Remove obsolete stoi import from blueprint OpenAPI route

Agent-Logs-Url: https://github.com/fosrl/pangolin/sessions/7b395a8e-7fae-4f4d-952e-4030fea08262

Co-authored-by: oschwartz10612 <4999704+oschwartz10612@users.noreply.github.com>

messages/en-US.json

@@ -255,23 +255,6 @@
     "resourceGoTo": "Go to Resource",
     "resourceDelete": "Delete Resource",
     "resourceDeleteConfirm": "Confirm Delete Resource",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Visibility",
     "enabled": "Enabled",
     "disabled": "Disabled",
@@ -1157,15 +1140,6 @@
     "idpErrorConnectingTo": "There was a problem connecting to {name}. Please contact your administrator.",
     "idpErrorNotFound": "IdP not found",
     "inviteInvalid": "Invalid Invite",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "The invite link is invalid.",
     "inviteErrorWrongUser": "Invite is not for this user",
     "inviteErrorUserNotExists": "User does not exist. Please create an account first.",
@@ -1646,7 +1620,6 @@
     "certificateStatus": "Certificate",
     "certificateStatusAutoRefreshHint": "Status refreshes automatically.",
     "loading": "Loading",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Loading Analytics",
     "restart": "Restart",
     "domains": "Domains",

server/auth/actions.ts

@@ -148,12 +148,6 @@ export enum ActionsEnum {
     updateAlertRule = "updateAlertRule",
     deleteAlertRule = "deleteAlertRule",
     listAlertRules = "listAlertRules",
-    listOrgLabels = "listOrgLabels",
-    createOrgLabel = "createOrgLabel",
-    updateOrgLabel = "updateOrgLabel",
-    deleteOrgLabel = "deleteOrgLabel",
-    attachLabelToItem = "attachLabelToItem",
-    detachLabelFromItem = "detachLabelFromItem",
     getAlertRule = "getAlertRule",
     createHealthCheck = "createHealthCheck",
     updateHealthCheck = "updateHealthCheck",

server/db/pg/schema/schema.ts

@@ -162,89 +162,6 @@ export const resources = pgTable("resources", {
     wildcard: boolean("wildcard").notNull().default(false)
 });
 
-export const labels = pgTable("labels", {
-    labelId: serial("labelId").primaryKey(),
-    name: varchar("name").notNull(),
-    color: varchar("color").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
-export const siteLabels = pgTable(
-    "siteLabels",
-    {
-        siteLabelId: serial("siteLabelId").primaryKey(),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
-);
-
-export const resourceLabels = pgTable(
-    "resourceLabels",
-    {
-        resourceLabelId: serial("resourceLabelId").primaryKey(),
-        resourceId: integer("resourceId")
-            .references(() => resources.resourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
-);
-
-export const siteResourceLabels = pgTable(
-    "siteResourceLabels",
-    {
-        siteResourceLabelId: serial("siteResourceLabelId").primaryKey(),
-        siteResourceId: integer("siteResourceId")
-            .references(() => siteResources.siteResourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
-);
-
-export const clientLabels = pgTable(
-    "clientLabels",
-    {
-        clientLabelId: serial("clientLabelId").primaryKey(),
-        clientId: integer("clientId")
-            .references(() => clients.clientId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
-);
-
 export const targets = pgTable("targets", {
     targetId: serial("targetId").primaryKey(),
     resourceId: integer("resourceId")
@@ -279,11 +196,9 @@ export const targetHealthCheck = pgTable("targetHealthCheck", {
             onDelete: "cascade"
         })
         .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    }).notNull(),
     name: varchar("name"),
     hcEnabled: boolean("hcEnabled").notNull().default(false),
     hcPath: varchar("hcPath"),
@@ -1182,30 +1097,19 @@ export const roundTripMessageTracker = pgTable("roundTripMessageTracker", {
     complete: boolean("complete").notNull().default(false)
 });
 
-export const statusHistory = pgTable(
-    "statusHistory",
-    {
-        id: serial("id").primaryKey(),
-        entityType: varchar("entityType").notNull(),
-        entityId: integer("entityId").notNull(),
-        orgId: varchar("orgId")
-            .notNull()
-            .references(() => orgs.orgId, { onDelete: "cascade" }),
-        status: varchar("status").notNull(),
-        timestamp: integer("timestamp").notNull()
-    },
-    (table) => [
-        index("idx_statusHistory_entity").on(
-            table.entityType,
-            table.entityId,
-            table.timestamp
-        ),
-        index("idx_statusHistory_org_timestamp").on(
-            table.orgId,
-            table.timestamp
-        )
-    ]
-);
+export const statusHistory = pgTable("statusHistory", {
+    id: serial("id").primaryKey(),
+    entityType: varchar("entityType").notNull(),
+    entityId: integer("entityId").notNull(),
+    orgId: varchar("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    status: varchar("status").notNull(),
+    timestamp: integer("timestamp").notNull(),
+}, (table) => [
+    index("idx_statusHistory_entity").on(table.entityType, table.entityId, table.timestamp),
+    index("idx_statusHistory_org_timestamp").on(table.orgId, table.timestamp),
+]);
 
 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
@@ -1275,4 +1179,3 @@ export type RoundTripMessageTracker = InferSelectModel<
 >;
 export type Network = InferSelectModel<typeof networks>;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type Label = InferSelectModel<typeof labels>;

server/db/sqlite/schema/schema.ts

@@ -183,95 +183,6 @@ export const resources = sqliteTable("resources", {
     wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false)
 });
 
-export const labels = sqliteTable("labels", {
-    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-    name: text("name").notNull(),
-    color: text("color").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
-export const siteLabels = sqliteTable(
-    "siteLabels",
-    {
-        siteLabelId: integer("siteLabelId").primaryKey({ autoIncrement: true }),
-        siteId: integer("siteId")
-            .references(() => sites.siteId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
-);
-
-export const resourceLabels = sqliteTable(
-    "resourceLabels",
-    {
-        resourceLabelId: integer("resourceLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        resourceId: integer("resourceId")
-            .references(() => resources.resourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
-);
-
-export const siteResourceLabels = sqliteTable(
-    "siteResourceLabels",
-    {
-        siteResourceLabelId: integer("siteResourceLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        siteResourceId: integer("siteResourceId")
-            .references(() => siteResources.siteResourceId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
-);
-
-export const clientLabels = sqliteTable(
-    "clientLabels",
-    {
-        clientLabelId: integer("clientLabelId").primaryKey({
-            autoIncrement: true
-        }),
-        clientId: integer("clientId")
-            .references(() => clients.clientId, {
-                onDelete: "cascade"
-            })
-            .notNull(),
-        labelId: integer("labelId")
-            .references(() => labels.labelId, {
-                onDelete: "cascade"
-            })
-            .notNull()
-    },
-    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
-);
-
 export const targets = sqliteTable("targets", {
     targetId: integer("targetId").primaryKey({ autoIncrement: true }),
     resourceId: integer("resourceId")
@@ -308,11 +219,9 @@ export const targetHealthCheck = sqliteTable("targetHealthCheck", {
             onDelete: "cascade"
         })
         .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
+    siteId: integer("siteId").references(() => sites.siteId, {
+        onDelete: "cascade"
+    }).notNull(),
     name: text("name"),
     hcEnabled: integer("hcEnabled", { mode: "boolean" })
         .notNull()
@@ -1287,30 +1196,19 @@ export const roundTripMessageTracker = sqliteTable("roundTripMessageTracker", {
     complete: integer("complete", { mode: "boolean" }).notNull().default(false)
 });
 
-export const statusHistory = sqliteTable(
-    "statusHistory",
-    {
-        id: integer("id").primaryKey({ autoIncrement: true }),
-        entityType: text("entityType").notNull(), // "site" | "healthCheck"
-        entityId: integer("entityId").notNull(), // siteId or targetHealthCheckId
-        orgId: text("orgId")
-            .notNull()
-            .references(() => orgs.orgId, { onDelete: "cascade" }),
-        status: text("status").notNull(), // "online"/"offline" for sites; "healthy"/"unhealthy"/"unknown" for healthChecks
-        timestamp: integer("timestamp").notNull() // unix epoch seconds
-    },
-    (table) => [
-        index("idx_statusHistory_entity").on(
-            table.entityType,
-            table.entityId,
-            table.timestamp
-        ),
-        index("idx_statusHistory_org_timestamp").on(
-            table.orgId,
-            table.timestamp
-        )
-    ]
-);
+export const statusHistory = sqliteTable("statusHistory", {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    entityType: text("entityType").notNull(), // "site" | "healthCheck"
+    entityId: integer("entityId").notNull(),  // siteId or targetHealthCheckId
+    orgId: text("orgId")
+        .notNull()
+        .references(() => orgs.orgId, { onDelete: "cascade" }),
+    status: text("status").notNull(), // "online"/"offline" for sites; "healthy"/"unhealthy"/"unknown" for healthChecks
+    timestamp: integer("timestamp").notNull(), // unix epoch seconds
+}, (table) => [
+    index("idx_statusHistory_entity").on(table.entityType, table.entityId, table.timestamp),
+    index("idx_statusHistory_org_timestamp").on(table.orgId, table.timestamp),
+]);
 
 export type Org = InferSelectModel<typeof orgs>;
 export type User = InferSelectModel<typeof users>;
@@ -1380,4 +1278,3 @@ export type RoundTripMessageTracker = InferSelectModel<
     typeof roundTripMessageTracker
 >;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type Label = InferSelectModel<typeof labels>;

server/integrationApiServer.ts

@@ -152,11 +152,17 @@ function getOpenApiDocumentation() {
 
             if (!hasExistingResponses) {
                 def.route.responses = {
-                    "*": {
-                        description: "",
+                    "200": {
+                        description: "Successful response",
                         content: {
                             "application/json": {
-                                schema: z.object({})
+                                schema: z.object({
+                                    data: z.unknown().nullable(),
+                                    success: z.boolean(),
+                                    error: z.boolean(),
+                                    message: z.string(),
+                                    status: z.number()
+                                })
                             }
                         }
                     }

server/lib/billing/tierMatrix.ts

@@ -24,12 +24,10 @@ export enum TierFeature {
     DomainNamespaces = "domainNamespaces", // handle downgrade by removing custom domain namespaces
     StandaloneHealthChecks = "standaloneHealthChecks",
     AlertingRules = "alertingRules",
-    WildcardSubdomain = "wildcardSubdomain",
-    Labels = "labels"
+    WildcardSubdomain = "wildcardSubdomain"
 }
 
 export const tierMatrix: Record<TierFeature, Tier[]> = {
-    [TierFeature.Labels]: ["tier2", "tier3", "enterprise"],
     [TierFeature.OrgOidc]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.LoginPageDomain]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.DeviceApprovals]: ["tier1", "tier3", "enterprise"],

server/lib/cache.ts

@@ -154,19 +154,8 @@ class AdaptiveCache {
     keys(): string[] {
         return localCache.keys();
     }
-
-    /**
-     * Get keys with a specific prefix
-     * @param prefix - Key prefix to match
-     * @returns Array of matching keys
-     */
-    async keysWithPrefix(prefix: string): Promise<string[]> {
-        const allKeys = localCache.keys();
-        return allKeys.filter((key) => key.startsWith(prefix));
-    }
 }
 
