Merge branch 'main' into holepunch

server/auth/actions.ts

@@ -64,7 +64,8 @@ export enum ActionsEnum {
     updateResourceRule = "updateResourceRule",
     createClient = "createClient",
     deleteClient = "deleteClient",
-    listClients = "listClients"
+    listClients = "listClients",
+    listOrgDomains = "listOrgDomains",
 }
 
 export async function checkUserActionPermission(

server/auth/sessions/app.ts

@@ -129,18 +129,19 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
 
 export function serializeSessionCookie(
     token: string,
-    isSecure: boolean
+    isSecure: boolean,
+    expiresAt: Date
 ): string {
     if (isSecure) {
-        return `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Strict; Max-Age=${SESSION_COOKIE_EXPIRES / 1000}; Path=/; Secure; Domain=${COOKIE_DOMAIN}`;
+        return `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${COOKIE_DOMAIN}`;
     } else {
-        return `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Lax; Max-Age=${SESSION_COOKIE_EXPIRES}; Path=/;`;
+        return `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/;`;
     }
 }
 
 export function createBlankSessionTokenCookie(isSecure: boolean): string {
     if (isSecure) {
-        return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/; Secure; Domain=${COOKIE_DOMAIN}`;
+        return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Secure; Domain=${COOKIE_DOMAIN}`;
     } else {
         return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/;`;
     }

server/auth/sessions/resource.ts

@@ -167,12 +167,19 @@ export function serializeResourceSessionCookie(
     cookieName: string,
     domain: string,
     token: string,
-    isHttp: boolean = false
+    isHttp: boolean = false,
+    expiresAt?: Date
 ): string {
     if (!isHttp) {
-        return `${cookieName}_s=${token}; HttpOnly; SameSite=Strict; Max-Age=${SESSION_COOKIE_EXPIRES / 1000}; Path=/; Secure; Domain=${"." + domain}`;
+        if (expiresAt === undefined) {
+            return `${cookieName}_s=${token}; HttpOnly; SameSite=Lax; Path=/; Secure; Domain=${"." + domain}`;
+        }
+        return `${cookieName}_s=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${"." + domain}`;
     } else {
-        return `${cookieName}=${token}; HttpOnly; SameSite=Strict; Max-Age=${SESSION_COOKIE_EXPIRES / 1000}; Path=/; Domain=${"." + domain}`;
+        if (expiresAt === undefined) {
+            return `${cookieName}=${token}; HttpOnly; SameSite=Lax; Path=/; Domain=${"." + domain}`;
+        }
+        return `${cookieName}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Domain=${"." + domain}`;
     }
 }
 
@@ -182,9 +189,9 @@ export function createBlankResourceSessionTokenCookie(
     isHttp: boolean = false
 ): string {
     if (!isHttp) {
-        return `${cookieName}_s=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/; Secure; Domain=${"." + domain}`;
+        return `${cookieName}_s=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Secure; Domain=${"." + domain}`;
     } else {
-        return `${cookieName}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/; Domain=${"." + domain}`;
+        return `${cookieName}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Domain=${"." + domain}`;
     }
 }
 

server/db/schema.ts

@@ -1,10 +1,26 @@
 import { InferSelectModel } from "drizzle-orm";
 import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
 
+export const domains = sqliteTable("domains", {
+    domainId: text("domainId").primaryKey(),
+    baseDomain: text("baseDomain").notNull(),
+    configManaged: integer("configManaged", { mode: "boolean" })
+        .notNull()
+        .default(false)
+});
+
 export const orgs = sqliteTable("orgs", {
     orgId: text("orgId").primaryKey(),
-    name: text("name").notNull(),
-    domain: text("domain").notNull()
+    name: text("name").notNull()
+});
+
+export const orgDomains = sqliteTable("orgDomains", {
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    domainId: text("domainId")
+        .notNull()
+        .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
 export const sites = sqliteTable("sites", {
@@ -50,6 +66,9 @@ export const resources = sqliteTable("resources", {
     name: text("name").notNull(),
     subdomain: text("subdomain"),
     fullDomain: text("fullDomain"),
+    domainId: text("domainId").references(() => domains.domainId, {
+        onDelete: "set null"
+    }),
     ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
     blockAccess: integer("blockAccess", { mode: "boolean" })
         .notNull()
@@ -490,3 +509,4 @@ export type ResourceRule = InferSelectModel<typeof resourceRules>;
 export type Client = InferSelectModel<typeof clients>;
 export type RoleClient = InferSelectModel<typeof roleClients>;
 export type UserClient = InferSelectModel<typeof userClients>;
+export type Domain = InferSelectModel<typeof domains>;

server/emails/index.ts

@@ -3,6 +3,7 @@ export * from "@server/emails/sendEmail";
 import nodemailer from "nodemailer";
 import config from "@server/lib/config";
 import logger from "@server/logger";
+import SMTPTransport from "nodemailer/lib/smtp-transport";
 
 function createEmailClient() {
     const emailConfig = config.getRawConfig().email;
@@ -13,7 +14,7 @@ function createEmailClient() {
         return;
     }
 
-    return nodemailer.createTransport({
+    const settings = {
         host: emailConfig.smtp_host,
         port: emailConfig.smtp_port,
         secure: emailConfig.smtp_secure || false,
@@ -21,7 +22,15 @@ function createEmailClient() {
             user: emailConfig.smtp_user,
             pass: emailConfig.smtp_pass
         }
-    });
+    } as SMTPTransport.Options;
+
+    if (emailConfig.smtp_tls_reject_unauthorized !== undefined) {
+        settings.tls = {
+            rejectUnauthorized: emailConfig.smtp_tls_reject_unauthorized
+        };
+    }
+
+    return nodemailer.createTransport(settings);
 }
 
 export const emailClient = createEmailClient();

server/lib/config.ts

@@ -1,11 +1,9 @@
 import fs from "fs";
 import yaml from "js-yaml";
-import path from "path";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import {
     __DIRNAME,
-    APP_PATH,
     APP_VERSION,
     configFilePath1,
     configFilePath2
@@ -15,12 +13,6 @@ import stoi from "./stoi";
 import { start } from "repl";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
-const hostnameSchema = z
-    .string()
-    .regex(
-        /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z]|[A-Za-z][A-Za-z0-9\-]*[A-Za-z0-9])$/
-    )
-    .or(z.literal("localhost"));
 
 const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
     return process.env[envVar] ?? valFromYaml;
@@ -32,34 +24,42 @@ const configSchema = z.object({
             .string()
             .url()
             .optional()
-            .transform(getEnvOrYaml("APP_DASHBOARDURL"))
             .pipe(z.string().url())
             .transform((url) => url.toLowerCase()),
-        base_domain: hostnameSchema
-            .optional()
-            .transform(getEnvOrYaml("APP_BASEDOMAIN"))
-            .pipe(hostnameSchema)
-            .transform((url) => url.toLowerCase()),
         log_level: z.enum(["debug", "info", "warn", "error"]),
         save_logs: z.boolean(),
         log_failed_attempts: z.boolean().optional()
     }),
+    domains: z
+        .record(
+            z.string(),
+            z.object({
+                base_domain: z
+                    .string()
+                    .nonempty("base_domain must not be empty")
+                    .transform((url) => url.toLowerCase()),
+                cert_resolver: z.string().optional(),
+                prefer_wildcard_cert: z.boolean().optional()
+            })
+        )
+        .refine(
+            (domains) => {
+                const keys = Object.keys(domains);
+
+                if (keys.length === 0) {
+                    return false;
+                }
+
+                return true;
+            },
+            {
+                message: "At least one domain must be defined"
+            }
+        ),
     server: z.object({
-        external_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_EXTERNALPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
-        internal_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_INTERNALPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
-        next_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("SERVER_NEXTPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
+        external_port: portSchema.optional().transform(stoi).pipe(portSchema),
+        internal_port: portSchema.optional().transform(stoi).pipe(portSchema),
+        next_port: portSchema.optional().transform(stoi).pipe(portSchema),
         internal_hostname: z.string().transform((url) => url.toLowerCase()),
         session_cookie_name: z.string(),
         resource_access_token_param: z.string(),
@@ -89,20 +89,13 @@ const configSchema = z.object({
     traefik: z.object({
         http_entrypoint: z.string(),
         https_entrypoint: z.string().optional(),
-        cert_resolver: z.string().optional(),
-        prefer_wildcard_cert: z.boolean().optional(),
         additional_middlewares: z.array(z.string()).optional()
     }),
     gerbil: z.object({
-        start_port: portSchema
-            .optional()
-            .transform(getEnvOrYaml("GERBIL_STARTPORT"))
-            .transform(stoi)
-            .pipe(portSchema),
+        start_port: portSchema.optional().transform(stoi).pipe(portSchema),
         base_endpoint: z
             .string()
             .optional()
-            .transform(getEnvOrYaml("GERBIL_BASEENDPOINT"))
             .pipe(z.string())
             .transform((url) => url.toLowerCase()),
         use_subdomain: z.boolean(),
@@ -135,6 +128,7 @@ const configSchema = z.object({
             smtp_user: z.string().optional(),
             smtp_pass: z.string().optional(),
             smtp_secure: z.boolean().optional(),
+            smtp_tls_reject_unauthorized: z.boolean().optional(),
             no_reply: z.string().email().optional()
         })
         .optional(),
@@ -159,7 +153,8 @@ const configSchema = z.object({
             disable_signup_without_invite: z.boolean().optional(),
             disable_user_create_org: z.boolean().optional(),
             allow_raw_resources: z.boolean().optional(),
-            allow_base_domain_resources: z.boolean().optional()
+            allow_base_domain_resources: z.boolean().optional(),
+            allow_local_sites: z.boolean().optional()
         })
         .optional()
 });
@@ -169,14 +164,8 @@ export class Config {
 
     constructor() {
         this.loadConfig();
-
-        if (process.env.GENERATE_TRAEFIK_CONFIG === "true") {
-            this.createTraefikConfig();
-        }
     }
 
-    public loadEnvironment() {}
-
     public loadConfig() {
         const loadConfig = (configPath: string) => {
             try {
@@ -199,45 +188,15 @@ export class Config {
         } else if (fs.existsSync(configFilePath2)) {
             environment = loadConfig(configFilePath2);
         }
-        if (!environment) {
-            const exampleConfigPath = path.join(
-                __DIRNAME,
-                "config.example.yml"
-            );
-            if (fs.existsSync(exampleConfigPath)) {
-                try {
-                    const exampleConfigContent = fs.readFileSync(
-                        exampleConfigPath,
-                        "utf8"
-                    );
-                    fs.writeFileSync(
-                        configFilePath1,
-                        exampleConfigContent,
-                        "utf8"
-                    );
-                    environment = loadConfig(configFilePath1);
-                } catch (error) {
-                    console.log(
-                        "See the docs for information about what to include in the configuration file: https://docs.fossorial.io/Pangolin/Configuration/config"
-                    );
-                    if (error instanceof Error) {
-                        throw new Error(
-                            `Error creating configuration file from example: ${
-                                error.message
-                            }`
-                        );
-                    }
-                    throw error;
-                }
-            } else {
-                throw new Error(
-                    "No configuration file found and no example configuration available"
-                );
-            }
+
+        if (process.env.APP_BASE_DOMAIN) {
+            console.log("You're using deprecated environment variables. Transition to the configuration file. https://docs.fossorial.io/");
         }
 
         if (!environment) {
-            throw new Error("No configuration file found");
+            throw new Error(
+                "No configuration file found. Please create one. https://docs.fossorial.io/"
+            );
         }
 
         const parsedConfig = configSchema.safeParse(environment);
@@ -290,80 +249,14 @@ export class Config {
         return this.rawConfig;
     }
 
