade"
-            { onDelete: "cascade" }
+    }),
-        ),
+    providerId: integer("providerId").references(() => aiProviders.providerId, {
-        providerId: integer("providerId").references(
+        onDelete: "cascade"
-            () => aiProviders.providerId,
+    }),
-            { onDelete: "cascade" }
-        ),
     siteId: integer("siteId")
         .references(() => sites.siteId, {
             onDelete: "cascade"
@@ -420,12 +394,7 @@ export const targets = sqliteTable(
         .notNull()
         .default("http"),
     authToken: text("authToken")
-    },
+});
-    (table) => [
-        index("idx_targets_resourceId").on(table.resourceId),
-        index("idx_targets_siteId").on(table.siteId)
-    ]
-);
 
 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
     targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -694,9 +663,7 @@ export const setupTokens = sqliteTable("setupTokens", {
     dateUsed: text("dateUsed")
 });
 
-export const newts = sqliteTable(
+export const newts = sqliteTable("newt", {
-    "newt",
-    {
     newtId: text("id").primaryKey(),
     secretHash: text("secretHash").notNull(),
     dateCreated: text("dateCreated").notNull(),
@@ -704,15 +671,9 @@ export const newts = sqliteTable(
     siteId: integer("siteId").references(() => sites.siteId, {
         onDelete: "cascade"
     })
-    },
+});
-    (table) => [
-        index("idx_newts_siteId").on(table.siteId)
-    ]
-);
 
-export const clients = sqliteTable(
+export const clients = sqliteTable("clients", {
-    "clients",
-    {
     clientId: integer("clientId").primaryKey({ autoIncrement: true }),
     orgId: text("orgId")
         .references(() => orgs.orgId, {
@@ -745,12 +706,7 @@ export const clients = sqliteTable(
     approvalState: text("approvalState").$type<
         "pending" | "approved" | "denied"
     >()
-    },
+});
-    (table) => [
-        index("idx_clients_orgId").on(table.orgId),
-        index("idx_clients_userId").on(table.userId)
-    ]
-);
 
 export const clientSitesAssociationsCache = sqliteTable(
     "clientSitesAssociationsCache",
@@ -778,9 +734,7 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
     }
 );
 
-export const olms = sqliteTable(
+export const olms = sqliteTable("olms", {
-    "olms",
-    {
     olmId: text("id").primaryKey(),
     secretHash: text("secretHash").notNull(),
     dateCreated: text("dateCreated").notNull(),
@@ -796,11 +750,7 @@ export const olms = sqliteTable(
         onDelete: "cascade"
     }),
     archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-    },
+});
-    (table) => [
-        index("idx_olms_userId").on(table.userId)
-    ]
-);
 
 export const currentFingerprint = sqliteTable("currentFingerprint", {
     fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -962,9 +912,7 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
     codeHash: text("codeHash").notNull()
 });
 
-export const sessions = sqliteTable(
+export const sessions = sqliteTable("session", {
-    "session",
-    {
     sessionId: text("id").primaryKey(),
     userId: text("userId")
         .notNull()
@@ -974,11 +922,7 @@ export const sessions = sqliteTable(
     deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
         .notNull()
         .default(false)
-    },
+});
-    (table) => [
-        index("idx_sessions_userId").on(table.userId)
-    ]
-);
 
 export const newtSessions = sqliteTable("newtSession", {
     sessionId: text("id").primaryKey(),
@@ -996,9 +940,7 @@ export const olmSessions = sqliteTable("clientSession", {
     expiresAt: integer("expiresAt").notNull()
 });
 
-export const userOrgs = sqliteTable(
+export const userOrgs = sqliteTable("userOrgs", {
-    "userOrgs",
-    {
     userId: text("userId")
         .notNull()
         .references(() => users.userId, { onDelete: "cascade" }),
@@ -1012,12 +954,7 @@ export const userOrgs = sqliteTable(
         mode: "boolean"
     }).default(false),
     pamUsername: text("pamUsername") // cleaned username for ssh and such
-    },
+});
-    (table) => [
-        index("idx_userOrgs_userId").on(table.userId),
-        index("idx_userOrgs_orgId").on(table.orgId)
-    ]
-);
 
 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
     codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -1045,9 +982,7 @@ export const actions = sqliteTable("actions", {
     description: text("description")
 });
 