 // Export singleton instance
 export const cache = new AdaptiveCache();
-export const regionalCache = cache; // Alias for compatability with the private version
 export default cache;

server/lib/ip.ts

@@ -873,7 +873,13 @@ export const portRangeStringSchema = z
             message:
                 'Port range must be "*" for all ports, or a comma-separated list of ports and ranges (e.g., "80,443,8000-9000"). Ports must be between 1 and 65535, and ranges must have start <= end.'
         }
-    );
+    )
+    .openapi({
+        type: "string",
+        description:
+            'Port range string. Use "*" for all ports, a comma-separated list of ports, or ranges (e.g., "80,443,8000-9000"). Ports must be between 1 and 65535.',
+        example: "80,443,8000-9000"
+    });
 
 /**
  * Parses a port range string into an array of port range objects

server/lib/openapi/createApiResponseSchema.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+
+export function createApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
+    return z.object({
+        data: dataSchema.nullable(),
+        success: z.boolean(),
+        error: z.boolean(),
+        message: z.string(),
+        status: z.number()
+    });
+}

server/lib/rebuildClientAssociations.ts

@@ -18,7 +18,7 @@ import {
     userOrgRoles,
     userSiteResources
 } from "@server/db";
-import { and, count, eq, inArray, ne } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";
 
 import { deletePeer as newtDeletePeer } from "@server/routers/newt/peers";
 import {
@@ -39,11 +39,6 @@ import {
     removePeerData,
     removeTargets as removeSubnetProxyTargets
 } from "@server/routers/client/targets";
-import { lockManager } from "#dynamic/lib/lock";
-
-// TTL for rebuild-association locks. These functions can fan out into many
-// peer/proxy updates, so give them a generous window.
-const REBUILD_ASSOCIATIONS_LOCK_TTL_MS = 120000;
 
 export async function getClientSiteResourceAccess(
     siteResource: SiteResource,
@@ -166,23 +161,6 @@ export async function rebuildClientAssociationsFromSiteResource(
         pubKey: string | null;
         subnet: string | null;
     }[];
-}> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-        () => rebuildClientAssociationsFromSiteResourceImpl(siteResource, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromSiteResourceImpl(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
-): Promise<{
-    mergedAllClients: {
-        clientId: number;
-        pubKey: string | null;
-        subnet: string | null;
-    }[];
 }> {
     logger.debug(
         `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] START siteResourceId=${siteResource.siteResourceId} networkId=${siteResource.networkId} orgId=${siteResource.orgId}`
@@ -561,29 +539,6 @@ async function handleMessagesForSiteClients(
         }
     }
 
-    // get the number of sites on each of these clients so we can log it and make decisions about whether to send messages based on it
-    const clientSiteCounts: Record<number, number> = {};
-    if (clientsToProcess.size > 0) {
-        const clientIdsToProcess = Array.from(clientsToProcess.keys());
-        const siteCounts = await trx
-            .select({
-                clientId: clientSitesAssociationsCache.clientId,
-                siteCount: count(clientSitesAssociationsCache.siteId)
-            })
-            .from(clientSitesAssociationsCache)
-            .where(
-                inArray(
-                    clientSitesAssociationsCache.clientId,
-                    clientIdsToProcess
-                )
-            )
-            .groupBy(clientSitesAssociationsCache.clientId);
-
-        for (const row of siteCounts) {
-            clientSiteCounts[row.clientId] = Number(row.siteCount);
-        }
-    }
-
     for (const client of clientsToProcess.values()) {
         // UPDATE THE NEWT
         if (!client.subnet || !client.pubKey) {
@@ -627,14 +582,7 @@ async function handleMessagesForSiteClients(
         }
 
         if (isAdd) {
-            if (clientSiteCounts[client.clientId] > 250) {
-                // skip adding the peer if we have more than 250 sites because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${clientSiteCounts[client.clientId]} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
             await initPeerAddHandshake(
                 // this will kick off the add peer process for the client
                 client.clientId,
@@ -652,24 +600,9 @@ async function handleMessagesForSiteClients(
         exitNodeJobs.push(updateClientSiteDestinations(client, trx));
     }
 
-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for site ${site.siteId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs); // do the servers first to make sure they are ready?
+    await Promise.all(olmJobs);
 }
 
 interface PeerDestination {
@@ -952,17 +885,6 @@ async function handleSubnetProxyTargetUpdates(
 export async function rebuildClientAssociationsFromClient(
     client: Client,
     trx: Transaction | typeof db = db
-): Promise<void> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:client:${client.clientId}`,
-        () => rebuildClientAssociationsFromClientImpl(client, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromClientImpl(
-    client: Client,
-    trx: Transaction | typeof db = db
 ): Promise<void> {
     let newSiteResourceIds: number[] = [];
 
@@ -1235,12 +1157,6 @@ async function handleMessagesForClientSites(
     const olmJobs: Promise<any>[] = [];
     const exitNodeJobs: Promise<any>[] = [];
 
-    const totalSitesOnClient = await trx
-        .select({ count: count(clientSitesAssociationsCache.siteId) })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId))
-        .then((rows) => Number(rows[0].count));
-
     for (const siteData of sitesData) {
         const site = siteData.sites;
         const exitNode = siteData.exitNodes;
@@ -1301,14 +1217,7 @@ async function handleMessagesForClientSites(
                 continue;
             }
 
-            if (totalSitesOnClient > 250) {
-                // skip adding the site if we have more than 250 because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${totalSitesOnClient} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
             await initPeerAddHandshake(
                 // this will kick off the add peer process for the client
                 client.clientId,
@@ -1336,24 +1245,9 @@ async function handleMessagesForClientSites(
         );
     }
 
-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for client ${client.clientId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs);
+    await Promise.all(olmJobs);
 }
 
 async function handleMessagesForClientResources(
@@ -1634,195 +1528,3 @@ async function handleMessagesForClientResources(
 
     await Promise.all([...proxyJobs, ...olmJobs]);
 }
-
-export type ClientAssociationsCacheVerification = {
-    clientId: number;
-    consistent: boolean;
-    // What permissions say the cache should contain
-    expectedSiteResourceIds: number[];
-    expectedSiteIds: number[];
-    // What the cache currently contains
-    actualSiteResourceIds: number[];
-    actualSiteIds: number[];
-    // Diff
-    missingSiteResourceIds: number[]; // present in expected, missing from cache
-    extraSiteResourceIds: number[]; // present in cache, not in expected
-    missingSiteIds: number[];
-    extraSiteIds: number[];
-};
-
-// verifyClientAssociationsCache walks the same permission-derivation logic as
-// rebuildClientAssociationsFromClient but does NOT modify the database. It
-// returns the expected vs actual cache contents and a boolean indicating
-// whether the cache is in sync with what permissions imply.
-export async function verifyClientAssociationsCache(
-    client: Client,
-    trx: Transaction | typeof db = db
-): Promise<ClientAssociationsCacheVerification> {
-    let newSiteResourceIds: number[] = [];
-
-    // 1. Direct client associations
-    const directSiteResources = await trx
-        .select({ siteResourceId: clientSiteResources.siteResourceId })
-        .from(clientSiteResources)
-        .innerJoin(
-            siteResources,
-            eq(siteResources.siteResourceId, clientSiteResources.siteResourceId)
-        )
-        .where(
-            and(
-                eq(clientSiteResources.clientId, client.clientId),
-                eq(siteResources.orgId, client.orgId)
-            )
-        );
-
-    newSiteResourceIds.push(
-        ...directSiteResources.map((r) => r.siteResourceId)
-    );
-
-    // 2. User-based and role-based access (if client has a userId)
-    if (client.userId) {
-        const userSiteResourceIds = await trx
-            .select({ siteResourceId: userSiteResources.siteResourceId })
-            .from(userSiteResources)
-            .innerJoin(
-                siteResources,
-                eq(
-                    siteResources.siteResourceId,
-                    userSiteResources.siteResourceId
-                )
-            )
-            .where(
-                and(
-                    eq(userSiteResources.userId, client.userId),
-                    eq(siteResources.orgId, client.orgId)
-                )
-            );
-
-        newSiteResourceIds.push(
-            ...userSiteResourceIds.map((r) => r.siteResourceId)
-        );
-
-        const roleIds = await trx
-            .select({ roleId: userOrgRoles.roleId })
-            .from(userOrgRoles)
-            .where(
-                and(
-                    eq(userOrgRoles.userId, client.userId),
-                    eq(userOrgRoles.orgId, client.orgId)
-                )
-            )
-            .then((rows) => rows.map((row) => row.roleId));
-
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId)
-                    )
-                );
-
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
-            );
-        }
-    }
-
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
-
-    const newSiteResources =
-        newSiteResourceIds.length > 0
-            ? await trx
-                  .select()
-                  .from(siteResources)
-                  .where(
-                      inArray(siteResources.siteResourceId, newSiteResourceIds)
-                  )
-            : [];
-
-    const networkIds = Array.from(
-        new Set(
-            newSiteResources
-                .map((sr) => sr.networkId)
-                .filter((id): id is number => id !== null)
-        )
-    );
-    const newSiteIds =
-        networkIds.length > 0
-            ? await trx
-                  .select({ siteId: siteNetworks.siteId })
-                  .from(siteNetworks)
-                  .where(inArray(siteNetworks.networkId, networkIds))
-                  .then((rows) =>
-                      Array.from(new Set(rows.map((r) => r.siteId)))
-                  )
-            : [];
-
-    // Read the existing cache state
-    const existingResourceAssociations = await trx
-        .select({
-            siteResourceId: clientSiteResourcesAssociationsCache.siteResourceId
-        })
-        .from(clientSiteResourcesAssociationsCache)
-        .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
-        );
-    const existingSiteResourceIds = existingResourceAssociations.map(
-        (r) => r.siteResourceId
-    );
-
-    const existingSiteAssociations = await trx
-        .select({ siteId: clientSitesAssociationsCache.siteId })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId));
-    const existingSiteIds = existingSiteAssociations.map((s) => s.siteId);
-
-    const expectedSiteResourceSet = new Set(newSiteResourceIds);
-    const actualSiteResourceSet = new Set(existingSiteResourceIds);
-    const expectedSiteSet = new Set(newSiteIds);
-    const actualSiteSet = new Set(existingSiteIds);
-
-    const missingSiteResourceIds = newSiteResourceIds.filter(
-        (id) => !actualSiteResourceSet.has(id)
-    );
-    const extraSiteResourceIds = existingSiteResourceIds.filter(
-        (id) => !expectedSiteResourceSet.has(id)
-    );
-    const missingSiteIds = newSiteIds.filter((id) => !actualSiteSet.has(id));
-    const extraSiteIds = existingSiteIds.filter(
-        (id) => !expectedSiteSet.has(id)
-    );
-
-    const consistent =
-        missingSiteResourceIds.length === 0 &&
-        extraSiteResourceIds.length === 0 &&
-        missingSiteIds.length === 0 &&
-        extraSiteIds.length === 0;
-
-    return {
-        clientId: client.clientId,
-        consistent,
-        expectedSiteResourceIds: Array.from(expectedSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        expectedSiteIds: Array.from(expectedSiteSet).sort((a, b) => a - b),
-        actualSiteResourceIds: Array.from(actualSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        actualSiteIds: Array.from(actualSiteSet).sort((a, b) => a - b),
-        missingSiteResourceIds: missingSiteResourceIds.sort((a, b) => a - b),
-        extraSiteResourceIds: extraSiteResourceIds.sort((a, b) => a - b),
-        missingSiteIds: missingSiteIds.sort((a, b) => a - b),
-        extraSiteIds: extraSiteIds.sort((a, b) => a - b)
-    };
-}