-    public getBaseDomain(): string {
-        return this.rawConfig.app.base_domain;
-    }
-
     public getNoReplyEmail(): string | undefined {
         return (
             this.rawConfig.email?.no_reply || this.rawConfig.email?.smtp_user
         );
     }
 
-    private createTraefikConfig() {
-        try {
-            // check if traefik_config.yml and dynamic_config.yml exists in APP_PATH/traefik
-            const defaultTraefikConfigPath = path.join(
-                __DIRNAME,
-                "traefik_config.example.yml"
-            );
-            const defaultDynamicConfigPath = path.join(
-                __DIRNAME,
-                "dynamic_config.example.yml"
-            );
-
-            const traefikPath = path.join(APP_PATH, "traefik");
-            if (!fs.existsSync(traefikPath)) {
-                return;
-            }
-
-            // load default configs
-            let traefikConfig = fs.readFileSync(
-                defaultTraefikConfigPath,
-                "utf8"
-            );
-            let dynamicConfig = fs.readFileSync(
-                defaultDynamicConfigPath,
-                "utf8"
-            );
-
-            traefikConfig = traefikConfig
-                .split("{{.LetsEncryptEmail}}")
-                .join(this.rawConfig.users.server_admin.email);
-            traefikConfig = traefikConfig
-                .split("{{.INTERNAL_PORT}}")
-                .join(this.rawConfig.server.internal_port.toString());
-
-            dynamicConfig = dynamicConfig
-                .split("{{.DashboardDomain}}")
-                .join(new URL(this.rawConfig.app.dashboard_url).hostname);
-            dynamicConfig = dynamicConfig
-                .split("{{.NEXT_PORT}}")
-                .join(this.rawConfig.server.next_port.toString());
-            dynamicConfig = dynamicConfig
-                .split("{{.EXTERNAL_PORT}}")
-                .join(this.rawConfig.server.external_port.toString());
-
-            // write thiese to the traefik directory
-            const traefikConfigPath = path.join(
-                traefikPath,
-                "traefik_config.yml"
-            );
-            const dynamicConfigPath = path.join(
-                traefikPath,
-                "dynamic_config.yml"
-            );
-
-            fs.writeFileSync(traefikConfigPath, traefikConfig, "utf8");
-            fs.writeFileSync(dynamicConfigPath, dynamicConfig, "utf8");
-
-            console.log("Traefik configuration files created");
-        } catch (e) {
-            console.log(
-                "Failed to generate the Traefik configuration files. Please create them manually."
-            );
-            console.error(e);
-        }
+    public getDomain(domainId: string) {
+        return this.rawConfig.domains[domainId];
     }
 }
 

server/lib/consts.ts

@@ -2,7 +2,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 
 // This is a placeholder value replaced by the build process
-export const APP_VERSION = "1.0.0-beta.14";
+export const APP_VERSION = "1.0.0";
 
 export const __FILENAME = fileURLToPath(import.meta.url);
 export const __DIRNAME = path.dirname(__FILENAME);

server/lib/ip.test.ts

@@ -1,61 +1,5 @@
 import { cidrToRange, findNextAvailableCidr } from "./ip";
-
-/**
- * Compares two objects for deep equality
- * @param actual The actual value to test
- * @param expected The expected value to compare against
- * @param message The message to display if assertion fails
- * @throws Error if objects are not equal
- */
-export function assertEqualsObj<T>(actual: T, expected: T, message: string): void {
-    const actualStr = JSON.stringify(actual);
-    const expectedStr = JSON.stringify(expected);
-    if (actualStr !== expectedStr) {
-        throw new Error(`${message}\nExpected: ${expectedStr}\nActual: ${actualStr}`);
-    }
-}
-
-/**
- * Compares two primitive values for equality
- * @param actual The actual value to test
- * @param expected The expected value to compare against
- * @param message The message to display if assertion fails
- * @throws Error if values are not equal
- */
-export function assertEquals<T>(actual: T, expected: T, message: string): void {
-    if (actual !== expected) {
-        throw new Error(`${message}\nExpected: ${expected}\nActual: ${actual}`);
-    }
-}
-
-/**
- * Tests if a function throws an expected error
- * @param fn The function to test
- * @param expectedError The expected error message or part of it
- * @param message The message to display if assertion fails
- * @throws Error if function doesn't throw or throws unexpected error
- */
-export function assertThrows(
-    fn: () => void,
-    expectedError: string,
-    message: string
-): void {
-    try {
-        fn();
-        throw new Error(`${message}: Expected to throw "${expectedError}"`);
-    } catch (error) {
-        if (!(error instanceof Error)) {
-            throw new Error(`${message}\nUnexpected error type: ${typeof error}`);
-        }
-        
-        if (!error.message.includes(expectedError)) {
-            throw new Error(
-                `${message}\nExpected error: ${expectedError}\nActual error: ${error.message}`
-            );
-        }
-    }
-}
-
+import { assertEquals } from "@test/assert";
 
 // Test cases
 function testFindNextAvailableCidr() {

server/lib/validators.test.ts

@@ -0,0 +1,71 @@
+import { isValidUrlGlobPattern } from "./validators"; 
+import { assertEquals } from "@test/assert";
+
+function runTests() {
+    console.log('Running URL pattern validation tests...');
+    
+    // Test valid patterns
+    assertEquals(isValidUrlGlobPattern('simple'), true, 'Simple path segment should be valid');
+    assertEquals(isValidUrlGlobPattern('simple/path'), true, 'Simple path with slash should be valid');
+    assertEquals(isValidUrlGlobPattern('/leading/slash'), true, 'Path with leading slash should be valid');
+    assertEquals(isValidUrlGlobPattern('path/'), true, 'Path with trailing slash should be valid');
+    assertEquals(isValidUrlGlobPattern('path/*'), true, 'Path with wildcard segment should be valid');
+    assertEquals(isValidUrlGlobPattern('*'), true, 'Single wildcard should be valid');
+    assertEquals(isValidUrlGlobPattern('*/subpath'), true, 'Wildcard with subpath should be valid');
+    assertEquals(isValidUrlGlobPattern('path/*/more'), true, 'Path with wildcard in the middle should be valid');
+    
+    // Test with special characters
+    assertEquals(isValidUrlGlobPattern('path-with-dash'), true, 'Path with dash should be valid');
+    assertEquals(isValidUrlGlobPattern('path_with_underscore'), true, 'Path with underscore should be valid');
+    assertEquals(isValidUrlGlobPattern('path.with.dots'), true, 'Path with dots should be valid');
+    assertEquals(isValidUrlGlobPattern('path~with~tilde'), true, 'Path with tilde should be valid');
+    assertEquals(isValidUrlGlobPattern('path!with!exclamation'), true, 'Path with exclamation should be valid');
+    assertEquals(isValidUrlGlobPattern('path$with$dollar'), true, 'Path with dollar should be valid');
+    assertEquals(isValidUrlGlobPattern('path&with&ampersand'), true, 'Path with ampersand should be valid');
+    assertEquals(isValidUrlGlobPattern("path'with'quote"), true, "Path with quote should be valid");
+    assertEquals(isValidUrlGlobPattern('path(with)parentheses'), true, 'Path with parentheses should be valid');
+    assertEquals(isValidUrlGlobPattern('path+with+plus'), true, 'Path with plus should be valid');
+    assertEquals(isValidUrlGlobPattern('path,with,comma'), true, 'Path with comma should be valid');
+    assertEquals(isValidUrlGlobPattern('path;with;semicolon'), true, 'Path with semicolon should be valid');
+    assertEquals(isValidUrlGlobPattern('path=with=equals'), true, 'Path with equals should be valid');
+    assertEquals(isValidUrlGlobPattern('path:with:colon'), true, 'Path with colon should be valid');
+    assertEquals(isValidUrlGlobPattern('path@with@at'), true, 'Path with at should be valid');
+    
+    // Test with percent encoding
+    assertEquals(isValidUrlGlobPattern('path%20with%20spaces'), true, 'Path with percent-encoded spaces should be valid');
+    assertEquals(isValidUrlGlobPattern('path%2Fwith%2Fencoded%2Fslashes'), true, 'Path with percent-encoded slashes should be valid');
+    
+    // Test with wildcards in segments (the fixed functionality)
+    assertEquals(isValidUrlGlobPattern('padbootstrap*'), true, 'Path with wildcard at the end of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('pad*bootstrap'), true, 'Path with wildcard in the middle of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('*bootstrap'), true, 'Path with wildcard at the start of segment should be valid');
+    assertEquals(isValidUrlGlobPattern('multiple*wildcards*in*segment'), true, 'Path with multiple wildcards in segment should be valid');
+    assertEquals(isValidUrlGlobPattern('wild*/cards/in*/different/seg*ments'), true, 'Path with wildcards in different segments should be valid');
+    
+    // Test invalid patterns
+    assertEquals(isValidUrlGlobPattern(''), false, 'Empty string should be invalid');
+    assertEquals(isValidUrlGlobPattern('//double/slash'), false, 'Path with double slash should be invalid');
+    assertEquals(isValidUrlGlobPattern('path//end'), false, 'Path with double slash in the middle should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid<char>'), false, 'Path with invalid characters should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid|char'), false, 'Path with invalid pipe character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid"char'), false, 'Path with invalid quote character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid`char'), false, 'Path with invalid backtick character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid^char'), false, 'Path with invalid caret character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid\\char'), false, 'Path with invalid backslash character should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid[char]'), false, 'Path with invalid square brackets should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid{char}'), false, 'Path with invalid curly braces should be invalid');
+    
+    // Test invalid percent encoding
+    assertEquals(isValidUrlGlobPattern('invalid%2'), false, 'Path with incomplete percent encoding should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid%GZ'), false, 'Path with invalid hex in percent encoding should be invalid');
+    assertEquals(isValidUrlGlobPattern('invalid%'), false, 'Path with isolated percent sign should be invalid');
+    
+    console.log('All tests passed!');
+}
+
+// Run all tests
+try {
+    runTests();
+} catch (error) {
+    console.error('Test failed:', error);
+}

server/lib/validators.ts

@@ -29,11 +29,6 @@ export function isValidUrlGlobPattern(pattern: string): boolean {
             return false;
         }
 
