Reconnect newts when a exit node comes back online

Merge pull request #3114 from Fredkiss3/fix/tag-input-scroll
fix: make tag input wrap around instead of scrolling
2026-05-27 10:39:53 +00:00 · 2026-05-20 15:38:40 -07:00 · 2026-05-19 20:03:59 -07:00 · 2026-05-19 20:03:22 -07:00 · 2026-05-19 22:52:44 +02:00 · 2026-05-19 22:48:15 +02:00
148 changed files with 6408 additions and 14711 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: [fosrl]
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -415,7 +415,9 @@ jobs:

            - name: Install cosign
              # cosign is used to sign container images using keyless (OIDC) signing
-              uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+              with:
+                cosign-release: v3.0.6

            - name: Sign (GHCR, keyless)
              # Sign each GHCR image by digest using keyless (OIDC) signing via Sigstore/Rekor.
--- a/.github/workflows/restart-runners.yml
+++ b/.github/workflows/restart-runners.yml
@@ -1,39 +0,0 @@
-name: Restart Runners
-
-on:
-  schedule:
-    - cron: '0 0 */7 * *'
-
-permissions:
-    id-token: write
-    contents: read
-
-jobs:
-  ec2-maintenance-prod:
-    runs-on: ubuntu-latest
-    permissions: write-all
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-          role-duration-seconds: 3600
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Verify AWS identity
-        run: aws sts get-caller-identity
-
-      - name: Start EC2 instance
-        run: |
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances started"
-
-      - name: Wait
-        run: sleep 600
-
-      - name: Stop EC2 instance
-        run: |
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-          aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_AMD_RUNNER }}
-          echo "EC2 instances stopped"
--- a/.github/workflows/saas.yml
+++ b/.github/workflows/saas.yml
@@ -1,160 +0,0 @@
-name: SAAS Pipeline
-
-# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
-# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.
-
-permissions:
-  contents: read
-  packages: write      # for GHCR push
-  id-token: write      # for Cosign Keyless (OIDC) Signing
-
-on:
-    push:
-        tags:
-            - "[0-9]+.[0-9]+.[0-9]+-s.[0-9]+"
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-    pre-run:
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Start EC2 instances
-              run: |
-                  aws ec2 start-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances started"
-
-
-    release-arm:
-        name: Build and Release (ARM64)
-        runs-on: [self-hosted, linux, arm64, us-east-1]
-        needs: [pre-run]
-        if: >-
-            ${{
-                needs.pre-run.result == 'success'
-            }}
-        # Job-level timeout to avoid runaway or stuck runs
-        timeout-minutes: 120
-        env:
-          # Target images
-          AWS_IMAGE: ${{ secrets.aws_account_id }}.dkr.ecr.us-east-1.amazonaws.com/${{ github.event.repository.name }}
-
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-            - name: Download MaxMind GeoLite2 databases
-              env:
-                MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }}
-              run: |
-                echo "Downloading MaxMind GeoLite2 databases..."
-
-                # Download GeoLite2-Country
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-Country.tar.gz
-
-                # Download GeoLite2-ASN
-                curl -L "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-ASN&license_key=${MAXMIND_LICENSE_KEY}&suffix=tar.gz" \
-                  -o GeoLite2-ASN.tar.gz
-
-                # Extract the .mmdb files
-                tar -xzf GeoLite2-Country.tar.gz --strip-components=1 --wildcards '*.mmdb'
-                tar -xzf GeoLite2-ASN.tar.gz --strip-components=1 --wildcards '*.mmdb'
-
-                # Verify files exist
-                if [ ! -f "GeoLite2-Country.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-Country.mmdb"
-                  exit 1
-                fi
-
-                if [ ! -f "GeoLite2-ASN.mmdb" ]; then
-                  echo "ERROR: Failed to download GeoLite2-ASN.mmdb"
-                  exit 1
-                fi
-
-                # Clean up tar files
-                rm -f GeoLite2-Country.tar.gz GeoLite2-ASN.tar.gz
-
-                echo "MaxMind databases downloaded successfully"
-                ls -lh GeoLite2-*.mmdb
-
-            - name: Monitor storage space
-              run: |
-                  THRESHOLD=75
-                  USED_SPACE=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
-                  echo "Used space: $USED_SPACE%"
-                  if [ "$USED_SPACE" -ge "$THRESHOLD" ]; then
-                      echo "Used space is below the threshold of 75% free. Running Docker system prune."
-                      echo y | docker system prune -a
-                  else
-                      echo "Storage space is above the threshold. No action needed."
-                  fi
-
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.aws_account_id }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Login to Amazon ECR
-              id: login-ecr
-              uses: aws-actions/amazon-ecr-login@v2
-
-            - name: Extract tag name
-              id: get-tag
-              run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-              shell: bash
-
-            - name: Update version in package.json
-              run: |
-                  TAG=${{ env.TAG }}
-                  sed -i "s/export const APP_VERSION = \".*\";/export const APP_VERSION = \"$TAG\";/" server/lib/consts.ts
-                  cat server/lib/consts.ts
-              shell: bash
-
-            - name: Build and push Docker images (Docker Hub - ARM64)
-              run: |
-                  TAG=${{ env.TAG }}
-                  make build-saas tag=$TAG
-                  echo "Built & pushed ARM64 images to: ${{ env.AWS_IMAGE }}:${TAG}"
-              shell: bash
-
-    post-run:
-        needs: [pre-run, release-arm]
-        if: >-
-            ${{
-                always() &&
-                needs.pre-run.result == 'success' &&
-                (needs.release-arm.result == 'success' || needs.release-arm.result == 'skipped' || needs.release-arm.result == 'failure')
-            }}
-        runs-on: ubuntu-latest
-        permissions: write-all
-        steps:
-            - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v6
-              with:
-                  role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
-                  role-duration-seconds: 3600
-                  aws-region: ${{ secrets.AWS_REGION }}
-
-            - name: Verify AWS identity
-              run: aws sts get-caller-identity
-
-            - name: Stop EC2 instances
-              run: |
-                  aws ec2 stop-instances --instance-ids ${{ secrets.EC2_INSTANCE_ID_ARM_RUNNER }}
-                  echo "EC2 instances stopped"
--- a/.gitignore
+++ b/.gitignore
@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite*
+*.sqlite
 !Dockerfile.sqlite
-*.sqlite3*
+*.sqlite3
 *.log
 .machinelogs*.json
 *-audit.json
@@ -54,4 +54,3 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
-solo.yml
--- a/install/main.go
+++ b/install/main.go
@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"embed"
 	"encoding/base64"
+	"flag"
 	"fmt"
 	"io"
 	"io/fs"
@@ -68,6 +69,9 @@ const (

 func main() {

+	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
+	flag.Parse()
+
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking

 	fmt.Println("Welcome to the Pangolin installer!")
@@ -206,7 +210,7 @@ func main() {
 		}
 	}

