Merge branch 'dev' into auth-providers-clients

server/auth/actions.ts

@@ -6,6 +6,7 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 
 export enum ActionsEnum {
+    createOrgUser = "createOrgUser",
     listOrgs = "listOrgs",
     listUserOrgs = "listUserOrgs",
     createOrg = "createOrg",
@@ -82,7 +83,14 @@ export enum ActionsEnum {
     deleteIdpOrg = "deleteIdpOrg",
     listIdpOrgs = "listIdpOrgs",
     updateIdpOrg = "updateIdpOrg",
-    checkOrgId = "checkOrgId"
+    checkOrgId = "checkOrgId",
+    createApiKey = "createApiKey",
+    deleteApiKey = "deleteApiKey",
+    setApiKeyActions = "setApiKeyActions",
+    setApiKeyOrgs = "setApiKeyOrgs",
+    listApiKeyActions = "listApiKeyActions",
+    listApiKeys = "listApiKeys",
+    getApiKey = "getApiKey"
 }
 
 export async function checkUserActionPermission(

server/db/schemas/schema.ts

@@ -85,7 +85,12 @@ export const resources = sqliteTable("resources", {
     applyRules: integer("applyRules", { mode: "boolean" })
         .notNull()
         .default(false),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true)
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+    stickySession: integer("stickySession", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    tlsServerName: text("tlsServerName"),
+    setHostHeader: text("setHostHeader")
 });
 
 export const targets = sqliteTable("targets", {
@@ -107,7 +112,7 @@ export const exitNodes = sqliteTable("exitNodes", {
     name: text("name").notNull(),
     address: text("address").notNull(), // this is the address of the wireguard interface in gerbil
     endpoint: text("endpoint").notNull(), // this is how to reach gerbil externally - gets put into the wireguard config
-    publicKey: text("pubicKey").notNull(),
+    publicKey: text("publicKey").notNull(),
     listenPort: integer("listenPort").notNull(),
     reachableAt: text("reachableAt") // this is the internal address of the gerbil http server for command control
 });
@@ -529,6 +534,57 @@ export const idpOidcConfig = sqliteTable("idpOidcConfig", {
     scopes: text("scopes").notNull()
 });
 
+export const licenseKey = sqliteTable("licenseKey", {
+    licenseKeyId: text("licenseKeyId").primaryKey().notNull(),
+    instanceId: text("instanceId").notNull(),
+    token: text("token").notNull()
+});
+
+export const hostMeta = sqliteTable("hostMeta", {
+    hostMetaId: text("hostMetaId").primaryKey().notNull(),
+    createdAt: integer("createdAt").notNull()
+});
+
+export const apiKeys = sqliteTable("apiKeys", {
+    apiKeyId: text("apiKeyId").primaryKey(),
+    name: text("name").notNull(),
+    apiKeyHash: text("apiKeyHash").notNull(),
+    lastChars: text("lastChars").notNull(),
+    createdAt: text("dateCreated").notNull(),
+    isRoot: integer("isRoot", { mode: "boolean" }).notNull().default(false)
+});
+
+export const apiKeyActions = sqliteTable("apiKeyActions", {
+    apiKeyId: text("apiKeyId")
+        .notNull()
+        .references(() => apiKeys.apiKeyId, { onDelete: "cascade" }),
+    actionId: text("actionId")
+        .notNull()
+        .references(() => actions.actionId, { onDelete: "cascade" })
+});
+
+export const apiKeyOrg = sqliteTable("apiKeyOrg", {
+    apiKeyId: text("apiKeyId")
+        .notNull()
+        .references(() => apiKeys.apiKeyId, { onDelete: "cascade" }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});
+
+export const idpOrg = sqliteTable("idpOrg", {
+    idpId: integer("idpId")
+        .notNull()
+        .references(() => idp.idpId, { onDelete: "cascade" }),
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    roleMapping: text("roleMapping"),
+    orgMapping: text("orgMapping")
+});
+
 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
 export type Site = InferSelectModel<typeof sites>;
@@ -571,3 +627,6 @@ export type UserClient = InferSelectModel<typeof userClients>;
 export type Domain = InferSelectModel<typeof domains>;
 export type SupporterKey = InferSelectModel<typeof supporterKey>;
 export type Idp = InferSelectModel<typeof idp>;
+export type ApiKey = InferSelectModel<typeof apiKeys>;
+export type ApiKeyAction = InferSelectModel<typeof apiKeyActions>;
+export type ApiKeyOrg = InferSelectModel<typeof apiKeyOrg>;

server/index.ts

@@ -4,7 +4,9 @@ import { runSetupFunctions } from "./setup";
 import { createApiServer } from "./apiServer";
 import { createNextServer } from "./nextServer";
 import { createInternalServer } from "./internalServer";
-import { Session, User, UserOrg } from "./db/schemas/schema";
+import { ApiKey, ApiKeyOrg, Session, User, UserOrg } from "./db/schemas";
+import { createIntegrationApiServer } from "./integrationApiServer";
+import license from "./license/license.js";
 
 async function startServers() {
     await runSetupFunctions();
@@ -14,10 +16,16 @@ async function startServers() {
     const internalServer = createInternalServer();
     const nextServer = await createNextServer();
 
+    let integrationServer;
+    if (await license.isUnlocked()) {
+        integrationServer = createIntegrationApiServer();
+    }
+
     return {
         apiServer,
         nextServer,
         internalServer,
+        integrationServer
     };
 }
 
@@ -25,9 +33,11 @@ async function startServers() {
 declare global {
     namespace Express {
         interface Request {
+            apiKey?: ApiKey;
             user?: User;
             session?: Session;
             userOrg?: UserOrg;
+            apiKeyOrg?: ApiKeyOrg;
             userOrgRoleId?: number;
             userOrgId?: string;
             userOrgIds?: string[];

server/integrationApiServer.ts

@@ -0,0 +1,112 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import express from "express";
+import cors from "cors";
+import cookieParser from "cookie-parser";
+import config from "@server/lib/config";
+import logger from "@server/logger";
+import {
+    errorHandlerMiddleware,
+    notFoundMiddleware,
+    verifyValidLicense
+} from "@server/middlewares";
+import { authenticated, unauthenticated } from "@server/routers/integration";
+import { logIncomingMiddleware } from "./middlewares/logIncoming";
+import { csrfProtectionMiddleware } from "./middlewares/csrfProtection";
+import helmet from "helmet";
+import swaggerUi from "swagger-ui-express";
+import { OpenApiGeneratorV3 } from "@asteasolutions/zod-to-openapi";
+import { registry } from "./openApi";
+
+const dev = process.env.ENVIRONMENT !== "prod";
+const externalPort = config.getRawConfig().server.integration_port;
+
+export function createIntegrationApiServer() {
+    const apiServer = express();
+
+    apiServer.use(verifyValidLicense);
+
+    if (config.getRawConfig().server.trust_proxy) {
+        apiServer.set("trust proxy", 1);
+    }
+
+    apiServer.use(cors());
+
+    if (!dev) {
+        apiServer.use(helmet());
+        apiServer.use(csrfProtectionMiddleware);
+    }
+
+    apiServer.use(cookieParser());
+    apiServer.use(express.json());
+
+    apiServer.use(
+        "/v1/docs",
+        swaggerUi.serve,
+        swaggerUi.setup(getOpenApiDocumentation())
+    );
+
+    // API routes
+    const prefix = `/v1`;
+    apiServer.use(logIncomingMiddleware);
+    apiServer.use(prefix, unauthenticated);
+    apiServer.use(prefix, authenticated);
+
+    // Error handling
+    apiServer.use(notFoundMiddleware);
+    apiServer.use(errorHandlerMiddleware);
+
+    // Create HTTP server
+    const httpServer = apiServer.listen(externalPort, (err?: any) => {
+        if (err) throw err;
+        logger.info(
+            `Integration API server is running on http://localhost:${externalPort}`
+        );
+    });
+
+    return httpServer;
+}
+
+function getOpenApiDocumentation() {
+    const bearerAuth = registry.registerComponent(
+        "securitySchemes",
+        "Bearer Auth",
+        {
+            type: "http",
+            scheme: "bearer"
+        }
+    );
+
+    for (const def of registry.definitions) {
+        if (def.type === "route") {
+            def.route.security = [
+                {
+                    [bearerAuth.name]: []
+                }
+            ];
+        }
+    }
+
+    registry.registerPath({
+        method: "get",
+        path: "/",
+        description: "Health check",
+        tags: [],
+        request: {},
+        responses: {}
+    });
+
+    const generator = new OpenApiGeneratorV3(registry.definitions);
+
+    return generator.generateDocument({
+        openapi: "3.0.0",
+        info: {
+            version: "v1",
+            title: "Pangolin Integration API"
+        },
+        servers: [{ url: "/v1" }]
+    });
+}

server/lib/config.ts

@@ -13,6 +13,7 @@ import stoi from "./stoi";
 import db from "@server/db";
 import { SupporterKey, supporterKey } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
+import { license } from "@server/license/license";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
 
@@ -59,6 +60,10 @@ const configSchema = z.object({
             }
         ),
     server: z.object({
+        integration_port: portSchema
+            .optional()
+            .transform(stoi)
+            .pipe(portSchema.optional()),
         external_port: portSchema.optional().transform(stoi).pipe(portSchema),
         internal_port: portSchema.optional().transform(stoi).pipe(portSchema),
         next_port: portSchema.optional().transform(stoi).pipe(portSchema),
@@ -95,14 +100,7 @@ const configSchema = z.object({
             .string()
             .optional()
             .transform(getEnvOrYaml("SERVER_SECRET"))
-            .pipe(
-                z
-                    .string()
-                    .min(
-                        32,
-                        "SERVER_SECRET must be at least 32 characters long"
-                    )
-            )
+            .pipe(z.string().min(8))
     }),
     traefik: z.object({
         http_entrypoint: z.string(),
@@ -270,13 +268,20 @@ export class Config {
             : "false";
         process.env.DASHBOARD_URL = parsedConfig.data.app.dashboard_url;
 
-        if (!this.isDev) {
-            this.checkSupporterKey();
-        }
+        license.setServerSecret(parsedConfig.data.server.secret);
+
+        this.checkKeyStatus();
 
         this.rawConfig = parsedConfig.data;
     }
 
+    private async checkKeyStatus() {
+        const licenseStatus = await license.check();
+        if (!licenseStatus.isHostLicensed) {
+            this.checkSupporterKey();
+        }
+    }
+
     public getRawConfig() {
         return this.rawConfig;
     }
@@ -322,7 +327,7 @@ export class Config {
 
         try {
             const response = await fetch(
-                "https://api.dev.fossorial.io/api/v1/license/validate",
+                "https://api.fossorial.io/api/v1/license/validate",
                 {
                     method: "POST",
                     headers: {

server/lib/crypto.ts

@@ -1,40 +1,12 @@
-import * as crypto from "crypto";
-
-const ALGORITHM = "aes-256-gcm";
+import CryptoJS from "crypto-js";
 
 export function encrypt(value: string, key: string): string {
-    const iv = crypto.randomBytes(12);
-    const keyBuffer = Buffer.from(key, "base64"); // assuming base64 input
-
-    const cipher = crypto.createCipheriv(ALGORITHM, keyBuffer, iv);
-
-    const encrypted = Buffer.concat([
-        cipher.update(value, "utf8"),
-        cipher.final()
-    ]);
-    const authTag = cipher.getAuthTag();
-
-    return [
-        iv.toString("base64"),
-        encrypted.toString("base64"),
-        authTag.toString("base64")
-    ].join(":");
+    const ciphertext = CryptoJS.AES.encrypt(value, key).toString();
+    return ciphertext;
 }
 
 export function decrypt(encryptedValue: string, key: string): string {
-    const [ivB64, encryptedB64, authTagB64] = encryptedValue.split(":");
-
-    const iv = Buffer.from(ivB64, "base64");
-    const encrypted = Buffer.from(encryptedB64, "base64");
-    const authTag = Buffer.from(authTagB64, "base64");
-    const keyBuffer = Buffer.from(key, "base64");
-
-    const decipher = crypto.createDecipheriv(ALGORITHM, keyBuffer, iv);
-    decipher.setAuthTag(authTag);
-
-    const decrypted = Buffer.concat([
-        decipher.update(encrypted),
-        decipher.final()
-    ]);
-    return decrypted.toString("utf8");
+    const bytes = CryptoJS.AES.decrypt(encryptedValue, key);
+    const originalText = bytes.toString(CryptoJS.enc.Utf8);
+    return originalText;
 }

server/lib/schemas.ts

@@ -9,3 +9,10 @@ export const subdomainSchema = z
     .min(1, "Subdomain must be at least 1 character long")
     .transform((val) => val.toLowerCase());
 