-        // If segment contains *, it must be exactly *
-        if (segment.includes("*") && segment !== "*") {
-            return false;
-        }
-
         // Check each character in the segment
         for (let j = 0; j < segment.length; j++) {
             const char = segment[j];
@@ -56,7 +51,7 @@ export function isValidUrlGlobPattern(pattern: string): boolean {
             // - unreserved (A-Z a-z 0-9 - . _ ~)
             // - sub-delims (! $ & ' ( ) * + , ; =)
             // - @ : for compatibility with some systems
-            if (!/^[A-Za-z0-9\-._~!$&'()*+,;=@:]$/.test(char)) {
+            if (!/^[A-Za-z0-9\-._~!$&'()*+,;#=@:]$/.test(char)) {
                 return false;
             }
         }

server/routers/accessToken/listAccessTokens.ts

@@ -5,7 +5,8 @@ import {
     resources,
     userResources,
     roleResources,
-    resourceAccessToken
+    resourceAccessToken,
+    sites
 } from "@server/db/schema";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -59,7 +60,8 @@ function queryAccessTokens(
         title: resourceAccessToken.title,
         description: resourceAccessToken.description,
         createdAt: resourceAccessToken.createdAt,
-        resourceName: resources.name
+        resourceName: resources.name,
+        siteName: sites.name
     };
 
     if (orgId) {
@@ -70,6 +72,10 @@ function queryAccessTokens(
                 resources,
                 eq(resourceAccessToken.resourceId, resources.resourceId)
             )
+            .leftJoin(
+                sites,
+                eq(resources.resourceId, sites.siteId)
+            )
             .where(
                 and(
                     inArray(
@@ -91,6 +97,10 @@ function queryAccessTokens(
                 resources,
                 eq(resourceAccessToken.resourceId, resources.resourceId)
             )
+            .leftJoin(
+                sites,
+                eq(resources.resourceId, sites.siteId)
+            )
             .where(
                 and(
                     inArray(

server/routers/auth/login.ts

@@ -78,7 +78,7 @@ export async function login(
             }
             return next(
                 createHttpError(
-                    HttpCode.BAD_REQUEST,
+                    HttpCode.UNAUTHORIZED,
                     "Username or password is incorrect"
                 )
             );
@@ -98,7 +98,7 @@ export async function login(
             }
             return next(
                 createHttpError(
-                    HttpCode.BAD_REQUEST,
+                    HttpCode.UNAUTHORIZED,
                     "Username or password is incorrect"
                 )
             );
@@ -129,7 +129,7 @@ export async function login(
                 }
                 return next(
                     createHttpError(
-                        HttpCode.BAD_REQUEST,
+                        HttpCode.UNAUTHORIZED,
                         "The two-factor code you entered is incorrect"
                     )
                 );
@@ -137,9 +137,13 @@ export async function login(
         }
 
         const token = generateSessionToken();
-        await createSession(token, existingUser.userId);
+        const sess = await createSession(token, existingUser.userId);
         const isSecure = req.protocol === "https";
-        const cookie = serializeSessionCookie(token, isSecure);
+        const cookie = serializeSessionCookie(
+            token,
+            isSecure,
+            new Date(sess.expiresAt)
+        );
 
         res.appendHeader("Set-Cookie", cookie);
 

server/routers/auth/signup.ts

@@ -170,9 +170,13 @@ export async function signup(
         // });
 
         const token = generateSessionToken();
-        await createSession(token, userId);
+        const sess = await createSession(token, userId);
         const isSecure = req.protocol === "https";
-        const cookie = serializeSessionCookie(token, isSecure);
+        const cookie = serializeSessionCookie(
+            token,
+            isSecure,
+            new Date(sess.expiresAt)
+        );
         res.appendHeader("Set-Cookie", cookie);
 
         if (config.getRawConfig().flags?.require_email_verification) {

server/routers/badger/exchangeSession.ts

@@ -102,6 +102,8 @@ export async function exchangeSession(
 
         const token = generateSessionToken();
 
+        let expiresAt: number | null = null;
+
         if (requestSession.userSessionId) {
             const [res] = await db
                 .select()
@@ -118,6 +120,7 @@ export async function exchangeSession(
                     expiresAt: res.expiresAt,
                     sessionLength: SESSION_COOKIE_EXPIRES
                 });
+                expiresAt = res.expiresAt;
             }
         } else if (requestSession.accessTokenId) {
             const [res] = await db
@@ -140,8 +143,12 @@ export async function exchangeSession(
                     expiresAt: res.expiresAt,
                     sessionLength: res.sessionLength
                 });
+                expiresAt = res.expiresAt;
             }
         } else {
+            const expires = new Date(
+                    Date.now() + SESSION_COOKIE_EXPIRES
+                ).getTime();
             await createResourceSession({
                 token,
                 resourceId: resource.resourceId,
@@ -152,11 +159,10 @@ export async function exchangeSession(
                 whitelistId: requestSession.whitelistId,
                 accessTokenId: requestSession.accessTokenId,
                 doNotExtend: false,
-                expiresAt: new Date(
-                    Date.now() + SESSION_COOKIE_EXPIRES
-                ).getTime(),
+                expiresAt: expires,
                 sessionLength: RESOURCE_SESSION_COOKIE_EXPIRES
             });
+            expiresAt = expires;
         }
 
         const cookieName = `${config.getRawConfig().server.session_cookie_name}`;
@@ -164,7 +170,8 @@ export async function exchangeSession(
             cookieName,
             resource.fullDomain!,
             token,
-            !resource.ssl
+            !resource.ssl,
+            expiresAt ? new Date(expiresAt) : undefined
         );
 
         logger.debug(JSON.stringify("Exchange cookie: " + cookie));

server/routers/badger/verifySession.test.ts

@@ -0,0 +1,67 @@
+import { isPathAllowed } from './verifySession';
+import { assertEquals } from '@test/assert';
+
+function runTests() {
+    console.log('Running path matching tests...');
+    
+    // Test exact matching
+    assertEquals(isPathAllowed('foo', 'foo'), true, 'Exact match should be allowed');
+    assertEquals(isPathAllowed('foo', 'bar'), false, 'Different segments should not match');
+    assertEquals(isPathAllowed('foo/bar', 'foo/bar'), true, 'Exact multi-segment match should be allowed');
+    assertEquals(isPathAllowed('foo/bar', 'foo/baz'), false, 'Partial multi-segment match should not be allowed');
+    
+    // Test with leading and trailing slashes
+    assertEquals(isPathAllowed('/foo', 'foo'), true, 'Pattern with leading slash should match');
+    assertEquals(isPathAllowed('foo/', 'foo'), true, 'Pattern with trailing slash should match');
+    assertEquals(isPathAllowed('/foo/', 'foo'), true, 'Pattern with both leading and trailing slashes should match');
+    assertEquals(isPathAllowed('foo', '/foo/'), true, 'Path with leading and trailing slashes should match');
+    
+    // Test simple wildcard matching
+    assertEquals(isPathAllowed('*', 'foo'), true, 'Single wildcard should match any single segment');
+    assertEquals(isPathAllowed('*', 'foo/bar'), true, 'Single wildcard should match multiple segments');
+    assertEquals(isPathAllowed('*/bar', 'foo/bar'), true, 'Wildcard prefix should match');
+    assertEquals(isPathAllowed('foo/*', 'foo/bar'), true, 'Wildcard suffix should match');
+    assertEquals(isPathAllowed('foo/*/baz', 'foo/bar/baz'), true, 'Wildcard in middle should match');
+    
+    // Test multiple wildcards
+    assertEquals(isPathAllowed('*/*', 'foo/bar'), true, 'Multiple wildcards should match corresponding segments');
+    assertEquals(isPathAllowed('*/*/*', 'foo/bar/baz'), true, 'Three wildcards should match three segments');
+    assertEquals(isPathAllowed('foo/*/*', 'foo/bar/baz'), true, 'Specific prefix with wildcards should match');
+    assertEquals(isPathAllowed('*/*/baz', 'foo/bar/baz'), true, 'Wildcards with specific suffix should match');
+    
+    // Test wildcard consumption behavior
+    assertEquals(isPathAllowed('*', ''), true, 'Wildcard should optionally consume segments');
+    assertEquals(isPathAllowed('foo/*', 'foo'), true, 'Trailing wildcard should be optional');
+    assertEquals(isPathAllowed('*/*', 'foo'), true, 'Multiple wildcards can match fewer segments');
+    assertEquals(isPathAllowed('*/*/*', 'foo/bar'), true, 'Extra wildcards can be skipped');
+    
+    // Test complex nested paths
+    assertEquals(isPathAllowed('api/*/users', 'api/v1/users'), true, 'API versioning pattern should match');
+    assertEquals(isPathAllowed('api/*/users/*', 'api/v1/users/123'), true, 'API resource pattern should match');
+    assertEquals(isPathAllowed('api/*/users/*/profile', 'api/v1/users/123/profile'), true, 'Nested API pattern should match');
+    
+    // Test for the requested padbootstrap* pattern
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap'), true, 'padbootstrap* should match padbootstrap');
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrapv1'), true, 'padbootstrap* should match padbootstrapv1');
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap/files'), false, 'padbootstrap* should not match padbootstrap/files');
+    assertEquals(isPathAllowed('padbootstrap*/*', 'padbootstrap/files'), true, 'padbootstrap*/* should match padbootstrap/files');
+    assertEquals(isPathAllowed('padbootstrap*/files', 'padbootstrapv1/files'), true, 'padbootstrap*/files should not match padbootstrapv1/files (wildcard is segment-based, not partial)');
+    
+    // Test wildcard edge cases
+    assertEquals(isPathAllowed('*/*/*/*/*/*', 'a/b'), true, 'Many wildcards can match few segments');
+    assertEquals(isPathAllowed('a/*/b/*/c', 'a/anything/b/something/c'), true, 'Multiple wildcards in pattern should match corresponding segments');
+    
+    // Test patterns with partial segment matches
+    assertEquals(isPathAllowed('padbootstrap*', 'padbootstrap-123'), true, 'Wildcards in isPathAllowed should be segment-based, not character-based');
+    assertEquals(isPathAllowed('test*', 'testuser'), true, 'Asterisk as part of segment name is treated as a literal, not a wildcard');
+    assertEquals(isPathAllowed('my*app', 'myapp'), true, 'Asterisk in middle of segment name is treated as a literal, not a wildcard');
+
+    console.log('All tests passed!');
+}
+
+// Run all tests
+try {
+    runTests();
+} catch (error) {
+    console.error('Test failed:', error);
+}

server/routers/badger/verifySession.ts

@@ -90,7 +90,15 @@ export async function verifyResourceSession(
 
         const clientIp = requestIp?.split(":")[0];
 
