set last used cookie in smart login lookup

messages/en-US.json

@@ -1517,6 +1517,7 @@
     "otpAuthDescription": "Enter the code from your authenticator app or one of your single-use backup codes.",
     "otpAuthSubmit": "Submit Code",
     "idpContinue": "Or continue with",
+    "idpLastUsed": "Last Used",
     "otpAuthBack": "Back to Password",
     "navbar": "Navigation Menu",
     "navbarDescription": "Main navigation menu for the application",

server/lib/blueprints/applyBlueprint.ts

@@ -34,6 +34,12 @@ import {
     rebuildClientAssociationsFromSiteResource,
     waitForSiteResourceRebuildIdle
 } from "../rebuildClientAssociations";
+import { build } from "@server/build";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import next from "next";
+import { LimitId } from "../billing";
+import { usageService } from "../billing/usageService";
 
 type ApplyBlueprintArgs = {
     orgId: string;

server/lib/blueprints/privateResources.ts

@@ -26,6 +26,9 @@ import { createCertificate } from "#dynamic/routers/certificates/createCertifica
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
 import { build } from "@server/build";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import next from "next";
 import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 
@@ -240,7 +243,8 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: resourceData.enabled ?? true,
+                    enabled: true, // hardcoded for now
+                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     disableIcmp:
                         resourceData["disable-icmp"] ||
@@ -492,7 +496,8 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: resourceData.enabled ?? true,
+                    enabled: true, // hardcoded for now
+                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
                     disableIcmp:

server/lib/blueprints/types.ts

@@ -470,7 +470,7 @@ export const PrivateResourceSchema = z
         // proxyPort: z.int().positive().optional(),
         "destination-port": z.int().positive().optional(),
         destination: z.string().min(1).optional(),
-        enabled: z.boolean().default(true),
+        // enabled: z.boolean().default(true),
         "tcp-ports": portRangeStringSchema.optional().default("*"),
         "udp-ports": portRangeStringSchema.optional().default("*"),
         "disable-icmp": z.boolean().optional().default(false),

server/lib/ip.ts

@@ -496,7 +496,6 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
-            if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
             if (sr.mode === "cidr") {
@@ -531,7 +530,6 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
     return allSiteResources
         .filter(
             (sr) =>
-                sr.enabled &&
                 sr.aliasAddress &&
                 ((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
                     (sr.fullDomain && sr.mode == "http"))
@@ -664,13 +662,6 @@ export async function generateSubnetProxyTargetV2(
         subnet: string | null;
     }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
-    if (!siteResource.enabled) {
-        logger.debug(
-            `Site resource ${siteResource.siteResourceId} is disabled, skipping target generation.`
-        );
-        return;
-    }
-
     if (clients.length === 0) {
         logger.debug(
             `No clients have access to site resource ${siteResource.siteResourceId}, skipping target generation.`

server/lib/rebuildClientAssociations.ts

@@ -1561,19 +1561,9 @@ export async function handleMessagingForUpdatedSiteResource(
                 updatedSiteResource.udpPortRangeString ||
             existingSiteResource.disableIcmp !==
                 updatedSiteResource.disableIcmp);
-    // Toggling enabled on/off doesn't change any of the fields above, but it
-    // does change whether targets/peer data should exist at all, so it needs
-    // to drive the same old->new diff machinery: going enabled->disabled
-    // diffs "real data" against "nothing" (a remove), and disabled->enabled
-    // diffs "nothing" against "real data" (an add). generateSubnetProxyTargetV2/
-    // generateRemoteSubnets/generateAliasConfig already return nothing for a
-    // disabled resource, so no other changes are needed here.
-    const enabledChanged =
-        existingSiteResource &&
-        existingSiteResource.enabled !== updatedSiteResource.enabled;
 
     logger.debug(
-        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)} enabledChanged=${Boolean(enabledChanged)}`
+        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)}`
     );
 
     // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all
@@ -1584,16 +1574,14 @@ export async function handleMessagingForUpdatedSiteResource(
         fullDomainChanged ||
         sslChanged ||
         portRangesChanged ||
-        destinationPortChanged ||
-        enabledChanged
+        destinationPortChanged
     ) {
         const shouldUpdateTargets =
             destinationChanged ||
             sslChanged ||
             portRangesChanged ||
             fullDomainChanged ||
-            destinationPortChanged ||
-            enabledChanged;
+            destinationPortChanged;
 
         logger.debug(
             `handleMessagingForUpdatedSiteResource: entering unchanged-site update path shouldUpdateTargets=${shouldUpdateTargets}`
@@ -1669,22 +1657,20 @@ export async function handleMessagingForUpdatedSiteResource(
                 peerDataUpdateBatch.push({
                     clientId: client.clientId,
                     siteId,
-                    remoteSubnets:
-                        destinationChanged || enabledChanged
-                            ? {
-                                  oldRemoteSubnets:
-                                      !oldDestinationStillInUseBySite
-                                          ? generateRemoteSubnets([
-                                                existingSiteResource
-                                            ])
-                                          : [],
-                                  newRemoteSubnets: generateRemoteSubnets([
-                                      updatedSiteResource
-                                  ])
-                              }
-                            : undefined,
+                    remoteSubnets: destinationChanged
+                        ? {
+                              oldRemoteSubnets: !oldDestinationStillInUseBySite
+                                  ? generateRemoteSubnets([
+                                        existingSiteResource
+                                    ])
+                                  : [],
+                              newRemoteSubnets: generateRemoteSubnets([
+                                  updatedSiteResource
+                              ])
+                          }
+                        : undefined,
                     aliases:
-                        aliasChanged || fullDomainChanged || enabledChanged // the full domain is sent down as an alias
+                        aliasChanged || fullDomainChanged // the full domain is sent down as an alias
                             ? {
                                   oldAliases: generateAliasConfig([
                                       existingSiteResource

server/routers/newt/buildConfiguration.ts

@@ -148,12 +148,7 @@ export async function buildClientConfigurationForNewtClient(
         .from(siteResources)
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
-        .where(
-            and(
-                eq(siteNetworks.siteId, siteId),
-                eq(siteResources.enabled, true)
-            )
-        )
+        .where(eq(siteNetworks.siteId, siteId))
         .then((rows) => rows.map((r) => r.siteResources));
 
     const targetsToSend: SubnetProxyTargetV2[] = [];

server/routers/olm/buildConfiguration.ts

@@ -16,7 +16,7 @@ import {
     generateRemoteSubnets
 } from "@server/lib/ip";
 import logger from "@server/logger";
-import { and, eq, inArray } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
 import config from "@server/lib/config";
 
@@ -70,13 +70,7 @@ export async function buildSiteConfigurationForOlmClient(
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
         .where(
-            and(
-                eq(
-                    clientSiteResourcesAssociationsCache.clientId,
-                    client.clientId
-                ),
-                eq(siteResources.enabled, true)
-            )
+            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
         );
 
     const siteResourcesBySiteId = new Map<number, SiteResource[]>();

server/routers/siteResource/createSiteResource.ts

@@ -56,6 +56,7 @@ const createSiteResourceSchema = z
         siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
         destinationPort: z.int().positive().optional(),
         destination: z.string().min(1).nullish(),
+        enabled: z.boolean().default(true),
         alias: z
             .string()
             .regex(
@@ -274,6 +275,7 @@ export async function createSiteResource(
             scheme,
             destinationPort,
             destination,
+            enabled,
             ssl,
             alias,
             userIds,
@@ -537,6 +539,7 @@ export async function createSiteResource(
                     destination: destination, // the ssh can be null
                     scheme,
                     destinationPort,
+                    enabled,
                     alias: alias ? alias.trim() : null,
                     aliasAddress,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,

server/routers/siteResource/updateSiteResource.ts

@@ -152,11 +152,6 @@ const updateSiteResourceSchema = z
     )
     .refine(
         (data) => {
-            // this is a partial update; only enforce destination when the
-            // caller is actually changing mode or destination
-            if (data.mode === undefined && data.destination === undefined) {
-                return true;
-            }
             // destination is only optional for ssh mode with native authDaemonMode
             if (data.mode === "ssh" && data.authDaemonMode === "native") {
                 return true;
@@ -416,10 +411,8 @@ export async function updateSiteResource(
             : [];
         const existingSiteIds = existingSiteNetworks.map((sn) => sn.siteId);
 
