Merge remote-tracking branch 'upstream/dev' into feature-response-headers

# Conflicts:
#	server/db/pg/schema/schema.ts
#	server/lib/blueprints/proxyResources.ts
#	server/routers/resource/getResource.ts
#	src/app/[orgId]/settings/resources/proxy/[niceId]/proxy/page.tsx
#	src/components/HealthCheckCredenza.tsx

server/private/lib/acmeCertSync.ts

@@ -693,9 +693,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
             );
             continue;
         }
-        logger.debug(
-            `acmeCertSync: found ${resolverData.Certificates.length} certificate(s) for resolver "${resolver}"`
-        );
+        // logger.debug(
+        //     `acmeCertSync: found ${resolverData.Certificates.length} certificate(s) for resolver "${resolver}"`
+        // );
         for (const cert of resolverData.Certificates) {
             allCerts.push(cert);
         }
@@ -780,9 +780,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
             }
         }
 
-        logger.debug(
-            `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
-        );
+        // logger.debug(
+        //     `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
+        // );
 
         for (const domain of allDomains) {
             try {
@@ -863,9 +863,9 @@ export function initAcmeCertSync(): void {
                     );
                     return;
                 }
-                logger.debug(
-                    `acmeCertSync: found ${files.length} acme.json file(s) in directory "${acmeJsonPath}"`
-                );
+                // logger.debug(
+                //     `acmeCertSync: found ${files.length} acme.json file(s) in directory "${acmeJsonPath}"`
+                // );
                 for (const file of files) {
                     syncAcmeCerts(file).catch((err) => {
                         logger.error(

server/private/lib/certificates.ts

@@ -17,7 +17,7 @@ import { certificates, db } from "@server/db";
 import { and, eq, isNotNull, or, inArray, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
 import logger from "@server/logger";
-import cache from "#private/lib/cache";
+import { regionalCache as cache } from "#private/lib/cache";
 import { build } from "@server/build";
 
 // Define the return type for clarity and type safety
@@ -36,8 +36,6 @@ export async function getValidCertificatesForDomains(
     domains: Set<string>,
     useCache: boolean = true
 ): Promise<Array<CertificateResult>> {
-
-
     const finalResults: CertificateResult[] = [];
     const domainsToQuery = new Set<string>();
 
@@ -49,7 +47,26 @@ export async function getValidCertificatesForDomains(
             if (cachedCert) {
                 finalResults.push(cachedCert); // Valid cache hit
             } else {
-                domainsToQuery.add(domain); // Cache miss or expired
+                // Also check for a wildcard cache entry covering this domain's parent
+                const parts = domain.split(".");
+                let wildcardHit = false;
+                if (parts.length > 1) {
+                    const parentDomain = parts.slice(1).join(".");
+                    const wildcardCacheKey = `cert:*.${parentDomain}`;
+                    const cachedWildcard =
+                        await cache.get<CertificateResult>(wildcardCacheKey);
+                    if (cachedWildcard) {
+                        // Re-stamp queriedDomain so callers see the originally requested domain
+                        finalResults.push({
+                            ...cachedWildcard,
+                            queriedDomain: domain
+                        });
+                        wildcardHit = true;
+                    }
+                }
+                if (!wildcardHit) {
+                    domainsToQuery.add(domain); // Cache miss or expired
+                }
             }
         }
     } else {
@@ -59,7 +76,10 @@ export async function getValidCertificatesForDomains(
 
     // 2. If all domains were resolved from the cache, return early
     if (domainsToQuery.size === 0) {
-        const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
+        const decryptedResults = decryptFinalResults(
+            finalResults,
+            config.getRawConfig().server.secret!
+        );
         return decryptedResults;
     }
 
@@ -78,7 +98,8 @@ export async function getValidCertificatesForDomains(
     const parentDomainsArray = Array.from(parentDomainsToQuery);
 
     // Build wildcard variants: for each parent domain "example.com", also query "*.example.com"
-    const wildcardPrefixedArray = build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
+    const wildcardPrefixedArray =
+        build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
 
     // 4. Build and execute a single, efficient Drizzle query
     // This query fetches all potential exact and wildcard matches in one database round-trip.
@@ -172,11 +193,24 @@ export async function getValidCertificatesForDomains(
             if (useCache) {
                 const cacheKey = `cert:${domain}`;
                 await cache.set(cacheKey, resultCert, 180);
+
+                // Also cache wildcard certs under a pattern key so other subdomains
+                // can find them without a DB round-trip
+                if (resultCert.wildcard) {
+                    const normalizedCertDomain = normalizeWildcardDomain(
+                        resultCert.domain
+                    );
+                    const wildcardCacheKey = `cert:*.${normalizedCertDomain}`;
+                    await cache.set(wildcardCacheKey, resultCert, 180);
+                }
             }
         }
     }
 
-    const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
+    const decryptedResults = decryptFinalResults(
+        finalResults,
+        config.getRawConfig().server.secret!
+    );
     return decryptedResults;
 }
 

server/private/lib/checkOrgAccessPolicy.ts

@@ -21,6 +21,49 @@ import {
 } from "@server/lib/checkOrgAccessPolicy";
 import { UserType } from "@server/types/UserTypes";
 
+function formatMaxSessionLengthRequirement(
+    maxSessionLengthHours: number
+): string {
+    if (maxSessionLengthHours < 24) {
+        return `This organization requires you to log in every ${maxSessionLengthHours} hours.`;
+    }
+
+    const maxDays = Math.round(maxSessionLengthHours / 24);
+    return `This organization requires you to log in every ${maxDays} days.`;
+}
+
+function buildOrgAccessPolicyError(
+    policies: CheckOrgAccessPolicyResult["policies"]
+): string | undefined {
+    if (!policies) {
+        return undefined;
+    }
+
+    const errors: string[] = [];
+
+    if (policies.requiredTwoFactor === false) {
+        errors.push(
+            "This organization requires two-factor authentication. Enable two-factor authentication on your account to continue."
+        );
+    }
+
+    if (policies.maxSessionLength?.compliant === false) {
+        errors.push(
+            `Your session has expired. ${formatMaxSessionLengthRequirement(
+                policies.maxSessionLength.maxSessionLengthHours
+            )}`
+        );
+    }
+
+    if (policies.passwordAge?.compliant === false) {
+        errors.push(
+            `Your password has expired. This organization requires you to change your password every ${policies.passwordAge.maxPasswordAgeDays} days.`
+        );
+    }
+
+    return errors.length > 0 ? errors.join(" ") : undefined;
+}
+
 export function enforceResourceSessionLength(
     resourceSession: ResourceSession,
     org: Org
@@ -36,13 +79,17 @@ export function enforceResourceSessionLength(
             if (sessionAgeMs > maxSessionLengthMs) {
                 return {
                     valid: false,
-                    error: `Resource session has expired due to organization policy (max session length: ${maxSessionLengthHours} hours)`
+                    error: `Your resource session has expired. ${formatMaxSessionLengthRequirement(
+                        maxSessionLengthHours
+                    )}`
                 };
             }
         } else {
             return {
                 valid: false,
-                error: `Resource session is invalid due to organization policy (max session length: ${maxSessionLengthHours} hours)`
+                error: `Your resource session is invalid. ${formatMaxSessionLengthRequirement(
+                    maxSessionLengthHours
+                )}`
             };
         }
     }
@@ -60,14 +107,20 @@ export async function checkOrgAccessPolicy(
     if (!orgId) {
         return {
             allowed: false,
-            error: "Organization ID is required"
+            error: "Unable to verify organization access. Organization information is missing."
         };
     }
     if (!userId) {
-        return { allowed: false, error: "User ID is required" };
+        return {
+            allowed: false,
+            error: "Unable to verify organization access. User information is missing."
+        };
     }
     if (!sessionId) {
-        return { allowed: false, error: "Session ID is required" };
+        return {
+            allowed: false,
+            error: "Your session is invalid. Please log in again."
+        };
     }
 
     if (build === "enterprise") {
@@ -89,7 +142,10 @@ export async function checkOrgAccessPolicy(
             .where(eq(orgs.orgId, orgId));
         props.org = orgQuery;
         if (!props.org) {
-            return { allowed: false, error: "Organization not found" };
+            return {
+                allowed: false,
+                error: "This organization could not be found."
+            };
         }
     }
 
@@ -100,7 +156,10 @@ export async function checkOrgAccessPolicy(
             .where(eq(users.userId, userId));
         props.user = userQuery;
         if (!props.user) {
-            return { allowed: false, error: "User not found" };
+            return {
+                allowed: false,
+                error: "Your account could not be found."
+            };
         }
     }
 
@@ -111,14 +170,17 @@ export async function checkOrgAccessPolicy(
             .where(eq(sessions.sessionId, sessionId));
         props.session = sessionQuery;
         if (!props.session) {
-            return { allowed: false, error: "Session not found" };
+            return {
+                allowed: false,
+                error: "Your session has expired. Please log in again."
+            };
         }
     }
 
     if (props.session.userId !== props.user.userId) {
         return {
             allowed: false,
-            error: "Session does not belong to the user"
+            error: "Your session is invalid. Please log in again."
         };
     }
 
@@ -187,8 +249,14 @@ export async function checkOrgAccessPolicy(
         allowed = false;
     }
 
+    const policyError = buildOrgAccessPolicyError(policies);
+
     return {
         allowed,
-        policies
+        policies,
+        error: allowed
+            ? undefined
+            : (policyError ??
+              "You do not meet this organization's security requirements.")
     };
 }

server/private/lib/exitNodes/exitNodes.ts

@@ -18,12 +18,15 @@ import {
     resources,
     targets,
     sites,
+    siteLabels,
+    remoteExitNodes,
+    remoteExitNodePreferenceLabels,
     targetHealthCheck,
     Transaction
 } from "@server/db";
 import logger from "@server/logger";
 import { ExitNodePingResult } from "@server/routers/newt";
-import { eq, and, or, ne, isNull } from "drizzle-orm";
+import { eq, and, or, ne, isNull, inArray } from "drizzle-orm";
 import axios from "axios";
 import config from "../config";
 
@@ -150,7 +153,8 @@ export async function verifyExitNodeOrgAccess(
 export async function listExitNodes(
     orgId: string,
     filterOnline = false,
-    noCloud = false
+    noCloud = false,
+    siteId?: number
 ) {
     const allExitNodes = await db
         .select({
@@ -237,7 +241,7 @@ export async function listExitNodes(
     //     })
     // );
 
-    const remoteExitNodes = allExitNodes.filter(
+    let remoteExitNodesList = allExitNodes.filter(
         (node) =>
             node.type === "remoteExitNode" && (!filterOnline || node.online)
     );
@@ -246,9 +250,82 @@ export async function listExitNodes(
             node.type === "gerbil" && (!filterOnline || node.online) && !noCloud
     );
 
+    // Apply label-based filtering to remote exit nodes if siteId is provided
+    if (siteId !== undefined && remoteExitNodesList.length > 0) {
+        // Get the site's labels
+        const siteLabelRows = await db
+            .select({ labelId: siteLabels.labelId })
+            .from(siteLabels)
+            .where(eq(siteLabels.siteId, siteId));
+        const siteLabelIds = new Set(siteLabelRows.map((r) => r.labelId));
+
+        // Get the remoteExitNode records for these exit nodes so we have the remoteExitNodeId
+        const exitNodeIds = remoteExitNodesList.map((n) => n.exitNodeId);
+        const remoteNodeRows = await db
+            .select({
+                exitNodeId: remoteExitNodes.exitNodeId,
+                remoteExitNodeId: remoteExitNodes.remoteExitNodeId
+            })
+            .from(remoteExitNodes)
+            .where(inArray(remoteExitNodes.exitNodeId, exitNodeIds));
+
+        const exitNodeIdToRemoteId = new Map(
+            remoteNodeRows
+                .filter((r) => r.exitNodeId !== null)
+                .map((r) => [r.exitNodeId!, r.remoteExitNodeId])
+        );
+
+        // Get preference labels for all remote exit nodes
+        const remoteExitNodeIds = remoteNodeRows.map((r) => r.remoteExitNodeId);
+        const prefLabelRows =
+            remoteExitNodeIds.length > 0
+                ? await db
+                      .select({
+                          remoteExitNodeId:
+                              remoteExitNodePreferenceLabels.remoteExitNodeId,
+                          labelId: remoteExitNodePreferenceLabels.labelId
+                      })
+                      .from(remoteExitNodePreferenceLabels)
+                      .where(
+                          inArray(
+                              remoteExitNodePreferenceLabels.remoteExitNodeId,
+                              remoteExitNodeIds
+                          )
+                      )
+                : [];
+
+        // Build a map of remoteExitNodeId -> Set of labelIds
+        const prefLabelsMap = new Map<string, Set<number>>();
+        for (const row of prefLabelRows) {
+            if (!prefLabelsMap.has(row.remoteExitNodeId)) {
+                prefLabelsMap.set(row.remoteExitNodeId, new Set());
+            }
+            prefLabelsMap.get(row.remoteExitNodeId)!.add(row.labelId);
+        }
+
+        // Filter: include node if it has no preference labels, or if site shares at least one label
+        const filtered = remoteExitNodesList.filter((node) => {
+            const remoteId = exitNodeIdToRemoteId.get(node.exitNodeId);
+            if (!remoteId) return true; // no remoteExitNode record, don't filter
+            const prefLabels = prefLabelsMap.get(remoteId);
+            if (!prefLabels || prefLabels.size === 0) return true; // no preference labels, include
+            // include only if site has at least one matching label
+            for (const labelId of siteLabelIds) {
+                if (prefLabels.has(labelId)) return true;
+            }
+            return false;
+        });
+
+        // Only apply the filtered list if at least one remote node remains;
+        // otherwise fall through to the gerbil fallback below
+        if (filtered.length > 0 || remoteExitNodesList.length === 0) {
+            remoteExitNodesList = filtered;
+        }
+    }
+
     // THIS PROVIDES THE FALL
     const exitNodesList =
-        remoteExitNodes.length > 0 ? remoteExitNodes : gerbilExitNodes;
+        remoteExitNodesList.length > 0 ? remoteExitNodesList : gerbilExitNodes;
 
     return exitNodesList;
 }

server/private/lib/lock.ts

@@ -11,37 +11,80 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { config } from "@server/lib/config";
 import logger from "@server/logger";
 import { redis } from "#private/lib/redis";
 import { v4 as uuidv4 } from "uuid";
 
 const instanceId = uuidv4();
 
+type LocalLockRecord = {
+    owner: string;
+    expiresAt: number;
+};
+
+const localLocks = new Map<string, LocalLockRecord>();
+
 export class LockManager {
+    private clearExpiredLocalLock(lockKey: string): void {
+        const current = localLocks.get(lockKey);
+        if (current && current.expiresAt <= Date.now()) {
+            localLocks.delete(lockKey);
+        }
+    }
+
     /**
      * Acquire a distributed lock using Redis SET with NX and PX options
      * @param lockKey - Unique identifier for the lock
      * @param ttlMs - Time to live in milliseconds
-     * @returns Promise<boolean> - true if lock acquired, false otherwise
+     * @returns Promise<string | null> - a token identifying this specific acquisition
+     *          (truthy) on success, or null if the lock could not be acquired.
      */
     async acquireLock(
         lockKey: string,
         ttlMs: number = 30000,
         maxRetries: number = 3,
         retryDelayMs: number = 100
-    ): Promise<boolean> {
+    ): Promise<string | null> {
         if (!redis || !redis.status || redis.status !== "ready") {
-            return true;
+            for (let attempt = 0; attempt < maxRetries; attempt++) {
+                this.clearExpiredLocalLock(lockKey);
+
+                const existing = localLocks.get(lockKey);
+                if (!existing) {
+                    const token = `${instanceId}:${uuidv4()}`;
+                    localLocks.set(lockKey, {
+                        owner: token,
+                        expiresAt: Date.now() + ttlMs
+                    });
+                    return token;
+                }
+
+                // Do not treat a same-process holder as automatically
+                // reentrant -- see the note in the Redis branch below.
+                if (attempt < maxRetries - 1) {
+                    const delay = retryDelayMs * Math.pow(2, attempt);
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                }
+            }
+
+            return null;
         }
 
-        const lockValue = `${
-            instanceId
-        }:${Date.now()}`;
         const redisKey = `lock:${lockKey}`;
 
         for (let attempt = 0; attempt < maxRetries; attempt++) {
             try {
+                // Every acquisition attempt gets its own unique token, even
+                // within the same process. Two independent logical operations
+                // (e.g. two different API requests handled by the same server)
+                // racing for this key must never both believe they hold the
+                // lock -- if we treated "existing value starts with my
+                // instanceId" as reentrant success, a second unrelated caller
+                // on this process could barge in while the first is still
+                // mid-flight, and their writes under the lock would interleave
+                // unguarded.
+                const lockValue = `${instanceId}:${uuidv4()}`;
+
                 // Use SET with NX (only set if not exists) and PX (expire in milliseconds)
                 // This is atomic and handles both setting and expiration
                 const result = await redis.set(
@@ -53,30 +96,8 @@ export class LockManager {
                 );
 
                 if (result === "OK") {
-                    logger.debug(
-                        `Lock acquired: ${lockKey} by ${
-                            instanceId
-                        }`
-                    );
-                    return true;
-                }
-
-                // Check if the existing lock is from this worker (reentrant behavior)
-                const existingValue = await redis.get(redisKey);
-                if (
-                    existingValue &&
-                    existingValue.startsWith(
-                        `${instanceId}:`
-                    )
-                ) {
-                    // Extend the lock TTL since it's the same worker
-                    await redis.pexpire(redisKey, ttlMs);
-                    logger.debug(
-                        `Lock extended: ${lockKey} by ${
-                            instanceId
-                        }`
-                    );
-                    return true;
+                    logger.debug(`Lock acquired: ${lockKey} by ${instanceId}`);
+                    return lockValue;
                 }
 
                 // If this isn't our last attempt, wait before retrying with exponential backoff
@@ -88,7 +109,10 @@ export class LockManager {
                     await new Promise((resolve) => setTimeout(resolve, delay));
                 }
             } catch (error) {
-                logger.error(`Failed to acquire lock ${lockKey} (attempt ${attempt + 1}/${maxRetries}):`, error);
+                logger.error(
+                    `Failed to acquire lock ${lockKey} (attempt ${attempt + 1}/${maxRetries}):`,
+                    error
+                );
                 // On error, still retry if we have attempts left
                 if (attempt < maxRetries - 1) {
                     const delay = retryDelayMs * Math.pow(2, attempt);
@@ -100,27 +124,36 @@ export class LockManager {
         logger.debug(
             `Failed to acquire lock ${lockKey} after ${maxRetries} attempts`
         );
-        return false;
+        return null;
     }
 
     /**
-     * Release a lock using Lua script to ensure atomicity
+     * Release a lock previously acquired via acquireLock/acquireLockWithRetry,
+     * using a Lua script to ensure we only delete it if it still matches the
+     * exact token from that acquisition (not just "owned by this process") --
+     * this ensures a caller whose TTL already expired can't delete a
+     * different, currently-active holder's lock.
      * @param lockKey - Unique identifier for the lock
+     * @param token - the exact token returned by the acquisition being released
      */
-    async releaseLock(lockKey: string): Promise<void> {
+    async releaseLock(lockKey: string, token: string): Promise<void> {
         if (!redis || !redis.status || redis.status !== "ready") {
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+            if (existing && existing.owner === token) {
+                localLocks.delete(lockKey);
+            }
             return;
         }
 
         const redisKey = `lock:${lockKey}`;
 
-        // Lua script to ensure we only delete the lock if it belongs to this worker
         const luaScript = `
       local key = KEYS[1]
-      local worker_prefix = ARGV[1]
+      local expected_value = ARGV[1]
       local current_value = redis.call('GET', key)
 
-      if current_value and string.find(current_value, worker_prefix, 1, true) == 1 then
+      if current_value and current_value == expected_value then
         return redis.call('DEL', key)
       else
         return 0
@@ -132,20 +165,14 @@ export class LockManager {
                 luaScript,
                 1,
                 redisKey,
-                `${instanceId}:`
+                token
             )) as number;
 
             if (result === 1) {
-                logger.debug(
-                    `Lock released: ${lockKey} by ${
-                        instanceId
-                    }`
-                );
+                logger.debug(`Lock released: ${lockKey} by ${instanceId}`);
             } else {
                 logger.warn(
-                    `Lock not released - not owned by worker: ${lockKey} by ${
-                        instanceId
-                    }`
+                    `Lock not released - token did not match current holder: ${lockKey} (attempted by ${instanceId})`
                 );
             }
         } catch (error) {
@@ -159,6 +186,7 @@ export class LockManager {
      */
     async forceReleaseLock(lockKey: string): Promise<void> {
         if (!redis || !redis.status || redis.status !== "ready") {
+            localLocks.delete(lockKey);
             return;
         }
 
@@ -186,7 +214,20 @@ export class LockManager {
         owner?: string;
     }> {
         if (!redis || !redis.status || redis.status !== "ready") {
-            return { exists: false, ownedByMe: true, ttl: 0 };
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+
+            if (!existing) {
+                return { exists: false, ownedByMe: false, ttl: 0 };
+            }
+
+            const ttl = Math.max(0, existing.expiresAt - Date.now());
+            return {
+                exists: true,
+                ownedByMe: existing.owner.startsWith(`${instanceId}:`),
+                ttl,
+                owner: existing.owner.split(":")[0]
+            };
         }
 
         const redisKey = `lock:${lockKey}`;
@@ -198,11 +239,7 @@ export class LockManager {
             ]);
 
             const exists = value !== null;
-            const ownedByMe =
-                exists &&
-                value!.startsWith(
-                    `${instanceId}:`
-                );
+            const ownedByMe = exists && value!.startsWith(`${instanceId}:`);
             const owner = exists ? value!.split(":")[0] : undefined;
 
             return {
@@ -218,26 +255,40 @@ export class LockManager {
     }
 
     /**
-     * Extend the TTL of an existing lock owned by this worker
+     * Extend the TTL of an existing lock, provided the token matches the
+     * acquisition currently holding it.
      * @param lockKey - Unique identifier for the lock
      * @param ttlMs - New TTL in milliseconds
+     * @param token - the token returned by the acquisition being extended
      * @returns Promise<boolean> - true if extended successfully
      */
-    async extendLock(lockKey: string, ttlMs: number): Promise<boolean> {
+    async extendLock(
+        lockKey: string,
+        ttlMs: number,
+        token: string
+    ): Promise<boolean> {
         if (!redis || !redis.status || redis.status !== "ready") {
+            this.clearExpiredLocalLock(lockKey);
+            const existing = localLocks.get(lockKey);
+
+            if (!existing || existing.owner !== token) {
+                return false;
+            }
+
+            existing.expiresAt = Date.now() + ttlMs;
+            localLocks.set(lockKey, existing);
             return true;
         }
 
         const redisKey = `lock:${lockKey}`;
 
-        // Lua script to extend TTL only if lock is owned by this worker
         const luaScript = `
       local key = KEYS[1]
-      local worker_prefix = ARGV[1]
+      local expected_value = ARGV[1]
       local ttl = tonumber(ARGV[2])
       local current_value = redis.call('GET', key)
 
-      if current_value and string.find(current_value, worker_prefix, 1, true) == 1 then
+      if current_value and current_value == expected_value then
         return redis.call('PEXPIRE', key, ttl)
       else
         return 0
@@ -249,15 +300,13 @@ export class LockManager {
                 luaScript,
                 1,
                 redisKey,
-                `${instanceId}:`,
+                token,
                 ttlMs.toString()
             )) as number;
 
             if (result === 1) {
                 logger.debug(
-                    `Lock extended: ${lockKey} by ${
-                        instanceId
-                    } for ${ttlMs}ms`
+                    `Lock extended: ${lockKey} by ${instanceId} for ${ttlMs}ms`
                 );
                 return true;
             }
@@ -274,23 +323,24 @@ export class LockManager {
      * @param ttlMs - Time to live in milliseconds
      * @param maxRetries - Maximum number of retry attempts
      * @param baseDelayMs - Base delay between retries in milliseconds
-     * @returns Promise<boolean> - true if lock acquired
+     * @returns Promise<string | null> - token if acquired, null otherwise
      */
     async acquireLockWithRetry(
         lockKey: string,
         ttlMs: number = 30000,
         maxRetries: number = 5,
         baseDelayMs: number = 100
-    ): Promise<boolean> {
-        if (!redis || !redis.status || redis.status !== "ready") {
-            return true;
-        }
-
+    ): Promise<string | null> {
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            const acquired = await this.acquireLock(lockKey, ttlMs);
+            const acquired = await this.acquireLock(
+                lockKey,
+                ttlMs,
+                1,
+                baseDelayMs
+            );
 
             if (acquired) {
-                return true;
+                return acquired;
             }
 
             if (attempt < maxRetries) {
@@ -304,7 +354,7 @@ export class LockManager {
         logger.warn(
             `Failed to acquire lock ${lockKey} after ${maxRetries + 1} attempts`
         );
-        return false;
+        return null;
     }
 
     /**
@@ -319,20 +369,16 @@ export class LockManager {
         fn: () => Promise<T>,
         ttlMs: number = 30000
     ): Promise<T> {
-        if (!redis || !redis.status || redis.status !== "ready") {
-            return await fn();
-        }
+        const token = await this.acquireLock(lockKey, ttlMs);
 
-        const acquired = await this.acquireLock(lockKey, ttlMs);
-
-        if (!acquired) {
+        if (!token) {
             throw new Error(`Failed to acquire lock: ${lockKey}`);
         }
 
         try {
             return await fn();
         } finally {
-            await this.releaseLock(lockKey);
+            await this.releaseLock(lockKey, token);
         }
     }
 