-        const resourceCacheKey = `resource:${host}`;
+        let cleanHost = host;
+        // if the host ends with :443 or :80 remove it
+        if (cleanHost.endsWith(":443")) {
+            cleanHost = cleanHost.slice(0, -4);
+        } else if (cleanHost.endsWith(":80")) {
+            cleanHost = cleanHost.slice(0, -3);
+        }
+
+        const resourceCacheKey = `resource:${cleanHost}`;
         let resourceData:
             | {
                   resource: Resource | null;
@@ -111,11 +119,11 @@ export async function verifyResourceSession(
                     resourcePassword,
                     eq(resourcePassword.resourceId, resources.resourceId)
                 )
-                .where(eq(resources.fullDomain, host))
+                .where(eq(resources.fullDomain, cleanHost))
                 .limit(1);
 
             if (!result) {
-                logger.debug("Resource not found", host);
+                logger.debug("Resource not found", cleanHost);
                 return notAllowed(res);
             }
 
@@ -131,7 +139,7 @@ export async function verifyResourceSession(
         const { resource, pincode, password } = resourceData;
 
         if (!resource) {
-            logger.debug("Resource not found", host);
+            logger.debug("Resource not found", cleanHost);
             return notAllowed(res);
         }
 
@@ -142,16 +150,6 @@ export async function verifyResourceSession(
             return notAllowed(res);
         }
 
-        if (
-            !resource.sso &&
-            !pincode &&
-            !password &&
-            !resource.emailWhitelistEnabled
-        ) {
-            logger.debug("Resource allowed because no auth");
-            return allowed(res);
-        }
-
         // check the rules
         if (resource.applyRules) {
             const action = await checkRules(
@@ -171,6 +169,16 @@ export async function verifyResourceSession(
             // otherwise its undefined and we pass
         }
 
+        if (
+            !resource.sso &&
+            !pincode &&
+            !password &&
+            !resource.emailWhitelistEnabled
+        ) {
+            logger.debug("Resource allowed because no auth");
+            return allowed(res);
+        }
+
         const redirectUrl = `${config.getRawConfig().app.dashboard_url}/auth/resource/${encodeURIComponent(
             resource.resourceId
         )}?redirect=${encodeURIComponent(originalRequestURL)}`;
@@ -376,7 +384,7 @@ async function createAccessTokenSession(
     tokenItem: ResourceAccessToken
 ) {
     const token = generateSessionToken();
-    await createResourceSession({
+    const sess = await createResourceSession({
         resourceId: resource.resourceId,
         token,
         accessTokenId: tokenItem.accessTokenId,
@@ -389,7 +397,8 @@ async function createAccessTokenSession(
         cookieName,
         resource.fullDomain!,
         token,
-        !resource.ssl
+        !resource.ssl,
+        new Date(sess.expiresAt)
     );
     res.appendHeader("Set-Cookie", cookie);
     logger.debug("Access token is valid, creating new session");
@@ -525,7 +534,7 @@ async function checkRules(
     return;
 }
 
-function isPathAllowed(pattern: string, path: string): boolean {
+export function isPathAllowed(pattern: string, path: string): boolean {
     logger.debug(`\nMatching path "${path}" against pattern "${pattern}"`);
 
     // Normalize and split paths into segments
@@ -566,7 +575,7 @@ function isPathAllowed(pattern: string, path: string): boolean {
             return result;
         }
 
-        // For wildcards, try consuming different numbers of path segments
+        // For full segment wildcards, try consuming different numbers of path segments
         if (currentPatternPart === "*") {
             logger.debug(
                 `${indent}Found wildcard at pattern index ${patternIndex}`
@@ -598,6 +607,32 @@ function isPathAllowed(pattern: string, path: string): boolean {
             return false;
         }
 
+        // Check for in-segment wildcard (e.g., "prefix*" or "prefix*suffix")
+        if (currentPatternPart.includes("*")) {
+            logger.debug(
+                `${indent}Found in-segment wildcard in "${currentPatternPart}"`
+            );
+            
+            // Convert the pattern segment to a regex pattern
+            const regexPattern = currentPatternPart
+                .replace(/\*/g, ".*") // Replace * with .* for regex wildcard
+                .replace(/\?/g, "."); // Replace ? with . for single character wildcard if needed
+            
+            const regex = new RegExp(`^${regexPattern}$`);
+            
+            if (regex.test(currentPathPart)) {
+                logger.debug(
+                    `${indent}Segment with wildcard matches: "${currentPatternPart}" matches "${currentPathPart}"`
+                );
+                return matchSegments(patternIndex + 1, pathIndex + 1);
+            }
+            
+            logger.debug(
+                `${indent}Segment with wildcard mismatch: "${currentPatternPart}" doesn't match "${currentPathPart}"`
+            );
+            return false;
+        }
+
         // For regular segments, they must match exactly
         if (currentPatternPart !== currentPathPart) {
             logger.debug(
@@ -616,4 +651,4 @@ function isPathAllowed(pattern: string, path: string): boolean {
     const result = matchSegments(0, 0);
     logger.debug(`Final result: ${result}`);
     return result;
-}
+}

server/routers/domain/index.ts

@@ -0,0 +1 @@
+export * from "./listDomains";

server/routers/domain/listDomains.ts

@@ -0,0 +1,109 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { domains, orgDomains, users } from "@server/db/schema";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { eq, sql } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const listDomainsParamsSchema = z
+    .object({
+        orgId: z.string()
+    })
+    .strict();
+
+const listDomainsSchema = z
+    .object({
+        limit: z
+            .string()
+            .optional()
+            .default("1000")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative()),
+        offset: z
+            .string()
+            .optional()
+            .default("0")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative())
+    })
+    .strict();
+
+async function queryDomains(orgId: string, limit: number, offset: number) {
+    const res = await db
+        .select({
+            domainId: domains.domainId,
+            baseDomain: domains.baseDomain
+        })
+        .from(orgDomains)
+        .where(eq(orgDomains.orgId, orgId))
+        .innerJoin(domains, eq(domains.domainId, orgDomains.domainId))
+        .limit(limit)
+        .offset(offset);
+    return res;
+}
+
+export type ListDomainsResponse = {
+    domains: NonNullable<Awaited<ReturnType<typeof queryDomains>>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+export async function listDomains(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listDomainsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const parsedParams = listDomainsParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        const domains = await queryDomains(orgId.toString(), limit, offset);
+
+        const [{ count }] = await db
+            .select({ count: sql<number>`count(*)` })
+            .from(users);
+
+        return response<ListDomainsResponse>(res, {
+            data: {
+                domains,
+                pagination: {
+                    total: count,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Users retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/external.ts

@@ -3,6 +3,7 @@ import config from "@server/lib/config";
 import * as site from "./site";
 import * as org from "./org";
 import * as resource from "./resource";
+import * as domain from "./domain";
 import * as target from "./target";
 import * as user from "./user";
 import * as auth from "./auth";
@@ -165,6 +166,13 @@ authenticated.get(
     resource.listResources
 );
 
+authenticated.get(
+    "/org/:orgId/domains",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listOrgDomains),
+    domain.listDomains
+);
+
 authenticated.post(
     "/org/:orgId/create-invite",
     verifyOrgAccess,

server/routers/newt/handleNewtRegisterMessage.ts

@@ -8,7 +8,7 @@ import {
     Target,
     targets
 } from "@server/db/schema";
-import { eq, and, sql } from "drizzle-orm";
+import { eq, and, sql, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../gerbil/peers";
 import logger from "@server/logger";
 
@@ -77,68 +77,84 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
         allowedIps: [site.subnet]
     });
 
-    const allResources = await db
-        .select({
-            // Resource fields
-            resourceId: resources.resourceId,
-            subdomain: resources.subdomain,
-            fullDomain: resources.fullDomain,
-            ssl: resources.ssl,
-            blockAccess: resources.blockAccess,
-            sso: resources.sso,
-            emailWhitelistEnabled: resources.emailWhitelistEnabled,
-            http: resources.http,
-            proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
-            // Targets as a subquery
-            targets: sql<string>`json_group_array(json_object(
-          'targetId', ${targets.targetId},
-          'ip', ${targets.ip},
-          'method', ${targets.method},
-          'port', ${targets.port},
-          'internalPort', ${targets.internalPort},
-          'enabled', ${targets.enabled}
-        ))`.as("targets")
-        })
-        .from(resources)
-        .leftJoin(
-            targets,
-            and(
-                eq(targets.resourceId, resources.resourceId),
-                eq(targets.enabled, true)
+    // Improved version
+    const allResources = await db.transaction(async (tx) => {
+        // First get all resources for the site
+        const resourcesList = await tx
+            .select({
+                resourceId: resources.resourceId,
+                subdomain: resources.subdomain,
+                fullDomain: resources.fullDomain,
+                ssl: resources.ssl,
+                blockAccess: resources.blockAccess,
+                sso: resources.sso,
+                emailWhitelistEnabled: resources.emailWhitelistEnabled,
+                http: resources.http,
+                proxyPort: resources.proxyPort,
+                protocol: resources.protocol
+            })
+            .from(resources)
+            .where(eq(resources.siteId, siteId));
+
+        // Get all enabled targets for these resources in a single query
+        const resourceIds = resourcesList.map((r) => r.resourceId);
+        const allTargets =
+            resourceIds.length > 0
+                ? await tx
+                      .select({
+                          resourceId: targets.resourceId,
+                          targetId: targets.targetId,
+                          ip: targets.ip,
+                          method: targets.method,
+                          port: targets.port,
+                          internalPort: targets.internalPort,
+                          enabled: targets.enabled
+                      })
+                      .from(targets)
+                      .where(
+                          and(
+                              inArray(targets.resourceId, resourceIds),
+                              eq(targets.enabled, true)
+                          )
+                      )
+                : [];
+
+        // Combine the data in JS instead of using SQL for the JSON
+        return resourcesList.map((resource) => ({
+            ...resource,
+            targets: allTargets.filter(
+                (target) => target.resourceId === resource.resourceId
             )
-        )
-        .where(eq(resources.siteId, siteId))
-        .groupBy(resources.resourceId);
+        }));
+    });
 
-    let tcpTargets: string[] = [];
-    let udpTargets: string[] = [];
+    const { tcpTargets, udpTargets } = allResources.reduce(
+        (acc, resource) => {
+            // Skip resources with no targets
+            if (!resource.targets?.length) return acc;
 