+export const tlsNameSchema = z
+    .string()
+    .regex(
+        /^(?!:\/\/)([a-zA-Z0-9-_]+\.)*[a-zA-Z0-9-_]+$|^$/,
+        "Invalid subdomain format"
+    )
+    .transform((val) => val.toLowerCase());

server/license/license.ts

@@ -0,0 +1,481 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import db from "@server/db";
+import { hostMeta, licenseKey, sites } from "@server/db/schemas";
+import logger from "@server/logger";
+import NodeCache from "node-cache";
+import { validateJWT } from "./licenseJwt";
+import { count, eq } from "drizzle-orm";
+import moment from "moment";
+import { setHostMeta } from "@server/setup/setHostMeta";
+import { encrypt, decrypt } from "@server/lib/crypto";
+
+export type LicenseStatus = {
+    isHostLicensed: boolean; // Are there any license keys?
+    isLicenseValid: boolean; // Is the license key valid?
+    hostId: string; // Host ID
+    maxSites?: number;
+    usedSites?: number;
+};
+
+export type LicenseKeyCache = {
+    licenseKey: string;
+    licenseKeyEncrypted: string;
+    valid: boolean;
+    iat?: Date;
+    type?: "LICENSE" | "SITES";
+    numSites?: number;
+};
+
+type ActivateLicenseKeyAPIResponse = {
+    data: {
+        instanceId: string;
+    };
+    success: boolean;
+    error: string;
+    message: string;
+    status: number;
+};
+
+type ValidateLicenseAPIResponse = {
+    data: {
+        licenseKeys: {
+            [key: string]: string;
+        };
+    };
+    success: boolean;
+    error: string;
+    message: string;
+    status: number;
+};
+
+type TokenPayload = {
+    valid: boolean;
+    type: "LICENSE" | "SITES";
+    quantity: number;
+    terminateAt: string; // ISO
+    iat: number; // Issued at
+};
+
+export class License {
+    private phoneHomeInterval = 6 * 60 * 60; // 6 hours = 6 * 60 * 60 = 21600 seconds
+    private validationServerUrl =
+        "https://api.fossorial.io/api/v1/license/professional/validate";
+    private activationServerUrl =
+        "https://api.fossorial.io/api/v1/license/professional/activate";
+
+    private statusCache = new NodeCache({ stdTTL: this.phoneHomeInterval });
+    private licenseKeyCache = new NodeCache();
+
+    private ephemeralKey!: string;
+    private statusKey = "status";
+    private serverSecret!: string;
+
+    private publicKey = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RKc8cw+G8r7h/xeozF
+FNkRDggQfYO6Ae+EWHGujZ9WYAZ10spLh9F/zoLhhr3XhsjpoRXwMfgNuO5HstWf
+CYM20I0l7EUUMWEyWd4tZLd+5XQ4jY5xWOCWyFJAGQSp7flcRmxdfde+l+xg9eKl
+apbY84aVp09/GqM96hCS+CsQZrhohu/aOqYVB/eAhF01qsbmiZ7Y3WtdhTldveYt
+h4mZWGmjf8d/aEgePf/tk1gp0BUxf+Ae5yqoAqU+6aiFbjJ7q1kgxc18PWFGfE9y
+zSk+OZk887N5ThQ52154+oOUCMMR2Y3t5OH1hVZod51vuY2u5LsQXsf+87PwB91y
+LQIDAQAB
+-----END PUBLIC KEY-----`;
+
+    constructor(private hostId: string) {
+        this.ephemeralKey = Buffer.from(
+            JSON.stringify({ ts: new Date().toISOString() })
+        ).toString("base64");
+
+        setInterval(
+            async () => {
+                await this.check();
+            },
+            1000 * 60 * 60
+        ); // 1 hour = 60 * 60 = 3600 seconds
+    }
+
+    public listKeys(): LicenseKeyCache[] {
+        const keys = this.licenseKeyCache.keys();
+        return keys.map((key) => {
+            return this.licenseKeyCache.get<LicenseKeyCache>(key)!;
+        });
+    }
+
+    public setServerSecret(secret: string) {
+        this.serverSecret = secret;
+    }
+
+    public async forceRecheck() {
+        this.statusCache.flushAll();
+        this.licenseKeyCache.flushAll();
+
+        return await this.check();
+    }
+
+    public async isUnlocked(): Promise<boolean> {
+        const status = await this.check();
+        if (status.isHostLicensed) {
+            if (status.isLicenseValid) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public async check(): Promise<LicenseStatus> {
+        // Set used sites
+        const [siteCount] = await db
+            .select({
+                value: count()
+            })
+            .from(sites);
+
+        const status: LicenseStatus = {
+            hostId: this.hostId,
+            isHostLicensed: true,
+            isLicenseValid: false,
+            maxSites: undefined,
+            usedSites: siteCount.value
+        };
+
+        try {
+            if (this.statusCache.has(this.statusKey)) {
+                const res = this.statusCache.get("status") as LicenseStatus;
+                res.usedSites = status.usedSites;
+                return res;
+            }
+
+            // Invalidate all
+            this.licenseKeyCache.flushAll();
+
+            const allKeysRes = await db.select().from(licenseKey);
+
+            if (allKeysRes.length === 0) {
+                status.isHostLicensed = false;
+                return status;
+            }
+
+            let foundHostKey = false;
+            // Validate stored license keys
+            for (const key of allKeysRes) {
+                try {
+                    // Decrypt the license key and token
+                    const decryptedKey = decrypt(
+                        key.licenseKeyId,
+                        this.serverSecret
+                    );
+                    const decryptedToken = decrypt(
+                        key.token,
+                        this.serverSecret
+                    );
+
+                    const payload = validateJWT<TokenPayload>(
+                        decryptedToken,
+                        this.publicKey
+                    );
+
+                    this.licenseKeyCache.set<LicenseKeyCache>(decryptedKey, {
+                        licenseKey: decryptedKey,
+                        licenseKeyEncrypted: key.licenseKeyId,
+                        valid: payload.valid,
+                        type: payload.type,
+                        numSites: payload.quantity,
+                        iat: new Date(payload.iat * 1000)
+                    });
+
+                    if (payload.type === "LICENSE") {
+                        foundHostKey = true;
+                    }
+                } catch (e) {
+                    logger.error(
+                        `Error validating license key: ${key.licenseKeyId}`
+                    );
+                    logger.error(e);
+
+                    this.licenseKeyCache.set<LicenseKeyCache>(
+                        key.licenseKeyId,
+                        {
+                            licenseKey: key.licenseKeyId,
+                            licenseKeyEncrypted: key.licenseKeyId,
+                            valid: false
+                        }
+                    );
+                }
+            }
+
+            if (!foundHostKey && allKeysRes.length) {
+                logger.debug("No host license key found");
+                status.isHostLicensed = false;
+            }
+
+            const keys = allKeysRes.map((key) => ({
+                licenseKey: decrypt(key.licenseKeyId, this.serverSecret),
+                instanceId: decrypt(key.instanceId, this.serverSecret)
+            }));
+
+            let apiResponse: ValidateLicenseAPIResponse | undefined;
+            try {
+                // Phone home to validate license keys
+                apiResponse = await this.phoneHome(keys);
+
+                if (!apiResponse?.success) {
+                    throw new Error(apiResponse?.error);
+                }
+            } catch (e) {
+                logger.error("Error communicating with license server:");
+                logger.error(e);
+            }
+
+            logger.debug("Validate response", apiResponse);
+
+            // Check and update all license keys with server response
+            for (const key of keys) {
+                try {
+                    const cached = this.licenseKeyCache.get<LicenseKeyCache>(
+                        key.licenseKey
+                    )!;
+                    const licenseKeyRes =
+                        apiResponse?.data?.licenseKeys[key.licenseKey];
+
+                    if (!apiResponse || !licenseKeyRes) {
+                        logger.debug(
+                            `No response from server for license key: ${key.licenseKey}`
+                        );
+                        if (cached.iat) {
+                            const exp = moment(cached.iat)
+                                .add(7, "days")
+                                .toDate();
+                            if (exp > new Date()) {
+                                logger.debug(
+                                    `Using cached license key: ${key.licenseKey}, valid ${cached.valid}`
+                                );
+                                continue;
+                            }
+                        }
+
+                        logger.debug(
+                            `Can't trust license key: ${key.licenseKey}`
+                        );
+                        cached.valid = false;
+                        this.licenseKeyCache.set<LicenseKeyCache>(
+                            key.licenseKey,
+                            cached
+                        );
+                        continue;
+                    }
+
+                    const payload = validateJWT<TokenPayload>(
+                        licenseKeyRes,
+                        this.publicKey
+                    );
+                    cached.valid = payload.valid;
+                    cached.type = payload.type;
+                    cached.numSites = payload.quantity;
+                    cached.iat = new Date(payload.iat * 1000);
+
+                    // Encrypt the updated token before storing
+                    const encryptedKey = encrypt(
+                        key.licenseKey,
+                        this.serverSecret
+                    );
+                    const encryptedToken = encrypt(
+                        licenseKeyRes,
+                        this.serverSecret
+                    );
+
+                    await db
+                        .update(licenseKey)
+                        .set({
+                            token: encryptedToken
+                        })
+                        .where(eq(licenseKey.licenseKeyId, encryptedKey));
+
+                    this.licenseKeyCache.set<LicenseKeyCache>(
+                        key.licenseKey,
+                        cached
+                    );
+                } catch (e) {
+                    logger.error(`Error validating license key: ${key}`);
+                    logger.error(e);
+                }
+            }
+
+            // Compute host status
+            for (const key of keys) {
+                const cached = this.licenseKeyCache.get<LicenseKeyCache>(
+                    key.licenseKey
+                )!;
+
+                logger.debug("Checking key", cached);
+
+                if (cached.type === "LICENSE") {
+                    status.isLicenseValid = cached.valid;
+                }
+
+                if (!cached.valid) {
+                    continue;
+                }
+
+                if (!status.maxSites) {
+                    status.maxSites = 0;
+                }
+
+                status.maxSites += cached.numSites || 0;
+            }
+        } catch (error) {
+            logger.error("Error checking license status:");
+            logger.error(error);
+        }
+
+        this.statusCache.set(this.statusKey, status);
+        return status;
+    }
+
+    public async activateLicenseKey(key: string) {
+        // Encrypt the license key before storing
+        const encryptedKey = encrypt(key, this.serverSecret);
+
+        const [existingKey] = await db
+            .select()
+            .from(licenseKey)
+            .where(eq(licenseKey.licenseKeyId, encryptedKey))
+            .limit(1);
+
+        if (existingKey) {
+            throw new Error("License key already exists");
+        }
+
+        let instanceId: string | undefined;
+        try {
+            // Call activate
+            const apiResponse = await fetch(this.activationServerUrl, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    licenseKey: key,
+                    instanceName: this.hostId
+                })
+            });
+
+            const data = await apiResponse.json();
+
+            if (!data.success) {
+                throw new Error(`${data.message || data.error}`);
+            }
+
+            const response = data as ActivateLicenseKeyAPIResponse;
+
+            if (!response.data) {
+                throw new Error("No response from server");
+            }
+
+            if (!response.data.instanceId) {
+                throw new Error("No instance ID in response");
+            }
+
+            instanceId = response.data.instanceId;
+        } catch (error) {
+            throw Error(`Error activating license key: ${error}`);
+        }
+
+        // Phone home to validate license key
+        const keys = [
+            {
+                licenseKey: key,
+                instanceId: instanceId!
+            }
+        ];
+
+        let validateResponse: ValidateLicenseAPIResponse;
+        try {
+            validateResponse = await this.phoneHome(keys);
+
+            if (!validateResponse) {
+                throw new Error("No response from server");
+            }
+
+            if (!validateResponse.success) {
+                throw new Error(validateResponse.error);
+            }
+
+            // Validate the license key
+            const licenseKeyRes = validateResponse.data.licenseKeys[key];
+            if (!licenseKeyRes) {
+                throw new Error("Invalid license key");
+            }
+
+            const payload = validateJWT<TokenPayload>(
+                licenseKeyRes,
+                this.publicKey
+            );
+
+            if (!payload.valid) {
+                throw new Error("Invalid license key");
+            }
+
+            const encryptedToken = encrypt(licenseKeyRes, this.serverSecret);
+            // Encrypt the instanceId before storing
+            const encryptedInstanceId = encrypt(instanceId!, this.serverSecret);
+
+            // Store the license key in the database
+            await db.insert(licenseKey).values({
+                licenseKeyId: encryptedKey,
+                token: encryptedToken,
+                instanceId: encryptedInstanceId
+            });
+        } catch (error) {
+            throw Error(`Error validating license key: ${error}`);
+        }
+
+        // Invalidate the cache and re-compute the status
+        return await this.forceRecheck();
+    }
+
+    private async phoneHome(
+        keys: {
+            licenseKey: string;
+            instanceId: string;
+        }[]
+    ): Promise<ValidateLicenseAPIResponse> {
+        // Decrypt the instanceIds before sending to the server
+        const decryptedKeys = keys.map((key) => ({
+            licenseKey: key.licenseKey,
+            instanceId: key.instanceId
+                ? decrypt(key.instanceId, this.serverSecret)
+                : key.instanceId
+        }));
+
+        const response = await fetch(this.validationServerUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                licenseKeys: decryptedKeys,
+                ephemeralKey: this.ephemeralKey,
+                instanceName: this.hostId
+            })
+        });
+
+        const data = await response.json();
+
+        return data as ValidateLicenseAPIResponse;
+    }
+}
+
+await setHostMeta();
+
+const [info] = await db.select().from(hostMeta).limit(1);
+
+if (!info) {
+    throw new Error("Host information not found");
+}
+
+export const license = new License(info.hostMetaId);
+
+export default license;

server/license/licenseJwt.ts

@@ -0,0 +1,114 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import * as crypto from "crypto";
+
+/**
+ * Validates a JWT using a public key
+ * @param token - The JWT to validate
+ * @param publicKey - The public key used for verification (PEM format)
+ * @returns The decoded payload if validation succeeds, throws an error otherwise
+ */
+function validateJWT<Payload>(
+    token: string,
+    publicKey: string
+): Payload {
+    // Split the JWT into its three parts
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new Error("Invalid JWT format");
+    }
+
+    const [encodedHeader, encodedPayload, signature] = parts;
+
+    // Decode the header to get the algorithm
+    const header = JSON.parse(Buffer.from(encodedHeader, "base64").toString());
+    const algorithm = header.alg;
+
+    // Verify the signature
+    const signatureInput = `${encodedHeader}.${encodedPayload}`;
+    const isValid = verify(signatureInput, signature, publicKey, algorithm);
+
+    if (!isValid) {
+        throw new Error("Invalid signature");
+    }
+
+    // Decode the payload
+    const payload = JSON.parse(
+        Buffer.from(encodedPayload, "base64").toString()
+    );
+
+    // Check if the token has expired
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp && payload.exp < now) {
+        throw new Error("Token has expired");
+    }
+
+    return payload;
+}
+
+/**
+ * Verifies the signature of a JWT
+ */
+function verify(
+    input: string,
+    signature: string,
+    publicKey: string,
+    algorithm: string
+): boolean {
+    let verifyAlgorithm: string;
+
+    // Map JWT algorithm name to Node.js crypto algorithm name
+    switch (algorithm) {
+        case "RS256":
+            verifyAlgorithm = "RSA-SHA256";
+            break;
+        case "RS384":
+            verifyAlgorithm = "RSA-SHA384";
+            break;
+        case "RS512":
+            verifyAlgorithm = "RSA-SHA512";
+            break;
+        case "ES256":
+            verifyAlgorithm = "SHA256";
+            break;
+        case "ES384":
+            verifyAlgorithm = "SHA384";
+            break;
+        case "ES512":
+            verifyAlgorithm = "SHA512";
+            break;
+        default:
+            throw new Error(`Unsupported algorithm: ${algorithm}`);
+    }
+
+    // Convert base64url signature to standard base64
+    const base64Signature = base64URLToBase64(signature);
+
+    // Verify the signature
+    const verifier = crypto.createVerify(verifyAlgorithm);
+    verifier.update(input);
+    return verifier.verify(publicKey, base64Signature, "base64");
+}
+
+/**
+ * Converts base64url format to standard base64
+ */
+function base64URLToBase64(base64url: string): string {
+    // Add padding if needed
+    let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+
+    const pad = base64.length % 4;
+    if (pad) {
+        if (pad === 1) {
+            throw new Error("Invalid base64url string");
+        }
+        base64 += "=".repeat(4 - pad);
+    }
+
+    return base64;
+}
+
+export { validateJWT };

server/middlewares/index.ts

@@ -17,3 +17,7 @@ export * from "./verifyAccessTokenAccess";
 export * from "./verifyUserIsServerAdmin";
 export * from "./verifyIsLoggedInUser";
 export * from "./verifyClientAccess";
+export * from "./integration";
+export * from "./verifyValidLicense";
+export * from "./verifyUserHasAction";
+export * from "./verifyApiKeyAccess";

server/middlewares/integration/index.ts

@@ -0,0 +1,17 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+export * from "./verifyApiKey";
+export * from "./verifyApiKeyOrgAccess";
+export * from "./verifyApiKeyHasAction";
+export * from "./verifyApiKeySiteAccess";
+export * from "./verifyApiKeyResourceAccess";
+export * from "./verifyApiKeyTargetAccess";
+export * from "./verifyApiKeyRoleAccess";
+export * from "./verifyApiKeyUserAccess";
+export * from "./verifyApiKeySetResourceUsers";
+export * from "./verifyAccessTokenAccess";
+export * from "./verifyApiKeyIsRoot";
+export * from "./verifyApiKeyApiKeyAccess";

server/middlewares/integration/verifyAccessTokenAccess.ts

@@ -0,0 +1,115 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resourceAccessToken, resources, apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyAccessTokenAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const accessTokenId = req.params.accessTokenId;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        const [accessToken] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(eq(resourceAccessToken.accessTokenId, accessTokenId))
+            .limit(1);
+
+        if (!accessToken) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Access token with ID ${accessTokenId} not found`
+                )
+            );
+        }
+
+        const resourceId = accessToken.resourceId;
+
+        if (!resourceId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Access token with ID ${accessTokenId} does not have a resource ID`
+                )
+            );
+        }
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        // Verify that the API key is linked to the resource's organization
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying access token access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKey.ts