-	if !checkIsCrowdsecInstalledInCompose() {
+	if *crowdsecFlag && !checkIsCrowdsecInstalledInCompose() {
 		fmt.Println("\n=== CrowdSec Install ===")
 		// check if crowdsec is installed
 		if readBool("Would you like to install CrowdSec?", false) {
--- a/messages/bg-BG.json
+++ b/messages/bg-BG.json
@@ -630,7 +630,7 @@
    "createdAt": "Създаден на",
    "proxyErrorInvalidHeader": "Невалидна стойност за заглавие на хоста. Използвайте формат на име на домейн, или оставете празно поле за да премахнете персонализирано заглавие на хост.",
    "proxyErrorTls": "Невалидно име на TLS сървър. Използвайте формат на име на домейн, или оставете празно за да премахнете името на TLS сървъра.",
-    "proxyEnableSSL": "Активиране на SSL",
+    "proxyEnableSSL": "Активиране на TLS",
    "proxyEnableSSLDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целите.",
    "target": "Цел",
    "configureTarget": "Конфигуриране на цели",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Метод",
-    "editInternalResourceDialogEnableSsl": "Активирайте SSL",
+    "editInternalResourceDialogEnableSsl": "Активирайте TLS",
    "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "editInternalResourceDialogDestination": "Дестинация",
    "editInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Метод",
    "createInternalResourceDialogScheme": "Метод",
-    "createInternalResourceDialogEnableSsl": "Активирайте SSL",
+    "createInternalResourceDialogEnableSsl": "Активирайте TLS",
    "createInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
    "createInternalResourceDialogDestination": "Дестинация",
    "createInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2233,7 +2233,7 @@
        "description": "По-надежден и по-нисък поддръжка на Самостоятелно-хостван Панголиин сървър с допълнителни екстри",
        "introTitle": "Управлявано Самостоятелно-хостван Панголиин",
        "introDescription": "е опция за внедряване, предназначена за хора, които искат простота и допълнителна надеждност, като същевременно запазят данните си частни и самостоятелно-хоствани.",
-        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, SSL терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
+        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, TLS терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
        "benefitSimplerOperations": {
            "title": "По-прости операции",
            "description": "Няма нужда да управлявате свой собствен имейл сървър или да настройвате сложни аларми. Ще получите проверки и предупреждения при прекъсване от самото начало."
@@ -3136,7 +3136,7 @@
    "httpDestNamePlaceholder": "Моята HTTP дестинация",
    "httpDestUrlLabel": "Дестинация URL",
    "httpDestUrlErrorHttpRequired": "URL адресът трябва да използва http или https",
-    "httpDestUrlErrorHttpsRequired": "SSL е необходимо за облачни инсталации",
+    "httpDestUrlErrorHttpsRequired": "HTTPS е необходимо за облачни инсталации",
    "httpDestUrlErrorInvalid": "Въведете валиден URL (напр. https://example.com/webhook)",
    "httpDestAuthTitle": "Удостоверяване",
    "httpDestAuthDescription": "Изберете как заявленията ви се удостоверяват.",
--- a/messages/cs-CZ.json
+++ b/messages/cs-CZ.json
@@ -630,7 +630,7 @@
    "createdAt": "Vytvořeno v",
    "proxyErrorInvalidHeader": "Neplatná hodnota hlavičky hostitele. Použijte formát názvu domény, nebo uložte prázdné pro zrušení vlastního hlavičky hostitele.",
    "proxyErrorTls": "Neplatné jméno TLS serveru. Použijte formát doménového jména nebo uložte prázdné pro odstranění názvu TLS serveru.",
-    "proxyEnableSSL": "Povolit SSL",
+    "proxyEnableSSL": "Povolit TLS",
    "proxyEnableSSLDescription": "Povolit šifrování SSL/TLS pro zabezpečená připojení HTTPS k cílům.",
    "target": "Target",
    "configureTarget": "Konfigurace cílů",
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -22,11 +22,11 @@
    "componentsMember": "Du bist Mitglied von {count, plural, =0 {keiner Organisation} one {einer Organisation} other {# Organisationen}}.",
    "componentsInvalidKey": "Ungültige oder abgelaufene Lizenzschlüssel erkannt. Beachte die Lizenzbedingungen, um alle Funktionen weiterhin zu nutzen.",
    "dismiss": "Verwerfen",
-    "subscriptionViolationMessage": "Sie überschreiten Ihre Grenzen für Ihr aktuelles Paket. Korrigieren Sie das Problem, indem Sie Webseiten, Benutzer oder andere Ressourcen entfernen, um in Ihrem Paket zu bleiben.",
+    "subscriptionViolationMessage": "Sie überschreiten Ihre Grenzen für Ihr aktuelles Paket. Korrigieren Sie das Problem, indem Sie Standorte, Benutzer oder andere Ressourcen entfernen, um in Ihrem Paket zu bleiben.",
    "trialBannerMessage": "Ihre Testversion läuft in {countdown} ab. Upgraden, um den Zugriff zu behalten.",
    "trialBannerExpired": "Ihre Testversion ist abgelaufen. Jetzt upgraden, um den Zugriff wiederherzustellen.",
    "billingTrialBannerTitle": "Kostenlose Testversion aktiv",
-    "billingTrialBannerDescription": "Sie nutzen derzeit eine kostenlose Testversion auf der Geschäftsstufe. Wenn die Testversion endet, wird Ihr Konto automatisch auf die Funktionen und Beschränkungen der Basisstufe zurückgesetzt. Upgraden Sie jederzeit, um weiterhin Zugriff auf die Funktionen Ihres aktuellen Plans zu behalten.",
+    "billingTrialBannerDescription": "Sie nutzen derzeit eine kostenlose Testversion auf der Business-Tarif. Wenn die Testversion endet, wird Ihr Konto automatisch auf die Funktionen und Beschränkungen der Basis-Tarif zurückgesetzt. Upgraden Sie jederzeit, um weiterhin Zugriff auf die Funktionen Ihres aktuellen Plans zu behalten.",
    "billingTrialBannerUpgrade": "Jetzt upgraden",
    "billingTrialBadge": "Kostenlose Testversion",
    "trialActive": "Kostenlose Testversion aktiv",
@@ -34,8 +34,8 @@
    "trialHasEnded": "Ihre Testversion ist beendet.",
    "trialDaysRemaining": "{count, plural, one {# Tag übrig} other {# Tage übrig}}",
    "trialDaysLeftShort": "Noch {days}d in der Testversion",
-    "trialGoToBilling": "Zur Rechnungsseite gehen",
-    "subscriptionViolationViewBilling": "Rechnung anzeigen",
+    "trialGoToBilling": "Zur Abrechnung gehen",
+    "subscriptionViolationViewBilling": "Abrechnung anzeigen",
    "componentsLicenseViolation": "Lizenzverstoß: Dieser Server benutzt {usedSites} Standorte, was das Lizenzlimit von {maxSites} Standorten überschreitet. Beachte die Lizenzbedingungen, um alle Funktionen weiterhin zu nutzen.",
    "componentsSupporterMessage": "Vielen Dank für die Unterstützung von Pangolin als {tier}!",
    "inviteErrorNotValid": "Es tut uns leid, aber es sieht so aus, als wäre die Einladung, auf die du zugreifen möchtest, entweder nicht angenommen worden oder nicht mehr gültig.",
@@ -67,7 +67,7 @@
    "edit": "Bearbeiten",
    "siteConfirmDelete": "Löschen des Standorts bestätigen",
    "siteDelete": "Standort löschen",
-    "siteMessageRemove": "Sobald der Standort entfernt ist, wird sie nicht mehr zugänglich sein. Alle mit dem Standort verbundenen Ziele werden ebenfalls entfernt.",
+    "siteMessageRemove": "Sobald der Standort entfernt ist, wird er nicht mehr zugänglich sein. Alle mit dem Standort verbundenen Ziele werden ebenfalls entfernt.",
    "siteQuestionRemove": "Sind Sie sicher, dass Sie den Standort aus der Organisation entfernen möchten?",
    "siteManageSites": "Standorte verwalten",
    "siteDescription": "Erstellen und Verwalten von Standorten, um die Verbindung zu privaten Netzwerken zu ermöglichen",
@@ -117,20 +117,20 @@
    "siteGeneralDescription": "Allgemeine Einstellungen für diesen Standort konfigurieren",
    "siteSettingDescription": "Standorteinstellungen konfigurieren",
    "siteResourcesTab": "Ressourcen",
-    "siteResourcesNoneOnSite": "Diese Seite hat noch keine öffentlichen oder privaten Ressourcen.",
+    "siteResourcesNoneOnSite": "Dieser Standort hat noch keine öffentlichen oder privaten Ressourcen",
    "siteResourcesSectionPublic": "Öffentliche Ressourcen",
    "siteResourcesSectionPrivate": "Private Ressourcen",
    "siteResourcesSectionPublicDescription": "Ressourcen, die extern über Domains oder Ports bereitgestellt werden.",
-    "siteResourcesSectionPrivateDescription": "Ressourcen, die in Ihrem privaten Netzwerk über die Seite verfügbar sind.",
+    "siteResourcesSectionPrivateDescription": "Ressourcen, die in Ihrem privaten Netzwerk über den Standort verfügbar sind.",
    "siteResourcesViewAllPublic": "Alle Ressourcen anzeigen",
    "siteResourcesViewAllPrivate": "Alle Ressourcen anzeigen",
-    "siteResourcesDialogDescription": "Überblick über öffentliche und private Ressourcen, die mit dieser Seite verbunden sind.",
+    "siteResourcesDialogDescription": "Überblick über öffentliche und private Ressourcen, die mit diesem Standort verbunden sind.",
    "siteResourcesShowMore": "Mehr anzeigen",
    "siteResourcesPermissionDenied": "Sie haben keine Berechtigung, diese Ressourcen aufzulisten.",
-    "siteResourcesEmptyPublic": "Noch sind keine öffentlichen Ressourcen für diese Seite vorhanden.",
-    "siteResourcesEmptyPrivate": "Noch sind keine privaten Ressourcen mit dieser Seite verbunden.",
+    "siteResourcesEmptyPublic": "Noch sind keine öffentlichen Ressourcen für diesen Standort vorhanden.",
+    "siteResourcesEmptyPrivate": "Noch sind keine privaten Ressourcen mit diesem Standort verbunden.",
    "siteResourcesHowToAccess": "Zugriffsmöglichkeiten",
-    "siteResourcesTargetsOnSite": "Ziele auf dieser Seite",
+    "siteResourcesTargetsOnSite": "Ziele an diesem Standort",
    "siteSetting": "{siteName} Einstellungen",
    "siteNewtTunnel": "Newt Standort (empfohlen)",
    "siteNewtTunnelDescription": "Einfachster Weg, einen Einstiegspunkt in jedes Netzwerk zu erstellen. Keine zusätzliche Einrichtung.",
@@ -148,10 +148,10 @@
    "siteCredentialsSaveDescription": "Du kannst das nur einmal sehen. Stelle sicher, dass du es an einen sicheren Ort kopierst.",
    "siteInfo": "Standortinformationen",
    "status": "Status",
-    "shareTitle": "Links zum Teilen verwalten",
+    "shareTitle": "Freigabelinks verwalten",
    "shareDescription": "Erstelle teilbare Links, um temporären oder permanenten Zugriff auf Proxy-Ressourcen zu gewähren",
-    "shareSearch": "Freigabe-Links suchen...",
-    "shareCreate": "Link erstellen",
+    "shareSearch": "Freigabelinks suchen...",
+    "shareCreate": "Freigabelink erstellen",
    "shareErrorDelete": "Link konnte nicht gelöscht werden",
    "shareErrorDeleteMessage": "Fehler beim Löschen des Links",
    "shareDeleted": "Link gelöscht",
@@ -161,7 +161,7 @@
    "shareQuestionRemove": "Sind Sie sicher, dass Sie diesen Freigabelink löschen möchten?",
    "shareMessageRemove": "Nach dem Löschen funktioniert der Link nicht mehr, und jeder, der ihn nutzt, verliert den Zugriff auf die Ressource.",
    "shareTokenDescription": "Das Zugriffstoken kann auf zwei Arten übergeben werden: als Abfrageparameter oder in den Request-Headern. Diese müssen vom Client auf jeder Anfrage für authentifizierten Zugriff weitergegeben werden.",
-    "accessToken": "Zugangs-Token",
+    "accessToken": "Zugriffstoken",
    "usageExamples": "Nutzungsbeispiele",
    "tokenId": "Token-ID",
    "requestHeades": "Anfrage-Header",
@@ -172,12 +172,12 @@
    "shareTokenSecurety": "Bewahren Sie das Zugriffstoken sicher. Teilen Sie es nicht in öffentlich zugänglichen Bereichen oder Client-seitigem Code.",
    "shareErrorFetchResource": "Fehler beim Abrufen der Ressourcen",
    "shareErrorFetchResourceDescription": "Beim Abrufen der Ressourcen ist ein Fehler aufgetreten",
-    "shareErrorCreate": "Fehler beim Erstellen des Teilen-Links",
-    "shareErrorCreateDescription": "Beim Erstellen des Teilen-Links ist ein Fehler aufgetreten",
+    "shareErrorCreate": "Fehler beim Erstellen des Freigabelinks",
+    "shareErrorCreateDescription": "Beim Erstellen des Freigabelinks ist ein Fehler aufgetreten",
    "shareCreateDescription": "Jeder mit diesem Link kann auf die Ressource zugreifen",
    "shareTitleOptional": "Titel (optional)",
-    "expireIn": "Verfällt in",
-    "neverExpire": "Nie ablaufen",
+    "expireIn": "Läuft ab in",
+    "neverExpire": "Läuft nie ab",
    "shareExpireDescription": "Ablaufzeit ist, wie lange der Link verwendet werden kann und bietet Zugriff auf die Ressource. Nach dieser Zeit wird der Link nicht mehr funktionieren und Benutzer, die diesen Link benutzt haben, verlieren den Zugriff auf die Ressource.",
    "shareSeeOnce": "Sie können diesen Link nur einmal sehen. Bitte kopieren Sie ihn.",
    "shareAccessHint": "Jeder mit diesem Link kann auf die Ressource zugreifen. Teilen Sie sie mit Vorsicht.",
@@ -186,7 +186,7 @@
    "resourcesNotFound": "Keine Ressourcen gefunden",
    "resourceSearch": "Suche Ressourcen",
    "machineSearch": "Maschinen suchen",
-    "machinesSearch": "Suche Maschinen-Klienten...",
+    "machinesSearch": "Maschinen-Clients suchen",
    "machineNotFound": "Keine Maschinen gefunden",
    "userDeviceSearch": "Benutzergeräte durchsuchen",
    "userDevicesSearch": "Benutzergeräte durchsuchen...",
@@ -203,7 +203,7 @@
    "proxyResourcesBannerDescription": "Öffentliche Ressourcen sind HTTPS oder TCP/UDP-Proxys, die über einen Webbrowser für jeden zugänglich sind. Im Gegensatz zu privaten Ressourcen benötigen sie keine Client-seitige Software und können Identitäts- und kontextbezogene Zugriffsrichtlinien beinhalten.",
    "clientResourceTitle": "Private Ressourcen verwalten",
    "clientResourceDescription": "Erstelle und verwalte Ressourcen, die nur über einen verbundenen Client zugänglich sind",
-    "privateResourcesBannerTitle": "Zero-Trust Privater Zugang",
+    "privateResourcesBannerTitle": "Zero-Trust-Zugriff auf private Ressourcen",
    "privateResourcesBannerDescription": "Private Ressourcen nutzen Zero-Trust und stellen sicher, dass Benutzer und Maschinen nur auf Ressourcen zugreifen können, die Sie explizit gewähren. Verbinden Sie Benutzergeräte oder Maschinen-Clients, um auf diese Ressourcen über ein sicheres virtuelles privates Netzwerk zuzugreifen.",
    "resourcesSearch": "Suche Ressourcen...",
    "resourceAdd": "Ressource hinzufügen",
@@ -265,7 +265,7 @@
    "rules": "Regeln",
    "resourceSettingDescription": "Einstellungen für die Ressource konfigurieren",
    "resourceSetting": "{resourceName} Einstellungen",
-    "alwaysAllow": "Auth umgehen",
+    "alwaysAllow": "Authentifizierung umgehen",
    "alwaysDeny": "Zugriff blockieren",
    "passToAuth": "Weiterleiten zur Authentifizierung",
    "orgSettingsDescription": "Organisationseinstellungen konfigurieren",
@@ -274,7 +274,7 @@
    "saveGeneralSettings": "Allgemeine Einstellungen speichern",
    "saveSettings": "Einstellungen speichern",
    "orgDangerZone": "Gefahrenzone",
-    "orgDangerZoneDescription": "Sobald Sie diesen Org löschen, gibt es kein Zurück mehr. Bitte seien Sie vorsichtig.",
+    "orgDangerZoneDescription": "Sobald Sie diese Organisation löschen, gibt es kein Zurück mehr. Bitte seien Sie vorsichtig.",
    "orgDelete": "Organisation löschen",
    "orgDeleteConfirm": "Organisation löschen bestätigen",
    "orgMessageRemove": "Diese Aktion ist unwiderruflich und löscht alle zugehörigen Daten.",
@@ -323,7 +323,7 @@
    "accessApprovalsManage": "Genehmigungen verwalten",
    "accessApprovalsDescription": "Zeige und verwalte ausstehende Genehmigungen für den Zugriff auf diese Organisation",
    "description": "Beschreibung",
-    "inviteTitle": "Einladungen öffnen",
+    "inviteTitle": "Offene Einladungen",
    "inviteDescription": "Einladungen für andere Benutzer verwalten, der Organisation beizutreten",
    "inviteSearch": "Einladungen suchen...",
    "minutes": "Minuten",
@@ -370,12 +370,12 @@
    "apiKeysDescription": "API-Schlüssel werden zur Authentifizierung mit der Integrations-API verwendet",
    "provisioningKeysTitle": "Bereitstellungsschlüssel",
    "provisioningKeysManage": "Bereitstellungsschlüssel verwalten",
-    "provisioningKeysDescription": "Bereitstellungsschlüssel werden verwendet, um die automatisierte Bereitstellung von Seiten für Ihr Unternehmen zu authentifizieren.",
+    "provisioningKeysDescription": "Bereitstellungsschlüssel werden verwendet, um die automatisierte Bereitstellung von Standorten für Ihr Unternehmen zu authentifizieren.",
    "provisioningManage": "Bereitstellung",
-    "provisioningDescription": "Bereitstellungsschlüssel verwalten und ausstehende Seiten prüfen, die noch auf Genehmigung warten.",
-    "pendingSites": "Ausstehende Seiten",
-    "siteApproveSuccess": "Site erfolgreich freigegeben",
-    "siteApproveError": "Fehler beim Bestätigen der Seite",
+    "provisioningDescription": "Bereitstellungsschlüssel verwalten und ausstehende Standorte prüfen, die noch auf Genehmigung warten.",
+    "pendingSites": "Ausstehende Standorte",
+    "siteApproveSuccess": "Standort erfolgreich freigegeben",
+    "siteApproveError": "Fehler beim Genehmigen des Standorts",
    "provisioningKeys": "Bereitstellungsschlüssel",
    "searchProvisioningKeys": "Bereitstellungsschlüssel suchen...",
    "provisioningKeysAdd": "Bereitstellungsschlüssel generieren",
@@ -405,7 +405,7 @@
    "provisioningKeysNeverUsed": "Nie",
    "provisioningKeysEdit": "Bereitstellungsschlüssel bearbeiten",
    "provisioningKeysEditDescription": "Aktualisieren Sie die maximale Batch-Größe und Ablaufzeit für diesen Schlüssel.",
-    "provisioningKeysApproveNewSites": "Neue Seiten genehmigen",
+    "provisioningKeysApproveNewSites": "Neuen Standort genehmigen",
    "provisioningKeysApproveNewSitesDescription": "Sites, die sich mit diesem Schlüssel registrieren, automatisch freigeben.",
    "provisioningKeysUpdateError": "Fehler beim Aktualisieren des Bereitstellungsschlüssels",
    "provisioningKeysUpdated": "Bereitstellungsschlüssel aktualisiert",
@@ -413,8 +413,8 @@
    "provisioningKeysBannerTitle": "Website-Bereitstellungsschlüssel",
    "provisioningKeysBannerDescription": "Generieren Sie einen Bereitstellungsschlüssel und verwenden Sie ihn mit dem Newt-Connector, um Standorte beim ersten Start automatisch zu erstellen - keine Notwendigkeit, separate Anmeldedaten für jede Seite einzurichten.",
    "provisioningKeysBannerButtonText": "Mehr erfahren",
-    "pendingSitesBannerTitle": "Ausstehende Seiten",
-    "pendingSitesBannerDescription": "Websites, die mit einem Bereitstellungsschlüssel verbunden sind, erscheinen hier zur Überprüfung.",
+    "pendingSitesBannerTitle": "Ausstehende Standorte",
+    "pendingSitesBannerDescription": "Standorte, die mit einem Bereitstellungsschlüssel verbunden sind, erscheinen hier zur Überprüfung.",
    "pendingSitesBannerButtonText": "Mehr erfahren",
    "apiKeysSettings": "{apiKeyName} Einstellungen",
    "userTitle": "Alle Benutzer verwalten",
@@ -461,7 +461,7 @@
    "licenseActivateKeyDescription": "Geben Sie einen Lizenzschlüssel ein, um ihn zu aktivieren.",
    "licenseActivate": "Lizenz aktivieren",
    "licenseAgreement": "Durch Ankreuzung dieses Kästchens bestätigen Sie, dass Sie die Lizenzbedingungen gelesen und akzeptiert haben, die mit dem Lizenzschlüssel in Verbindung stehen.",
-    "fossorialLicense": "Fossorial Gewerbelizenz & Abonnementbedingungen anzeigen",
+    "fossorialLicense": "Kommerzielle Fossorial-Lizenz und Abonnementbedingungen anzeigen",
    "licenseMessageRemove": "Dadurch werden der Lizenzschlüssel und alle zugehörigen Berechtigungen entfernt.",
    "licenseMessageConfirm": "Um zu bestätigen, geben Sie bitte den Lizenzschlüssel unten ein.",
    "licenseQuestionRemove": "Sind Sie sicher, dass Sie den Lizenzschlüssel löschen möchten?",
@@ -481,7 +481,7 @@
    "licensePurchaseSites": "Zusätzliche Standorte kaufen\n",
    "licenseSitesUsedMax": "{usedSites} von {maxSites} Standorten verwendet",
    "licenseSitesUsed": "{count, plural, =0 {# Standorte} one {# Standort} other {# Standorte}} im System.",
-    "licensePurchaseDescription": "Wähle aus, für wieviele Seiten du möchtest {selectedMode, select, license {kaufe eine Lizenz. Du kannst später immer weitere Seiten hinzufügen.} other {Füge zu deiner bestehenden Lizenz hinzu.}}",
+    "licensePurchaseDescription": "Wähle aus, für wie viele Standorte du möchtest {selectedMode, select, license {kaufe eine Lizenz. Du kannst später immer weitere Standorte hinzufügen.} other {Füge zu deiner bestehenden Lizenz hinzu.}}",
    "licenseFee": "Lizenzgebühr",
    "licensePriceSite": "Preis pro Standort",
    "total": "Gesamt",
@@ -532,7 +532,7 @@
    "userRemoveOrgConfirmSelf": "Entfernung bestätigen",
    "userRemoveOrgSelf": "Sich selbst aus der Organisation entfernen",
    "userRemoveOrgSelfWarning": "Sie verlieren sofort den Zugriff auf diese Organisation.",
-    "userRemoveOrgConfirmPhraseSelf": "ENTFERNUNG MICH SELBST AUS DER ORGANISATION",
+    "userRemoveOrgConfirmPhraseSelf": "MICH SELBST AUS DER ORGANISATION ENTFERNEN",
    "users": "Benutzer",
    "accessRoleMember": "Mitglied",
    "accessRoleOwner": "Eigentümer",
@@ -630,7 +630,7 @@
    "createdAt": "Erstellt am",
    "proxyErrorInvalidHeader": "Ungültiger benutzerdefinierter Host-Header-Wert. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den benutzerdefinierten Host-Header zu deaktivieren.",
    "proxyErrorTls": "Ungültiger TLS-Servername. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den TLS-Servernamen zu entfernen.",
-    "proxyEnableSSL": "SSL aktivieren",
+    "proxyEnableSSL": "TLS aktivieren",
    "proxyEnableSSLDescription": "Aktiviere SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zu den Zielen.",
    "target": "Ziel",
    "configureTarget": "Ziele konfigurieren",
@@ -1711,11 +1711,11 @@
    "regionSelectorComingSoon": "Kommt bald",
    "billingLoadingSubscription": "Abonnement wird geladen...",
    "billingFreeTier": "Kostenlose Stufe",
-    "billingWarningOverLimit": "Warnung: Sie haben ein oder mehrere Nutzungslimits überschritten. Ihre Webseiten werden nicht verbunden, bis Sie Ihr Abonnement ändern oder Ihren Verbrauch anpassen.",
+    "billingWarningOverLimit": "Warnung: Sie haben ein oder mehrere Nutzungslimits überschritten. Ihre Standorte werden nicht verbunden, bis Sie Ihr Abonnement ändern oder Ihren Verbrauch anpassen.",
    "billingUsageLimitsOverview": "Übersicht über Nutzungsgrenzen",
    "billingMonitorUsage": "Überwachen Sie Ihren Verbrauch im Vergleich zu konfigurierten Grenzwerten. Wenn Sie eine Erhöhung der Limits benötigen, kontaktieren Sie uns bitte support@pangolin.net.",
    "billingDataUsage": "Datenverbrauch",
-    "billingSites": "Seiten",
+    "billingSites": "Standorte",
    "billingUsers": "Benutzergeräte",
    "billingDomains": "Domänen",
    "billingOrganizations": "Orden",
@@ -1743,7 +1743,7 @@
    "billingCheckoutError": "Checkout-Fehler",
    "billingFailedToGetPortalUrl": "Fehler beim Abrufen der Portal-URL",
    "billingPortalError": "Portalfehler",
-    "billingDataUsageInfo": "Wenn Sie mit der Cloud verbunden sind, werden alle Daten über Ihre sicheren Tunnel belastet. Dies schließt eingehenden und ausgehenden Datenverkehr über alle Ihre Websites ein. Wenn Sie Ihr Limit erreichen, werden Ihre Seiten die Verbindung trennen, bis Sie Ihr Paket upgraden oder die Nutzung verringern. Daten werden nicht belastet, wenn Sie Knoten verwenden.",
+    "billingDataUsageInfo": "Wenn Sie mit der Cloud verbunden sind, werden alle Daten über Ihre sicheren Tunnel belastet. Dies schließt eingehenden und ausgehenden Datenverkehr über alle Ihre Standorte ein. Wenn Sie Ihr Limit erreichen, werden Ihre Standorte die Verbindung trennen, bis Sie Ihr Paket upgraden oder die Nutzung verringern. Daten werden nicht belastet, wenn Sie Knoten verwenden.",
    "billingSInfo": "Anzahl der Sites die Sie verwenden können",
    "billingUsersInfo": "Wie viele Benutzer Sie verwenden können",
    "billingDomainInfo": "Wie viele Domains Sie verwenden können",
@@ -1927,7 +1927,7 @@
    "configureHealthCheck": "Gesundheits-Check konfigurieren",
    "configureHealthCheckDescription": "Richten Sie die Gesundheitsüberwachung für {target} ein",
    "enableHealthChecks": "Gesundheits-Checks aktivieren",
-    "healthCheckDisabledStateDescription": "Wenn deaktiviert, führt die Seite keine Gesundheitsprüfungen durch und der Zustand wird als unbekannt betrachtet.",
+    "healthCheckDisabledStateDescription": "Wenn deaktiviert, führt der Standort keine Gesundheitsprüfungen durch und der Zustand wird als unbekannt betrachtet.",
    "enableHealthChecksDescription": "Überwachen Sie die Gesundheit dieses Ziels. Bei Bedarf können Sie einen anderen Endpunkt als das Ziel überwachen.",
    "healthScheme": "Methode",
    "healthSelectScheme": "Methode auswählen",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "SSL aktivieren",
+    "editInternalResourceDialogEnableSsl": "TLS aktivieren",
    "editInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
    "editInternalResourceDialogDestination": "Ziel",
    "editInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "SSL aktivieren",
+    "createInternalResourceDialogEnableSsl": "TLS aktivieren",
    "createInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
    "createInternalResourceDialogDestination": "Ziel",
    "createInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2187,8 +2187,8 @@
        }
    },
    "remoteExitNodeSelection": "Knotenauswahl",
-    "remoteExitNodeSelectionDescription": "Wählen Sie einen Knoten aus, durch den Traffic für diese lokale Seite geleitet werden soll",
-    "remoteExitNodeRequired": "Ein Knoten muss für lokale Seiten ausgewählt sein",
+    "remoteExitNodeSelectionDescription": "Wählen Sie einen Knoten aus, durch den Traffic für diesen lokalen Standort geleitet werden soll",
+    "remoteExitNodeRequired": "Ein Knoten muss für lokale Standorte ausgewählt sein",
    "noRemoteExitNodesAvailable": "Keine Knoten verfügbar",
    "noRemoteExitNodesAvailableDescription": "Für diese Organisation sind keine Knoten verfügbar. Erstellen Sie zuerst einen Knoten, um lokale Standorte zu verwenden.",
    "exitNode": "Exit-Node",
@@ -2233,7 +2233,7 @@
        "description": "Zuverlässiger und wartungsarmer Pangolin Server mit zusätzlichen Glocken und Pfeifen",
        "introTitle": "Verwalteter selbstgehosteter Pangolin",
        "introDescription": "ist eine Deployment-Option, die für Personen konzipiert wurde, die Einfachheit und zusätzliche Zuverlässigkeit wünschen, während sie ihre Daten privat und selbstgehostet halten.",
-        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, SSL-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
+        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, TLS-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
        "benefitSimplerOperations": {
            "title": "Einfachere Operationen",
            "description": "Sie brauchen keinen eigenen Mail-Server auszuführen oder komplexe Warnungen einzurichten. Sie erhalten Gesundheitschecks und Ausfallwarnungen aus dem Box."
@@ -3235,7 +3235,7 @@
    "uptimeAddAlert": "Warnmeldung hinzufügen",
    "uptimeViewAlerts": "Warnungen anzeigen",
    "uptimeCreateEmailAlert": "E-Mail Alarm erstellen",
-    "uptimeAlertDescriptionSite": "Werde per E-Mail benachrichtigt, wenn diese Seite offline oder wieder online ist.",
+    "uptimeAlertDescriptionSite": "Werde per E-Mail benachrichtigt, wenn dieser Standort offline oder wieder online ist.",
    "uptimeAlertDescriptionResource": "Werde per E-Mail benachrichtigt, wenn diese Ressource offline oder wieder online ist.",
    "uptimeAlertNamePlaceholder": "Alarmname",
    "uptimeAdditionalEmails": "Zusätzliche E-Mails",
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -208,33 +208,11 @@
    "resourcesSearch": "Search resources...",
    "resourceAdd": "Add Resource",
    "resourceErrorDelte": "Error deleting resource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
    "authentication": "Authentication",
    "protected": "Protected",
    "notProtected": "Not Protected",
    "resourceMessageRemove": "Once removed, the resource will no longer be accessible. All targets associated with the resource will also be removed.",
    "resourceQuestionRemove": "Are you sure you want to remove the resource from the organization?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
    "resourceHTTP": "HTTPS Resource",
    "resourceHTTPDescription": "Proxy requests over HTTPS using a fully qualified domain name.",
    "resourceRaw": "Raw TCP/UDP Resource",
@@ -275,10 +253,25 @@
    "resourceLearnRaw": "Learn how to configure TCP/UDP resources",
    "resourceBack": "Back to Resources",
    "resourceGoTo": "Go to Resource",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
    "resourceDelete": "Delete Resource",
    "resourceDeleteConfirm": "Confirm Delete Resource",
+    "labelDelete": "Delete Label",
+    "labelAdd": "Add Label",
+    "labelCreateSuccessMessage": "Label Created Successfully",
+    "labelEditSuccessMessage": "Label Modified Successfully",
+    "labelNameField": "Label Name",
+    "labelColorField": "Label Color",
+    "labelPlaceholder": "Ex: homelab",
+    "labelCreate": "Create Label",
+    "createLabelDialogTitle": "Create Label",
+    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
+    "labelEdit": "Edit Label",
+    "editLabelDialogTitle": "Update Label",
+    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
+    "labelDeleteConfirm": "Confirm Delete Label",
+    "labelErrorDelete": "Failed to delete label",
+    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
+    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
    "visibility": "Visibility",
    "enabled": "Enabled",
    "disabled": "Disabled",
@@ -289,8 +282,6 @@
    "rules": "Rules",
    "resourceSettingDescription": "Configure the settings on the resource",
    "resourceSetting": "{resourceName} Settings",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
    "alwaysAllow": "Bypass Auth",
    "alwaysDeny": "Block Access",
    "passToAuth": "Pass to Auth",
@@ -656,7 +647,7 @@
    "createdAt": "Created At",
    "proxyErrorInvalidHeader": "Invalid custom Host Header value. Use domain name format, or save empty to unset custom Host Header.",
    "proxyErrorTls": "Invalid TLS Server Name. Use domain name format, or save empty to remove the TLS Server Name.",
-    "proxyEnableSSL": "Enable SSL",
+    "proxyEnableSSL": "Enable TLS",
    "proxyEnableSSLDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the targets.",
    "target": "Target",
    "configureTarget": "Configure Targets",
@@ -773,16 +764,6 @@
    "rulesNoOne": "No rules. Add a rule using the form.",
    "rulesOrder": "Rules are evaluated by priority in ascending order.",
    "rulesSubmit": "Save Rules",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
    "resourceErrorCreate": "Error creating resource",
    "resourceErrorCreateDescription": "An error occurred when creating the resource",
    "resourceErrorCreateMessage": "Error creating resource:",
@@ -846,16 +827,6 @@
    "pincodeAdd": "Add PIN Code",
    "pincodeRemove": "Remove PIN Code",
    "resourceAuthMethods": "Authentication Methods",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
    "resourceAuthMethodsDescriptions": "Allow access to the resource via additional auth methods",
    "resourceAuthSettingsSave": "Saved successfully",
    "resourceAuthSettingsSaveDescription": "Authentication settings have been saved",
@@ -891,12 +862,6 @@
    "resourcePincodeSetupTitle": "Set Pincode",
    "resourcePincodeSetupTitleDescription": "Set a pincode to protect this resource",
    "resourceRoleDescription": "Admins can always access this resource.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
    "resourceUsersRoles": "Access Controls",
    "resourceUsersRolesDescription": "Configure which users and roles can visit this resource",
    "resourceUsersRolesSubmit": "Save Access Controls",
@@ -1192,6 +1157,15 @@
    "idpErrorConnectingTo": "There was a problem connecting to {name}. Please contact your administrator.",
    "idpErrorNotFound": "IdP not found",
    "inviteInvalid": "Invalid Invite",
+    "labels": "Labels",
+    "orgLabelsDescription": "Manage labels in this organization.",
+    "addLabels": "Add labels",
+    "siteLabelsTab": "Labels",
+    "siteLabelsDescription": "Manage labels associated with this site.",
+    "labelsNotFound": "Labels not found",
+    "labelSearch": "Search labels",
+    "selectColor": "Select color",
+    "createNewLabel": "Create new org label \"{label}\"",
    "inviteInvalidDescription": "The invite link is invalid.",
    "inviteErrorWrongUser": "Invite is not for this user",
    "inviteErrorUserNotExists": "User does not exist. Please create an account first.",
@@ -1426,8 +1400,6 @@
    "sidebarResources": "Resources",
    "sidebarProxyResources": "Public",
    "sidebarClientResources": "Private",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
    "sidebarAccessControl": "Access Control",
    "sidebarLogsAndAnalytics": "Logs & Analytics",
    "sidebarTeam": "Team",
@@ -2104,7 +2076,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Scheme",
-    "editInternalResourceDialogEnableSsl": "Enable SSL",
+    "editInternalResourceDialogEnableSsl": "Enable TLS",
    "editInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
    "editInternalResourceDialogDestination": "Destination",
    "editInternalResourceDialogDestinationHostDescription": "The IP address or hostname of the resource on the site's network.",
@@ -2154,7 +2126,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Scheme",
    "createInternalResourceDialogScheme": "Scheme",
-    "createInternalResourceDialogEnableSsl": "Enable SSL",
+    "createInternalResourceDialogEnableSsl": "Enable TLS",
    "createInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
    "createInternalResourceDialogDestination": "Destination",
    "createInternalResourceDialogDestinationHostDescription": "The IP address or hostname of the resource on the site's network.",
@@ -2287,7 +2259,7 @@
        "description": "More reliable and low-maintenance self-hosted Pangolin server with extra bells and whistles",
        "introTitle": "Managed Self-Hosted Pangolin",
        "introDescription": "is a deployment option designed for people who want simplicity and extra reliability while still keeping their data private and self-hosted.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, SSL termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
        "benefitSimplerOperations": {
            "title": "Simpler operations",
            "description": "No need to run your own mail server or set up complex alerting. You'll get health checks and downtime alerts out of the box."
--- a/messages/es-ES.json
+++ b/messages/es-ES.json
@@ -630,7 +630,7 @@
    "createdAt": "Creado el",
    "proxyErrorInvalidHeader": "Valor de cabecera de host personalizado no válido. Utilice el formato de nombre de dominio, o guarde en blanco para desestablecer cabecera de host personalizada.",
    "proxyErrorTls": "Nombre de servidor TLS inválido. Utilice el formato de nombre de dominio o guarde en blanco para eliminar el nombre de servidor TLS.",
-    "proxyEnableSSL": "Activar SSL",
+    "proxyEnableSSL": "Activar TLS",
    "proxyEnableSSLDescription": "Habilita el cifrado SSL/TLS para conexiones seguras HTTPS a los objetivos.",
    "target": "Target",
    "configureTarget": "Configurar objetivos",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Activar SSL",
+    "editInternalResourceDialogEnableSsl": "Activar TLS",
    "editInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
    "editInternalResourceDialogDestination": "Destino",
    "editInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Activar SSL",
+    "createInternalResourceDialogEnableSsl": "Activar TLS",
    "createInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
    "createInternalResourceDialogDestination": "Destino",
    "createInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2233,7 +2233,7 @@
        "description": "Servidor Pangolin autoalojado más fiable y de bajo mantenimiento con campanas y silbidos extra",
        "introTitle": "Pangolin autogestionado",
        "introDescription": "es una opción de despliegue diseñada para personas que quieren simplicidad y fiabilidad extra mientras mantienen sus datos privados y autoalojados.",
-        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación SSL y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
+        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación TLS y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
        "benefitSimplerOperations": {
            "title": "Operaciones simples",
            "description": "No necesitas ejecutar tu propio servidor de correo o configurar alertas complejas. Recibirás cheques de salud y alertas de tiempo de inactividad."
--- a/messages/fr-FR.json
+++ b/messages/fr-FR.json
@@ -630,7 +630,7 @@
    "createdAt": "Créé le",
    "proxyErrorInvalidHeader": "Valeur d'en-tête Host personnalisée invalide. Utilisez le format de nom de domaine, ou laissez vide pour désactiver l'en-tête Host personnalisé.",
    "proxyErrorTls": "Nom de serveur TLS invalide. Utilisez le format de nom de domaine, ou laissez vide pour supprimer le nom de serveur TLS.",
-    "proxyEnableSSL": "Activer SSL",
+    "proxyEnableSSL": "Activer TLS",
    "proxyEnableSSLDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers les cibles.",
    "target": "Cible",
    "configureTarget": "Configurer les cibles",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Méthode HTTP",
-    "editInternalResourceDialogEnableSsl": "Activer SSL",
+    "editInternalResourceDialogEnableSsl": "Activer TLS",
    "editInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
    "editInternalResourceDialogDestination": "Destination",
    "editInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Méthode HTTP",
    "createInternalResourceDialogScheme": "Méthode HTTP",
-    "createInternalResourceDialogEnableSsl": "Activer SSL",
+    "createInternalResourceDialogEnableSsl": "Activer TLS",
    "createInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
    "createInternalResourceDialogDestination": "Destination",
    "createInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2233,7 +2233,7 @@
        "description": "Serveur Pangolin auto-hébergé avec des cloches et des sifflets supplémentaires",
        "introTitle": "Pangolin auto-hébergé géré",
        "introDescription": "est une option de déploiement conçue pour les personnes qui veulent de la simplicité et de la fiabilité tout en gardant leurs données privées et auto-hébergées.",
-        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison SSL et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
+        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison TLS et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
        "benefitSimplerOperations": {
            "title": "Opérations plus simples",
            "description": "Pas besoin de faire tourner votre propre serveur de messagerie ou de configurer des alertes complexes. Vous obtiendrez des contrôles de santé et des alertes de temps d'arrêt par la suite."
--- a/messages/it-IT.json
+++ b/messages/it-IT.json
@@ -630,7 +630,7 @@
    "createdAt": "Creato Il",
    "proxyErrorInvalidHeader": "Valore dell'intestazione Host personalizzata non valido. Usa il formato nome dominio o salva vuoto per rimuovere l'intestazione Host personalizzata.",
    "proxyErrorTls": "Nome Server TLS non valido. Usa il formato nome dominio o salva vuoto per rimuovere il Nome Server TLS.",
-    "proxyEnableSSL": "Abilita SSL",
+    "proxyEnableSSL": "Abilita TLS",
    "proxyEnableSSLDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alle risorse interne target.",
    "target": "Target",
    "configureTarget": "Configura Risorse Interne",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Metodo HTTP",
-    "editInternalResourceDialogEnableSsl": "Abilitare SSL",
+    "editInternalResourceDialogEnableSsl": "Abilitare TLS",
    "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "editInternalResourceDialogDestination": "Destinazione",
    "editInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Metodo HTTP",
    "createInternalResourceDialogScheme": "Metodo HTTP",
-    "createInternalResourceDialogEnableSsl": "Abilitare SSL",
+    "createInternalResourceDialogEnableSsl": "Abilitare TLS",
    "createInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
    "createInternalResourceDialogDestination": "Destinazione",
    "createInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2233,7 +2233,7 @@
        "description": "Server Pangolin self-hosted più affidabile e a bassa manutenzione con campanelli e fischietti extra",
        "introTitle": "Managed Self-Hosted Pangolin",
        "introDescription": "è un'opzione di distribuzione progettata per le persone che vogliono la semplicità e l'affidabilità extra mantenendo i loro dati privati e self-hosted.",
-        "introDetail": "Con questa opzione, esegui ancora il tuo nodo Pangolin - i tunnel, la terminazione SSL e il traffico rimangono tutti sul tuo server. La differenza è che la gestione e il monitoraggio sono gestiti attraverso il nostro cruscotto cloud, che sblocca una serie di vantaggi:",
+        "introDetail": "Con questa opzione, esegui ancora il tuo nodo Pangolin - i tunnel, la terminazione TLS e il traffico rimangono tutti sul tuo server. La differenza è che la gestione e il monitoraggio sono gestiti attraverso il nostro cruscotto cloud, che sblocca una serie di vantaggi:",
        "benefitSimplerOperations": {
            "title": "Operazioni più semplici",
            "description": "Non è necessario eseguire il proprio server di posta o impostare un avviso complesso. Otterrai controlli di salute e avvisi di inattività fuori dalla casella."
--- a/messages/ko-KR.json
+++ b/messages/ko-KR.json
@@ -630,7 +630,7 @@
    "createdAt": "생성일",
    "proxyErrorInvalidHeader": "잘못된 사용자 정의 호스트 헤더 값입니다. 도메인 이름 형식을 사용하거나 사용자 정의 호스트 헤더를 해제하려면 비워 두십시오.",
    "proxyErrorTls": "유효하지 않은 TLS 서버 이름입니다. 도메인 이름 형식을 사용하거나 비워 두어 TLS 서버 이름을 제거하십시오.",
-    "proxyEnableSSL": "SSL 활성화",
+    "proxyEnableSSL": "TLS 활성화",
    "proxyEnableSSLDescription": "타겟과의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화를 활성화하세요.",
    "target": "대상",
    "configureTarget": "대상 구성",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "스킴",
-    "editInternalResourceDialogEnableSsl": "SSL 활성화",
+    "editInternalResourceDialogEnableSsl": "TLS 활성화",
    "editInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
    "editInternalResourceDialogDestination": "대상지",
    "editInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "스킴",
    "createInternalResourceDialogScheme": "스킴",
-    "createInternalResourceDialogEnableSsl": "SSL 활성화",
+    "createInternalResourceDialogEnableSsl": "TLS 활성화",
    "createInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
    "createInternalResourceDialogDestination": "대상지",
    "createInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2233,7 +2233,7 @@
        "description": "더 신뢰할 수 있고 낮은 유지보수의 자체 호스팅 팡골린 서버, 추가 기능 포함",
        "introTitle": "관리 자체 호스팅 팡골린",
        "introDescription": "는 자신의 데이터를 프라이빗하고 자체 호스팅을 유지하면서 더 간단하고 추가적인 신뢰성을 원하는 사람들을 위한 배포 옵션입니다.",
-        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, SSL 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
+        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, TLS 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
        "benefitSimplerOperations": {
            "title": "더 간단한 운영",
            "description": "자체 메일 서버를 운영하거나 복잡한 경고를 설정할 필요가 없습니다. 기본적으로 상태 점검 및 다운타임 경고를 받을 수 있습니다."
--- a/messages/nb-NO.json
+++ b/messages/nb-NO.json
@@ -630,7 +630,7 @@
    "createdAt": "Opprettet",
    "proxyErrorInvalidHeader": "Ugyldig verdi for egendefinert vertsoverskrift. Bruk domenenavnformat, eller lagre tomt for å fjerne den egendefinerte vertsoverskriften.",
    "proxyErrorTls": "Ugyldig TLS-servernavn. Bruk domenenavnformat, eller la stå tomt for å fjerne TLS-servernavnet.",
-    "proxyEnableSSL": "Aktiver SSL",
+    "proxyEnableSSL": "Aktiver TLS",
    "proxyEnableSSLDescription": "Aktivere SSL/TLS-kryptering for sikker HTTPS tilkobling til målene.",
    "target": "Target",
    "configureTarget": "Konfigurer mål",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Skjema",
-    "editInternalResourceDialogEnableSsl": "Aktiver SSL",
+    "editInternalResourceDialogEnableSsl": "Aktiver TLS",
    "editInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
    "editInternalResourceDialogDestination": "Destinasjon",
    "editInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Skjema",
    "createInternalResourceDialogScheme": "Skjema",
-    "createInternalResourceDialogEnableSsl": "Aktiver SSL",
+    "createInternalResourceDialogEnableSsl": "Aktiver TLS",
    "createInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
    "createInternalResourceDialogDestination": "Destinasjon",
    "createInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2233,7 +2233,7 @@
        "description": "Sikre og lavvedlikeholdsservere, selvbetjente Pangolin med ekstra klokker, og understell",
        "introTitle": "Administrert Self-Hosted Pangolin",
        "introDescription": "er et alternativ for bruk utviklet for personer som ønsker enkel og ekstra pålitelighet mens de fortsatt holder sine data privat og selvdrevne.",
-        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, SSL-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
+        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, TLS-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
        "benefitSimplerOperations": {
            "title": "Enklere operasjoner",
            "description": "Ingen grunn til å kjøre din egen e-postserver eller sette opp kompleks varsling. Du vil få helsesjekk og nedetid varsler ut av boksen."
--- a/messages/nl-NL.json
+++ b/messages/nl-NL.json
@@ -630,7 +630,7 @@
    "createdAt": "Aangemaakt op",
    "proxyErrorInvalidHeader": "Ongeldige aangepaste Header waarde. Gebruik het domeinnaam formaat, of sla leeg op om de aangepaste Host header ongedaan te maken.",
    "proxyErrorTls": "Ongeldige TLS servernaam. Gebruik de domeinnaam of sla leeg op om de TLS servernaam te verwijderen.",
-    "proxyEnableSSL": "SSL inschakelen",
+    "proxyEnableSSL": "TLS inschakelen",
    "proxyEnableSSLDescription": "SSL/TLS-versleuteling inschakelen voor beveiligde HTTPS-verbindingen naar de doelen.",
    "target": "Target",
    "configureTarget": "Doelstellingen configureren",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "SSL inschakelen",
+    "editInternalResourceDialogEnableSsl": "TLS inschakelen",
    "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "editInternalResourceDialogDestination": "Bestemming",
    "editInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "SSL inschakelen",
+    "createInternalResourceDialogEnableSsl": "TLS inschakelen",
    "createInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
    "createInternalResourceDialogDestination": "Bestemming",
    "createInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2233,7 +2233,7 @@
        "description": "betrouwbaardere en slecht onderhouden Pangolin server met extra klokken en klokkenluiders",
        "introTitle": "Beheerde zelfgehoste pangolin",
        "introDescription": "is een implementatieoptie ontworpen voor mensen die eenvoud en extra betrouwbaarheid willen, terwijl hun gegevens privé en zelf georganiseerd blijven.",
-        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, SSL-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
+        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, TLS-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
        "benefitSimplerOperations": {
            "title": "Simpler operaties",
            "description": "Je hoeft geen eigen mailserver te draaien of complexe waarschuwingen in te stellen. Je krijgt gezondheidscontroles en downtime meldingen uit de box."
--- a/messages/pl-PL.json
+++ b/messages/pl-PL.json
@@ -630,7 +630,7 @@
    "createdAt": "Utworzono",
    "proxyErrorInvalidHeader": "Nieprawidłowa wartość niestandardowego nagłówka hosta. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć niestandardowy nagłówek hosta.",
    "proxyErrorTls": "Nieprawidłowa nazwa serwera TLS. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć nazwę serwera TLS.",
-    "proxyEnableSSL": "Włącz SSL",
+    "proxyEnableSSL": "Włącz TLS",
    "proxyEnableSSLDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z celami.",
    "target": "Target",
    "configureTarget": "Konfiguruj Targety",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Schemat",
-    "editInternalResourceDialogEnableSsl": "Włącz SSL",
+    "editInternalResourceDialogEnableSsl": "Włącz TLS",
    "editInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
    "editInternalResourceDialogDestination": "Miejsce docelowe",
    "editInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Schemat",
    "createInternalResourceDialogScheme": "Schemat",
-    "createInternalResourceDialogEnableSsl": "Włącz SSL",
+    "createInternalResourceDialogEnableSsl": "Włącz TLS",
    "createInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
    "createInternalResourceDialogDestination": "Miejsce docelowe",
    "createInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2233,7 +2233,7 @@
        "description": "Większa niezawodność i niska konserwacja serwera Pangolin z dodatkowymi dzwonkami i sygnałami",
        "introTitle": "Zarządzany samowystarczalny Pangolin",
        "introDescription": "jest opcją wdrażania zaprojektowaną dla osób, które chcą prostoty i dodatkowej niezawodności, przy jednoczesnym utrzymaniu swoich danych prywatnych i samodzielnych.",
-        "introDetail": "Z tą opcją nadal obsługujesz swój własny węzeł Pangolin - tunele, zakończenie SSL i ruch na Twoim serwerze. Różnica polega na tym, że zarządzanie i monitorowanie odbywa się za pomocą naszej tablicy rozdzielczej, która odblokowuje szereg korzyści:",
+        "introDetail": "Z tą opcją nadal obsługujesz swój własny węzeł Pangolin - tunele, zakończenie TLS i ruch na Twoim serwerze. Różnica polega na tym, że zarządzanie i monitorowanie odbywa się za pomocą naszej tablicy rozdzielczej, która odblokowuje szereg korzyści:",
        "benefitSimplerOperations": {
            "title": "Uproszczone operacje",
            "description": "Nie ma potrzeby uruchamiania własnego serwera pocztowego lub ustawiania skomplikowanych powiadomień. Będziesz mieć kontrolę zdrowia i powiadomienia o przestoju."
--- a/messages/pt-PT.json
+++ b/messages/pt-PT.json
@@ -630,7 +630,7 @@
    "createdAt": "Criado Em",
    "proxyErrorInvalidHeader": "Valor do cabeçalho Host personalizado inválido. Use o formato de nome de domínio ou salve vazio para remover o cabeçalho Host personalizado.",
    "proxyErrorTls": "Nome do Servidor TLS inválido. Use o formato de nome de domínio ou salve vazio para remover o Nome do Servidor TLS.",
-    "proxyEnableSSL": "Habilitar SSL",
+    "proxyEnableSSL": "Habilitar TLS",
    "proxyEnableSSLDescription": "Habilitar criptografia SSL/TLS para conexões HTTPS seguras aos alvos.",
    "target": "Target",
    "configureTarget": "Configurar Alvos",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Ativar SSL",
+    "editInternalResourceDialogEnableSsl": "Ativar TLS",
    "editInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
    "editInternalResourceDialogDestination": "Destino",
    "editInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Ativar SSL",
+    "createInternalResourceDialogEnableSsl": "Ativar TLS",
    "createInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
    "createInternalResourceDialogDestination": "Destino",
    "createInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2233,7 +2233,7 @@
        "description": "Servidor Pangolin auto-hospedado mais confiável e com baixa manutenção com sinos extras e assobiamentos",
        "introTitle": "Pangolin Auto-Hospedado Gerenciado",
        "introDescription": "é uma opção de implantação projetada para pessoas que querem simplicidade e confiança adicional, mantendo os seus dados privados e auto-hospedados.",
-        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação SSL e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
+        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação TLS e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
        "benefitSimplerOperations": {
            "title": "Operações simples",
            "description": "Não é necessário executar o seu próprio servidor de e-mail ou configurar um alerta complexo. Você receberá fora de caixa verificações de saúde e alertas de tempo de inatividade."
--- a/messages/ru-RU.json
+++ b/messages/ru-RU.json
@@ -630,7 +630,7 @@
    "createdAt": "Создано в",
    "proxyErrorInvalidHeader": "Неверное значение пользовательского заголовка Host. Используйте формат доменного имени или оставьте пустым для сброса пользовательского заголовка Host.",
    "proxyErrorTls": "Неверное имя TLS сервера. Используйте формат доменного имени или оставьте пустым для удаления имени TLS сервера.",
-    "proxyEnableSSL": "Включить SSL",
+    "proxyEnableSSL": "Включить TLS",
    "proxyEnableSSLDescription": "Включить шифрование SSL/TLS для безопасных HTTPS соединений с целями.",
    "target": "Target",
    "configureTarget": "Настроить адресаты",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Схема",
-    "editInternalResourceDialogEnableSsl": "Включить SSL",
+    "editInternalResourceDialogEnableSsl": "Включить TLS",
    "editInternalResourceDialogEnableSslDescription": "Включите шифрование SSL/TLS для защищенных HTTPS соединений с конечной точкой.",
    "editInternalResourceDialogDestination": "Пункт назначения",
    "editInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Схема",
    "createInternalResourceDialogScheme": "Схема",
-    "createInternalResourceDialogEnableSsl": "Включить SSL",
+    "createInternalResourceDialogEnableSsl": "Включить TLS",
    "createInternalResourceDialogEnableSslDescription": "Включите SSL/TLS шифрование для защищенных HTTPS соединений с конечной точкой.",
    "createInternalResourceDialogDestination": "Пункт назначения",
    "createInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2233,7 +2233,7 @@
        "description": "Более надежный и низко обслуживаемый сервер Pangolin с дополнительными колокольнями и свистками",
        "introTitle": "Управляемый Само-Хост Панголина",
        "introDescription": "- это вариант развертывания, предназначенный для людей, которые хотят простоты и надёжности, сохраняя при этом свои данные конфиденциальными и самостоятельными.",
-        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, SSL, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
+        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, TLS, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
        "benefitSimplerOperations": {
            "title": "Более простые операции",
            "description": "Не нужно запускать свой собственный почтовый сервер или настроить комплексное оповещение. Вы будете получать проверки состояния здоровья и оповещения о неисправностях из коробки."
--- a/messages/tr-TR.json
+++ b/messages/tr-TR.json
@@ -630,7 +630,7 @@
    "createdAt": "Oluşturulma Tarihi",
    "proxyErrorInvalidHeader": "Geçersiz özel Ana Bilgisayar Başlığı değeri. Alan adı formatını kullanın veya özel Ana Bilgisayar Başlığını ayarlamak için boş bırakın.",
    "proxyErrorTls": "Geçersiz TLS Sunucu Adı. Alan adı formatını kullanın veya TLS Sunucu Adını kaldırmak için boş bırakılsın.",
-    "proxyEnableSSL": "SSL Etkinleştir",
+    "proxyEnableSSL": "TLS Etkinleştir",
    "proxyEnableSSLDescription": "Hedeflere güvenli HTTPS bağlantıları için SSL/TLS şifrelemesini etkinleştirin.",
    "target": "Hedef",
    "configureTarget": "Hedefleri Yapılandır",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "Şema",
-    "editInternalResourceDialogEnableSsl": "SSL'i Etkinleştir",
+    "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
    "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
    "editInternalResourceDialogDestination": "Hedef",
    "editInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "Şema",
    "createInternalResourceDialogScheme": "Şema",
-    "createInternalResourceDialogEnableSsl": "SSL'i Etkinleştir",
+    "createInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",
    "createInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
    "createInternalResourceDialogDestination": "Hedef",
    "createInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2233,7 +2233,7 @@
        "description": "Daha güvenilir ve düşük bakım gerektiren, ekstra özelliklere sahip kendi kendine barındırabileceğiniz Pangolin sunucusu",
        "introTitle": "Yönetilen Kendi Kendine Barındırılan Pangolin",
        "introDescription": "Bu, basitlik ve ekstra güvenilirlik arayan, ancak verilerini gizli tutmak ve kendi sunucularında barındırmak isteyen kişiler için tasarlanmış bir dağıtım seçeneğidir.",
-        "introDetail": "Bu seçenekle, kendi Pangolin düğümünüzü çalıştırmaya devam edersiniz - tünelleriniz, SSL bitişiniz ve trafiğiniz tamamen sunucunuzda kalır. Fark, yönetim ve izlemeyi bulut panomuz üzerinden gerçekleştiririz, bu da bir dizi avantaj sağlar:",
+        "introDetail": "Bu seçenekle, kendi Pangolin düğümünüzü çalıştırmaya devam edersiniz - tünelleriniz, TLS bitişiniz ve trafiğiniz tamamen sunucunuzda kalır. Fark, yönetim ve izlemeyi bulut panomuz üzerinden gerçekleştiririz, bu da bir dizi avantaj sağlar:",
        "benefitSimplerOperations": {
            "title": "Daha basit işlemler",
            "description": "Kendi e-posta sunucunuzu çalıştırmanıza veya karmaşık uyarılar kurmanıza gerek yok. Sağlık kontrolleri ve kesinti uyarılarını kutudan çıktığı gibi alırsınız."
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -630,7 +630,7 @@
    "createdAt": "创建于",
    "proxyErrorInvalidHeader": "无效的自定义主机头值。使用域名格式，或将空保存为取消自定义主机头。",
    "proxyErrorTls": "无效的 TLS 服务器名称。使用域名格式，或保存空以删除 TLS 服务器名称。",
-    "proxyEnableSSL": "启用 SSL",
+    "proxyEnableSSL": "启用 TLS",
    "proxyEnableSSLDescription": "启用 SSL/TLS 加密以确保目标的 HTTPS 连接。",
    "target": "Target",
    "configureTarget": "配置目标",
@@ -2050,7 +2050,7 @@
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
    "editInternalResourceDialogScheme": "方案",
-    "editInternalResourceDialogEnableSsl": "启用 SSL",
+    "editInternalResourceDialogEnableSsl": "启用 TLS",
    "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
    "editInternalResourceDialogDestination": "目标",
    "editInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2100,7 +2100,7 @@
    "createInternalResourceDialogModeHttps": "HTTPS",
    "scheme": "方案",
    "createInternalResourceDialogScheme": "方案",
-    "createInternalResourceDialogEnableSsl": "启用 SSL",
+    "createInternalResourceDialogEnableSsl": "启用 TLS",
    "createInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
    "createInternalResourceDialogDestination": "目标",
    "createInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2233,7 +2233,7 @@
        "description": "更可靠和低维护自我托管的 Pangolin 服务器，带有额外的铃声和告密器",
        "introTitle": "托管自托管的潘戈林公司",
        "introDescription": "这是一种部署选择，为那些希望简洁和额外可靠的人设计，同时仍然保持他们的数据的私密性和自我托管性。",
-        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、SSL 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
+        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、TLS 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
        "benefitSimplerOperations": {
            "title": "简单的操作",
            "description": "无需运行您自己的邮件服务器或设置复杂的警报。您将从方框中获得健康检查和下限提醒。"
--- a/messages/zh-TW.json
+++ b/messages/zh-TW.json
@@ -489,7 +489,7 @@
    "createdAt": "創建於",
    "proxyErrorInvalidHeader": "無效的自訂主機 Header。使用域名格式，或將空保存為取消自訂 Header。",
    "proxyErrorTls": "無效的 TLS 伺服器名稱。使用域名格式，或保存空以刪除 TLS 伺服器名稱。",
-    "proxyEnableSSL": "啟用 SSL",
+    "proxyEnableSSL": "啟用 TLS",
    "proxyEnableSSLDescription": "啟用 SSL/TLS 加密以確保您目標的 HTTPS 連接。",
    "target": "目標",
    "configureTarget": "配置目標",
@@ -1763,7 +1763,7 @@
        "description": "更可靠、維護成本更低的自架 Pangolin 伺服器，並附帶額外的附加功能",
        "introTitle": "託管式自架 Pangolin",
        "introDescription": "這是一種部署選擇，為那些希望簡潔和額外可靠的人設計，同時仍然保持他們的數據的私密性和自我託管性。",
-        "introDetail": "通過此選項，您仍然運行您自己的 Pangolin 節點 - - 您的隧道、SSL 終止，並且流量在您的伺服器上保持所有狀態。 不同之處在於，管理和監測是通過我們的雲層儀錶板進行的，該儀錶板開啟了一些好處：",
+        "introDetail": "通過此選項，您仍然運行您自己的 Pangolin 節點 - - 您的隧道、TLS 終止，並且流量在您的伺服器上保持所有狀態。 不同之處在於，管理和監測是通過我們的雲層儀錶板進行的，該儀錶板開啟了一些好處：",
        "benefitSimplerOperations": {
            "title": "簡單的操作",
            "description": "無需運行您自己的郵件伺服器或設置複雜的警報。您將從方框中獲得健康檢查和下限提醒。"
--- a/server/auth/actions.ts
+++ b/server/auth/actions.ts
@@ -5,7 +5,6 @@ import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import logger from "@server/logger";