-export const roles = sqliteTable(
+export const roles = sqliteTable("roles", {
-    "roles",
-    {
     roleId: integer("roleId").primaryKey({ autoIncrement: true }),
     orgId: text("orgId")
         .references(() => orgs.orgId, {
@@ -1066,11 +1001,7 @@ export const roles = sqliteTable(
         true
     ),
     sshUnixGroups: text("sshUnixGroups").default("[]")
-    },
+});
-    (table) => [
-        index("idx_roles_orgId").on(table.orgId)
-    ]
-);
 
 export const userOrgRoles = sqliteTable(
     "userOrgRoles",

server/lib/blueprints/types.ts

@@ -101,7 +101,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
     .object({
         action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
+        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
         value: z.coerce.string(),
         priority: z.int().optional(),
         enabled: z.boolean().optional().default(true)
@@ -136,7 +136,7 @@ export const RuleSchema = z
     )
     .refine(
         (rule) => {
-            if (rule.match === "country" || rule.match === "country_is_not") {
+            if (rule.match === "country") {
                 if (!hasMaxmindCountryDb) {
                     return false;
                 }

server/lib/domainUtils.ts

@@ -31,6 +31,7 @@ export async function validateAndConstructDomain(
     subdomain?: string | null
 ): Promise<DomainValidationResult> {
     try {
+        // Query domain with organization access check
         const [domainRes] = await db
             .select()
             .from(domains)
@@ -41,10 +42,6 @@ export async function validateAndConstructDomain(
                     eq(orgDomains.orgId, orgId),
                     eq(orgDomains.domainId, domainId)
                 )
-            )
-            .leftJoin(
-                domainNamespaces,
-                eq(domainNamespaces.domainId, domainId)
             );
 
         // Check if domain exists
@@ -55,7 +52,7 @@ export async function validateAndConstructDomain(
             };
         }
 
-        if (!domainRes.orgDomains && !domainRes.domainNamespaces) {
+        if (!domainRes.orgDomains) {
             return {
                 success: false,
                 error: `Organization does not have access to domain with ID ${domainId}`
@@ -86,12 +83,20 @@ export async function validateAndConstructDomain(
         }
 
         // Wildcard subdomains are not allowed on namespace (provided/free) domains
-        if (isWildcard && domainRes.domainNamespaces) {
+        if (isWildcard) {
+            const [namespaceDomain] = await db
+                .select()
+                .from(domainNamespaces)
+                .where(eq(domainNamespaces.domainId, domainId))
+                .limit(1);
+
+            if (namespaceDomain) {
                 return {
                     success: false,
                     error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
                 };
             }
+        }
 
         if (
             isWildcard &&

server/middlewares/integration/verifyAccessTokenAccess.ts

@@ -68,11 +68,6 @@ export async function verifyApiKeyAccessTokenAccess(
             );
         }
 
-        if (apiKey.isRoot) {
-            // Root keys can access any access token in any org
-            return next();
-        }
-
         if (!resource.orgId) {
             return next(
                 createHttpError(

server/private/license/license.ts

@@ -149,8 +149,12 @@ LQIDAQAB
         }
 
         // Count used sites and users for license comparison
-        const [siteCountRes] = await db.select({ value: count() }).from(sites);
+        const [siteCountRes] = await db
-        const [userCountRes] = await db.select({ value: count() }).from(users);
+            .select({ value: count() })
+            .from(sites);
+        const [userCountRes] = await db
+            .select({ value: count() })
+            .from(users);
 
         const status: LicenseStatus = {
             hostId: this.hostMeta.hostMetaId,
@@ -272,13 +276,10 @@ LQIDAQAB
                         logger.error(
                             `Allowing failure. Will retry one more time at next run interval.`
                         );
-                        // Fall back to last known good status if we have
+                        // return last known good status
-                        // one cached; otherwise return the freshly built
+                        return this.statusCache.get(
-                        // status (with defaults) rather than undefined.
-                        const lastKnownStatus = this.statusCache.get(
                             this.statusKey
-                        ) as LicenseStatus | undefined;
+                        ) as LicenseStatus;
-                        return lastKnownStatus ?? status;
                     } else {
                         // Subsequent failures: fail abruptly
                         throw e;
@@ -367,7 +368,10 @@ LQIDAQAB
                 }
 
                 // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
+                if (
+                    cached.quantity_2 !== undefined &&
+                    cached.quantity_2 >= 0
+                ) {
                     status.maxSites =
                         (status.maxSites ?? 0) + cached.quantity_2;
                 }