server/lib/statusHistory.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
 import { and, eq, gte, asc } from "drizzle-orm";
-import { regionalCache as cache } from "#dynamic/lib/cache";
+import cache from "@server/lib/cache";
 
 const STATUS_HISTORY_CACHE_TTL = 60; // seconds
 
@@ -66,7 +66,7 @@ export async function invalidateStatusHistoryCache(
     entityId: number
 ): Promise<void> {
     const prefix = `statusHistory:${entityType}:${entityId}:`;
-    const keys = await cache.keysWithPrefix(prefix);
+    const keys = cache.keys().filter((k) => k.startsWith(prefix));
     if (keys.length > 0) {
         await cache.del(keys);
     }

server/private/lib/cache.ts

@@ -13,7 +13,7 @@
 
 import NodeCache from "node-cache";
 import logger from "@server/logger";
-import { redisManager, regionalRedisManager } from "@server/private/lib/redis";
+import { redisManager } from "@server/private/lib/redis";
 
 // Create local cache with maxKeys limit to prevent memory leaks
 // With ~10k requests/day and 5min TTL, 10k keys should be more than sufficient
@@ -298,147 +298,3 @@ class AdaptiveCache {
 // Export singleton instance
 export const cache = new AdaptiveCache();
 export default cache;
-
-/**
- * Regional adaptive cache backed by the in-cluster Redis instance.
- * Falls back to a local NodeCache when the regional Redis is unavailable.
- * Use this for data that is regional in nature (e.g. status history) so
- * reads are served from the same cluster the user is hitting.
- */
-const regionalLocalCache = new NodeCache({
-    stdTTL: 3600,
-    checkperiod: 120,
-    maxKeys: 10000
-});
-
-class RegionalAdaptiveCache {
-    private useRedis(): boolean {
-        return (
-            regionalRedisManager.isRedisEnabled() &&
-            regionalRedisManager.getHealthStatus().isHealthy
-        );
-    }
-
-    async set(key: string, value: any, ttl?: number): Promise<boolean> {
-        const effectiveTtl = ttl === 0 ? undefined : ttl;
-        const redisTtl = ttl === 0 ? undefined : (ttl ?? 3600);
-
-        if (this.useRedis()) {
-            try {
-                const serialized = JSON.stringify(value);
-                const success = await regionalRedisManager.set(
-                    key,
-                    serialized,
-                    redisTtl
-                );
-                if (success) {
-                    logger.debug(`[regional] Set key in Redis: ${key}`);
-                    return true;
-                }
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis set error for key ${key}:`,
-                    error
-                );
-            }
-        }
-
-        const success = regionalLocalCache.set(key, value, effectiveTtl || 0);
-        if (success) logger.debug(`[regional] Set key in local cache: ${key}`);
-        return success;
-    }
-
-    async get<T = any>(key: string): Promise<T | undefined> {
-        if (this.useRedis()) {
-            try {
-                const value = await regionalRedisManager.get(key);
-                if (value !== null) {
-                    logger.debug(`[regional] Cache hit in Redis: ${key}`);
-                    return JSON.parse(value) as T;
-                }
-                logger.debug(`[regional] Cache miss in Redis: ${key}`);
-                return undefined;
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis get error for key ${key}:`,
-                    error
-                );
-            }
-        }
-
-        const value = regionalLocalCache.get<T>(key);
-        if (value !== undefined) {
-            logger.debug(`[regional] Cache hit in local cache: ${key}`);
-        } else {
-            logger.debug(`[regional] Cache miss in local cache: ${key}`);
-        }
-        return value;
-    }
-
-    async del(key: string | string[]): Promise<number> {
-        const keys = Array.isArray(key) ? key : [key];
-        let deletedCount = 0;
-
-        if (this.useRedis()) {
-            try {
-                for (const k of keys) {
-                    const success = await regionalRedisManager.del(k);
-                    if (success) {
-                        deletedCount++;
-                        logger.debug(`[regional] Deleted key from Redis: ${k}`);
-                    }
-                }
-                if (deletedCount === keys.length) return deletedCount;
-                deletedCount = 0;
-            } catch (error) {
-                logger.error(`[regional] Redis del error:`, error);
-                deletedCount = 0;
-            }
-        }
-
-        for (const k of keys) {
-            const count = regionalLocalCache.del(k);
-            if (count > 0) {
-                deletedCount++;
-                logger.debug(`[regional] Deleted key from local cache: ${k}`);
-            }
-        }
-        return deletedCount;
-    }
-
-    async has(key: string): Promise<boolean> {
-        if (this.useRedis()) {
-            try {
-                const value = await regionalRedisManager.get(key);
-                return value !== null;
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis has error for key ${key}:`,
-                    error
-                );
-            }
-        }
-        return regionalLocalCache.has(key);
-    }
-
-    /**
-     * Returns keys matching the given prefix from whichever backend is active.
-     * Redis uses a KEYS scan; local cache filters in-memory keys.
-     */
-    async keysWithPrefix(prefix: string): Promise<string[]> {
-        if (this.useRedis()) {
-            try {
-                return await regionalRedisManager.keys(`${prefix}*`);
-            } catch (error) {
-                logger.error(`[regional] Redis keys error:`, error);
-            }
-        }
-        return regionalLocalCache.keys().filter((k) => k.startsWith(prefix));
-    }
-
-    getCurrentBackend(): "redis" | "local" {
-        return this.useRedis() ? "redis" : "local";
-    }
-}
-
-export const regionalCache = new RegionalAdaptiveCache();

server/private/lib/logStreaming/index.ts

@@ -24,8 +24,7 @@ import { LogStreamingManager } from "./LogStreamingManager";
  */
 export const logStreamingManager = new LogStreamingManager();
 
-if (build !== "saas") {
-    // this is handled separately in the saas build, so we don't want to start it here
+if (build != "saas") { // this is handled separately in the saas build, so we don't want to start it here
     logStreamingManager.start();
 }
 

server/private/lib/readConfigFile.ts

@@ -73,25 +73,6 @@ export const privateConfigSchema = z
                     .object({
                         rejectUnauthorized: z.boolean().optional().default(true)
                     })
-                    .optional(),
-                regional_redis: z
-                    .object({
-                        host: z.string(),
-                        port: portSchema,
-                        password: z
-                            .string()
-                            .optional()
-                            .transform(getEnvOrYaml("REGIONAL_REDIS_PASSWORD")),
-                        db: z.int().nonnegative().optional().default(0),
-                        tls: z
-                            .object({
-                                rejectUnauthorized: z
-                                    .boolean()
-                                    .optional()
-                                    .default(true)
-                            })
-                            .optional()
-                    })
                     .optional()
             })
             .optional(),

server/private/lib/redis.ts

@@ -109,14 +109,14 @@ class RedisManager {
             password: redisConfig.password,
             db: redisConfig.db
         };
-
+        
         // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
         if (redisConfig.tls) {
             opts.tls = {
                 rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
             };
         }
-
+        
         return opts;
     }
 
@@ -135,14 +135,14 @@ class RedisManager {
             password: replica.password,
             db: replica.db || redisConfig.db
         };
-
+        
         // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
         if (redisConfig.tls) {
             opts.tls = {
                 rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
             };
         }
-
+        
         return opts;
     }
 