@@ -346,7 +392,21 @@ export class LockManager {
         locksOwnedByMe: number;
     }> {
         if (!redis || !redis.status || redis.status !== "ready") {
-            return { activeLocksCount: 0, locksOwnedByMe: 0 };
+            const now = Date.now();
+            for (const [key, value] of localLocks.entries()) {
+                if (value.expiresAt <= now) {
+                    localLocks.delete(key);
+                }
+            }
+
+            let locksOwnedByMe = 0;
+            for (const value of localLocks.values()) {
+                if (value.owner.startsWith(`${instanceId}:`)) {
+                    locksOwnedByMe++;
+                }
+            }
+
+            return { activeLocksCount: localLocks.size, locksOwnedByMe };
         }
 
         try {
@@ -356,11 +416,7 @@ export class LockManager {
             if (keys.length > 0) {
                 const values = await redis.mget(...keys);
                 locksOwnedByMe = values.filter(
-                    (value) =>
-                        value &&
-                        value.startsWith(
-                            `${instanceId}:`
-                        )
+                    (value) => value && value.startsWith(`${instanceId}:`)
                 ).length;
             }
 

server/private/lib/orgRebuildCounter.ts

@@ -0,0 +1,105 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { redis } from "#private/lib/redis";
+import logger from "@server/logger";
+
+export const ORG_REBUILD_CONCURRENCY_LIMIT = 10;
+
+// Safety-net TTL: slightly longer than the rebuild lock TTL (120 s). If a
+// server process dies while holding a rebuild, this ensures the counter key
+// eventually expires rather than staying inflated forever.
+const ORG_REBUILD_COUNT_TTL_MS = 180000;
+const KEY_PREFIX = "rebuild-org-count:";
+
+// In-memory fallback used when Redis is unavailable.
+const localFallback = new Map<string, number>();
+
+function isRedisReady(): boolean {
+    return !!(redis && redis.status === "ready");
+}
+
+export async function incrementOrgRebuildCount(orgId: string): Promise<void> {
+    if (!isRedisReady()) {
+        localFallback.set(orgId, (localFallback.get(orgId) ?? 0) + 1);
+        return;
+    }
+    try {
+        const key = `${KEY_PREFIX}${orgId}`;
+        await redis!.incr(key);
+        // Always refresh the TTL so the key doesn't expire while rebuilds are
+        // still in progress. The TTL is purely a crash-recovery safety net.
+        await redis!.pexpire(key, ORG_REBUILD_COUNT_TTL_MS);
+    } catch (err) {
+        logger.warn(
+            `orgRebuildCounter: Redis increment failed for org ${orgId}, falling back to local:`,
+            err
+        );
+        localFallback.set(orgId, (localFallback.get(orgId) ?? 0) + 1);
+    }
+}
+
+export async function decrementOrgRebuildCount(orgId: string): Promise<void> {
+    if (!isRedisReady()) {
+        const current = localFallback.get(orgId) ?? 0;
+        if (current <= 1) {
+            localFallback.delete(orgId);
+        } else {
+            localFallback.set(orgId, current - 1);
+        }
+        return;
+    }
+    try {
+        const key = `${KEY_PREFIX}${orgId}`;
+        const count = await redis!.decr(key);
+        if (count <= 0) {
+            await redis!.del(key);
+        }
+    } catch (err) {
+        logger.warn(
+            `orgRebuildCounter: Redis decrement failed for org ${orgId}, falling back to local:`,
+            err
+        );
+        const current = localFallback.get(orgId) ?? 0;
+        if (current <= 1) {
+            localFallback.delete(orgId);
+        } else {
+            localFallback.set(orgId, current - 1);
+        }
+    }
+}
+
+export async function getOrgActiveRebuildCount(orgId: string): Promise<number> {
+    if (!isRedisReady()) {
+        return localFallback.get(orgId) ?? 0;
+    }
+    try {
+        const key = `${KEY_PREFIX}${orgId}`;
+        const val = await redis!.get(key);
+        return val ? parseInt(val, 10) : 0;
+    } catch (err) {
+        logger.warn(
+            `orgRebuildCounter: Redis get failed for org ${orgId}, falling back to local:`,
+            err
+        );
+        return localFallback.get(orgId) ?? 0;
+    }
+}
+
+export async function checkOrgRebuildRateLimit(
+    orgId: string
+): Promise<boolean> {
+    return (
+        (await getOrgActiveRebuildCount(orgId)) >= ORG_REBUILD_CONCURRENCY_LIMIT
+    );
+}

server/private/lib/rateLimit.ts

@@ -12,7 +12,7 @@
  */
 
 import logger from "@server/logger";
-import redisManager from "#private/lib/redis";
+import { regionalRedisManager as redisManager } from "#private/lib/redis";
 import { build } from "@server/build";
 
 // Rate limiting configuration
@@ -152,10 +152,9 @@ export class RateLimitService {
             );
 
             // Set TTL using the client directly - this prevents the key from persisting forever
-            if (redisManager.getClient()) {
-                await redisManager
-                    .getClient()
-                    .expire(globalKey, RATE_LIMIT_WINDOW + 10);
+            const writeClient = redisManager.getClient();
+            if (writeClient) {
+                await writeClient.expire(globalKey, RATE_LIMIT_WINDOW + 10);
             }
 
             // Update tracking
@@ -204,10 +203,12 @@ export class RateLimitService {
             );
 
             // Set TTL using the client directly - this prevents the key from persisting forever
-            if (redisManager.getClient()) {
-                await redisManager
-                    .getClient()
-                    .expire(messageTypeKey, RATE_LIMIT_WINDOW + 10);
+            const writeClient = redisManager.getClient();
+            if (writeClient) {
+                await writeClient.expire(
+                    messageTypeKey,
+                    RATE_LIMIT_WINDOW + 10
+                );
             }
 
             // Update tracking
@@ -487,16 +488,13 @@ export class RateLimitService {
             await redisManager.del(globalKey);
 
             // Get all message type keys for this client and delete them
-            const client = redisManager.getClient();
-            if (client) {
-                const messageTypeKeys = await client.keys(
-                    `ratelimit:${clientId}:*`
+            const messageTypeKeys = await redisManager.keys(
+                `ratelimit:${clientId}:*`
+            );
+            if (messageTypeKeys.length > 0) {
+                await Promise.all(
+                    messageTypeKeys.map((key) => redisManager.del(key))
                 );
-                if (messageTypeKeys.length > 0) {
-                    await Promise.all(
-                        messageTypeKeys.map((key) => redisManager.del(key))
-                    );
-                }
             }
         }
     }

server/private/lib/readConfigFile.ts

@@ -109,7 +109,11 @@ export const privateConfigSchema = z
                 enable_redis: z.boolean().optional().default(false),
                 use_pangolin_dns: z.boolean().optional().default(false),
                 use_org_only_idp: z.boolean().optional(),
-                enable_acme_cert_sync: z.boolean().optional().default(true)
+                enable_acme_cert_sync: z.boolean().optional().default(true),
+                disable_private_http_placeholder: z
+                    .boolean()
+                    .optional()
+                    .default(false)
             })
             .optional()
             .prefault({}),

server/private/lib/rebuildQueue.ts

@@ -0,0 +1,241 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { redis } from "#private/lib/redis";
+import { lockManager } from "#private/lib/lock";
+import logger from "@server/logger";
+import { isTransientError } from "@server/lib/dbRetry";
+
+export type RebuildJobType = "site-resource" | "client";
+
+export interface RebuildJob {
+    type: RebuildJobType;
+    id: number;
+    // Number of times this job has already been re-queued after a transient
+    // failure. Absent/0 means it has not failed yet.
+    attempt?: number;
+}
+
+export interface RebuildJobHandlers {
+    onSiteResource(siteResourceId: number): Promise<void>;
+    onClient(clientId: number): Promise<void>;
+}
+
+// Redis list holding pending rebuild jobs (RPUSH to enqueue, LPOP to dequeue — FIFO order).
+const QUEUE_KEY = "rebuild-client-associations:queue";
+const QUEUED_SET_KEY = "rebuild-client-associations:queued";
+
+// Distributed lock that serialises queue consumption to a single server instance
+// at a time. TTL is generous enough to cover a full batch of expensive rebuilds.
+const PROCESSOR_LOCK_KEY = "rebuild-client-associations:processor";
+
+// Each rebuild can take up to REBUILD_ASSOCIATIONS_LOCK_TTL_MS (120 s) per
+// resource. Allow BATCH_SIZE resources per processor-lock acquisition, plus a
+// small buffer.
+const BATCH_SIZE = 5;
+const PROCESSOR_LOCK_TTL_MS = 120000 * BATCH_SIZE + 30000; // ~630 s
+
+const POLL_INTERVAL_MS = 500;
+
+// A job that fails with a transient DB error gets re-queued with backoff
+// instead of being dropped, up to this many times.
+const MAX_JOB_ATTEMPTS = 5;
+const JOB_RETRY_BASE_DELAY_MS = 1000;
+
+class RedisRebuildQueue {
+    private processingStarted = false;
+
+    async isQueued(job: RebuildJob): Promise<boolean> {
+        if (!redis || redis.status !== "ready") return false;
+        const dedupeKey = `${job.type}:${job.id}`;
+        try {
+            const member = await redis.sismember(QUEUED_SET_KEY, dedupeKey);
+            return member === 1;
+        } catch {
+            return false;
+        }
+    }
+
+    async enqueue(job: RebuildJob): Promise<void> {
+        if (!redis || redis.status !== "ready") {
+            logger.warn(
+                `Rebuild queue: Redis not available — rebuild for ${job.type}:${job.id} will not be retried`
+            );
+            return;
+        }
+
+        try {
+            const dedupeKey = `${job.type}:${job.id}`;
+            const added = await redis.sadd(QUEUED_SET_KEY, dedupeKey);
+            if (added === 0) {
+                logger.debug(
+                    `Rebuild queue: skipped duplicate queued job ${job.type}:${job.id}`
+                );
+                return;
+            }
+
+            await redis.rpush(QUEUE_KEY, JSON.stringify(job));
+            logger.debug(
+                `Rebuild queue: enqueued ${job.type}:${job.id} (queue position: tail)`
+            );
+        } catch (err) {
+            await redis
+                .srem(QUEUED_SET_KEY, `${job.type}:${job.id}`)
+                .catch((cleanupErr) =>
+                    logger.warn(
+                        `Rebuild queue: failed to cleanup dedupe key for ${job.type}:${job.id} after enqueue failure:`,
+                        cleanupErr
+                    )
+                );
+            logger.error(
+                `Rebuild queue: failed to enqueue ${job.type}:${job.id}:`,
+                err
+            );
+        }
+    }
+
+    startProcessing(handlers: RebuildJobHandlers): void {
+        if (this.processingStarted) return;
+        this.processingStarted = true;
+
+        this.processLoop(handlers).catch((err) => {
+            logger.error("Rebuild queue processor loop crashed:", err);
+        });
+
+        logger.info("Rebuild queue processor started");
+    }
+
+    private async processLoop(handlers: RebuildJobHandlers): Promise<void> {
+        while (true) {
+            try {
+                await this.tryProcessBatch(handlers);
+            } catch (err) {
+                logger.error(
+                    "Rebuild queue: unhandled error in process loop:",
+                    err
+                );
+            }
+            await new Promise((resolve) =>
+                setTimeout(resolve, POLL_INTERVAL_MS)
+            );
+        }
+    }
+
+    private async tryProcessBatch(handlers: RebuildJobHandlers): Promise<void> {
+        if (!redis || redis.status !== "ready") return;
+
+        // Peek before acquiring the processor lock to avoid unnecessary Redis
+        // round-trips and lock contention when the queue is idle.
+        const queueLength = await redis.llen(QUEUE_KEY).catch(() => 0);
+        if (queueLength === 0) return;
+
+        try {
+            await lockManager.withLock(
+                PROCESSOR_LOCK_KEY,
+                async () => {
+                    for (let i = 0; i < BATCH_SIZE; i++) {
+                        if (!redis || redis.status !== "ready") break;
+
+                        const payload = await redis.lpop(QUEUE_KEY);
+                        if (payload === null) break; // queue drained
+
+                        let job: RebuildJob;
+                        try {
+                            job = JSON.parse(payload) as RebuildJob;
+                        } catch {
+                            logger.error(
+                                `Rebuild queue: could not parse job payload, discarding: ${payload}`
+                            );
+                            continue;
+                        }
+
+                        // Remove from dedupe set once dequeued so the same job
+                        // can be re-queued while this one is in progress.
+                        await redis
+                            .srem(QUEUED_SET_KEY, `${job.type}:${job.id}`)
+                            .catch((cleanupErr) =>
+                                logger.warn(
+                                    `Rebuild queue: failed to remove dedupe key for ${job.type}:${job.id} on dequeue:`,
+                                    cleanupErr
+                                )
+                            );
+
+                        logger.debug(
+                            `Rebuild queue: processing ${job.type}:${job.id}`
+                        );
+
+                        try {
+                            if (job.type === "site-resource") {
+                                await handlers.onSiteResource(job.id);
+                            } else if (job.type === "client") {
+                                await handlers.onClient(job.id);
+                            } else {
+                                logger.warn(
+                                    `Rebuild queue: unknown job type "${(job as any).type}", discarding`
+                                );
+                            }
+
+                            logger.debug(
+                                `Rebuild queue: completed ${job.type}:${job.id}`
+                            );
+                        } catch (err) {
+                            const attempt = (job.attempt ?? 0) + 1;
+                            if (
+                                isTransientError(err) &&
+                                attempt <= MAX_JOB_ATTEMPTS
+                            ) {
+                                const delay =
+                                    JOB_RETRY_BASE_DELAY_MS *
+                                    Math.pow(2, attempt - 1);
+                                logger.warn(
+                                    `Rebuild queue: job ${job.type}:${job.id} hit a transient error (attempt ${attempt}/${MAX_JOB_ATTEMPTS}), re-queuing in ${delay}ms:`,
+                                    err
+                                );
+                                setTimeout(() => {
+                                    this.enqueue({ ...job, attempt }).catch(
+                                        (enqueueErr) =>
+                                            logger.error(
+                                                `Rebuild queue: failed to re-queue ${job.type}:${job.id} after transient error:`,
+                                                enqueueErr
+                                            )
+                                    );
+                                }, delay);
+                            } else {
+                                logger.error(
+                                    `Rebuild queue: job ${job.type}:${job.id} threw an error:`,
+                                    err
+                                );
+                            }
+                        }
+                    }
+                },
+                PROCESSOR_LOCK_TTL_MS
+            );
+        } catch (err: any) {
+            if (
+                typeof err?.message === "string" &&
+                err.message.startsWith("Failed to acquire lock")
+            ) {
+                // Another server instance currently holds the processor lock and
+                // is consuming the queue — nothing to do this cycle.
+                logger.debug(
+                    "Rebuild queue: processor lock held by another instance, skipping this cycle"
+                );
+            } else {
+                throw err;
+            }
+        }
+    }
+}
+
+export const rebuildQueue: RedisRebuildQueue = new RedisRebuildQueue();

server/private/lib/redis.ts

@@ -894,6 +894,19 @@ class RegionalRedisManager {
         return opts;
     }
 
+    // The regional Redis StatefulSet's "redis" service pins to pod redis-0
+    // (primary). The replica (redis-1) is only reachable through the
+    // per-pod headless service: <svc>.<namespace>.svc.cluster.local ->
+    // redis-1.redis-headless.<namespace>.svc.cluster.local. Returns null
+    // if the configured host doesn't match that pattern (e.g. local dev),
+    // in which case callers should fall back to the primary for reads.
+    private getReplicaHost(primaryHost: string): string | null {
+        const match = primaryHost.match(/^redis\.([^.]+)\.svc\.cluster\.local$/);
+        if (!match) return null;
+        const namespace = match[1];
+        return `redis-1.redis-headless.${namespace}.svc.cluster.local`;
+    }
+
     private initializeClients(): void {
         const cfg = this.getConfig();
         const baseOpts = {
@@ -907,35 +920,42 @@ class RegionalRedisManager {
 
         try {
             this.writeClient = new Redis(baseOpts);
-            // redis-1 (replica) handles reads; fall back to primary if not resolvable
-            this.readClient = new Redis({
-                ...baseOpts,
-                host: cfg.host!.replace(/^(.*?)(\.\S+)$/, (_, h, rest) => {
-                    // Derive replica hostname from the headless service pattern:
-                    // redis.redis.svc.cluster.local -> redis-1.redis-headless.redis.svc.cluster.local
-                    // If it doesn't look like a k8s service, just use the same host
-                    return h + rest;
-                })
-            });
 
-            // For simplicity use same host for both; callers can always read from primary
-            // The real replica routing is handled by the StatefulSet headless service
-            this.readClient = this.writeClient;
+            const replicaHost = this.getReplicaHost(cfg.host!);
+            this.readClient = replicaHost
+                ? new Redis({ ...baseOpts, host: replicaHost })
+                : this.writeClient;
 
             this.writeClient.on("ready", () => {
-                logger.info("Regional Redis client ready");
+                logger.info("Regional Redis write client ready");
                 this.isHealthy = true;
             });
             this.writeClient.on("error", (err) => {
-                logger.error("Regional Redis client error:", err);
+                logger.error("Regional Redis write client error:", err);
                 this.isHealthy = false;
             });
             this.writeClient.on("reconnecting", () => {
-                logger.info("Regional Redis client reconnecting...");
+                logger.info("Regional Redis write client reconnecting...");
                 this.isHealthy = false;
             });
 
-            logger.info("Regional Redis client initialized");
+            if (this.readClient !== this.writeClient) {
+                this.readClient.on("ready", () => {
+                    logger.info("Regional Redis read client ready");
+                });
+                this.readClient.on("error", (err) => {
+                    logger.error("Regional Redis read client error:", err);
+                });
+                this.readClient.on("reconnecting", () => {
+                    logger.info("Regional Redis read client reconnecting...");
+                });
+            }
+
+            logger.info(
+                replicaHost
+                    ? `Regional Redis client initialized (reads routed to replica ${replicaHost})`
+                    : "Regional Redis client initialized (no replica resolvable, reads routed to primary)"
+            );
         } catch (error) {
             logger.error("Failed to initialize regional Redis client:", error);
             this.isEnabled = false;
@@ -1000,13 +1020,55 @@ class RegionalRedisManager {
         }
     }
 
+    public getClient(): Redis | null {
+        return this.writeClient;
+    }
+
+    public async hget(key: string, field: string): Promise<string | null> {
+        if (!this.isRedisEnabled() || !this.readClient) return null;
+        try {
+            return await this.readClient.hget(key, field);
+        } catch (error) {
+            logger.error("Regional Redis HGET error:", error);
+            return null;
+        }
+    }
+
+    public async hset(
+        key: string,
+        field: string,
+        value: string
+    ): Promise<boolean> {
+        if (!this.isRedisEnabled() || !this.writeClient) return false;
+        try {
+            await this.writeClient.hset(key, field, value);
+            return true;
+        } catch (error) {
+            logger.error("Regional Redis HSET error:", error);
+            return false;
+        }
+    }
+
+    public async hgetall(key: string): Promise<Record<string, string>> {
+        if (!this.isRedisEnabled() || !this.readClient) return {};
+        try {
+            return await this.readClient.hgetall(key);
+        } catch (error) {
+            logger.error("Regional Redis HGETALL error:", error);
+            return {};
+        }
+    }
+
     public async disconnect(): Promise<void> {
         try {
+            if (this.readClient && this.readClient !== this.writeClient) {
+                await this.readClient.quit();
+            }
+            this.readClient = null;
             if (this.writeClient) {
                 await this.writeClient.quit();
                 this.writeClient = null;
             }
-            this.readClient = null;
             logger.info("Regional Redis client disconnected");
         } catch (error) {
             logger.error("Error disconnecting regional Redis client:", error);

server/private/lib/traefik/getTraefikConfig.ts

@@ -84,7 +84,8 @@ export async function getTraefikConfig(
     filterOutNamespaceDomains = false,
     generateLoginPageRouters = false,
     allowRawResources = true,
-    allowMaintenancePage = true
+    maintenancePageUiUrl: string | null = null,
+    browserGatewayUiUrl: string | null = null
 ): Promise<any> {
     // Get resources with their targets and sites in a single optimized query
     // Start from sites on this exit node, then join to targets and resources
@@ -95,9 +96,7 @@ export async function getTraefikConfig(
             resourceName: resources.name,
             fullDomain: resources.fullDomain,
             ssl: resources.ssl,
-            http: resources.http,
             proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
             subdomain: resources.subdomain,
             domainId: resources.domainId,
             enabled: resources.enabled,
@@ -110,6 +109,7 @@ export async function getTraefikConfig(
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
             wildcard: resources.wildcard,
+            mode: resources.mode,
 
             maintenanceModeEnabled: resources.maintenanceModeEnabled,
             maintenanceModeType: resources.maintenanceModeType,
@@ -172,8 +172,15 @@ export async function getTraefikConfig(
                 ),
                 inArray(sites.type, siteTypes),
                 allowRawResources
-                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
-                    : eq(resources.http, true)
+                    ? inArray(resources.mode, [
+                          "http",
+                          "udp",
+                          "tcp",
+                          "vnc",
+                          "ssh",
+                          "rdp"
+                      ]) // allow all three
+                    : inArray(resources.mode, ["http", "vnc", "ssh", "rdp"])
             )
         )
         .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -181,7 +188,10 @@ export async function getTraefikConfig(
     // Group by resource and include targets with their unique site data
     const resourcesMap = new Map();
 
-    resourcesWithTargetsAndSites.forEach((row) => {
+    for (const row of resourcesWithTargetsAndSites) {
+        if (!["http", "tcp", "udp"].includes(row.mode)) {
+            continue;
+        }
         const resourceId = row.resourceId;
         const resourceName = sanitize(row.resourceName) || "";
         const targetPath = encodePath(row.path); // Use encodePath to avoid collisions (e.g. "/a/b" vs "/a-b")
@@ -191,7 +201,7 @@ export async function getTraefikConfig(
         const priority = row.priority ?? 100;
 
         if (filterOutNamespaceDomains && row.domainNamespaceId) {
-            return;
+            continue;
         }
 
         // Create a unique key combining resourceId, path config, and rewrite config
@@ -218,7 +228,7 @@ export async function getTraefikConfig(
                 logger.debug(
                     `Invalid path rewrite configuration for resource ${resourceId}: ${validation.error}`
                 );
-                return;
+                continue;
             }
 
             resourcesMap.set(mapKey, {
@@ -227,9 +237,8 @@ export async function getTraefikConfig(
                 key: key,
                 fullDomain: row.fullDomain,
                 ssl: row.ssl,
-                http: row.http,
                 proxyPort: row.proxyPort,
-                protocol: row.protocol,
+                mode: row.mode,
                 subdomain: row.subdomain,
                 domainId: row.domainId,
                 enabled: row.enabled,
@@ -277,14 +286,88 @@ export async function getTraefikConfig(
                 online: row.siteOnline
             }
         });
-    });
+    }
+
+    // Group browser gateway targets by resource
+    type BrowserGatewayResourceEntry = {
+        resourceId: number;
+        name: string;
+        fullDomain: string | null;
+        ssl: boolean | null;
+        subdomain: string | null;
+        domainId: string | null;
+        enabled: boolean | null;
+        wildcard: boolean | null;
+        domainCertResolver: string | null;
+        preferWildcardCert: boolean | null;
+        maintenanceModeEnabled: boolean | null;
+        maintenanceModeType: string | null;
+        maintenanceTitle: string | null;
+        maintenanceMessage: string | null;
+        maintenanceEstimatedTime: string | null;
+        targets: {
+            targetId: number;
+            bgType: string;
+            siteId: number;
+            siteType: string;
+            siteOnline: boolean | null;
+            subnet: string | null;
+        }[];
+    };
+    const browserGatewayResourcesMap = new Map<
+        number,
+        BrowserGatewayResourceEntry
+    >();
+
+    if (browserGatewayUiUrl) {
+        for (const row of resourcesWithTargetsAndSites) {
+            if (!["ssh", "vnc", "rdp"].includes(row.mode)) {
+                continue;
+            }
+            if (filterOutNamespaceDomains && row.domainNamespaceId) {
+                continue;
+            }
+            if (!browserGatewayResourcesMap.has(row.resourceId)) {
+                browserGatewayResourcesMap.set(row.resourceId, {
+                    resourceId: row.resourceId,
+                    name: sanitize(row.resourceName) || "",
+                    fullDomain: row.fullDomain,
+                    ssl: row.ssl,
+                    subdomain: row.subdomain,
+                    domainId: row.domainId,
+                    enabled: row.enabled,
+                    wildcard: row.wildcard,
+                    domainCertResolver: row.domainCertResolver,
+                    preferWildcardCert: row.preferWildcardCert,
+                    maintenanceModeEnabled: row.maintenanceModeEnabled,
+                    maintenanceModeType: row.maintenanceModeType,
+                    maintenanceTitle: row.maintenanceTitle,
+                    maintenanceMessage: row.maintenanceMessage,
+                    maintenanceEstimatedTime: row.maintenanceEstimatedTime,
+                    targets: []
+                });
+            }
+            browserGatewayResourcesMap.get(row.resourceId)!.targets.push({
+                targetId: row.targetId,
+                bgType: row.mode,
+                siteId: row.siteId,
+                siteType: row.siteType,
+                siteOnline: row.siteOnline,
+                subnet: row.subnet
+            });
+        }
+    }
 
     let siteResourcesWithFullDomain: {
         siteResourceId: number;
         fullDomain: string | null;
-        mode: "http" | "host" | "cidr";
+        mode: "http" | "host" | "cidr" | "ssh";
     }[] = [];
-    if (build == "enterprise") {
+    if (
+        build == "enterprise" &&
+        !privateConfig.getRawPrivateConfig().flags
+            .disable_private_http_placeholder
+    ) {
         // we dont want to do this on the cloud
         // Query siteResources in HTTP mode with SSL enabled and aliases - cert generation / HTTPS edge
         siteResourcesWithFullDomain = await db
@@ -326,6 +409,12 @@ export async function getTraefikConfig(
                 domains.add(sr.fullDomain);
             }
         }
+        // Include browser gateway resource domains
+        for (const bgResource of browserGatewayResourcesMap.values()) {
+            if (bgResource.enabled && bgResource.ssl && bgResource.fullDomain) {
+                domains.add(bgResource.fullDomain);
+            }
+        }
         // get the valid certs for these domains
         validCerts = await getValidCertificatesForDomains(domains, true); // we are caching here because this is called often
         // logger.debug(`Valid certs for domains: ${JSON.stringify(validCerts)}`);
@@ -361,16 +450,29 @@ export async function getTraefikConfig(
         const transportName = `${key}-transport`;
         const headersMiddlewareName = `${key}-headers-middleware`;
 
+        logger.debug(
+            `Processing resource ${resource.name} with domain ${fullDomain} and ${targets.length} targets`
+        );
+
         if (!resource.enabled) {
+            logger.debug(
+                `Resource ${resource.name} is disabled, skipping Traefik config`
+            );
             continue;
         }
 
-        if (resource.http) {
+        if (resource.mode == "http") {
             if (!resource.domainId) {
+                logger.debug(
+                    `Resource ${resource.name} does not have a domainId, skipping Traefik config`
+                );
                 continue;
             }
 
             if (!resource.fullDomain) {
+                logger.debug(
+                    `Resource ${resource.name} does not have a fullDomain, skipping Traefik config`
+                );
                 continue;
             }
 
@@ -530,10 +632,11 @@ export async function getTraefikConfig(
                 }
             }
 
-            if (showMaintenancePage && allowMaintenancePage) {
+            if (showMaintenancePage && maintenancePageUiUrl) {
                 const maintenanceServiceName = `${key}-maintenance-service`;
                 const maintenanceRouterName = `${key}-maintenance-router`;
                 const rewriteMiddlewareName = `${key}-maintenance-rewrite`;
+                const maintenanceHeadersMiddlewareName = `${key}-maintenance-headers`;
 
                 const entrypointHttp =
                     config.getRawConfig().traefik.http_entrypoint;
@@ -546,15 +649,11 @@ export async function getTraefikConfig(
                     ? `*.${domainParts.slice(1).join(".")}`
                     : fullDomain;
 
-                const maintenancePort = config.getRawConfig().server.next_port;
-                const maintenanceHost =
-                    config.getRawConfig().server.internal_hostname;
-
                 config_output.http.services[maintenanceServiceName] = {
                     loadBalancer: {
                         servers: [
                             {
-                                url: `http://${maintenanceHost}:${maintenancePort}`
+                                url: maintenancePageUiUrl
                             }
                         ],
                         passHostHeader: true
@@ -573,12 +672,26 @@ export async function getTraefikConfig(
                     }
                 };
 
+                config_output.http.middlewares[
+                    maintenanceHeadersMiddlewareName
+                ] = {
+                    headers: {
+                        customRequestHeaders: {
+                            Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                            "p-host": fullDomain
+                        }
+                    }
+                };
+
                 config_output.http.routers[maintenanceRouterName] = {
                     entryPoints: [
                         resource.ssl ? entrypointHttps : entrypointHttp
                     ],
                     service: maintenanceServiceName,
-                    middlewares: [rewriteMiddlewareName],
+                    middlewares: [
+                        rewriteMiddlewareName,
+                        maintenanceHeadersMiddlewareName
+                    ],
                     rule: rule,
                     priority: 2000,
                     ...(resource.ssl ? { tls } : {})
@@ -591,7 +704,8 @@ export async function getTraefikConfig(
                             resource.ssl ? entrypointHttps : entrypointHttp
                         ],
                         service: maintenanceServiceName,
-                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
+                        middlewares: [maintenanceHeadersMiddlewareName],
+                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`)) `,
                         priority: 2001,
                         ...(resource.ssl ? { tls } : {})
                     };
@@ -845,13 +959,13 @@ export async function getTraefikConfig(
                     serviceName
                 ].loadBalancer.serversTransport = transportName;
             }
-        } else {
+        } else if (resource.mode == "tcp" || resource.mode == "udp") {
             // Non-HTTP (TCP/UDP) configuration
             if (!resource.enableProxy) {
                 continue;
             }
 