-    for (const resource of allResources) {
-        const targets = JSON.parse(resource.targets);
-        if (!targets || targets.length === 0) {
-            continue;
-        }
-        if (resource.protocol === "tcp") {
-            tcpTargets = tcpTargets.concat(
-                targets.map(
+            // Format valid targets into strings
+            const formattedTargets = resource.targets
+                .filter(
                     (target: Target) =>
-                        `${
-                            target.internalPort ? target.internalPort + ":" : ""
-                        }${target.ip}:${target.port}`
+                        target?.internalPort && target?.ip && target?.port
                 )
-            );
-        } else {
-            udpTargets = tcpTargets.concat(
-                targets.map(
+                .map(
                     (target: Target) =>
-                        `${
-                            target.internalPort ? target.internalPort + ":" : ""
-                        }${target.ip}:${target.port}`
-                )
-            );
-        }
-    }
+                        `${target.internalPort}:${target.ip}:${target.port}`
+                );
+
+            // Add to the appropriate protocol array
+            if (resource.protocol === "tcp") {
+                acc.tcpTargets.push(...formattedTargets);
+            } else {
+                acc.udpTargets.push(...formattedTargets);
+            }
+
+            return acc;
+        },
+        { tcpTargets: [] as string[], udpTargets: [] as string[] }
+    );
 
     return {
         message: {

server/routers/org/createOrg.ts

@@ -2,7 +2,15 @@ import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
 import { eq } from "drizzle-orm";
-import { Org, orgs, roleActions, roles, userOrgs } from "@server/db/schema";
+import {
+    domains,
+    Org,
+    orgDomains,
+    orgs,
+    roleActions,
+    roles,
+    userOrgs
+} from "@server/db/schema";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -16,7 +24,6 @@ const createOrgSchema = z
     .object({
         orgId: z.string(),
         name: z.string().min(1).max(255)
-        // domain: z.string().min(1).max(255).optional(),
     })
     .strict();
 
@@ -82,14 +89,16 @@ export async function createOrg(
         let org: Org | null = null;
 
         await db.transaction(async (trx) => {
-            const domain = config.getBaseDomain();
+            const allDomains = await trx
+                .select()
+                .from(domains)
+                .where(eq(domains.configManaged, true));
 
             const newOrg = await trx
                 .insert(orgs)
                 .values({
                     orgId,
-                    name,
-                    domain
+                    name
                 })
                 .returning();
 
@@ -109,6 +118,13 @@ export async function createOrg(
                 return;
             }
 
+            await trx.insert(orgDomains).values(
+                allDomains.map((domain) => ({
+                    orgId: newOrg[0].orgId,
+                    domainId: domain.domainId
+                }))
+            );
+
             await trx.insert(userOrgs).values({
                 userId: req.user!.userId,
                 orgId: newOrg[0].orgId,

server/routers/resource/createResource.ts

@@ -1,8 +1,9 @@
-import { SqliteError } from "better-sqlite3";
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
 import {
+    domains,
+    orgDomains,
     orgs,
     Resource,
     resources,
@@ -27,69 +28,29 @@ const createResourceParamsSchema = z
     })
     .strict();
 
-const createResourceSchema = z
+const createHttpResourceSchema = z
     .object({
-        subdomain: z.string().optional(),
         name: z.string().min(1).max(255),
+        subdomain: z
+            .string()
+            .optional()
+            .transform((val) => val?.toLowerCase()),
+        isBaseDomain: z.boolean().optional(),
         siteId: z.number(),
         http: z.boolean(),
         protocol: z.string(),
-        proxyPort: z.number().optional(),
-        isBaseDomain: z.boolean().optional()
+        domainId: z.string()
     })
+    .strict()
     .refine(
         (data) => {
-            if (!data.http) {
-                return z
-                    .number()
-                    .int()
-                    .min(1)
-                    .max(65535)
-                    .safeParse(data.proxyPort).success;
-            }
-            return true;
-        },
-        {
-            message: "Invalid port number",
-            path: ["proxyPort"]
-        }
-    )
-    .refine(
-        (data) => {
-            if (data.http && !data.isBaseDomain) {
+            if (data.subdomain) {
                 return subdomainSchema.safeParse(data.subdomain).success;
             }
             return true;
         },
-        {
-            message: "Invalid subdomain",
-            path: ["subdomain"]
-        }
+        { message: "Invalid subdomain" }
     )
-    .refine(
-        (data) => {
-            if (!config.getRawConfig().flags?.allow_raw_resources) {
-                if (data.proxyPort !== undefined) {
-                    return false;
-                }
-            }
-            return true;
-        },
-        {
-            message: "Proxy port cannot be set"
-        }
-    )
-    // .refine(
-    //     (data) => {
-    //         if (data.proxyPort === 443 || data.proxyPort === 80) {
-    //             return false;
-    //         }
-    //         return true;
-    //     },
-    //     {
-    //         message: "Port 80 and 443 are reserved for http and https resources"
-    //     }
-    // )
     .refine(
         (data) => {
             if (!config.getRawConfig().flags?.allow_base_domain_resources) {
@@ -104,6 +65,29 @@ const createResourceSchema = z
         }
     );
 
+const createRawResourceSchema = z
+    .object({
+        name: z.string().min(1).max(255),
+        siteId: z.number(),
+        http: z.boolean(),
+        protocol: z.string(),
+        proxyPort: z.number().int().min(1).max(65535)
+    })
+    .strict()
+    .refine(
+        (data) => {
+            if (!config.getRawConfig().flags?.allow_raw_resources) {
+                if (data.proxyPort !== undefined) {
+                    return false;
+                }
+            }
+            return true;
+        },
+        {
+            message: "Proxy port cannot be set"
+        }
+    );
+
 export type CreateResourceResponse = Resource;
 
 export async function createResource(
@@ -112,18 +96,6 @@ export async function createResource(
     next: NextFunction
 ): Promise<any> {
     try {
-        const parsedBody = createResourceSchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        let { name, subdomain, protocol, proxyPort, http, isBaseDomain } = parsedBody.data;
-
         // Validate request params
         const parsedParams = createResourceParamsSchema.safeParse(req.params);
         if (!parsedParams.success) {
@@ -159,99 +131,25 @@ export async function createResource(
             );
         }
 
-        let fullDomain = "";
-        if (isBaseDomain) {
-            fullDomain = org[0].domain;
-        } else {
-            fullDomain = `${subdomain}.${org[0].domain}`;
+        if (typeof req.body.http !== "boolean") {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "http field is required")
+            );
         }
 
-        // if http is false check to see if there is already a resource with the same port and protocol
-        if (!http) {
-            const existingResource = await db
-                .select()
-                .from(resources)
-                .where(
-                    and(
-                        eq(resources.protocol, protocol),
-                        eq(resources.proxyPort, proxyPort!)
-                    )
-                );
+        const { http } = req.body;
 
-            if (existingResource.length > 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        "Resource with that protocol and port already exists"
-                    )
-                );
-            }
+        if (http) {
+            return await createHttpResource(
+                { req, res, next },
+                { siteId, orgId }
+            );
         } else {
-            // make sure the full domain is unique
-            const existingResource = await db
-                .select()
-                .from(resources)
-                .where(eq(resources.fullDomain, fullDomain));
-
-            if (existingResource.length > 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        "Resource with that domain already exists"
-                    )
-                );
-            }
+            return await createRawResource(
+                { req, res, next },
+                { siteId, orgId }
+            );
         }
-
-        await db.transaction(async (trx) => {
-            const newResource = await trx
-                .insert(resources)
-                .values({
-                    siteId,
-                    fullDomain: http ? fullDomain : null,
-                    orgId,
-                    name,
-                    subdomain,
-                    http,
-                    protocol,
-                    proxyPort,
-                    ssl: true,
-                    isBaseDomain
-                })
-                .returning();
-
-            const adminRole = await db
-                .select()
-                .from(roles)
-                .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-                .limit(1);
-
-            if (adminRole.length === 0) {
-                return next(
-                    createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
-                );
-            }
-
-            await trx.insert(roleResources).values({
-                roleId: adminRole[0].roleId,
-                resourceId: newResource[0].resourceId
-            });
-
-            if (req.userOrgRoleId != adminRole[0].roleId) {
-                // make sure the user can access the resource
-                await trx.insert(userResources).values({
-                    userId: req.user?.userId!,
-                    resourceId: newResource[0].resourceId
-                });
-            }
-            response<CreateResourceResponse>(res, {
-                data: newResource[0],
-                success: true,
-                error: false,
-                message: "Resource created successfully",
-                status: HttpCode.CREATED
-            });
-        });
     } catch (error) {
         logger.error(error);
         return next(
@@ -259,3 +157,245 @@ export async function createResource(
         );
     }
 }
+
+async function createHttpResource(
+    route: {
+        req: Request;
+        res: Response;
+        next: NextFunction;
+    },
+    meta: {
+        siteId: number;
+        orgId: string;
+    }
+) {
+    const { req, res, next } = route;
+    const { siteId, orgId } = meta;
+
+    const parsedBody = createHttpResourceSchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const { name, subdomain, isBaseDomain, http, protocol, domainId } =
+        parsedBody.data;
+
+    const [orgDomain] = await db
+        .select()
+        .from(orgDomains)
+        .where(
+            and(eq(orgDomains.orgId, orgId), eq(orgDomains.domainId, domainId))
+        )
+        .leftJoin(domains, eq(orgDomains.domainId, domains.domainId));
+
+    if (!orgDomain || !orgDomain.domains) {
+        return next(
+            createHttpError(
+                HttpCode.NOT_FOUND,
+                `Domain with ID ${parsedBody.data.domainId} not found`
+            )
+        );
+    }
+
+    const domain = orgDomain.domains;
+
+    let fullDomain = "";
+    if (isBaseDomain) {
+        fullDomain = domain.baseDomain;
+    } else {
+        fullDomain = `${subdomain}.${domain.baseDomain}`;
+    }
+
+    logger.debug(`Full domain: ${fullDomain}`);
+
+    // make sure the full domain is unique
+    const existingResource = await db
+        .select()
+        .from(resources)
+        .where(eq(resources.fullDomain, fullDomain));
+
+    if (existingResource.length > 0) {
+        return next(
+            createHttpError(
+                HttpCode.CONFLICT,
+                "Resource with that domain already exists"
+            )
+        );
+    }
+
+    let resource: Resource | undefined;
+
+    await db.transaction(async (trx) => {
+        const newResource = await trx
+            .insert(resources)
+            .values({
+                siteId,
+                fullDomain,
+                domainId,
+                orgId,
+                name,
+                subdomain,
+                http,
+                protocol,
+                ssl: true,
+                isBaseDomain
+            })
+            .returning();
+
+        const adminRole = await db
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (adminRole.length === 0) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
+            );
+        }
+
+        await trx.insert(roleResources).values({
+            roleId: adminRole[0].roleId,
+            resourceId: newResource[0].resourceId
+        });
+
+        if (req.userOrgRoleId != adminRole[0].roleId) {
+            // make sure the user can access the resource
+            await trx.insert(userResources).values({
+                userId: req.user?.userId!,
+                resourceId: newResource[0].resourceId
+            });
+        }
+
+        resource = newResource[0];
+    });
+
+    if (!resource) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to create resource"
+            )
+        );
+    }
+
+    return response<CreateResourceResponse>(res, {
+        data: resource,
+        success: true,
+        error: false,
+        message: "Http resource created successfully",
+        status: HttpCode.CREATED
+    });
+}
+
+async function createRawResource(
+    route: {
+        req: Request;
+        res: Response;
+        next: NextFunction;
+    },
+    meta: {
+        siteId: number;
+        orgId: string;
+    }
+) {
+    const { req, res, next } = route;
+    const { siteId, orgId } = meta;
+
+    const parsedBody = createRawResourceSchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const { name, http, protocol, proxyPort } = parsedBody.data;
+
+    // if http is false check to see if there is already a resource with the same port and protocol
+    const existingResource = await db
+        .select()
+        .from(resources)
+        .where(
+            and(
+                eq(resources.protocol, protocol),
+                eq(resources.proxyPort, proxyPort!)
+            )
+        );
+
+    if (existingResource.length > 0) {
+        return next(
+            createHttpError(
+                HttpCode.CONFLICT,
+                "Resource with that protocol and port already exists"
+            )
+        );
+    }
+
+    let resource: Resource | undefined;
+
+    await db.transaction(async (trx) => {
+        const newResource = await trx
+            .insert(resources)
+            .values({
+                siteId,
+                orgId,
+                name,
+                http,
+                protocol,
+                proxyPort
+            })
+            .returning();
+
+        const adminRole = await db
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (adminRole.length === 0) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
+            );
+        }
+
+        await trx.insert(roleResources).values({
+            roleId: adminRole[0].roleId,
+            resourceId: newResource[0].resourceId
+        });
+
+        if (req.userOrgRoleId != adminRole[0].roleId) {
+            // make sure the user can access the resource
+            await trx.insert(userResources).values({
+                userId: req.user?.userId!,
+                resourceId: newResource[0].resourceId
+            });
+        }
+
+        resource = newResource[0];
+    });
+
+    if (!resource) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to create resource"
+            )
+        );
+    }
+
+    return response<CreateResourceResponse>(res, {
+        data: resource,
+        success: true,
+        error: false,
+        message: "Non-http resource created successfully",
+        status: HttpCode.CREATED
+    });
+}