 export enum ActionsEnum {
    createOrgUser = "createOrgUser",
@@ -149,25 +148,17 @@ export enum ActionsEnum {
    updateAlertRule = "updateAlertRule",
    deleteAlertRule = "deleteAlertRule",
    listAlertRules = "listAlertRules",
+    listOrgLabels = "listOrgLabels",
+    createOrgLabel = "createOrgLabel",
+    updateOrgLabel = "updateOrgLabel",
+    deleteOrgLabel = "deleteOrgLabel",
+    attachLabelToItem = "attachLabelToItem",
+    detachLabelFromItem = "detachLabelFromItem",
    getAlertRule = "getAlertRule",
    createHealthCheck = "createHealthCheck",
    updateHealthCheck = "updateHealthCheck",
    deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks",
-    listResourcePolicies = "listResourcePolicies",
-    getResourcePolicy = "getResourcePolicy",
-    createResourcePolicy = "createResourcePolicy",
-    updateResourcePolicy = "updateResourcePolicy",
-    deleteResourcePolicy = "deleteResourcePolicy",
-    listResourcePolicyRoles = "listResourcePolicyRoles",
-    setResourcePolicyRoles = "setResourcePolicyRoles",
-    listResourcePolicyUsers = "listResourcePolicyUsers",
-    setResourcePolicyUsers = "setResourcePolicyUsers",
-    setResourcePolicyPassword = "setResourcePolicyPassword",
-    setResourcePolicyPincode = "setResourcePolicyPincode",
-    setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
-    setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
-    setResourcePolicyRules = "setResourcePolicyRules"
+    listHealthChecks = "listHealthChecks"
 }