@@ -855,163 +855,3 @@ class RedisManager {
 export const redisManager = new RedisManager();
 export const redis = redisManager.getClient();
 export default redisManager;
-
-/**
- * Lightweight Redis manager for the regional (in-cluster) Redis instance.
- * Connects only when `redis.regional_redis` is present in the private config
- * and `flags.enable_redis` is true. No pub/sub — designed for low-latency
- * caching of regionally-scoped data.
- */
-class RegionalRedisManager {
-    private writeClient: Redis | null = null;
-    private readClient: Redis | null = null;
-    private isEnabled: boolean = false;
-    private isHealthy: boolean = false;
-    private connectionTimeout: number = 5000;
-    private commandTimeout: number = 5000;
-
-    constructor() {
-        if (build === "oss") return;
-
-        const cfg = privateConfig.getRawPrivateConfig();
-        if (!cfg.flags.enable_redis || !cfg.redis?.regional_redis) return;
-
-        this.isEnabled = true;
-        this.initializeClients();
-    }
-
-    private getConfig(): RedisOptions {
-        const r = privateConfig.getRawPrivateConfig().redis!.regional_redis!;
-        const opts: RedisOptions = {
-            host: r.host,
-            port: r.port,
-            password: r.password,
-            db: r.db
-        };
-        if (r.tls) {
-            opts.tls = { rejectUnauthorized: r.tls.rejectUnauthorized ?? true };
-        }
-        return opts;
-    }
-
-    private initializeClients(): void {
-        const cfg = this.getConfig();
-        const baseOpts = {
-            ...cfg,
-            enableReadyCheck: false,
-            maxRetriesPerRequest: 3,
-            keepAlive: 10000,
-            connectTimeout: this.connectionTimeout,
-            commandTimeout: this.commandTimeout
-        };
-
-        try {
-            this.writeClient = new Redis(baseOpts);
-            // redis-1 (replica) handles reads; fall back to primary if not resolvable
-            this.readClient = new Redis({
-                ...baseOpts,
-                host: cfg.host!.replace(/^(.*?)(\.\S+)$/, (_, h, rest) => {
-                    // Derive replica hostname from the headless service pattern:
-                    // redis.redis.svc.cluster.local -> redis-1.redis-headless.redis.svc.cluster.local
-                    // If it doesn't look like a k8s service, just use the same host
-                    return h + rest;
-                })
-            });
-
-            // For simplicity use same host for both; callers can always read from primary
-            // The real replica routing is handled by the StatefulSet headless service
-            this.readClient = this.writeClient;
-
-            this.writeClient.on("ready", () => {
-                logger.info("Regional Redis client ready");
-                this.isHealthy = true;
-            });
-            this.writeClient.on("error", (err) => {
-                logger.error("Regional Redis client error:", err);
-                this.isHealthy = false;
-            });
-            this.writeClient.on("reconnecting", () => {
-                logger.info("Regional Redis client reconnecting...");
-                this.isHealthy = false;
-            });
-
-            logger.info("Regional Redis client initialized");
-        } catch (error) {
-            logger.error("Failed to initialize regional Redis client:", error);
-            this.isEnabled = false;
-        }
-    }
-
-    public isRedisEnabled(): boolean {
-        return this.isEnabled && this.writeClient !== null && this.isHealthy;
-    }
-
-    public getHealthStatus() {
-        return { isEnabled: this.isEnabled, isHealthy: this.isHealthy };
-    }
-
-    public async set(
-        key: string,
-        value: string,
-        ttl?: number
-    ): Promise<boolean> {
-        if (!this.isRedisEnabled() || !this.writeClient) return false;
-        try {
-            if (ttl) {
-                await this.writeClient.setex(key, ttl, value);
-            } else {
-                await this.writeClient.set(key, value);
-            }
-            return true;
-        } catch (error) {
-            logger.error("Regional Redis SET error:", error);
-            return false;
-        }
-    }
-
-    public async get(key: string): Promise<string | null> {
-        if (!this.isRedisEnabled() || !this.readClient) return null;
-        try {
-            return await this.readClient.get(key);
-        } catch (error) {
-            logger.error("Regional Redis GET error:", error);
-            return null;
-        }
-    }
-
-    public async del(key: string): Promise<boolean> {
-        if (!this.isRedisEnabled() || !this.writeClient) return false;
-        try {
-            await this.writeClient.del(key);
-            return true;
-        } catch (error) {
-            logger.error("Regional Redis DEL error:", error);
-            return false;
-        }
-    }
-
-    public async keys(pattern: string): Promise<string[]> {
-        if (!this.isRedisEnabled() || !this.readClient) return [];
-        try {
-            return await this.readClient.keys(pattern);
-        } catch (error) {
-            logger.error("Regional Redis KEYS error:", error);
-            return [];
-        }
-    }
-
-    public async disconnect(): Promise<void> {
-        try {
-            if (this.writeClient) {
-                await this.writeClient.quit();
-                this.writeClient = null;
-            }
-            this.readClient = null;
-            logger.info("Regional Redis client disconnected");
-        } catch (error) {
-            logger.error("Error disconnecting regional Redis client:", error);
-        }
-    }
-}
-
-export const regionalRedisManager = new RegionalRedisManager();

server/private/middlewares/verifySubscription.ts

@@ -25,7 +25,7 @@ export function verifyValidSubscription(tiers: Tier[]) {
         next: NextFunction
     ): Promise<any> {
         try {
-            if (build !== "saas") {
+            if (build != "saas") {
                 return next();
             }
 

server/private/routers/alertRule/createAlertRule.ts

@@ -202,7 +202,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createAlertRule(

server/private/routers/alertRule/deleteAlertRule.ts

@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteAlertRule(

server/private/routers/alertRule/getAlertRule.ts

@@ -49,7 +49,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getAlertRule(

server/private/routers/alertRule/listAlertRules.ts

@@ -95,7 +95,22 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listAlertRules(

server/private/routers/alertRule/updateAlertRule.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import {
     alertRules,
@@ -148,6 +149,10 @@ const bodySchema = z
 export type UpdateAlertRuleResponse = {
     alertRuleId: number;
 };
+const UpdateAlertRuleResponseDataSchema = z.object({
+    alertRuleId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -164,7 +169,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateAlertRuleResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateAlertRule(

server/private/routers/approvals/processPendingApproval.ts

@@ -24,7 +24,7 @@ import type { NextFunction, Request, Response } from "express";
 
 const paramsSchema = z.strictObject({
     orgId: z.string(),
-    approvalId: z.string().transform(Number).pipe(z.int().positive())
+    approvalId: z.coerce.number().int().positive()
 });
 
 const bodySchema = z.strictObject({

server/private/routers/auditLogs/exportAccessAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryAccessAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryAccessAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportAccessAuditLogs(

server/private/routers/auditLogs/exportActionAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryActionAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryActionAuditLogsQuery,
         params: queryActionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportActionAuditLogs(

server/private/routers/auditLogs/exportConnectionAuditLog.ts

@@ -18,6 +18,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryConnectionAuditLogsParams,
@@ -37,7 +38,22 @@ registry.registerPath({
         query: queryConnectionAuditLogsQuery,
         params: queryConnectionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportConnectionAuditLogs(

server/private/routers/auditLogs/queryAccessAuditLog.ts

@@ -324,7 +324,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryAccessAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryAccessAuditLogs(

server/private/routers/auditLogs/queryActionAuditLog.ts

@@ -165,7 +165,22 @@ registry.registerPath({
         query: queryActionAuditLogsQuery,
         params: queryActionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryActionAuditLogs(

server/private/routers/auditLogs/queryConnectionAuditLog.ts

@@ -439,7 +439,22 @@ registry.registerPath({
         query: queryConnectionAuditLogsQuery,
         params: queryConnectionAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function queryConnectionAuditLogs(

server/private/routers/billing/getOrgUsage.ts

@@ -39,7 +39,22 @@ const getOrgSchema = z.strictObject({
 //     request: {
 //         params: getOrgSchema
 //     },
-//     responses: {}
+// responses: {
+// 200: {
+// description: "Successful response",
+// content: {
+// "application/json": {
+// schema: z.object({
+// data: z.unknown().nullable(),
+// success: z.boolean(),
+// error: z.boolean(),
+// message: z.string(),
+// status: z.number()
+// })
+// }
+// }
+// }
+// }
 // });
 
 export async function getOrgUsage(

server/private/routers/certificates/getCertificate.ts

@@ -115,7 +115,22 @@ registry.registerPath({
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getCertificate(

server/private/routers/certificates/restartCertificate.ts

@@ -25,7 +25,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const restartCertificateParamsSchema = z.strictObject({
-    certId: z.string().transform(stoi).pipe(z.int().positive()),
+    certId: z.coerce.number().int().positive(),
     orgId: z.string()
 });
 
@@ -36,11 +36,26 @@ registry.registerPath({
     tags: ["Certificate"],
     request: {
         params: z.object({
-            certId: z.string().transform(stoi).pipe(z.int().positive()),
+            certId: z.coerce.number().int().positive(),
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function restartCertificate(

server/private/routers/domain/checkDomainNamespaceAvailability.ts

@@ -42,7 +42,22 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function checkDomainNamespaceAvailability(

server/private/routers/domain/listDomainNamespaces.ts

@@ -25,6 +25,7 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const paramsSchema = z.strictObject({});
 
@@ -65,6 +66,20 @@ export type ListDomainNamespacesResponse = {
     pagination: { total: number; limit: number; offset: number };
 };
 
+const ListDomainNamespacesResponseDataSchema = z.object({
+    domainNamespaces: z.array(
+        z.object({
+            domainNamespaceId: z.string(),
+            domainId: z.string()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 registry.registerPath({
     method: "get",
     path: "/domains/namepaces",
@@ -73,7 +88,18 @@ registry.registerPath({
     request: {
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListDomainNamespacesResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listDomainNamespaces(

server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import { eventStreamingDestinations } from "@server/db";
 import { logStreamingManager } from "#private/lib/logStreaming";
@@ -42,6 +43,10 @@ const bodySchema = z.strictObject({
 export type CreateEventStreamingDestinationResponse = {
     destinationId: number;
 };
+const CreateEventStreamingDestinationResponseDataSchema = z.object({
+    destinationId: z.number()
+});
+
 
 registry.registerPath({
     method: "put",
@@ -58,7 +63,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateEventStreamingDestinationResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createEventStreamingDestination(

server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts

@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteEventStreamingDestination(

server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts

@@ -24,6 +24,7 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { eq, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const paramsSchema = z.strictObject({
     orgId: z.string().nonempty()
@@ -67,6 +68,31 @@ export type ListEventStreamingDestinationsResponse = {
     };
 };
 