server/routers/resource/getResource.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { Resource, resources } from "@server/db/schema";
+import { Resource, resources, sites } from "@server/db/schema";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -18,7 +18,9 @@ const getResourceSchema = z
     })
     .strict();
 
-export type GetResourceResponse = Resource;
+export type GetResourceResponse = Resource & {
+    siteName: string;
+};
 
 export async function getResource(
     req: Request,
@@ -38,13 +40,17 @@ export async function getResource(
 
         const { resourceId } = parsedParams.data;
 
-        const resource = await db
+        const [resp] = await db
             .select()
             .from(resources)
             .where(eq(resources.resourceId, resourceId))
+            .leftJoin(sites, eq(sites.siteId, resources.siteId))
             .limit(1);
 
-        if (resource.length === 0) {
+        const resource = resp.resources;
+        const site = resp.sites;
+
+        if (!resource) {
             return next(
                 createHttpError(
                     HttpCode.NOT_FOUND,
@@ -54,7 +60,10 @@ export async function getResource(
         }
 
         return response(res, {
-            data: resource[0],
+            data: {
+                ...resource,
+                siteName: site?.name
+            },
             success: true,
             error: false,
             message: "Resource retrieved successfully",

server/routers/resource/updateResource.ts

@@ -1,8 +1,15 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { orgs, resources, sites } from "@server/db/schema";
-import { eq, or, and } from "drizzle-orm";
+import {
+    domains,
+    Org,
+    orgDomains,
+    orgs,
+    Resource,
+    resources
+} from "@server/db/schema";
+import { eq, and } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -20,17 +27,53 @@ const updateResourceParamsSchema = z
     })
     .strict();
 
-const updateResourceBodySchema = z
+const updateHttpResourceBodySchema = z
     .object({
         name: z.string().min(1).max(255).optional(),
-        subdomain: subdomainSchema.optional(),
+        subdomain: subdomainSchema
+            .optional()
+            .transform((val) => val?.toLowerCase()),
         ssl: z.boolean().optional(),
         sso: z.boolean().optional(),
         blockAccess: z.boolean().optional(),
-        proxyPort: z.number().int().min(1).max(65535).optional(),
         emailWhitelistEnabled: z.boolean().optional(),
         isBaseDomain: z.boolean().optional(),
         applyRules: z.boolean().optional(),
+        domainId: z.string().optional()
+    })
+    .strict()
+    .refine((data) => Object.keys(data).length > 0, {
+        message: "At least one field must be provided for update"
+    })
+    .refine(
+        (data) => {
+            if (data.subdomain) {
+                return subdomainSchema.safeParse(data.subdomain).success;
+            }
+            return true;
+        },
+        { message: "Invalid subdomain" }
+    )
+    .refine(
+        (data) => {
+            if (!config.getRawConfig().flags?.allow_base_domain_resources) {
+                if (data.isBaseDomain) {
+                    return false;
+                }
+            }
+            return true;
+        },
+        {
+            message: "Base domain resources are not allowed"
+        }
+    );
+
+export type UpdateResourceResponse = Resource;
+
+const updateRawResourceBodySchema = z
+    .object({
+        name: z.string().min(1).max(255).optional(),
+        proxyPort: z.number().int().min(1).max(65535).optional()
     })
     .strict()
     .refine((data) => Object.keys(data).length > 0, {
@@ -46,30 +89,6 @@ const updateResourceBodySchema = z
             return true;
         },
         { message: "Cannot update proxyPort" }
-    )
-    // .refine(
-    //     (data) => {
-    //         if (data.proxyPort === 443 || data.proxyPort === 80) {
-    //             return false;
-    //         }
-    //         return true;
-    //     },
-    //     {
-    //         message: "Port 80 and 443 are reserved for http and https resources"
-    //     }
-    // )
-    .refine(
-        (data) => {
-            if (!config.getRawConfig().flags?.allow_base_domain_resources) {
-                if (data.isBaseDomain) {
-                    return false;
-                }
-            }
-            return true;
-        },
-        {
-            message: "Base domain resources are not allowed"
-        }
     );
 
 export async function updateResource(
@@ -88,18 +107,7 @@ export async function updateResource(
             );
         }
 
-        const parsedBody = updateResourceBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
         const { resourceId } = parsedParams.data;
-        const updateData = parsedBody.data;
 
         const [result] = await db
             .select()
@@ -119,117 +127,33 @@ export async function updateResource(
             );
         }
 
-        if (updateData.subdomain) {
-            if (!resource.http) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Cannot update subdomain for non-http resource"
-                    )
-                );
-            }
-
-            const valid = subdomainSchema.safeParse(
-                updateData.subdomain
-            ).success;
-            if (!valid) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid subdomain provided"
-                    )
-                );
-            }
-        }
-
-        if (updateData.proxyPort) {
-            const proxyPort = updateData.proxyPort;
-            const existingResource = await db
-                .select()
-                .from(resources)
-                .where(
-                    and(
-                        eq(resources.protocol, resource.protocol),
-                        eq(resources.proxyPort, proxyPort!)
-                    )
-                );
-
-            if (
-                existingResource.length > 0 &&
-                existingResource[0].resourceId !== resourceId
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        "Resource with that protocol and port already exists"
-                    )
-                );
-            }
-        }
-
-        if (!org?.domain) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Resource does not have a domain"
-                )
+        if (resource.http) {
+            // HANDLE UPDATING HTTP RESOURCES
+            return await updateHttpResource(
+                {
+                    req,
+                    res,
+                    next
+                },
+                {
+                    resource,
+                    org
+                }
+            );
+        } else {
+            // HANDLE UPDATING RAW TCP/UDP RESOURCES
+            return await updateRawResource(
+                {
+                    req,
+                    res,
+                    next
+                },
+                {
+                    resource,
+                    org
+                }
             );
         }
-
-        let fullDomain: string | undefined;
-        if (updateData.isBaseDomain) {
-            fullDomain = org.domain;
-        } else if (updateData.subdomain) {
-            fullDomain = `${updateData.subdomain}.${org.domain}`;
-        }
-
-        const updatePayload = {
-            ...updateData,
-            ...(fullDomain && { fullDomain })
-        };
-
-        if (
-            fullDomain &&
-            (updatePayload.subdomain !== undefined ||
-                updatePayload.isBaseDomain !== undefined)
-        ) {
-            const [existingDomain] = await db
-                .select()
-                .from(resources)
-                .where(eq(resources.fullDomain, fullDomain));
-
-            if (existingDomain && existingDomain.resourceId !== resourceId) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        "Resource with that domain already exists"
-                    )
-                );
-            }
-        }
-
-        const updatedResource = await db
-            .update(resources)
-            .set(updatePayload)
-            .where(eq(resources.resourceId, resourceId))
-            .returning();
-
-        if (updatedResource.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource with ID ${resourceId} not found`
-                )
-            );
-        }
-
-        return response(res, {
-            data: updatedResource[0],
-            success: true,
-            error: false,
-            message: "Resource updated successfully",
-            status: HttpCode.OK
-        });
     } catch (error) {
         logger.error(error);
         return next(
@@ -237,3 +161,191 @@ export async function updateResource(
         );
     }
 }
+
+async function updateHttpResource(
+    route: {
+        req: Request;
+        res: Response;
+        next: NextFunction;
+    },
+    meta: {
+        resource: Resource;
+        org: Org;
+    }
+) {
+    const { next, req, res } = route;
+    const { resource, org } = meta;
+
+    const parsedBody = updateHttpResourceBodySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const updateData = parsedBody.data;
+
+    if (updateData.domainId) {
+        const [existingDomain] = await db
+            .select()
+            .from(orgDomains)
+            .where(
+                and(
+                    eq(orgDomains.orgId, org.orgId),
+                    eq(orgDomains.domainId, updateData.domainId)
+                )
+            )
+            .leftJoin(domains, eq(orgDomains.domainId, domains.domainId));
+
+        if (!existingDomain) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, `Domain not found`)
+            );
+        }
+    }
+
+    const domainId = updateData.domainId || resource.domainId!;
+    const subdomain = updateData.subdomain || resource.subdomain;
+
+    const [domain] = await db
+        .select()
+        .from(domains)
+        .where(eq(domains.domainId, domainId));
+
+    const isBaseDomain =
+        updateData.isBaseDomain !== undefined
+            ? updateData.isBaseDomain
+            : resource.isBaseDomain;
+
+    let fullDomain: string | null = null;
+    if (isBaseDomain) {
+        fullDomain = domain.baseDomain;
+    } else if (subdomain && domain) {
+        fullDomain = `${subdomain}.${domain.baseDomain}`;
+    }
+
+    if (fullDomain) {
+        const [existingDomain] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.fullDomain, fullDomain));
+
+        if (
+            existingDomain &&
+            existingDomain.resourceId !== resource.resourceId
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    "Resource with that domain already exists"
+                )
+            );
+        }
+    }
+
+    const updatePayload = {
+        ...updateData,
+        fullDomain
+    };
+
+    const updatedResource = await db
+        .update(resources)
+        .set(updatePayload)
+        .where(eq(resources.resourceId, resource.resourceId))
+        .returning();
+
+    if (updatedResource.length === 0) {
+        return next(
+            createHttpError(
+                HttpCode.NOT_FOUND,
+                `Resource with ID ${resource.resourceId} not found`
+            )
+        );
+    }
+
+    return response(res, {
+        data: updatedResource[0],
+        success: true,
+        error: false,
+        message: "HTTP resource updated successfully",
+        status: HttpCode.OK
+    });
+}
+
+async function updateRawResource(
+    route: {
+        req: Request;
+        res: Response;
+        next: NextFunction;
+    },
+    meta: {
+        resource: Resource;
+        org: Org;
+    }
+) {
+    const { next, req, res } = route;
+    const { resource } = meta;
+
+    const parsedBody = updateRawResourceBodySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const updateData = parsedBody.data;
+
+    if (updateData.proxyPort) {
+        const proxyPort = updateData.proxyPort;
+        const existingResource = await db
+            .select()
+            .from(resources)
+            .where(
+                and(
+                    eq(resources.protocol, resource.protocol),
+                    eq(resources.proxyPort, proxyPort!)
+                )
+            );
+
+        if (
+            existingResource.length > 0 &&
+            existingResource[0].resourceId !== resource.resourceId
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    "Resource with that protocol and port already exists"
+                )
+            );
+        }
+    }
+
+    const updatedResource = await db
+        .update(resources)
+        .set(updateData)
+        .where(eq(resources.resourceId, resource.resourceId))
+        .returning();
+
+    if (updatedResource.length === 0) {
+        return next(
+            createHttpError(
+                HttpCode.NOT_FOUND,
+                `Resource with ID ${resource.resourceId} not found`
+            )
+        );
+    }
+
+    return response(res, {
+        data: updatedResource[0],
+        success: true,
+        error: false,
+        message: "Non-http Resource updated successfully",
+        status: HttpCode.OK
+    });
+}