-        // undefined means "leave unchanged" (partial update); only nulled out
-        // when the mode is explicitly being changed away from http
-        let fullDomain: string | null | undefined = undefined;
-        let finalSubdomain: string | null | undefined = undefined;
+        let fullDomain: string | null = null;
+        let finalSubdomain: string | null = null;
         if (domainId) {
             // Validate domain and construct full domain
             const domainResult = await validateAndConstructDomain(
@@ -455,11 +448,6 @@ export async function updateSiteResource(
                     )
                 );
             }
-        } else if (mode !== undefined && mode !== "http") {
-            // mode is explicitly changing away from http, so the resource
-            // can no longer have a domain associated with it
-            fullDomain = null;
-            finalSubdomain = null;
         }
 
         // make sure the alias is unique within the org if provided
@@ -528,28 +516,15 @@ export async function updateSiteResource(
                     destination: destination,
                     destinationPort: destinationPort,
                     enabled: enabled,
-                    alias:
-                        alias !== undefined
-                            ? alias
-                                ? alias.trim()
-                                : null
-                            : mode !== undefined &&
-                                mode !== "host" &&
-                                mode !== "ssh"
-                              ? null
-                              : undefined,
+                    alias: alias ? alias.trim() : null,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
                     udpPortRangeString:
                         mode == "http" || mode == "ssh"
                             ? ""
                             : udpPortRangeString,
                     disableIcmp:
-                        mode !== undefined
-                            ? disableIcmp ||
-                              (mode == "http" || mode == "ssh"
-                                  ? true
-                                  : false)
-                            : disableIcmp,
+                        disableIcmp ||
+                        (mode == "http" || mode == "ssh" ? true : false),
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

src/app/[orgId]/settings/resources/private/[niceId]/general/page.tsx

@@ -16,14 +16,12 @@ import { Button } from "@app/components/ui/button";
 import {
     Form,
     FormControl,
-    FormDescription,
     FormField,
     FormItem,
     FormLabel,
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
-import { SwitchInput } from "@app/components/SwitchInput";
 import { createGeneralFormSchema } from "@app/lib/privateResourceForm";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useTranslations } from "next-intl";
@@ -43,8 +41,7 @@ export default function PrivateResourceGeneralPage() {
         resolver: zodResolver(formSchema),
         defaultValues: {
             name: siteResource.name,
-            niceId: siteResource.niceId,
-            enabled: siteResource.enabled
+            niceId: siteResource.niceId
         }
     });
 
@@ -55,8 +52,7 @@ export default function PrivateResourceGeneralPage() {
         const data = form.getValues();
         await save({
             name: data.name,
-            niceId: data.niceId,
-            enabled: data.enabled
+            niceId: data.niceId
         });
     }, null);
 
@@ -80,42 +76,6 @@ export default function PrivateResourceGeneralPage() {
                                 id="private-resource-general-form"
                             >
                                 <SettingsFormGrid>
-                                    <SettingsFormCell span="full">
-                                        <FormField
-                                            control={form.control}
-                                            name="enabled"
-                                            render={() => (
-                                                <FormItem>
-                                                    <FormControl>
-                                                        <SwitchInput
-                                                            id="enable-resource"
-                                                            defaultChecked={
-                                                                siteResource.enabled
-                                                            }
-                                                            label={t(
-                                                                "resourceEnable"
-                                                            )}
-                                                            onCheckedChange={(
-                                                                val
-                                                            ) =>
-                                                                form.setValue(
-                                                                    "enabled",
-                                                                    val
-                                                                )
-                                                            }
-                                                        />
-                                                    </FormControl>
-                                                    <FormDescription>
-                                                        {t(
-                                                            "disabledResourceDescription"
-                                                        )}
-                                                    </FormDescription>
-                                                    <FormMessage />
-                                                </FormItem>
-                                            )}
-                                        />
-                                    </SettingsFormCell>
-
                                     <SettingsFormCell span="half">
                                         <FormField
                                             control={form.control}

src/app/auth/login/page.tsx

@@ -16,8 +16,11 @@ import LoginCardHeader from "@app/components/LoginCardHeader";
 import { priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
 import { LoginFormIDP } from "@app/components/LoginForm";
-import { ListIdpsResponse } from "@server/routers/idp";
+import { ListIdpsResponse, type GetIdpResponse } from "@server/routers/idp";
 import type { Metadata } from "next";
+import { cookies } from "next/headers";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import z from "zod";
 