@@ -0,0 +1,65 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { verifyPassword } from "@server/auth/password";
+import db from "@server/db";
+import { apiKeys } from "@server/db/schemas";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { eq } from "drizzle-orm";
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+
+export async function verifyApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<void> {
+    try {
+        const authHeader = req.headers["authorization"];
+
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "API key required")
+            );
+        }
+
+        const key = authHeader.split(" ")[1]; // Get the token part after "Bearer"
+        const [apiKeyId, apiKeySecret] = key.split(".");
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .where(eq(apiKeys.apiKeyId, apiKeyId))
+            .limit(1);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid API key")
+            );
+        }
+
+        const secretHash = apiKey.apiKeyHash;
+        const valid = await verifyPassword(apiKeySecret, secretHash);
+
+        if (!valid) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid API key")
+            );
+        }
+
+        req.apiKey = apiKey;
+
+        return next();
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred checking API key"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyApiKeyAccess.ts

@@ -0,0 +1,86 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { apiKeys, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const {apiKey: callerApiKey } = req;
+
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!callerApiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
+            );
+        }
+
+        const [callerApiKeyOrg] = await db
+            .select()
+            .from(apiKeyOrg)
+            .where(
+                and(eq(apiKeys.apiKeyId, callerApiKey.apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!callerApiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `API key with ID ${apiKeyId} does not have an organization ID`
+                )
+            );
+        }
+
+        const [otherApiKeyOrg] = await db
+            .select()
+            .from(apiKeyOrg)
+            .where(
+                and(eq(apiKeys.apiKeyId, apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!otherApiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `API key with ID ${apiKeyId} does not have access to organization with ID ${orgId}`
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying key access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyHasAction.ts

@@ -0,0 +1,61 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+import { ActionsEnum } from "@server/auth/actions";
+import db from "@server/db";
+import { apiKeyActions } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+
+export function verifyApiKeyHasAction(action: ActionsEnum) {
+    return async function (
+        req: Request,
+        res: Response,
+        next: NextFunction
+    ): Promise<any> {
+        try {
+            if (!req.apiKey) {
+                return next(
+                    createHttpError(
+                        HttpCode.UNAUTHORIZED,
+                        "API Key not authenticated"
+                    )
+                );
+            }
+
+            const [actionRes] = await db
+                .select()
+                .from(apiKeyActions)
+                .where(
+                    and(
+                        eq(apiKeyActions.apiKeyId, req.apiKey.apiKeyId),
+                        eq(apiKeyActions.actionId, action)
+                    )
+                );
+
+            if (!actionRes) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Key does not have permission perform this action"
+                    )
+                );
+            }
+
+            return next();
+        } catch (error) {
+            logger.error("Error verifying key action access:", error);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Error verifying key action access"
+                )
+            );
+        }
+    };
+}

server/middlewares/integration/verifyApiKeyIsRoot.ts

@@ -0,0 +1,44 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+
+export async function verifyApiKeyIsRoot(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<void> {
+    try {
+        const { apiKey } = req;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!apiKey.isRoot) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have root access"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred checking API key"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyOrgAccess.ts

@@ -0,0 +1,66 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+
+export async function verifyApiKeyOrgAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKeyId = req.apiKey?.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                );
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying organization access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyResourceAccess.ts

@@ -0,0 +1,90 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resources, apiKeyOrg } from "@server/db/schemas";
+import { eq, and } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyResourceAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    const apiKey = req.apiKey;
+    const resourceId =
+        req.params.resourceId || req.body.resourceId || req.query.resourceId;
+
+    if (!apiKey) {
+        return next(
+            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+        );
+    }
+
+    try {
+        // Retrieve the resource
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        // Verify that the API key is linked to the resource's organization
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying resource access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyRoleAccess.ts

@@ -0,0 +1,132 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { roles, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, inArray } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import logger from "@server/logger";
+
+export async function verifyApiKeyRoleAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const singleRoleId = parseInt(
+            req.params.roleId || req.body.roleId || req.query.roleId
+        );
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        const { roleIds } = req.body;
+        const allRoleIds =
+            roleIds || (isNaN(singleRoleId) ? [] : [singleRoleId]);
+
+        if (allRoleIds.length === 0) {
+            return next();
+        }
+
+        const rolesData = await db
+            .select()
+            .from(roles)
+            .where(inArray(roles.roleId, allRoleIds));
+
+        if (rolesData.length !== allRoleIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "One or more roles not found"
+                )
+            );
+        }
+
+        const orgIds = new Set(rolesData.map((role) => role.orgId));
+
+        for (const role of rolesData) {
+            const apiKeyOrgAccess = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, role.orgId!)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgAccess.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        `Key does not have access to organization for role ID ${role.roleId}`
+                    )
+                );
+            }
+        }
+
+        if (orgIds.size > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Roles must belong to the same organization"
+                )
+            );
+        }
+
+        const orgId = orgIds.values().next().value;
+
+        if (!orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Roles do not have an organization ID"
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            // Retrieve the API key's organization link if not already set
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                )
+                .limit(1);
+
+            if (apiKeyOrgRes.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Key does not have access to this organization"
+                    )
+                );
+            }
+
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        return next();
+    } catch (error) {
+        logger.error("Error verifying role access:", error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying role access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeySetResourceUsers.ts

@@ -0,0 +1,74 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs } from "@server/db/schemas";
+import { and, eq, inArray } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeySetResourceUsers(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    const apiKey = req.apiKey;
+    const userIds = req.body.userIds;
+
+    if (!apiKey) {
+        return next(
+            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+        );
+    }
+
+    if (!req.apiKeyOrg) {
+        return next(
+            createHttpError(
+                HttpCode.FORBIDDEN,
+                "Key does not have access to this organization"
+            )
+        );
+    }
+
+    if (!userIds) {
+        return next(createHttpError(HttpCode.BAD_REQUEST, "Invalid user IDs"));
+    }
+
+    if (userIds.length === 0) {
+        return next();
+    }
+
+    try {
+        const orgId = req.apiKeyOrg.orgId;
+        const userOrgsData = await db
+            .select()
+            .from(userOrgs)
+            .where(
+                and(
+                    inArray(userOrgs.userId, userIds),
+                    eq(userOrgs.orgId, orgId)
+                )
+            );
+
+        if (userOrgsData.length !== userIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to one or more specified users"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error checking if key has access to the specified users"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeySiteAccess.ts

@@ -0,0 +1,94 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import {
+    sites,
+    apiKeyOrg
+} from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeySiteAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const siteId = parseInt(
+            req.params.siteId || req.body.siteId || req.query.siteId
+        );
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (isNaN(siteId)) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid site ID")
+            );
+        }
+
+        const site = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (site.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!site[0].orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Site with ID ${siteId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgRes = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, site[0].orgId)
+                    )
+                );
+            req.apiKeyOrg = apiKeyOrgRes[0];
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying site access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyTargetAccess.ts

@@ -0,0 +1,117 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { resources, targets, apiKeyOrg } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyTargetAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const targetId = parseInt(req.params.targetId);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (isNaN(targetId)) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid target ID")
+            );
+        }
+
+        const [target] = await db
+            .select()
+            .from(targets)
+            .where(eq(targets.targetId, targetId))
+            .limit(1);
+
+        if (!target) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Target with ID ${targetId} not found`
+                )
+            );
+        }
+
+        const resourceId = target.resourceId;
+        if (!resourceId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Target with ID ${targetId} does not have a resource ID`
+                )
+            );
+        }
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        if (!resource.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `Resource with ID ${resourceId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.apiKeyOrg) {
+            const apiKeyOrgResult = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
+                        eq(apiKeyOrg.orgId, resource.orgId)
+                    )
+                )
+                .limit(1);
+            if (apiKeyOrgResult.length > 0) {
+                req.apiKeyOrg = apiKeyOrgResult[0];
+            }
+        }
+
+        if (!req.apiKeyOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this organization"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying target access"
+            )
+        );
+    }
+}

server/middlewares/integration/verifyApiKeyUserAccess.ts

@@ -0,0 +1,72 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyUserAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const apiKey = req.apiKey;
+        const reqUserId =
+            req.params.userId || req.body.userId || req.query.userId;
+
+        if (!apiKey) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
+            );
+        }
+
+        if (!reqUserId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid user ID")
+            );
+        }
+
+        if (!req.apiKeyOrg || !req.apiKeyOrg.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have organization access"
+                )
+            );
+        }
+
+        const orgId = req.apiKeyOrg.orgId;
+
+        const [userOrgRecord] = await db
+            .select()
+            .from(userOrgs)
+            .where(
+                and(eq(userOrgs.userId, reqUserId), eq(userOrgs.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!userOrgRecord) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Key does not have access to this user"
+                )
+            );
+        }
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error checking if key has access to this user"
+            )
+        );
+    }
+}

server/middlewares/verifyApiKeyAccess.ts

@@ -0,0 +1,104 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { db } from "@server/db";
+import { userOrgs, apiKeys, apiKeyOrg } from "@server/db/schemas";
+import { and, eq, or } from "drizzle-orm";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+
+export async function verifyApiKeyAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const userId = req.user!.userId;
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;
+
+        if (!userId) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
+            );
+        }
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (!apiKeyId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
+            );
+        }
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .innerJoin(apiKeyOrg, eq(apiKeys.apiKeyId, apiKeyOrg.apiKeyId))
+            .where(
+                and(eq(apiKeys.apiKeyId, apiKeyId), eq(apiKeyOrg.orgId, orgId))
+            )
+            .limit(1);
+
+        if (!apiKey.apiKeys) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `API key with ID ${apiKeyId} not found`
+                )
+            );
+        }
+
+        if (!apiKeyOrg.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    `API key with ID ${apiKeyId} does not have an organization ID`
+                )
+            );
+        }
+
+        if (!req.userOrg) {
+            const userOrgRole = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(
+                        eq(userOrgs.userId, userId),
+                        eq(userOrgs.orgId, apiKeyOrg.orgId)
+                    )
+                )
+                .limit(1);
+            req.userOrg = userOrgRole[0];
+        }
+
+        if (!req.userOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        const userOrgRoleId = req.userOrg.roleId;
+        req.userOrgRoleId = userOrgRoleId;
+
+        return next();
+    } catch (error) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying key access"
+            )
+        );
+    }
+}

server/middlewares/verifyValidLicense.ts

@@ -0,0 +1,33 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import license from "@server/license/license";
+
+export async function verifyValidLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const unlocked = await license.isUnlocked();
+        if (!unlocked) {
+            return next(
+                createHttpError(HttpCode.FORBIDDEN, "License is not valid")
+            );
+        }
+
+        return next();
+    } catch (e) {
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Error verifying license"
+            )
+        );
+    }
+}

server/openApi.ts

@@ -13,5 +13,6 @@ export enum OpenAPITags {
     Rule = "Rule",
     AccessToken = "Access Token",
     Idp = "Identity Provider",
-    Client = "Client"
+    Client = "Client",
+    ApiKey = "API Key"
 }

server/routers/apiKeys/createOrgApiKey.ts

@@ -0,0 +1,133 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { NextFunction, Request, Response } from "express";
+import db from "@server/db";
+import HttpCode from "@server/types/HttpCode";
+import { z } from "zod";
+import { apiKeyOrg, apiKeys } from "@server/db/schemas";
+import { fromError } from "zod-validation-error";
+import createHttpError from "http-errors";
+import response from "@server/lib/response";
+import moment from "moment";
+import {
+    generateId,
+    generateIdFromEntropySize
+} from "@server/auth/sessions/app";
+import logger from "@server/logger";
+import { hashPassword } from "@server/auth/password";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.object({
+    orgId: z.string().nonempty()
+});
+
+const bodySchema = z.object({
+    name: z.string().min(1).max(255)
+});
+
+export type CreateOrgApiKeyBody = z.infer<typeof bodySchema>;
+
+export type CreateOrgApiKeyResponse = {
+    apiKeyId: string;
+    name: string;
+    apiKey: string;
+    lastChars: string;
+    createdAt: string;
+};
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/api-key",
+    description: "Create a new API key scoped to the organization.",
+    tags: [OpenAPITags.Org, OpenAPITags.ApiKey],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createOrgApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    const parsedParams = paramsSchema.safeParse(req.params);
+
+    if (!parsedParams.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedParams.error).toString()
+            )
+        );
+    }
+
+    const parsedBody = bodySchema.safeParse(req.body);
+
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const { orgId } = parsedParams.data;
+    const { name } = parsedBody.data;
+
+    const apiKeyId = generateId(15);
+    const apiKey = generateIdFromEntropySize(25);
+    const apiKeyHash = await hashPassword(apiKey);
+    const lastChars = apiKey.slice(-4);
+    const createdAt = moment().toISOString();
+
+    await db.transaction(async (trx) => {
+        await trx.insert(apiKeys).values({
+            name,
+            apiKeyId,
+            apiKeyHash,
+            createdAt,
+            lastChars
+        });
+
+        await trx.insert(apiKeyOrg).values({
+            apiKeyId,
+            orgId
+        });
+    });
+
+    try {
+        return response<CreateOrgApiKeyResponse>(res, {
+            data: {
+                apiKeyId,
+                apiKey,
+                name,
+                lastChars,
+                createdAt
+            },
+            success: true,
+            error: false,
+            message: "API key created",
+            status: HttpCode.CREATED
+        });
+    } catch (e) {
+        logger.error(e);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to create API key"
+            )
+        );
+    }
+}