+const ListEventStreamingDestinationsResponseDataSchema = z.object({
+    destinations: z.array(
+        z.object({
+            destinationId: z.number(),
+            orgId: z.string(),
+            type: z.string(),
+            config: z.string(),
+            enabled: z.boolean(),
+            lastError: z.string().nullable(),
+            lastErrorAt: z.number().nullable(),
+            createdAt: z.number(),
+            updatedAt: z.number(),
+            sendConnectionLogs: z.boolean(),
+            sendRequestLogs: z.boolean(),
+            sendActionLogs: z.boolean(),
+            sendAccessLogs: z.boolean()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 async function query(orgId: string, limit: number, offset: number) {
     const res = await db
         .select()
@@ -88,7 +114,18 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListEventStreamingDestinationsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listEventStreamingDestinations(

server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import { eventStreamingDestinations } from "@server/db";
 import response from "@server/lib/response";
@@ -45,6 +46,10 @@ const bodySchema = z.strictObject({
 export type UpdateEventStreamingDestinationResponse = {
     destinationId: number;
 };
+const UpdateEventStreamingDestinationResponseDataSchema = z.object({
+    destinationId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -61,7 +66,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateEventStreamingDestinationResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateEventStreamingDestination(

server/private/routers/external.ts

@@ -31,8 +31,6 @@ import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
-import * as labels from "#private/routers/labels";
-import * as client from "@server/routers/client";
 
 import {
     verifyOrgAccess,
@@ -734,59 +732,6 @@ authenticated.get(
     alertRule.getAlertRule
 );
 
-authenticated.get(
-    "/org/:orgId/labels",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyValidSubscription(tierMatrix.labels),
-    verifyUserHasAction(ActionsEnum.listOrgLabels),
-    labels.listOrgLabels
-);
-
-authenticated.post(
-    "/org/:orgId/labels",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyValidSubscription(tierMatrix.labels),
-    verifyUserHasAction(ActionsEnum.createOrgLabel),
-    labels.createOrgLabel
-);
-
-authenticated.patch(
-    "/org/:orgId/label/:labelId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyValidSubscription(tierMatrix.labels),
-    verifyUserHasAction(ActionsEnum.updateOrgLabel),
-    labels.updateOrgLabel
-);
-
-authenticated.delete(
-    "/org/:orgId/label/:labelId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.deleteOrgLabel),
-    labels.deleteOrgLabel
-);
-
-authenticated.put(
-    "/org/:orgId/label/:labelId/attach",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyValidSubscription(tierMatrix.labels),
-    verifyUserHasAction(ActionsEnum.attachLabelToItem),
-    labels.attachLabelToItem
-);
-
-authenticated.put(
-    "/org/:orgId/label/:labelId/detach",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyValidSubscription(tierMatrix.labels),
-    verifyUserHasAction(ActionsEnum.detachLabelFromItem),
-    labels.detachLabelFromItem
-);
-
 authenticated.get(
     "/org/:orgId/health-checks",
     verifyValidLicense,
@@ -830,15 +775,3 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.getTarget),
     healthChecks.getHealthCheckStatusHistory
 );
-
-authenticated.get(
-    "/client/:clientId/verify-associations-cache",
-    verifyClientAccess,
-    client.verifyClientAssociationsCache
-);
-
-authenticated.post(
-    "/client/:clientId/rebuild-associations-cache",
-    verifyClientAccess,
-    client.rebuildClientAssociationsCacheRoute
-);

server/private/routers/healthChecks/createHealthCheck.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, targetHealthCheck, newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
@@ -52,6 +53,10 @@ const bodySchema = z.strictObject({
 export type CreateHealthCheckResponse = {
     targetHealthCheckId: number;
 };
+const CreateHealthCheckResponseDataSchema = z.object({
+    targetHealthCheckId: z.number()
+});
+
 
 registry.registerPath({
     method: "put",
@@ -68,7 +73,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateHealthCheckResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createHealthCheck(

server/private/routers/healthChecks/deleteHealthCheck.ts

@@ -41,7 +41,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteHealthCheck(

server/private/routers/healthChecks/listHealthChecks.ts

@@ -68,7 +68,22 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listHealthChecks(

server/private/routers/healthChecks/updateHealthCheck.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, targetHealthCheck, newts, sites } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -81,6 +82,29 @@ export type UpdateHealthCheckResponse = {
     hcHealthyThreshold: number | null;
     hcUnhealthyThreshold: number | null;
 };
+const UpdateHealthCheckResponseDataSchema = z.object({
+    targetHealthCheckId: z.number(),
+    name: z.string().nullable(),
+    siteId: z.number().nullable(),
+    hcEnabled: z.boolean(),
+    hcHealth: z.string().nullable(),
+    hcMode: z.string().nullable(),
+    hcHostname: z.string().nullable(),
+    hcPort: z.number().nullable(),
+    hcPath: z.string().nullable(),
+    hcScheme: z.string().nullable(),
+    hcMethod: z.string().nullable(),
+    hcInterval: z.number().nullable(),
+    hcUnhealthyInterval: z.number().nullable(),
+    hcTimeout: z.number().nullable(),
+    hcHeaders: z.string().nullable(),
+    hcFollowRedirects: z.boolean().nullable(),
+    hcStatus: z.number().nullable(),
+    hcTlsServerName: z.string().nullable(),
+    hcHealthyThreshold: z.number().nullable(),
+    hcUnhealthyThreshold: z.number().nullable()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -97,7 +121,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateHealthCheckResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateHealthCheck(

server/private/routers/labels/attachLabelToItem.ts

@@ -1,224 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import {
-    clients,
-    clientLabels,
-    db,
-    labels,
-    resourceLabels,
-    resources,
-    siteLabels,
-    siteResourceLabels,
-    siteResources,
-    sites
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, isNull } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    labelId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const attachLabelBodySchema = z.strictObject({
-    siteId: z.number().int().optional(),
-    resourceId: z.number().int().optional(),
-    siteResourceId: z.number().int().optional(),
-    clientId: z.number().int().optional()
-});
-
-export async function attachLabelToItem(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, labelId } = parsedParams.data;
-
-        const parsedBody = attachLabelBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { siteId, resourceId, siteResourceId, clientId } =
-            parsedBody.data;
-
-        if (!siteId && !resourceId && !siteResourceId && !clientId) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "At least one of `siteId`, `resourceId`, `siteResourceId` or `clientId` should be provided."
-                )
-            );
-        }
-
-        const [existing] = await db
-            .select()
-            .from(labels)
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Label with Id ${labelId} not found`
-                )
-            );
-        }
-
-        if (siteId) {
-            const siteCount = await db.$count(
-                sites,
-                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-            );
-
-            if (siteCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Site with Id ${siteId} doesn't exist.`
-                    )
-                );
-            }
-
-            // idempotent, calling this endpoint multiple times should attach the label only once
-            await db
-                .insert(siteLabels)
-                .values({
-                    labelId,
-                    siteId
-                })
-                .onConflictDoNothing();
-        }
-
-        if (resourceId) {
-            const resourceCount = await db.$count(
-                resources,
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(resources.orgId, orgId)
-                )
-            );
-
-            if (resourceCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Resource with Id ${resourceId} doesn't exist.`
-                    )
-                );
-            }
-
-            // idempotent, calling this endpoint multiple times should attach the label only once
-            await db
-                .insert(resourceLabels)
-                .values({
-                    labelId,
-                    resourceId
-                })
-                .onConflictDoNothing();
-        }
-
-        if (siteResourceId) {
-            const resourceCount = await db.$count(
-                siteResources,
-                and(
-                    eq(siteResources.siteResourceId, siteResourceId),
-                    eq(siteResources.orgId, orgId)
-                )
-            );
-
-            if (resourceCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `SiteResource with Id ${siteResourceId} doesn't exist.`
-                    )
-                );
-            }
-
-            // idempotent, calling this endpoint multiple times should attach the label only once
-            await db
-                .insert(siteResourceLabels)
-                .values({
-                    labelId,
-                    siteResourceId
-                })
-                .onConflictDoNothing();
-        }
-
-        if (clientId) {
-            const clientCount = await db.$count(
-                clients,
-                and(
-                    eq(clients.clientId, clientId),
-                    eq(clients.orgId, orgId),
-                    isNull(clients.userId)
-                )
-            );
-
-            if (clientCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Client with Id ${clientId} doesn't exist.`
-                    )
-                );
-            }
-
-            // idempotent, calling this endpoint multiple times should attach the label only once
-            await db
-                .insert(clientLabels)
-                .values({
-                    labelId,
-                    clientId
-                })
-                .onConflictDoNothing();
-        }
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Label attached successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/labels/createOrgLabel.ts

@@ -1,149 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-import {
-    db,
-    labels,
-    resourceLabels,
-    resources,
-    siteLabels,
-    sites
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty()
-});
-
-const bodySchema = z.strictObject({
-    name: z.string().nonempty(),
-    color: z
-        .string()
-        .regex(/^#?([0-9a-f]{6}|[0-9a-f]{3})$/i)
-        .nonempty(),
-    siteId: z.number().int().optional(),
-    resourceId: z.number().int().optional()
-});
-
-export async function createOrgLabel(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { name, color, siteId, resourceId } = parsedBody.data;
-
-        if (siteId) {
-            const siteCount = await db.$count(
-                sites,
-                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-            );
-
-            if (siteCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        `Site with Id ${siteId} doesn't exist.`
-                    )
-                );
-            }
-        }
-
-        if (resourceId) {
-            const resourceCount = await db.$count(
-                resources,
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(resources.orgId, orgId)
-                )
-            );
-
-            if (resourceCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        `Resource with Id ${resourceId} doesn't exist.`
-                    )
-                );
-            }
-        }
-
-        const label = await db.transaction(async (tx) => {
-            const [label] = await tx
-                .insert(labels)
-                .values({
-                    name,
-                    color,
-                    orgId
-                })
-                .returning();
-
-            if (siteId) {
-                await tx.insert(siteLabels).values({
-                    siteId,
-                    labelId: label.labelId
-                });
-            }
-
-            if (resourceId) {
-                await tx.insert(resourceLabels).values({
-                    resourceId,
-                    labelId: label.labelId
-                });
-            }
-            return label;
-        });
-
-        return response<CreateOrEditLabelResponse>(res, {
-            data: { label },
-            success: true,
-            error: false,
-            message: "Org Label created successfully",
-            status: HttpCode.CREATED
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/labels/deleteOrgLabel.ts

@@ -1,72 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-import { db, labels } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    labelId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-export async function deleteOrgLabel(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, labelId } = parsedParams.data;
-
-        const [existing] = await db
-            .select()
-            .from(labels)
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
-
-        if (!existing) {
-            return next(createHttpError(HttpCode.NOT_FOUND, "Label not found"));
-        }
-
-        await db
-            .delete(labels)
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Label deleted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/labels/detachLabelFromItem.ts