 export const metadata: Metadata = {
     title: "Log In"
@@ -29,8 +32,9 @@ export default async function Page(props: {
     searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }) {
     const searchParams = await props.searchParams;
-    const getUser = cache(verifySession);
-    const user = await getUser({ skipCheckVerifyEmail: true });
+    const user = await verifySession({ skipCheckVerifyEmail: true });
+
+    const lastUsedIdpCookie = (await cookies()).get(LAST_USED_IDP_COOKIE_NAME);
 
     const isInvite = searchParams?.redirect?.includes("/invite");
     const forceLoginParam = searchParams?.forceLogin;
@@ -85,19 +89,47 @@ export default async function Page(props: {
         (build === "enterprise" && env.app.identityProviderMode === "org");
 
     let loginIdps: LoginFormIDP[] = [];
+    let lastUsedIdpForSmartLogin: (LoginFormIDP & { orgId?: string }) | null =
+        null;
     if (!useSmartLogin) {
         // Load IdPs for DashboardLoginForm (OSS or org-only IdP mode)
         if (build === "oss" || env.app.identityProviderMode !== "org") {
-            const idpsRes = await cache(
-                async () =>
-                    await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
-            )();
+            const idpsRes =
+                await priv.get<AxiosResponse<ListIdpsResponse>>("/idp");
             loginIdps = idpsRes.data.data.idps.map((idp) => ({
                 idpId: idp.idpId,
                 name: idp.name,
                 variant: idp.type
             })) as LoginFormIDP[];
         }
+    } else {
+        if (lastUsedIdpCookie) {
+            const lastUsedIdpSchema = z.object({
+                orgId: z.string().optional(),
+                idpId: z.number()
+            });
+            try {
+                const persistedData = lastUsedIdpSchema.parse(
+                    JSON.parse(lastUsedIdpCookie.value)
+                );
+
+                const idpRes = await priv.get<AxiosResponse<GetIdpResponse>>(
+                    `/idp/${persistedData.idpId}`
+                );
+
+                const idp = idpRes.data.data.idp;
+
+                lastUsedIdpForSmartLogin = {
+                    idpId: idp.idpId,
+                    name: idp.name,
+                    variant: idp.type,
+                    orgId: persistedData.orgId,
+                    lastUsed: true
+                };
+            } catch (error) {
+                // the idp might not exist or the data is malformatted, skip this
+            }
+        }
     }
 
     const t = await getTranslations();
@@ -160,6 +192,7 @@ export default async function Page(props: {
                                 redirect={redirectUrl}
                                 forceLogin={forceLogin}
                                 defaultUser={defaultUser}
+                                lastUsedIdp={lastUsedIdpForSmartLogin}
                                 orgSignIn={
                                     !isInvite &&
                                     (build === "saas" ||

src/app/page.tsx

@@ -5,7 +5,6 @@ import UserProvider from "@app/providers/UserProvider";
 import { ListUserOrgsResponse } from "@server/routers/org";
 import { AxiosResponse } from "axios";
 import { redirect } from "next/navigation";
-import { cache } from "react";
 import OrganizationLanding from "@app/components/OrganizationLanding";
 import { pullEnv } from "@app/lib/pullEnv";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
@@ -13,7 +12,6 @@ import { Layout } from "@app/components/Layout";
 import RedirectToOrg from "@app/components/RedirectToOrg";
 import { InitialSetupCompleteResponse } from "@server/routers/auth";
 import { cookies } from "next/headers";
-import { build } from "@server/build";
 
 export const dynamic = "force-dynamic";
 
@@ -29,8 +27,7 @@ export default async function Page(props: {
 
     const env = pullEnv();
 
-    const getUser = cache(verifySession);
-    const user = await getUser({ skipCheckVerifyEmail: true });
+    const user = await verifySession({ skipCheckVerifyEmail: true });
 
     let complete = false;
     try {

src/components/IdpLoginButtons.tsx

@@ -1,26 +1,25 @@
 "use client";
 