-            const protocol = resource.protocol.toLowerCase();
+            const protocol = resource.mode == "udp" ? "udp" : "tcp";
             const port = resource.proxyPort;
 
             if (!port) {
@@ -946,6 +1060,293 @@ export async function getTraefikConfig(
         }
     }
 
+    if (browserGatewayUiUrl) {
+        // Generate Traefik config for browser gateway resources
+        const browserGatewayPort = 39999;
+        for (const [, bgResource] of browserGatewayResourcesMap.entries()) {
+            if (!bgResource.enabled) continue;
+            if (!bgResource.domainId) continue;
+            if (!bgResource.fullDomain) continue;
+
+            if (!config_output.http.routers) config_output.http.routers = {};
+            if (!config_output.http.services) config_output.http.services = {};
+
+            const fullDomain = bgResource.fullDomain;
+            const additionalMiddlewares =
+                config.getRawConfig().traefik.additional_middlewares || [];
+            const routerMiddlewares = [
+                badgerMiddlewareName,
+                ...additionalMiddlewares
+            ];
+
+            const hostRule = `Host(\`${fullDomain}\`)`;
+
+            // Build TLS config
+            let tls = {};
+            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+                const domainParts = fullDomain.split(".");
+                let wildCard: string;
+                if (domainParts.length <= 2) {
+                    wildCard = `*.${domainParts.join(".")}`;
+                } else {
+                    wildCard = `*.${domainParts.slice(1).join(".")}`;
+                }
+                if (!bgResource.subdomain) {
+                    wildCard = fullDomain;
+                }
+
+                const globalDefaultResolver =
+                    config.getRawConfig().traefik.cert_resolver;
+                const globalDefaultPreferWildcard =
+                    config.getRawConfig().traefik.prefer_wildcard_cert;
+                const resolverName = bgResource.domainCertResolver
+                    ? bgResource.domainCertResolver.trim()
+                    : globalDefaultResolver;
+                const preferWildcard =
+                    bgResource.preferWildcardCert !== undefined &&
+                    bgResource.preferWildcardCert !== null
+                        ? bgResource.preferWildcardCert
+                        : globalDefaultPreferWildcard;
+
+                tls = {
+                    certResolver: resolverName,
+                    ...(preferWildcard ? { domains: [{ main: wildCard }] } : {})
+                };
+            } else {
+                const matchingCert = validCerts.find(
+                    (cert) => cert.queriedDomain === fullDomain
+                );
+                if (!matchingCert) {
+                    logger.debug(
+                        `No matching certificate found for browser gateway domain: ${fullDomain}`
+                    );
+                    continue;
+                }
+            }
+
+            const bgUiServiceName = `bg-r${bgResource.resourceId}-ui-service`;
+
+            if (bgResource.ssl) {
+                const redirectRouterName = `bg-r${bgResource.resourceId}-redirect`;
+                config_output.http.routers![redirectRouterName] = {
+                    entryPoints: [
+                        config.getRawConfig().traefik.http_entrypoint
+                    ],
+                    middlewares: [redirectHttpsMiddlewareName],
+                    service: bgUiServiceName,
+                    rule: hostRule,
+                    priority: 100
+                };
+            }
+
+            // Collect online sites for this resource (for any type)
+            const anySiteOnline = bgResource.targets.some((t) => t.siteOnline);
+
+            // Maintenance page logic for browser gateway resources
+            let showBgMaintenancePage = false;
+            if (bgResource.maintenanceModeEnabled) {
+                if (bgResource.maintenanceModeType === "forced") {
+                    showBgMaintenancePage = true;
+                } else if (bgResource.maintenanceModeType === "automatic") {
+                    showBgMaintenancePage = !anySiteOnline;
+                }
+            }
+
+            if (showBgMaintenancePage && maintenancePageUiUrl) {
+                const bgMaintenanceServiceName = `bg-r${bgResource.resourceId}-maintenance-service`;
+                const bgMaintenanceRouterName = `bg-r${bgResource.resourceId}-maintenance-router`;
+                const bgRewriteMiddlewareName = `bg-r${bgResource.resourceId}-maintenance-rewrite`;
+                const bgMaintenanceHeadersMiddlewareName = `bg-r${bgResource.resourceId}-maintenance-headers`;
+
+                const entrypointHttp =
+                    config.getRawConfig().traefik.http_entrypoint;
+                const entrypointHttps =
+                    config.getRawConfig().traefik.https_entrypoint;
+
+                if (!config_output.http.services)
+                    config_output.http.services = {};
+                if (!config_output.http.middlewares)
+                    config_output.http.middlewares = {};
+                if (!config_output.http.routers)
+                    config_output.http.routers = {};
+
+                config_output.http.services![bgMaintenanceServiceName] = {
+                    loadBalancer: {
+                        servers: [
+                            {
+                                url: maintenancePageUiUrl
+                            }
+                        ],
+                        passHostHeader: true
+                    }
+                };
+
+                config_output.http.middlewares![bgRewriteMiddlewareName] = {
+                    replacePathRegex: {
+                        regex: "^/(.*)",
+                        replacement: "/maintenance-screen"
+                    }
+                };
+
+                config_output.http.middlewares![
+                    bgMaintenanceHeadersMiddlewareName
+                ] = {
+                    headers: {
+                        customRequestHeaders: {
+                            Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                            "p-host": fullDomain
+                        }
+                    }
+                };
+
+                config_output.http.routers![bgMaintenanceRouterName] = {
+                    entryPoints: [
+                        bgResource.ssl ? entrypointHttps : entrypointHttp
+                    ],
+                    service: bgMaintenanceServiceName,
+                    middlewares: [
+                        bgRewriteMiddlewareName,
+                        bgMaintenanceHeadersMiddlewareName
+                    ],
+                    rule: hostRule,
+                    priority: 2000,
+                    ...(bgResource.ssl ? { tls } : {})
+                };
+
+                config_output.http.routers![
+                    `${bgMaintenanceRouterName}-assets`
+                ] = {
+                    entryPoints: [
+                        bgResource.ssl ? entrypointHttps : entrypointHttp
+                    ],
+                    service: bgMaintenanceServiceName,
+                    middlewares: [bgMaintenanceHeadersMiddlewareName],
+                    rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                    priority: 2001,
+                    ...(bgResource.ssl ? { tls } : {})
+                };
+
+                continue;
+            }
+
+            // Group targets by type and generate per-type websocket routers and services
+            const typeMap = new Map<string, typeof bgResource.targets>();
+            for (const t of bgResource.targets) {
+                if (!typeMap.has(t.bgType)) typeMap.set(t.bgType, []);
+                typeMap.get(t.bgType)!.push(t);
+            }
+
+            for (const [bgType, typedTargets] of typeMap.entries()) {
+                const bgKey = `bg-r${bgResource.resourceId}-${bgType}`;
+                const bgRouterName = `${bgKey}-router`;
+                const bgServiceName = `${bgKey}-service`;
+                const bgRule = `${hostRule} && PathPrefix(\`/gateway/${bgType}\`)`;
+
+                const servers = typedTargets
+                    .filter((t) => {
+                        if (!t.siteOnline && anySiteOnline) return false;
+                        if (t.siteType === "newt") return !!t.subnet;
+                        return false; // browser gateway only supported on newt sites
+                    })
+                    .map((t) => ({
+                        url: `http://${t.subnet!.split("/")[0]}:${browserGatewayPort}`
+                    }))
+                    .filter(
+                        (v, i, a) => a.findIndex((u) => u.url === v.url) === i
+                    );
+
+                config_output.http.routers![bgRouterName] = {
+                    entryPoints: [
+                        bgResource.ssl
+                            ? config.getRawConfig().traefik.https_entrypoint
+                            : config.getRawConfig().traefik.http_entrypoint
+                    ],
+                    middlewares: routerMiddlewares,
+                    service: bgServiceName,
+                    rule: bgRule,
+                    priority: 110, // highest - websocket path takes precedence
+                    ...(bgResource.ssl ? { tls } : {})
+                };
+
+                config_output.http.services![bgServiceName] = {
+                    loadBalancer: {
+                        servers
+                    }
+                };
+            }
+
+            // UI: serve the browser gateway page from the internal pangolin instance.
+            // The primary type is used for the path rewrite (e.g. /rdp), mirroring
+            // how the maintenance page rewrites everything to /maintenance-screen.
+            const primaryType = typeMap.keys().next().value as string;
+            const uiRewriteMiddlewareName = `bg-r${bgResource.resourceId}-ui-rewrite`;
+            const uiHeadersMiddlewareName = `bg-r${bgResource.resourceId}-ui-headers`;
+            const entrypoint = bgResource.ssl
+                ? config.getRawConfig().traefik.https_entrypoint
+                : config.getRawConfig().traefik.http_entrypoint;
+
+            if (!config_output.http.middlewares) {
+                config_output.http.middlewares = {};
+            }
+
+            config_output.http.middlewares![uiRewriteMiddlewareName] = {
+                replacePathRegex: {
+                    regex: "^/(.*)",
+                    replacement: `/${primaryType}`
+                }
+            };
+
+            config_output.http.middlewares![uiHeadersMiddlewareName] = {
+                headers: {
+                    customRequestHeaders: {
+                        Host: "app.pangolin.net", // if we are sending to the cloud the host needs to be this but we will pull the p-host to find the resource
+                        "p-host": fullDomain
+                    }
+                }
+            };
+
+            config_output.http.services![bgUiServiceName] = {
+                loadBalancer: {
+                    servers: [
+                        {
+                            url: browserGatewayUiUrl
+                        }
+                    ]
+                }
+            };
+
+            // Assets router at higher priority so /_next files load without rewrite.
+            // Do NOT apply the path-rewrite middleware here — static assets must
+            // keep their original path; only the host headers are needed.
+            config_output.http.routers![
+                `bg-r${bgResource.resourceId}-assets-router`
+            ] = {
+                entryPoints: [entrypoint],
+                middlewares: [...routerMiddlewares, uiHeadersMiddlewareName],
+                service: bgUiServiceName,
+                rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                priority: 101,
+                ...(bgResource.ssl ? { tls } : {})
+            };
+
+            // Catch-all router rewrites everything on the domain to /{primaryType}
+            config_output.http.routers![
+                `bg-r${bgResource.resourceId}-ui-router`
+            ] = {
+                entryPoints: [entrypoint],
+                middlewares: [
+                    ...routerMiddlewares,
+                    uiRewriteMiddlewareName,
+                    uiHeadersMiddlewareName
+                ],
+                service: bgUiServiceName,
+                rule: hostRule,
+                priority: 100,
+                ...(bgResource.ssl ? { tls } : {})
+            };
+        }
+    }
+
     // Add Traefik routes for siteResource aliases (HTTP mode + SSL) so that
     // Traefik generates TLS certificates for those domains even when no
     // matching resource exists yet.
@@ -970,10 +1371,6 @@ export async function getTraefikConfig(
             const siteResourceRouterName = `${srKey}-router`;
             const siteResourceRewriteMiddlewareName = `${srKey}-rewrite`;
 
-            const maintenancePort = config.getRawConfig().server.next_port;
-            const maintenanceHost =
-                config.getRawConfig().server.internal_hostname;
-
             if (!config_output.http.routers) {
                 config_output.http.routers = {};
             }
@@ -989,7 +1386,7 @@ export async function getTraefikConfig(
                 loadBalancer: {
                     servers: [
                         {
-                            url: `http://${maintenanceHost}:${maintenancePort}`
+                            url: maintenancePageUiUrl
                         }
                     ],
                     passHostHeader: true
@@ -1061,7 +1458,7 @@ export async function getTraefikConfig(
             config_output.http.routers[`${siteResourceRouterName}-assets`] = {
                 entryPoints: [config.getRawConfig().traefik.https_entrypoint],
                 service: siteResourceServiceName,
-                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
+                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                 priority: 101,
                 tls
             };
@@ -1164,7 +1561,7 @@ export async function getTraefikConfig(
                         config.getRawConfig().traefik.https_entrypoint
                     ],
                     service: "landing-service",
-                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`))`,
+                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                     priority: 203,
                     tls: tls
                 };

server/private/middlewares/verifyCertificateAccess.ts

@@ -19,6 +19,7 @@ import { eq, and } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import logger from "@server/logger";
+import { getFirstString } from "@server/lib/requestParams";
 
 export async function verifyCertificateAccess(
     req: Request,
@@ -27,11 +28,43 @@ export async function verifyCertificateAccess(
 ) {
     try {
         // Assume user/org access is already verified
-        const orgId = req.params.orgId;
-        const certId =
-            req.params.certId || req.body?.certId || req.query?.certId;
-        let domainId =
-            req.params.domainId || req.body?.domainId || req.query?.domainId;
+        const orgId = getFirstString(req.params.orgId);
+
+        const certIdFromParams = getFirstString(req.params?.certId);
+        const certIdFromBody = getFirstString(req.body?.certId);
+
+        if (
+            certIdFromParams &&
+            certIdFromBody &&
+            certIdFromParams !== certIdFromBody
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Certificate ID provided in both URL and body with different values"
+                )
+            );
+        }
+
+        const certId = certIdFromParams || certIdFromBody;
+
+        const domainIdFromParams = getFirstString(req.params?.domainId);
+        const domainIdFromBody = getFirstString(req.body?.domainId);
+
+        if (
+            domainIdFromParams &&
+            domainIdFromBody &&
+            domainIdFromParams !== domainIdFromBody
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Domain ID provided in both URL and body with different values"
+                )
+            );
+        }
+
+        let domainId = domainIdFromParams || domainIdFromBody;
 
         if (!orgId) {
             return next(
@@ -65,7 +98,7 @@ export async function verifyCertificateAccess(
                 );
             }
 
-            domainId = cert.domainId;
+            domainId = cert.domainId ?? undefined;
             if (!domainId) {
                 return next(
                     createHttpError(

server/private/middlewares/verifyIdpAccess.ts

@@ -17,6 +17,7 @@ import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
+import { getFirstString } from "@server/lib/requestParams";
 
 export async function verifyIdpAccess(
     req: Request,
@@ -25,8 +26,12 @@ export async function verifyIdpAccess(
 ) {
     try {
         const userId = req.user!.userId;
-        const idpId = req.params.idpId || req.body.idpId || req.query.idpId;
-        const orgId = req.params.orgId;
+        const idpIdRaw =
+            getFirstString(req.params.idpId) ||
+            getFirstString(req.body?.idpId) ||
+            getFirstString(req.query?.idpId);
+        const idpId = Number.parseInt(idpIdRaw ?? "", 10);
+        const orgId = getFirstString(req.params.orgId);
 
         if (!userId) {
             return next(
@@ -40,7 +45,7 @@ export async function verifyIdpAccess(
             );
         }
 
-        if (!idpId) {
+        if (Number.isNaN(idpId)) {
             return next(
                 createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
             );

server/private/middlewares/verifyRemoteExitNodeAccess.ts

@@ -18,6 +18,7 @@ import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
+import { getFirstString } from "@server/lib/requestParams";
 
 export async function verifyRemoteExitNodeAccess(
     req: Request,
@@ -25,11 +26,11 @@ export async function verifyRemoteExitNodeAccess(
     next: NextFunction
 ) {
     const userId = req.user!.userId; // Assuming you have user information in the request
-    const orgId = req.params.orgId;
+    const orgId = getFirstString(req.params.orgId);
     const remoteExitNodeId =
-        req.params.remoteExitNodeId ||
-        req.body.remoteExitNodeId ||
-        req.query.remoteExitNodeId;
+        getFirstString(req.params.remoteExitNodeId) ||
+        getFirstString(req.body?.remoteExitNodeId) ||
+        getFirstString(req.query?.remoteExitNodeId);
 
     if (!userId) {
         return next(
@@ -37,6 +38,15 @@ export async function verifyRemoteExitNodeAccess(
         );
     }
 
+    if (!orgId || !remoteExitNodeId) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "Invalid organization or remote exit node ID"
+            )
+        );
+    }
+
     try {
         const [remoteExitNode] = await db
             .select()

server/private/middlewares/verifySubscription.ts

@@ -65,6 +65,7 @@ export function verifyValidSubscription(tiers: Tier[]) {
 
             return next();
         } catch (e) {
+            console.error(e);
             return next(
                 createHttpError(
                     HttpCode.INTERNAL_SERVER_ERROR,

server/private/routers/alertRule/createAlertRule.ts

@@ -202,7 +202,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createAlertRule(

server/private/routers/alertRule/deleteAlertRule.ts

@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteAlertRule(
@@ -97,4 +112,4 @@ export async function deleteAlertRule(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
+}

server/private/routers/alertRule/getAlertRule.ts

@@ -32,7 +32,10 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { and, eq } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
-import { GetAlertRuleResponse, WebhookAlertConfig } from "@server/routers/alertRule/types";
+import {
+    GetAlertRuleResponse,
+    WebhookAlertConfig
+} from "@server/routers/alertRule/types";
 
 const paramsSchema = z
     .object({
@@ -49,7 +52,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getAlertRule(

server/private/routers/alertRule/listAlertRules.ts

@@ -95,7 +95,22 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listAlertRules(

server/private/routers/alertRule/updateAlertRule.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import {
     alertRules,
@@ -148,6 +149,10 @@ const bodySchema = z
 export type UpdateAlertRuleResponse = {
     alertRuleId: number;
 };
+const UpdateAlertRuleResponseDataSchema = z.object({
+    alertRuleId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -164,7 +169,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateAlertRuleResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateAlertRule(

server/private/routers/approvals/processPendingApproval.ts

@@ -24,7 +24,7 @@ import type { NextFunction, Request, Response } from "express";
 
 const paramsSchema = z.strictObject({
     orgId: z.string(),
-    approvalId: z.string().transform(Number).pipe(z.int().positive())
+    approvalId: z.coerce.number().int().positive()
 });
 
 const bodySchema = z.strictObject({

server/private/routers/auditLogs/exportAccessAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryAccessAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryAccessAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportAccessAuditLogs(

server/private/routers/auditLogs/exportActionAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryActionAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryActionAuditLogsQuery,
         params: queryActionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportActionAuditLogs(

server/private/routers/auditLogs/exportConnectionAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryConnectionAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryConnectionAuditLogsQuery,
         params: queryConnectionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportConnectionAuditLogs(
@@ -56,7 +72,9 @@ export async function exportConnectionAuditLogs(
             );
         }
 
-        const parsedParams = queryConnectionAuditLogsParams.safeParse(req.params);
+        const parsedParams = queryConnectionAuditLogsParams.safeParse(
+            req.params
+        );
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -96,4 +114,4 @@ export async function exportConnectionAuditLogs(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
+}

server/private/routers/auditLogs/index.ts

@@ -17,3 +17,4 @@ export * from "./queryAccessAuditLog";
 export * from "./exportAccessAuditLog";
 export * from "./queryConnectionAuditLog";
 export * from "./exportConnectionAuditLog";
+export * from "./logAccessAuditAttempt";

server/private/routers/auditLogs/logAccessAuditAttempt.ts

@@ -0,0 +1,95 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction } from "express";
+import { Request, Response } from "express";
+import { z } from "zod";
+import createHttpError from "http-errors";
+import HttpCode from "@server/types/HttpCode";
+import { fromError } from "zod-validation-error";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { logAccessAudit } from "#private/lib/logAccessAudit";
+
+export const logAccessAuditAttemptSchema = z.object({
+    resourceId: z.number().int().positive(),
+    action: z.boolean(),
+    type: z.enum(["login", "ssh", "vnc", "rdp"])
+});
+
+export const logAccessAuditAttemptParams = z.object({
+    orgId: z.string()
+});
+
+export async function logAccessAuditAttempt(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = logAccessAuditAttemptSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error)
+                )
+            );
+        }
+        const parsedParams = logAccessAuditAttemptParams.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error)
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+        const { resourceId, action, type } = parsedBody.data;
+
+        const username = req.user?.username;
+        const userId = req.user?.userId;
+
+        await logAccessAudit({
+            orgId: orgId,
+            resourceId: resourceId,
+            action: action,
+            ...(username && userId
+                ? {
+                      user: {
+                          username,
+                          userId
+                      }
+                  }
+                : {}),
+            type: type,
+            userAgent: req.headers["user-agent"],
+            requestIp: req.ip
+        });
+
+        return response<null>(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Access audit attempt logged successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/auditLogs/queryAccessAuditLog.ts

@@ -11,11 +11,18 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { accessAuditLog, logsDb, resources, siteResources, db, primaryDb } from "@server/db";
+import {
+    accessAuditLog,
+    logsDb,
+    resources,
+    siteResources,
+    db,
+    primaryDb
+} from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
-import { eq, gt, lt, and, count, desc, inArray, isNull } from "drizzle-orm";
+import { eq, gt, lt, and, count, desc, inArray, isNull, or } from "drizzle-orm";
 import { OpenAPITags } from "@server/openApi";
 import { z } from "zod";
 import createHttpError from "http-errors";
@@ -93,13 +100,30 @@ export const queryAccessAuditLogsCombined = queryAccessAuditLogsQuery.merge(
 );
 type Q = z.infer<typeof queryAccessAuditLogsCombined>;
 
+function sortNamedFilterOptions<T extends { id: number; name: string | null }>(
+    items: T[]
+): T[] {
+    return [...items].sort((a, b) => {
+        const nameA = a.name ?? "";
+        const nameB = b.name ?? "";
+
+        if (nameA < nameB) return -1;
+        if (nameA > nameB) return 1;
+
+        return a.id - b.id;
+    });
+}
+
 function getWhere(data: Q) {
     return and(
         gt(accessAuditLog.timestamp, data.timeStart),
         lt(accessAuditLog.timestamp, data.timeEnd),
         eq(accessAuditLog.orgId, data.orgId),
         data.resourceId
-            ? eq(accessAuditLog.resourceId, data.resourceId)
+            ? or(
+                  eq(accessAuditLog.resourceId, data.resourceId),
+                  eq(accessAuditLog.siteResourceId, data.resourceId)
+              )
             : undefined,
         data.actor ? eq(accessAuditLog.actor, data.actor) : undefined,
         data.actorType
@@ -136,21 +160,30 @@ export function queryAccess(data: Q) {
         .orderBy(desc(accessAuditLog.timestamp), desc(accessAuditLog.id));
 }
 
-async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAccess>>) {
+async function enrichWithResourceDetails(
+    logs: Awaited<ReturnType<typeof queryAccess>>
+) {
     const resourceIds = logs
-        .map(log => log.resourceId)
+        .map((log) => log.resourceId)
         .filter((id): id is number => id !== null && id !== undefined);
 
     const siteResourceIds = logs
-        .filter(log => log.resourceId == null && log.siteResourceId != null)
-        .map(log => log.siteResourceId)
+        .filter((log) => log.resourceId == null && log.siteResourceId != null)
+        .map((log) => log.siteResourceId)
         .filter((id): id is number => id !== null && id !== undefined);
 
     if (resourceIds.length === 0 && siteResourceIds.length === 0) {
-        return logs.map(log => ({ ...log, resourceName: null, resourceNiceId: null }));
+        return logs.map((log) => ({
+            ...log,
+            resourceName: null,
+            resourceNiceId: null
+        }));
     }
 
-    const resourceMap = new Map<number, { name: string | null; niceId: string | null }>();
+    const resourceMap = new Map<
+        number,
+        { name: string | null; niceId: string | null }
+    >();
 
     if (resourceIds.length > 0) {
         const resourceDetails = await primaryDb
@@ -167,7 +200,10 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAc
         }
     }
 
-    const siteResourceMap = new Map<number, { name: string | null; niceId: string | null }>();
+    const siteResourceMap = new Map<
+        number,
+        { name: string | null; niceId: string | null }
+    >();
 
     if (siteResourceIds.length > 0) {
         const siteResourceDetails = await primaryDb
@@ -180,12 +216,15 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAc
             .where(inArray(siteResources.siteResourceId, siteResourceIds));
 
         for (const r of siteResourceDetails) {
-            siteResourceMap.set(r.siteResourceId, { name: r.name, niceId: r.niceId });
+            siteResourceMap.set(r.siteResourceId, {
+                name: r.name,
+                niceId: r.niceId
+            });
         }
     }
 
     // Enrich logs with resource details
-    return logs.map(log => {
+    return logs.map((log) => {
         if (log.resourceId != null) {
             const details = resourceMap.get(log.resourceId);
             return {
@@ -197,7 +236,6 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAc
             const details = siteResourceMap.get(log.siteResourceId);
             return {
                 ...log,
-                resourceId: log.siteResourceId,
                 resourceName: details?.name ?? null,
                 resourceNiceId: details?.niceId ?? null
             };
@@ -259,11 +297,11 @@ async function queryUniqueFilterAttributes(
 
     // Fetch resource names from main database for the unique resource IDs
     const resourceIds = uniqueResources
-        .map(row => row.id)
+        .map((row) => row.id)
         .filter((id): id is number => id !== null);
 
     const siteResourceIds = uniqueSiteResources
-        .map(row => row.id)
+        .map((row) => row.id)
         .filter((id): id is number => id !== null);
 
     let resourcesWithNames: Array<{ id: number; name: string | null }> = [];
@@ -279,7 +317,7 @@ async function queryUniqueFilterAttributes(
 
         resourcesWithNames = [
             ...resourcesWithNames,
-            ...resourceDetails.map(r => ({
+            ...resourceDetails.map((r) => ({
                 id: r.resourceId,
                 name: r.name
             }))
@@ -297,7 +335,7 @@ async function queryUniqueFilterAttributes(
 
         resourcesWithNames = [
             ...resourcesWithNames,
-            ...siteResourceDetails.map(r => ({
+            ...siteResourceDetails.map((r) => ({
                 id: r.siteResourceId,
                 name: r.name
             }))
@@ -308,7 +346,7 @@ async function queryUniqueFilterAttributes(
         actors: uniqueActors
             .map((row) => row.actor)
             .filter((actor): actor is string => actor !== null),
-        resources: resourcesWithNames,
+        resources: sortNamedFilterOptions(resourcesWithNames),
         locations: uniqueLocations
             .map((row) => row.locations)
             .filter((location): location is string => location !== null)
@@ -324,7 +362,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryAccessAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryAccessAuditLogs(

server/private/routers/auditLogs/queryActionAuditLog.ts

@@ -165,7 +165,22 @@ registry.registerPath({
         query: queryActionAuditLogsQuery,
         params: queryActionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryActionAuditLogs(

server/private/routers/auditLogs/queryConnectionAuditLog.ts

@@ -107,6 +107,20 @@ export const queryConnectionAuditLogsCombined =
     queryConnectionAuditLogsQuery.merge(queryConnectionAuditLogsParams);
 type Q = z.infer<typeof queryConnectionAuditLogsCombined>;
 