 export async function checkUserActionPermission(
@@ -200,23 +191,6 @@ export async function checkUserActionPermission(
            }
        }

-        // If no direct permission, check role-based permission (any of user's roles)
-        const roleActionPermission = await db
-            .select()
-            .from(roleActions)
-            .where(
-                and(
-                    eq(roleActions.actionId, actionId),
-                    inArray(roleActions.roleId, userOrgRoleIds),
-                    eq(roleActions.orgId, req.userOrgId!)
-                )
-            )
-            .limit(1);
-
-        if (roleActionPermission.length > 0) {
-            return true;
-        }
-
        // Check if the user has direct permission for the action in the current org
        const userActionPermission = await db
            .select()
@@ -234,7 +208,20 @@ export async function checkUserActionPermission(
            return true;
        }

-        return false;
+        // If no direct permission, check role-based permission (any of user's roles)
+        const roleActionPermission = await db
+            .select()
+            .from(roleActions)
+            .where(
+                and(
+                    eq(roleActions.actionId, actionId),
+                    inArray(roleActions.roleId, userOrgRoleIds),
+                    eq(roleActions.orgId, req.userOrgId!)
+                )
+            )
+            .limit(1);
+
+        return roleActionPermission.length > 0;
    } catch (error) {
        console.error("Error checking user action permission:", error);
        throw createHttpError(
--- a/server/db/names.ts
+++ b/server/db/names.ts
@@ -1,12 +1,6 @@
 import { join } from "path";
 import { readFileSync } from "fs";
-import {
-    clients,
-    db,
-    resourcePolicies,
-    resources,
-    siteResources
-} from "@server/db";
+import { clients, db, resources, siteResources } from "@server/db";
 import { randomInt } from "crypto";
 import { exitNodes, sites } from "@server/db";
 import { eq, and } from "drizzle-orm";
@@ -113,35 +107,6 @@ export async function getUniqueResourceName(orgId: string): Promise<string> {
    }
 }

-export async function getUniqueResourcePolicyName(
-    orgId: string
-): Promise<string> {
-    let loops = 0;
-    while (true) {
-        if (loops > 100) {
-            throw new Error("Could not generate a unique name");
-        }
-
-        const name = generateName();
-        const policyCount = await db
-            .select({
-                niceId: resourcePolicies.niceId,
-                orgId: resourcePolicies.orgId
-            })
-            .from(resourcePolicies)
-            .where(
-                and(
-                    eq(resourcePolicies.niceId, name),
-                    eq(resourcePolicies.orgId, orgId)
-                )
-            );
-        if (policyCount.length === 0) {
-            return name;
-        }
-        loops++;
-    }
-}
-
 export async function getUniqueSiteResourceName(
    orgId: string
 ): Promise<string> {
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -110,16 +110,6 @@ export const sites = pgTable("sites", {

 export const resources = pgTable("resources", {
    resourceId: serial("resourceId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
    resourceGuid: varchar("resourceGuid", { length: 36 })
        .unique()
        .notNull()
@@ -172,6 +162,89 @@ export const resources = pgTable("resources", {
    wildcard: boolean("wildcard").notNull().default(false)
 });

+export const labels = pgTable("labels", {
+    labelId: serial("labelId").primaryKey(),
+    name: varchar("name").notNull(),
+    color: varchar("color").notNull(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});
+
+export const siteLabels = pgTable(
+    "siteLabels",
+    {
+        siteLabelId: serial("siteLabelId").primaryKey(),
+        siteId: integer("siteId")
+            .references(() => sites.siteId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
+);
+
+export const resourceLabels = pgTable(
+    "resourceLabels",
+    {
+        resourceLabelId: serial("resourceLabelId").primaryKey(),
+        resourceId: integer("resourceId")
+            .references(() => resources.resourceId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
+);
+
+export const siteResourceLabels = pgTable(
+    "siteResourceLabels",
+    {
+        siteResourceLabelId: serial("siteResourceLabelId").primaryKey(),
+        siteResourceId: integer("siteResourceId")
+            .references(() => siteResources.siteResourceId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
+);
+
+export const clientLabels = pgTable(
+    "clientLabels",
+    {
+        clientLabelId: serial("clientLabelId").primaryKey(),
+        clientId: integer("clientId")
+            .references(() => clients.clientId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
+);
+
 export const targets = pgTable("targets", {
    targetId: serial("targetId").primaryKey(),
    resourceId: integer("resourceId")
@@ -533,38 +606,6 @@ export const userResources = pgTable("userResources", {
        .references(() => resources.resourceId, { onDelete: "cascade" })
 });

-export const rolePolicies = pgTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = pgTable("userPolicies", {
-    userId: varchar("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = pgTable("resourcePolicyWhitelist", {
-    whitelistId: serial("id").primaryKey(),
-    email: varchar("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const userInvites = pgTable("userInvites", {
    inviteId: varchar("inviteId").primaryKey(),
    orgId: varchar("orgId")
@@ -630,40 +671,6 @@ export const resourceHeaderAuthExtendedCompatibility = pgTable(
    }
 );

-export const resourcePolicyPincode = pgTable("resourcePolicyPincode", {
-    pincodeId: serial("pincodeId").primaryKey(),
-    pincodeHash: varchar("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = pgTable("resourcePolicyPassword", {
-    passwordId: serial("passwordId").primaryKey(),
-    passwordHash: varchar("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = pgTable("resourcePolicyHeaderAuth", {
-    headerAuthId: serial("headerAuthId").primaryKey(),
-    headerAuthHash: varchar("headerAuthHash").notNull(),
-    extendedCompatibility: boolean("extendedCompatibility")
-        .notNull()
-        .default(true),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const resourceAccessToken = pgTable("resourceAccessToken", {
    accessTokenId: varchar("accessTokenId").primaryKey(),
    orgId: varchar("orgId")
@@ -757,43 +764,6 @@ export const resourceRules = pgTable("resourceRules", {
    value: varchar("value").notNull()
 });

-export const resourcePolicyRules = pgTable("resourcePolicyRules", {
-    ruleId: serial("ruleId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: boolean("enabled").notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: varchar("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: varchar("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: varchar("value").notNull()
-});
-
-export const resourcePolicies = pgTable("resourcePolicies", {
-    resourcePolicyId: serial("resourcePolicyId").primaryKey(),
-    sso: boolean("sso").notNull().default(true),
-    applyRules: boolean("applyRules").notNull().default(false),
-    scope: varchar("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: boolean("emailWhitelistEnabled")
-        .notNull()
-        .default(false),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    niceId: text("niceId").notNull(),
-    name: varchar("name").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = pgTable("supporterKey", {
    keyId: serial("keyId").primaryKey(),
    key: varchar("key").notNull(),
@@ -1305,6 +1275,4 @@ export type RoundTripMessageTracker = InferSelectModel<
 >;
 export type Network = InferSelectModel<typeof networks>;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;
+export type Label = InferSelectModel<typeof labels>;
--- a/server/db/queries/verifySessionQueries.ts
+++ b/server/db/queries/verifySessionQueries.ts
@@ -17,13 +17,10 @@ import {
    resourceHeaderAuth,
    ResourceHeaderAuth,
    resourceRules,
-    resourcePolicyRules,
    resources,
    roleResources,
-    rolePolicies,
    sessions,
    userResources,
-    userPolicies,
    users,
    ResourceHeaderAuthExtendedCompatibility,
    resourceHeaderAuthExtendedCompatibility
@@ -157,126 +154,58 @@ export async function getRoleName(roleId: number): Promise<string | null> {
 }

 /**
- * Check if role has access to resource (direct or via resource policy)
+ * Check if role has access to resource
 */
 export async function getRoleResourceAccess(
    resourceId: number,
    roleIds: number[]
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(roleResources)
-            .where(
-                and(
-                    eq(roleResources.resourceId, resourceId),
-                    inArray(roleResources.roleId, roleIds)
-                )
-            ),
-        db
-            .select({
-                roleId: rolePolicies.roleId,
-                resourcePolicyId: rolePolicies.resourcePolicyId
-            })
-            .from(rolePolicies)
-            .innerJoin(
-                resources,
-                eq(resources.resourcePolicyId, rolePolicies.resourcePolicyId)
+    const roleResourceAccess = await db
+        .select()
+        .from(roleResources)
+        .where(
+            and(
+                eq(roleResources.resourceId, resourceId),
+                inArray(roleResources.roleId, roleIds)
            )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    inArray(rolePolicies.roleId, roleIds)
-                )
-            )
-    ]);
+        );

-    const combined = [...direct, ...viaPolicies];
-    return combined.length > 0 ? combined : null;
+    return roleResourceAccess.length > 0 ? roleResourceAccess : null;
 }

 /**
- * Check if user has access to resource (direct or via resource policy)
+ * Check if user has direct access to resource
 */
 export async function getUserResourceAccess(
    userId: string,
    resourceId: number
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(userResources)
-            .where(
-                and(
-                    eq(userResources.userId, userId),
-                    eq(userResources.resourceId, resourceId)
-                )
+    const userResourceAccess = await db
+        .select()
+        .from(userResources)
+        .where(
+            and(
+                eq(userResources.userId, userId),
+                eq(userResources.resourceId, resourceId)
            )
-            .limit(1),
-        db
-            .select({
-                userId: userPolicies.userId,
-                resourcePolicyId: userPolicies.resourcePolicyId
-            })
-            .from(userPolicies)
-            .innerJoin(
-                resources,
-                eq(resources.resourcePolicyId, userPolicies.resourcePolicyId)
-            )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(userPolicies.userId, userId)
-                )
-            )
-            .limit(1)
-    ]);
+        )
+        .limit(1);

-    return direct[0] ?? viaPolicies[0] ?? null;
+    return userResourceAccess.length > 0 ? userResourceAccess[0] : null;
 }

 /**
- * Get resource rules for a given resource (direct and via resource policy)
+ * Get resource rules for a given resource
 */
 export async function getResourceRules(
    resourceId: number
 ): Promise<ResourceRule[]> {
-    const [directRules, policyRules] = await Promise.all([
-        db
-            .select()
-            .from(resourceRules)
-            .where(eq(resourceRules.resourceId, resourceId)),
-        db
-            .select({
-                ruleId: resourcePolicyRules.ruleId,
-                resourceId: sql<number>`${resourceId}`,
-                enabled: resourcePolicyRules.enabled,
-                priority: resourcePolicyRules.priority,
-                action: resourcePolicyRules.action,
-                match: resourcePolicyRules.match,
-                value: resourcePolicyRules.value
-            })
-            .from(resourcePolicyRules)
-            .innerJoin(
-                resources,
-                eq(
-                    resources.resourcePolicyId,
-                    resourcePolicyRules.resourcePolicyId
-                )
-            )
-            .where(eq(resources.resourceId, resourceId))
-    ]);
+    const rules = await db
+        .select()
+        .from(resourceRules)
+        .where(eq(resourceRules.resourceId, resourceId));