server/routers/apiKeys/createRootApiKey.ts

@@ -0,0 +1,105 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { NextFunction, Request, Response } from "express";
+import db from "@server/db";
+import HttpCode from "@server/types/HttpCode";
+import { z } from "zod";
+import { apiKeyOrg, apiKeys, orgs } from "@server/db/schemas";
+import { fromError } from "zod-validation-error";
+import createHttpError from "http-errors";
+import response from "@server/lib/response";
+import moment from "moment";
+import {
+    generateId,
+    generateIdFromEntropySize
+} from "@server/auth/sessions/app";
+import logger from "@server/logger";
+import { hashPassword } from "@server/auth/password";
+
+const bodySchema = z
+    .object({
+        name: z.string().min(1).max(255)
+    })
+    .strict();
+
+export type CreateRootApiKeyBody = z.infer<typeof bodySchema>;
+
+export type CreateRootApiKeyResponse = {
+    apiKeyId: string;
+    name: string;
+    apiKey: string;
+    lastChars: string;
+    createdAt: string;
+};
+
+export async function createRootApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    const parsedBody = bodySchema.safeParse(req.body);
+
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const { name } = parsedBody.data;
+
+    const apiKeyId = generateId(15);
+    const apiKey = generateIdFromEntropySize(25);
+    const apiKeyHash = await hashPassword(apiKey);
+    const lastChars = apiKey.slice(-4);
+    const createdAt = moment().toISOString();
+
+    await db.transaction(async (trx) => {
+        await trx.insert(apiKeys).values({
+            apiKeyId,
+            name,
+            apiKeyHash,
+            createdAt,
+            lastChars,
+            isRoot: true
+        });
+
+        const allOrgs = await trx.select().from(orgs);
+
+        for (const org of allOrgs) {
+            await trx.insert(apiKeyOrg).values({
+                apiKeyId,
+                orgId: org.orgId
+            });
+        }
+    });
+
+    try {
+        return response<CreateRootApiKeyResponse>(res, {
+            data: {
+                apiKeyId,
+                name,
+                apiKey,
+                lastChars,
+                createdAt
+            },
+            success: true,
+            error: false,
+            message: "API key created",
+            status: HttpCode.CREATED
+        });
+    } catch (e) {
+        logger.error(e);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to create API key"
+            )
+        );
+    }
+}

server/routers/apiKeys/deleteApiKey.ts

@@ -0,0 +1,81 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { apiKeys } from "@server/db/schemas";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty()
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/api-key/{apiKeyId}",
+    description: "Delete an API key.",
+    tags: [OpenAPITags.Org, OpenAPITags.ApiKey],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function deleteApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { apiKeyId } = parsedParams.data;
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .where(eq(apiKeys.apiKeyId, apiKeyId))
+            .limit(1);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `API Key with ID ${apiKeyId} not found`
+                )
+            );
+        }
+
+        await db.delete(apiKeys).where(eq(apiKeys.apiKeyId, apiKeyId));
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "API key deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/deleteOrgApiKey.ts

@@ -0,0 +1,104 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { apiKeyOrg, apiKeys } from "@server/db/schemas";
+import { and, eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty(),
+    orgId: z.string().nonempty()
+});
+
+export async function deleteOrgApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { apiKeyId, orgId } = parsedParams.data;
+
+        const [apiKey] = await db
+            .select()
+            .from(apiKeys)
+            .where(eq(apiKeys.apiKeyId, apiKeyId))
+            .innerJoin(
+                apiKeyOrg,
+                and(
+                    eq(apiKeys.apiKeyId, apiKeyOrg.apiKeyId),
+                    eq(apiKeyOrg.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `API Key with ID ${apiKeyId} not found`
+                )
+            );
+        }
+
+        if (apiKey.apiKeys.isRoot) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "Cannot delete root API key"
+                )
+            );
+        }
+
+        await db.transaction(async (trx) => {
+            await trx
+                .delete(apiKeyOrg)
+                .where(
+                    and(
+                        eq(apiKeyOrg.apiKeyId, apiKeyId),
+                        eq(apiKeyOrg.orgId, orgId)
+                    )
+                );
+
+            const apiKeyOrgs = await db
+                .select()
+                .from(apiKeyOrg)
+                .where(eq(apiKeyOrg.apiKeyId, apiKeyId));
+
+            if (apiKeyOrgs.length === 0) {
+                await trx.delete(apiKeys).where(eq(apiKeys.apiKeyId, apiKeyId));
+            }
+        });
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "API removed from organization",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/getApiKey.ts

@@ -0,0 +1,81 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { apiKeys } from "@server/db/schemas";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty()
+});
+
+async function query(apiKeyId: string) {
+    return await db
+        .select({
+            apiKeyId: apiKeys.apiKeyId,
+            lastChars: apiKeys.lastChars,
+            createdAt: apiKeys.createdAt,
+            isRoot: apiKeys.isRoot,
+            name: apiKeys.name
+        })
+        .from(apiKeys)
+        .where(eq(apiKeys.apiKeyId, apiKeyId))
+        .limit(1);
+}
+
+export type GetApiKeyResponse = NonNullable<
+    Awaited<ReturnType<typeof query>>[0]
+>;
+
+export async function getApiKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { apiKeyId } = parsedParams.data;
+
+        const [apiKey] = await query(apiKeyId);
+
+        if (!apiKey) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `API Key with ID ${apiKeyId} not found`
+                )
+            );
+        }
+
+        return response<GetApiKeyResponse>(res, {
+            data: apiKey,
+            success: true,
+            error: false,
+            message: "API key deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/index.ts

@@ -0,0 +1,16 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+export * from "./createRootApiKey";
+export * from "./deleteApiKey";
+export * from "./getApiKey";
+export * from "./listApiKeyActions";
+export * from "./listOrgApiKeys";
+export * from "./listApiKeyActions";
+export * from "./listRootApiKeys";
+export * from "./setApiKeyActions";
+export * from "./setApiKeyOrgs";
+export * from "./createOrgApiKey";
+export * from "./deleteOrgApiKey";

server/routers/apiKeys/listApiKeyActions.ts

@@ -0,0 +1,118 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { db } from "@server/db";
+import { actions, apiKeyActions, apiKeyOrg, apiKeys } from "@server/db/schemas";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/lib/response";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import { eq } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty()
+});
+
+const querySchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().positive()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+function queryActions(apiKeyId: string) {
+    return db
+        .select({
+            actionId: actions.actionId
+        })
+        .from(apiKeyActions)
+        .where(eq(apiKeyActions.apiKeyId, apiKeyId))
+        .innerJoin(actions, eq(actions.actionId, apiKeyActions.actionId));
+}
+
+export type ListApiKeyActionsResponse = {
+    actions: Awaited<ReturnType<typeof queryActions>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/api-key/{apiKeyId}/actions",
+    description:
+        "List all actions set for an API key.",
+    tags: [OpenAPITags.Org, OpenAPITags.ApiKey],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {}
+});
+
+export async function listApiKeyActions(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error)
+                )
+            );
+        }
+
+        const { limit, offset } = parsedQuery.data;
+        const { apiKeyId } = parsedParams.data;
+
+        const baseQuery = queryActions(apiKeyId);
+
+        const actionsList = await baseQuery.limit(limit).offset(offset);
+
+        return response<ListApiKeyActionsResponse>(res, {
+            data: {
+                actions: actionsList,
+                pagination: {
+                    total: actionsList.length,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "API keys retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/listOrgApiKeys.ts

@@ -0,0 +1,121 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { db } from "@server/db";
+import { apiKeyOrg, apiKeys } from "@server/db/schemas";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/lib/response";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import { eq, and } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const querySchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().positive()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+const paramsSchema = z.object({
+    orgId: z.string()
+});
+
+function queryApiKeys(orgId: string) {
+    return db
+        .select({
+            apiKeyId: apiKeys.apiKeyId,
+            orgId: apiKeyOrg.orgId,
+            lastChars: apiKeys.lastChars,
+            createdAt: apiKeys.createdAt,
+            name: apiKeys.name
+        })
+        .from(apiKeyOrg)
+        .where(and(eq(apiKeyOrg.orgId, orgId), eq(apiKeys.isRoot, false)))
+        .innerJoin(apiKeys, eq(apiKeys.apiKeyId, apiKeyOrg.apiKeyId));
+}
+
+export type ListOrgApiKeysResponse = {
+    apiKeys: Awaited<ReturnType<typeof queryApiKeys>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/api-keys",
+    description: "List all API keys for an organization",
+    tags: [OpenAPITags.Org, OpenAPITags.ApiKey],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {}
+});
+
+export async function listOrgApiKeys(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error)
+                )
+            );
+        }
+
+        const { limit, offset } = parsedQuery.data;
+        const { orgId } = parsedParams.data;
+
+        const baseQuery = queryApiKeys(orgId);
+
+        const apiKeysList = await baseQuery.limit(limit).offset(offset);
+
+        return response<ListOrgApiKeysResponse>(res, {
+            data: {
+                apiKeys: apiKeysList,
+                pagination: {
+                    total: apiKeysList.length,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "API keys retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/listRootApiKeys.ts

@@ -0,0 +1,90 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { db } from "@server/db";
+import { apiKeys } from "@server/db/schemas";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/lib/response";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import { eq } from "drizzle-orm";
+
+const querySchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().positive()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+function queryApiKeys() {
+    return db
+        .select({
+            apiKeyId: apiKeys.apiKeyId,
+            lastChars: apiKeys.lastChars,
+            createdAt: apiKeys.createdAt,
+            name: apiKeys.name
+        })
+        .from(apiKeys)
+        .where(eq(apiKeys.isRoot, true));
+}
+
+export type ListRootApiKeysResponse = {
+    apiKeys: Awaited<ReturnType<typeof queryApiKeys>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+export async function listRootApiKeys(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const baseQuery = queryApiKeys();
+
+        const apiKeysList = await baseQuery.limit(limit).offset(offset);
+
+        return response<ListRootApiKeysResponse>(res, {
+            data: {
+                apiKeys: apiKeysList,
+                pagination: {
+                    total: apiKeysList.length,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "API keys retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/setApiKeyActions.ts

@@ -0,0 +1,141 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { actions, apiKeyActions } from "@server/db/schemas";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { eq, and, inArray } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const bodySchema = z
+    .object({
+        actionIds: z
+            .array(z.string().nonempty())
+            .transform((v) => Array.from(new Set(v)))
+    })
+    .strict();
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/api-key/{apiKeyId}/actions",
+    description:
+        "Set actions for an API key. This will replace any existing actions.",
+    tags: [OpenAPITags.Org, OpenAPITags.ApiKey],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function setApiKeyActions(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { actionIds: newActionIds } = parsedBody.data;
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { apiKeyId } = parsedParams.data;
+
+        const actionsExist = await db
+            .select()
+            .from(actions)
+            .where(inArray(actions.actionId, newActionIds));
+
+        if (actionsExist.length !== newActionIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "One or more actions do not exist"
+                )
+            );
+        }
+
+        await db.transaction(async (trx) => {
+            const existingActions = await trx
+                .select()
+                .from(apiKeyActions)
+                .where(eq(apiKeyActions.apiKeyId, apiKeyId));
+
+            const existingActionIds = existingActions.map((a) => a.actionId);
+
+            const actionIdsToAdd = newActionIds.filter(
+                (id) => !existingActionIds.includes(id)
+            );
+            const actionIdsToRemove = existingActionIds.filter(
+                (id) => !newActionIds.includes(id)
+            );
+
+            if (actionIdsToRemove.length > 0) {
+                await trx
+                    .delete(apiKeyActions)
+                    .where(
+                        and(
+                            eq(apiKeyActions.apiKeyId, apiKeyId),
+                            inArray(apiKeyActions.actionId, actionIdsToRemove)
+                        )
+                    );
+            }
+
+            if (actionIdsToAdd.length > 0) {
+                const insertValues = actionIdsToAdd.map((actionId) => ({
+                    apiKeyId,
+                    actionId
+                }));
+                await trx.insert(apiKeyActions).values(insertValues);
+            }
+        });
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "API key actions updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/apiKeys/setApiKeyOrgs.ts

@@ -0,0 +1,122 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { apiKeyOrg, orgs } from "@server/db/schemas";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { eq, and, inArray } from "drizzle-orm";
+
+const bodySchema = z
+    .object({
+        orgIds: z
+            .array(z.string().nonempty())
+            .transform((v) => Array.from(new Set(v)))
+    })
+    .strict();
+
+const paramsSchema = z.object({
+    apiKeyId: z.string().nonempty()
+});
+
+export async function setApiKeyOrgs(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { orgIds: newOrgIds } = parsedBody.data;
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { apiKeyId } = parsedParams.data;
+
+        // make sure all orgs exist
+        const allOrgs = await db
+            .select()
+            .from(orgs)
+            .where(inArray(orgs.orgId, newOrgIds));
+
+        if (allOrgs.length !== newOrgIds.length) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "One or more orgs do not exist"
+                )
+            );
+        }
+
+        await db.transaction(async (trx) => {
+            const existingOrgs = await trx
+                .select({ orgId: apiKeyOrg.orgId })
+                .from(apiKeyOrg)
+                .where(eq(apiKeyOrg.apiKeyId, apiKeyId));
+
+            const existingOrgIds = existingOrgs.map((a) => a.orgId);
+
+            const orgIdsToAdd = newOrgIds.filter(
+                (id) => !existingOrgIds.includes(id)
+            );
+            const orgIdsToRemove = existingOrgIds.filter(
+                (id) => !newOrgIds.includes(id)
+            );
+
+            if (orgIdsToRemove.length > 0) {
+                await trx
+                    .delete(apiKeyOrg)
+                    .where(
+                        and(
+                            eq(apiKeyOrg.apiKeyId, apiKeyId),
+                            inArray(apiKeyOrg.orgId, orgIdsToRemove)
+                        )
+                    );
+            }
+
+            if (orgIdsToAdd.length > 0) {
+                const insertValues = orgIdsToAdd.map((orgId) => ({
+                    apiKeyId,
+                    orgId
+                }));
+                await trx.insert(apiKeyOrg).values(insertValues);
+            }
+
+            return response(res, {
+                data: {},
+                success: true,
+                error: false,
+                message: "API key orgs updated successfully",
+                status: HttpCode.OK
+            });
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/external.ts

@@ -12,6 +12,8 @@ import * as client from "./client";
 import * as supporterKey from "./supporterKey";
 import * as accessToken from "./accessToken";
 import * as idp from "./idp";
+import * as license from "./license";
+import * as apiKeys from "./apiKeys";
 import HttpCode from "@server/types/HttpCode";
 import {
     verifyAccessTokenAccess,
@@ -29,6 +31,8 @@ import {
     verifyUserIsServerAdmin,
     verifyIsLoggedInUser,
     verifyClientAccess,
+    verifyApiKeyAccess,
+    verifyValidLicense
 } from "@server/middlewares";
 import { verifyUserHasAction } from "../middlewares/verifyUserHasAction";
 import { ActionsEnum } from "@server/auth/actions";
@@ -498,7 +502,15 @@ authenticated.delete(
     user.adminRemoveUser
 );
 