+function sortNamedFilterOptions<T extends { id: number; name: string | null }>(
+    items: T[]
+): T[] {
+    return [...items].sort((a, b) => {
+        const nameA = a.name ?? "";
+        const nameB = b.name ?? "";
+
+        if (nameA < nameB) return -1;
+        if (nameA > nameB) return 1;
+
+        return a.id - b.id;
+    });
+}
+
 function getWhere(data: Q) {
     return and(
         gt(connectionAuditLog.startedAt, data.timeStart),
@@ -425,7 +439,7 @@ async function queryUniqueFilterAttributes(
             .map((row) => row.destAddr)
             .filter((addr): addr is string => addr !== null),
         clients: clientsWithNames,
-        resources: resourcesWithNames,
+        resources: sortNamedFilterOptions(resourcesWithNames),
         users: usersWithEmails
     };
 }
@@ -439,7 +453,22 @@ registry.registerPath({
         query: queryConnectionAuditLogsQuery,
         params: queryConnectionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryConnectionAuditLogs(

server/private/routers/auth/transferSession.ts

@@ -17,8 +17,7 @@ import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
-import { sessions, sessionTransferToken } from "@server/db";
-import { db } from "@server/db";
+import { db, safeRead, sessions, sessionTransferToken } from "@server/db";
 import { eq } from "drizzle-orm";
 import { response } from "@server/lib/response";
 import { encodeHexLowerCase } from "@oslojs/encoding";
@@ -57,15 +56,19 @@ export async function transferSession(
             sha256(new TextEncoder().encode(token))
         );
 
-        const [existing] = await db
-            .select()
-            .from(sessionTransferToken)
-            .where(eq(sessionTransferToken.token, tokenRaw))
-            .innerJoin(
-                sessions,
-                eq(sessions.sessionId, sessionTransferToken.sessionId)
-            )
-            .limit(1);
+        const result = await safeRead((db) =>
+            db
+                .select()
+                .from(sessionTransferToken)
+                .where(eq(sessionTransferToken.token, tokenRaw))
+                .innerJoin(
+                    sessions,
+                    eq(sessions.sessionId, sessionTransferToken.sessionId)
+                )
+                .limit(1)
+        );
+
+        const [existing] = result;
 
         if (!existing) {
             return next(

server/private/routers/billing/changeTier.ts

@@ -25,7 +25,7 @@ import {
     getTier1FeaturePriceSet,
     getTier3FeaturePriceSet,
     getTier2FeaturePriceSet,
-    FeatureId,
+    LimitId,
     type FeaturePriceSet
 } from "@server/lib/billing";
 import { getLineItems } from "@server/lib/billing/getLineItems";
@@ -214,7 +214,7 @@ export async function changeTier(
                     }
 
                     // Map to the corresponding feature in the new tier
-                    const newPriceId = targetPriceSet[FeatureId.USERS];
+                    const newPriceId = targetPriceSet[LimitId.USERS];
 
                     if (newPriceId) {
                         return {

server/private/routers/billing/featureLifecycle.ts

@@ -308,8 +308,8 @@ async function disableFeature(
                 await disableAutoProvisioning(orgId);
                 break;
 
-            case TierFeature.SshPam:
-                await disableSshPam(orgId);
+            case TierFeature.AdvancedPrivateResources:
+                await disableAdvancedPrivateResources(orgId);
                 break;
 
             case TierFeature.FullRbac:
@@ -357,10 +357,11 @@ async function disableDeviceApprovals(orgId: string): Promise<void> {
     logger.info(`Disabled device approvals on all roles for org ${orgId}`);
 }
 
-async function disableSshPam(orgId: string): Promise<void> {
-    logger.info(
-        `Disabled SSH PAM options on all roles and site resources for org ${orgId}`
-    );
+async function disableAdvancedPrivateResources(orgId: string): Promise<void> {
+    // TODO: implement logic to disable advanced private resourcs like ssh and ssh pam
+    // logger.info(
+    //     `Disabled advanced private resources on all roles and site resources for org ${orgId}`
+    // );
 }
 
 async function disableFullRbac(orgId: string): Promise<void> {

server/private/routers/billing/getOrgUsage.ts

@@ -24,7 +24,7 @@ import { fromZodError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { Limit, limits, Usage, usage } from "@server/db";
 import { usageService } from "@server/lib/billing/usageService";
-import { FeatureId } from "@server/lib/billing";
+import { LimitId } from "@server/lib/billing";
 import { GetOrgUsageResponse } from "@server/routers/billing/types";
 
 const getOrgSchema = z.strictObject({
@@ -39,7 +39,22 @@ const getOrgSchema = z.strictObject({
 //     request: {
 //         params: getOrgSchema
 //     },
-//     responses: {}
+// responses: {
+// 200: {
+// description: "Successful response",
+// content: {
+// "application/json": {
+// schema: z.object({
+// data: z.record(z.string(), z.any()).nullable(),
+// success: z.boolean(),
+// error: z.boolean(),
+// message: z.string(),
+// status: z.number()
+// })
+// }
+// }
+// }
+// }
 // });
 
 export async function getOrgUsage(
@@ -78,16 +93,28 @@ export async function getOrgUsage(
         // Get usage for org
         const usageData = [];
 
-        const sites = await usageService.getUsage(orgId, FeatureId.SITES);
-        const users = await usageService.getUsage(orgId, FeatureId.USERS);
-        const domains = await usageService.getUsage(orgId, FeatureId.DOMAINS);
+        const sites = await usageService.getUsage(orgId, LimitId.SITES);
+        const users = await usageService.getUsage(orgId, LimitId.USERS);
+        const domains = await usageService.getUsage(orgId, LimitId.DOMAINS);
         const remoteExitNodes = await usageService.getUsage(
             orgId,
-            FeatureId.REMOTE_EXIT_NODES
+            LimitId.REMOTE_EXIT_NODES
         );
         const organizations = await usageService.getUsage(
             orgId,
-            FeatureId.ORGINIZATIONS
+            LimitId.ORGANIZATIONS
+        );
+        const publicResources = await usageService.getUsage(
+            orgId,
+            LimitId.PUBLIC_RESOURCES
+        );
+        const privateResources = await usageService.getUsage(
+            orgId,
+            LimitId.PRIVATE_RESOURCES
+        );
+        const machineClients = await usageService.getUsage(
+            orgId,
+            LimitId.MACHINE_CLIENTS
         );
         // const egressData = await usageService.getUsage(
         //     orgId,
@@ -112,6 +139,15 @@ export async function getOrgUsage(
         if (organizations) {
             usageData.push(organizations);
         }
+        if (publicResources) {
+            usageData.push(publicResources);
+        }
+        if (privateResources) {
+            usageData.push(privateResources);
+        }
+        if (machineClients) {
+            usageData.push(machineClients);
+        }
 
         const orgLimits = await db
             .select()

server/private/routers/browserGatewayTarget/getBrowserTarget.ts

@@ -0,0 +1,115 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources, targets } from "@server/db";
+import { eq, and, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { decrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+import { GetBrowserTargetResponse } from "@server/routers/browserGatewayTarget";
+
+const getBrowserTargetSchema = z
+    .object({
+        fullDomain: z.string().min(1, "fullDomain is required")
+    })
+    .strict();
+
+export async function getBrowserTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsed = getBrowserTargetSchema.safeParse(req.query);
+        if (!parsed.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsed.error).toString()
+                )
+            );
+        }
+
+        const { fullDomain } = parsed.data;
+
+        logger.info(`Retrieving browser target for domain: ${fullDomain}`);
+
+        const [row] = await db
+            .select({
+                ip: targets.ip,
+                port: targets.port,
+                authToken: targets.authToken,
+                resourceId: resources.resourceId,
+                niceId: resources.niceId,
+                name: resources.name,
+                orgId: resources.orgId,
+                pamMode: resources.pamMode,
+                authDaemonMode: resources.authDaemonMode
+            })
+            .from(targets)
+            .innerJoin(resources, eq(targets.resourceId, resources.resourceId))
+            .where(
+                and(
+                    eq(resources.fullDomain, fullDomain),
+                    eq(targets.enabled, true),
+                    inArray(targets.mode, ["ssh", "rdp", "vnc"])
+                )
+            )
+            .limit(1);
+
+        if (!row) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "No resource found for this domain"
+                )
+            );
+        }
+
+        const decryptedAuthToken = row.authToken
+            ? decrypt(row.authToken, config.getRawConfig().server.secret!)
+            : "";
+
+        return response<GetBrowserTargetResponse>(res, {
+            data: {
+                ip: row.ip,
+                port: row.port,
+                authToken: decryptedAuthToken,
+                pamMode: row.pamMode,
+                authDaemonMode: row.authDaemonMode,
+                orgId: row.orgId,
+                resourceId: row.resourceId,
+                niceId: row.niceId,
+                name: row.name ?? ""
+            },
+            success: true,
+            error: false,
+            message: "Browser target retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while retrieving the browser target"
+            )
+        );
+    }
+}

server/private/routers/browserGatewayTarget/index.ts

@@ -0,0 +1,14 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./getBrowserTarget";

server/private/routers/certificates/getCertificate.ts

@@ -115,7 +115,22 @@ registry.registerPath({
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getCertificate(

server/private/routers/certificates/restartCertificate.ts

@@ -25,7 +25,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const restartCertificateParamsSchema = z.strictObject({
-    certId: z.string().transform(stoi).pipe(z.int().positive()),
+    certId: z.coerce.number().int().positive(),
     orgId: z.string()
 });
 
@@ -36,11 +36,26 @@ registry.registerPath({
     tags: ["Certificate"],
     request: {
         params: z.object({
-            certId: z.string().transform(stoi).pipe(z.int().positive()),
+            certId: z.coerce.number().int().positive(),
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function restartCertificate(

server/private/routers/domain/checkDomainNamespaceAvailability.ts

@@ -29,7 +29,7 @@ import { tierMatrix } from "@server/lib/billing/tierMatrix";
 const paramsSchema = z.strictObject({});
 
 const querySchema = z.strictObject({
-    subdomain: z.string(),
+    subdomain: z.string()
     // orgId: build === "saas" ? z.string() : z.string().optional() // Required for saas, optional otherwise
 });
 
@@ -42,7 +42,22 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function checkDomainNamespaceAvailability(

server/private/routers/domain/listDomainNamespaces.ts

@@ -25,6 +25,7 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const paramsSchema = z.strictObject({});
 
@@ -65,6 +66,20 @@ export type ListDomainNamespacesResponse = {
     pagination: { total: number; limit: number; offset: number };
 };
 
+const ListDomainNamespacesResponseDataSchema = z.object({
+    domainNamespaces: z.array(
+        z.object({
+            domainNamespaceId: z.string(),
+            domainId: z.string()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 registry.registerPath({
     method: "get",
     path: "/domains/namepaces",
@@ -73,7 +88,18 @@ registry.registerPath({
     request: {
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListDomainNamespacesResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listDomainNamespaces(

server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import { eventStreamingDestinations } from "@server/db";
 import { logStreamingManager } from "#private/lib/logStreaming";
@@ -42,6 +43,10 @@ const bodySchema = z.strictObject({
 export type CreateEventStreamingDestinationResponse = {
     destinationId: number;
 };
+const CreateEventStreamingDestinationResponseDataSchema = z.object({
+    destinationId: z.number()
+});
+
 
 registry.registerPath({
     method: "put",
@@ -58,7 +63,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateEventStreamingDestinationResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createEventStreamingDestination(

server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts

@@ -33,12 +33,28 @@ const paramsSchema = z
 registry.registerPath({
     method: "delete",
     path: "/org/{orgId}/event-streaming-destination/{destinationId}",
-    description: "Delete an event streaming destination for a specific organization.",
+    description:
+        "Delete an event streaming destination for a specific organization.",
     tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteEventStreamingDestination(
@@ -100,4 +116,4 @@ export async function deleteEventStreamingDestination(
             createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
         );
     }
-}
+}

server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts

@@ -24,6 +24,7 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { eq, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -67,6 +68,31 @@ export type ListEventStreamingDestinationsResponse = {
     };
 };
 
+const ListEventStreamingDestinationsResponseDataSchema = z.object({
+    destinations: z.array(
+        z.object({
+            destinationId: z.number(),
+            orgId: z.string(),
+            type: z.string(),
+            config: z.string(),
+            enabled: z.boolean(),
+            lastError: z.string().nullable(),
+            lastErrorAt: z.number().nullable(),
+            createdAt: z.number(),
+            updatedAt: z.number(),
+            sendConnectionLogs: z.boolean(),
+            sendRequestLogs: z.boolean(),
+            sendActionLogs: z.boolean(),
+            sendAccessLogs: z.boolean()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 async function query(orgId: string, limit: number, offset: number) {
     const res = await db
         .select()
@@ -88,7 +114,18 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListEventStreamingDestinationsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listEventStreamingDestinations(

server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import { eventStreamingDestinations } from "@server/db";
 import response from "@server/lib/response";
@@ -45,6 +46,10 @@ const bodySchema = z.strictObject({
 export type UpdateEventStreamingDestinationResponse = {
     destinationId: number;
 };
+const UpdateEventStreamingDestinationResponseDataSchema = z.object({
+    destinationId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -61,7 +66,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateEventStreamingDestinationResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateEventStreamingDestination(

server/private/routers/external.ts

@@ -33,6 +33,8 @@ import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
 import * as labels from "#private/routers/labels";
 import * as client from "@server/routers/client";
+import * as resource from "#private/routers/resource";
+import * as policy from "#private/routers/policy";
 
 import {
     verifyOrgAccess,
@@ -46,7 +48,8 @@ import {
     verifyUserCanSetUserOrgRoles,
     verifySiteProvisioningKeyAccess,
     verifyIsLoggedInUser,
-    verifyAdmin
+    verifyAdmin,
+    verifyResourcePolicyAccess
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import {
@@ -326,6 +329,44 @@ authenticated.delete(
     remoteExitNode.deleteRemoteExitNode
 );
 
+authenticated.get(
+    "/org/:orgId/remote-exit-node/:remoteExitNodeId/resources",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyRemoteExitNodeAccess,
+    verifyUserHasAction(ActionsEnum.getRemoteExitNode),
+    remoteExitNode.listRemoteExitNodeResources
+);
+
+authenticated.post(
+    "/org/:orgId/remote-exit-node/:remoteExitNodeId/resources",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyRemoteExitNodeAccess,
+    verifyUserHasAction(ActionsEnum.updateRemoteExitNode),
+    logActionAudit(ActionsEnum.updateRemoteExitNode),
+    remoteExitNode.setRemoteExitNodeResources
+);
+
+authenticated.get(
+    "/org/:orgId/remote-exit-node/:remoteExitNodeId/preference-labels",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyRemoteExitNodeAccess,
+    verifyUserHasAction(ActionsEnum.getRemoteExitNode),
+    remoteExitNode.listRemoteExitNodePreferenceLabels
+);
+
+authenticated.post(
+    "/org/:orgId/remote-exit-node/:remoteExitNodeId/preference-labels",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyRemoteExitNodeAccess,
+    verifyUserHasAction(ActionsEnum.updateRemoteExitNode),
+    logActionAudit(ActionsEnum.updateRemoteExitNode),
+    remoteExitNode.setRemoteExitNodePreferenceLabels
+);
+
 authenticated.put(
     "/org/:orgId/login-page",
     verifyValidLicense,
@@ -384,6 +425,39 @@ authenticated.get(
     approval.countApprovals
 );
 
+authenticated.delete(
+    "/resource-policy/:resourcePolicyId",
+    verifyResourcePolicyAccess,
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.deleteResourcePolicy),
+    logActionAudit(ActionsEnum.deleteResourcePolicy),
+    policy.deleteResourcePolicy
+);
+
+authenticated.get(
+    "/org/:orgId/resource-policies",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyOrgAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.listResourcePolicies),
+    logActionAudit(ActionsEnum.listResourcePolicies),
+    policy.listResourcePolicies
+);
+
+authenticated.post(
+    "/org/:orgId/resource-policy",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyOrgAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.createResourcePolicy),
+    logActionAudit(ActionsEnum.createResourcePolicy),
+    policy.createResourcePolicy
+);
+
 authenticated.put(
     "/org/:orgId/approvals/:approvalId",
     verifyValidLicense,
@@ -459,29 +533,31 @@ authRouter.post(
     auth.transferSession
 );
 
-authenticated.post(
-    "/license/activate",
-    verifyUserIsServerAdmin,
-    license.activateLicense
-);
+if (build !== "saas") {
+    authenticated.post(
+        "/license/activate",
+        verifyUserIsServerAdmin,
+        license.activateLicense
+    );
 
-authenticated.get(
-    "/license/keys",
-    verifyUserIsServerAdmin,
-    license.listLicenseKeys
-);
+    authenticated.get(
+        "/license/keys",
+        verifyUserIsServerAdmin,
+        license.listLicenseKeys
+    );
 
-authenticated.delete(
-    "/license/:licenseKey",
-    verifyUserIsServerAdmin,
-    license.deleteLicenseKey
-);
+    authenticated.delete(
+        "/license/:licenseKey",
+        verifyUserIsServerAdmin,
+        license.deleteLicenseKey
+    );
 
-authenticated.post(
-    "/license/recheck",
-    verifyUserIsServerAdmin,
-    license.recheckStatus
-);
+    authenticated.post(
+        "/license/recheck",
+        verifyUserIsServerAdmin,
+        license.recheckStatus
+    );
+}
 
 authenticated.get(
     "/org/:orgId/logs/action",
@@ -573,10 +649,10 @@ authenticated.put(
 authenticated.post(
     "/org/:orgId/ssh/sign-key",
     verifyValidLicense,
-    verifyValidSubscription(tierMatrix.sshPam),
+    verifyValidSubscription(tierMatrix.advancedPrivateResources),
     verifyOrgAccess,
     verifyLimits,
-    verifyUserHasAction(ActionsEnum.signSshKey),
+    // verifyUserHasAction(ActionsEnum.signSshKey), // this check happens inside of the function now
     // logActionAudit(ActionsEnum.signSshKey), // it is handled inside of the function below so we can include more metadata
     ssh.signSshKey
 );
@@ -842,3 +918,9 @@ authenticated.post(
     verifyClientAccess,
     client.rebuildClientAssociationsCacheRoute
 );
+
+authenticated.post(
+    "/org/:orgId/logs/access/attempt",
+    verifyOrgAccess,
+    logs.logAccessAuditAttempt
+);

server/private/routers/generatedLicense/generateNewLicense.ts

@@ -16,40 +16,44 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { response as sendResponse } from "@server/lib/response";
+import { getFirstString } from "@server/lib/requestParams";
 import privateConfig from "#private/lib/config";
 import { GenerateNewLicenseResponse } from "@server/routers/generatedLicense/types";
 
 export interface CreateNewLicenseResponse {
-  data: Data
-  success: boolean
-  error: boolean
-  message: string
-  status: number
+    data: Data;
+    success: boolean;
+    error: boolean;
+    message: string;
+    status: number;
 }
 
 export interface Data {
-  licenseKey: LicenseKey
+    licenseKey: LicenseKey;
 }
 
 export interface LicenseKey {
-  id: number
-  instanceName: any
-  instanceId: string
-  licenseKey: string
-  tier: string
-  type: string
-  quantity: number
-  quantity_2: number
-  isValid: boolean
-  updatedAt: string
-  createdAt: string
-  expiresAt: string
-  paidFor: boolean
-  orgId: string
-  metadata: string
+    id: number;
+    instanceName: any;
+    instanceId: string;
+    licenseKey: string;
+    tier: string;
+    type: string;
+    quantity: number;
+    quantity_2: number;
+    isValid: boolean;
+    updatedAt: string;
+    createdAt: string;
+    expiresAt: string;
+    paidFor: boolean;
+    orgId: string;
+    metadata: string;
 }
 
-export async function createNewLicense(orgId: string, licenseData: any): Promise<CreateNewLicenseResponse> {
+export async function createNewLicense(
+    orgId: string,
+    licenseData: any
+): Promise<CreateNewLicenseResponse> {
     try {
         const response = await fetch(
             `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/${orgId}/create`, // this says enterprise but it does both
@@ -80,7 +84,7 @@ export async function generateNewLicense(
     next: NextFunction
 ): Promise<any> {
     try {
-        const { orgId } = req.params;
+        const orgId = getFirstString(req.params.orgId);
 
         if (!orgId) {
             return next(

server/private/routers/generatedLicense/listGeneratedLicenses.ts

@@ -16,6 +16,7 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { response as sendResponse } from "@server/lib/response";
+import { getFirstString } from "@server/lib/requestParams";
 import privateConfig from "#private/lib/config";
 import {
     GeneratedLicenseKey,
@@ -55,7 +56,7 @@ export async function listSaasLicenseKeys(
     next: NextFunction
 ): Promise<any> {
     try {
-        const { orgId } = req.params;
+        const orgId = getFirstString(req.params.orgId);
 
         if (!orgId) {
             return next(

server/private/routers/gerbil/createExitNode.ts

@@ -29,37 +29,41 @@ export async function createExitNode(
         .where(eq(exitNodes.publicKey, publicKey));
     let exitNode: ExitNode;
     if (!exitNodeQuery) {
-        const address = await getNextAvailableSubnet();
-        // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
-        // const listenPort = await getNextAvailablePort();
-        const listenPort = config.getRawConfig().gerbil.start_port;
-        let subEndpoint = "";
-        if (config.getRawConfig().gerbil.use_subdomain) {
-            subEndpoint = await getUniqueExitNodeEndpointName();
+        const { value: address, release } = await getNextAvailableSubnet();
+        try {
+            // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
+            // const listenPort = await getNextAvailablePort();
+            const listenPort = config.getRawConfig().gerbil.start_port;
+            let subEndpoint = "";
+            if (config.getRawConfig().gerbil.use_subdomain) {
+                subEndpoint = await getUniqueExitNodeEndpointName();
+            }
+
+            const exitNodeName =
+                config.getRawConfig().gerbil.exit_node_name ||
+                `Exit Node ${publicKey.slice(0, 8)}`;
+
+            // create a new exit node
+            [exitNode] = await db
+                .insert(exitNodes)
+                .values({
+                    publicKey,
+                    endpoint: `${subEndpoint}${subEndpoint != "" ? "." : ""}${config.getRawConfig().gerbil.base_endpoint}`,
+                    address,
+                    listenPort,
+                    online: true,
+                    reachableAt,
+                    name: exitNodeName
+                })
+                .returning()
+                .execute();
+
+            logger.info(
+                `Created new exit node ${exitNode.name} with address ${exitNode.address} and port ${exitNode.listenPort}`
+            );
+        } finally {
+            await release();
         }
-
-        const exitNodeName =
-            config.getRawConfig().gerbil.exit_node_name ||
-            `Exit Node ${publicKey.slice(0, 8)}`;
-
-        // create a new exit node
-        [exitNode] = await db
-            .insert(exitNodes)
-            .values({
-                publicKey,
-                endpoint: `${subEndpoint}${subEndpoint != "" ? "." : ""}${config.getRawConfig().gerbil.base_endpoint}`,
-                address,
-                listenPort,
-                online: true,
-                reachableAt,
-                name: exitNodeName
-            })
-            .returning()
-            .execute();
-
-        logger.info(
-            `Created new exit node ${exitNode.name} with address ${exitNode.address} and port ${exitNode.listenPort}`
-        );
     } else {
         // update the reachable at
         [exitNode] = await db

server/private/routers/healthChecks/createHealthCheck.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, targetHealthCheck, newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -28,30 +29,47 @@ const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
 });
 
-const bodySchema = z.strictObject({
-    name: z.string().nonempty(),
-    siteId: z.number().int().positive(),
-    hcEnabled: z.boolean().default(false),
-    hcMode: z.string().default("http"),
-    hcHostname: z.string().optional(),
-    hcPort: z.number().int().min(1).max(65535).optional(),
-    hcPath: z.string().optional(),
-    hcScheme: z.string().optional(),
-    hcMethod: z.string().default("GET"),
-    hcInterval: z.number().int().positive().default(30),
-    hcUnhealthyInterval: z.number().int().positive().default(30),
-    hcTimeout: z.number().int().positive().default(1),
-    hcHeaders: z.string().optional().nullable(),
-    hcFollowRedirects: z.boolean().default(true),
-    hcStatus: z.number().int().optional().nullable(),
-    hcTlsServerName: z.string().optional(),
-    hcHealthyThreshold: z.number().int().positive().default(1),
-    hcUnhealthyThreshold: z.number().int().positive().default(1)
-});
+const bodySchema = z
+    .strictObject({
+        name: z.string().nonempty(),
+        siteId: z.number().int().positive(),
+        hcEnabled: z.boolean().default(false),
+        hcMode: z.string().default("http"),
+        hcHostname: z.string().optional(),
+        hcPort: z.number().int().min(1).max(65535).optional(),
+        hcPath: z.string().optional(),
+        hcScheme: z.string().optional(),
+        hcMethod: z.string().default("GET"),
+        hcInterval: z.number().int().positive().default(30),
+        hcUnhealthyInterval: z.number().int().positive().default(30),
+        hcTimeout: z.number().int().positive().default(1),
+        hcHeaders: z.string().optional().nullable(),
+        hcFollowRedirects: z.boolean().default(true),
+        hcStatus: z.number().int().optional().nullable(),
+        hcTlsServerName: z.string().optional(),
+        hcHealthyThreshold: z.number().int().positive().default(1),
+        hcUnhealthyThreshold: z.number().int().positive().default(1)
+    })
+    .superRefine((data, ctx) => {
+        const hcHostnameMissing =
+            data.hcHostname === undefined ||
+            data.hcHostname.trim().length === 0;
+
+        if (data.hcEnabled === true && hcHostnameMissing) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["hcHostname"],
+                message: "hcHostname is required when hcEnabled is true"
+            });
+        }
+    });
 
 export type CreateHealthCheckResponse = {
     targetHealthCheckId: number;
 };
+const CreateHealthCheckResponseDataSchema = z.object({
+    targetHealthCheckId: z.number()
+});
 
 registry.registerPath({
     method: "put",
@@ -68,7 +86,18 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        CreateHealthCheckResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function createHealthCheck(

server/private/routers/healthChecks/deleteHealthCheck.ts

@@ -41,7 +41,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteHealthCheck(

server/private/routers/healthChecks/listHealthChecks.ts

@@ -68,7 +68,22 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listHealthChecks(

server/private/routers/healthChecks/updateHealthCheck.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, targetHealthCheck, newts, sites } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -81,6 +82,28 @@ export type UpdateHealthCheckResponse = {
     hcHealthyThreshold: number | null;
     hcUnhealthyThreshold: number | null;
 };
+const UpdateHealthCheckResponseDataSchema = z.object({
+    targetHealthCheckId: z.number(),
+    name: z.string().nullable(),
+    siteId: z.number().nullable(),
+    hcEnabled: z.boolean(),
+    hcHealth: z.string().nullable(),
+    hcMode: z.string().nullable(),
+    hcHostname: z.string().nullable(),
+    hcPort: z.number().nullable(),
+    hcPath: z.string().nullable(),
+    hcScheme: z.string().nullable(),
+    hcMethod: z.string().nullable(),
+    hcInterval: z.number().nullable(),
+    hcUnhealthyInterval: z.number().nullable(),
+    hcTimeout: z.number().nullable(),
+    hcHeaders: z.string().nullable(),
+    hcFollowRedirects: z.boolean().nullable(),
+    hcStatus: z.number().nullable(),
+    hcTlsServerName: z.string().nullable(),
+    hcHealthyThreshold: z.number().nullable(),
+    hcUnhealthyThreshold: z.number().nullable()
+});
 
 registry.registerPath({
     method: "post",
@@ -97,7 +120,18 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        UpdateHealthCheckResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function updateHealthCheck(
@@ -182,6 +216,32 @@ export async function updateHealthCheck(
             )
             .limit(1);
 