-    const maxDirectPriority = directRules.reduce(
-        (max, r) => Math.max(max, r.priority),
-        0
-    );
-    const offsetPolicyRules = policyRules.map((r) => ({
-        ...r,
-        priority: maxDirectPriority + r.priority
-    }));
-
-    return [...directRules, ...offsetPolicyRules] as ResourceRule[];
+    return rules;
 }

 /**
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -121,16 +121,6 @@ export const sites = sqliteTable("sites", {

 export const resources = sqliteTable("resources", {
    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
    resourceGuid: text("resourceGuid", { length: 36 })
        .unique()
        .notNull()
@@ -193,6 +183,95 @@ export const resources = sqliteTable("resources", {
    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false)
 });

+export const labels = sqliteTable("labels", {
+    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
+    name: text("name").notNull(),
+    color: text("color").notNull(),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull()
+});
+
+export const siteLabels = sqliteTable(
+    "siteLabels",
+    {
+        siteLabelId: integer("siteLabelId").primaryKey({ autoIncrement: true }),
+        siteId: integer("siteId")
+            .references(() => sites.siteId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("site_label_uniq").on(t.siteId, t.labelId)]
+);
+
+export const resourceLabels = sqliteTable(
+    "resourceLabels",
+    {
+        resourceLabelId: integer("resourceLabelId").primaryKey({
+            autoIncrement: true
+        }),
+        resourceId: integer("resourceId")
+            .references(() => resources.resourceId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("resource_label_uniq").on(t.resourceId, t.labelId)]
+);
+
+export const siteResourceLabels = sqliteTable(
+    "siteResourceLabels",
+    {
+        siteResourceLabelId: integer("siteResourceLabelId").primaryKey({
+            autoIncrement: true
+        }),
+        siteResourceId: integer("siteResourceId")
+            .references(() => siteResources.siteResourceId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("site_resource_label_uniq").on(t.siteResourceId, t.labelId)]
+);
+
+export const clientLabels = sqliteTable(
+    "clientLabels",
+    {
+        clientLabelId: integer("clientLabelId").primaryKey({
+            autoIncrement: true
+        }),
+        clientId: integer("clientId")
+            .references(() => clients.clientId, {
+                onDelete: "cascade"
+            })
+            .notNull(),
+        labelId: integer("labelId")
+            .references(() => labels.labelId, {
+                onDelete: "cascade"
+            })
+            .notNull()
+    },
+    (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
+);
+
 export const targets = sqliteTable("targets", {
    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
    resourceId: integer("resourceId")
@@ -921,47 +1000,6 @@ export const resourceHeaderAuth = sqliteTable("resourceHeaderAuth", {
    headerAuthHash: text("headerAuthHash").notNull()
 });

-export const resourcePolicyPincode = sqliteTable("resourcePolicyPincode", {
-    pincodeId: integer("pincodeId").primaryKey({ autoIncrement: true }),
-    pincodeHash: text("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = sqliteTable("resourcePolicyPassword", {
-    passwordId: integer("passwordId").primaryKey({ autoIncrement: true }),
-    passwordHash: text("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = sqliteTable(
-    "resourcePolicyHeaderAuth",
-    {
-        headerAuthId: integer("headerAuthId").primaryKey({
-            autoIncrement: true
-        }),
-        headerAuthHash: text("headerAuthHash").notNull(),
-        extendedCompatibility: integer("extendedCompatibility", {
-            mode: "boolean"
-        })
-            .notNull()
-            .default(true),
-        resourcePolicyId: integer("resourcePolicyId")
-            .notNull()
-            .references(() => resourcePolicies.resourcePolicyId, {
-                onDelete: "cascade"
-            })
-    }
-);
-
 export const resourceHeaderAuthExtendedCompatibility = sqliteTable(
    "resourceHeaderAuthExtendedCompatibility",
    {
@@ -1076,77 +1114,6 @@ export const resourceRules = sqliteTable("resourceRules", {
    value: text("value").notNull()
 });

-export const rolePolicies = sqliteTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = sqliteTable("userPolicies", {
-    userId: text("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = sqliteTable("resourcePolicyWhitelist", {
-    whitelistId: integer("id").primaryKey({ autoIncrement: true }),
-    email: text("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
-    ruleId: integer("ruleId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: text("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: text("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: text("value").notNull()
-});
-
-export const resourcePolicies = sqliteTable("resourcePolicies", {
-    resourcePolicyId: integer("resourcePolicyId").primaryKey(),
-    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    applyRules: integer("applyRules", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    scope: text("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    niceId: text("niceId").notNull(),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    name: text("name").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = sqliteTable("supporterKey", {
    keyId: integer("keyId").primaryKey({ autoIncrement: true }),
    key: text("key").notNull(),
@@ -1413,6 +1380,4 @@ export type RoundTripMessageTracker = InferSelectModel<
    typeof roundTripMessageTracker
 >;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;
+export type Label = InferSelectModel<typeof labels>;
--- a/server/lib/billing/tierMatrix.ts
+++ b/server/lib/billing/tierMatrix.ts
@@ -25,10 +25,11 @@ export enum TierFeature {
    StandaloneHealthChecks = "standaloneHealthChecks",
    AlertingRules = "alertingRules",
    WildcardSubdomain = "wildcardSubdomain",
-    ResourcePolicies = "resourcePolicies"
+    Labels = "labels"
 }

 export const tierMatrix: Record<TierFeature, Tier[]> = {
+    [TierFeature.Labels]: ["tier2", "tier3", "enterprise"],
    [TierFeature.OrgOidc]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.LoginPageDomain]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.DeviceApprovals]: ["tier1", "tier3", "enterprise"],
@@ -67,6 +68,5 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
    [TierFeature.DomainNamespaces]: ["tier1", "tier2", "tier3", "enterprise"],
    [TierFeature.StandaloneHealthChecks]: ["tier3", "enterprise"],
    [TierFeature.AlertingRules]: ["tier3", "enterprise"],
-    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
-    [TierFeature.ResourcePolicies]: ["tier3", "enterprise"]
+    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"]
 };
--- a/server/lib/blueprints/proxyResources.ts
+++ b/server/lib/blueprints/proxyResources.ts
--- a/server/lib/blueprints/types.ts
+++ b/server/lib/blueprints/types.ts
@@ -162,10 +162,9 @@ export const HeaderSchema = z.object({
 });

 // Schema for individual resource
-export const PublicResourceSchema = z
+export const ResourceSchema = z
    .object({
        name: z.string().optional(),
-        policy: z.string().optional(),
        protocol: z.enum(["http", "tcp", "udp"]).optional(),
        ssl: z.boolean().optional(),
        scheme: z.enum(["http", "https"]).optional(),
@@ -341,8 +340,7 @@ export const PublicResourceSchema = z
            if (parts.includes("*", 1)) return false; // no further wildcards
            if (parts.length < 3) return false; // need at least *.label.tld

-            const labelRegex =
-                /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
+            const labelRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
            return parts.slice(1).every((label) => labelRegex.test(label));
        },
        {
@@ -356,7 +354,7 @@ export function isTargetsOnlyResource(resource: any): boolean {
    return Object.keys(resource).length === 1 && resource.targets;
 }

-export const PrivateResourceSchema = z
+export const ClientResourceSchema = z
    .object({
        name: z.string().min(1).max(255),
        mode: z.enum(["host", "cidr", "http"]),
@@ -437,19 +435,19 @@ export const PrivateResourceSchema = z
 export const ConfigSchema = z
    .object({
        "proxy-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
            .optional()
            .prefault({}),
        "public-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
            .optional()
            .prefault({}),
        "client-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
            .optional()
            .prefault({}),
        "private-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
            .optional()
            .prefault({}),
        sites: z.record(z.string(), SiteSchema).optional().prefault({})
@@ -474,13 +472,10 @@ export const ConfigSchema = z
        }

        return data as {
-            "proxy-resources": Record<
-                string,
-                z.infer<typeof PublicResourceSchema>
-            >;
+            "proxy-resources": Record<string, z.infer<typeof ResourceSchema>>;
            "client-resources": Record<
                string,
-                z.infer<typeof PrivateResourceSchema>
+                z.infer<typeof ClientResourceSchema>
            >;
            sites: Record<string, z.infer<typeof SiteSchema>>;
        };
@@ -619,5 +614,5 @@ export const ConfigSchema = z
 // Type inference from the schema
 export type Site = z.infer<typeof SiteSchema>;
 export type Target = z.infer<typeof TargetSchema>;
-export type Resource = z.infer<typeof PublicResourceSchema>;
+export type Resource = z.infer<typeof ResourceSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
--- a/server/lib/rebuildClientAssociations.ts
+++ b/server/lib/rebuildClientAssociations.ts
@@ -20,9 +20,7 @@ import {
 } from "@server/db";
 import { and, eq, inArray, ne } from "drizzle-orm";

-import {
-    deletePeer as newtDeletePeer
-} from "@server/routers/newt/peers";
+import { deletePeer as newtDeletePeer } from "@server/routers/newt/peers";
 import {
    initPeerAddHandshake,
    deletePeer as olmDeletePeer
@@ -33,7 +31,7 @@ import {
    generateAliasConfig,
    generateRemoteSubnets,
    generateSubnetProxyTargetV2,
-    parseEndpoint,
+    parseEndpoint
 } from "@server/lib/ip";
 import {
    addPeerData,
@@ -51,10 +49,7 @@ export async function getClientSiteResourceAccess(
        ? await trx
              .select()
              .from(sites)
-              .innerJoin(
-                  siteNetworks,
-                  eq(siteNetworks.siteId, sites.siteId)
-              )
+              .innerJoin(siteNetworks, eq(siteNetworks.siteId, sites.siteId))
              .where(eq(siteNetworks.networkId, siteResource.networkId))
              .then((rows) => rows.map((row) => row.sites))
        : [];
@@ -362,7 +357,8 @@ export async function rebuildClientAssociationsFromSiteResource(
                      .where(inArray(clients.clientId, existingClientSiteIds))
                : [];

-        const otherResourceClientIds = clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();
+        const otherResourceClientIds =
+            clientsFromOtherResourcesBySite.get(siteId) ?? new Set<number>();

        logger.debug(
            `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] siteId=${siteId} otherResourceClientIds=[${[...otherResourceClientIds].join(", ")}] mergedAllClientIds=[${mergedAllClientIds.join(", ")}]`
@@ -709,7 +705,7 @@ export async function updateClientSiteDestinations(
            sourcePort: destination.sourcePort,
            destinations: destination.destinations
        };
-        logger.info(
+        logger.debug(
            `Payload for update-destinations: ${JSON.stringify(payload, null, 2)}`
        );

--- a/server/middlewares/index.ts
+++ b/server/middlewares/index.ts
@@ -32,4 +32,3 @@ export * from "./verifySiteResourceAccess";
 export * from "./logActionAudit";
 export * from "./verifyOlmAccess";
 export * from "./verifyLimits";
-export * from "./verifyResourcePolicyAccess";
--- a/server/middlewares/integration/index.ts
+++ b/server/middlewares/integration/index.ts
@@ -16,4 +16,3 @@ export * from "./verifyApiKeyClientAccess";
 export * from "./verifyApiKeySiteResourceAccess";
 export * from "./verifyApiKeyIdpAccess";
 export * from "./verifyApiKeyDomainAccess";
-export * from "./verifyApiKeyResourcePolicyAccess";
--- a/server/middlewares/integration/verifyApiKeyResourcePolicyAccess.ts
+++ b/server/middlewares/integration/verifyApiKeyResourcePolicyAccess.ts
@@ -1,92 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, apiKeyOrg } from "@server/db";
-import { eq, and } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-
-export async function verifyApiKeyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const apiKey = req.apiKey;
-    const resourcePolicyId =
-        req.params.resourcePolicyId ||
-        req.body.resourcePolicyId ||
-        req.query.resourcePolicyId;
-
-    if (!apiKey) {
-        return next(
-            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
-        );
-    }
-
-    try {
-        // Retrieve the resource policy
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        if (apiKey.isRoot) {
-            // Root keys can access any resource policy in any org
-            return next();
-        }
-
-        if (!policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    `Resource policy with ID ${resourcePolicyId} does not have an organization ID`
-                )
-            );
-        }
-
-        // Verify that the API key is linked to the resource policy's organization
-        if (!req.apiKeyOrg) {
-            const apiKeyOrgResult = await db
-                .select()
-                .from(apiKeyOrg)
-                .where(
-                    and(
-                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
-                        eq(apiKeyOrg.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-
-            if (apiKeyOrgResult.length > 0) {
-                req.apiKeyOrg = apiKeyOrgResult[0];
-            }
-        }
-
-        if (!req.apiKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Key does not have access to this organization"
-                )
-            );
-        }
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}
--- a/server/middlewares/verifyResourcePolicyAccess.ts
+++ b/server/middlewares/verifyResourcePolicyAccess.ts
@@ -1,127 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, userOrgs } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
-import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-
-export async function verifyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const userId = req.user!.userId;
-    const resourcePolicyIdStr =
-        req.params?.resourcePolicyId ||
-        req.body?.resourcePolicyId ||
-        req.query?.resourcePolicyId;
-    const niceId = req.params?.niceId || req.body?.niceId || req.query?.niceId;
-    const orgId = req.params?.orgId || req.body?.orgId || req.query?.orgId;
-
-    try {
-        if (!userId) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
-            );
-        }
-
-        let policy: typeof resourcePolicies.$inferSelect | null = null;
-
-        if (orgId && niceId) {
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    and(
-                        eq(resourcePolicies.niceId, niceId),
-                        eq(resourcePolicies.orgId, orgId)
-                    )
-                )
-                .limit(1);
-            policy = policyRes ?? null;
-        } else {
-            const resourcePolicyId = parseInt(resourcePolicyIdStr);
-            if (isNaN(resourcePolicyId)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid resource policy ID"
-                    )
-                );
-            }
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-                .limit(1);
-            policy = policyRes ?? null;
-        }
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyIdStr ?? niceId} not found`
-                )
-            );
-        }
-
-        if (!req.userOrg) {
-            const userOrgRes = await db
-                .select()
-                .from(userOrgs)
-                .where(
-                    and(
-                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-            req.userOrg = userOrgRes[0];
-        }
-
-        if (!req.userOrg || req.userOrg.orgId !== policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        if (req.orgPolicyAllowed === undefined && req.userOrg.orgId) {
-            const policyCheck = await checkOrgAccessPolicy({
-                orgId: req.userOrg.orgId,
-                userId,
-                session: req.session
-            });
-            req.orgPolicyAllowed = policyCheck.allowed;
-            if (!policyCheck.allowed || policyCheck.error) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
-                    )
-                );
-            }
-        }
-
-        req.userOrgRoleIds = await getUserOrgRoleIds(
-            req.userOrg.userId,
-            policy.orgId
-        );
-        req.userOrgId = policy.orgId;
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}
--- a/server/middlewares/verifyUserCanSetUserOrgRoles.ts
+++ b/server/middlewares/verifyUserCanSetUserOrgRoles.ts
@@ -38,7 +38,7 @@ export function verifyUserCanSetUserOrgRoles() {
            return next(
                createHttpError(
                    HttpCode.FORBIDDEN,
-                    "User does not have permission to set user organization roles"
+                    "User does not have permission perform this action"
                )
            );
        } catch (error) {
--- a/server/openApi.ts
+++ b/server/openApi.ts
@@ -7,7 +7,6 @@ export enum OpenAPITags {
    Org = "Organization",
    PublicResource = "Public Resource",
    PrivateResource = "Private Resource",
-    Policy = "Policy",
    Role = "Role",
    User = "User",
    Invitation = "User Invitation",
--- a/server/private/lib/logStreaming/index.ts
+++ b/server/private/lib/logStreaming/index.ts
@@ -24,7 +24,8 @@ import { LogStreamingManager } from "./LogStreamingManager";
 */
 export const logStreamingManager = new LogStreamingManager();

-if (build != "saas") { // this is handled separately in the saas build, so we don't want to start it here
+if (build !== "saas") {
+    // this is handled separately in the saas build, so we don't want to start it here
    logStreamingManager.start();
 }

--- a/server/private/middlewares/verifySubscription.ts
+++ b/server/private/middlewares/verifySubscription.ts
@@ -25,7 +25,7 @@ export function verifyValidSubscription(tiers: Tier[]) {
        next: NextFunction
    ): Promise<any> {
        try {
-            if (build != "saas") {
+            if (build !== "saas") {
                return next();
            }

--- a/server/private/routers/external.ts
+++ b/server/private/routers/external.ts
@@ -31,8 +31,7 @@ import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
-import * as resource from "#private/routers/resource";
-import * as policy from "#private/routers/policy";
+import * as labels from "#private/routers/labels";

 import {
    verifyOrgAccess,
@@ -46,8 +45,7 @@ import {
    verifyUserCanSetUserOrgRoles,
    verifySiteProvisioningKeyAccess,
    verifyIsLoggedInUser,
-    verifyAdmin,
-    verifyResourcePolicyAccess
+    verifyAdmin
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import {
@@ -385,39 +383,6 @@ authenticated.get(
    approval.countApprovals
 );

-authenticated.delete(
-    "/resource-policy/:resourcePolicyId",
-    verifyResourcePolicyAccess,
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.deleteResourcePolicy),
-    logActionAudit(ActionsEnum.deleteResourcePolicy),
-    policy.deleteResourcePolicy
-);
-
-authenticated.get(
-    "/org/:orgId/resource-policies",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.listResourcePolicies),
-    logActionAudit(ActionsEnum.listResourcePolicies),
-    policy.listResourcePolicies
-);
-
-authenticated.post(
-    "/org/:orgId/resource-policy",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.createResourcePolicy),
-    logActionAudit(ActionsEnum.createResourcePolicy),
-    policy.createResourcePolicy
-);
-
 authenticated.put(
    "/org/:orgId/approvals/:approvalId",
    verifyValidLicense,
@@ -768,6 +733,59 @@ authenticated.get(
    alertRule.getAlertRule
 );

+authenticated.get(
+    "/org/:orgId/labels",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyValidSubscription(tierMatrix.labels),
+    verifyUserHasAction(ActionsEnum.listOrgLabels),
+    labels.listOrgLabels
+);
+
+authenticated.post(
+    "/org/:orgId/labels",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyValidSubscription(tierMatrix.labels),
+    verifyUserHasAction(ActionsEnum.createOrgLabel),
+    labels.createOrgLabel
+);
+
+authenticated.patch(
+    "/org/:orgId/label/:labelId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyValidSubscription(tierMatrix.labels),
+    verifyUserHasAction(ActionsEnum.updateOrgLabel),
+    labels.updateOrgLabel
+);
+
+authenticated.delete(
+    "/org/:orgId/label/:labelId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.deleteOrgLabel),
+    labels.deleteOrgLabel
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/attach",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyValidSubscription(tierMatrix.labels),
+    verifyUserHasAction(ActionsEnum.attachLabelToItem),
+    labels.attachLabelToItem
+);
+
+authenticated.put(
+    "/org/:orgId/label/:labelId/detach",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyValidSubscription(tierMatrix.labels),
+    verifyUserHasAction(ActionsEnum.detachLabelFromItem),
+    labels.detachLabelFromItem
+);
+
 authenticated.get(
    "/org/:orgId/health-checks",
    verifyValidLicense,
--- a/server/private/routers/hybrid.ts
+++ b/server/private/routers/hybrid.ts
@@ -45,11 +45,8 @@ import {
    users,
    userOrgs,
    roleResources,
-    rolePolicies,
    userResources,
-    userPolicies,
    resourceRules,
-    resourcePolicyRules,
    userOrgRoles,
    roles
 } from "@server/db";
@@ -433,10 +430,7 @@ hybridRouter.get(
                );

                // Decrypt and save key file
-                const decryptedKey = decrypt(
-                    cert.keyFile!,
-                    config.getRawConfig().server.secret!
-                );
+                const decryptedKey = decrypt(cert.keyFile!, config.getRawConfig().server.secret!);