+authenticated.put(
+    "/org/:orgId/user",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.createOrgUser),
+    user.createOrgUser
+);
+
 authenticated.get("/org/:orgId/user/:userId", verifyOrgAccess, user.getOrgUser);
+
 authenticated.get(
     "/org/:orgId/users",
     verifyOrgAccess,
@@ -567,6 +579,155 @@ authenticated.get("/idp", verifyUserIsServerAdmin, idp.listIdps);
 
 authenticated.get("/idp/:idpId", verifyUserIsServerAdmin, idp.getIdp);
 
+authenticated.put(
+    "/idp/:idpId/org/:orgId",
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    idp.createIdpOrgPolicy
+);
+
+authenticated.post(
+    "/idp/:idpId/org/:orgId",
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    idp.updateIdpOrgPolicy
+);
+
+authenticated.delete(
+    "/idp/:idpId/org/:orgId",
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    idp.deleteIdpOrgPolicy
+);
+
+authenticated.get(
+    "/idp/:idpId/org",
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    idp.listIdpOrgPolicies
+);
+
+authenticated.get("/idp", idp.listIdps); // anyone can see this; it's just a list of idp names and ids
+authenticated.get("/idp/:idpId", verifyUserIsServerAdmin, idp.getIdp);
+
+authenticated.post(
+    "/license/activate",
+    verifyUserIsServerAdmin,
+    license.activateLicense
+);
+
+authenticated.get(
+    "/license/keys",
+    verifyUserIsServerAdmin,
+    license.listLicenseKeys
+);
+
+authenticated.delete(
+    "/license/:licenseKey",
+    verifyUserIsServerAdmin,
+    license.deleteLicenseKey
+);
+
+authenticated.post(
+    "/license/recheck",
+    verifyUserIsServerAdmin,
+    license.recheckStatus
+);
+
+authenticated.get(
+    `/api-key/:apiKeyId`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.getApiKey
+);
+
+authenticated.put(
+    `/api-key`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.createRootApiKey
+);
+
+authenticated.delete(
+    `/api-key/:apiKeyId`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.deleteApiKey
+);
+
+authenticated.get(
+    `/api-keys`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.listRootApiKeys
+);
+
+authenticated.get(
+    `/api-key/:apiKeyId/actions`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.listApiKeyActions
+);
+
+authenticated.post(
+    `/api-key/:apiKeyId/actions`,
+    verifyValidLicense,
+    verifyUserIsServerAdmin,
+    apiKeys.setApiKeyActions
+);
+
+authenticated.get(
+    `/org/:orgId/api-keys`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listApiKeys),
+    apiKeys.listOrgApiKeys
+);
+
+authenticated.post(
+    `/org/:orgId/api-key/:apiKeyId/actions`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyApiKeyAccess,
+    verifyUserHasAction(ActionsEnum.setApiKeyActions),
+    apiKeys.setApiKeyActions
+);
+
+authenticated.get(
+    `/org/:orgId/api-key/:apiKeyId/actions`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyApiKeyAccess,
+    verifyUserHasAction(ActionsEnum.listApiKeyActions),
+    apiKeys.listApiKeyActions
+);
+
+authenticated.put(
+    `/org/:orgId/api-key`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.createApiKey),
+    apiKeys.createOrgApiKey
+);
+
+authenticated.delete(
+    `/org/:orgId/api-key/:apiKeyId`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyApiKeyAccess,
+    verifyUserHasAction(ActionsEnum.deleteApiKey),
+    apiKeys.deleteOrgApiKey
+);
+
+authenticated.get(
+    `/org/:orgId/api-key/:apiKeyId`,
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyApiKeyAccess,
+    verifyUserHasAction(ActionsEnum.getApiKey),
+    apiKeys.getApiKey
+);
+
 // Auth routes
 export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);

server/routers/idp/createIdpOrgPolicy.ts

@@ -0,0 +1,129 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import config from "@server/lib/config";
+import { eq, and } from "drizzle-orm";
+import { idp, idpOrg } from "@server/db/schemas";
+
+const paramsSchema = z
+    .object({
+        idpId: z.coerce.number(),
+        orgId: z.string()
+    })
+    .strict();
+
+const bodySchema = z
+    .object({
+        roleMapping: z.string().optional(),
+        orgMapping: z.string().optional()
+    })
+    .strict();
+
+export type CreateIdpOrgPolicyResponse = {};
+
+registry.registerPath({
+    method: "put",
+    path: "/idp/{idpId}/org/{orgId}",
+    description: "Create an IDP policy for an existing IDP on an organization.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createIdpOrgPolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+        const { roleMapping, orgMapping } = parsedBody.data;
+
+        const [existing] = await db
+            .select()
+            .from(idp)
+            .leftJoin(
+                idpOrg,
+                and(eq(idpOrg.orgId, orgId), eq(idpOrg.idpId, idpId))
+            )
+            .where(eq(idp.idpId, idpId));
+
+        if (!existing?.idp) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP with this ID does not exist."
+                )
+            );
+        }
+
+        if (existing.idpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP org policy already exists."
+                )
+            );
+        }
+
+        await db.insert(idpOrg).values({
+            idpId,
+            orgId,
+            roleMapping,
+            orgMapping
+        });
+
+        return response<CreateIdpOrgPolicyResponse>(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Idp created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/createOidcIdp.ts

@@ -7,10 +7,11 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-import { idp, idpOidcConfig } from "@server/db/schemas";
+import { idp, idpOidcConfig, idpOrg, orgs } from "@server/db/schemas";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import license from "@server/license/license";
 
 const paramsSchema = z.object({}).strict();
 
@@ -67,7 +68,7 @@ export async function createOidcIdp(
             );
         }
 
-        const {
+        let {
             clientId,
             clientSecret,
             authUrl,
@@ -80,6 +81,10 @@ export async function createOidcIdp(
             autoProvision
         } = parsedBody.data;
 
+        if (!(await license.isUnlocked())) {
+            autoProvision = false;
+        }
+
         const key = config.getRawConfig().server.secret;
 
         const encryptedSecret = encrypt(clientSecret, key);

server/routers/idp/deleteIdp.ts

@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { idp, idpOidcConfig } from "@server/db/schemas";
+import { idp, idpOidcConfig, idpOrg } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
 
@@ -67,6 +67,11 @@ export async function deleteIdp(
                 .delete(idpOidcConfig)
                 .where(eq(idpOidcConfig.idpId, idpId));
 
+            // Delete IDP-org mappings
+            await trx
+                .delete(idpOrg)
+                .where(eq(idpOrg.idpId, idpId));
+
             // Delete the IDP itself
             await trx
                 .delete(idp)

server/routers/idp/deleteIdpOrgPolicy.ts

@@ -0,0 +1,95 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { idp, idpOrg } from "@server/db/schemas";
+import { eq, and } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z
+    .object({
+        idpId: z.coerce.number(),
+        orgId: z.string()
+    })
+    .strict();
+
+registry.registerPath({
+    method: "delete",
+    path: "/idp/{idpId}/org/{orgId}",
+    description: "Create an OIDC IdP for an organization.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function deleteIdpOrgPolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(idp)
+            .leftJoin(idpOrg, eq(idpOrg.orgId, orgId))
+            .where(and(eq(idp.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        if (!existing.idp) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP with this ID does not exist."
+                )
+            );
+        }
+
+        if (!existing.idpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "A policy for this IDP and org does not exist."
+                )
+            );
+        }
+
+        await db
+            .delete(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        return response<null>(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Policy deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/generateOidcUrl.ts

@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { idp, idpOidcConfig } from "@server/db/schemas";
+import { idp, idpOidcConfig, idpOrg } from "@server/db/schemas";
 import { and, eq } from "drizzle-orm";
 import * as arctic from "arctic";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
@@ -27,6 +27,10 @@ const bodySchema = z
     })
     .strict();
 
+const ensureTrailingSlash = (url: string): string => {
+    return url.endsWith('/') ? url : `${url}/`;
+};
+
 export type GenerateOidcUrlResponse = {
     redirectUrl: string;
 };
@@ -106,12 +110,13 @@ export async function generateOidcUrl(
         const codeVerifier = arctic.generateCodeVerifier();
         const state = arctic.generateState();
         const url = client.createAuthorizationURLWithPKCE(
-            existingIdp.idpOidcConfig.authUrl,
+            ensureTrailingSlash(existingIdp.idpOidcConfig.authUrl),
             state,
             arctic.CodeChallengeMethod.S256,
             codeVerifier,
             parsedScopes
         );
+        logger.debug("Generated OIDC URL", { url });
 
         const stateJwt = jsonwebtoken.sign(
             {

server/routers/idp/index.ts

@@ -5,3 +5,7 @@ export * from "./listIdps";
 export * from "./generateOidcUrl";
 export * from "./validateOidcCallback";
 export * from "./getIdp";
+export * from "./createIdpOrgPolicy";
+export * from "./deleteIdpOrgPolicy";
+export * from "./listIdpOrgPolicies";
+export * from "./updateIdpOrgPolicy";

server/routers/idp/listIdpOrgPolicies.ts

@@ -0,0 +1,121 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { idpOrg } from "@server/db/schemas";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { eq, sql } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.object({
+    idpId: z.coerce.number()
+});
+
+const querySchema = z
+    .object({
+        limit: z
+            .string()
+            .optional()
+            .default("1000")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative()),
+        offset: z
+            .string()
+            .optional()
+            .default("0")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative())
+    })
+    .strict();
+
+async function query(idpId: number, limit: number, offset: number) {
+    const res = await db
+        .select()
+        .from(idpOrg)
+        .where(eq(idpOrg.idpId, idpId))
+        .limit(limit)
+        .offset(offset);
+    return res;
+}
+
+export type ListIdpOrgPoliciesResponse = {
+    policies: NonNullable<Awaited<ReturnType<typeof query>>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/idp/{idpId}/org",
+    description: "List all org policies on an IDP.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {}
+});
+
+export async function listIdpOrgPolicies(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { idpId } = parsedParams.data;
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const list = await query(idpId, limit, offset);
+
+        const [{ count }] = await db
+            .select({ count: sql<number>`count(*)` })
+            .from(idpOrg)
+            .where(eq(idpOrg.idpId, idpId));
+
+        return response<ListIdpOrgPoliciesResponse>(res, {
+            data: {
+                policies: list,
+                pagination: {
+                    total: count,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Policies retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/listIdps.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { idp } from "@server/db/schemas";
+import { domains, idp, orgDomains, users, idpOrg } from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -33,8 +33,10 @@ async function query(limit: number, offset: number) {
             idpId: idp.idpId,
             name: idp.name,
             type: idp.type,
+            orgCount: sql<number>`count(${idpOrg.orgId})`
         })
         .from(idp)
+        .leftJoin(idpOrg, sql`${idp.idpId} = ${idpOrg.idpId}`)
         .groupBy(idp.idpId)
         .limit(limit)
         .offset(offset);
@@ -46,6 +48,7 @@ export type ListIdpsResponse = {
         idpId: number;
         name: string;
         type: string;
+        orgCount: number;
     }>;
     pagination: {
         total: number;

server/routers/idp/oidcAutoProvision.ts

@@ -0,0 +1,233 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import {
+    createSession,
+    generateId,
+    generateSessionToken,
+    serializeSessionCookie
+} from "@server/auth/sessions/app";
+import db from "@server/db";
+import { Idp, idpOrg, orgs, roles, User, userOrgs, users } from "@server/db/schemas";
+import logger from "@server/logger";
+import { UserType } from "@server/types/UserTypes";
+import { eq, and, inArray } from "drizzle-orm";
+import jmespath from "jmespath";
+import { Request, Response } from "express";
+
+export async function oidcAutoProvision({
+    idp,
+    claims,
+    existingUser,
+    userIdentifier,
+    email,
+    name,
+    req,
+    res
+}: {
+    idp: Idp;
+    claims: any;
+    existingUser?: User;
+    userIdentifier: string;
+    email?: string;
+    name?: string;
+    req: Request;
+    res: Response;
+}) {
+    const allOrgs = await db.select().from(orgs);
+
+    const defaultRoleMapping = idp.defaultRoleMapping;
+    const defaultOrgMapping = idp.defaultOrgMapping;
+
+    let userOrgInfo: { orgId: string; roleId: number }[] = [];
+    for (const org of allOrgs) {
+        const [idpOrgRes] = await db
+            .select()
+            .from(idpOrg)
+            .where(
+                and(eq(idpOrg.idpId, idp.idpId), eq(idpOrg.orgId, org.orgId))
+            );
+
+        let roleId: number | undefined = undefined;
+
+        const orgMapping = idpOrgRes?.orgMapping || defaultOrgMapping;
+        const hydratedOrgMapping = hydrateOrgMapping(orgMapping, org.orgId);
+
+        if (hydratedOrgMapping) {
+            logger.debug("Hydrated Org Mapping", {
+                hydratedOrgMapping
+            });
+            const orgId = jmespath.search(claims, hydratedOrgMapping);
+            logger.debug("Extraced Org ID", { orgId });
+            if (orgId !== true && orgId !== org.orgId) {
+                // user not allowed to access this org
+                continue;
+            }
+        }
+
+        const roleMapping = idpOrgRes?.roleMapping || defaultRoleMapping;
+        if (roleMapping) {
+            logger.debug("Role Mapping", { roleMapping });
+            const roleName = jmespath.search(claims, roleMapping);
+
+            if (!roleName) {
+                logger.error("Role name not found in the ID token", {
+                    roleName
+                });
+                continue;
+            }
+
+            const [roleRes] = await db
+                .select()
+                .from(roles)
+                .where(
+                    and(eq(roles.orgId, org.orgId), eq(roles.name, roleName))
+                );
+
+            if (!roleRes) {
+                logger.error("Role not found", {
+                    orgId: org.orgId,
+                    roleName
+                });
+                continue;
+            }
+
+            roleId = roleRes.roleId;
+
+            userOrgInfo.push({
+                orgId: org.orgId,
+                roleId
+            });
+        }
+    }
+
+    logger.debug("User org info", { userOrgInfo });
+
+    let existingUserId = existingUser?.userId;
+
+    // sync the user with the orgs and roles
+    await db.transaction(async (trx) => {
+        let userId = existingUser?.userId;
+
+        // create user if not exists
+        if (!existingUser) {
+            userId = generateId(15);
+
+            await trx.insert(users).values({
+                userId,
+                username: userIdentifier,
+                email: email || null,
+                name: name || null,
+                type: UserType.OIDC,
+                idpId: idp.idpId,
+                emailVerified: true, // OIDC users are always verified
+                dateCreated: new Date().toISOString()
+            });
+        } else {
+            // set the name and email
+            await trx
+                .update(users)
+                .set({
+                    username: userIdentifier,
+                    email: email || null,
+                    name: name || null
+                })
+                .where(eq(users.userId, userId!));
+        }
+
+        existingUserId = userId;
+
+        // get all current user orgs
+        const currentUserOrgs = await trx
+            .select()
+            .from(userOrgs)
+            .where(eq(userOrgs.userId, userId!));
+
+        // Delete orgs that are no longer valid
+        const orgsToDelete = currentUserOrgs.filter(
+            (currentOrg) =>
+                !userOrgInfo.some((newOrg) => newOrg.orgId === currentOrg.orgId)
+        );
+
+        if (orgsToDelete.length > 0) {
+            await trx.delete(userOrgs).where(
+                and(
+                    eq(userOrgs.userId, userId!),
+                    inArray(
+                        userOrgs.orgId,
+                        orgsToDelete.map((org) => org.orgId)
+                    )
+                )
+            );
+        }
+
+        // Update roles for existing orgs where the role has changed
+        const orgsToUpdate = currentUserOrgs.filter((currentOrg) => {
+            const newOrg = userOrgInfo.find(
+                (newOrg) => newOrg.orgId === currentOrg.orgId
+            );
+            return newOrg && newOrg.roleId !== currentOrg.roleId;
+        });
+
+        if (orgsToUpdate.length > 0) {
+            for (const org of orgsToUpdate) {
+                const newRole = userOrgInfo.find(
+                    (newOrg) => newOrg.orgId === org.orgId
+                );
+                if (newRole) {
+                    await trx
+                        .update(userOrgs)
+                        .set({ roleId: newRole.roleId })
+                        .where(
+                            and(
+                                eq(userOrgs.userId, userId!),
+                                eq(userOrgs.orgId, org.orgId)
+                            )
+                        );
+                }
+            }
+        }
+
+        // Add new orgs that don't exist yet
+        const orgsToAdd = userOrgInfo.filter(
+            (newOrg) =>
+                !currentUserOrgs.some(
+                    (currentOrg) => currentOrg.orgId === newOrg.orgId
+                )
+        );
+
+        if (orgsToAdd.length > 0) {
+            await trx.insert(userOrgs).values(
+                orgsToAdd.map((org) => ({
+                    userId: userId!,
+                    orgId: org.orgId,
+                    roleId: org.roleId,
+                    dateCreated: new Date().toISOString()
+                }))
+            );
+        }
+    });
+
+    const token = generateSessionToken();
+    const sess = await createSession(token, existingUserId!);
+    const isSecure = req.protocol === "https";
+    const cookie = serializeSessionCookie(
+        token,
+        isSecure,
+        new Date(sess.expiresAt)
+    );
+
+    res.appendHeader("Set-Cookie", cookie);
+}
+
+function hydrateOrgMapping(
+    orgMapping: string | null,
+    orgId: string
+): string | undefined {
+    if (!orgMapping) {
+        return undefined;
+    }
+    return orgMapping.split("{{orgId}}").join(orgId);
+}