+        if (!existingHealthCheck) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Standalone health check not found"
+                )
+            );
+        }
+
+        const nextHcEnabled = hcEnabled ?? existingHealthCheck.hcEnabled;
+        const nextHcHostname =
+            hcHostname !== undefined
+                ? hcHostname
+                : existingHealthCheck.hcHostname;
+        const hcHostnameMissing =
+            !nextHcHostname || nextHcHostname.trim().length === 0;
+
+        if (nextHcEnabled && hcHostnameMissing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "hcHostname is required when hcEnabled is true"
+                )
+            );
+        }
+
         if (name !== undefined) updateData.name = name;
         if (siteId !== undefined) updateData.siteId = siteId;
         if (hcEnabled !== undefined) updateData.hcEnabled = hcEnabled;

server/private/routers/hybrid.ts

@@ -35,7 +35,14 @@ import {
     ResourceHeaderAuthExtendedCompatibility,
     orgs,
     requestAuditLog,
-    Org
+    Org,
+    resourcePolicies,
+    resourcePolicyPincode,
+    ResourcePolicyPincode,
+    resourcePolicyPassword,
+    ResourcePolicyPassword,
+    resourcePolicyHeaderAuth,
+    ResourcePolicyHeaderAuth
 } from "@server/db";
 import {
     resources,
@@ -45,12 +52,16 @@ import {
     users,
     userOrgs,
     roleResources,
+    rolePolicies,
     userResources,
+    userPolicies,
     resourceRules,
+    resourcePolicyRules,
     userOrgRoles,
     roles
 } from "@server/db";
-import { eq, and, inArray, isNotNull, ne, or, sql } from "drizzle-orm";
+import { eq, and, inArray, isNotNull, isNull, ne, or, sql } from "drizzle-orm";
+import { alias } from "@server/db";
 import { response } from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import { NextFunction, Request, Response } from "express";
@@ -68,7 +79,10 @@ import logger from "@server/logger";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
 import { exchangeSession } from "@server/routers/badger";
-import { validateResourceSessionToken } from "@server/auth/sessions/resource";
+import {
+    ResourceSessionValidationResult,
+    validateResourceSessionToken
+} from "@server/auth/sessions/resource";
 import { checkExitNodeOrg, resolveExitNodes } from "#private/lib/exitNodes";
 import { maxmindLookup } from "@server/db/maxmind";
 import { verifyResourceAccessToken } from "@server/auth/verifyResourceAccessToken";
@@ -201,10 +215,13 @@ export type ValidateResourceSessionTokenBody = z.infer<
 // Type definitions for API responses
 export type ResourceWithAuth = {
     resource: Resource | null;
-    pincode: ResourcePincode | null;
-    password: ResourcePassword | null;
-    headerAuth: ResourceHeaderAuth | null;
+    pincode: ResourcePincode | ResourcePolicyPincode | null;
+    password: ResourcePassword | ResourcePolicyPassword | null;
+    headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
     headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
+    applyRules: boolean | null;
+    sso: boolean | null;
+    emailWhitelistEnabled: boolean | null;
     org: Org;
 };
 
@@ -260,6 +277,8 @@ hybridRouter.get(
             );
         }
 
+        const pangolinUIUrl = config.getRawConfig().app.dashboard_url; // points to the dashboard to serve from there
+
         try {
             const traefikConfig = await getTraefikConfig(
                 remoteExitNode.exitNodeId,
@@ -267,7 +286,8 @@ hybridRouter.get(
                 true, // But don't allow domain namespace resources
                 false, // Dont include login pages,
                 true, // allow raw resources
-                false // dont generate maintenance page
+                pangolinUIUrl, // dont generate maintenance page
+                pangolinUIUrl // generate browser gateway targets
             );
 
             return response(res, {
@@ -430,7 +450,10 @@ hybridRouter.get(
                 );
 
                 // Decrypt and save key file
-                const decryptedKey = decrypt(cert.keyFile!, config.getRawConfig().server.secret!);
+                const decryptedKey = decrypt(
+                    cert.keyFile!,
+                    config.getRawConfig().server.secret!
+                );
 
                 // Return only the certificate data without org information
                 return {
@@ -500,6 +523,33 @@ hybridRouter.get(
                 wildcardCandidates.push(`*.${domainParts.slice(i).join(".")}`);
             }
 
+            const sharedPolicy = alias(resourcePolicies, "sharedPolicy");
+            const defaultPolicy = alias(resourcePolicies, "defaultPolicy");
+            const sharedPolicyPincode = alias(
+                resourcePolicyPincode,
+                "sharedPolicyPincode"
+            );
+            const defaultPolicyPincode = alias(
+                resourcePolicyPincode,
+                "defaultPolicyPincode"
+            );
+            const sharedPolicyPassword = alias(
+                resourcePolicyPassword,
+                "sharedPolicyPassword"
+            );
+            const defaultPolicyPassword = alias(
+                resourcePolicyPassword,
+                "defaultPolicyPassword"
+            );
+            const sharedPolicyHeaderAuth = alias(
+                resourcePolicyHeaderAuth,
+                "sharedPolicyHeaderAuth"
+            );
+            const defaultPolicyHeaderAuth = alias(
+                resourcePolicyHeaderAuth,
+                "defaultPolicyHeaderAuth"
+            );
+
             const potentialResults = await db
                 .select()
                 .from(resources)
@@ -522,6 +572,62 @@ hybridRouter.get(
                         resources.resourceId
                     )
                 )
+                .leftJoin(
+                    sharedPolicy,
+                    eq(
+                        sharedPolicy.resourcePolicyId,
+                        resources.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    sharedPolicyPincode,
+                    eq(
+                        sharedPolicyPincode.resourcePolicyId,
+                        sharedPolicy.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    sharedPolicyPassword,
+                    eq(
+                        sharedPolicyPassword.resourcePolicyId,
+                        sharedPolicy.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    sharedPolicyHeaderAuth,
+                    eq(
+                        sharedPolicyHeaderAuth.resourcePolicyId,
+                        sharedPolicy.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    defaultPolicy,
+                    eq(
+                        defaultPolicy.resourcePolicyId,
+                        resources.defaultResourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    defaultPolicyPincode,
+                    eq(
+                        defaultPolicyPincode.resourcePolicyId,
+                        defaultPolicy.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    defaultPolicyPassword,
+                    eq(
+                        defaultPolicyPassword.resourcePolicyId,
+                        defaultPolicy.resourcePolicyId
+                    )
+                )
+                .leftJoin(
+                    defaultPolicyHeaderAuth,
+                    eq(
+                        defaultPolicyHeaderAuth.resourcePolicyId,
+                        defaultPolicy.resourcePolicyId
+                    )
+                )
                 .innerJoin(orgs, eq(orgs.orgId, resources.orgId))
                 .where(
                     or(
@@ -531,7 +637,10 @@ hybridRouter.get(
                         wildcardCandidates.length > 0
                             ? and(
                                   eq(resources.wildcard, true),
-                                  inArray(resources.fullDomain, wildcardCandidates)
+                                  inArray(
+                                      resources.fullDomain,
+                                      wildcardCandidates
+                                  )
                               )
                             : sql`false`
                     )
@@ -545,10 +654,10 @@ hybridRouter.get(
 
             if (
                 result &&
-                await checkExitNodeOrg(
+                (await checkExitNodeOrg(
                     remoteExitNode.exitNodeId,
                     result.resources.orgId
-                )
+                ))
             ) {
                 // If the exit node is not allowed for the org, return an error
                 return next(
@@ -569,13 +678,49 @@ hybridRouter.get(
                 });
             }
 
+            const hasSharedPolicy = result.sharedPolicy !== null;
+
+            const effectivePolicyPincode = hasSharedPolicy
+                ? result.sharedPolicyPincode
+                : (result.defaultPolicyPincode ?? null);
+            const effectivePolicyPassword = hasSharedPolicy
+                ? result.sharedPolicyPassword
+                : (result.defaultPolicyPassword ?? null);
+            const effectivePolicyHeaderAuth = hasSharedPolicy
+                ? result.sharedPolicyHeaderAuth
+                : (result.defaultPolicyHeaderAuth ?? null);
+            const selectedPolicy = hasSharedPolicy
+                ? result.sharedPolicy
+                : result.defaultPolicy;
+            const effectiveApplyRules =
+                selectedPolicy?.applyRules ?? result.resources.applyRules;
+            const effectiveSSO = selectedPolicy?.sso ?? result.resources.sso;
+            const effectiveEmailWhitelistEnabled =
+                selectedPolicy?.emailWhitelistEnabled ??
+                result.resources.emailWhitelistEnabled;
+
             const resourceWithAuth: ResourceWithAuth = {
-                resource: result.resources,
-                pincode: result.resourcePincode,
-                password: result.resourcePassword,
-                headerAuth: result.resourceHeaderAuth,
-                headerAuthExtendedCompatibility:
-                    result.resourceHeaderAuthExtendedCompatibility,
+                resource: {
+                    ...result.resources,
+                    applyRules: effectiveApplyRules,
+                    sso: effectiveSSO,
+                    emailWhitelistEnabled: effectiveEmailWhitelistEnabled
+                },
+                pincode: effectivePolicyPincode ?? result.resourcePincode,
+                password: effectivePolicyPassword ?? result.resourcePassword,
+                headerAuth:
+                    effectivePolicyHeaderAuth ?? result.resourceHeaderAuth,
+                headerAuthExtendedCompatibility: effectivePolicyHeaderAuth
+                    ? ({
+                          headerAuthExtendedCompatibilityId: 0,
+                          resourceId: result.resources.resourceId,
+                          extendedCompatibilityIsActivated:
+                              effectivePolicyHeaderAuth.extendedCompatibility
+                      } as ResourceHeaderAuthExtendedCompatibility)
+                    : result.resourceHeaderAuthExtendedCompatibility,
+                applyRules: effectiveApplyRules,
+                sso: effectiveSSO,
+                emailWhitelistEnabled: effectiveEmailWhitelistEnabled,
                 org: result.orgs
             };
 
@@ -1132,22 +1277,52 @@ hybridRouter.get(
                 );
             }
 
-            const roleResourceAccess = await db
-                .select()
-                .from(roleResources)
-                .where(
-                    and(
-                        eq(roleResources.resourceId, resourceId),
-                        eq(roleResources.roleId, roleId)
+            const [direct, viaPolicies] = await Promise.all([
+                db
+                    .select()
+                    .from(roleResources)
+                    .where(
+                        and(
+                            eq(roleResources.resourceId, resourceId),
+                            eq(roleResources.roleId, roleId)
+                        )
                     )
-                )
-                .limit(1);
+                    .limit(1),
+                db
+                    .select({
+                        roleId: rolePolicies.roleId,
+                        resourcePolicyId: rolePolicies.resourcePolicyId
+                    })
+                    .from(rolePolicies)
+                    .innerJoin(
+                        resources,
+                        or(
+                            eq(
+                                resources.resourcePolicyId,
+                                rolePolicies.resourcePolicyId
+                            ),
+                            and(
+                                isNull(resources.resourcePolicyId),
+                                eq(
+                                    resources.defaultResourcePolicyId,
+                                    rolePolicies.resourcePolicyId
+                                )
+                            )
+                        )
+                    )
+                    .where(
+                        and(
+                            eq(resources.resourceId, resourceId),
+                            eq(rolePolicies.roleId, roleId)
+                        )
+                    )
+                    .limit(1)
+            ]);
 
-            const result =
-                roleResourceAccess.length > 0 ? roleResourceAccess[0] : null;
+            const result = direct[0] ?? viaPolicies[0] ?? null;
 
             return response<typeof roleResources.$inferSelect | null>(res, {
-                data: result,
+                data: result as any,
                 success: true,
                 error: false,
                 message: result
@@ -1222,21 +1397,53 @@ hybridRouter.get(
                 );
             }
 
-            const roleResourceAccess = await db
-                .select({
-                    resourceId: roleResources.resourceId,
-                    roleId: roleResources.roleId
-                })
-                .from(roleResources)
-                .where(
-                    and(
-                        eq(roleResources.resourceId, resourceId),
-                        inArray(roleResources.roleId, roleIds)
-                    )
-                );
+            const [direct, viaPolicies] = await Promise.all([
+                db
+                    .select({
+                        resourceId: roleResources.resourceId,
+                        roleId: roleResources.roleId
+                    })
+                    .from(roleResources)
+                    .where(
+                        and(
+                            eq(roleResources.resourceId, resourceId),
+                            inArray(roleResources.roleId, roleIds)
+                        )
+                    ),
+                roleIds.length > 0
+                    ? db
+                          .select({
+                              resourceId: sql<number>`${resourceId}`,
+                              roleId: rolePolicies.roleId
+                          })
+                          .from(rolePolicies)
+                          .innerJoin(
+                              resources,
+                              or(
+                                  eq(
+                                      resources.resourcePolicyId,
+                                      rolePolicies.resourcePolicyId
+                                  ),
+                                  and(
+                                      isNull(resources.resourcePolicyId),
+                                      eq(
+                                          resources.defaultResourcePolicyId,
+                                          rolePolicies.resourcePolicyId
+                                      )
+                                  )
+                              )
+                          )
+                          .where(
+                              and(
+                                  eq(resources.resourceId, resourceId),
+                                  inArray(rolePolicies.roleId, roleIds)
+                              )
+                          )
+                    : Promise.resolve([])
+            ]);
 
-            const result =
-                roleResourceAccess.length > 0 ? roleResourceAccess : null;
+            const combined = [...direct, ...viaPolicies];
+            const result = combined.length > 0 ? combined : null;
 
             return response<{ resourceId: number; roleId: number }[] | null>(
                 res,
@@ -1312,19 +1519,52 @@ hybridRouter.get(
                 );
             }
 
-            const userResourceAccess = await db
-                .select()
-                .from(userResources)
-                .where(
-                    and(
-                        eq(userResources.userId, userId),
-                        eq(userResources.resourceId, resourceId)
-                    )
-                )
-                .limit(1);
+            const [directUserAccess, viaPoliciesUserAccess] = await Promise.all(
+                [
+                    db
+                        .select()
+                        .from(userResources)
+                        .where(
+                            and(
+                                eq(userResources.userId, userId),
+                                eq(userResources.resourceId, resourceId)
+                            )
+                        )
+                        .limit(1),
+                    db
+                        .select({
+                            userId: userPolicies.userId,
+                            resourcePolicyId: userPolicies.resourcePolicyId
+                        })
+                        .from(userPolicies)
+                        .innerJoin(
+                            resources,
+                            or(
+                                eq(
+                                    resources.resourcePolicyId,
+                                    userPolicies.resourcePolicyId
+                                ),
+                                and(
+                                    isNull(resources.resourcePolicyId),
+                                    eq(
+                                        resources.defaultResourcePolicyId,
+                                        userPolicies.resourcePolicyId
+                                    )
+                                )
+                            )
+                        )
+                        .where(
+                            and(
+                                eq(resources.resourceId, resourceId),
+                                eq(userPolicies.userId, userId)
+                            )
+                        )
+                        .limit(1)
+                ]
+            );
 
             const result =
-                userResourceAccess.length > 0 ? userResourceAccess[0] : null;
+                directUserAccess[0] ?? viaPoliciesUserAccess[0] ?? null;
 
             return response<typeof userResources.$inferSelect | null>(res, {
                 data: result,
@@ -1397,10 +1637,54 @@ hybridRouter.get(
                 );
             }
 
-            const rules = await db
-                .select()
-                .from(resourceRules)
-                .where(eq(resourceRules.resourceId, resourceId));
+            const [directRules, policyRules] = await Promise.all([
+                db
+                    .select()
+                    .from(resourceRules)
+                    .where(eq(resourceRules.resourceId, resourceId)),
+                db
+                    .select({
+                        ruleId: resourcePolicyRules.ruleId,
+                        resourceId: sql<number>`${resourceId}`,
+                        enabled: resourcePolicyRules.enabled,
+                        priority: resourcePolicyRules.priority,
+                        action: resourcePolicyRules.action,
+                        match: resourcePolicyRules.match,
+                        value: resourcePolicyRules.value
+                    })
+                    .from(resourcePolicyRules)
+                    .innerJoin(
+                        resources,
+                        or(
+                            eq(
+                                resources.resourcePolicyId,
+                                resourcePolicyRules.resourcePolicyId
+                            ),
+                            and(
+                                isNull(resources.resourcePolicyId),
+                                eq(
+                                    resources.defaultResourcePolicyId,
+                                    resourcePolicyRules.resourcePolicyId
+                                )
+                            )
+                        )
+                    )
+                    .where(eq(resources.resourceId, resourceId))
+            ]);
+
+            const maxDirectPriority = directRules.reduce(
+                (max, r) => Math.max(max, r.priority),
+                0
+            );
+            const offsetPolicyRules = policyRules.map((r) => ({
+                ...r,
+                priority: maxDirectPriority + r.priority
+            }));
+
+            const rules = [
+                ...directRules,
+                ...offsetPolicyRules
+            ] as (typeof resourceRules.$inferSelect)[];
 
             // backward compatibility: COUNTRY -> GEOIP
             // TODO: remove this after a few versions once all exit nodes are updated
@@ -1475,11 +1759,34 @@ hybridRouter.post(
                 resourceId
             );
 
+            // this is for backward compatibility with nodes that did not have the policy id checking
+            const modifiedResult: ResourceSessionValidationResult = {
+                ...result,
+                resourceSession: result.resourceSession
+                    ? {
+                          ...result.resourceSession,
+                          // Prefer policy IDs, but keep legacy IDs populated for older nodes.
+                          pincodeId:
+                              result.resourceSession.policyPincodeId ??
+                              result.resourceSession.pincodeId ??
+                              null,
+                          passwordId:
+                              result.resourceSession.policyPasswordId ??
+                              result.resourceSession.passwordId ??
+                              null,
+                          whitelistId:
+                              result.resourceSession.policyWhitelistId ??
+                              result.resourceSession.whitelistId ??
+                              null
+                      }
+                    : null
+            };
+
             return response(res, {
-                data: result,
+                data: modifiedResult,
                 success: true,
                 error: false,
-                message: result.resourceSession
+                message: modifiedResult.resourceSession
                     ? "Resource session token is valid"
                     : "Resource session token is invalid or expired",
                 status: HttpCode.OK

server/private/routers/internal.ts

@@ -17,8 +17,14 @@ import * as orgIdp from "#private/routers/orgIdp";
 import * as billing from "#private/routers/billing";
 import * as license from "#private/routers/license";
 import * as resource from "#private/routers/resource";
+import * as ssh from "#private/routers/ssh";
+import * as ws from "@server/routers/ws";
+import * as browserTarget from "#private/routers/browserGatewayTarget";
 
-import { verifySessionUserMiddleware } from "@server/middlewares";
+import {
+    verifySessionUserMiddleware,
+    verifyUserFromResourceSessionMiddleware
+} from "@server/middlewares";
 
 import { internalRouter as ir } from "@server/routers/internal";
 
@@ -40,3 +46,17 @@ internalRouter.post(
 internalRouter.get(`/license/status`, license.getLicenseStatus);
 
 internalRouter.get("/maintenance/info", resource.getMaintenanceInfo);
+
+internalRouter.post(
+    "/org/:orgId/ssh/sign-key",
+    verifyUserFromResourceSessionMiddleware,
+    ssh.signSshKey
+);
+
+internalRouter.get(
+    "/ws/round-trip-message/:messageId",
+    verifyUserFromResourceSessionMiddleware,
+    ws.checkRoundTripMessage
+);
+
+internalRouter.get("/resource/browser-target", browserTarget.getBrowserTarget);

server/private/routers/labels/createOrgLabel.ts

@@ -22,7 +22,7 @@ import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -107,6 +107,26 @@ export async function createOrgLabel(
             }
         }
 
+        const [existingLabel] = await db
+            .select({ labelId: labels.labelId })
+            .from(labels)
+            .where(
+                and(
+                    eq(labels.orgId, orgId),
+                    sql`LOWER(${labels.name}) = ${name.toLowerCase()}`
+                )
+            )
+            .limit(1);
+
+        if (existingLabel) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    "A label with this name already exists"
+                )
+            );
+        }
+
         const label = await db.transaction(async (tx) => {
             const [label] = await tx
                 .insert(labels)

server/private/routers/labels/updateOrgLabel.ts

@@ -16,7 +16,7 @@ import response from "@server/lib/response";
 import logger from "@server/logger";
 import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
+import { and, eq, ne, sql } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -74,6 +74,29 @@ export async function updateOrgLabel(
 
         const { name, color } = parsedBody.data;
 
+        if (name && name.toLowerCase() !== existing.name.toLowerCase()) {
+            const [duplicateLabel] = await db
+                .select({ labelId: labels.labelId })
+                .from(labels)
+                .where(
+                    and(
+                        eq(labels.orgId, orgId),
+                        ne(labels.labelId, labelId),
+                        sql`LOWER(${labels.name}) = ${name.toLowerCase()}`
+                    )
+                )
+                .limit(1);
+
+            if (duplicateLabel) {
+                return next(
+                    createHttpError(
+                        HttpCode.CONFLICT,
+                        "A label with this name already exists"
+                    )
+                );
+            }
+        }
+
         const [label] = await db
             .update(labels)
             .set({

server/private/routers/org/sendTrialNotification.ts

@@ -215,7 +215,7 @@ export async function sendTrialNotification(
 
         if (resetLimits) {
             // this will only fire if they have not upgraded yet because when upgrading we delete the trial
-            await handleSubscriptionLifesycle(orgId, "cancled");
+            await handleSubscriptionLifesycle(orgId, "canceled");
             logger.debug(
                 `Trial ended for org ${orgId}, limits reset to free tier`
             );

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -63,7 +63,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createOrgOidcIdp(
@@ -112,7 +127,8 @@ export async function createOrgOidcIdp(
 
         let { autoProvision } = parsedBody.data;
 
-        if (build == "saas") { // this is not paywalled with a ee license because this whole endpoint is restricted
+        if (build == "saas") {
+            // this is not paywalled with a ee license because this whole endpoint is restricted
             const subscribed = await isSubscribed(
                 orgId,
                 tierMatrix.deviceApprovals

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteOrgIdp(

server/private/routers/orgIdp/getOrgIdp.ts

@@ -56,7 +56,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getOrgIdp(

server/private/routers/orgIdp/listOrgIdps.ts

@@ -72,7 +72,22 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listOrgIdps(

server/private/routers/orgIdp/unassociateOrgIdp.ts

@@ -13,14 +13,17 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, idpOrg } from "@server/db";
+import { db, idpOrg, orgs, primaryDb, users, userOrgs } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { and, eq, sql } from "drizzle-orm";
+import { removeUserFromOrg } from "@server/lib/userOrg";
+import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsForOrgs";
 import { OpenAPITags, registry } from "@server/openApi";
+import { isOrgRebuildRateLimited } from "@server/lib/rebuildClientAssociations";
 
 const paramsSchema = z
     .object({
@@ -76,9 +79,64 @@ export async function unassociateOrgIdp(
             );
         }
 
-        await db
-            .delete(idpOrg)
-            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (!org) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Organization not found")
+            );
+        }
+
+        if (await isOrgRebuildRateLimited(org.orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
+        const orgUsersFromIdp = await db
+            .select({
+                userId: userOrgs.userId,
+                isOwner: userOrgs.isOwner
+            })
+            .from(userOrgs)
+            .innerJoin(users, eq(users.userId, userOrgs.userId))
+            .where(and(eq(userOrgs.orgId, orgId), eq(users.idpId, idpId)));
+
+        if (orgUsersFromIdp.some((u) => u.isOwner)) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Cannot unassociate identity provider while an organization owner uses it"
+                )
+            );
+        }
+
+        const userIdsToRemove = orgUsersFromIdp.map((u) => u.userId);
+
+        await db.transaction(async (trx) => {
+            for (const userId of userIdsToRemove) {
+                await removeUserFromOrg(org, userId, trx);
+            }
+
+            await trx
+                .delete(idpOrg)
+                .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+        });
+
+        for (const userId of userIdsToRemove) {
+            calculateUserClientsForOrgs(userId).catch((e) => {
+                logger.error(
+                    `Failed to calculate user clients after removing user ${userId} from org ${orgId} during IdP unassociation: ${e}`
+                );
+            });
+        }
 
         return response<null>(res, {
             data: null,

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, idpOrg } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -54,6 +55,10 @@ const bodySchema = z.strictObject({
 export type UpdateOrgIdpResponse = {
     idpId: number;
 };
+const UpdateOrgIdpResponseDataSchema = z.object({
+    idpId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -70,7 +75,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateOrgIdpResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateOrgOidcIdp(