@@ -1,224 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import {
-    clients,
-    clientLabels,
-    db,
-    labels,
-    resourceLabels,
-    resources,
-    siteLabels,
-    siteResourceLabels,
-    siteResources,
-    sites
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, isNull } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    labelId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const detachLabelBodySchema = z.strictObject({
-    siteId: z.number().int().optional(),
-    resourceId: z.number().int().optional(),
-    siteResourceId: z.number().int().optional(),
-    clientId: z.number().int().optional()
-});
-
-export async function detachLabelFromItem(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, labelId } = parsedParams.data;
-
-        const parsedBody = detachLabelBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { siteId, resourceId, siteResourceId, clientId } =
-            parsedBody.data;
-
-        if (!siteId && !resourceId && !siteResourceId && !clientId) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "At least one of `siteId`, `resourceId`, `siteResourceId` or `clientId` should be provided."
-                )
-            );
-        }
-
-        const [existing] = await db
-            .select()
-            .from(labels)
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Label with Id ${labelId} not found`
-                )
-            );
-        }
-
-        if (siteId) {
-            const siteCount = await db.$count(
-                sites,
-                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-            );
-
-            if (siteCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Site with Id ${siteId} doesn't exist.`
-                    )
-                );
-            }
-
-            await db
-                .delete(siteLabels)
-                .where(
-                    and(
-                        eq(siteLabels.labelId, labelId),
-                        eq(siteLabels.siteId, siteId)
-                    )
-                );
-        }
-
-        if (resourceId) {
-            const resourceCount = await db.$count(
-                resources,
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(resources.orgId, orgId)
-                )
-            );
-
-            if (resourceCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Resource with Id ${resourceId} doesn't exist.`
-                    )
-                );
-            }
-
-            await db
-                .delete(resourceLabels)
-                .where(
-                    and(
-                        eq(resourceLabels.labelId, labelId),
-                        eq(resourceLabels.resourceId, resourceId)
-                    )
-                );
-        }
-
-        if (siteResourceId) {
-            const resourceCount = await db.$count(
-                siteResources,
-                and(
-                    eq(siteResources.siteResourceId, siteResourceId),
-                    eq(siteResources.orgId, orgId)
-                )
-            );
-
-            if (resourceCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `SiteResource with Id ${siteResourceId} doesn't exist.`
-                    )
-                );
-            }
-
-            await db
-                .delete(siteResourceLabels)
-                .where(
-                    and(
-                        eq(siteResourceLabels.labelId, labelId),
-                        eq(siteResourceLabels.siteResourceId, siteResourceId)
-                    )
-                );
-        }
-
-        if (clientId) {
-            const clientCount = await db.$count(
-                clients,
-                and(
-                    eq(clients.clientId, clientId),
-                    eq(clients.orgId, orgId),
-                    isNull(clients.userId)
-                )
-            );
-
-            if (clientCount === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Client with Id ${clientId} doesn't exist.`
-                    )
-                );
-            }
-
-            await db
-                .delete(clientLabels)
-                .where(
-                    and(
-                        eq(clientLabels.labelId, labelId),
-                        eq(clientLabels.clientId, clientId)
-                    )
-                );
-        }
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Label detached successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/labels/index.ts

@@ -1,19 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./listOrgLabels";
-export * from "./createOrgLabel";
-export * from "./updateOrgLabel";
-export * from "./attachLabelToItem";
-export * from "./detachLabelFromItem";
-export * from "./deleteOrgLabel";

server/private/routers/labels/listOrgLabels.ts

@@ -1,155 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db, labels } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, asc, eq, like, sql } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty()
-});
-
-const listLabelsSchema = z.object({
-    pageSize: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .positive()
-        .optional()
-        .catch(20)
-        .default(20)
-        .openapi({
-            type: "integer",
-            default: 20,
-            description: "Number of items per page"
-        }),
-    page: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .min(0)
-        .optional()
-        .catch(1)
-        .default(1)
-        .openapi({
-            type: "integer",
-            default: 1,
-            description: "Page number to retrieve"
-        }),
-    query: z.string().optional()
-});
-
-function queryLabelsBase() {
-    return db
-        .select({
-            labelId: labels.labelId,
-            name: labels.name,
-            color: labels.color
-        })
-        .from(labels);
-}
-
-export async function listOrgLabels(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = listLabelsSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error)
-                )
-            );
-        }
-
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error)
-                )
-            );
-        }
-        const { orgId } = parsedParams.data;
-
-        if (req.user && orgId && orgId !== req.userOrgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        const { pageSize, page, query } = parsedQuery.data;
-
-        const conditions = [and(eq(labels.orgId, orgId))];
-
-        if (query) {
-            conditions.push(
-                like(
-                    sql`LOWER(${labels.name})`,
-                    "%" + query.toLowerCase() + "%"
-                )
-            );
-        }
-
-        const baseQuery = queryLabelsBase().where(and(...conditions));
-
-        // we need to add `as` so that drizzle filters the result as a subquery
-        const countQuery = db.$count(
-            queryLabelsBase()
-                .where(and(...conditions))
-                .as("filtered_labels")
-        );
-
-        const labelListQuery = baseQuery
-            .limit(pageSize)
-            .offset(pageSize * (page - 1))
-            .orderBy(asc(labels.name));
-
-        const [totalCount, rows] = await Promise.all([
-            countQuery,
-            labelListQuery
-        ]);
-
-        return response<ListOrgLabelsResponse>(res, {
-            data: {
-                labels: rows,
-                pagination: {
-                    total: totalCount,
-                    pageSize,
-                    page
-                }
-            },
-            success: true,
-            error: false,
-            message: "Labels retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/labels/updateOrgLabel.ts

@@ -1,101 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db, labels } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    labelId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const updateLabelBodySchema = z.strictObject({
-    name: z.string().min(1).max(255).optional(),
-    color: z
-        .string()
-        .regex(/^#?([0-9a-f]{6}|[0-9a-f]{3})$/i)
-        .nonempty()
-});
-
-export async function updateOrgLabel(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, labelId } = parsedParams.data;
-
-        const parsedBody = updateLabelBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const [existing] = await db
-            .select()
-            .from(labels)
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
-
-        if (!existing) {
-            return next(createHttpError(HttpCode.NOT_FOUND, "Label not found"));
-        }
-
-        const { name, color } = parsedBody.data;
-
-        const [label] = await db
-            .update(labels)
-            .set({
-                name,
-                color
-            })
-            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)))
-            .returning();
-
-        return response<CreateOrEditLabelResponse>(res, {
-            data: {
-                label
-            },
-            success: true,
-            error: false,
-            message: "Label updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/loginPage/upsertLoginPageBranding.ts

@@ -26,6 +26,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq, InferInsertModel } from "drizzle-orm";
 import { build } from "@server/build";
+import { validateLocalPath } from "@app/lib/validateLocalPath";
 import config from "#private/lib/config";
 
 const paramsSchema = z.strictObject({
@@ -34,9 +35,78 @@ const paramsSchema = z.strictObject({
 
 const bodySchema = z.strictObject({
     logoUrl: z
-        .string()
-        .optional()
-        .transform((val) => (val === "" ? null : val)),
+        .union([
+            z.literal(""),
+            z
+                .string()
+                .superRefine(async (urlOrPath, ctx) => {
+                    const parseResult = z.url().safeParse(urlOrPath);
+                    if (!parseResult.success) {
+                        if (build !== "enterprise") {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: "Must be a valid URL"
+                            });
+                            return;
+                        } else {
+                            try {
+                                validateLocalPath(urlOrPath);
+                            } catch (error) {
+                                ctx.addIssue({
+                                    code: "custom",
+                                    message: "Must be either a valid image URL or a valid pathname starting with `/` and not containing query parameters, `..` or `*`"
+                                });
+                            } finally {
+                                return;
+                            }
+                        }
+                    }
+
+                    try {
+                        const response = await fetch(urlOrPath, {
+                            method: "HEAD"
+                        }).catch(() => {
+                            // If HEAD fails (CORS or method not allowed), try GET
+                            return fetch(urlOrPath, { method: "GET" });
+                        });
+
+                        if (response.status !== 200) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `Failed to load image. Please check that the URL is accessible.`
+                            });
+                            return;
+                        }
+
+                        const contentType =
+                            response.headers.get("content-type") ?? "";
+                        if (!contentType.startsWith("image/")) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `URL does not point to an image. Please provide a URL to an image file (e.g., .png, .jpg, .svg).`
+                            });
+                            return;
+                        }
+                    } catch (error) {
+                        let errorMessage =
+                            "Unable to verify image URL. Please check that the URL is accessible and points to an image file.";
+
+                        if (error instanceof TypeError && error.message.includes("fetch")) {
+                            errorMessage =
+                                "Network error: Unable to reach the URL. Please check your internet connection and verify the URL is correct.";
+                        } else if (error instanceof Error) {
+                            errorMessage = `Error verifying URL: ${error.message}`;
+                        }
+
+                        ctx.addIssue({
+                            code: "custom",
+                            message: errorMessage
+                        });
+                    }
+                })
+        ])
+        .transform((val) => (val === "" ? null : val))
+        .nullish(),
     logoWidth: z.coerce.number<number>().min(1),
     logoHeight: z.coerce.number<number>().min(1),
     resourceTitle: z.string(),

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -63,7 +63,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createOrgOidcIdp(

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteOrgIdp(

server/private/routers/orgIdp/getOrgIdp.ts

@@ -56,7 +56,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getOrgIdp(

server/private/routers/orgIdp/listOrgIdps.ts

@@ -72,7 +72,22 @@ registry.registerPath({
         query: querySchema,
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listOrgIdps(