-import { useEffect, useState } from "react";
-import { Button } from "@app/components/ui/button";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { useTranslations } from "next-intl";
+import { generateOidcUrlProxy } from "@app/actions/server";
 import IdpTypeIcon from "@app/components/IdpTypeIcon";
-import {
-    generateOidcUrlProxy,
-    type GenerateOidcUrlResponse
-} from "@app/actions/server";
+import { Alert, AlertDescription } from "@app/components/ui/alert";
+import { Button } from "@app/components/ui/button";
+import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import { setClientCookie } from "@app/lib/setClientCookie";
+import { useTranslations } from "next-intl";
 import {
     redirect as redirectTo,
-    useParams,
+    useRouter,
     useSearchParams
 } from "next/navigation";
-import { useRouter } from "next/navigation";
-import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { useEffect, useState, useTransition } from "react";
 
 export type LoginFormIDP = {
     idpId: number;
     name: string;
     variant?: string;
+    lastUsed?: boolean;
 };
 
 type IdpLoginButtonsProps = {
@@ -35,7 +34,6 @@ export default function IdpLoginButtons({
     orgId
 }: IdpLoginButtonsProps) {
     const [error, setError] = useState<string | null>(null);
-    const [loading, setLoading] = useState(false);
     const t = useTranslations();
 
     const params = useSearchParams();
@@ -52,10 +50,22 @@ export default function IdpLoginButtons({
         }
     }, []);
 
+    const [loading, startTransition] = useTransition();
+
     async function loginWithIdp(idpId: number) {
-        setLoading(true);
         setError(null);
 
+        setClientCookie(
+            LAST_USED_IDP_COOKIE_NAME,
+            JSON.stringify({
+                orgId,
+                idpId
+            }),
+            {
+                sameSite: "Lax"
+            }
+        );
+
         let redirectToUrl: string | undefined;
         try {
             console.log("generating", idpId, redirect || "/", orgId);
@@ -68,7 +78,6 @@ export default function IdpLoginButtons({
 
             if (response.error) {
                 setError(response.message);
-                setLoading(false);
                 return;
             }
 
@@ -84,7 +93,6 @@ export default function IdpLoginButtons({
                         "An unexpected error occurred. Please try again."
                 })
             );
-            setLoading(false);
         }
 
         if (redirectToUrl) {
@@ -124,20 +132,38 @@ export default function IdpLoginButtons({
                                 idp.variant || idp.name.toLowerCase();
 
                             return (
-                                <Button
+                                <div
+                                    className="w-full relative"
                                     key={idp.idpId}
-                                    type="button"
-                                    variant="outline"
-                                    className="w-full inline-flex items-center space-x-2"
-                                    onClick={() => {
-                                        loginWithIdp(idp.idpId);
-                                    }}
-                                    disabled={loading}
-                                    loading={loading}
                                 >
-                                    <IdpTypeIcon type={effectiveType} size={16} />
-                                    <span>{idp.name}</span>
-                                </Button>
+                                    <Button
+                                        key={idp.idpId}
+                                        type="button"
+                                        variant="outline"
+                                        className="w-full inline-flex items-center space-x-2  after:absolute after:inset-0 after:z-10"
+                                        onClick={() => {
+                                            startTransition(() =>
+                                                loginWithIdp(idp.idpId)
+                                            );
+                                        }}
+                                        disabled={loading}
+                                        loading={loading}
+                                    >
+                                        <IdpTypeIcon
+                                            type={effectiveType}
+                                            size={16}
+                                        />
+                                        <span>{idp.name}</span>
+                                    </Button>
+
+                                    {idp.lastUsed && (
+                                        <div className="absolute inset-0">
+                                            <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
+                                                {t("idpLastUsed")}
+                                            </span>
+                                        </div>
+                                    )}
+                                </div>
                             );
                         })}
                     </>

src/components/LoginForm.tsx

@@ -30,10 +30,7 @@ import Link from "next/link";
 import { GenerateOidcUrlResponse } from "@server/routers/idp";
 import { Separator } from "./ui/separator";
 import { useTranslations } from "next-intl";
-import {
-    generateOidcUrlProxy,
-    loginProxy
-} from "@app/actions/server";
+import { generateOidcUrlProxy, loginProxy } from "@app/actions/server";
 import { redirect as redirectTo } from "next/navigation";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import IdpTypeIcon from "@app/components/IdpTypeIcon";
@@ -41,11 +38,13 @@ import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import { loadReoScript } from "reodotdev";
 import { build } from "@server/build";
 import MfaInputForm from "@app/components/MfaInputForm";
+import { useLocalStorage } from "@app/hooks/useLocalStorage";
 
 export type LoginFormIDP = {
     idpId: number;
     name: string;
     variant?: string;
+    lastUsed?: boolean;
 };
 
 type LoginFormProps = {
@@ -105,7 +104,6 @@ export default function LoginForm({
         }
     }, []);
 