server/private/routers/policy/createResourcePolicy.ts

@@ -0,0 +1,403 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { hashPassword } from "@server/auth/password";
+import {
+    db,
+    idp,
+    idpOrg,
+    orgs,
+    resourcePolicies,
+    resourcePolicyHeaderAuth,
+    resourcePolicyPassword,
+    resourcePolicyPincode,
+    resourcePolicyRules,
+    resourcePolicyWhiteList,
+    rolePolicies,
+    roles,
+    userOrgs,
+    userPolicies,
+    users,
+    type ResourcePolicy
+} from "@server/db";
+import { getUniqueResourcePolicyName } from "@server/db/names";
+import response from "@server/lib/response";
+import {
+    getResourceRuleValueValidationError,
+    RESOURCE_RULE_MATCH_TYPES
+} from "@server/lib/validators";
+import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq, inArray, type InferInsertModel } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import z from "zod";
+import { fromError } from "zod-validation-error";
+
+const createResourcePolicyParamsSchema = z.strictObject({
+    orgId: z.string()
+});
+
+const ruleSchema = z.strictObject({
+    action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
+        type: "string",
+        enum: ["ACCEPT", "DROP", "PASS"],
+        description: "rule action"
+    }),
+    match: z.enum(RESOURCE_RULE_MATCH_TYPES).openapi({
+        type: "string",
+        enum: [...RESOURCE_RULE_MATCH_TYPES],
+        description: "rule match"
+    }),
+    value: z.string().min(1),
+    priority: z.int().openapi({
+        type: "integer",
+        description: "Rule priority"
+    }),
+    enabled: z.boolean().optional()
+});
+
+const createResourcePolicyBodySchema = z.strictObject({
+    name: z.string().min(1).max(255),
+    // Access control
+    sso: z.boolean().default(true),
+    skipToIdpId: z
+        .int()
+        .positive()
+        .optional()
+        .nullable()
+        .openapi({ type: "integer" }),
+    roleIds: z
+        .array(z.string().transform(Number).pipe(z.int().positive()))
+        .optional()
+        .default([]),
+    userIds: z.array(z.string()).optional().default([]),
+    // auth methods
+    password: z.string().min(4).max(100).nullable().optional(),
+    pincode: z
+        .string()
+        .regex(/^\d{6}$/)
+        .or(z.null())
+        .optional(),
+    headerAuth: z
+        .object({
+            user: z.string().min(4).max(100),
+            password: z.string().min(4).max(100),
+            extendedCompatibility: z.boolean()
+        })
+        .nullable()
+        .optional(),
+    // email OTP
+    emailWhitelistEnabled: z.boolean().optional().default(false),
+    emails: z
+        .array(
+            z.email().or(
+                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
+                    error: "Invalid email address. Wildcard (*) must be the entire local part."
+                })
+            )
+        )
+        .max(50)
+        .transform((v) => v.map((e) => e.toLowerCase()))
+        .optional()
+        .default([]),
+    // rules
+    applyRules: z.boolean().default(false),
+    rules: z.array(ruleSchema).optional().default([])
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/resource-policy",
+    description: "Create a resource policy.",
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    request: {
+        params: createResourcePolicyParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: createResourcePolicyBodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createResourcePolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        // Validate request params
+        const parsedParams = createResourcePolicyParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        if (req.user && req.userOrgRoleIds?.length === 0) {
+            return next(
+                createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
+            );
+        }
+
+        // get the org
+        const org = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (org.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Organization with ID ${orgId} not found`
+                )
+            );
+        }
+
+        const parsedBody = createResourcePolicyBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const {
+            name,
+            sso,
+            userIds,
+            roleIds,
+            skipToIdpId,
+            applyRules,
+            emailWhitelistEnabled,
+            password,
+            pincode,
+            headerAuth,
+            emails,
+            rules
+        } = parsedBody.data;
+
+        // Check if Identity provider in `skipToIdpId` exists
+        if (skipToIdpId) {
+            const [provider] = await db
+                .select()
+                .from(idp)
+                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
+                .where(and(eq(idp.idpId, skipToIdpId), eq(idpOrg.orgId, orgId)))
+                .limit(1);
+
+            if (!provider) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Identity provider not found in this organization"
+                    )
+                );
+            }
+        }
+
+        const adminRole = await db
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (adminRole.length === 0) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
+            );
+        }
+
+        const existingRoles = await db
+            .select()
+            .from(roles)
+            .where(and(inArray(roles.roleId, roleIds)));
+
+        const hasAdminRole = existingRoles.some((role) => role.isAdmin);
+
+        if (hasAdminRole) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Admin role cannot be assigned to resource policy"
+                )
+            );
+        }
+
+        const existingUsers = await db
+            .select()
+            .from(users)
+            .innerJoin(userOrgs, eq(userOrgs.userId, users.userId))
+            .where(
+                and(eq(userOrgs.orgId, orgId), inArray(users.userId, userIds))
+            );
+
+        const niceId = await getUniqueResourcePolicyName(orgId);
+
+        for (const rule of rules) {
+            const validationError = getResourceRuleValueValidationError(
+                rule.match,
+                rule.value
+            );
+            if (validationError) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, validationError)
+                );
+            }
+        }
+
+        const policy = await db.transaction(async (trx) => {
+            const [newPolicy] = await trx
+                .insert(resourcePolicies)
+                .values({
+                    niceId,
+                    orgId,
+                    name,
+                    sso,
+                    idpId: skipToIdpId,
+                    applyRules,
+                    emailWhitelistEnabled
+                })
+                .returning();
+
+            const rolesToAdd = [
+                {
+                    roleId: adminRole[0].roleId,
+                    resourcePolicyId: newPolicy.resourcePolicyId
+                }
+            ] satisfies InferInsertModel<typeof rolePolicies>[];
+
+            rolesToAdd.push(
+                ...existingRoles.map((role) => ({
+                    roleId: role.roleId,
+                    resourcePolicyId: newPolicy.resourcePolicyId
+                }))
+            );
+
+            await trx.insert(rolePolicies).values(rolesToAdd);
+
+            const usersToAdd: InferInsertModel<typeof userPolicies>[] = [];
+
+            if (
+                req.user &&
+                !req.userOrgRoleIds?.includes(adminRole[0].roleId)
+            ) {
+                // make sure the user can access the policy
+                usersToAdd.push({
+                    userId: req.user?.userId!,
+                    resourcePolicyId: newPolicy.resourcePolicyId
+                });
+            }
+
+            usersToAdd.push(
+                ...existingUsers.map(({ user }) => ({
+                    userId: user.userId,
+                    resourcePolicyId: newPolicy.resourcePolicyId
+                }))
+            );
+
+            if (usersToAdd.length > 0) {
+                await trx.insert(userPolicies).values(usersToAdd);
+            }
+
+            if (password) {
+                const passwordHash = await hashPassword(password);
+
+                await trx.insert(resourcePolicyPassword).values({
+                    resourcePolicyId: newPolicy.resourcePolicyId,
+                    passwordHash
+                });
+            }
+
+            if (pincode) {
+                const pincodeHash = await hashPassword(pincode);
+
+                await trx.insert(resourcePolicyPincode).values({
+                    resourcePolicyId: newPolicy.resourcePolicyId,
+                    pincodeHash,
+                    digitLength: 6
+                });
+            }
+
+            if (headerAuth) {
+                const headerAuthHash = await hashPassword(
+                    Buffer.from(
+                        `${headerAuth.user}:${headerAuth.password}`
+                    ).toString("base64")
+                );
+
+                await trx.insert(resourcePolicyHeaderAuth).values({
+                    resourcePolicyId: newPolicy.resourcePolicyId,
+                    headerAuthHash,
+                    extendedCompatibility: headerAuth.extendedCompatibility
+                });
+            }
+
+            if (emailWhitelistEnabled && emails.length > 0) {
+                await trx.insert(resourcePolicyWhiteList).values(
+                    emails.map((email) => ({
+                        email,
+                        resourcePolicyId: newPolicy.resourcePolicyId
+                    }))
+                );
+            }
+
+            if (rules.length > 0) {
+                await trx.insert(resourcePolicyRules).values(
+                    rules.map((rule) => ({
+                        resourcePolicyId: newPolicy.resourcePolicyId,
+                        ...rule
+                    }))
+                );
+            }
+
+            return newPolicy;
+        });
+
+        if (!policy) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Failed to create policy"
+                )
+            );
+        }
+        return response<ResourcePolicy>(res, {
+            data: policy,
+            success: true,
+            error: false,
+            message: "resource policy created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/policy/deleteResourcePolicy.ts

@@ -0,0 +1,107 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { db, resourcePolicies, resources } from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
+import HttpCode from "@server/types/HttpCode";
+import { eq } from "drizzle-orm";
+import type { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import z from "zod";
+import { fromError } from "zod-validation-error";
+
+// Define Zod schema for request parameters validation
+const deleteResourcePolicySchema = z.strictObject({
+    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/resource-policy/{resourcePolicyId}",
+    description: "Delete a resource policy.",
+    tags: [OpenAPITags.Policy],
+    request: {
+        params: deleteResourcePolicySchema
+    },
+    responses: {}
+});
+
+export async function deleteResourcePolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = deleteResourcePolicySchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourcePolicyId } = parsedParams.data;
+
+        const [existingResource] = await db
+            .select()
+            .from(resourcePolicies)
+            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
+
+        if (!existingResource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource Policy with ID ${resourcePolicyId} not found`
+                )
+            );
+        }
+
+        const totalAffectedResources = await db.$count(
+            db
+                .select()
+                .from(resources)
+                .where(eq(resources.resourcePolicyId, resourcePolicyId))
+        );
+
+        if (totalAffectedResources > 0) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `Cannot delete Policy '${existingResource.name}' as it's being used by at least one resource`
+                )
+            );
+        }
+
+        // delete policy
+        await db
+            .delete(resourcePolicies)
+            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Resource Policy deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/policy/index.ts

@@ -0,0 +1,16 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./createResourcePolicy";
+export * from "./listResourcePolicies";
+export * from "./deleteResourcePolicy";

server/private/routers/policy/listResourcePolicies.ts

@@ -0,0 +1,272 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import {
+    db,
+    resourcePolicies,
+    resources,
+    rolePolicies,
+    userPolicies
+} from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { OpenAPITags, registry } from "@server/openApi";
+import type {
+    ListResourcePoliciesResponse,
+    ResourcePolicyWithResources
+} from "@server/routers/resource/types";
+import HttpCode from "@server/types/HttpCode";
+import { and, asc, eq, inArray, like, or, sql } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromZodError } from "zod-validation-error";
+
+const listResourcePoliciesParamsSchema = z.strictObject({
+    orgId: z.string()
+});
+
+const listResourcePoliciesSchema = z.object({
+    pageSize: z.coerce
+        .number<string>() // for prettier formatting
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>() // for prettier formatting
+        .int()
+        .min(0)
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional()
+});
+
+function queryResourcePoliciesBase() {
+    return db
+        .select({
+            resourcePolicyId: resourcePolicies.resourcePolicyId,
+            name: resourcePolicies.name,
+            niceId: resourcePolicies.niceId,
+            orgId: resourcePolicies.orgId
+        })
+        .from(resourcePolicies);
+}
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/resource-policies",
+    description: "List resource policies for an organization.",
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    request: {
+        params: z.object({
+            orgId: z.string()
+        }),
+        query: listResourcePoliciesSchema
+    },
+    responses: {}
+});
+
+export async function listResourcePolicies(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listResourcePoliciesSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromZodError(parsedQuery.error)
+                )
+            );
+        }
+        const { page, pageSize, query } = parsedQuery.data;
+
+        const parsedParams = listResourcePoliciesParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromZodError(parsedParams.error)
+                )
+            );
+        }
+
+        const orgId =
+            parsedParams.data.orgId ||
+            req.userOrg?.orgId ||
+            req.apiKeyOrg?.orgId;
+
+        if (!orgId) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+            );
+        }
+
+        if (req.user && orgId && orgId !== req.userOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        let accessibleResourcePolicies: Array<{ resourcePolicyId: number }>;
+        if (req.user) {
+            accessibleResourcePolicies = await db
+                .select({
+                    resourcePolicyId: sql<number>`COALESCE(${userPolicies.resourcePolicyId}, ${rolePolicies.resourcePolicyId})`
+                })
+                .from(userPolicies)
+                .fullJoin(
+                    rolePolicies,
+                    eq(
+                        userPolicies.resourcePolicyId,
+                        rolePolicies.resourcePolicyId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userPolicies.userId, req.user!.userId),
+                        inArray(rolePolicies.roleId, req.userOrgRoleIds || [])
+                    )
+                );
+        } else {
+            accessibleResourcePolicies = await db
+                .select({
+                    resourcePolicyId: resourcePolicies.resourcePolicyId
+                })
+                .from(resourcePolicies)
+                .where(eq(resourcePolicies.orgId, orgId));
+        }
+
+        const accessibleResourceIds = accessibleResourcePolicies.map(
+            (resource) => resource.resourcePolicyId
+        );
+
+        const conditions = [
+            and(
+                inArray(
+                    resourcePolicies.resourcePolicyId,
+                    accessibleResourceIds
+                ),
+                eq(resourcePolicies.orgId, orgId),
+                eq(resourcePolicies.scope, "global")
+            )
+        ];
+
+        if (query) {
+            conditions.push(
+                or(
+                    like(
+                        sql`LOWER(${resourcePolicies.name})`,
+                        "%" + query.toLowerCase() + "%"
+                    ),
+                    like(
+                        sql`LOWER(${resourcePolicies.niceId})`,
+                        "%" + query.toLowerCase() + "%"
+                    )
+                )
+            );
+        }
+
+        const baseQuery = queryResourcePoliciesBase().where(and(...conditions));
+
+        // we need to add `as` so that drizzle filters the result as a subquery
+        const countQuery = db.$count(baseQuery.as("filtered_policies"));
+
+        const [rows, totalCount] = await Promise.all([
+            baseQuery
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(asc(resourcePolicies.resourcePolicyId)),
+            countQuery
+        ]);
+
+        const attachedResources =
+            rows.length === 0
+                ? []
+                : await db
+                      .select({
+                          resourceId: resources.resourceId,
+                          niceId: resources.niceId,
+                          name: resources.name,
+                          fullDomain: resources.fullDomain,
+                          resourcePolicyId: resources.resourcePolicyId
+                      })
+                      .from(resources)
+                      .where(
+                          inArray(
+                              resources.resourcePolicyId,
+                              rows.map((row) => row.resourcePolicyId)
+                          )
+                      );
+
+        // avoids TS issues with reduce/never[]
+        const map = new Map<number, ResourcePolicyWithResources>();
+
+        for (const row of rows) {
+            let entry = map.get(row.resourcePolicyId);
+            if (!entry) {
+                entry = {
+                    ...row,
+                    resources: []
+                };
+                map.set(row.resourcePolicyId, entry);
+            }
+
+            entry.resources = attachedResources.filter(
+                (r) => r.resourcePolicyId === entry?.resourcePolicyId
+            );
+        }
+
+        const policiesList = Array.from(map.values());
+
+        return response<ListResourcePoliciesResponse>(res, {
+            data: {
+                policies: policiesList,
+                pagination: {
+                    total: totalCount,
+                    pageSize,
+                    page
+                }
+            },
+            success: true,
+            error: false,
+            message: "Resources retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/re-key/reGenerateClientSecret.ts

@@ -28,7 +28,7 @@ import { OlmErrorCodes, sendOlmError } from "@server/routers/olm/error";
 import { sendTerminateClient } from "@server/routers/client/terminate";
 
 const reGenerateSecretParamsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 const reGenerateSecretBodySchema = z.strictObject({

server/private/routers/re-key/reGenerateSiteSecret.ts

@@ -27,7 +27,7 @@ import { getAllowedIps } from "@server/routers/target/helpers";
 import { disconnectClient, sendToClient } from "#private/routers/ws";
 
 const updateSiteParamsSchema = z.strictObject({
-    siteId: z.string().transform(Number).pipe(z.int().positive())
+    siteId: z.coerce.number().int().positive()
 });
 
 const updateSiteBodySchema = z.strictObject({

server/private/routers/remoteExitNode/createRemoteExitNode.ts

@@ -35,7 +35,7 @@ import logger from "@server/logger";
 import { and, eq, inArray, ne } from "drizzle-orm";
 import { getNextAvailableSubnet } from "@server/lib/exitNodes";
 import { usageService } from "@server/lib/billing/usageService";
-import { FeatureId } from "@server/lib/billing";
+import { LimitId } from "@server/lib/billing";
 import { CreateRemoteExitNodeResponse } from "@server/routers/remoteExitNode/types";
 
 export const paramsSchema = z.object({
@@ -79,7 +79,10 @@ export async function createRemoteExitNode(
 
         const { remoteExitNodeId, secret } = parsedBody.data;
 
-        if (req.user && (!req.userOrgRoleIds || req.userOrgRoleIds.length === 0)) {
+        if (
+            req.user &&
+            (!req.userOrgRoleIds || req.userOrgRoleIds.length === 0)
+        ) {
             return next(
                 createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
             );
@@ -87,13 +90,13 @@ export async function createRemoteExitNode(
 
         const usage = await usageService.getUsage(
             orgId,
-            FeatureId.REMOTE_EXIT_NODES
+            LimitId.REMOTE_EXIT_NODES
         );
         if (usage) {
             const rejectRemoteExitNodes = await usageService.checkLimitSet(
                 orgId,
 
-                FeatureId.REMOTE_EXIT_NODES,
+                LimitId.REMOTE_EXIT_NODES,
                 {
                     ...usage,
                     instantaneousValue: (usage.instantaneousValue || 0) + 1
@@ -111,8 +114,6 @@ export async function createRemoteExitNode(
         }
 
         const secretHash = await hashPassword(secret);
-        // const address = await getNextAvailableSubnet();
-        const address = "100.89.140.1/24"; // FOR NOW LETS HARDCODE THESE ADDRESSES
 
         const [existingRemoteExitNode] = await db
             .select()
@@ -188,89 +189,106 @@ export async function createRemoteExitNode(
             );
         }
 
-        await db.transaction(async (trx) => {
-            if (!existingExitNode) {
-                const [res] = await trx
-                    .insert(exitNodes)
-                    .values({
-                        name: remoteExitNodeId,
-                        address,
-                        endpoint: "",
-                        publicKey: "",
-                        listenPort: 0,
-                        online: false,
-                        type: "remoteExitNode"
-                    })
-                    .returning();
-                existingExitNode = res;
-            }
+        // If this remote exit node isn't already backing an exit node in
+        // another org, we're about to create a brand new one. Reserve a
+        // subnet for it up front so the allocation lock is held across the
+        // whole insert - this guarantees exit node subnets never overlap,
+        // even under concurrent creation, which matters for HA setups.
+        let releaseSubnetLock: (() => Promise<void>) | null = null;
+        let newExitNodeAddress: string | null = null;
+        if (!existingExitNode) {
+            const { value, release } = await getNextAvailableSubnet();
+            newExitNodeAddress = value;
+            releaseSubnetLock = release;
+        }
 
-            if (!existingRemoteExitNode) {
-                await trx.insert(remoteExitNodes).values({
-                    remoteExitNodeId: remoteExitNodeId,
-                    secretHash,
-                    dateCreated: moment().toISOString(),
-                    exitNodeId: existingExitNode.exitNodeId
-                });
-            } else {
-                // update the existing remote exit node
-                await trx
-                    .update(remoteExitNodes)
-                    .set({
-                        exitNodeId: existingExitNode.exitNodeId
-                    })
-                    .where(
-                        eq(
-                            remoteExitNodes.remoteExitNodeId,
-                            existingRemoteExitNode.remoteExitNodeId
-                        )
-                    );
-            }
-
-            if (!existingExitNodeOrg) {
-                await trx.insert(exitNodeOrgs).values({
-                    exitNodeId: existingExitNode.exitNodeId,
-                    orgId: orgId
-                });
-            }
-
-            // calculate if the node is in any other of the orgs before we count it as an add to the billing org
-            if (org.billingOrgId) {
-                const otherBillingOrgs = await trx
-                    .select()
-                    .from(orgs)
-                    .where(
-                        and(
-                            eq(orgs.billingOrgId, org.billingOrgId),
-                            ne(orgs.orgId, orgId)
-                        )
-                    );
-
-                const billingOrgIds = otherBillingOrgs.map((o) => o.orgId);
-
-                const orgsInBillingDomainThatTheNodeIsStillIn = await trx
-                    .select()
-                    .from(exitNodeOrgs)
-                    .where(
-                        and(
-                            eq(
-                                exitNodeOrgs.exitNodeId,
-                                existingExitNode.exitNodeId
-                            ),
-                            inArray(exitNodeOrgs.orgId, billingOrgIds)
-                        )
-                    );
-
-                if (orgsInBillingDomainThatTheNodeIsStillIn.length === 0) {
-                    await usageService.add(
-                        orgId,
-                        FeatureId.REMOTE_EXIT_NODES,
-                        1,
-                        trx
-                    );
+        try {
+            await db.transaction(async (trx) => {
+                if (!existingExitNode) {
+                    const [res] = await trx
+                        .insert(exitNodes)
+                        .values({
+                            name: remoteExitNodeId,
+                            address: newExitNodeAddress!,
+                            endpoint: "",
+                            publicKey: "",
+                            listenPort: 0,
+                            online: false,
+                            type: "remoteExitNode"
+                        })
+                        .returning();
+                    existingExitNode = res;
                 }
-            }
-        });
+
+                if (!existingRemoteExitNode) {
+                    await trx.insert(remoteExitNodes).values({
+                        remoteExitNodeId: remoteExitNodeId,
+                        secretHash,
+                        dateCreated: moment().toISOString(),
+                        exitNodeId: existingExitNode.exitNodeId
+                    });
+                } else {
+                    // update the existing remote exit node
+                    await trx
+                        .update(remoteExitNodes)
+                        .set({
+                            exitNodeId: existingExitNode.exitNodeId
+                        })
+                        .where(
+                            eq(
+                                remoteExitNodes.remoteExitNodeId,
+                                existingRemoteExitNode.remoteExitNodeId
+                            )
+                        );
+                }
+
+                if (!existingExitNodeOrg) {
+                    await trx.insert(exitNodeOrgs).values({
+                        exitNodeId: existingExitNode.exitNodeId,
+                        orgId: orgId
+                    });
+                }
+
+                // calculate if the node is in any other of the orgs before we count it as an add to the billing org
+                if (org.billingOrgId) {
+                    const otherBillingOrgs = await trx
+                        .select()
+                        .from(orgs)
+                        .where(
+                            and(
+                                eq(orgs.billingOrgId, org.billingOrgId),
+                                ne(orgs.orgId, orgId)
+                            )
+                        );
+
+                    const billingOrgIds = otherBillingOrgs.map((o) => o.orgId);
+
+                    const orgsInBillingDomainThatTheNodeIsStillIn = await trx
+                        .select()
+                        .from(exitNodeOrgs)
+                        .where(
+                            and(
+                                eq(
+                                    exitNodeOrgs.exitNodeId,
+                                    existingExitNode.exitNodeId
+                                ),
+                                inArray(exitNodeOrgs.orgId, billingOrgIds)
+                            )
+                        );
+
+                    if (orgsInBillingDomainThatTheNodeIsStillIn.length === 0) {
+                        await usageService.add(
+                            orgId,
+                            LimitId.REMOTE_EXIT_NODES,
+                            1,
+                            trx
+                        );
+                    }
+                }
+            });
+        } finally {
+            await releaseSubnetLock?.();
+        }
 
         const token = generateSessionToken();
         await createRemoteExitNodeSession(token, remoteExitNodeId);

server/private/routers/remoteExitNode/deleteRemoteExitNode.ts

@@ -22,7 +22,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { usageService } from "@server/lib/billing/usageService";
-import { FeatureId } from "@server/lib/billing";
+import { LimitId } from "@server/lib/billing";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().min(1),
@@ -117,7 +117,7 @@ export async function deleteRemoteExitNode(
                 if (orgsInBillingDomainThatTheNodeIsStillIn.length === 0) {
                     await usageService.add(
                         orgId,
-                        FeatureId.REMOTE_EXIT_NODES,
+                        LimitId.REMOTE_EXIT_NODES,
                         -1,
                         trx
                     );

server/private/routers/remoteExitNode/exitNodeReconnectScheduler.ts

@@ -0,0 +1,202 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import axios from "axios";
+import { db, exitNodes, newts, sites } from "@server/db";
+import { eq } from "drizzle-orm";
+import logger from "@server/logger";
+import redisManager from "#private/lib/redis";
+import { sendToClient } from "#private/routers/ws";
+
+const INITIAL_DELAY_MS = 15 * 1000; // 15 seconds before first check
+const CHECK_INTERVAL_MS = 10 * 1000; // Check every 10 seconds
+const MAX_DURATION_MS = 5 * 60 * 1000; // Give up after 5 minutes
+const REDIS_PENDING_SET = "exit-node-reconnect-pending";
+const REDIS_HASH_PREFIX = "exit-node-reconnect:";
+
+interface PendingReconnect {
+    startTime: number;
+    reachableAt: string;
+}
+
+// In-memory tracking for this node
+const pendingReconnects = new Map<number, PendingReconnect>();
+
+let schedulerInterval: NodeJS.Timeout | null = null;
+
+/**
+ * Schedules a reconnect check for newts connected to the given exit node.
+ * Called when an exit node transitions from offline to online.
+ */
+export async function scheduleExitNodeReconnect(
+    exitNodeId: number,
+    reachableAt: string
+): Promise<void> {
+    logger.info(
+        `Scheduling newt reconnect for exit node ${exitNodeId} (reachableAt: ${reachableAt})`
+    );
+
+    const entry: PendingReconnect = {
+        startTime: Date.now(),
+        reachableAt
+    };
+
+    pendingReconnects.set(exitNodeId, entry);
+
+    // Store in Redis if available for cross-node coordination
+    if (redisManager.isRedisEnabled()) {
+        await redisManager.sadd(REDIS_PENDING_SET, exitNodeId.toString());
+        await redisManager.hset(
+            `${REDIS_HASH_PREFIX}${exitNodeId}`,
+            "startTime",
+            entry.startTime.toString()
+        );
+        await redisManager.hset(
+            `${REDIS_HASH_PREFIX}${exitNodeId}`,
+            "reachableAt",
+            reachableAt
+        );
+    }
+}
+
+/**
+ * Starts the background interval that checks pending exit node reconnects.
+ */
+export function startExitNodeReconnectScheduler(): void {
+    if (schedulerInterval) {
+        return;
+    }
+
+    schedulerInterval = setInterval(async () => {
+        try {
+            await processPendingReconnects();
+        } catch (error) {
+            logger.error("Error in exit node reconnect scheduler", { error });
+        }
+    }, CHECK_INTERVAL_MS);
+
+    logger.debug("Started exit node reconnect scheduler");
+}
+
+async function processPendingReconnects(): Promise<void> {
+    // Merge in-memory and Redis-tracked pending reconnects
+    const toProcess = new Map(pendingReconnects);
+
+    if (redisManager.isRedisEnabled()) {
+        const redisIds = await redisManager.smembers(REDIS_PENDING_SET);
+        for (const idStr of redisIds) {
+            const id = parseInt(idStr, 10);
+            if (!toProcess.has(id)) {
+                const startTimeStr = await redisManager.hget(
+                    `${REDIS_HASH_PREFIX}${id}`,
+                    "startTime"
+                );
+                const reachableAt = await redisManager.hget(
+                    `${REDIS_HASH_PREFIX}${id}`,
+                    "reachableAt"
+                );
+                if (startTimeStr && reachableAt) {
+                    toProcess.set(id, {
+                        startTime: parseInt(startTimeStr, 10),
+                        reachableAt
+                    });
+                }
+            }
+        }
+    }
+
+    const now = Date.now();
+
+    for (const [exitNodeId, entry] of toProcess) {
+        const elapsed = now - entry.startTime;
+
+        // Give up after max duration
+        if (elapsed >= MAX_DURATION_MS) {
+            logger.warn(
+                `Exit node reconnect check timed out for exit node ${exitNodeId} after 5 minutes`
+            );
+            await removePending(exitNodeId);
+            continue;
+        }
+
+        // Respect initial delay
+        if (elapsed < INITIAL_DELAY_MS) {
+            continue;
+        }
+
+        // Check if the exit node HTTP endpoint is reachable
+        const pingUrl = `${entry.reachableAt}/ping`;
+        try {
+            await axios.get(pingUrl, { timeout: 5000 });
+        } catch {
+            logger.debug(
+                `Exit node ${exitNodeId} not yet reachable at ${pingUrl}`
+            );
+            continue;
+        }
+
+        // Node is reachable — send reconnect to all connected newts
+        logger.info(
+            `Exit node ${exitNodeId} is reachable. Sending newt/wg/reconnect to connected newts.`
+        );
+
+        await sendReconnectToNewts(exitNodeId);
+        await removePending(exitNodeId);
+    }
+}
+
+async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
+    try {
+        const connectedNewts = await db
+            .select({ newtId: newts.newtId })
+            .from(newts)
+            .innerJoin(sites, eq(newts.siteId, sites.siteId))
+            .where(eq(sites.exitNodeId, exitNodeId));
+
+        if (connectedNewts.length === 0) {
+            logger.debug(
+                `No newts found for exit node ${exitNodeId}, nothing to reconnect`
+            );
+            return;
+        }
+
+        logger.info(
+            `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
+        );
+
+        const reconnectMessage = {
+            type: "newt/wg/reconnect",
+            data: {}
+        };
+
+        await Promise.allSettled(
+            connectedNewts.map(({ newtId }) =>
+                sendToClient(newtId, reconnectMessage)
+            )
+        );
+    } catch (error) {
+        logger.error(
+            `Failed to send reconnect messages for exit node ${exitNodeId}`,
+            { error }
+        );
+    }
+}
+
+async function removePending(exitNodeId: number): Promise<void> {
+    pendingReconnects.delete(exitNodeId);
+
+    if (redisManager.isRedisEnabled()) {
+        await redisManager.srem(REDIS_PENDING_SET, exitNodeId.toString());
+        await redisManager.del(`${REDIS_HASH_PREFIX}${exitNodeId}`);
+    }
+}

server/private/routers/remoteExitNode/handleRemoteExitNodePingMessage.ts

@@ -16,6 +16,7 @@ import { MessageHandler } from "@server/routers/ws";
 import { RemoteExitNode } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
+import { scheduleExitNodeReconnect } from "./exitNodeReconnectScheduler";
 