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -13,6 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, idpOrg } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -54,6 +55,10 @@ const bodySchema = z.strictObject({
 export type UpdateOrgIdpResponse = {
     idpId: number;
 };
+const UpdateOrgIdpResponseDataSchema = z.object({
+    idpId: z.number()
+});
+
 
 registry.registerPath({
     method: "post",
@@ -70,7 +75,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateOrgIdpResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateOrgOidcIdp(

server/private/routers/re-key/reGenerateClientSecret.ts

@@ -28,7 +28,7 @@ import { OlmErrorCodes, sendOlmError } from "@server/routers/olm/error";
 import { sendTerminateClient } from "@server/routers/client/terminate";
 
 const reGenerateSecretParamsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 const reGenerateSecretBodySchema = z.strictObject({

server/private/routers/re-key/reGenerateSiteSecret.ts

@@ -27,7 +27,7 @@ import { getAllowedIps } from "@server/routers/target/helpers";
 import { disconnectClient, sendToClient } from "#private/routers/ws";
 
 const updateSiteParamsSchema = z.strictObject({
-    siteId: z.string().transform(Number).pipe(z.int().positive())
+    siteId: z.coerce.number().int().positive()
 });
 
 const updateSiteBodySchema = z.strictObject({

server/private/routers/ssh/signSshKey.ts

@@ -19,7 +19,6 @@ import {
     logsDb,
     newts,
     roles,
-    roleSiteResources,
     roundTripMessageTracker,
     siteResources,
     siteNetworks,
@@ -93,7 +92,22 @@ export type SignSshKeyResponse = {
 //             }
 //         }
 //     },
-//     responses: {}
+// responses: {
+// 200: {
+// description: "Successful response",
+// content: {
+// "application/json": {
+// schema: z.object({
+// data: z.unknown().nullable(),
+// success: z.boolean(),
+// error: z.boolean(),
+// message: z.string(),
+// status: z.number()
+// })
+// }
+// }
+// }
+// }
 // });
 
 export async function signSshKey(
@@ -362,26 +376,9 @@ export async function signSshKey(
         }
 
         const roleRows = await db
-            .select({
-                sshSudoCommands: roles.sshSudoCommands,
-                sshUnixGroups: roles.sshUnixGroups,
-                sshCreateHomeDir: roles.sshCreateHomeDir,
-                sshSudoMode: roles.sshSudoMode
-            })
+            .select()
             .from(roles)
-            .innerJoin(
-                roleSiteResources,
-                eq(roleSiteResources.roleId, roles.roleId)
-            )
-            .where(
-                and(
-                    inArray(roles.roleId, roleIds),
-                    eq(
-                        roleSiteResources.siteResourceId,
-                        resource.siteResourceId
-                    )
-                )
-            );
+            .where(inArray(roles.roleId, roleIds));
 
         const parsedSudoCommands: string[] = [];
         const parsedGroupsSet = new Set<string>();
@@ -397,17 +394,13 @@ export async function signSshKey(
             }
             try {
                 const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                if (Array.isArray(grps))
-                    grps.forEach((g: string) => parsedGroupsSet.add(g));
+                if (Array.isArray(grps)) grps.forEach((g: string) => parsedGroupsSet.add(g));
             } catch {
                 // skip
             }
             if (roleRow?.sshCreateHomeDir === true) homedir = true;
             const m = roleRow?.sshSudoMode ?? "none";
-            if (
-                sudoModeOrder[m as keyof typeof sudoModeOrder] >
-                sudoModeOrder[sudoMode]
-            ) {
+            if (sudoModeOrder[m as keyof typeof sudoModeOrder] > sudoModeOrder[sudoMode]) {
                 sudoMode = m as "none" | "commands" | "full";
             }
         }

server/private/routers/user/addUserRole.ts

@@ -27,7 +27,7 @@ import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAs
 
 const addUserRoleParamsSchema = z.strictObject({
     userId: z.string(),
-    roleId: z.string().transform(stoi).pipe(z.number())
+    roleId: z.coerce.number()
 });
 
 registry.registerPath({
@@ -38,7 +38,22 @@ registry.registerPath({
     request: {
         params: addUserRoleParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function addUserRole(

server/private/routers/user/removeUserRole.ts

@@ -27,7 +27,7 @@ import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAs
 
 const removeUserRoleParamsSchema = z.strictObject({
     userId: z.string(),
-    roleId: z.string().transform(stoi).pipe(z.number())
+    roleId: z.coerce.number()
 });
 
 registry.registerPath({
@@ -39,7 +39,22 @@ registry.registerPath({
     request: {
         params: removeUserRoleParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function removeUserRole(

server/routers/accessToken/deleteAccessToken.ts

@@ -22,7 +22,22 @@ registry.registerPath({
     request: {
         params: deleteAccessTokenParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteAccessToken(

server/routers/accessToken/generateAccessToken.ts

@@ -31,7 +31,7 @@ export const generateAccessTokenBodySchema = z.strictObject({
 });
 
 export const generateAccssTokenParamsSchema = z.strictObject({
-    resourceId: z.string().transform(Number).pipe(z.int().positive())
+    resourceId: z.coerce.number().int().positive()
 });
 
 export type GenerateAccessTokenResponse = Omit<
@@ -54,7 +54,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function generateAccessToken(

server/routers/accessToken/listAccessTokens.ts

@@ -129,7 +129,22 @@ registry.registerPath({
         }),
         query: listAccessTokensSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 registry.registerPath({
@@ -143,7 +158,22 @@ registry.registerPath({
         }),
         query: listAccessTokensSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listAccessTokens(

server/routers/apiKeys/createOrgApiKey.ts

@@ -2,6 +2,7 @@ import { NextFunction, Request, Response } from "express";
 import { db } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { apiKeyOrg, apiKeys } from "@server/db";
 import { fromError } from "zod-validation-error";
 import createHttpError from "http-errors";
@@ -32,6 +33,14 @@ export type CreateOrgApiKeyResponse = {
     lastChars: string;
     createdAt: string;
 };
+const CreateOrgApiKeyResponseDataSchema = z.object({
+    apiKeyId: z.string(),
+    name: z.string(),
+    apiKey: z.string(),
+    lastChars: z.string(),
+    createdAt: z.string()
+});
+
 
 registry.registerPath({
     method: "put",
@@ -48,7 +57,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateOrgApiKeyResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createOrgApiKey(

server/routers/apiKeys/deleteApiKey.ts

@@ -22,7 +22,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteApiKey(

server/routers/apiKeys/listApiKeyActions.ts

@@ -9,6 +9,7 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const paramsSchema = z.object({
     apiKeyId: z.string().nonempty()
@@ -44,6 +45,19 @@ export type ListApiKeyActionsResponse = {
     pagination: { total: number; limit: number; offset: number };
 };
 
+const ListApiKeyActionsResponseDataSchema = z.object({
+    actions: z.array(
+        z.object({
+            actionId: z.string()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}/api-key/{apiKeyId}/actions",
@@ -53,7 +67,18 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListApiKeyActionsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listApiKeyActions(

server/routers/apiKeys/listOrgApiKeys.ts

@@ -9,6 +9,7 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq, and } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const querySchema = z.object({
     limit: z
@@ -48,6 +49,23 @@ export type ListOrgApiKeysResponse = {
     pagination: { total: number; limit: number; offset: number };
 };
 
+const ListOrgApiKeysResponseDataSchema = z.object({
+    apiKeys: z.array(
+        z.object({
+            apiKeyId: z.string(),
+            orgId: z.string(),
+            lastChars: z.string(),
+            createdAt: z.string(),
+            name: z.string()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}/api-keys",
@@ -57,7 +75,18 @@ registry.registerPath({
         params: paramsSchema,
         query: querySchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListOrgApiKeysResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
 });
 
 export async function listOrgApiKeys(

server/routers/apiKeys/setApiKeyActions.ts

@@ -36,7 +36,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function setApiKeyActions(

server/routers/auditLogs/exportRequestAuditLog.ts

@@ -5,6 +5,7 @@ import { OpenAPITags } from "@server/openApi";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { fromError } from "zod-validation-error";
+import { z } from "zod";
 import logger from "@server/logger";
 import {
     queryAccessAuditLogsQuery,
@@ -28,7 +29,22 @@ registry.registerPath({
         }),
         params: queryRequestAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function exportRequestAuditLogs(

server/routers/auditLogs/queryRequestAnalytics.ts

@@ -156,7 +156,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryRequestAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export type QueryRequestAnalyticsResponse = Awaited<ReturnType<typeof query>>;

server/routers/auditLogs/queryRequestAuditLog.ts

@@ -227,7 +227,22 @@ registry.registerPath({
         query: queryAccessAuditLogsQuery,
         params: queryRequestAuditLogsParams
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 async function queryUniqueFilterAttributes(

server/routers/auth/checkResourceSession.ts

@@ -9,7 +9,7 @@ import logger from "@server/logger";
 
 export const params = z.strictObject({
     token: z.string(),
-    resourceId: z.string().transform(Number).pipe(z.int().positive())
+    resourceId: z.coerce.number().int().positive()
 });
 
 export type CheckResourceSessionParams = z.infer<typeof params>;

server/routers/auth/lookupUser.ts

@@ -51,7 +51,22 @@ export type LookupUserResponse = {
 //     request: {
 //         body: lookupBodySchema
 //     },
-//     responses: {}
+// responses: {
+// 200: {
+// description: "Successful response",
+// content: {
+// "application/json": {
+// schema: z.object({
+// data: z.unknown().nullable(),
+// success: z.boolean(),
+// error: z.boolean(),
+// message: z.string(),
+// status: z.number()
+// })
+// }
+// }
+// }
+// }
 // });
 
 export async function lookupUser(

server/routers/blueprints/applyJSONBlueprint.ts

@@ -31,7 +31,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function applyJSONBlueprint(

server/routers/blueprints/applyYAMLBlueprint.ts

@@ -54,7 +54,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function applyYAMLBlueprint(

server/routers/blueprints/getBlueprint.ts

@@ -7,13 +7,12 @@ import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
-import stoi from "@server/lib/stoi";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { BlueprintData } from "./types";
 
 const getBlueprintSchema = z.strictObject({
-    blueprintId: z.string().transform(stoi).pipe(z.int().positive()),
+    blueprintId: z.coerce.number().int().positive(),
     orgId: z.string()
 });
 