server/routers/idp/updateIdpOrgPolicy.ts

@@ -0,0 +1,131 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { eq, and } from "drizzle-orm";
+import { idp, idpOrg } from "@server/db/schemas";
+
+const paramsSchema = z
+    .object({
+        idpId: z.coerce.number(),
+        orgId: z.string()
+    })
+    .strict();
+
+const bodySchema = z
+    .object({
+        roleMapping: z.string().optional(),
+        orgMapping: z.string().optional()
+    })
+    .strict();
+
+export type UpdateIdpOrgPolicyResponse = {};
+
+registry.registerPath({
+    method: "post",
+    path: "/idp/{idpId}/org/{orgId}",
+    description: "Update an IDP org policy.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function updateIdpOrgPolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+        const { roleMapping, orgMapping } = parsedBody.data;
+
+        // Check if IDP and policy exist
+        const [existing] = await db
+            .select()
+            .from(idp)
+            .leftJoin(
+                idpOrg,
+                and(eq(idpOrg.orgId, orgId), eq(idpOrg.idpId, idpId))
+            )
+            .where(eq(idp.idpId, idpId));
+
+        if (!existing?.idp) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP with this ID does not exist."
+                )
+            );
+        }
+
+        if (!existing.idpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "A policy for this IDP and org does not exist."
+                )
+            );
+        }
+
+        // Update the policy
+        await db
+            .update(idpOrg)
+            .set({
+                roleMapping,
+                orgMapping
+            })
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        return response<UpdateIdpOrgPolicyResponse>(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Policy updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/updateOidcIdp.ts

@@ -11,6 +11,7 @@ import { idp, idpOidcConfig } from "@server/db/schemas";
 import { eq } from "drizzle-orm";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import license from "@server/license/license";
 
 const paramsSchema = z
     .object({
@@ -41,7 +42,7 @@ export type UpdateIdpResponse = {
 
 registry.registerPath({
     method: "post",
-    path: "/idp/:idpId/oidc",
+    path: "/idp/{idpId}/oidc",
     description: "Update an OIDC IdP.",
     tags: [OpenAPITags.Idp],
     request: {
@@ -84,7 +85,7 @@ export async function updateOidcIdp(
         }
 
         const { idpId } = parsedParams.data;
-        const {
+        let {
             clientId,
             clientSecret,
             authUrl,
@@ -99,6 +100,10 @@ export async function updateOidcIdp(
             defaultOrgMapping
         } = parsedBody.data;
 
+        if (!(await license.isUnlocked())) {
+            autoProvision = false;
+        }
+
         // Check if IDP exists and is of type OIDC
         const [existingIdp] = await db
             .select()

server/routers/idp/validateOidcCallback.ts

@@ -1,22 +1,30 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
+import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import {
-    idp,
-    idpOidcConfig,
-    users
-} from "@server/db/schemas";
-import { and, eq } from "drizzle-orm";
+import { idp, idpOidcConfig, users } from "@server/db/schemas";
+import { and, eq, inArray } from "drizzle-orm";
 import * as arctic from "arctic";
 import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
 import jmespath from "jmespath";
 import jsonwebtoken from "jsonwebtoken";
 import config from "@server/lib/config";
+import {
+    createSession,
+    generateSessionToken,
+    serializeSessionCookie
+} from "@server/auth/sessions/app";
 import { decrypt } from "@server/lib/crypto";
+import { oidcAutoProvision } from "./oidcAutoProvision";
+import license from "@server/license/license";
+
+const ensureTrailingSlash = (url: string): string => {
+    return url.endsWith('/') ? url : `${url}/`;
+};
 
 const paramsSchema = z
     .object({
@@ -146,7 +154,7 @@ export async function validateOidcCallback(
         }
 
         const tokens = await client.validateAuthorizationCode(
-            existingIdp.idpOidcConfig.tokenUrl,
+            ensureTrailingSlash(existingIdp.idpOidcConfig.tokenUrl),
             code,
             codeVerifier
         );
@@ -202,42 +210,54 @@ export async function validateOidcCallback(
             );
 
         if (existingIdp.idp.autoProvision) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Auto provisioning is not supported"
-                )
-            );
+            if (!(await license.isUnlocked())) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Auto-provisioning is not available"
+                    )
+                );
+            }
+            await oidcAutoProvision({
+                idp: existingIdp.idp,
+                userIdentifier,
+                email,
+                name,
+                claims,
+                existingUser,
+                req,
+                res
+            });
         } else {
             if (!existingUser) {
                 return next(
                     createHttpError(
                         HttpCode.UNAUTHORIZED,
-                        "User not found in the IdP"
+                        "User not provisioned in the system"
                     )
                 );
             }
-            //
-            // const token = generateSessionToken();
-            // const sess = await createSession(token, existingUser.userId);
-            // const isSecure = req.protocol === "https";
-            // const cookie = serializeSessionCookie(
-            //     token,
-            //     isSecure,
-            //     new Date(sess.expiresAt)
-            // );
-            //
-            // res.appendHeader("Set-Cookie", cookie);
-            //
-            // return response<ValidateOidcUrlCallbackResponse>(res, {
-            //     data: {
-            //         redirectUrl: postAuthRedirectUrl
-            //     },
-            //     success: true,
-            //     error: false,
-            //     message: "OIDC callback validated successfully",
-            //     status: HttpCode.CREATED
-            // });
+
+            const token = generateSessionToken();
+            const sess = await createSession(token, existingUser.userId);
+            const isSecure = req.protocol === "https";
+            const cookie = serializeSessionCookie(
+                token,
+                isSecure,
+                new Date(sess.expiresAt)
+            );
+
+            res.appendHeader("Set-Cookie", cookie);
+
+            return response<ValidateOidcUrlCallbackResponse>(res, {
+                data: {
+                    redirectUrl: postAuthRedirectUrl
+                },
+                success: true,
+                error: false,
+                message: "OIDC callback validated successfully",
+                status: HttpCode.CREATED
+            });
         }
     } catch (error) {
         logger.error(error);
@@ -246,13 +266,3 @@ export async function validateOidcCallback(
         );
     }
 }
-
-function hydrateOrgMapping(
-    orgMapping: string | null,
-    orgId: string
-): string | undefined {
-    if (!orgMapping) {
-        return undefined;
-    }
-    return orgMapping.split("{{orgId}}").join(orgId);
-}

server/routers/integration.ts

@@ -0,0 +1,499 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import * as site from "./site";
+import * as org from "./org";
+import * as resource from "./resource";
+import * as domain from "./domain";
+import * as target from "./target";
+import * as user from "./user";
+import * as role from "./role";
+// import * as client from "./client";
+import * as accessToken from "./accessToken";
+import * as apiKeys from "./apiKeys";
+import * as idp from "./idp";
+import {
+    verifyApiKey,
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction,
+    verifyApiKeySiteAccess,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyTargetAccess,
+    verifyApiKeyRoleAccess,
+    verifyApiKeyUserAccess,
+    verifyApiKeySetResourceUsers,
+    verifyApiKeyAccessTokenAccess,
+    verifyApiKeyIsRoot
+} from "@server/middlewares";
+import HttpCode from "@server/types/HttpCode";
+import { Router } from "express";
+import { ActionsEnum } from "@server/auth/actions";
+
+export const unauthenticated = Router();
+
+unauthenticated.get("/", (_, res) => {
+    res.status(HttpCode.OK).json({ message: "Healthy" });
+});
+
+export const authenticated = Router();
+authenticated.use(verifyApiKey);
+
+authenticated.get(
+    "/org/checkId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.checkOrgId),
+    org.checkId
+);
+
+authenticated.put(
+    "/org",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.createOrg),
+    org.createOrg
+);
+
+authenticated.get(
+    "/orgs",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listOrgs),
+    org.listOrgs
+); // TODO we need to check the orgs here
+
+authenticated.get(
+    "/org/:orgId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getOrg),
+    org.getOrg
+);
+
+authenticated.post(
+    "/org/:orgId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateOrg),
+    org.updateOrg
+);
+
+authenticated.delete(
+    "/org/:orgId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteOrg),
+    org.deleteOrg
+);
+
+authenticated.put(
+    "/org/:orgId/site",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.createSite),
+    site.createSite
+);
+
+authenticated.get(
+    "/org/:orgId/sites",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listSites),
+    site.listSites
+);
+
+authenticated.get(
+    "/org/:orgId/site/:niceId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getSite),
+    site.getSite
+);
+
+authenticated.get(
+    "/org/:orgId/pick-site-defaults",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.createSite),
+    site.pickSiteDefaults
+);
+
+authenticated.get(
+    "/site/:siteId",
+    verifyApiKeySiteAccess,
+    verifyApiKeyHasAction(ActionsEnum.getSite),
+    site.getSite
+);
+
+authenticated.post(
+    "/site/:siteId",
+    verifyApiKeySiteAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateSite),
+    site.updateSite
+);
+
+authenticated.delete(
+    "/site/:siteId",
+    verifyApiKeySiteAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteSite),
+    site.deleteSite
+);
+
+authenticated.put(
+    "/org/:orgId/site/:siteId/resource",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.createResource),
+    resource.createResource
+);
+
+authenticated.get(
+    "/site/:siteId/resources",
+    verifyApiKeySiteAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResources),
+    resource.listResources
+);
+
+authenticated.get(
+    "/org/:orgId/resources",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResources),
+    resource.listResources
+);
+
+authenticated.get(
+    "/org/:orgId/domains",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listOrgDomains),
+    domain.listDomains
+);
+
+authenticated.post(
+    "/org/:orgId/create-invite",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.inviteUser),
+    user.inviteUser
+);
+
+authenticated.get(
+    "/resource/:resourceId/roles",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
+    resource.listResourceRoles
+);
+
+authenticated.get(
+    "/resource/:resourceId/users",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
+    resource.listResourceUsers
+);
+
+authenticated.get(
+    "/resource/:resourceId",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.getResource),
+    resource.getResource
+);
+
+authenticated.post(
+    "/resource/:resourceId",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateResource),
+    resource.updateResource
+);
+
+authenticated.delete(
+    "/resource/:resourceId",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteResource),
+    resource.deleteResource
+);
+
+authenticated.put(
+    "/resource/:resourceId/target",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.createTarget),
+    target.createTarget
+);
+
+authenticated.get(
+    "/resource/:resourceId/targets",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listTargets),
+    target.listTargets
+);
+
+authenticated.put(
+    "/resource/:resourceId/rule",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.createResourceRule),
+    resource.createResourceRule
+);
+
+authenticated.get(
+    "/resource/:resourceId/rules",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceRules),
+    resource.listResourceRules
+);
+
+authenticated.post(
+    "/resource/:resourceId/rule/:ruleId",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateResourceRule),
+    resource.updateResourceRule
+);
+
+authenticated.delete(
+    "/resource/:resourceId/rule/:ruleId",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourceRule),
+    resource.deleteResourceRule
+);
+
+authenticated.get(
+    "/target/:targetId",
+    verifyApiKeyTargetAccess,
+    verifyApiKeyHasAction(ActionsEnum.getTarget),
+    target.getTarget
+);
+
+authenticated.post(
+    "/target/:targetId",
+    verifyApiKeyTargetAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateTarget),
+    target.updateTarget
+);
+
+authenticated.delete(
+    "/target/:targetId",
+    verifyApiKeyTargetAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteTarget),
+    target.deleteTarget
+);
+
+authenticated.put(
+    "/org/:orgId/role",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.createRole),
+    role.createRole
+);
+
+authenticated.get(
+    "/org/:orgId/roles",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listRoles),
+    role.listRoles
+);
+
+authenticated.delete(
+    "/role/:roleId",
+    verifyApiKeyRoleAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteRole),
+    role.deleteRole
+);
+
+authenticated.post(
+    "/role/:roleId/add/:userId",
+    verifyApiKeyRoleAccess,
+    verifyApiKeyUserAccess,
+    verifyApiKeyHasAction(ActionsEnum.addUserRole),
+    user.addUserRole
+);
+
+authenticated.post(
+    "/resource/:resourceId/roles",
+    verifyApiKeyResourceAccess,
+    verifyApiKeyRoleAccess,
+    verifyApiKeyHasAction(ActionsEnum.setResourceRoles),
+    resource.setResourceRoles
+);
+
+authenticated.post(
+    "/resource/:resourceId/users",
+    verifyApiKeyResourceAccess,
+    verifyApiKeySetResourceUsers,
+    verifyApiKeyHasAction(ActionsEnum.setResourceUsers),
+    resource.setResourceUsers
+);
+
+authenticated.post(
+    `/resource/:resourceId/password`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePassword),
+    resource.setResourcePassword
+);
+
+authenticated.post(
+    `/resource/:resourceId/pincode`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.setResourcePincode),
+    resource.setResourcePincode
+);
+
+authenticated.post(
+    `/resource/:resourceId/whitelist`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
+    resource.setResourceWhitelist
+);
+
+authenticated.get(
+    `/resource/:resourceId/whitelist`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.getResourceWhitelist),
+    resource.getResourceWhitelist
+);
+
+authenticated.post(
+    `/resource/:resourceId/transfer`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateResource),
+    resource.transferResource
+);
+
+authenticated.post(
+    `/resource/:resourceId/access-token`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.generateAccessToken),
+    accessToken.generateAccessToken
+);
+
+authenticated.delete(
+    `/access-token/:accessTokenId`,
+    verifyApiKeyAccessTokenAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteAcessToken),
+    accessToken.deleteAccessToken
+);
+
+authenticated.get(
+    `/org/:orgId/access-tokens`,
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
+    accessToken.listAccessTokens
+);
+
+authenticated.get(
+    `/resource/:resourceId/access-tokens`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
+    accessToken.listAccessTokens
+);
+
+authenticated.get(
+    "/org/:orgId/user/:userId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getOrgUser),
+    user.getOrgUser
+);
+
+authenticated.get(
+    "/org/:orgId/users",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listUsers),
+    user.listUsers
+);
+
+authenticated.delete(
+    "/org/:orgId/user/:userId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyUserAccess,
+    verifyApiKeyHasAction(ActionsEnum.removeUser),
+    user.removeUserOrg
+);
+
+// authenticated.put(
+//     "/newt",
+//     verifyApiKeyHasAction(ActionsEnum.createNewt),
+//     newt.createNewt
+// );
+
+authenticated.get(
+    `/org/:orgId/api-keys`,
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listApiKeys),
+    apiKeys.listOrgApiKeys
+);
+
+authenticated.post(
+    `/org/:orgId/api-key/:apiKeyId/actions`,
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.setApiKeyActions),
+    apiKeys.setApiKeyActions
+);
+
+authenticated.get(
+    `/org/:orgId/api-key/:apiKeyId/actions`,
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listApiKeyActions),
+    apiKeys.listApiKeyActions
+);
+
+authenticated.put(
+    `/org/:orgId/api-key`,
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.createApiKey),
+    apiKeys.createOrgApiKey
+);
+
+authenticated.delete(
+    `/org/:orgId/api-key/:apiKeyId`,
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteApiKey),
+    apiKeys.deleteApiKey
+);
+
+authenticated.put(
+    "/idp/oidc",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.createIdp),
+    idp.createOidcIdp
+);
+
+authenticated.post(
+    "/idp/:idpId/oidc",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.updateIdp),
+    idp.updateOidcIdp
+);
+
+authenticated.delete(
+    "/idp/:idpId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteIdp),
+    idp.deleteIdp
+);
+
+authenticated.get(
+    "/idp",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listIdps),
+    idp.listIdps
+);
+
+authenticated.get(
+    "/idp/:idpId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.getIdp),
+    idp.getIdp
+);
+
+authenticated.put(
+    "/idp/:idpId/org/:orgId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.createIdpOrg),
+    idp.createIdpOrgPolicy
+);
+
+authenticated.post(
+    "/idp/:idpId/org/:orgId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.updateIdpOrg),
+    idp.updateIdpOrgPolicy
+);
+
+authenticated.delete(
+    "/idp/:idpId/org/:orgId",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.deleteIdpOrg),
+    idp.deleteIdpOrgPolicy
+);
+
+authenticated.get(
+    "/idp/:idpId/org",
+    verifyApiKeyIsRoot,
+    verifyApiKeyHasAction(ActionsEnum.listIdpOrgs),
+    idp.listIdpOrgPolicies
+);