                // Return only the certificate data without org information
                return {
@@ -537,10 +531,7 @@ hybridRouter.get(
                        wildcardCandidates.length > 0
                            ? and(
                                  eq(resources.wildcard, true),
-                                  inArray(
-                                      resources.fullDomain,
-                                      wildcardCandidates
-                                  )
+                                  inArray(resources.fullDomain, wildcardCandidates)
                              )
                            : sql`false`
                    )
@@ -554,10 +545,10 @@ hybridRouter.get(

            if (
                result &&
-                (await checkExitNodeOrg(
+                await checkExitNodeOrg(
                    remoteExitNode.exitNodeId,
                    result.resources.orgId
-                ))
+                )
            ) {
                // If the exit node is not allowed for the org, return an error
                return next(
@@ -1141,43 +1132,22 @@ hybridRouter.get(
                );
            }

-            const [direct, viaPolicies] = await Promise.all([
-                db
-                    .select()
-                    .from(roleResources)
-                    .where(
-                        and(
-                            eq(roleResources.resourceId, resourceId),
-                            eq(roleResources.roleId, roleId)
-                        )
+            const roleResourceAccess = await db
+                .select()
+                .from(roleResources)
+                .where(
+                    and(
+                        eq(roleResources.resourceId, resourceId),
+                        eq(roleResources.roleId, roleId)
                    )
-                    .limit(1),
-                db
-                    .select({
-                        roleId: rolePolicies.roleId,
-                        resourcePolicyId: rolePolicies.resourcePolicyId
-                    })
-                    .from(rolePolicies)
-                    .innerJoin(
-                        resources,
-                        eq(
-                            resources.resourcePolicyId,
-                            rolePolicies.resourcePolicyId
-                        )
-                    )
-                    .where(
-                        and(
-                            eq(resources.resourceId, resourceId),
-                            eq(rolePolicies.roleId, roleId)
-                        )
-                    )
-                    .limit(1)
-            ]);
+                )
+                .limit(1);

-            const result = direct[0] ?? viaPolicies[0] ?? null;
+            const result =
+                roleResourceAccess.length > 0 ? roleResourceAccess[0] : null;

            return response<typeof roleResources.$inferSelect | null>(res, {
-                data: result as any,
+                data: result,
                success: true,
                error: false,
                message: result
@@ -1252,44 +1222,21 @@ hybridRouter.get(
                );
            }

-            const [direct, viaPolicies] = await Promise.all([
-                db
-                    .select({
-                        resourceId: roleResources.resourceId,
-                        roleId: roleResources.roleId
-                    })
-                    .from(roleResources)
-                    .where(
-                        and(
-                            eq(roleResources.resourceId, resourceId),
-                            inArray(roleResources.roleId, roleIds)
-                        )
-                    ),
-                roleIds.length > 0
-                    ? db
-                          .select({
-                              resourceId: sql<number>`${resourceId}`,
-                              roleId: rolePolicies.roleId
-                          })
-                          .from(rolePolicies)
-                          .innerJoin(
-                              resources,
-                              eq(
-                                  resources.resourcePolicyId,
-                                  rolePolicies.resourcePolicyId
-                              )
-                          )
-                          .where(
-                              and(
-                                  eq(resources.resourceId, resourceId),
-                                  inArray(rolePolicies.roleId, roleIds)
-                              )
-                          )
-                    : Promise.resolve([])
-            ]);
+            const roleResourceAccess = await db
+                .select({
+                    resourceId: roleResources.resourceId,
+                    roleId: roleResources.roleId
+                })
+                .from(roleResources)
+                .where(
+                    and(
+                        eq(roleResources.resourceId, resourceId),
+                        inArray(roleResources.roleId, roleIds)
+                    )
+                );

-            const combined = [...direct, ...viaPolicies];
-            const result = combined.length > 0 ? combined : null;
+            const result =
+                roleResourceAccess.length > 0 ? roleResourceAccess : null;

            return response<{ resourceId: number; roleId: number }[] | null>(
                res,
@@ -1450,45 +1397,10 @@ hybridRouter.get(
                );
            }

-            const [directRules, policyRules] = await Promise.all([
-                db
-                    .select()
-                    .from(resourceRules)
-                    .where(eq(resourceRules.resourceId, resourceId)),
-                db
-                    .select({
-                        ruleId: resourcePolicyRules.ruleId,
-                        resourceId: sql<number>`${resourceId}`,
-                        enabled: resourcePolicyRules.enabled,
-                        priority: resourcePolicyRules.priority,
-                        action: resourcePolicyRules.action,
-                        match: resourcePolicyRules.match,
-                        value: resourcePolicyRules.value
-                    })
-                    .from(resourcePolicyRules)
-                    .innerJoin(
-                        resources,
-                        eq(
-                            resources.resourcePolicyId,
-                            resourcePolicyRules.resourcePolicyId
-                        )
-                    )
-                    .where(eq(resources.resourceId, resourceId))
-            ]);
-
-            const maxDirectPriority = directRules.reduce(
-                (max, r) => Math.max(max, r.priority),
-                0
-            );
-            const offsetPolicyRules = policyRules.map((r) => ({
-                ...r,
-                priority: maxDirectPriority + r.priority
-            }));
-
-            const rules = [
-                ...directRules,
-                ...offsetPolicyRules
-            ] as (typeof resourceRules.$inferSelect)[];
+            const rules = await db
+                .select()
+                .from(resourceRules)
+                .where(eq(resourceRules.resourceId, resourceId));

            // backward compatibility: COUNTRY -> GEOIP
            // TODO: remove this after a few versions once all exit nodes are updated
--- a/server/private/routers/labels/attachLabelToItem.ts
+++ b/server/private/routers/labels/attachLabelToItem.ts
@@ -0,0 +1,224 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import {
+    clients,
+    clientLabels,
+    db,
+    labels,
+    resourceLabels,
+    resources,
+    siteLabels,
+    siteResourceLabels,
+    siteResources,
+    sites
+} from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq, isNull } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    labelId: z.string().transform(Number).pipe(z.int().positive())
+});
+
+const attachLabelBodySchema = z.strictObject({
+    siteId: z.number().int().optional(),
+    resourceId: z.number().int().optional(),
+    siteResourceId: z.number().int().optional(),
+    clientId: z.number().int().optional()
+});
+
+export async function attachLabelToItem(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, labelId } = parsedParams.data;
+
+        const parsedBody = attachLabelBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { siteId, resourceId, siteResourceId, clientId } =
+            parsedBody.data;
+
+        if (!siteId && !resourceId && !siteResourceId && !clientId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "At least one of `siteId`, `resourceId`, `siteResourceId` or `clientId` should be provided."
+                )
+            );
+        }
+
+        const [existing] = await db
+            .select()
+            .from(labels)
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Label with Id ${labelId} not found`
+                )
+            );
+        }
+
+        if (siteId) {
+            const siteCount = await db.$count(
+                sites,
+                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
+            );
+
+            if (siteCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Site with Id ${siteId} doesn't exist.`
+                    )
+                );
+            }
+
+            // idempotent, calling this endpoint multiple times should attach the label only once
+            await db
+                .insert(siteLabels)
+                .values({
+                    labelId,
+                    siteId
+                })
+                .onConflictDoNothing();
+        }
+
+        if (resourceId) {
+            const resourceCount = await db.$count(
+                resources,
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(resources.orgId, orgId)
+                )
+            );
+
+            if (resourceCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource with Id ${resourceId} doesn't exist.`
+                    )
+                );
+            }
+
+            // idempotent, calling this endpoint multiple times should attach the label only once
+            await db
+                .insert(resourceLabels)
+                .values({
+                    labelId,
+                    resourceId
+                })
+                .onConflictDoNothing();
+        }
+
+        if (siteResourceId) {
+            const resourceCount = await db.$count(
+                siteResources,
+                and(
+                    eq(siteResources.siteResourceId, siteResourceId),
+                    eq(siteResources.orgId, orgId)
+                )
+            );
+
+            if (resourceCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `SiteResource with Id ${siteResourceId} doesn't exist.`
+                    )
+                );
+            }
+
+            // idempotent, calling this endpoint multiple times should attach the label only once
+            await db
+                .insert(siteResourceLabels)
+                .values({
+                    labelId,
+                    siteResourceId
+                })
+                .onConflictDoNothing();
+        }
+
+        if (clientId) {
+            const clientCount = await db.$count(
+                clients,
+                and(
+                    eq(clients.clientId, clientId),
+                    eq(clients.orgId, orgId),
+                    isNull(clients.userId)
+                )
+            );
+
+            if (clientCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Client with Id ${clientId} doesn't exist.`
+                    )
+                );
+            }
+
+            // idempotent, calling this endpoint multiple times should attach the label only once
+            await db
+                .insert(clientLabels)
+                .values({
+                    labelId,
+                    clientId
+                })
+                .onConflictDoNothing();
+        }
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Label attached successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/labels/createOrgLabel.ts
+++ b/server/private/routers/labels/createOrgLabel.ts
@@ -0,0 +1,149 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+import {
+    db,
+    labels,
+    resourceLabels,
+    resources,
+    siteLabels,
+    sites
+} from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const bodySchema = z.strictObject({
+    name: z.string().nonempty(),
+    color: z
+        .string()
+        .regex(/^#?([0-9a-f]{6}|[0-9a-f]{3})$/i)
+        .nonempty(),
+    siteId: z.number().int().optional(),
+    resourceId: z.number().int().optional()
+});
+
+export async function createOrgLabel(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { name, color, siteId, resourceId } = parsedBody.data;
+
+        if (siteId) {
+            const siteCount = await db.$count(
+                sites,
+                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
+            );
+
+            if (siteCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        `Site with Id ${siteId} doesn't exist.`
+                    )
+                );
+            }
+        }
+
+        if (resourceId) {
+            const resourceCount = await db.$count(
+                resources,
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(resources.orgId, orgId)
+                )
+            );
+
+            if (resourceCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        `Resource with Id ${resourceId} doesn't exist.`
+                    )
+                );
+            }
+        }
+
+        const label = await db.transaction(async (tx) => {
+            const [label] = await tx
+                .insert(labels)
+                .values({
+                    name,
+                    color,
+                    orgId
+                })
+                .returning();
+
+            if (siteId) {
+                await tx.insert(siteLabels).values({
+                    siteId,
+                    labelId: label.labelId
+                });
+            }
+
+            if (resourceId) {
+                await tx.insert(resourceLabels).values({
+                    resourceId,
+                    labelId: label.labelId
+                });
+            }
+            return label;
+        });
+
+        return response<CreateOrEditLabelResponse>(res, {
+            data: { label },
+            success: true,
+            error: false,
+            message: "Org Label created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/labels/deleteOrgLabel.ts
+++ b/server/private/routers/labels/deleteOrgLabel.ts
@@ -0,0 +1,72 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+import { db, labels } from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    labelId: z.string().transform(Number).pipe(z.int().positive())
+});
+
+export async function deleteOrgLabel(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, labelId } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(labels)
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
+
+        if (!existing) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "Label not found"));
+        }
+
+        await db
+            .delete(labels)
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Label deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/labels/detachLabelFromItem.ts
+++ b/server/private/routers/labels/detachLabelFromItem.ts
@@ -0,0 +1,224 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import {
+    clients,
+    clientLabels,
+    db,
+    labels,
+    resourceLabels,
+    resources,
+    siteLabels,
+    siteResourceLabels,
+    siteResources,
+    sites
+} from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq, isNull } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    labelId: z.string().transform(Number).pipe(z.int().positive())
+});
+
+const detachLabelBodySchema = z.strictObject({
+    siteId: z.number().int().optional(),
+    resourceId: z.number().int().optional(),
+    siteResourceId: z.number().int().optional(),
+    clientId: z.number().int().optional()
+});
+
+export async function detachLabelFromItem(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, labelId } = parsedParams.data;
+
+        const parsedBody = detachLabelBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { siteId, resourceId, siteResourceId, clientId } =
+            parsedBody.data;
+
+        if (!siteId && !resourceId && !siteResourceId && !clientId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "At least one of `siteId`, `resourceId`, `siteResourceId` or `clientId` should be provided."
+                )
+            );
+        }
+
+        const [existing] = await db
+            .select()
+            .from(labels)
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Label with Id ${labelId} not found`
+                )
+            );
+        }
+
+        if (siteId) {
+            const siteCount = await db.$count(
+                sites,
+                and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
+            );
+
+            if (siteCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Site with Id ${siteId} doesn't exist.`
+                    )
+                );
+            }
+
+            await db
+                .delete(siteLabels)
+                .where(
+                    and(
+                        eq(siteLabels.labelId, labelId),
+                        eq(siteLabels.siteId, siteId)
+                    )
+                );
+        }
+
+        if (resourceId) {
+            const resourceCount = await db.$count(
+                resources,
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(resources.orgId, orgId)
+                )
+            );
+
+            if (resourceCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource with Id ${resourceId} doesn't exist.`
+                    )
+                );
+            }
+
+            await db
+                .delete(resourceLabels)
+                .where(
+                    and(
+                        eq(resourceLabels.labelId, labelId),
+                        eq(resourceLabels.resourceId, resourceId)
+                    )
+                );
+        }
+
+        if (siteResourceId) {
+            const resourceCount = await db.$count(
+                siteResources,
+                and(
+                    eq(siteResources.siteResourceId, siteResourceId),
+                    eq(siteResources.orgId, orgId)
+                )
+            );
+
+            if (resourceCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `SiteResource with Id ${siteResourceId} doesn't exist.`
+                    )
+                );
+            }
+
+            await db
+                .delete(siteResourceLabels)
+                .where(
+                    and(
+                        eq(siteResourceLabels.labelId, labelId),
+                        eq(siteResourceLabels.siteResourceId, siteResourceId)
+                    )
+                );
+        }
+
+        if (clientId) {
+            const clientCount = await db.$count(
+                clients,
+                and(
+                    eq(clients.clientId, clientId),
+                    eq(clients.orgId, orgId),
+                    isNull(clients.userId)
+                )
+            );
+
+            if (clientCount === 0) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Client with Id ${clientId} doesn't exist.`
+                    )
+                );
+            }
+
+            await db
+                .delete(clientLabels)
+                .where(
+                    and(
+                        eq(clientLabels.labelId, labelId),
+                        eq(clientLabels.clientId, clientId)
+                    )
+                );
+        }
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Label detached successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/labels/index.ts
+++ b/server/private/routers/labels/index.ts
@@ -11,6 +11,9 @@
 * This file is not licensed under the AGPLv3.
 */