-
     const formSchema = z.object({
         email: z.string().email({ message: t("emailInvalid") }),
         password: z.string().min(8, { message: t("passwordRequirementsChars") })
@@ -130,11 +128,16 @@ export default function LoginForm({
         }
     });
 
+    const [lastUsedIdpId, setLastUsedIdpId] = useLocalStorage<string | null>(
+        "login:last-used-idp",
+        null
+    );
 
     async function onSubmit(values: any) {
         const { email, password } = form.getValues();
         const { code } = mfaForm.getValues();
 
+        setLastUsedIdpId(null);
         setLoading(true);
         setError(null);
 
@@ -179,8 +182,7 @@ export default function LoginForm({
             if (data.useSecurityKey) {
                 setError(
                     t("securityKeyRequired", {
-                        defaultValue:
-                            "Please use your security key to sign in."
+                        defaultValue: "Please use your security key to sign in."
                     })
                 );
                 return;
@@ -242,6 +244,8 @@ export default function LoginForm({
 
     async function loginWithIdp(idpId: number) {
         let redirectUrl: string | undefined;
+
+        setLastUsedIdpId(idpId.toString());
         try {
             const data = await generateOidcUrlProxy(
                 idpId,
@@ -356,7 +360,6 @@ export default function LoginForm({
             )}
 
             <div className="space-y-4">
-
                 {!mfaRequested && (
                     <>
                         <SecurityKeyAuthButton
@@ -385,25 +388,41 @@ export default function LoginForm({
                                         idp.variant || idp.name.toLowerCase();
 
                                     return (
-                                        <Button
+                                        <div
+                                            className="w-full relative"
                                             key={idp.idpId}
-                                            type="button"
-                                            variant="outline"
-                                            className="w-full inline-flex items-center space-x-2"
-                                            onClick={() => {
-                                                loginWithIdp(idp.idpId);
-                                            }}
                                         >
-                                            <IdpTypeIcon type={effectiveType} size={16} />
-                                            <span>{idp.name}</span>
-                                        </Button>
+                                            <Button
+                                                key={idp.idpId}
+                                                type="button"
+                                                variant="outline"
+                                                className="w-full inline-flex items-center space-x-2 after:absolute after:inset-0 after:z-10"
+                                                onClick={() => {
+                                                    loginWithIdp(idp.idpId);
+                                                }}
+                                            >
+                                                <IdpTypeIcon
+                                                    type={effectiveType}
+                                                    size={16}
+                                                />
+                                                <span>{idp.name}</span>
+                                            </Button>
+
+                                            {lastUsedIdpId ===
+                                                idp.idpId.toString() && (
+                                                <div className="absolute inset-0">
+                                                    <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
+                                                        {t("idpLastUsed")}
+                                                    </span>
+                                                </div>
+                                            )}
+                                        </div>
                                     );
                                 })}
                             </>
                         )}
                     </>
                 )}
-
             </div>
         </div>
     );

src/components/LoginPasswordForm.tsx

@@ -22,6 +22,8 @@ import Link from "next/link";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
 import MfaInputForm from "@app/components/MfaInputForm";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import { setClientCookie } from "@app/lib/setClientCookie";
 
 type LoginPasswordFormProps = {
     identifier: string;
@@ -82,6 +84,12 @@ export default function LoginPasswordForm({
         const { password } = values;
         const { code } = mfaForm.getValues();
 