server/routers/internal.ts

@@ -5,6 +5,7 @@ import * as resource from "./resource";
 import * as badger from "./badger";
 import * as auth from "@server/routers/auth";
 import * as supporterKey from "@server/routers/supporterKey";
+import * as license from "@server/routers/license";
 import HttpCode from "@server/types/HttpCode";
 import {
     verifyResourceAccess,
@@ -37,6 +38,11 @@ internalRouter.get(
     supporterKey.isSupporterKeyVisible
 );
 
+internalRouter.get(
+    `/license/status`,
+    license.getLicenseStatus
+);
+
 // Gerbil routes
 const gerbilRouter = Router();
 internalRouter.use("/gerbil", gerbilRouter);

server/routers/license/activateLicense.ts

@@ -0,0 +1,62 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib";
+import license, { LicenseStatus } from "@server/license/license";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const bodySchema = z
+    .object({
+        licenseKey: z.string().min(1).max(255)
+    })
+    .strict();
+
+export type ActivateLicenseStatus = LicenseStatus;
+
+export async function activateLicense(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { licenseKey } = parsedBody.data;
+
+        try {
+            const status = await license.activateLicenseKey(licenseKey);
+            return sendResponse(res, {
+                data: status,
+                success: true,
+                error: false,
+                message: "License key activated successfully",
+                status: HttpCode.OK
+            });
+        } catch (e) {
+            logger.error(e);
+            return next(
+                createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `${e}`)
+            );
+        }
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/license/deleteLicenseKey.ts

@@ -0,0 +1,78 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import db from "@server/db";
+import { eq } from "drizzle-orm";
+import { licenseKey } from "@server/db/schemas";
+import license, { LicenseStatus } from "@server/license/license";
+import { encrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+
+const paramsSchema = z
+    .object({
+        licenseKey: z.string().min(1).max(255)
+    })
+    .strict();
+
+export type DeleteLicenseKeyResponse = LicenseStatus;
+
+export async function deleteLicenseKey(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { licenseKey: key } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(licenseKey)
+            .where(eq(licenseKey.licenseKeyId, key))
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `License key ${key} not found`
+                )
+            );
+        }
+
+        await db.delete(licenseKey).where(eq(licenseKey.licenseKeyId, key));
+
+        const status = await license.forceRecheck();
+
+        return sendResponse(res, {
+            data: status,
+            success: true,
+            error: false,
+            message: "License key deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/license/getLicenseStatus.ts

@@ -0,0 +1,36 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib";
+import license, { LicenseStatus } from "@server/license/license";
+
+export type GetLicenseStatusResponse = LicenseStatus;
+
+export async function getLicenseStatus(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const status = await license.check();
+
+        return sendResponse<GetLicenseStatusResponse>(res, {
+            data: status,
+            success: true,
+            error: false,
+            message: "Got status",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/license/index.ts

@@ -0,0 +1,10 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+export * from "./getLicenseStatus";
+export * from "./activateLicense";
+export * from "./listLicenseKeys";
+export * from "./deleteLicenseKey";
+export * from "./recheckStatus";

server/routers/license/listLicenseKeys.ts

@@ -0,0 +1,36 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib";
+import license, { LicenseKeyCache } from "@server/license/license";
+
+export type ListLicenseKeysResponse = LicenseKeyCache[];
+
+export async function listLicenseKeys(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const keys = license.listKeys();
+
+        return sendResponse<ListLicenseKeysResponse>(res, {
+            data: keys,
+            success: true,
+            error: false,
+            message: "Successfully retrieved license keys",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/license/recheckStatus.ts

@@ -0,0 +1,42 @@
+// This file is licensed under the Fossorial Commercial License.
+// Unauthorized use, copying, modification, or distribution is strictly prohibited.
+//
+// Copyright (c) 2025 Fossorial LLC. All rights reserved.
+
+import { Request, Response, NextFunction } from "express";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { response as sendResponse } from "@server/lib";
+import license, { LicenseStatus } from "@server/license/license";
+
+export type RecheckStatusResponse = LicenseStatus;
+
+export async function recheckStatus(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        try {
+            const status = await license.forceRecheck();
+            return sendResponse(res, {
+                data: status,
+                success: true,
+                error: false,
+                message: "License status rechecked successfully",
+                status: HttpCode.OK
+            });
+        } catch (e) {
+            logger.error(e);
+            return next(
+                createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `${e}`)
+            );
+        }
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/org/listUserOrgs.ts

@@ -31,7 +31,7 @@ const listOrgsSchema = z.object({
 
 registry.registerPath({
     method: "get",
-    path: "/user/:userId/orgs",
+    path: "/user/{userId}/orgs",
     description: "List all organizations for a user.",
     tags: [OpenAPITags.Org, OpenAPITags.User],
     request: {

server/routers/resource/createResource.ts

@@ -39,7 +39,6 @@ const createHttpResourceSchema = z
         isBaseDomain: z.boolean().optional(),
         siteId: z.number(),
         http: z.boolean(),
-        protocol: z.string(),
         domainId: z.string()
     })
     .strict()
@@ -203,7 +202,7 @@ async function createHttpResource(
         );
     }
 
-    const { name, subdomain, isBaseDomain, http, protocol, domainId } =
+    const { name, subdomain, isBaseDomain, http, domainId } =
         parsedBody.data;
 
     const [orgDomain] = await db
@@ -262,7 +261,7 @@ async function createHttpResource(
                 name,
                 subdomain,
                 http,
-                protocol,
+                protocol: "tcp",
                 ssl: true,
                 isBaseDomain
             })

server/routers/resource/listResources.ts

@@ -69,7 +69,9 @@ function queryResources(
                 http: resources.http,
                 protocol: resources.protocol,
                 proxyPort: resources.proxyPort,
-                enabled: resources.enabled
+                enabled: resources.enabled,
+                tlsServerName: resources.tlsServerName,
+                setHostHeader: resources.setHostHeader
             })
             .from(resources)
             .leftJoin(sites, eq(resources.siteId, sites.siteId))
@@ -103,7 +105,9 @@ function queryResources(
                 http: resources.http,
                 protocol: resources.protocol,
                 proxyPort: resources.proxyPort,
-                enabled: resources.enabled
+                enabled: resources.enabled,
+                tlsServerName: resources.tlsServerName,
+                setHostHeader: resources.setHostHeader
             })
             .from(resources)
             .leftJoin(sites, eq(resources.siteId, sites.siteId))

server/routers/resource/updateResource.ts

@@ -16,6 +16,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import config from "@server/lib/config";
+import { tlsNameSchema } from "@server/lib/schemas";
 import { subdomainSchema } from "@server/lib/schemas";
 import { registry } from "@server/openApi";
 import { OpenAPITags } from "@server/openApi";
@@ -42,7 +43,10 @@ const updateHttpResourceBodySchema = z
         isBaseDomain: z.boolean().optional(),
         applyRules: z.boolean().optional(),
         domainId: z.string().optional(),
-        enabled: z.boolean().optional()
+        enabled: z.boolean().optional(),
+        stickySession: z.boolean().optional(),
+        tlsServerName: z.string().optional(),
+        setHostHeader: z.string().optional()
     })
     .strict()
     .refine((data) => Object.keys(data).length > 0, {
@@ -69,6 +73,24 @@ const updateHttpResourceBodySchema = z
         {
             message: "Base domain resources are not allowed"
         }
+    )
+    .refine(
+        (data) => {
+            if (data.tlsServerName) {
+                return tlsNameSchema.safeParse(data.tlsServerName).success;
+            }
+            return true;
+        },
+        { message: "Invalid TLS Server Name. Use domain name format, or save empty to remove the TLS Server Name." }
+    )
+    .refine(
+        (data) => {
+            if (data.setHostHeader) {
+                return tlsNameSchema.safeParse(data.setHostHeader).success;
+            }
+            return true;
+        },
+        { message: "Invalid custom Host Header value. Use domain name format, or save empty to unset custom Host Header." }
     );
 
 export type UpdateResourceResponse = Resource;
@@ -77,6 +99,7 @@ const updateRawResourceBodySchema = z
     .object({
         name: z.string().min(1).max(255).optional(),
         proxyPort: z.number().int().min(1).max(65535).optional(),
+        stickySession: z.boolean().optional(),
         enabled: z.boolean().optional()
     })
     .strict()

server/routers/supporterKey/isSupporterKeyVisible.ts

@@ -7,6 +7,7 @@ import config from "@server/lib/config";
 import db from "@server/db";
 import { count } from "drizzle-orm";
 import { users } from "@server/db/schemas";
+import license from "@server/license/license";
 
 export type IsSupporterKeyVisibleResponse = {
     visible: boolean;
@@ -26,6 +27,12 @@ export async function isSupporterKeyVisible(
 
         let visible = !hidden && key?.valid !== true;
 