-export * from "./createResourcePolicy";
-export * from "./listResourcePolicies";
-export * from "./deleteResourcePolicy";
+export * from "./listOrgLabels";
+export * from "./createOrgLabel";
+export * from "./updateOrgLabel";
+export * from "./attachLabelToItem";
+export * from "./detachLabelFromItem";
+export * from "./deleteOrgLabel";
--- a/server/private/routers/labels/listOrgLabels.ts
+++ b/server/private/routers/labels/listOrgLabels.ts
@@ -0,0 +1,155 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { db, labels } from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import HttpCode from "@server/types/HttpCode";
+import { and, asc, eq, like, sql } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const listLabelsSchema = z.object({
+    pageSize: z.coerce
+        .number<string>() // for prettier formatting
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>() // for prettier formatting
+        .int()
+        .min(0)
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional()
+});
+
+function queryLabelsBase() {
+    return db
+        .select({
+            labelId: labels.labelId,
+            name: labels.name,
+            color: labels.color
+        })
+        .from(labels);
+}
+
+export async function listOrgLabels(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listLabelsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error)
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        if (req.user && orgId && orgId !== req.userOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        const { pageSize, page, query } = parsedQuery.data;
+
+        const conditions = [and(eq(labels.orgId, orgId))];
+
+        if (query) {
+            conditions.push(
+                like(
+                    sql`LOWER(${labels.name})`,
+                    "%" + query.toLowerCase() + "%"
+                )
+            );
+        }
+
+        const baseQuery = queryLabelsBase().where(and(...conditions));
+
+        // we need to add `as` so that drizzle filters the result as a subquery
+        const countQuery = db.$count(
+            queryLabelsBase()
+                .where(and(...conditions))
+                .as("filtered_labels")
+        );
+
+        const labelListQuery = baseQuery
+            .limit(pageSize)
+            .offset(pageSize * (page - 1))
+            .orderBy(asc(labels.name));
+
+        const [totalCount, rows] = await Promise.all([
+            countQuery,
+            labelListQuery
+        ]);
+
+        return response<ListOrgLabelsResponse>(res, {
+            data: {
+                labels: rows,
+                pagination: {
+                    total: totalCount,
+                    pageSize,
+                    page
+                }
+            },
+            success: true,
+            error: false,
+            message: "Labels retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/labels/updateOrgLabel.ts
+++ b/server/private/routers/labels/updateOrgLabel.ts
@@ -0,0 +1,101 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { db, labels } from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import type { CreateOrEditLabelResponse } from "@server/routers/labels/types";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    labelId: z.string().transform(Number).pipe(z.int().positive())
+});
+
+const updateLabelBodySchema = z.strictObject({
+    name: z.string().min(1).max(255).optional(),
+    color: z
+        .string()
+        .regex(/^#?([0-9a-f]{6}|[0-9a-f]{3})$/i)
+        .nonempty()
+});
+
+export async function updateOrgLabel(
+    req: Request,
+    res: Response,
+    next: NextFunction
+) {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, labelId } = parsedParams.data;
+
+        const parsedBody = updateLabelBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const [existing] = await db
+            .select()
+            .from(labels)
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)));
+
+        if (!existing) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "Label not found"));
+        }
+
+        const { name, color } = parsedBody.data;
+
+        const [label] = await db
+            .update(labels)
+            .set({
+                name,
+                color
+            })
+            .where(and(eq(labels.labelId, labelId), eq(labels.orgId, orgId)))
+            .returning();
+
+        return response<CreateOrEditLabelResponse>(res, {
+            data: {
+                label
+            },
+            success: true,
+            error: false,
+            message: "Label updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
--- a/server/private/routers/policy/createResourcePolicy.ts
+++ b/server/private/routers/policy/createResourcePolicy.ts
@@ -1,417 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { hashPassword } from "@server/auth/password";
-import {
-    db,
-    idp,
-    idpOrg,
-    orgs,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
-    resourcePolicyRules,
-    resourcePolicyWhiteList,
-    rolePolicies,
-    roles,
-    userOrgs,
-    userPolicies,
-    users,
-    type ResourcePolicy
-} from "@server/db";
-import { getUniqueResourcePolicyName } from "@server/db/names";
-import response from "@server/lib/response";
-import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
-} from "@server/lib/validators";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, type InferInsertModel } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const createResourcePolicyParamsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const ruleSchema = z.strictObject({
-    action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
-        type: "string",
-        enum: ["ACCEPT", "DROP", "PASS"],
-        description: "rule action"
-    }),
-    match: z.enum(["CIDR", "IP", "PATH"]).openapi({
-        type: "string",
-        enum: ["CIDR", "IP", "PATH"],
-        description: "rule match"
-    }),
-    value: z.string().min(1),
-    priority: z.int().openapi({
-        type: "integer",
-        description: "Rule priority"
-    }),
-    enabled: z.boolean().optional()
-});
-
-const createResourcePolicyBodySchema = z.strictObject({
-    name: z.string().min(1).max(255),
-    // Access control
-    sso: z.boolean().default(true),
-    skipToIdpId: z
-        .int()
-        .positive()
-        .optional()
-        .nullable()
-        .openapi({ type: "integer" }),
-    roleIds: z
-        .array(z.string().transform(Number).pipe(z.int().positive()))
-        .optional()
-        .default([]),
-    userIds: z.array(z.string()).optional().default([]),
-    // auth methods
-    password: z.string().min(4).max(100).nullable().optional(),
-    pincode: z
-        .string()
-        .regex(/^\d{6}$/)
-        .or(z.null())
-        .optional(),
-    headerAuth: z
-        .object({
-            user: z.string().min(4).max(100),
-            password: z.string().min(4).max(100),
-            extendedCompatibility: z.boolean()
-        })
-        .nullable()
-        .optional(),
-    // email OTP
-    emailWhitelistEnabled: z.boolean().optional().default(false),
-    emails: z
-        .array(
-            z.email().or(
-                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
-                    error: "Invalid email address. Wildcard (*) must be the entire local part."
-                })
-            )
-        )
-        .max(50)
-        .transform((v) => v.map((e) => e.toLowerCase()))
-        .optional()
-        .default([]),
-    // rules
-    applyRules: z.boolean().default(false),
-    rules: z.array(ruleSchema).optional().default([])
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/resource-policy",
-    description: "Create a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: createResourcePolicyParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createResourcePolicyBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function createResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        // Validate request params
-        const parsedParams = createResourcePolicyParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-        const { orgId } = parsedParams.data;
-
-        if (req.user && req.userOrgRoleIds?.length === 0) {
-            return next(
-                createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
-            );
-        }
-
-        // get the org
-        const org = await db
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId))
-            .limit(1);
-
-        if (org.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Organization with ID ${orgId} not found`
-                )
-            );
-        }
-
-        const parsedBody = createResourcePolicyBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const {
-            name,
-            sso,
-            userIds,
-            roleIds,
-            skipToIdpId,
-            applyRules,
-            emailWhitelistEnabled,
-            password,
-            pincode,
-            headerAuth,
-            emails,
-            rules
-        } = parsedBody.data;
-
-        // Check if Identity provider in `skipToIdpId` exists
-        if (skipToIdpId) {
-            const [provider] = await db
-                .select()
-                .from(idp)
-                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
-                .where(and(eq(idp.idpId, skipToIdpId), eq(idpOrg.orgId, orgId)))
-                .limit(1);
-
-            if (!provider) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Identity provider not found in this organization"
-                    )
-                );
-            }
-        }
-
-        const adminRole = await db
-            .select()
-            .from(roles)
-            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-            .limit(1);
-
-        if (adminRole.length === 0) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
-            );
-        }
-
-        const existingRoles = await db
-            .select()
-            .from(roles)
-            .where(and(inArray(roles.roleId, roleIds)));
-
-        const hasAdminRole = existingRoles.some((role) => role.isAdmin);
-
-        if (hasAdminRole) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Admin role cannot be assigned to resource policy"
-                )
-            );
-        }
-
-        const existingUsers = await db
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(userOrgs.userId, users.userId))
-            .where(
-                and(eq(userOrgs.orgId, orgId), inArray(users.userId, userIds))
-            );
-
-        const niceId = await getUniqueResourcePolicyName(orgId);
-
-        for (const rule of rules) {
-            if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            } else if (rule.match === "IP" && !isValidIP(rule.value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            } else if (
-                rule.match === "PATH" &&
-                !isValidUrlGlobPattern(rule.value)
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        }
-
-        const policy = await db.transaction(async (trx) => {
-            const [newPolicy] = await trx
-                .insert(resourcePolicies)
-                .values({
-                    niceId,
-                    orgId,
-                    name,
-                    sso,
-                    idpId: skipToIdpId,
-                    applyRules,
-                    emailWhitelistEnabled
-                })
-                .returning();
-
-            const rolesToAdd = [
-                {
-                    roleId: adminRole[0].roleId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }
-            ] satisfies InferInsertModel<typeof rolePolicies>[];
-
-            rolesToAdd.push(
-                ...existingRoles.map((role) => ({
-                    roleId: role.roleId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }))
-            );
-
-            await trx.insert(rolePolicies).values(rolesToAdd);
-
-            const usersToAdd: InferInsertModel<typeof userPolicies>[] = [];
-
-            if (
-                req.user &&
-                !req.userOrgRoleIds?.includes(adminRole[0].roleId)
-            ) {
-                // make sure the user can access the policy
-                usersToAdd.push({
-                    userId: req.user?.userId!,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                });
-            }
-
-            usersToAdd.push(
-                ...existingUsers.map(({ user }) => ({
-                    userId: user.userId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }))
-            );
-
-            if (usersToAdd.length > 0) {
-                await trx.insert(userPolicies).values(usersToAdd);
-            }
-
-            if (password) {
-                const passwordHash = await hashPassword(password);
-
-                await trx.insert(resourcePolicyPassword).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    passwordHash
-                });
-            }
-
-            if (pincode) {
-                const pincodeHash = await hashPassword(pincode);
-
-                await trx.insert(resourcePolicyPincode).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    pincodeHash,
-                    digitLength: 6
-                });
-            }
-
-            if (headerAuth) {
-                const headerAuthHash = await hashPassword(
-                    Buffer.from(
-                        `${headerAuth.user}:${headerAuth.password}`
-                    ).toString("base64")
-                );
-
-                await trx.insert(resourcePolicyHeaderAuth).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    headerAuthHash,
-                    extendedCompatibility: headerAuth.extendedCompatibility
-                });
-            }
-
-            if (emailWhitelistEnabled && emails.length > 0) {
-                await trx.insert(resourcePolicyWhiteList).values(
-                    emails.map((email) => ({
-                        email,
-                        resourcePolicyId: newPolicy.resourcePolicyId
-                    }))
-                );
-            }
-
-            if (rules.length > 0) {
-                await trx.insert(resourcePolicyRules).values(
-                    rules.map((rule) => ({
-                        resourcePolicyId: newPolicy.resourcePolicyId,
-                        ...rule
-                    }))
-                );
-            }
-
-            return newPolicy;
-        });
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Failed to create policy"
-                )
-            );
-        }
-        return response<ResourcePolicy>(res, {
-            data: policy,
-            success: true,
-            error: false,
-            message: "resource policy created successfully",
-            status: HttpCode.CREATED
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/policy/deleteResourcePolicy.ts
+++ b/server/private/routers/policy/deleteResourcePolicy.ts
@@ -1,107 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db, resourcePolicies, resources } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-// Define Zod schema for request parameters validation
-const deleteResourcePolicySchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Delete a resource policy.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: deleteResourcePolicySchema
-    },
-    responses: {}
-});
-
-export async function deleteResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = deleteResourcePolicySchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-
-        const [existingResource] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        if (!existingResource) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource Policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        const totalAffectedResources = await db.$count(
-            db
-                .select()
-                .from(resources)
-                .where(eq(resources.resourcePolicyId, resourcePolicyId))
-        );
-
-        if (totalAffectedResources > 0) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    `Cannot delete Policy '${existingResource.name}' as it's being used by at least one resource`
-                )
-            );
-        }
-
-        // delete policy
-        await db
-            .delete(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Resource Policy deleted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/policy/listResourcePolicies.ts
+++ b/server/private/routers/policy/listResourcePolicies.ts
@@ -1,271 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import {
-    db,
-    resourcePolicies,
-    resources,
-    rolePolicies,
-    userPolicies
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import type {
-    ListResourcePoliciesResponse,
-    ResourcePolicyWithResources
-} from "@server/routers/resource/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, asc, eq, inArray, like, or, sql } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromZodError } from "zod-validation-error";
-
-const listResourcePoliciesParamsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const listResourcePoliciesSchema = z.object({
-    pageSize: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .positive()
-        .optional()
-        .catch(20)
-        .default(20)
-        .openapi({
-            type: "integer",
-            default: 20,
-            description: "Number of items per page"
-        }),
-    page: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .min(0)
-        .optional()
-        .catch(1)
-        .default(1)
-        .openapi({
-            type: "integer",
-            default: 1,
-            description: "Page number to retrieve"
-        }),
-    query: z.string().optional()
-});
-
-function queryResourcePoliciesBase() {
-    return db
-        .select({
-            resourcePolicyId: resourcePolicies.resourcePolicyId,
-            name: resourcePolicies.name,
-            niceId: resourcePolicies.niceId,
-            orgId: resourcePolicies.orgId
-        })
-        .from(resourcePolicies);
-}
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/resource-policies",
-    description: "List resource policies for an organization.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            orgId: z.string()
-        }),
-        query: listResourcePoliciesSchema
-    },
-    responses: {}
-});
-
-export async function listResourcePolicies(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = listResourcePoliciesSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromZodError(parsedQuery.error)
-                )
-            );
-        }
-        const { page, pageSize, query } = parsedQuery.data;
-
-        const parsedParams = listResourcePoliciesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromZodError(parsedParams.error)
-                )
-            );
-        }
-
-        const orgId =
-            parsedParams.data.orgId ||
-            req.userOrg?.orgId ||
-            req.apiKeyOrg?.orgId;
-
-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
-        if (req.user && orgId && orgId !== req.userOrgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        let accessibleResourcePolicies: Array<{ resourcePolicyId: number }>;
-        if (req.user) {
-            accessibleResourcePolicies = await db
-                .select({
-                    resourcePolicyId: sql<number>`COALESCE(${userPolicies.resourcePolicyId}, ${rolePolicies.resourcePolicyId})`
-                })
-                .from(userPolicies)
-                .fullJoin(
-                    rolePolicies,
-                    eq(
-                        userPolicies.resourcePolicyId,
-                        rolePolicies.resourcePolicyId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userPolicies.userId, req.user!.userId),
-                        inArray(rolePolicies.roleId, req.userOrgRoleIds || [])
-                    )
-                );
-        } else {
-            accessibleResourcePolicies = await db
-                .select({
-                    resourcePolicyId: resourcePolicies.resourcePolicyId
-                })
-                .from(resourcePolicies)
-                .where(eq(resourcePolicies.orgId, orgId));
-        }
-
-        const accessibleResourceIds = accessibleResourcePolicies.map(
-            (resource) => resource.resourcePolicyId
-        );
-
-        const conditions = [
-            and(
-                inArray(
-                    resourcePolicies.resourcePolicyId,
-                    accessibleResourceIds
-                ),
-                eq(resourcePolicies.orgId, orgId),
-                eq(resourcePolicies.scope, "global")
-            )
-        ];
-
-        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${resourcePolicies.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${resourcePolicies.niceId})`,
-                        "%" + query.toLowerCase() + "%"
-                    )
-                )
-            );
-        }
-
-        const baseQuery = queryResourcePoliciesBase().where(and(...conditions));
-
-        // we need to add `as` so that drizzle filters the result as a subquery
-        const countQuery = db.$count(baseQuery.as("filtered_policies"));
-
-        const [rows, totalCount] = await Promise.all([
-            baseQuery
-                .limit(pageSize)
-                .offset(pageSize * (page - 1))
-                .orderBy(asc(resourcePolicies.resourcePolicyId)),
-            countQuery
-        ]);
-
-        const attachedResources =
-            rows.length === 0
-                ? []
-                : await db
-                      .select({
-                          resourceId: resources.resourceId,
-                          name: resources.name,
-                          fullDomain: resources.fullDomain,
-                          resourcePolicyId: resources.resourcePolicyId
-                      })
-                      .from(resources)
-                      .where(
-                          inArray(
-                              resources.resourcePolicyId,
-                              rows.map((row) => row.resourcePolicyId)
-                          )
-                      );
-
-        // avoids TS issues with reduce/never[]
-        const map = new Map<number, ResourcePolicyWithResources>();
-
-        for (const row of rows) {
-            let entry = map.get(row.resourcePolicyId);
-            if (!entry) {
-                entry = {
-                    ...row,
-                    resources: []
-                };
-                map.set(row.resourcePolicyId, entry);
-            }
-
-            entry.resources = attachedResources.filter(
-                (r) => r.resourcePolicyId === entry?.resourcePolicyId
-            );
-        }
-
-        const policiesList = Array.from(map.values());
-
-        return response<ListResourcePoliciesResponse>(res, {
-            data: {
-                policies: policiesList,
-                pagination: {
-                    total: totalCount,
-                    pageSize,
-                    page
-                }
-            },
-            success: true,
-            error: false,
-            message: "Resources retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/private/routers/remoteExitNode/exitNodeReconnectScheduler.ts
+++ b/server/private/routers/remoteExitNode/exitNodeReconnectScheduler.ts
@@ -0,0 +1,202 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import axios from "axios";
+import { db, exitNodes, newts, sites } from "@server/db";
+import { eq } from "drizzle-orm";
+import logger from "@server/logger";
+import redisManager from "#private/lib/redis";
+import { sendToClient } from "#private/routers/ws";
+
+const INITIAL_DELAY_MS = 15 * 1000; // 15 seconds before first check
+const CHECK_INTERVAL_MS = 10 * 1000; // Check every 10 seconds
+const MAX_DURATION_MS = 5 * 60 * 1000; // Give up after 5 minutes
+const REDIS_PENDING_SET = "exit-node-reconnect-pending";
+const REDIS_HASH_PREFIX = "exit-node-reconnect:";
+
+interface PendingReconnect {
+    startTime: number;
+    reachableAt: string;
+}
+
+// In-memory tracking for this node
+const pendingReconnects = new Map<number, PendingReconnect>();
+
+let schedulerInterval: NodeJS.Timeout | null = null;
+
+/**
+ * Schedules a reconnect check for newts connected to the given exit node.
+ * Called when an exit node transitions from offline to online.
+ */
+export async function scheduleExitNodeReconnect(
+    exitNodeId: number,
+    reachableAt: string
+): Promise<void> {
+    logger.info(
+        `Scheduling newt reconnect for exit node ${exitNodeId} (reachableAt: ${reachableAt})`
+    );
+
+    const entry: PendingReconnect = {
+        startTime: Date.now(),
+        reachableAt
+    };
+
+    pendingReconnects.set(exitNodeId, entry);
+
+    // Store in Redis if available for cross-node coordination
+    if (redisManager.isRedisEnabled()) {
+        await redisManager.sadd(REDIS_PENDING_SET, exitNodeId.toString());
+        await redisManager.hset(
+            `${REDIS_HASH_PREFIX}${exitNodeId}`,
+            "startTime",
+            entry.startTime.toString()
+        );
+        await redisManager.hset(
+            `${REDIS_HASH_PREFIX}${exitNodeId}`,
+            "reachableAt",
+            reachableAt
+        );
+    }
+}
+
+/**
+ * Starts the background interval that checks pending exit node reconnects.
+ */
+export function startExitNodeReconnectScheduler(): void {
+    if (schedulerInterval) {
+        return;
+    }
+
+    schedulerInterval = setInterval(async () => {
+        try {
+            await processPendingReconnects();
+        } catch (error) {
+            logger.error("Error in exit node reconnect scheduler", { error });
+        }
+    }, CHECK_INTERVAL_MS);
+
+    logger.debug("Started exit node reconnect scheduler");
+}
+
+async function processPendingReconnects(): Promise<void> {
+    // Merge in-memory and Redis-tracked pending reconnects
+    const toProcess = new Map(pendingReconnects);
+
+    if (redisManager.isRedisEnabled()) {
+        const redisIds = await redisManager.smembers(REDIS_PENDING_SET);
+        for (const idStr of redisIds) {
+            const id = parseInt(idStr, 10);
+            if (!toProcess.has(id)) {
+                const startTimeStr = await redisManager.hget(
+                    `${REDIS_HASH_PREFIX}${id}`,
+                    "startTime"
+                );
+                const reachableAt = await redisManager.hget(
+                    `${REDIS_HASH_PREFIX}${id}`,
+                    "reachableAt"
+                );
+                if (startTimeStr && reachableAt) {
+                    toProcess.set(id, {
+                        startTime: parseInt(startTimeStr, 10),
+                        reachableAt
+                    });
+                }
+            }
+        }
+    }
+
+    const now = Date.now();
+
+    for (const [exitNodeId, entry] of toProcess) {
+        const elapsed = now - entry.startTime;
+
+        // Give up after max duration
+        if (elapsed >= MAX_DURATION_MS) {
+            logger.warn(
+                `Exit node reconnect check timed out for exit node ${exitNodeId} after 5 minutes`
+            );
+            await removePending(exitNodeId);
+            continue;
+        }
+
+        // Respect initial delay
+        if (elapsed < INITIAL_DELAY_MS) {
+            continue;
+        }
+
+        // Check if the exit node HTTP endpoint is reachable
+        const pingUrl = `${entry.reachableAt}/ping`;
+        try {
+            await axios.get(pingUrl, { timeout: 5000 });
+        } catch {
+            logger.debug(
+                `Exit node ${exitNodeId} not yet reachable at ${pingUrl}`
+            );
+            continue;
+        }
+
+        // Node is reachable — send reconnect to all connected newts
+        logger.info(
+            `Exit node ${exitNodeId} is reachable. Sending newt/wg/reconnect to connected newts.`
+        );
+
+        await sendReconnectToNewts(exitNodeId);
+        await removePending(exitNodeId);
+    }
+}
+
+async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
+    try {
+        const connectedNewts = await db
+            .select({ newtId: newts.newtId })
+            .from(newts)
+            .innerJoin(sites, eq(newts.siteId, sites.siteId))
+            .where(eq(sites.exitNodeId, exitNodeId));
+
+        if (connectedNewts.length === 0) {
+            logger.debug(
+                `No newts found for exit node ${exitNodeId}, nothing to reconnect`
+            );
+            return;
+        }
+
+        logger.info(
+            `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
+        );
+
+        const reconnectMessage = {
+            type: "newt/wg/reconnect",
+            data: {}
+        };
+
+        await Promise.allSettled(
+            connectedNewts.map(({ newtId }) =>
+                sendToClient(newtId, reconnectMessage)
+            )
+        );
+    } catch (error) {
+        logger.error(
+            `Failed to send reconnect messages for exit node ${exitNodeId}`,
+            { error }
+        );
+    }
+}
+
+async function removePending(exitNodeId: number): Promise<void> {
+    pendingReconnects.delete(exitNodeId);
+
+    if (redisManager.isRedisEnabled()) {
+        await redisManager.srem(REDIS_PENDING_SET, exitNodeId.toString());
+        await redisManager.del(`${REDIS_HASH_PREFIX}${exitNodeId}`);
+    }
+}
--- a/server/private/routers/remoteExitNode/handleRemoteExitNodePingMessage.ts
+++ b/server/private/routers/remoteExitNode/handleRemoteExitNodePingMessage.ts
@@ -16,6 +16,7 @@ import { MessageHandler } from "@server/routers/ws";
 import { RemoteExitNode } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
+import { scheduleExitNodeReconnect } from "./exitNodeReconnectScheduler";

 /**
 * Handles ping messages from clients and responds with pong
@@ -37,6 +38,13 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
    }

    try {
+        // Fetch the current state before updating so we can detect the offline→online transition
+        const [currentExitNode] = await db
+            .select({ online: exitNodes.online, reachableAt: exitNodes.reachableAt })
+            .from(exitNodes)
+            .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId))
+            .limit(1);
+
        // Update the exit node's last ping timestamp
        await db
            .update(exitNodes)
@@ -45,6 +53,16 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
                online: true
            })
            .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId));
+
+        // If the exit node was offline and is now coming online, schedule newt reconnects
+        if (currentExitNode && !currentExitNode.online && currentExitNode.reachableAt) {
+            scheduleExitNodeReconnect(
+                remoteExitNode.exitNodeId,
+                currentExitNode.reachableAt
+            ).catch((error) => {
+                logger.error("Failed to schedule exit node reconnect", { error });
+            });
+        }
    } catch (error) {
        logger.error("Error handling ping message", { error });
    }
--- a/server/private/routers/remoteExitNode/index.ts
+++ b/server/private/routers/remoteExitNode/index.ts
@@ -22,3 +22,4 @@ export * from "./listRemoteExitNodes";
 export * from "./pickRemoteExitNodeDefaults";
 export * from "./quickStartRemoteExitNode";
 export * from "./offlineChecker";
+export * from "./exitNodeReconnectScheduler";
--- a/server/private/routers/ssh/signSshKey.ts
+++ b/server/private/routers/ssh/signSshKey.ts
@@ -19,6 +19,7 @@ import {
    logsDb,
    newts,
    roles,
+    roleSiteResources,
    roundTripMessageTracker,
    siteResources,
    siteNetworks,
@@ -361,9 +362,26 @@ export async function signSshKey(
        }

        const roleRows = await db
-            .select()
+            .select({
+                sshSudoCommands: roles.sshSudoCommands,
+                sshUnixGroups: roles.sshUnixGroups,
+                sshCreateHomeDir: roles.sshCreateHomeDir,
+                sshSudoMode: roles.sshSudoMode
+            })
            .from(roles)
-            .where(inArray(roles.roleId, roleIds));
+            .innerJoin(
+                roleSiteResources,
+                eq(roleSiteResources.roleId, roles.roleId)
+            )
+            .where(
+                and(
+                    inArray(roles.roleId, roleIds),
+                    eq(
+                        roleSiteResources.siteResourceId,
+                        resource.siteResourceId
+                    )
+                )
+            );

        const parsedSudoCommands: string[] = [];
        const parsedGroupsSet = new Set<string>();
@@ -379,13 +397,17 @@ export async function signSshKey(
            }
            try {
                const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                if (Array.isArray(grps)) grps.forEach((g: string) => parsedGroupsSet.add(g));
+                if (Array.isArray(grps))
+                    grps.forEach((g: string) => parsedGroupsSet.add(g));
            } catch {
                // skip
            }
            if (roleRow?.sshCreateHomeDir === true) homedir = true;
            const m = roleRow?.sshSudoMode ?? "none";
-            if (sudoModeOrder[m as keyof typeof sudoModeOrder] > sudoModeOrder[sudoMode]) {
+            if (
+                sudoModeOrder[m as keyof typeof sudoModeOrder] >
+                sudoModeOrder[sudoMode]
+            ) {
                sudoMode = m as "none" | "commands" | "full";
            }
        }
--- a/server/private/routers/ws/messageHandlers.ts
+++ b/server/private/routers/ws/messageHandlers.ts
@@ -14,7 +14,8 @@
 import {
    handleRemoteExitNodeRegisterMessage,
    handleRemoteExitNodePingMessage,
-    startRemoteExitNodeOfflineChecker
+    startRemoteExitNodeOfflineChecker,
+    startExitNodeReconnectScheduler
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
 import { build } from "@server/build";
@@ -29,4 +30,5 @@ export const messageHandlers: Record<string, MessageHandler> = {

 if (build != "saas") {
    startRemoteExitNodeOfflineChecker(); // this is to handle the offline check for remote exit nodes
+    startExitNodeReconnectScheduler(); // check pending exit node reconnects and notify newts
 }
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -671,8 +671,7 @@ export async function verifyResourceSession(
                            resourceData.org
                        );