@@ -57,7 +56,22 @@ registry.registerPath({
     request: {
         params: getBlueprintSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getBlueprint(

server/routers/blueprints/listBlueprints.ts

@@ -74,7 +74,22 @@ registry.registerPath({
         }),
         query: listBluePrintsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listBlueprints(

server/routers/client/archiveClient.ts

@@ -11,7 +11,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const archiveClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 registry.registerPath({
@@ -22,7 +22,22 @@ registry.registerPath({
     request: {
         params: archiveClientSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function archiveClient(

server/routers/client/blockClient.ts

@@ -13,7 +13,7 @@ import { sendTerminateClient } from "./terminate";
 import { OlmErrorCodes } from "../olm/error";
 
 const blockClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 registry.registerPath({
@@ -24,7 +24,22 @@ registry.registerPath({
     request: {
         params: blockClientSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function blockClient(

server/routers/client/createClient.ts

@@ -59,7 +59,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createClient(

server/routers/client/createUserClient.ts

@@ -60,7 +60,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function createUserClient(

server/routers/client/deleteClient.ts

@@ -14,7 +14,7 @@ import { sendTerminateClient } from "./terminate";
 import { OlmErrorCodes } from "../olm/error";
 
 const deleteClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 registry.registerPath({
@@ -25,7 +25,22 @@ registry.registerPath({
     request: {
         params: deleteClientSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteClient(

server/routers/client/getClient.ts

@@ -253,7 +253,22 @@ registry.registerPath({
             niceId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 registry.registerPath({
@@ -266,7 +281,22 @@ registry.registerPath({
             clientId: z.number()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getClient(

server/routers/client/index.ts

@@ -10,5 +10,3 @@ export * from "./listUserDevices";
 export * from "./updateClient";
 export * from "./getClient";
 export * from "./createUserClient";
-export * from "./verifyClientAssociationsCache";
-export * from "./rebuildClientAssociationsCacheRoute";

server/routers/client/listClients.ts

@@ -1,20 +1,15 @@
 import {
-    clientLabels,
     clients,
     clientSitesAssociationsCache,
     currentFingerprint,
     db,
-    labels,
     olms,
     orgs,
     roleClients,
     sites,
     userClients,
-    users,
-    type Label
+    users
 } from "@server/db";
-import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -174,7 +169,6 @@ type ClientWithSites = Awaited<ReturnType<typeof queryClientsBase>>[0] & {
         siteNiceId: string | null;
     }>;
     olmUpdateAvailable?: boolean;
-    labels?: Array<Pick<Label, "labelId" | "name" | "color">>;
 };
 
 type OlmWithUpdateAvailable = ClientWithSites;
@@ -192,7 +186,22 @@ registry.registerPath({
         query: listClientsSchema,
         params: listClientsParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listClients(
@@ -261,11 +270,6 @@ export async function listClients(
             (client) => client.clientId
         );
 
-        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
-            orgId,
-            tierMatrix.labels
-        );
-
         // Get client count with filter
         const conditions = [
             and(
@@ -299,29 +303,18 @@ export async function listClients(
         }
 
         if (query) {
-            const q = "%" + query.toLowerCase() + "%";
-            const queryList = [
-                like(sql`LOWER(${clients.name})`, q),
-                like(sql`LOWER(${clients.niceId})`, q)
-            ];
-
-            if (isLabelFeatureEnabled) {
-                queryList.push(
-                    inArray(
-                        clients.clientId,
-                        db
-                            .select({ id: clientLabels.clientId })
-                            .from(clientLabels)
-                            .innerJoin(
-                                labels,
-                                eq(labels.labelId, clientLabels.labelId)
-                            )
-                            .where(like(sql`LOWER(${labels.name})`, q))
+            conditions.push(
+                or(
+                    like(
+                        sql`LOWER(${clients.name})`,
+                        "%" + query.toLowerCase() + "%"
+                    ),
+                    like(
+                        sql`LOWER(${clients.niceId})`,
+                        "%" + query.toLowerCase() + "%"
                     )
-                );
-            }
-
-            conditions.push(or(...queryList));
+                )
+            );
         }
 
         const baseQuery = queryClientsBase().where(and(...conditions));
@@ -348,30 +341,6 @@ export async function listClients(
         const clientIds = clientsList.map((client) => client.clientId);
         const siteAssociations = await getSiteAssociations(clientIds);
 
-        let labelsForClients: Array<{
-            labelId: number;
-            name: string;
-            color: string;
-            clientId: number;
-        }> = [];
-
-        if (isLabelFeatureEnabled && clientIds.length > 0) {
-            labelsForClients = await db
-                .select({
-                    labelId: labels.labelId,
-                    name: labels.name,
-                    color: labels.color,
-                    clientId: clientLabels.clientId
-                })
-                .from(labels)
-                .innerJoin(
-                    clientLabels,
-                    eq(clientLabels.labelId, labels.labelId)
-                )
-                .where(inArray(clientLabels.clientId, clientIds))
-                .orderBy(asc(clientLabels.clientLabelId));
-        }
-
         // Group site associations by client ID
         const sitesByClient = siteAssociations.reduce(
             (acc, association) => {
@@ -399,10 +368,7 @@ export async function listClients(
         const clientsWithSites = clientsList.map((client) => {
             return {
                 ...client,
-                sites: sitesByClient[client.clientId] || [],
-                labels: labelsForClients.filter(
-                    (l) => l.clientId === client.clientId
-                )
+                sites: sitesByClient[client.clientId] || []
             };
         });
 

server/routers/client/listUserDevices.ts

@@ -213,7 +213,22 @@ registry.registerPath({
         query: listUserDevicesSchema,
         params: listUserDevicesParamsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function listUserDevices(

server/routers/client/pickClientDefaults.ts

@@ -6,6 +6,7 @@ import logger from "@server/logger";
 import { generateId } from "@server/auth/sessions/app";
 import { getNextAvailableClientSubnet } from "@server/lib/ip";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
@@ -14,6 +15,12 @@ export type PickClientDefaultsResponse = {
     olmSecret: string;
     subnet: string;
 };
+const PickClientDefaultsResponseDataSchema = z.object({
+    olmId: z.string(),
+    olmSecret: z.string(),
+    subnet: z.string()
+});
+
 
 const pickClientDefaultsSchema = z.strictObject({
     orgId: z.string()
@@ -27,7 +34,16 @@ registry.registerPath({
     request: {
         params: pickClientDefaultsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(PickClientDefaultsResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function pickClientDefaults(

server/routers/client/rebuildClientAssociationsCacheRoute.ts

@@ -1,81 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-
-const paramsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/rebuild-associations-cache",
-    description:
-        "Rebuild the client's site/site-resource association cache based on current permissions.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function rebuildClientAssociationsCacheRoute(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        await rebuildClientAssociationsFromClient(client);
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client association cache rebuilt successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to rebuild client association cache"
-            )
-        );
-    }
-}

server/routers/client/unarchiveClient.ts

@@ -11,7 +11,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const unarchiveClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 registry.registerPath({
@@ -22,7 +22,22 @@ registry.registerPath({
     request: {
         params: unarchiveClientSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function unarchiveClient(

server/routers/client/unblockClient.ts

@@ -11,7 +11,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const unblockClientSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 registry.registerPath({
@@ -22,7 +22,22 @@ registry.registerPath({
     request: {
         params: unblockClientSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function unblockClient(

server/routers/client/updateClient.ts

@@ -11,7 +11,7 @@ import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 
 const updateClientParamsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
+    clientId: z.coerce.number().int().positive()
 });
 
 const updateClientSchema = z.strictObject({
@@ -36,7 +36,22 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function updateClient(

server/routers/client/verifyClientAssociationsCache.ts

@@ -1,83 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { verifyClientAssociationsCache as verifyClientAssociationsCacheLib } from "@server/lib/rebuildClientAssociations";
-
-const paramsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/client/{clientId}/verify-associations-cache",
-    description:
-        "Read-only check of whether the client's site/site-resource association cache matches what the current permissions imply.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function verifyClientAssociationsCache(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        const report = await verifyClientAssociationsCacheLib(client);
-
-        return response(res, {
-            data: report,
-            success: true,
-            error: false,
-            message: report.consistent
-                ? "Client association cache is consistent"
-                : "Client association cache is INCONSISTENT",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to verify client association cache"
-            )
-        );
-    }
-}

server/routers/domain/getDNSRecords.ts

@@ -37,7 +37,22 @@ registry.registerPath({
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getDNSRecords(

server/routers/domain/getDomain.ts

@@ -39,7 +39,22 @@ registry.registerPath({
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function getDomain(

server/routers/domain/listDomains.ts

@@ -9,6 +9,7 @@ import { eq, sql } from "drizzle-orm";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 
 const listDomainsParamsSchema = z.strictObject({
     orgId: z.string()
@@ -56,6 +57,28 @@ export type ListDomainsResponse = {
     pagination: { total: number; limit: number; offset: number };
 };
 
+const ListDomainsResponseDataSchema = z.object({
+    domains: z.array(
+        z.object({
+            domainId: z.string(),
+            baseDomain: z.string(),
+            verified: z.boolean(),
+            type: z.string().nullable(),
+            failed: z.boolean(),
+            tries: z.number(),
+            configManaged: z.boolean(),
+            certResolver: z.string().nullable(),
+            preferWildcardCert: z.boolean().nullable(),
+            errorMessage: z.string().nullable()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}/domains",
@@ -67,7 +90,16 @@ registry.registerPath({
         }),
         query: listDomainsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(ListDomainsResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function listDomains(

server/routers/domain/updateDomain.ts

@@ -1,5 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -24,6 +25,12 @@ export type UpdateDomainResponse = {
     certResolver: string | null;
     preferWildcardCert: boolean | null;
 };
+const UpdateDomainResponseDataSchema = z.object({
+    domainId: z.string(),
+    certResolver: z.string().nullable(),
+    preferWildcardCert: z.boolean().nullable()
+});
+
 
 registry.registerPath({
     method: "patch",
@@ -36,7 +43,16 @@ registry.registerPath({
             orgId: z.string()
         })
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(UpdateDomainResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function updateOrgDomain(

server/routers/idp/createIdpOrgPolicy.ts

@@ -1,5 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -22,6 +23,8 @@ const bodySchema = z.strictObject({
 });
 
 export type CreateIdpOrgPolicyResponse = {};
+const CreateIdpOrgPolicyResponseDataSchema = z.object({});
+
 
 registry.registerPath({
     method: "put",
@@ -38,7 +41,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateIdpOrgPolicyResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createIdpOrgPolicy(

server/routers/idp/createOidcIdp.ts

@@ -1,5 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
 import { db } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -33,6 +34,11 @@ export type CreateIdpResponse = {
     idpId: number;
     redirectUrl: string;
 };
+const CreateIdpResponseDataSchema = z.object({
+    idpId: z.number(),
+    redirectUrl: z.string()
+});
+
 
 registry.registerPath({
     method: "put",
@@ -48,7 +54,16 @@ registry.registerPath({
             }
         }
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(CreateIdpResponseDataSchema)
+                }
+            }
+        }
+    }
 });
 
 export async function createOidcIdp(

server/routers/idp/deleteIdp.ts

@@ -25,7 +25,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteIdp(

server/routers/idp/deleteIdpOrgPolicy.ts

@@ -23,7 +23,22 @@ registry.registerPath({
     request: {
         params: paramsSchema
     },
-    responses: {}
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.unknown().nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
 });
 
 export async function deleteIdpOrgPolicy(