+        const licenseStatus = await license.check();
+
+        if (licenseStatus.isLicenseValid) {
+            visible = false;
+        }
+
         if (key?.tier === "Limited Supporter") {
             const [numUsers] = await db.select({ count: count() }).from(users);
 

server/routers/supporterKey/validateSupporterKey.ts

@@ -44,7 +44,7 @@ export async function validateSupporterKey(
         const { githubUsername, key } = parsedBody.data;
 
         const response = await fetch(
-            "https://api.dev.fossorial.io/api/v1/license/validate",
+            "https://api.fossorial.io/api/v1/license/validate",
             {
                 method: "POST",
                 headers: {

server/routers/traefik/getTraefikConfig.ts

@@ -40,7 +40,10 @@ export async function traefikConfigProvider(
                     org: {
                         orgId: orgs.orgId
                     },
-                    enabled: resources.enabled
+                    enabled: resources.enabled,
+                    stickySession: resources.stickySession,
+                    tlsServerName: resources.tlsServerName,
+                    setHostHeader: resources.setHostHeader
                 })
                 .from(resources)
                 .innerJoin(sites, eq(sites.siteId, resources.siteId))
@@ -102,7 +105,10 @@ export async function traefikConfigProvider(
                             [badgerMiddlewareName]: {
                                 apiBaseUrl: new URL(
                                     "/api/v1",
-                                    `http://${config.getRawConfig().server.internal_hostname}:${
+                                    `http://${
+                                        config.getRawConfig().server
+                                            .internal_hostname
+                                    }:${
                                         config.getRawConfig().server
                                             .internal_port
                                     }`
@@ -139,6 +145,8 @@ export async function traefikConfigProvider(
             const routerName = `${resource.resourceId}-router`;
             const serviceName = `${resource.resourceId}-service`;
             const fullDomain = `${resource.fullDomain}`;
+            const transportName = `${resource.resourceId}-transport`;
+            const hostHeaderMiddlewareName = `${resource.resourceId}-host-header-middleware`;
 
             if (!resource.enabled) {
                 continue;
@@ -275,9 +283,57 @@ export async function traefikConfigProvider(
                                         url: `${target.method}://${ip}:${target.internalPort}`
                                     };
                                 }
-                            })
+                            }),
+                        ...(resource.stickySession
+                            ? {
+                                  sticky: {
+                                      cookie: {
+                                          name: "p_sticky", // TODO: make this configurable via config.yml like other cookies
+                                          secure: resource.ssl,
+                                          httpOnly: true
+                                      }
+                                  }
+                              }
+                            : {})
                     }
                 };
+
+                // Add the serversTransport if TLS server name is provided
+                if (resource.tlsServerName) {
+                    if (!config_output.http.serversTransports) {
+                        config_output.http.serversTransports = {};
+                    }
+                    config_output.http.serversTransports![transportName] = {
+                        serverName: resource.tlsServerName,
+                        //unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
+                        // if defined in the static config and here. if not set, self-signed certs won't work
+                        insecureSkipVerify: true
+                    };
+                    config_output.http.services![serviceName].loadBalancer.serversTransport = transportName;
+                }
+
+                // Add the host header middleware
+                if (resource.setHostHeader) {
+                    if (!config_output.http.middlewares) {
+                        config_output.http.middlewares = {};
+                    }
+                    config_output.http.middlewares[hostHeaderMiddlewareName] =
+                        {
+                            headers: {
+                                customRequestHeaders: {
+                                    Host: resource.setHostHeader
+                                }
+                            }
+                        };
+                    if (!config_output.http.routers![routerName].middlewares) {
+                        config_output.http.routers![routerName].middlewares = [];
+                    }
+                    config_output.http.routers![routerName].middlewares = [
+                        ...config_output.http.routers![routerName].middlewares,
+                        hostHeaderMiddlewareName
+                    ];
+                }
+
             } else {
                 // Non-HTTP (TCP/UDP) configuration
                 const protocol = resource.protocol.toLowerCase();
@@ -335,7 +391,17 @@ export async function traefikConfigProvider(
                                         address: `${ip}:${target.internalPort}`
                                     };
                                 }
-                            })
+                            }),
+                        ...(resource.stickySession
+                            ? {
+                                  sticky: {
+                                      ipStrategy: {
+                                          depth: 0,
+                                          sourcePort: true
+                                      }
+                                  }
+                              }
+                            : {})
                     }
                 };
             }

server/routers/user/createOrgUser.ts

@@ -0,0 +1,207 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import db from "@server/db";
+import { and, eq } from "drizzle-orm";
+import { idp, idpOidcConfig, roles, userOrgs, users } from "@server/db/schemas";
+import { generateId } from "@server/auth/sessions/app";
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().nonempty()
+    })
+    .strict();
+
+const bodySchema = z
+    .object({
+        email: z.string().email().optional(),
+        username: z.string().nonempty(),
+        name: z.string().optional(),
+        type: z.enum(["internal", "oidc"]).optional(),
+        idpId: z.number().optional(),
+        roleId: z.number()
+    })
+    .strict();
+
+export type CreateOrgUserResponse = {};
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/user",
+    description: "Create an organization user.",
+    tags: [OpenAPITags.User, OpenAPITags.Org],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createOrgUser(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+        const { username, email, name, type, idpId, roleId } = parsedBody.data;
+
+        const [role] = await db
+            .select()
+            .from(roles)
+            .where(eq(roles.roleId, roleId));
+
+        if (!role) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Role ID not found")
+            );
+        }
+
+        if (type === "internal") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Internal users are not supported yet"
+                )
+            );
+        } else if (type === "oidc") {
+            if (!idpId) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "IDP ID is required for OIDC users"
+                    )
+                );
+            }
+
+            const [idpRes] = await db
+                .select()
+                .from(idp)
+                .innerJoin(idpOidcConfig, eq(idp.idpId, idpOidcConfig.idpId))
+                .where(eq(idp.idpId, idpId));
+
+            if (!idpRes) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, "IDP ID not found")
+                );
+            }
+
+            if (idpRes.idp.type !== "oidc") {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "IDP ID is not of type OIDC"
+                    )
+                );
+            }
+
+            const [existingUser] = await db
+                .select()
+                .from(users)
+                .where(eq(users.username, username));
+
+            if (existingUser) {
+                const [existingOrgUser] = await db
+                    .select()
+                    .from(userOrgs)
+                    .where(
+                        and(
+                            eq(userOrgs.orgId, orgId),
+                            eq(userOrgs.userId, existingUser.userId)
+                        )
+                    );
+
+                if (existingOrgUser) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "User already exists in this organization"
+                        )
+                    );
+                }
+
+                await db
+                    .insert(userOrgs)
+                    .values({
+                        orgId,
+                        userId: existingUser.userId,
+                        roleId: role.roleId
+                    })
+                    .returning();
+            } else {
+                const userId = generateId(15);
+
+                const [newUser] = await db
+                    .insert(users)
+                    .values({
+                        userId: userId,
+                        email,
+                        username,
+                        name,
+                        type: "oidc",
+                        idpId,
+                        dateCreated: new Date().toISOString(),
+                        emailVerified: true
+                    })
+                    .returning();
+
+                await db
+                    .insert(userOrgs)
+                    .values({
+                        orgId,
+                        userId: newUser.userId,
+                        roleId: role.roleId
+                    })
+                    .returning();
+            }
+        } else {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "User type is required")
+            );
+        }
+
+        return response<CreateOrgUserResponse>(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Org user created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/user/index.ts

@@ -9,3 +9,4 @@ export * from "./adminListUsers";
 export * from "./adminRemoveUser";
 export * from "./listInvitations";
 export * from "./removeInvitation";
+export * from "./createOrgUser";

server/setup/migrations.ts

@@ -19,6 +19,8 @@ import m15 from "./scripts/1.0.0-beta15";
 import m16 from "./scripts/1.0.0";
 import m17 from "./scripts/1.1.0";
 import m18 from "./scripts/1.2.0";
+import m19 from "./scripts/1.3.0";
+import { setHostMeta } from "./setHostMeta";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -37,7 +39,8 @@ const migrations = [
     { version: "1.0.0-beta.15", run: m15 },
     { version: "1.0.0", run: m16 },
     { version: "1.1.0", run: m17 },
-    { version: "1.2.0", run: m18 }
+    { version: "1.2.0", run: m18 },
+    { version: "1.3.0", run: m19 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scripts/1.3.0.ts

@@ -0,0 +1,205 @@
+import Database from "better-sqlite3";
+import path from "path";
+import fs from "fs";
+import yaml from "js-yaml";
+import { encodeBase32LowerCaseNoPadding } from "@oslojs/encoding";
+import { APP_PATH, configFilePath1, configFilePath2 } from "@server/lib/consts";
+
+const version = "1.3.0";
+const location = path.join(APP_PATH, "db", "db.sqlite");
+
+await migration();
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const db = new Database(location);
+
+    try {
+        db.pragma("foreign_keys = OFF");
+        db.transaction(() => {
+            db.exec(`
+                CREATE TABLE 'apiKeyActions' (
+                    'apiKeyId' text NOT NULL,
+                    'actionId' text NOT NULL,
+                    FOREIGN KEY ('apiKeyId') REFERENCES 'apiKeys'('apiKeyId') ON UPDATE no action ON DELETE cascade,
+                    FOREIGN KEY ('actionId') REFERENCES 'actions'('actionId') ON UPDATE no action ON DELETE cascade
+                );
+
+                CREATE TABLE 'apiKeyOrg' (
+                    'apiKeyId' text NOT NULL,
+                    'orgId' text NOT NULL,
+                    FOREIGN KEY ('apiKeyId') REFERENCES 'apiKeys'('apiKeyId') ON UPDATE no action ON DELETE cascade,
+                    FOREIGN KEY ('orgId') REFERENCES 'orgs'('orgId') ON UPDATE no action ON DELETE cascade
+                );
+
+                CREATE TABLE 'apiKeys' (
+                    'apiKeyId' text PRIMARY KEY NOT NULL,
+                    'name' text NOT NULL,
+                    'apiKeyHash' text NOT NULL,
+                    'lastChars' text NOT NULL,
+                    'dateCreated' text NOT NULL,
+                    'isRoot' integer DEFAULT false NOT NULL
+                );
+
+                CREATE TABLE 'hostMeta' (
+                    'hostMetaId' text PRIMARY KEY NOT NULL,
+                    'createdAt' integer NOT NULL
+                );
+
+                CREATE TABLE 'idp' (
+                    'idpId' integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+                    'name' text NOT NULL,
+                    'type' text NOT NULL,
+                    'defaultRoleMapping' text,
+                    'defaultOrgMapping' text,
+                    'autoProvision' integer DEFAULT false NOT NULL
+                );
+
+                CREATE TABLE 'idpOidcConfig' (
+                    'idpOauthConfigId' integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+                    'idpId' integer NOT NULL,
+                    'clientId' text NOT NULL,
+                    'clientSecret' text NOT NULL,
+                    'authUrl' text NOT NULL,
+                    'tokenUrl' text NOT NULL,
+                    'identifierPath' text NOT NULL,
+                    'emailPath' text,
+                    'namePath' text,
+                    'scopes' text NOT NULL,
+                    FOREIGN KEY ('idpId') REFERENCES 'idp'('idpId') ON UPDATE no action ON DELETE cascade
+                );
+
+                CREATE TABLE 'idpOrg' (
+                    'idpId' integer NOT NULL,
+                    'orgId' text NOT NULL,
+                    'roleMapping' text,
+                    'orgMapping' text,
+                    FOREIGN KEY ('idpId') REFERENCES 'idp'('idpId') ON UPDATE no action ON DELETE cascade,
+                    FOREIGN KEY ('orgId') REFERENCES 'orgs'('orgId') ON UPDATE no action ON DELETE cascade
+                );
+
+                CREATE TABLE 'licenseKey' (
+                    'licenseKeyId' text PRIMARY KEY NOT NULL,
+                    'instanceId' text NOT NULL,
+                    'token' text NOT NULL
+                );
+
+                CREATE TABLE '__new_user' (
+                    'id' text PRIMARY KEY NOT NULL,
+                    'email' text,
+                    'username' text NOT NULL,
+                    'name' text,
+                    'type' text NOT NULL,
+                    'idpId' integer,
+                    'passwordHash' text,
+                    'twoFactorEnabled' integer DEFAULT false NOT NULL,
+                    'twoFactorSecret' text,
+                    'emailVerified' integer DEFAULT false NOT NULL,
+                    'dateCreated' text NOT NULL,
+                    'serverAdmin' integer DEFAULT false NOT NULL,
+                    FOREIGN KEY ('idpId') REFERENCES 'idp'('idpId') ON UPDATE no action ON DELETE cascade
+                );
+
+                INSERT INTO '__new_user'(
+                    "id", "email", "username", "name", "type", "idpId", "passwordHash",
+                    "twoFactorEnabled", "twoFactorSecret", "emailVerified", "dateCreated", "serverAdmin"
+                )
+                SELECT
+                    "id",
+                    "email",
+                    COALESCE("email", 'unknown'),
+                    NULL,
+                    'internal',
+                    NULL,
+                    "passwordHash",
+                    "twoFactorEnabled",
+                    "twoFactorSecret",
+                    "emailVerified",
+                    "dateCreated",
+                    "serverAdmin"
+                FROM 'user';
+
+                DROP TABLE 'user';
+                ALTER TABLE '__new_user' RENAME TO 'user';
+
+                ALTER TABLE 'resources' ADD 'stickySession' integer DEFAULT false NOT NULL;
+                ALTER TABLE 'resources' ADD 'tlsServerName' text;
+                ALTER TABLE 'resources' ADD 'setHostHeader' text;
+
+                CREATE TABLE 'exitNodes_new' (
+                    'exitNodeId' integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+                    'name' text NOT NULL,
+                    'address' text NOT NULL,
+                    'endpoint' text NOT NULL,
+                    'publicKey' text NOT NULL,
+                    'listenPort' integer NOT NULL,
+                    'reachableAt' text
+                );
+
+                INSERT INTO 'exitNodes_new' (
+                    'exitNodeId', 'name', 'address', 'endpoint', 'publicKey', 'listenPort', 'reachableAt'
+                )
+                SELECT
+                    exitNodeId,
+                    name,
+                    address,
+                    endpoint,
+                    pubicKey,
+                    listenPort,
+                    reachableAt
+                FROM exitNodes;
+
+                DROP TABLE 'exitNodes';
+                ALTER TABLE 'exitNodes_new' RENAME TO 'exitNodes';
+            `);
+        })(); // <-- executes the transaction immediately
+        db.pragma("foreign_keys = ON");
+        console.log(`Migrated database schema`);
+    } catch (e) {
+        console.log("Unable to migrate database schema");
+        throw e;
+    }
+
+    // Update config file
+    try {
+        const filePaths = [configFilePath1, configFilePath2];
+        let filePath = "";
+        for (const path of filePaths) {
+            if (fs.existsSync(path)) {
+                filePath = path;
+                break;
+            }
+        }
+
+        if (!filePath) {
+            throw new Error(
+                `No config file found (expected config.yml or config.yaml).`
+            );
+        }
+
+        const fileContents = fs.readFileSync(filePath, "utf8");
+        let rawConfig: any = yaml.load(fileContents);
+
+        if (!rawConfig.server.secret) {
+            rawConfig.server.secret = generateIdFromEntropySize(32);
+        }
+
+        const updatedYaml = yaml.dump(rawConfig);
+        fs.writeFileSync(filePath, updatedYaml, "utf8");
+
+        console.log(`Added new config option: server.secret`);
+    } catch (e) {
+        console.log(
+            `Unable to add new config option: server.secret. Please add it manually.`
+        );
+        console.error(e);
+    }
+
+    console.log(`${version} migration complete`);
+}
+
+function generateIdFromEntropySize(size: number): string {
+    const buffer = crypto.getRandomValues(new Uint8Array(size));
+    return encodeBase32LowerCaseNoPadding(buffer);
+}

server/setup/setHostMeta.ts

@@ -0,0 +1,17 @@
+import db from "@server/db";
+import { hostMeta } from "@server/db/schemas";
+import { v4 as uuidv4 } from "uuid";
+
+export async function setHostMeta() {
+    const [existing] = await db.select().from(hostMeta).limit(1);
+
+    if (existing && existing.hostMetaId) {
+        return;
+    }
+
+    const id = uuidv4();
+
+    await db
+        .insert(hostMeta)
+        .values({ hostMetaId: id, createdAt: new Date().getTime() });
+}