Move mtls out of private

server/private/routers/external.ts

@@ -34,8 +34,6 @@ import * as eventStreamingDestination from "#private/routers/eventStreamingDesti
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
 import * as policy from "#private/routers/policy";
-import * as resource from "#private/routers/resource";
-
 import {
     verifyOrgAccess,
     verifyUserHasAction,
@@ -864,25 +862,3 @@ authenticated.post(
     verifyOrgAccess,
     logs.logAccessAuditAttempt
 );
-
-authenticated.put(
-    "/resource/:resourceId/mtls/certificate",
-    verifyResourceAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.createResourceMtlsCertificate),
-    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
-    resource.createResourceMtlsCertificate
-);
-authenticated.get(
-    "/resource/:resourceId/mtls/certificates",
-    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.listResourceMtlsCertificates),
-    resource.listResourceMtlsCertificates
-);
-authenticated.delete(
-    "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
-    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.deleteResourceMtlsCertificate),
-    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
-    resource.deleteResourceMtlsCertificate
-);

server/private/routers/integration.ts

@@ -467,36 +467,3 @@ authenticated.get(
     verifyApiKeyHasAction(ActionsEnum.getTarget),
     healthChecks.getHealthCheckStatusHistory
 );
-
-authenticated.put(
-    [
-        "/resource/:resourceId/mtls/certificate",
-        "/public-resource/:resourceId/mtls/certificate"
-    ],
-    verifyApiKeyResourceAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createResourceMtlsCertificate),
-    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
-    resource.createResourceMtlsCertificate
-);
-
-authenticated.get(
-    [
-        "/resource/:resourceId/mtls/certificates",
-        "/public-resource/:resourceId/mtls/certificates"
-    ],
-    verifyApiKeyResourceAccess,
-    verifyApiKeyHasAction(ActionsEnum.listResourceMtlsCertificates),
-    resource.listResourceMtlsCertificates
-);
-
-authenticated.delete(
-    [
-        "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
-        "/public-resource/:resourceId/mtls/certificate/:mtlsCertificateId"
-    ],
-    verifyApiKeyResourceAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteResourceMtlsCertificate),
-    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
-    resource.deleteResourceMtlsCertificate
-);

server/private/routers/resource/index.ts

@@ -12,6 +12,3 @@
  */
 
 export * from "./getMaintenanceInfo";
-export * from "./deleteResourceMtlsCertificate";
-export * from "./createResourceMtlsCertificate";
-export * from "./listResourceMtlsCertificates";

server/routers/external.ts

@@ -1997,6 +1997,28 @@ authenticated.put(
     reKey.reGenerateExitNodeSecret
 );
 
+authenticated.put(
+    "/resource/:resourceId/mtls/certificate",
+    verifyResourceAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+authenticated.get(
+    "/resource/:resourceId/mtls/certificates",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+authenticated.delete(
+    "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);
+
 // Auth routes
 export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);

server/routers/integration.ts

@@ -1963,3 +1963,36 @@ authenticated.put(
     logActionAudit(ActionsEnum.detachLabelFromItem),
     labels.detachLabelFromItem
 );
+
+authenticated.put(
+    [
+        "/resource/:resourceId/mtls/certificate",
+        "/public-resource/:resourceId/mtls/certificate"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.createResourceMtlsCertificate),
+    resource.createResourceMtlsCertificate
+);
+
+authenticated.get(
+    [
+        "/resource/:resourceId/mtls/certificates",
+        "/public-resource/:resourceId/mtls/certificates"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.listResourceMtlsCertificates),
+    resource.listResourceMtlsCertificates
+);
+
+authenticated.delete(
+    [
+        "/resource/:resourceId/mtls/certificate/:mtlsCertificateId",
+        "/public-resource/:resourceId/mtls/certificate/:mtlsCertificateId"
+    ],
+    verifyApiKeyResourceAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourceMtlsCertificate),
+    logActionAudit(ActionsEnum.deleteResourceMtlsCertificate),
+    resource.deleteResourceMtlsCertificate
+);

server/routers/resource/createResourceMtlsCertificate.ts

@@ -1,16 +1,3 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db, resourceMtlsCertificates, resources } from "@server/db";

server/routers/resource/deleteResourceMtlsCertificate.ts

@@ -1,16 +1,3 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db, resourceMtlsCertificates, resources } from "@server/db";

server/routers/resource/index.ts

@@ -45,3 +45,6 @@ export * from "./addAiProviderToResource";
 export * from "./removeAiProviderFromResource";
 export * from "./exportResourceBlueprint";
 export * from "./types";
+export * from "./deleteResourceMtlsCertificate";
+export * from "./createResourceMtlsCertificate";
+export * from "./listResourceMtlsCertificates";

server/routers/resource/listResourceMtlsCertificates.ts

@@ -1,16 +1,3 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db, resourceMtlsCertificates, resources } from "@server/db";

src/app/[orgId]/settings/resources/public/[niceId]/mtls/page.tsx

@@ -16,14 +16,11 @@ import {
 import { SwitchInput } from "@app/components/SwitchInput";
 import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
 import { Badge } from "@app/components/ui/badge";
-import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useResourceContext } from "@app/hooks/useResourceContext";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { resourceQueries } from "@app/lib/queries";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type {
     CreateResourceMtlsCertificateResponse,
     DeleteResourceMtlsCertificateResponse,
@@ -47,10 +44,9 @@ export default function ResourceMtlsPage() {
     const t = useTranslations();
     const api = createApiClient({ env });
     const queryClient = useQueryClient();
-    const { isPaidUser } = usePaidStatus();
 
     const supportsMtls = resource.mode === "http";
-    const isMtlsDisabled = !isPaidUser(tierMatrix.mtls);
+    const isMtlsDisabled = false;
 
     useEffect(() => {
         if (env.flags.disableEnterpriseFeatures || !supportsMtls) {
@@ -206,7 +202,6 @@ export default function ResourceMtlsPage() {
 
     return (
         <>
-            <PaidFeaturesAlert tiers={tierMatrix.mtls} />
             <div
                 className={
                     isMtlsDisabled