server/routers/traefik/getTraefikConfig.ts

@@ -1,6 +1,6 @@
 import { Request, Response } from "express";
 import db from "@server/db";
-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
 import config from "@server/lib/config";
@@ -12,52 +12,79 @@ export async function traefikConfigProvider(
     res: Response
 ): Promise<any> {
     try {
-        const allResources = await db
-            .select({
-                // Resource fields
-                resourceId: resources.resourceId,
-                subdomain: resources.subdomain,
-                fullDomain: resources.fullDomain,
-                ssl: resources.ssl,
-                blockAccess: resources.blockAccess,
-                sso: resources.sso,
-                emailWhitelistEnabled: resources.emailWhitelistEnabled,
-                http: resources.http,
-                proxyPort: resources.proxyPort,
-                protocol: resources.protocol,
-                isBaseDomain: resources.isBaseDomain,
-                // Site fields
-                site: {
-                    siteId: sites.siteId,
-                    type: sites.type,
-                    subnet: sites.subnet
-                },
-                // Org fields
-                org: {
-                    orgId: orgs.orgId,
-                    domain: orgs.domain
-                },
-                // Targets as a subquery
-                targets: sql<string>`json_group_array(json_object(
-          'targetId', ${targets.targetId},
-          'ip', ${targets.ip},
-          'method', ${targets.method},
-          'port', ${targets.port},
-          'internalPort', ${targets.internalPort},
-          'enabled', ${targets.enabled}
-        ))`.as("targets")
-            })
-            .from(resources)
-            .innerJoin(sites, eq(sites.siteId, resources.siteId))
-            .innerJoin(orgs, eq(resources.orgId, orgs.orgId))
-            .leftJoin(
-                targets,
-                and(
-                    eq(targets.resourceId, resources.resourceId),
-                    eq(targets.enabled, true)
-                )
-            )
-            .groupBy(resources.resourceId);
+        // Get all resources with related data
+        const allResources = await db.transaction(async (tx) => {
+            // First query to get resources with site and org info
+            const resourcesWithRelations = await tx
+                .select({
+                    // Resource fields
+                    resourceId: resources.resourceId,
+                    subdomain: resources.subdomain,
+                    fullDomain: resources.fullDomain,
+                    ssl: resources.ssl,
+                    blockAccess: resources.blockAccess,
+                    sso: resources.sso,
+                    emailWhitelistEnabled: resources.emailWhitelistEnabled,
+                    http: resources.http,
+                    proxyPort: resources.proxyPort,
+                    protocol: resources.protocol,
+                    isBaseDomain: resources.isBaseDomain,
+                    domainId: resources.domainId,
+                    // Site fields
+                    site: {
+                        siteId: sites.siteId,
+                        type: sites.type,
+                        subnet: sites.subnet
+                    },
+                    // Org fields
+                    org: {
+                        orgId: orgs.orgId
+                    }
+                })
+                .from(resources)
+                .innerJoin(sites, eq(sites.siteId, resources.siteId))
+                .innerJoin(orgs, eq(resources.orgId, orgs.orgId));
+
+            // Get all resource IDs from the first query
+            const resourceIds = resourcesWithRelations.map((r) => r.resourceId);
+
+            // Second query to get all enabled targets for these resources
+            const allTargets =
+                resourceIds.length > 0
+                    ? await tx
+                          .select({
+                              resourceId: targets.resourceId,
+                              targetId: targets.targetId,
+                              ip: targets.ip,
+                              method: targets.method,
+                              port: targets.port,
+                              internalPort: targets.internalPort,
+                              enabled: targets.enabled
+                          })
+                          .from(targets)
+                          .where(
+                              and(
+                                  inArray(targets.resourceId, resourceIds),
+                                  eq(targets.enabled, true)
+                              )
+                          )
+                    : [];
+
+            // Create a map for fast target lookup by resourceId
+            const targetsMap = allTargets.reduce((map, target) => {
+                if (!map.has(target.resourceId)) {
+                    map.set(target.resourceId, []);
+                }
+                map.get(target.resourceId).push(target);
+                return map;
+            }, new Map());
+
+            // Combine the data
+            return resourcesWithRelations.map((resource) => ({
+                ...resource,
+                targets: targetsMap.get(resource.resourceId) || []
+            }));
+        });
 
         if (!allResources.length) {
             return res.status(HttpCode.OK).json({});
@@ -101,19 +128,26 @@ export async function traefikConfigProvider(
         };
 
         for (const resource of allResources) {
-            const targets = JSON.parse(resource.targets);
+            const targets = resource.targets as Target[];
             const site = resource.site;
             const org = resource.org;
 
-            if (!org.domain) {
-                continue;
-            }
-
             const routerName = `${resource.resourceId}-router`;
             const serviceName = `${resource.resourceId}-service`;
             const fullDomain = `${resource.fullDomain}`;
 
             if (resource.http) {
+                if (!resource.domainId) {
+                    continue;
+                }
+
+                if (!resource.fullDomain) {
+                    logger.error(
+                        `Resource ${resource.resourceId} has no fullDomain`
+                    );
+                    continue;
+                }
+
                 // HTTP configuration remains the same
                 if (!resource.subdomain && !resource.isBaseDomain) {
                     continue;
@@ -136,9 +170,18 @@ export async function traefikConfigProvider(
                     wildCard = `*.${domainParts.slice(1).join(".")}`;
                 }
 
+                const configDomain = config.getDomain(resource.domainId);
+
+                if (!configDomain) {
+                    logger.error(
+                        `Failed to get domain from config for resource ${resource.resourceId}`
+                    );
+                    continue;
+                }
+
                 const tls = {
-                    certResolver: config.getRawConfig().traefik.cert_resolver,
-                    ...(config.getRawConfig().traefik.prefer_wildcard_cert
+                    certResolver: configDomain.cert_resolver,
+                    ...(configDomain.prefer_wildcard_cert
                         ? {
                               domains: [
                                   {

server/setup/clearStaleData.ts

@@ -0,0 +1,79 @@
+import { db } from "@server/db";
+import {
+    emailVerificationCodes,
+    newtSessions,
+    passwordResetTokens,
+    resourceAccessToken,
+    resourceOtp,
+    resourceSessions,
+    sessions,
+    userInvites
+} from "@server/db/schema";
+import logger from "@server/logger";
+import { lt } from "drizzle-orm";
+
+export async function clearStaleData() {
+    try {
+        await db
+            .delete(sessions)
+            .where(lt(sessions.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired sessions:", e);
+    }
+
+    try {
+        await db
+            .delete(newtSessions)
+            .where(lt(newtSessions.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired newtSessions:", e);
+    }
+
+    try {
+        await db
+            .delete(emailVerificationCodes)
+            .where(lt(emailVerificationCodes.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired emailVerificationCodes:", e);
+    }
+
+    try {
+        await db
+            .delete(passwordResetTokens)
+            .where(lt(passwordResetTokens.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired passwordResetTokens:", e);
+    }
+
+    try {
+        await db
+            .delete(userInvites)
+            .where(lt(userInvites.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired userInvites:", e);
+    }
+
+    try {
+        await db
+            .delete(resourceAccessToken)
+            .where(lt(resourceAccessToken.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired resourceAccessToken:", e);
+    }
+
+    try {
+        await db
+            .delete(resourceSessions)
+            .where(lt(resourceSessions.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired resourceSessions:", e);
+    }
+
+    try {
+        await db
+            .delete(resourceOtp)
+            .where(lt(resourceOtp.expiresAt, new Date().getTime()));
+    } catch (e) {
+        logger.warn("Error clearing expired resourceOtp:", e);
+    }
+}

server/setup/copyInConfig.ts

@@ -1,34 +1,103 @@
 import { db } from "@server/db";
-import { exitNodes, orgs, resources } from "../db/schema";
+import { domains, exitNodes, orgDomains, orgs, resources } from "../db/schema";
 import config from "@server/lib/config";
 import { eq, ne } from "drizzle-orm";
 import logger from "@server/logger";
 
 export async function copyInConfig() {
-    const domain = config.getBaseDomain();
     const endpoint = config.getRawConfig().gerbil.base_endpoint;
     const listenPort = config.getRawConfig().gerbil.start_port;
 