+        // delete last used auth cookie by setting it in the past
+        setClientCookie(LAST_USED_IDP_COOKIE_NAME, JSON.stringify(null), {
+            sameSite: "Lax",
+            days: -1
+        });
+
         setLoading(true);
         setError(null);
 

src/components/PrivateResourcesTable.tsx

@@ -23,7 +23,6 @@ import {
     PopoverContent,
     PopoverTrigger
 } from "@app/components/ui/popover";
-import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
@@ -37,9 +36,7 @@ import { getPrivateResourceSettingsHref } from "@app/lib/launcherResourceAdminHr
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import { UpdateSiteResourceResponse } from "@server/routers/siteResource";
 import type { PaginationState } from "@tanstack/react-table";
-import { AxiosResponse } from "axios";
 import {
     ArrowDown01Icon,
     ArrowRight,
@@ -52,17 +49,8 @@ import {
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
-import {
-    startTransition,
-    useMemo,
-    useOptimistic,
-    useRef,
-    useState,
-    useTransition,
-    type ComponentRef
-} from "react";
+import { startTransition, useMemo, useState, useTransition } from "react";
 import { useDebouncedCallback } from "use-debounce";
-import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
@@ -126,11 +114,6 @@ function isSafeUrlForLink(href: string): boolean {
     }
 }
 
-const booleanSearchFilterSchema = z
-    .enum(["true", "false"])
-    .optional()
-    .catch(undefined);
-
 type ClientResourcesTableProps = {
     internalResources: InternalResourceRow[];
     orgId: string;
@@ -191,30 +174,6 @@ export default function PrivateResourcesTable({
         });
     };
 
-    async function toggleInternalResourceEnabled(
-        val: boolean,
-        resourceId: number
-    ) {
-        try {
-            await api.post<AxiosResponse<UpdateSiteResourceResponse>>(
-                `site-resource/${resourceId}`,
-                {
-                    enabled: val
-                }
-            );
-            router.refresh();
-        } catch (e) {
-            toast({
-                variant: "destructive",
-                title: t("resourcesErrorUpdate"),
-                description: formatAxiosError(
-                    e,
-                    t("resourcesErrorUpdateDescription")
-                )
-            });
-        }
-    }
-
     const deleteInternalResource = async (
         resourceId: number,
         siteId: number
@@ -470,36 +429,6 @@ export default function PrivateResourcesTable({
                     );
                 }
             },
-            {
-                accessorKey: "enabled",
-                friendlyName: t("enabled"),
-                header: () => (
-                    <ColumnFilterButton
-                        options={[
-                            { value: "true", label: t("enabled") },
-                            { value: "false", label: t("disabled") }
-                        ]}
-                        selectedValue={booleanSearchFilterSchema.parse(
-                            searchParams.get("enabled")
-                        )}
-                        onValueChange={(value) =>
-                            handleFilterChange("enabled", value)
-                        }
-                        searchPlaceholder={t("searchPlaceholder")}
-                        emptyMessage={t("emptySearchOptions")}
-                        label={t("enabled")}
-                        className="p-3"
-                    />
-                ),
-                cell: ({ row }) => (
-                    <InternalResourceEnabledForm
-                        resource={row.original}
-                        onToggleInternalResourceEnabled={
-                            toggleInternalResourceEnabled
-                        }
-                    />
-                )
-            },
             {
                 id: "labels",
                 accessorKey: "labels",
@@ -714,39 +643,3 @@ function ClientResourceLabelCell({
         />
     );
 }
-
-type InternalResourceEnabledFormProps = {
-    resource: InternalResourceRow;
-    onToggleInternalResourceEnabled: (
-        val: boolean,
-        resourceId: number
-    ) => Promise<void>;
-};
-
-function InternalResourceEnabledForm({
-    resource,
-    onToggleInternalResourceEnabled
-}: InternalResourceEnabledFormProps) {
-    const [optimisticEnabled, setOptimisticEnabled] = useOptimistic(
-        resource.enabled
-    );
-
-    const formRef = useRef<ComponentRef<"form">>(null);
-
-    async function submitAction(formData: FormData) {
-        const newEnabled = !(formData.get("enabled") === "on");
-        setOptimisticEnabled(newEnabled);
-        await onToggleInternalResourceEnabled(newEnabled, resource.id);
-    }
-
-    return (
-        <form action={submitAction} ref={formRef}>
-            <Switch
-                checked={optimisticEnabled}
-                disabled={optimisticEnabled !== resource.enabled}
-                name="enabled"
-                onCheckedChange={() => formRef.current?.requestSubmit()}
-            />
-        </form>
-    );
-}