 /**
  * Handles ping messages from clients and responds with pong
@@ -37,6 +38,13 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
     }
 
     try {
+        // Fetch the current state before updating so we can detect the offline→online transition
+        const [currentExitNode] = await db
+            .select({ online: exitNodes.online, reachableAt: exitNodes.reachableAt })
+            .from(exitNodes)
+            .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId))
+            .limit(1);
+
         // Update the exit node's last ping timestamp
         await db
             .update(exitNodes)
@@ -45,6 +53,16 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
                 online: true
             })
             .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId));
+
+        // If the exit node was offline and is now coming online, schedule newt reconnects
+        if (currentExitNode && !currentExitNode.online && currentExitNode.reachableAt) {
+            scheduleExitNodeReconnect(
+                remoteExitNode.exitNodeId,
+                currentExitNode.reachableAt
+            ).catch((error) => {
+                logger.error("Failed to schedule exit node reconnect", { error });
+            });
+        }
     } catch (error) {
         logger.error("Error handling ping message", { error });
     }

server/private/routers/remoteExitNode/index.ts

@@ -22,3 +22,8 @@ export * from "./listRemoteExitNodes";
 export * from "./pickRemoteExitNodeDefaults";
 export * from "./quickStartRemoteExitNode";
 export * from "./offlineChecker";
+export * from "./exitNodeReconnectScheduler";
+export * from "./listRemoteExitNodeResources";
+export * from "./setRemoteExitNodeResources";
+export * from "./listRemoteExitNodePreferenceLabels";
+export * from "./setRemoteExitNodePreferenceLabels";

server/private/routers/remoteExitNode/listRemoteExitNodePreferenceLabels.ts

@@ -0,0 +1,102 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction, Request, Response } from "express";
+import { z } from "zod";
+import {
+    db,
+    labels,
+    remoteExitNodePreferenceLabels,
+    remoteExitNodes
+} from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { ListRemoteExitNodePreferenceLabelsResponse } from "@server/routers/remoteExitNode";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().min(1),
+    remoteExitNodeId: z.string().min(1)
+});
+
+export async function listRemoteExitNodePreferenceLabels(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { remoteExitNodeId } = parsedParams.data;
+
+        const [remoteExitNode] = await db
+            .select()
+            .from(remoteExitNodes)
+            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
+            .limit(1);
+
+        if (!remoteExitNode) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Remote exit node with ID ${remoteExitNodeId} not found`
+                )
+            );
+        }
+
+        const rows = await db
+            .select({
+                remoteExitNodePreferenceLabelId:
+                    remoteExitNodePreferenceLabels.remoteExitNodePreferenceLabelId,
+                labelId: remoteExitNodePreferenceLabels.labelId,
+                name: labels.name,
+                color: labels.color
+            })
+            .from(remoteExitNodePreferenceLabels)
+            .innerJoin(
+                labels,
+                eq(labels.labelId, remoteExitNodePreferenceLabels.labelId)
+            )
+            .where(
+                eq(
+                    remoteExitNodePreferenceLabels.remoteExitNodeId,
+                    remoteExitNodeId
+                )
+            );
+
+        return response<ListRemoteExitNodePreferenceLabelsResponse>(res, {
+            data: { labels: rows },
+            success: true,
+            error: false,
+            message:
+                "Remote exit node preference labels retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/remoteExitNode/listRemoteExitNodeResources.ts

@@ -0,0 +1,83 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction, Request, Response } from "express";
+import { z } from "zod";
+import { db, remoteExitNodeResources, remoteExitNodes } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { ListRemoteExitNodeResourcesResponse } from "@server/routers/remoteExitNode/types";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().min(1),
+    remoteExitNodeId: z.string().min(1)
+});
+
+export async function listRemoteExitNodeResources(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { remoteExitNodeId } = parsedParams.data;
+
+        const [remoteExitNode] = await db
+            .select()
+            .from(remoteExitNodes)
+            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
+            .limit(1);
+
+        if (!remoteExitNode) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Remote exit node with ID ${remoteExitNodeId} not found`
+                )
+            );
+        }
+
+        const resources = await db
+            .select()
+            .from(remoteExitNodeResources)
+            .where(
+                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
+            );
+
+        return response<ListRemoteExitNodeResourcesResponse>(res, {
+            data: { resources },
+            success: true,
+            error: false,
+            message: "Remote exit node resources retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/remoteExitNode/listRemoteExitNodes.ts

@@ -22,7 +22,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
-import cache from "#private/lib/cache";
+import { regionalCache as cache } from "#private/lib/cache";
 import semver from "semver";
 
 let stalePangolinNodeVersion: string | null = null;

server/private/routers/remoteExitNode/setRemoteExitNodePreferenceLabels.ts

@@ -0,0 +1,160 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction, Request, Response } from "express";
+import { z } from "zod";
+import {
+    db,
+    labels,
+    remoteExitNodePreferenceLabels,
+    remoteExitNodes
+} from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { SetRemoteExitNodePreferenceLabelsResponse } from "@server/routers/remoteExitNode";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().min(1),
+    remoteExitNodeId: z.string().min(1)
+});
+
+const bodySchema = z.strictObject({
+    labelIds: z.array(z.number().int().positive())
+});
+
+export type SetRemoteExitNodePreferenceLabelsBody = z.infer<typeof bodySchema>;
+
+export async function setRemoteExitNodePreferenceLabels(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, remoteExitNodeId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { labelIds } = parsedBody.data;
+
+        const [remoteExitNode] = await db
+            .select()
+            .from(remoteExitNodes)
+            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
+            .limit(1);
+
+        if (!remoteExitNode) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Remote exit node with ID ${remoteExitNodeId} not found`
+                )
+            );
+        }
+
+        // Validate all provided labelIds belong to this org
+        if (labelIds.length > 0) {
+            const existingLabels = await db
+                .select({ labelId: labels.labelId })
+                .from(labels)
+                .where(
+                    and(
+                        eq(labels.orgId, orgId),
+                        inArray(labels.labelId, labelIds)
+                    )
+                );
+
+            if (existingLabels.length !== labelIds.length) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "One or more label IDs are invalid or do not belong to this organization"
+                    )
+                );
+            }
+        }
+
+        // Replace all preference labels atomically
+        await db
+            .delete(remoteExitNodePreferenceLabels)
+            .where(
+                eq(
+                    remoteExitNodePreferenceLabels.remoteExitNodeId,
+                    remoteExitNodeId
+                )
+            );
+
+        if (labelIds.length > 0) {
+            await db.insert(remoteExitNodePreferenceLabels).values(
+                labelIds.map((labelId) => ({
+                    remoteExitNodeId,
+                    labelId
+                }))
+            );
+        }
+
+        const rows = await db
+            .select({
+                remoteExitNodePreferenceLabelId:
+                    remoteExitNodePreferenceLabels.remoteExitNodePreferenceLabelId,
+                labelId: remoteExitNodePreferenceLabels.labelId,
+                name: labels.name,
+                color: labels.color
+            })
+            .from(remoteExitNodePreferenceLabels)
+            .innerJoin(
+                labels,
+                eq(labels.labelId, remoteExitNodePreferenceLabels.labelId)
+            )
+            .where(
+                eq(
+                    remoteExitNodePreferenceLabels.remoteExitNodeId,
+                    remoteExitNodeId
+                )
+            );
+
+        return response<SetRemoteExitNodePreferenceLabelsResponse>(res, {
+            data: { labels: rows },
+            success: true,
+            error: false,
+            message: "Remote exit node preference labels updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/remoteExitNode/setRemoteExitNodeResources.ts

@@ -0,0 +1,153 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction, Request, Response } from "express";
+import { z } from "zod";
+import {
+    db,
+    newts,
+    remoteExitNodeResources,
+    remoteExitNodes,
+    sites
+} from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { sendToClientsBatch } from "#private/routers/ws";
+import { canCompress } from "@server/lib/clientVersionChecks";
+import { SetRemoteExitNodeResourcesResponse } from "@server/routers/remoteExitNode";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().min(1),
+    remoteExitNodeId: z.string().min(1)
+});
+
+const cidrRegex =
+    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$|^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]+|::(ffff(:0{1,4})?:)?((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1?[0-9])?[0-9])\.){3}(25[0-5]|(2[0-4]|1?[0-9])?[0-9]))(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))$/;
+
+const bodySchema = z.strictObject({
+    destinations: z.array(
+        z.string().regex(cidrRegex, "Must be a valid CIDR range")
+    )
+});
+
+export type SetRemoteExitNodeResourcesBody = z.infer<typeof bodySchema>;
+
+export async function setRemoteExitNodeResources(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { remoteExitNodeId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { destinations } = parsedBody.data;
+
+        const [remoteExitNode] = await db
+            .select()
+            .from(remoteExitNodes)
+            .where(eq(remoteExitNodes.remoteExitNodeId, remoteExitNodeId))
+            .limit(1);
+
+        if (!remoteExitNode) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Remote exit node with ID ${remoteExitNodeId} not found`
+                )
+            );
+        }
+
+        // Replace all resources atomically
+        await db
+            .delete(remoteExitNodeResources)
+            .where(
+                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
+            );
+
+        if (destinations.length > 0) {
+            await db.insert(remoteExitNodeResources).values(
+                destinations.map((destination) => ({
+                    remoteExitNodeId,
+                    destination
+                }))
+            );
+        }
+
+        const resources = await db
+            .select()
+            .from(remoteExitNodeResources)
+            .where(
+                eq(remoteExitNodeResources.remoteExitNodeId, remoteExitNodeId)
+            );
+
+        // Notify all newts connected to this remote exit node's exit node
+        if (remoteExitNode.exitNodeId) {
+            const connectedNewts = await db
+                .select({ newtId: newts.newtId, version: newts.version })
+                .from(newts)
+                .innerJoin(sites, eq(newts.siteId, sites.siteId))
+                .where(eq(sites.exitNodeId, remoteExitNode.exitNodeId));
+
+            await sendToClientsBatch(
+                connectedNewts.map(({ newtId, version }) => ({
+                    clientId: newtId,
+                    message: {
+                        type: "newt/wg/subnets/update",
+                        data: { subnets: destinations }
+                    },
+                    options: {
+                        incrementConfigVersion: true,
+                        compress: canCompress(version, "newt")
+                    }
+                }))
+            );
+        }
+
+        return response<SetRemoteExitNodeResourcesResponse>(res, {
+            data: { resources },
+            success: true,
+            error: false,
+            message: "Remote exit node resources updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/ssh/signSshKey.ts

@@ -12,6 +12,7 @@
  */
 
 import { Request, Response, NextFunction } from "express";
+import { randomInt } from "crypto";
 import { z } from "zod";
 import {
     actionAuditLog,
@@ -19,11 +20,19 @@ import {
     logsDb,
     newts,
     roles,
+    roleActions,
+    rolePolicies,
+    roleResources,
     roleSiteResources,
+    resources,
     roundTripMessageTracker,
     siteResources,
     siteNetworks,
-    userOrgs
+    targets,
+    userOrgs,
+    sites,
+    Resource,
+    SiteResource
 } from "@server/db";
 import { logAccessAudit } from "#private/lib/logAccessAudit";
 import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
@@ -33,12 +42,14 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNull, or } from "drizzle-orm";
+import { canUserAccessResource } from "@server/auth/canUserAccessResource";
 import { canUserAccessSiteResource } from "@server/auth/canUserAccessSiteResource";
 import { signPublicKey, getOrgCAKeys } from "@server/lib/sshCA";
 import config from "@server/lib/config";
 import { sendToClient } from "#private/routers/ws";
 import { ActionsEnum } from "@server/auth/actions";
+import type { SignSshKeyResponse } from "@server/routers/ssh/types";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -48,7 +59,9 @@ const bodySchema = z
     .strictObject({
         publicKey: z.string().nonempty(),
         resourceId: z.number().int().positive().optional(),
-        resource: z.string().nonempty().optional() // this is either the nice id or the alias
+        resource: z.string().nonempty().optional(), // this is either the nice id or the alias
+        username: z.string().nonempty().optional(),
+        type: z.enum(["public", "private"]).default("private")
     })
     .refine(
         (data) => {
@@ -62,40 +75,6 @@ const bodySchema = z
         }
     );
 
-export type SignSshKeyResponse = {
-    certificate: string;
-    messageIds: number[];
-    messageId: number;
-    sshUsername: string;
-    sshHost: string;
-    resourceId: number;
-    siteIds: number[];
-    siteId: number;
-    keyId: string;
-    validPrincipals: string[];
-    validAfter: string;
-    validBefore: string;
-    expiresIn: number;
-};
-
-// registry.registerPath({
-//     method: "post",
-//     path: "/org/{orgId}/ssh/sign-key",
-//     description: "Sign an SSH public key for access to a resource.",
-//     tags: [OpenAPITags.Org, OpenAPITags.Ssh],
-//     request: {
-//         params: paramsSchema,
-//         body: {
-//             content: {
-//                 "application/json": {
-//                     schema: bodySchema
-//                 }
-//             }
-//         }
-//     },
-//     responses: {}
-// });
-
 export async function signSshKey(
     req: Request,
     res: Response,
@@ -126,7 +105,9 @@ export async function signSshKey(
         const {
             publicKey,
             resourceId,
-            resource: resourceQueryString
+            type,
+            resource: resourceQueryString,
+            username
         } = parsedBody.data;
         const userId = req.user?.userId;
         const roleIds = req.userOrgRoleIds ?? [];
@@ -161,9 +142,30 @@ export async function signSshKey(
             );
         }
 
+        const roleActionPermission = await db
+            .select({ roleId: roleActions.roleId })
+            .from(roleActions)
+            .where(
+                and(
+                    eq(roleActions.actionId, ActionsEnum.signSshKey),
+                    inArray(roleActions.roleId, roleIds),
+                    eq(roleActions.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (roleActionPermission.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have permission perform this action"
+                )
+            );
+        }
+
         const isLicensed = await isLicensedOrSubscribed(
             orgId,
-            tierMatrix.sshPam
+            tierMatrix.advancedPrivateResources
         );
         if (!isLicensed) {
             return next(
@@ -174,101 +176,6 @@ export async function signSshKey(
             );
         }
 
-        let usernameToUse;
-        if (!userOrg.pamUsername) {
-            if (req.user?.email) {
-                // Extract username from email (first part before @)
-                usernameToUse = req.user?.email
-                    .split("@")[0]
-                    .replace(/[^a-zA-Z0-9_-]/g, "");
-                if (!usernameToUse) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Unable to extract username from email"
-                        )
-                    );
-                }
-            } else if (req.user?.username) {
-                usernameToUse = req.user.username;
-                // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
-                usernameToUse = usernameToUse.replace(/[^a-zA-Z0-9_-]/g, "-");
-                if (!usernameToUse) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Username is not valid for SSH certificate"
-                        )
-                    );
-                }
-            } else {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "User does not have a valid email or username for SSH certificate"
-                    )
-                );
-            }
-
-            // prefix with p-
-            usernameToUse = `p-${usernameToUse}`;
-
-            // check if we have a existing user in this org with the same
-            const [existingUserWithSameName] = await db
-                .select()
-                .from(userOrgs)
-                .where(
-                    and(
-                        eq(userOrgs.orgId, orgId),
-                        eq(userOrgs.pamUsername, usernameToUse)
-                    )
-                )
-                .limit(1);
-
-            if (existingUserWithSameName) {
-                let foundUniqueUsername = false;
-                for (let attempt = 0; attempt < 20; attempt++) {
-                    const randomNum = Math.floor(Math.random() * 101); // 0 to 100
-                    const candidateUsername = `${usernameToUse}${randomNum}`;
-
-                    const [existingUser] = await db
-                        .select()
-                        .from(userOrgs)
-                        .where(
-                            and(
-                                eq(userOrgs.orgId, orgId),
-                                eq(userOrgs.pamUsername, candidateUsername)
-                            )
-                        )
-                        .limit(1);
-
-                    if (!existingUser) {
-                        usernameToUse = candidateUsername;
-                        foundUniqueUsername = true;
-                        break;
-                    }
-                }
-
-                if (!foundUniqueUsername) {
-                    return next(
-                        createHttpError(
-                            HttpCode.CONFLICT,
-                            "Unable to generate a unique username for SSH certificate"
-                        )
-                    );
-                }
-            }
-
-            await db
-                .update(userOrgs)
-                .set({ pamUsername: usernameToUse })
-                .where(
-                    and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId))
-                );
-        } else {
-            usernameToUse = userOrg.pamUsername;
-        }
-
         // Get and decrypt the org's CA keys
         const caKeys = await getOrgCAKeys(
             orgId,
@@ -284,18 +191,25 @@ export async function signSshKey(
             );
         }
 
-        // Verify the resource exists and belongs to the org
-        // Build the where clause dynamically based on which field is provided
+        let matchingResources: SiteResource[] | Resource[] = [];
+        // Verify the resource exists and belongs to the org.
+        // Build the where clause dynamically based on which field is provided.
         let whereClause;
         if (resourceId !== undefined) {
-            whereClause = eq(siteResources.siteResourceId, resourceId);
+            whereClause =
+                type === "private"
+                    ? eq(siteResources.siteResourceId, resourceId)
+                    : eq(resources.resourceId, resourceId);
         } else if (resourceQueryString !== undefined) {
-            whereClause = or(
-                eq(siteResources.niceId, resourceQueryString),
-                eq(siteResources.alias, resourceQueryString)
-            );
+            whereClause =
+                type === "private"
+                    ? or(
+                          eq(siteResources.niceId, resourceQueryString),
+                          eq(siteResources.alias, resourceQueryString)
+                      )
+                    : eq(resources.niceId, resourceQueryString);
         } else {
-            // This should never happen due to the schema validation, but TypeScript doesn't know that
+            // This should never happen due to the schema validation, but TypeScript doesn't know that.
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
@@ -304,18 +218,25 @@ export async function signSshKey(
             );
         }
 
-        const resources = await db
-            .select()
-            .from(siteResources)
-            .where(and(whereClause, eq(siteResources.orgId, orgId)));
+        if (type === "private") {
+            matchingResources = await db
+                .select()
+                .from(siteResources)
+                .where(and(whereClause, eq(siteResources.orgId, orgId)));
+        } else {
+            matchingResources = await db
+                .select()
+                .from(resources)
+                .where(and(whereClause, eq(resources.orgId, orgId)));
+        }
 
-        if (!resources || resources.length === 0) {
+        if (!matchingResources || matchingResources.length === 0) {
             return next(
                 createHttpError(HttpCode.NOT_FOUND, `Resource not found`)
             );
         }
 
-        if (resources.length > 1) {
+        if (matchingResources.length > 1) {
             // error but this should not happen because the nice id cant contain a dot and the alias has to have a dot and both have to be unique within the org so there should never be multiple matches
             return next(
                 createHttpError(
@@ -325,7 +246,11 @@ export async function signSshKey(
             );
         }
 
-        const resource = resources[0];
+        const resource = matchingResources[0];
+        const normalizedResourceId =
+            type === "private"
+                ? (resource as SiteResource).siteResourceId
+                : (resource as Resource).resourceId;
 
         if (resource.orgId !== orgId) {
             return next(
@@ -346,11 +271,18 @@ export async function signSshKey(
         }
 
         // Check if the user has access to the resource
-        const hasAccess = await canUserAccessSiteResource({
-            userId: userId,
-            resourceId: resource.siteResourceId,
-            roleIds
-        });
+        const hasAccess =
+            type === "private"
+                ? await canUserAccessSiteResource({
+                      userId: userId,
+                      resourceId: (resource as SiteResource).siteResourceId,
+                      roleIds
+                  })
+                : await canUserAccessResource({
+                      userId: userId,
+                      resourceId: (resource as Resource).resourceId,
+                      roleIds
+                  });
 
         if (!hasAccess) {
             return next(
@@ -361,90 +293,436 @@ export async function signSshKey(
             );
         }
 
-        const roleRows = await db
-            .select({
-                sshSudoCommands: roles.sshSudoCommands,
-                sshUnixGroups: roles.sshUnixGroups,
-                sshCreateHomeDir: roles.sshCreateHomeDir,
-                sshSudoMode: roles.sshSudoMode
-            })
-            .from(roles)
-            .innerJoin(
-                roleSiteResources,
-                eq(roleSiteResources.roleId, roles.roleId)
-            )
-            .where(
-                and(
-                    inArray(roles.roleId, roleIds),
-                    eq(
-                        roleSiteResources.siteResourceId,
-                        resource.siteResourceId
+        const siteAgentHostMap = new Map<number, string>();
+        let siteIds: number[] = [];
+
+        if (type === "private") {
+            const privateResource = resource as SiteResource;
+            const sitesFromNetworks = await db
+                .select({ siteId: siteNetworks.siteId })
+                .from(siteNetworks)
+                .where(eq(siteNetworks.networkId, privateResource.networkId!));
+
+            siteIds = sitesFromNetworks.map((site) => site.siteId);
+            for (const siteId of siteIds) {
+                if (privateResource.destination) {
+                    siteAgentHostMap.set(siteId, privateResource.destination);
+                }
+            }
+        } else {
+            const publicResource = resource as Resource;
+            const targetRows = await db
+                .select({
+                    siteId: targets.siteId,
+                    ip: targets.ip
+                })
+                .from(targets)
+                .where(
+                    and(
+                        eq(targets.resourceId, publicResource.resourceId),
+                        eq(targets.enabled, true),
+                        eq(targets.mode, "ssh")
                     )
+                );
+
+            if (targetRows.length === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "No enabled targets found for the resource"
+                    )
+                );
+            }
+
+            for (const targetRow of targetRows) {
+                if (!siteAgentHostMap.has(targetRow.siteId)) {
+                    siteAgentHostMap.set(targetRow.siteId, targetRow.ip);
+                }
+            }
+
+            siteIds = Array.from(siteAgentHostMap.keys());
+        }
+
+        let expiresIn: number | undefined;
+        let messageIds: number[] = [];
+        let cert:
+            | {
+                  certificate: string;
+                  keyId: string;
+                  validPrincipals: string[];
+                  validAfter: Date;
+                  validBefore: Date;
+              }
+            | undefined;
+        // if the pam mode is push then we generate the user's pam username and use that or pull it from the userOrgs table
+        // if the mode is passthrough then just use what was provided because the user will log in themselves
+        let usernameToUse;
+        if (resource.pamMode === "push") {
+            if (!userOrg.pamUsername) {
+                if (req.user?.email) {
+                    // Extract username from email (first part before @)
+                    usernameToUse = req.user?.email
+                        .split("@")[0]
+                        .replace(/[^a-zA-Z0-9_-]/g, "");
+                    if (!usernameToUse) {
+                        return next(
+                            createHttpError(
+                                HttpCode.BAD_REQUEST,
+                                "Unable to extract username from email"
+                            )
+                        );
+                    }
+                } else if (req.user?.username) {
+                    usernameToUse = req.user.username;
+                    // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
+                    usernameToUse = usernameToUse.replace(
+                        /[^a-zA-Z0-9_-]/g,
+                        "-"
+                    );
+                    if (!usernameToUse) {
+                        return next(
+                            createHttpError(
+                                HttpCode.BAD_REQUEST,
+                                "Username is not valid for SSH certificate"
+                            )
+                        );
+                    }
+                } else {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "User does not have a valid email or username for SSH certificate"
+                        )
+                    );
+                }
+
+                // prefix with p-
+                usernameToUse = `p-${usernameToUse}`;
+
+                // check if we have a existing user in this org with the same
+                const [existingUserWithSameName] = await db
+                    .select()
+                    .from(userOrgs)
+                    .where(
+                        and(
+                            eq(userOrgs.orgId, orgId),
+                            eq(userOrgs.pamUsername, usernameToUse)
+                        )
+                    )
+                    .limit(1);
+
+                if (existingUserWithSameName) {
+                    let foundUniqueUsername = false;
+                    for (let attempt = 0; attempt < 20; attempt++) {
+                        const randomNum = randomInt(0, 101); // 0 to 100
+                        const candidateUsername = `${usernameToUse}${randomNum}`;
+
+                        const [existingUser] = await db
+                            .select()
+                            .from(userOrgs)
+                            .where(
+                                and(
+                                    eq(userOrgs.orgId, orgId),
+                                    eq(userOrgs.pamUsername, candidateUsername)
+                                )
+                            )
+                            .limit(1);
+
+                        if (!existingUser) {
+                            usernameToUse = candidateUsername;
+                            foundUniqueUsername = true;
+                            break;
+                        }
+                    }
+
+                    if (!foundUniqueUsername) {
+                        return next(
+                            createHttpError(
+                                HttpCode.CONFLICT,
+                                "Unable to generate a unique username for SSH certificate"
+                            )
+                        );
+                    }
+                }
+
+                await db
+                    .update(userOrgs)
+                    .set({ pamUsername: usernameToUse })
+                    .where(
+                        and(
+                            eq(userOrgs.orgId, orgId),
+                            eq(userOrgs.userId, userId)
+                        )
+                    );
+            } else {
+                usernameToUse = userOrg.pamUsername;
+            }
+
+            type RoleSshMeta = {
+                roleId: number;
+                sshSudoCommands: string | null;
+                sshUnixGroups: string | null;
+                sshCreateHomeDir: boolean | null;
+                sshSudoMode: string | null;
+            };
+
+            let roleRows: RoleSshMeta[] = [];
+
+            if (type === "private") {
+                roleRows = await db
+                    .select({
+                        roleId: roles.roleId,
+                        sshSudoCommands: roles.sshSudoCommands,
+                        sshUnixGroups: roles.sshUnixGroups,
+                        sshCreateHomeDir: roles.sshCreateHomeDir,
+                        sshSudoMode: roles.sshSudoMode
+                    })
+                    .from(roles)
+                    .innerJoin(
+                        roleSiteResources,
+                        eq(roleSiteResources.roleId, roles.roleId)
+                    )
+                    .where(
+                        and(
+                            inArray(roles.roleId, roleIds),
+                            eq(
+                                roleSiteResources.siteResourceId,
+                                (resource as SiteResource).siteResourceId
+                            )
+                        )
+                    );
+            } else {
+                const publicResourceId = (resource as Resource).resourceId;
+                const [directRoleRows, policyRoleRows] = await Promise.all([
+                    db
+                        .select({
+                            roleId: roles.roleId,
+                            sshSudoCommands: roles.sshSudoCommands,
+                            sshUnixGroups: roles.sshUnixGroups,
+                            sshCreateHomeDir: roles.sshCreateHomeDir,
+                            sshSudoMode: roles.sshSudoMode
+                        })
+                        .from(roles)
+                        .innerJoin(
+                            roleResources,
+                            eq(roleResources.roleId, roles.roleId)
+                        )
+                        .where(
+                            and(
+                                inArray(roles.roleId, roleIds),
+                                eq(roleResources.resourceId, publicResourceId)
+                            )
+                        ),
+                    db
+                        .select({
+                            roleId: roles.roleId,
+                            sshSudoCommands: roles.sshSudoCommands,
+                            sshUnixGroups: roles.sshUnixGroups,
+                            sshCreateHomeDir: roles.sshCreateHomeDir,
+                            sshSudoMode: roles.sshSudoMode
+                        })
+                        .from(roles)
+                        .innerJoin(
+                            rolePolicies,
+                            eq(rolePolicies.roleId, roles.roleId)
+                        )
+                        .innerJoin(
+                            resources,
+                            or(
+                                eq(
+                                    resources.resourcePolicyId,
+                                    rolePolicies.resourcePolicyId
+                                ),
+                                and(
+                                    isNull(resources.resourcePolicyId),
+                                    eq(
+                                        resources.defaultResourcePolicyId,
+                                        rolePolicies.resourcePolicyId
+                                    )
+                                )
+                            )
+                        )
+                        .where(
+                            and(
+                                inArray(roles.roleId, roleIds),
+                                eq(resources.resourceId, publicResourceId)
+                            )
+                        )
+                ]);
+
+                const uniqueByRoleId = new Map<number, RoleSshMeta>();
+                for (const row of [...directRoleRows, ...policyRoleRows]) {
+                    if (!uniqueByRoleId.has(row.roleId)) {
+                        uniqueByRoleId.set(row.roleId, row);
+                    }
+                }
+                roleRows = Array.from(uniqueByRoleId.values());
+            }
+
+            const parsedSudoCommands: string[] = [];
+            const parsedGroupsSet = new Set<string>();
+            let homedir: boolean | null = null;
+            const sudoModeOrder = { none: 0, commands: 1, full: 2 };
+            let sudoMode: "none" | "commands" | "full" = "none";
+            for (const roleRow of roleRows) {
+                try {
+                    const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
+                    if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
+                } catch {
+                    // skip
+                }
+                try {
+                    const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
+                    if (Array.isArray(grps))
+                        grps.forEach((g: string) => parsedGroupsSet.add(g));
+                } catch {
+                    // skip
+                }
+                if (roleRow?.sshCreateHomeDir === true) homedir = true;
+                const m = roleRow?.sshSudoMode ?? "none";
+                if (
+                    sudoModeOrder[m as keyof typeof sudoModeOrder] >
+                    sudoModeOrder[sudoMode]
+                ) {
+                    sudoMode = m as "none" | "commands" | "full";
+                }
+            }
+            const parsedGroups = Array.from(parsedGroupsSet);
+            if (homedir === null && roleRows.length > 0) {
+                homedir = roleRows[0].sshCreateHomeDir ?? null;
+            }
+
+            // Sign the public key
+            const now = BigInt(Math.floor(Date.now() / 1000));
+            // only valid for 5 minutes
+            const validFor = 300n;
+            expiresIn = Number(validFor); // seconds
+
+            cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
+                keyId: `${usernameToUse}@${resource.niceId}`,
+                validPrincipals: [usernameToUse, resource.niceId],
+                validAfter: now - 60n, // Start 1 min ago for clock skew
+                validBefore: now + validFor
+            });
+
+            messageIds = [];
+            for (const siteId of siteIds) {
+                // get the site
+                const [newt] = await db
+                    .select()
+                    .from(newts)
+                    .where(eq(newts.siteId, siteId))
+                    .limit(1);
+
+                if (!newt) {
+                    return next(
+                        createHttpError(
+                            HttpCode.INTERNAL_SERVER_ERROR,
+                            "Site associated with resource not found"
+                        )
+                    );
+                }
+
+                const [message] = await db
+                    .insert(roundTripMessageTracker)
+                    .values({
+                        wsClientId: newt.newtId,
+                        messageType: `newt/pam/connection`,
+                        sentAt: Math.floor(Date.now() / 1000)
+                    })
+                    .returning();
+
+                if (!message) {
+                    return next(
+                        createHttpError(
+                            HttpCode.INTERNAL_SERVER_ERROR,
+                            "Failed to create message tracker entry"
+                        )
+                    );
+                }
+
+                messageIds.push(message.messageId);
+
+                const agentHost = siteAgentHostMap.get(siteId);
+
+                await sendToClient(newt.newtId, {
+                    type: `newt/pam/connection`,
+                    data: {
+                        messageId: message.messageId,
+                        orgId: orgId,
+                        agentPort: resource.authDaemonPort ?? 22123,
+                        authDaemonMode: resource.authDaemonMode, // site, remote, native where native is the pty mode
+                        externalAuthDaemon:
+                            resource.authDaemonMode === "remote", // keep this for backward compatibility but new newts are using the authDaemonMode field
+                        agentHost,
+                        caCert: caKeys.publicKeyOpenSSH,
+                        username: usernameToUse,
+                        niceId: resource.niceId,
+                        metadata: {
+                            sudoMode: sudoMode,
+                            sudoCommands: parsedSudoCommands,
+                            homedir: homedir,
+                            groups: parsedGroups
+                        }
+                    }
+                });
+            }
+        } else if (resource.pamMode === "passthrough") {
+            usernameToUse = username;
+            if (!usernameToUse) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Username must be provided when PAM mode is passthrough"
+                    )
+                );
+            }
+        } else {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Invalid PAM mode configured for resource"
                 )
             );
-
-        const parsedSudoCommands: string[] = [];
-        const parsedGroupsSet = new Set<string>();
-        let homedir: boolean | null = null;
-        const sudoModeOrder = { none: 0, commands: 1, full: 2 };
-        let sudoMode: "none" | "commands" | "full" = "none";
-        for (const roleRow of roleRows) {
-            try {
-                const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
-                if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
-            } catch {
-                // skip
-            }
-            try {
-                const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                if (Array.isArray(grps))
-                    grps.forEach((g: string) => parsedGroupsSet.add(g));
-            } catch {
-                // skip
-            }
-            if (roleRow?.sshCreateHomeDir === true) homedir = true;
-            const m = roleRow?.sshSudoMode ?? "none";
-            if (
-                sudoModeOrder[m as keyof typeof sudoModeOrder] >
-                sudoModeOrder[sudoMode]
-            ) {
-                sudoMode = m as "none" | "commands" | "full";
-            }
-        }
-        const parsedGroups = Array.from(parsedGroupsSet);
-        if (homedir === null && roleRows.length > 0) {
-            homedir = roleRows[0].sshCreateHomeDir ?? null;
         }
 