-    // update the domain on all of the orgs where the domain is not equal to the new domain
-    // TODO: eventually each org could have a unique domain that we do not want to overwrite, so this will be unnecessary
-    await db.update(orgs).set({ domain }).where(ne(orgs.domain, domain));
-
-    // TODO: eventually each exit node could have a different endpoint
-    await db.update(exitNodes).set({ endpoint }).where(ne(exitNodes.endpoint, endpoint));
-    // TODO: eventually each exit node could have a different port
-    await db.update(exitNodes).set({ listenPort }).where(ne(exitNodes.listenPort, listenPort));
-
-    // update all resources fullDomain to use the new domain
     await db.transaction(async (trx) => {
-        const allResources = await trx.select().from(resources);
+        const rawDomains = config.getRawConfig().domains;
+
+        const configDomains = Object.entries(rawDomains).map(
+            ([key, value]) => ({
+                domainId: key,
+                baseDomain: value.base_domain.toLowerCase()
+            })
+        );
+
+        const existingDomains = await trx
+            .select()
+            .from(domains)
+            .where(eq(domains.configManaged, true));
+        const existingDomainKeys = new Set(
+            existingDomains.map((d) => d.domainId)
+        );
+
+        const configDomainKeys = new Set(configDomains.map((d) => d.domainId));
+        for (const existingDomain of existingDomains) {
+            if (!configDomainKeys.has(existingDomain.domainId)) {
+                await trx
+                    .delete(domains)
+                    .where(eq(domains.domainId, existingDomain.domainId))
+                    .execute();
+            }
+        }
+
+        for (const { domainId, baseDomain } of configDomains) {
+            if (existingDomainKeys.has(domainId)) {
+                await trx
+                    .update(domains)
+                    .set({ baseDomain })
+                    .where(eq(domains.domainId, domainId))
+                    .execute();
+            } else {
+                await trx
+                    .insert(domains)
+                    .values({ domainId, baseDomain, configManaged: true })
+                    .execute();
+            }
+        }
+
+        const allOrgs = await trx.select().from(orgs);
+
+        const existingOrgDomains = await trx.select().from(orgDomains);
+        const existingOrgDomainSet = new Set(
+            existingOrgDomains.map((od) => `${od.orgId}-${od.domainId}`)
+        );
+
+        const newOrgDomains = [];
+        for (const org of allOrgs) {
+            for (const domain of configDomains) {
+                const key = `${org.orgId}-${domain.domainId}`;
+                if (!existingOrgDomainSet.has(key)) {
+                    newOrgDomains.push({
+                        orgId: org.orgId,
+                        domainId: domain.domainId
+                    });
+                }
+            }
+        }
+
+        if (newOrgDomains.length > 0) {
+            await trx.insert(orgDomains).values(newOrgDomains).execute();
+        }
+    });
+
+    await db.transaction(async (trx) => {
+        const allResources = await trx
+            .select()
+            .from(resources)
+            .leftJoin(domains, eq(domains.domainId, resources.domainId));
+
+        for (const { resources: resource, domains: domain } of allResources) {
+            if (!resource || !domain) {
+                continue;
+            }
+
+            if (!domain.configManaged) {
+                continue;
+            }
 
-        for (const resource of allResources) {
             let fullDomain = "";
             if (resource.isBaseDomain) {
-                fullDomain = domain;
+                fullDomain = domain.baseDomain;
             } else {
-                fullDomain = `${resource.subdomain}.${domain}`;
+                fullDomain = `${resource.subdomain}.${domain.baseDomain}`;
             }
+
             await trx
                 .update(resources)
                 .set({ fullDomain })
@@ -36,5 +105,14 @@ export async function copyInConfig() {
         }
     });
 
-    logger.info(`Updated orgs with new domain (${domain})`);
+    // TODO: eventually each exit node could have a different endpoint
+    await db
+        .update(exitNodes)
+        .set({ endpoint })
+        .where(ne(exitNodes.endpoint, endpoint));
+    // TODO: eventually each exit node could have a different port
+    await db
+        .update(exitNodes)
+        .set({ listenPort })
+        .where(ne(exitNodes.listenPort, listenPort));
 }

server/setup/index.ts

@@ -2,12 +2,14 @@ import { ensureActions } from "./ensureActions";
 import { copyInConfig } from "./copyInConfig";
 import { setupServerAdmin } from "./setupServerAdmin";
 import logger from "@server/logger";
+import { clearStaleData } from "./clearStaleData";
 
 export async function runSetupFunctions() {
     try {
         await copyInConfig(); // copy in the config to the db as needed
         await setupServerAdmin();
         await ensureActions(); // make sure all of the actions are in the db and the roles
+        await clearStaleData();
     } catch (error) {
         logger.error("Error running setup functions:", error);
         process.exit(1);

server/setup/migrations.ts

@@ -15,6 +15,8 @@ import m6 from "./scripts/1.0.0-beta9";
 import m7 from "./scripts/1.0.0-beta10";
 import m8 from "./scripts/1.0.0-beta12";
 import m13 from "./scripts/1.0.0-beta13";
+import m15 from "./scripts/1.0.0-beta15";
+import m16 from "./scripts/1.0.0";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -29,16 +31,15 @@ const migrations = [
     { version: "1.0.0-beta.9", run: m6 },
     { version: "1.0.0-beta.10", run: m7 },
     { version: "1.0.0-beta.12", run: m8 },
-    { version: "1.0.0-beta.13", run: m13 }
+    { version: "1.0.0-beta.13", run: m13 },
+    { version: "1.0.0-beta.15", run: m15 },
+    { version: "1.0.0", run: m16 }
     // Add new migrations here as they are created
 ] as const;
 
 await run();
 
 async function run() {
-    // backup the database
-    backupDb();
-
     // run the migrations
     await runMigrations();
 }
@@ -123,6 +124,11 @@ async function executeScripts() {
             console.log(`Running migration ${migration.version}`);
 
             try {
+                if (!process.env.DISABLE_BACKUP_ON_MIGRATION) {
+                    // Backup the database before running the migration
+                    backupDb();
+                }
+
                 await migration.run();
 
                 // Update version in database

server/setup/scripts/1.0.0-beta15.ts

@@ -0,0 +1,129 @@
+import db from "@server/db";
+import { configFilePath1, configFilePath2 } from "@server/lib/consts";
+import fs from "fs";
+import yaml from "js-yaml";
+import { sql } from "drizzle-orm";
+import { domains, orgDomains, resources } from "@server/db/schema";
+
+const version = "1.0.0-beta.15";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    let domain = "";
+
+    try {
+        // Determine which config file exists
+        const filePaths = [configFilePath1, configFilePath2];
+        let filePath = "";
+        for (const path of filePaths) {
+            if (fs.existsSync(path)) {
+                filePath = path;
+                break;
+            }
+        }
+
+        if (!filePath) {
+            throw new Error(
+                `No config file found (expected config.yml or config.yaml).`
+            );
+        }
+
+        // Read and parse the YAML file
+        let rawConfig: any;
+        const fileContents = fs.readFileSync(filePath, "utf8");
+        rawConfig = yaml.load(fileContents);
+
+        const baseDomain = rawConfig.app.base_domain;
+        const certResolver = rawConfig.traefik.cert_resolver;
+        const preferWildcardCert = rawConfig.traefik.prefer_wildcard_cert;
+
+        delete rawConfig.traefik.prefer_wildcard_cert;
+        delete rawConfig.traefik.cert_resolver;
+        delete rawConfig.app.base_domain;
+
+        rawConfig.domains = {
+            domain1: {
+                base_domain: baseDomain
+            }
+        };
+
+        if (certResolver) {
+            rawConfig.domains.domain1.cert_resolver = certResolver;
+        }
+
+        if (preferWildcardCert) {
+            rawConfig.domains.domain1.prefer_wildcard_cert = preferWildcardCert;
+        }
+
+        // Write the updated YAML back to the file
+        const updatedYaml = yaml.dump(rawConfig);
+        fs.writeFileSync(filePath, updatedYaml, "utf8");
+
+        domain = baseDomain;
+
+        console.log(`Moved base_domain to new domains section`);
+    } catch (e) {
+        console.log(
+            `Unable to migrate config file and move base_domain to domains. Error: ${e}`
+        );
+        throw e;
+    }
+
+    try {
+        db.transaction((trx) => {
+            trx.run(sql`CREATE TABLE 'domains' (
+	'domainId' text PRIMARY KEY NOT NULL,
+	'baseDomain' text NOT NULL,
+	'configManaged' integer DEFAULT false NOT NULL
+);`);
+
+            trx.run(sql`CREATE TABLE 'orgDomains' (
+    'orgId' text NOT NULL,
+    'domainId' text NOT NULL,
+    FOREIGN KEY ('orgId') REFERENCES 'orgs'('orgId') ON UPDATE no action ON DELETE cascade,
+    FOREIGN KEY ('domainId') REFERENCES 'domains'('domainId') ON UPDATE no action ON DELETE cascade
+);`);
+
+            trx.run(
+                sql`ALTER TABLE 'resources' ADD 'domainId' text REFERENCES domains(domainId);`
+            );
+            trx.run(sql`ALTER TABLE 'orgs' DROP COLUMN 'domain';`);
+        });
+
+        console.log(`Migrated database schema`);
+    } catch (e) {
+        console.log("Unable to migrate database schema");
+        throw e;
+    }
+
+    try {
+        await db.transaction(async (trx) => {
+            await trx
+                .insert(domains)
+                .values({
+                    domainId: "domain1",
+                    baseDomain: domain,
+                    configManaged: true
+                })
+                .execute();
+            await trx.update(resources).set({ domainId: "domain1" });
+            const existingOrgDomains = await trx.select().from(orgDomains);
+            for (const orgDomain of existingOrgDomains) {
+                await trx
+                    .insert(orgDomains)
+                    .values({ orgId: orgDomain.orgId, domainId: "domain1" })
+                    .execute();
+            }
+        });
+
+        console.log(`Updated resources table with new domainId`);
+    } catch (e) {
+        console.log(
+            `Unable to update resources table with new domainId. Error: ${e}`
+        );
+        return;
+    }
+
+    console.log(`${version} migration complete`);
+}

server/setup/scripts/1.0.0.ts

@@ -0,0 +1,57 @@
+import { APP_PATH } from "@server/lib/consts";
+import fs from "fs";
+import yaml from "js-yaml";
+import path from "path";
+import { z } from "zod";
+import { fromZodError } from "zod-validation-error";
+
+const version = "1.0.0";
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        const traefikPath = path.join(
+            APP_PATH,
+            "traefik",
+            "traefik_config.yml"
+        );
+
+        const schema = z.object({
+            experimental: z.object({
+                plugins: z.object({
+                    badger: z.object({
+                        moduleName: z.string(),
+                        version: z.string()
+                    })
+                })
+            })
+        });
+
+        const traefikFileContents = fs.readFileSync(traefikPath, "utf8");
+        const traefikConfig = yaml.load(traefikFileContents) as any;
+
+        const parsedConfig = schema.safeParse(traefikConfig);
+
+        if (!parsedConfig.success) {
+            throw new Error(fromZodError(parsedConfig.error).toString());
+        }
+
+        traefikConfig.experimental.plugins.badger.version = "v1.0.0";
+
+        const updatedTraefikYaml = yaml.dump(traefikConfig);
+
+        fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");
+
+        console.log(
+            "Updated the version of Badger in your Traefik configuration to 1.0.0"
+        );
+    } catch (e) {
+        console.log(
+            "We were unable to update the version of Badger in your Traefik configuration. Please update it manually."
+        );
+        console.error(e);
+    }
+
+    console.log(`${version} migration complete`);
+}