src/components/SmartLoginForm.tsx

@@ -27,6 +27,8 @@ import UserProfileCard from "@app/components/UserProfileCard";
 import SecurityKeyAuthButton from "@app/components/SecurityKeyAuthButton";
 import { Separator } from "@app/components/ui/separator";
 import OrgSignInLink from "@app/components/OrgSignInLink";
+import type { LoginFormIDP } from "./LoginForm";
+import IdpLoginButtons from "./IdpLoginButtons";
 
 const identifierSchema = z.object({
     identifier: z.string().min(1, "Username or email is required")
@@ -53,6 +55,7 @@ type SmartLoginFormProps = {
     forceLogin?: boolean;
     defaultUser?: string;
     orgSignIn?: OrgSignInConfig;
+    lastUsedIdp?: (LoginFormIDP & { orgId?: string }) | null;
 };
 
 type ViewState =
@@ -89,7 +92,8 @@ export default function SmartLoginForm({
     redirect,
     forceLogin,
     defaultUser,
-    orgSignIn
+    orgSignIn,
+    lastUsedIdp
 }: SmartLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -294,6 +298,15 @@ export default function SmartLoginForm({
                                 </span>
                             </div>
                         </div>
+
+                        {lastUsedIdp && (
+                            <IdpLoginButtons
+                                idps={[lastUsedIdp]}
+                                orgId={lastUsedIdp.orgId}
+                                redirect={redirect}
+                            />
+                        )}
+
                         <OrgSignInLink
                             href={orgSignIn.href}
                             linkText={orgSignIn.linkText}

src/components/SmartLoginOrgSelector.tsx

@@ -17,6 +17,8 @@ import {
 } from "next/navigation";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
 import { Separator } from "@app/components/ui/separator";
+import { setClientCookie } from "@app/lib/setClientCookie";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
 
 type SmartLoginOrgSelectorProps = {
     identifier: string;
@@ -141,6 +143,17 @@ export default function SmartLoginOrgSelector({
         setPendingIdpId(idpId);
         setError(null);
 
+        setClientCookie(
+            LAST_USED_IDP_COOKIE_NAME,
+            JSON.stringify({
+                orgId,
+                idpId
+            }),
+            {
+                sameSite: "Lax"
+            }
+        );
+
         let redirectToUrl: string | undefined;
         try {
             const safeRedirect = cleanRedirect(redirect || "/");

src/lib/consts.ts

@@ -0,0 +1 @@
+export const LAST_USED_IDP_COOKIE_NAME = "p__last_used_idp";

src/lib/privateResourceForm.ts

@@ -165,6 +165,7 @@ export function buildCreateSiteResourcePayload(
         siteIds: data.siteIds,
         mode: data.mode,
         destination: isNativeSsh ? undefined : (data.destination ?? undefined),
+        enabled: true,
         ...(data.mode === "http" && {
             scheme: data.scheme,
             ssl: data.ssl ?? false,
@@ -341,8 +342,7 @@ export function createGeneralFormSchema(t: TranslateFn) {
             .string()
             .min(1)
             .max(255)
-            .regex(/^[a-zA-Z0-9-]+$/),
-        enabled: z.boolean()
+            .regex(/^[a-zA-Z0-9-]+$/)
     });
 }
 

src/lib/setClientCookie.ts

@@ -0,0 +1,32 @@
+/**
+ * Set a cookie on the client side in javascript code, not on the server
+ * @param name
+ * @param value
+ * @param days
+ * @param options
+ */
+export function setClientCookie(
+    name: string,
+    value: string,
+    options: {
+        days?: number;
+        path?: string;
+        secure?: boolean;
+        sameSite?: "Strict" | "Lax" | "None";
+    } = {}
+): void {
+    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+
+    if (options.days) {
+        const date = new Date();
+        date.setTime(date.getTime() + options.days * 864e5);
+        cookie += `; expires=${date.toUTCString()}`;
+    }
+
+    cookie += `; path=${options.path ?? "/"}`;
+
+    if (options.secure) cookie += "; Secure";
+    if (options.sameSite) cookie += `; SameSite=${options.sameSite}`;
+
+    document.cookie = cookie;
+}