-        const sites = await db
-            .select({ siteId: siteNetworks.siteId })
-            .from(siteNetworks)
-            .where(eq(siteNetworks.networkId, resource.networkId!));
+        let sshHost: string | undefined;
+        if (
+            resource.authDaemonMode === "site" ||
+            resource.authDaemonMode === "remote"
+        ) {
+            if (type === "private") {
+                const privateResource = resource as SiteResource;
+                if (privateResource.alias && privateResource.alias !== "") {
+                    sshHost = privateResource.alias;
+                } else {
+                    sshHost = privateResource.destination || "";
+                }
+            } else {
+                const publicResource = resource as Resource;
+                sshHost =
+                    publicResource.fullDomain ||
+                    publicResource.subdomain ||
+                    publicResource.niceId;
+            }
+        } else if (resource.authDaemonMode === "native") {
+            if (siteIds.length > 1) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Multiple sites associated with resource, unable to determine SSH host when in native mode"
+                    )
+                );
+            }
 
-        const siteIds = sites.map((site) => site.siteId);
-
-        // Sign the public key
-        const now = BigInt(Math.floor(Date.now() / 1000));
-        // only valid for 5 minutes
-        const validFor = 300n;
-
-        const cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
-            keyId: `${usernameToUse}@${resource.niceId}`,
-            validPrincipals: [usernameToUse, resource.niceId],
-            validAfter: now - 60n, // Start 1 min ago for clock skew
-            validBefore: now + validFor
-        });
-
-        const messageIds: number[] = [];
-        for (const siteId of siteIds) {
             // get the site
-            const [newt] = await db
+            const [site] = await db
                 .select()
-                .from(newts)
-                .where(eq(newts.siteId, siteId))
+                .from(sites)
+                .where(eq(sites.siteId, siteIds[0]))
                 .limit(1);
 
-            if (!newt) {
+            if (!site) {
                 return next(
                     createHttpError(
                         HttpCode.INTERNAL_SERVER_ERROR,
@@ -453,54 +731,26 @@ export async function signSshKey(
                 );
             }
 
-            const [message] = await db
-                .insert(roundTripMessageTracker)
-                .values({
-                    wsClientId: newt.newtId,
-                    messageType: `newt/pam/connection`,
-                    sentAt: Math.floor(Date.now() / 1000)
-                })
-                .returning();
-
-            if (!message) {
+            if (!site.address) {
                 return next(
                     createHttpError(
                         HttpCode.INTERNAL_SERVER_ERROR,
-                        "Failed to create message tracker entry"
+                        "Site address not configured, unable to determine SSH host when in native mode"
                     )
                 );
             }
 
-            messageIds.push(message.messageId);
-
-            await sendToClient(newt.newtId, {
-                type: `newt/pam/connection`,
-                data: {
-                    messageId: message.messageId,
-                    orgId: orgId,
-                    agentPort: resource.authDaemonPort ?? 22123,
-                    externalAuthDaemon: resource.authDaemonMode === "remote",
-                    agentHost: resource.destination,
-                    caCert: caKeys.publicKeyOpenSSH,
-                    username: usernameToUse,
-                    niceId: resource.niceId,
-                    metadata: {
-                        sudoMode: sudoMode,
-                        sudoCommands: parsedSudoCommands,
-                        homedir: homedir,
-                        groups: parsedGroups
-                    }
-                }
-            });
+            // its the address but split off the cidr if there is one
+            sshHost = site.address.split("/")[0];
         }
 
-        const expiresIn = Number(validFor); // seconds
-
-        let sshHost;
-        if (resource.alias && resource.alias != "") {
-            sshHost = resource.alias;
-        } else {
-            sshHost = resource.destination;
+        if (!sshHost) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Unable to determine SSH host for the resource"
+                )
+            );
         }
 
         await logsDb.insert(actionAuditLog).values({
@@ -511,7 +761,8 @@ export async function signSshKey(
             actorId: req.user?.userId ?? "",
             action: ActionsEnum.signSshKey,
             metadata: JSON.stringify({
-                resourceId: resource.siteResourceId,
+                resourceId: normalizedResourceId,
+                resourceType: type,
                 resource: resource.name,
                 siteIds: siteIds
             })
@@ -521,13 +772,20 @@ export async function signSshKey(
             action: true,
             type: "ssh",
             orgId: orgId,
-            siteResourceId: resource.siteResourceId,
+            resourceId:
+                type === "public"
+                    ? (resource as Resource).resourceId
+                    : undefined,
+            siteResourceId:
+                type === "private"
+                    ? (resource as SiteResource).siteResourceId
+                    : undefined,
             user: req.user
                 ? { username: req.user.username ?? "", userId: req.user.userId }
                 : undefined,
             metadata: {
                 resourceName: resource.name,
-                siteId: siteIds[0],
+                siteIds: siteIds,
                 sshUsername: usernameToUse,
                 sshHost: sshHost
             },
@@ -537,18 +795,19 @@ export async function signSshKey(
 
         return response<SignSshKeyResponse>(res, {
             data: {
-                certificate: cert.certificate,
+                certificate: cert?.certificate,
                 messageIds: messageIds,
-                messageId: messageIds[0], // just pick the first one for backward compatibility
+                messageId: messageIds[0], // just pick the first one for backward compatibility with older olms
                 sshUsername: usernameToUse,
-                sshHost: sshHost,
-                resourceId: resource.siteResourceId,
+                sshHost: sshHost, // just pick the first one for backward compatibility with older olms
+                resourceId: normalizedResourceId,
                 siteIds: siteIds,
-                siteId: siteIds[0], // just pick the first one for backward compatibility
-                keyId: cert.keyId,
-                validPrincipals: cert.validPrincipals,
-                validAfter: cert.validAfter.toISOString(),
-                validBefore: cert.validBefore.toISOString(),
+                siteId: siteIds[0], // just pick the first one for backward compatibility with older olms
+                keyId: cert?.keyId,
+                authDaemonMode: resource.authDaemonMode,
+                validPrincipals: cert?.validPrincipals,
+                validAfter: cert?.validAfter.toISOString(),
+                validBefore: cert?.validBefore.toISOString(),
                 expiresIn
             },
             success: true,

server/private/routers/user/addUserRole.ts

@@ -23,11 +23,14 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
+import {
+    rebuildClientAssociationsFromClient,
+    isOrgRebuildRateLimited
+} from "@server/lib/rebuildClientAssociations";
 
 const addUserRoleParamsSchema = z.strictObject({
     userId: z.string(),
-    roleId: z.string().transform(stoi).pipe(z.number())
+    roleId: z.coerce.number()
 });
 
 registry.registerPath({
@@ -38,7 +41,22 @@ registry.registerPath({
     request: {
         params: addUserRoleParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function addUserRole(
@@ -113,6 +131,15 @@ export async function addUserRole(
             );
         }
 
+        if (await isOrgRebuildRateLimited(role.orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
         let newUserRole: {
             userId: string;
             orgId: string;
@@ -148,13 +175,11 @@ export async function addUserRole(
         });
 
         for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
+                );
+            });
         }
 
         return response(res, {

server/private/routers/user/removeUserRole.ts

@@ -27,7 +27,7 @@ import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAs
 
 const removeUserRoleParamsSchema = z.strictObject({
     userId: z.string(),
-    roleId: z.string().transform(stoi).pipe(z.number())
+    roleId: z.coerce.number()
 });
 
 registry.registerPath({
@@ -39,7 +39,22 @@ registry.registerPath({
     request: {
         params: removeUserRoleParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function removeUserRole(
@@ -155,13 +170,11 @@ export async function removeUserRole(
         });
 
         for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
+                );
+            });
         }
 
         return response(res, {

server/private/routers/user/setUserOrgRoles.ts

@@ -21,7 +21,10 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
+import {
+    rebuildClientAssociationsFromClient,
+    isOrgRebuildRateLimited
+} from "@server/lib/rebuildClientAssociations";
 
 const setUserOrgRolesParamsSchema = z.strictObject({
     orgId: z.string(),
@@ -87,6 +90,15 @@ export async function setUserOrgRoles(
             );
         }
 
+        if (await isOrgRebuildRateLimited(orgId)) {
+            return next(
+                createHttpError(
+                    HttpCode.TOO_MANY_REQUESTS,
+                    "Too many concurrent rebuild operations for this organization. Please retry after a moment."
+                )
+            );
+        }
+
         const orgRoles = await db
             .select({ roleId: roles.roleId, isAdmin: roles.isAdmin })
             .from(roles)
@@ -150,13 +162,11 @@ export async function setUserOrgRoles(
         });
 
         for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
+                );
+            });
         }
 
         return response(res, {

server/private/routers/ws/messageHandlers.ts

@@ -14,7 +14,8 @@
 import {
     handleRemoteExitNodeRegisterMessage,
     handleRemoteExitNodePingMessage,
-    startRemoteExitNodeOfflineChecker
+    startRemoteExitNodeOfflineChecker,
+    startExitNodeReconnectScheduler
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
 import { build } from "@server/build";
@@ -29,4 +30,5 @@ export const messageHandlers: Record<string, MessageHandler> = {
 
 if (build != "saas") {
     startRemoteExitNodeOfflineChecker(); // this is to handle the offline check for remote exit nodes
+    startExitNodeReconnectScheduler(); // check pending exit node reconnects and notify newts
 }

server/private/routers/ws/ws.ts

@@ -26,7 +26,7 @@ import {
 } from "@server/db";
 import { eq } from "drizzle-orm";
 import { db } from "@server/db";
-import { recordPing } from "@server/routers/newt/pingAccumulator";
+import { recordSitePing } from "@server/routers/newt/pingAccumulator";
 import { validateNewtSessionToken } from "@server/auth/sessions/newt";
 import { validateOlmSessionToken } from "@server/auth/sessions/olm";
 import logger from "@server/logger";
@@ -38,6 +38,7 @@ import { messageHandlers } from "@server/routers/ws/messageHandlers";
 import { messageHandlers as privateMessageHandlers } from "#private/routers/ws/messageHandlers";
 import {
     AuthenticatedWebSocket,
+    BatchSendMessage,
     ClientType,
     WSMessage,
     TokenPayload,
@@ -187,6 +188,8 @@ const wss: WebSocketServer = new WebSocketServer({ noServer: true });
 // Generate unique node ID for this instance
 const NODE_ID = uuidv4();
 const REDIS_CHANNEL = "websocket_messages";
+const REDIS_DIRECT_BATCH_SIZE = 250;
+const REDIS_DIRECT_FLUSH_INTERVAL_MS = 10;
 
 // Client tracking map (local to this node)
 const connectedClients: Map<string, AuthenticatedWebSocket[]> = new Map();
@@ -197,6 +200,15 @@ const clientConfigVersions: Map<string, number> = new Map();
 // Recovery tracking
 let isRedisRecoveryInProgress = false;
 
+interface RedisDirectBatchEntry {
+    targetClientId: string;
+    message: WSMessage;
+    resolve: () => void;
+}
+
+let pendingRedisDirectMessages: RedisDirectBatchEntry[] = [];
+let redisDirectFlushTimer: NodeJS.Timeout | null = null;
+
 // Helper to get map key
 const getClientMapKey = (clientId: string) => clientId;
 
@@ -207,6 +219,78 @@ const getNodeConnectionsKey = (nodeId: string, clientId: string) =>
 const getConfigVersionKey = (clientId: string) =>
     `ws:configVersion:${clientId}`;
 
+const clearRedisDirectFlushTimer = (): void => {
+    if (redisDirectFlushTimer) {
+        clearTimeout(redisDirectFlushTimer);
+        redisDirectFlushTimer = null;
+    }
+};
+
+const publishDirectBatch = async (
+    entries: RedisDirectBatchEntry[]
+): Promise<void> => {
+    const redisMessage: RedisMessage = {
+        type: "direct-batch",
+        messages: entries.map((entry) => ({
+            targetClientId: entry.targetClientId,
+            message: entry.message
+        })),
+        fromNodeId: NODE_ID
+    };
+
+    await redisManager.publish(REDIS_CHANNEL, JSON.stringify(redisMessage));
+};
+
+const flushPendingRedisDirectMessages = async (): Promise<void> => {
+    clearRedisDirectFlushTimer();
+
+    if (pendingRedisDirectMessages.length === 0) {
+        return;
+    }
+
+    const entries = pendingRedisDirectMessages;
+    pendingRedisDirectMessages = [];
+
+    if (!redisManager.isRedisEnabled()) {
+        entries.forEach((entry) => entry.resolve());
+        return;
+    }
+
+    for (let i = 0; i < entries.length; i += REDIS_DIRECT_BATCH_SIZE) {
+        const batch = entries.slice(i, i + REDIS_DIRECT_BATCH_SIZE);
+        try {
+            await publishDirectBatch(batch);
+        } catch (error) {
+            logger.error(
+                "Failed to send batched direct messages via Redis, messages may be lost:",
+                error
+            );
+        } finally {
+            batch.forEach((entry) => entry.resolve());
+        }
+    }
+};
+
+const enqueueRedisDirectMessage = async (
+    targetClientId: string,
+    message: WSMessage
+): Promise<void> => {
+    await new Promise<void>((resolve) => {
+        pendingRedisDirectMessages.push({ targetClientId, message, resolve });
+
+        if (pendingRedisDirectMessages.length >= REDIS_DIRECT_BATCH_SIZE) {
+            void flushPendingRedisDirectMessages();
+            return;
+        }
+
+        if (!redisDirectFlushTimer) {
+            redisDirectFlushTimer = setTimeout(() => {
+                void flushPendingRedisDirectMessages();
+            }, REDIS_DIRECT_FLUSH_INTERVAL_MS);
+        }
+    });
+};
+
 // Initialize Redis subscription for cross-node messaging
 const initializeRedisSubscription = async (): Promise<void> => {
     if (!redisManager.isRedisEnabled()) return;
@@ -227,7 +311,16 @@ const initializeRedisSubscription = async (): Promise<void> => {
                     // Send to specific client on this node
                     await sendToClientLocal(
                         redisMessage.targetClientId,
-                        redisMessage.message
+                        redisMessage.message,
+                        {},
+                        redisMessage.message.configVersion
+                    );
+                } else if (
+                    redisMessage.type === "direct-batch" &&
+                    redisMessage.messages
+                ) {
+                    await sendRedisDirectBatchToLocalClients(
+                        redisMessage.messages
                     );
                 } else if (redisMessage.type === "broadcast") {
                     // Broadcast to all clients on this node except excluded
@@ -503,7 +596,8 @@ const incrementClientConfigVersion = async (
 const sendToClientLocal = async (
     clientId: string,
     message: WSMessage,
-    options: SendMessageOptions = {}
+    options: SendMessageOptions = {},
+    preResolvedConfigVersion?: number
 ): Promise<boolean> => {
     const mapKey = getClientMapKey(clientId);
     const clients = connectedClients.get(mapKey);
@@ -512,7 +606,8 @@ const sendToClientLocal = async (
     }
 
     // Handle config version
-    const configVersion = await getClientConfigVersion(clientId);
+    const configVersion =
+        preResolvedConfigVersion ?? (await getClientConfigVersion(clientId));
 
     // Add config version to message
     const messageWithVersion = {
@@ -522,13 +617,13 @@ const sendToClientLocal = async (
 
     const messageString = JSON.stringify(messageWithVersion);
     if (options.compress) {
-        logger.debug(
-            `Message size before compression: ${messageString.length} bytes`
-        );
+        // logger.debug(
+        //     `Message size before compression: ${messageString.length} bytes`
+        // );
         const compressed = zlib.gzipSync(Buffer.from(messageString, "utf8"));
-        logger.debug(
-            `Message size after compression: ${compressed.length} bytes`
-        );
+        // logger.debug(
+        //     `Message size after compression: ${compressed.length} bytes`
+        // );
         clients.forEach((client) => {
             if (client.readyState === WebSocket.OPEN) {
                 client.send(compressed);
@@ -545,43 +640,71 @@ const sendToClientLocal = async (
     return true;
 };
 
+const sendRedisDirectBatchToLocalClients = async (
+    entries: { targetClientId: string; message: WSMessage }[]
+): Promise<void> => {
+    const jobs = entries.map((entry) =>
+        sendToClientLocal(
+            entry.targetClientId,
+            entry.message,
+            {},
+            entry.message.configVersion
+        )
+    );
+    await Promise.all(jobs);
+};
+
 const broadcastToAllExceptLocal = async (
     message: WSMessage,
     excludeClientId?: string,
     options: SendMessageOptions = {}
 ): Promise<void> => {
-    for (const [mapKey, clients] of connectedClients.entries()) {
-        const [type, id] = mapKey.split(":");
-        const clientId = mapKey; // mapKey is the clientId
-        if (!(excludeClientId && clientId === excludeClientId)) {
-            // Handle config version per client
-            let configVersion = await getClientConfigVersion(clientId);
-            if (options.incrementConfigVersion) {
-                configVersion = await incrementClientConfigVersion(clientId);
-            }
+    const sendPlans = await Promise.all(
+        Array.from(connectedClients.entries()).map(
+            async ([mapKey, clients]) => {
+                const clientId = mapKey; // mapKey is the clientId
+                if (excludeClientId && clientId === excludeClientId) {
+                    return null;
+                }
 
-            // Add config version to message
-            const messageWithVersion = {
-                ...message,
-                configVersion
-            };
+                let configVersion = await getClientConfigVersion(clientId);
+                if (options.incrementConfigVersion) {
+                    configVersion =
+                        await incrementClientConfigVersion(clientId);
+                }
 
-            if (options.compress) {
-                const compressed = zlib.gzipSync(
-                    Buffer.from(JSON.stringify(messageWithVersion), "utf8")
-                );
-                clients.forEach((client) => {
-                    if (client.readyState === WebSocket.OPEN) {
-                        client.send(compressed);
+                return {
+                    clients,
+                    messageWithVersion: {
+                        ...message,
+                        configVersion
                     }
-                });
-            } else {
-                clients.forEach((client) => {
-                    if (client.readyState === WebSocket.OPEN) {
-                        client.send(JSON.stringify(messageWithVersion));
-                    }
-                });
+                };
             }
+        )
+    );
+
+    for (const plan of sendPlans) {
+        if (!plan) {
+            continue;
+        }
+
+        if (options.compress) {
+            const compressed = zlib.gzipSync(
+                Buffer.from(JSON.stringify(plan.messageWithVersion), "utf8")
+            );
+            plan.clients.forEach((client) => {
+                if (client.readyState === WebSocket.OPEN) {
+                    client.send(compressed);
+                }
+            });
+        } else {
+            const messageString = JSON.stringify(plan.messageWithVersion);
+            plan.clients.forEach((client) => {
+                if (client.readyState === WebSocket.OPEN) {
+                    client.send(messageString);
+                }
+            });
         }
     }
 };
@@ -602,28 +725,23 @@ const sendToClient = async (
     );
 
     // Try to send locally first
-    const localSent = await sendToClientLocal(clientId, message, options);
+    const localSent = await sendToClientLocal(
+        clientId,
+        message,
+        options,
+        configVersion
+    );
 
     // Only send via Redis if the client is not connected locally and Redis is enabled
     if (!localSent && redisManager.isRedisEnabled()) {
         try {
-            const redisMessage: RedisMessage = {
-                type: "direct",
-                targetClientId: clientId,
-                message: {
-                    ...message,
-                    configVersion
-                },
-                fromNodeId: NODE_ID
-            };
-
-            await redisManager.publish(
-                REDIS_CHANNEL,
-                JSON.stringify(redisMessage)
-            );
+            await enqueueRedisDirectMessage(clientId, {
+                ...message,
+                configVersion
+            });
         } catch (error) {
             logger.error(
-                "Failed to send message via Redis, message may be lost:",
+                "Failed to queue batched direct message for Redis delivery, message may be lost:",
                 error
             );
             // Continue execution - local delivery already attempted
@@ -638,6 +756,95 @@ const sendToClient = async (
     return localSent;
 };
 
+const sendToClientsBatch = async (
+    entries: BatchSendMessage[]
+): Promise<void> => {
+    if (entries.length === 0) {
+        return;
+    }
+
+    const remoteEntries: { targetClientId: string; message: WSMessage }[] = [];
+    const clientsWithIncrement = new Set(
+        entries
+            .filter((entry) => !!entry.options?.incrementConfigVersion)
+            .map((entry) => entry.clientId)
+    );
+    const nonIncrementOnlyClientIds = Array.from(
+        new Set(
+            entries
+                .map((entry) => entry.clientId)
+                .filter((clientId) => !clientsWithIncrement.has(clientId))
+        )
+    );
+    const stableConfigVersionByClient = new Map<string, number | undefined>(
+        await Promise.all(
+            nonIncrementOnlyClientIds.map(
+                async (clientId) =>
+                    [clientId, await getClientConfigVersion(clientId)] as const
+            )
+        )
+    );
+
+    for (const entry of entries) {
+        const options = entry.options || {};
+        const { clientId, message } = entry;
+
+        const configVersion = options.incrementConfigVersion
+            ? await incrementClientConfigVersion(clientId)
+            : stableConfigVersionByClient.get(clientId);
+
+        logger.debug(
+            `sendToClientsBatch: Message type ${message.type} queued for clientId ${clientId} (new configVersion: ${configVersion})`
+        );
+
+        const localSent = await sendToClientLocal(
+            clientId,
+            message,
+            options,
+            configVersion
+        );
+
+        if (!localSent && redisManager.isRedisEnabled()) {
+            remoteEntries.push({
+                targetClientId: clientId,
+                message: {
+                    ...message,
+                    configVersion
+                }
+            });
+        } else if (!localSent && !redisManager.isRedisEnabled()) {
+            logger.debug(
+                `Could not deliver batch message to ${clientId} - not connected locally and Redis unavailable`
+            );
+        }
+    }
+
+    if (!redisManager.isRedisEnabled() || remoteEntries.length === 0) {
+        return;
+    }
+
+    for (let i = 0; i < remoteEntries.length; i += REDIS_DIRECT_BATCH_SIZE) {
+        const messages = remoteEntries.slice(i, i + REDIS_DIRECT_BATCH_SIZE);
+        try {
+            const redisMessage: RedisMessage = {
+                type: "direct-batch",
+                messages,
+                fromNodeId: NODE_ID
+            };
+
+            await redisManager.publish(
+                REDIS_CHANNEL,
+                JSON.stringify(redisMessage)
+            );
+        } catch (error) {
+            logger.error(
+                "Failed to send explicit direct batch via Redis, messages may be lost:",
+                error
+            );
+        }
+    }
+};
+
 const broadcastToAllExcept = async (
     message: WSMessage,
     excludeClientId?: string,
@@ -856,7 +1063,7 @@ const setupConnection = async (
             // pending pings in a single batched UPDATE every ~10s, which
             // prevents connection pool exhaustion under load (especially
             // with cross-region latency to the database).
-            recordPing(newtClient.siteId);
+            recordSitePing(newtClient.siteId);
         });
     }
 
@@ -1109,6 +1316,8 @@ const disconnectClient = async (clientId: string): Promise<boolean> => {
 // Cleanup function for graceful shutdown
 const cleanup = async (): Promise<void> => {
     try {
+        await flushPendingRedisDirectMessages();
+
         // Close all WebSocket connections
         connectedClients.forEach((clients) => {
             clients.forEach((client) => {
@@ -1139,6 +1348,7 @@ export {
     router,
     handleWSUpgrade,
     sendToClient,
+    sendToClientsBatch,
     broadcastToAllExcept,
     connectedClients,
     hasActiveConnections,