-                        // this is query intensive so let it cache a little longer
-                        localCache.set(userAccessCacheKey, allowedUserData, 12);
+                        localCache.set(userAccessCacheKey, allowedUserData, 5);
                    }

                    if (
@@ -1004,7 +1003,11 @@ async function checkRules(
            isIpInCidr(clientIp, rule.value)
        ) {
            return rule.action as any;
-        } else if (clientIp && rule.match == "IP" && clientIp == rule.value) {
+        } else if (
+            clientIp &&
+            rule.match == "IP" &&
+            clientIp == rule.value
+        ) {
            return rule.action as any;
        } else if (
            path &&
@@ -1012,7 +1015,10 @@ async function checkRules(
            isPathAllowed(rule.value, path)
        ) {
            return rule.action as any;
-        } else if (clientIp && rule.match == "COUNTRY") {
+        } else if (
+            clientIp &&
+            rule.match == "COUNTRY"
+        ) {
            // COUNTRY=ALL should not affect local/private/CGNAT addresses.
            if (
                rule.value.toUpperCase() === "ALL" &&
@@ -1024,7 +1030,10 @@ async function checkRules(
            if (await isIpInGeoIP(ipCC, rule.value)) {
                return rule.action as any;
            }
-        } else if (clientIp && rule.match == "ASN") {
+        } else if (
+            clientIp &&
+            rule.match == "ASN"
+        ) {
            // ASN=ALL/AS0 should not affect local/private/CGNAT addresses.
            if (
                (rule.value.toUpperCase() === "ALL" ||
@@ -1263,15 +1272,11 @@ export async function isIpInRegion(
        if (region.id === checkRegionCode) {
            for (const subregion of region.includes) {
                if (subregion.countries.includes(upperCode)) {
-                    logger.debug(
-                        `Country ${upperCode} is in region ${region.id} (${region.name})`
-                    );
+                    logger.debug(`Country ${upperCode} is in region ${region.id} (${region.name})`);
                    return true;
                }
            }
-            logger.debug(
-                `Country ${upperCode} is not in region ${region.id} (${region.name})`
-            );
+            logger.debug(`Country ${upperCode} is not in region ${region.id} (${region.name})`);
            return false;
        }

@@ -1279,14 +1284,10 @@ export async function isIpInRegion(
        for (const subregion of region.includes) {
            if (subregion.id === checkRegionCode) {
                if (subregion.countries.includes(upperCode)) {
-                    logger.debug(
-                        `Country ${upperCode} is in region ${subregion.id} (${subregion.name})`
-                    );
+                    logger.debug(`Country ${upperCode} is in region ${subregion.id} (${subregion.name})`);
                    return true;
                }
-                logger.debug(
-                    `Country ${upperCode} is not in region ${subregion.id} (${subregion.name})`
-                );
+                logger.debug(`Country ${upperCode} is not in region ${subregion.id} (${subregion.name})`);
                return false;
            }
        }
--- a/server/routers/client/listClients.ts
+++ b/server/routers/client/listClients.ts
@@ -1,15 +1,20 @@
 import {
+    clientLabels,
    clients,
    clientSitesAssociationsCache,
    currentFingerprint,
    db,
+    labels,
    olms,
    orgs,
    roleClients,
    sites,
    userClients,
-    users
+    users,
+    type Label
 } from "@server/db";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -169,6 +174,7 @@ type ClientWithSites = Awaited<ReturnType<typeof queryClientsBase>>[0] & {
        siteNiceId: string | null;
    }>;
    olmUpdateAvailable?: boolean;
+    labels?: Array<Pick<Label, "labelId" | "name" | "color">>;
 };

 type OlmWithUpdateAvailable = ClientWithSites;
@@ -255,6 +261,11 @@ export async function listClients(
            (client) => client.clientId
        );

+        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.labels
+        );
+
        // Get client count with filter
        const conditions = [
            and(
@@ -288,18 +299,29 @@ export async function listClients(
        }

        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${clients.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${clients.niceId})`,
-                        "%" + query.toLowerCase() + "%"
+            const q = "%" + query.toLowerCase() + "%";
+            const queryList = [
+                like(sql`LOWER(${clients.name})`, q),
+                like(sql`LOWER(${clients.niceId})`, q)
+            ];
+
+            if (isLabelFeatureEnabled) {
+                queryList.push(
+                    inArray(
+                        clients.clientId,
+                        db
+                            .select({ id: clientLabels.clientId })
+                            .from(clientLabels)
+                            .innerJoin(
+                                labels,
+                                eq(labels.labelId, clientLabels.labelId)
+                            )
+                            .where(like(sql`LOWER(${labels.name})`, q))
                    )
-                )
-            );
+                );
+            }
+
+            conditions.push(or(...queryList));
        }

        const baseQuery = queryClientsBase().where(and(...conditions));
@@ -326,6 +348,30 @@ export async function listClients(
        const clientIds = clientsList.map((client) => client.clientId);
        const siteAssociations = await getSiteAssociations(clientIds);

+        let labelsForClients: Array<{
+            labelId: number;
+            name: string;
+            color: string;
+            clientId: number;
+        }> = [];
+
+        if (isLabelFeatureEnabled && clientIds.length > 0) {
+            labelsForClients = await db
+                .select({
+                    labelId: labels.labelId,
+                    name: labels.name,
+                    color: labels.color,
+                    clientId: clientLabels.clientId
+                })
+                .from(labels)
+                .innerJoin(
+                    clientLabels,
+                    eq(clientLabels.labelId, labels.labelId)
+                )
+                .where(inArray(clientLabels.clientId, clientIds))
+                .orderBy(asc(clientLabels.clientLabelId));
+        }
+
        // Group site associations by client ID
        const sitesByClient = siteAssociations.reduce(
            (acc, association) => {
@@ -353,7 +399,10 @@ export async function listClients(
        const clientsWithSites = clientsList.map((client) => {
            return {
                ...client,
-                sites: sitesByClient[client.clientId] || []
+                sites: sitesByClient[client.clientId] || [],
+                labels: labelsForClients.filter(
+                    (l) => l.clientId === client.clientId
+                )
            };
        });

--- a/server/routers/external.ts
+++ b/server/routers/external.ts
@@ -3,7 +3,6 @@ import config from "@server/lib/config";
 import * as site from "./site";
 import * as org from "./org";
 import * as resource from "./resource";
-import * as policy from "./policy";
 import * as domain from "./domain";
 import * as target from "./target";
 import * as user from "./user";
@@ -43,8 +42,7 @@ import {
    verifyUserIsOrgOwner,
    verifySiteResourceAccess,
    verifyOlmAccess,
-    verifyLimits,
-    verifyResourcePolicyAccess
+    verifyLimits
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import rateLimit, { ipKeyGenerator } from "express-rate-limit";
@@ -105,6 +103,7 @@ authenticated.put(
    site.createSite
 );

+
 authenticated.get(
    "/org/:orgId/sites",
    verifyOrgAccess,
@@ -541,7 +540,6 @@ authenticated.get(
    verifyUserHasAction(ActionsEnum.getResource),
    resource.getResource
 );
-
 authenticated.post(
    "/resource/:resourceId",
    verifyResourceAccess,
@@ -648,29 +646,6 @@ authenticated.post(
    logActionAudit(ActionsEnum.updateRole),
    role.updateRole
 );
-
-authenticated.get(
-    "/org/:orgId/resource-policy/:niceId",
-    verifyOrgAccess,
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.getResourcePolicy),
-    policy.getResourcePolicy
-);
-
-authenticated.get(
-    "/resource/:resourceId/policies",
-    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.getResourcePolicy),
-    resource.getResourcePolicies
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId",
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.updateResourcePolicy),
-    policy.updateResourcePolicy
-);
-
 // authenticated.get(
 //     "/role/:roleId",
 //     verifyRoleAccess,
@@ -722,59 +697,6 @@ authenticated.post(
    resource.setResourceUsers
 );

-authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    logActionAudit(ActionsEnum.setResourcePolicyUsers),
-    policy.setResourcePolicyAccessControl
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyPassword),
-    logActionAudit(ActionsEnum.setResourcePolicyPassword),
-    policy.setResourcePolicyPassword
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyPincode),
-    logActionAudit(ActionsEnum.setResourcePolicyPincode),
-    policy.setResourcePolicyPincode
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
-    logActionAudit(ActionsEnum.setResourcePolicyHeaderAuth),
-    policy.setResourcePolicyHeaderAuth
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyWhitelist),
-    logActionAudit(ActionsEnum.setResourcePolicyWhitelist),
-    policy.setResourcePolicyWhitelist
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRules),
-    logActionAudit(ActionsEnum.setResourcePolicyRules),
-    policy.setResourcePolicyRules
-);
-
 authenticated.post(
    `/resource/:resourceId/password`,
    verifyResourceAccess,
--- a/server/routers/gerbil/getAllRelays.ts
+++ b/server/routers/gerbil/getAllRelays.ts
@@ -11,7 +11,7 @@ import {
    ExitNode
 } from "@server/db";
 import { db } from "@server/db";
-import { eq } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
@@ -97,86 +97,119 @@ export async function generateRelayMappings(exitNode: ExitNode) {
        return {};
    }

+    // Filter to sites with the required fields up front so the rest of the
+    // function can safely treat endpoint/subnet/listenPort as defined.
+    const validSites = sitesRes.filter(
+        (s) => s.endpoint && s.subnet && s.listenPort
+    );
+
+    if (validSites.length === 0) {
+        return {};
+    }
+
+    const siteIds = validSites.map((s) => s.siteId);
+    const orgIds = Array.from(
+        new Set(
+            validSites
+                .map((s) => s.orgId)
+                .filter((id): id is NonNullable<typeof id> => id != null)
+        )
+    );
+
+    // Batch fetch all client-site associations for these sites in one query.
+    const clientSitesRes = siteIds.length
+        ? await db
+              .select()
+              .from(clientSitesAssociationsCache)
+              .where(inArray(clientSitesAssociationsCache.siteId, siteIds))
+        : [];
+
+    // Batch fetch all sites in the relevant orgs in one query (covers
+    // site-to-site communication for every site processed below).
+    const orgSitesRes = orgIds.length
+        ? await db.select().from(sites).where(inArray(sites.orgId, orgIds))
+        : [];
+
+    // Index org sites by orgId for O(1) lookup per site.
+    const sitesByOrg = new Map<string, typeof orgSitesRes>();
+    for (const peer of orgSitesRes) {
+        if (
+            peer.orgId == null ||
+            !peer.endpoint ||
+            !peer.subnet ||
+            !peer.listenPort
+        ) {
+            continue;
+        }
+        let arr = sitesByOrg.get(peer.orgId);
+        if (!arr) {
+            arr = [];
+            sitesByOrg.set(peer.orgId, arr);
+        }
+        arr.push(peer);
+    }
+
+    // Index client-site associations by siteId for O(1) lookup per site.
+    const clientSitesBySite = new Map<number, typeof clientSitesRes>();
+    for (const cs of clientSitesRes) {
+        let arr = clientSitesBySite.get(cs.siteId);
+        if (!arr) {
+            arr = [];
+            clientSitesBySite.set(cs.siteId, arr);
+        }
+        arr.push(cs);
+    }
+
    // Initialize mappings object for multi-peer support
    const mappings: { [key: string]: ProxyMapping } = {};

-    // Process each site
-    for (const site of sitesRes) {
-        if (!site.endpoint || !site.subnet || !site.listenPort) {
-            continue;
+    // Track destinations per endpoint to deduplicate in O(1).
+    const seen = new Map<string, Set<string>>();
+
+    const addDestination = (endpoint: string, dest: PeerDestination) => {
+        let destSet = seen.get(endpoint);
+        if (!destSet) {
+            destSet = new Set();
+            seen.set(endpoint, destSet);
+            mappings[endpoint] = { destinations: [] };
        }
-
-        // Find all clients associated with this site through clientSites
-        const clientSitesRes = await db
-            .select()
-            .from(clientSitesAssociationsCache)
-            .where(eq(clientSitesAssociationsCache.siteId, site.siteId));
-
-        for (const clientSite of clientSitesRes) {
-            if (!clientSite.endpoint) {
-                continue;
-            }
-
-            // Add this site as a destination for the client
-            if (!mappings[clientSite.endpoint]) {
-                mappings[clientSite.endpoint] = { destinations: [] };
-            }
-
-            // Add site as a destination for this client
-            const destination: PeerDestination = {
-                destinationIP: site.subnet.split("/")[0],
-                destinationPort: site.listenPort || 1 // this satisfies gerbil for now but should be reevaluated
-            };
-
-            // Check if this destination is already in the array to avoid duplicates
-            const isDuplicate = mappings[clientSite.endpoint].destinations.some(
-                (dest) =>
-                    dest.destinationIP === destination.destinationIP &&
-                    dest.destinationPort === destination.destinationPort
-            );
-
-            if (!isDuplicate) {
-                mappings[clientSite.endpoint].destinations.push(destination);
-            }
+        const key = `${dest.destinationIP}:${dest.destinationPort}`;
+        if (!destSet.has(key)) {
+            destSet.add(key);
+            mappings[endpoint].destinations.push(dest);
        }
+    };

-        // Also handle site-to-site communication (all sites in the same org)
-        if (site.orgId) {
-            const orgSites = await db
-                .select()
-                .from(sites)
-                .where(eq(sites.orgId, site.orgId));
+    // Process each site using the pre-fetched data.
+    for (const site of validSites) {
+        const siteDestination: PeerDestination = {
+            destinationIP: site.subnet!.split("/")[0],
+            destinationPort: site.listenPort! || 1 // this satisfies gerbil for now but should be reevaluated
+        };

-            for (const peer of orgSites) {
-                // Skip self
-                if (
-                    peer.siteId === site.siteId ||
-                    !peer.endpoint ||
-                    !peer.subnet ||
-                    !peer.listenPort
-                ) {
+        // Add this site as a destination for each associated client.
+        const clientSites = clientSitesBySite.get(site.siteId);
+        if (clientSites) {
+            for (const clientSite of clientSites) {
+                if (!clientSite.endpoint) {
                    continue;
                }
+                addDestination(clientSite.endpoint, siteDestination);
+            }
+        }

-                // Add peer site as a destination for this site
-                if (!mappings[site.endpoint]) {
-                    mappings[site.endpoint] = { destinations: [] };
-                }
-
-                const destination: PeerDestination = {
-                    destinationIP: peer.subnet.split("/")[0],
-                    destinationPort: peer.listenPort || 1 // this satisfies gerbil for now but should be reevaluated
-                };
-
-                // Check for duplicates
-                const isDuplicate = mappings[site.endpoint].destinations.some(
-                    (dest) =>
-                        dest.destinationIP === destination.destinationIP &&
-                        dest.destinationPort === destination.destinationPort
-                );
-
-                if (!isDuplicate) {
-                    mappings[site.endpoint].destinations.push(destination);
+        // Site-to-site communication (all sites in the same org).
+        if (site.orgId != null) {
+            const peers = sitesByOrg.get(site.orgId);
+            if (peers) {
+                for (const peer of peers) {
+                    if (peer.siteId === site.siteId) {
+                        continue;
+                    }
+                    addDestination(site.endpoint!, {
+                        destinationIP: peer.subnet!.split("/")[0],
+                        destinationPort: peer.listenPort! || 1 // this satisfies gerbil for now but should be reevaluated
+                    });
                }
            }
        }
--- a/server/routers/gerbil/updateHolePunch.ts
+++ b/server/routers/gerbil/updateHolePunch.ts
@@ -11,7 +11,7 @@ import {
    ExitNode
 } from "@server/db";
 import { db } from "@server/db";
-import { eq, and } from "drizzle-orm";
+import { eq, and, inArray } from "drizzle-orm";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
@@ -185,16 +185,20 @@ export async function updateAndGenerateEndpointDestinations(
        const sitesOnExitNode = await db
            .select({
                siteId: sites.siteId,
+                newtId: newts.newtId,
                subnet: sites.subnet,
                listenPort: sites.listenPort,
                publicKey: sites.publicKey,
-                endpoint: clientSitesAssociationsCache.endpoint
+                endpoint: clientSitesAssociationsCache.endpoint,
+                isRelayed: clientSitesAssociationsCache.isRelayed,
+                isJitMode: clientSitesAssociationsCache.isJitMode
            })
            .from(sites)
            .innerJoin(
                clientSitesAssociationsCache,
                eq(sites.siteId, clientSitesAssociationsCache.siteId)
            )
+            .innerJoin(newts, eq(sites.siteId, newts.siteId))
            .where(
                and(
                    eq(sites.exitNodeId, exitNode.exitNodeId),
@@ -202,24 +206,36 @@ export async function updateAndGenerateEndpointDestinations(
                )
            );

-        // Update clientSites for each site on this exit node
+        // Format the endpoint properly for both IPv4 and IPv6
+        const formattedEndpoint = formatEndpoint(ip, port);
+
+        // Determine which rows actually need updating and whether the endpoint
+        // (as opposed to only the publicKey) changed for any of them.
+        const siteIdsToUpdate: number[] = [];
+        const sitesWithNewtsToUpdate: { siteId: number; newtId: string }[] = [];
+        let endpointChanged = false;
        for (const site of sitesOnExitNode) {
-            // logger.debug(
-            //     `Updating site ${site.siteId} on exit node ${exitNode.exitNodeId}`
-            // );
-
-            // Format the endpoint properly for both IPv4 and IPv6
-            const formattedEndpoint = formatEndpoint(ip, port);
-
-            // if the public key or endpoint has changed, update it otherwise continue
            if (
                site.endpoint === formattedEndpoint &&
                site.publicKey === publicKey
            ) {
                continue;
            }
+            siteIdsToUpdate.push(site.siteId);
+            if (!site.isRelayed && !site.isJitMode) {
+                sitesWithNewtsToUpdate.push({
+                    siteId: site.siteId,
+                    newtId: site.newtId
+                });
+            }
+            if (site.endpoint !== formattedEndpoint) {
+                endpointChanged = true;
+            }
+        }

-            const [updatedClientSitesAssociationsCache] = await db
+        if (siteIdsToUpdate.length > 0) {
+            // Single bulk update for all affected rows for this client on this exit node
+            await db
                .update(clientSitesAssociationsCache)
                .set({
                    endpoint: formattedEndpoint,
@@ -228,24 +244,30 @@ export async function updateAndGenerateEndpointDestinations(
                .where(
                    and(
                        eq(clientSitesAssociationsCache.clientId, olm.clientId),
-                        eq(clientSitesAssociationsCache.siteId, site.siteId)
+                        inArray(
+                            clientSitesAssociationsCache.siteId,
+                            siteIdsToUpdate
+                        )
                    )
-                )
-                .returning();
+                );

-            if (
-                updatedClientSitesAssociationsCache.endpoint !==
-                    site.endpoint && // this is the endpoint from the join table not the site
-                updatedClient.pubKey === publicKey // only trigger if the client's public key matches the current public key which means it has registered so we dont prematurely send the update
-            ) {
+            // Only trigger downstream peer updates once per hole punch: the
+            // endpoint is the same for every site on this exit node, and
+            // handleClientEndpointChange already fans out to all connected
+            // sites for this client.
+            if (endpointChanged && updatedClient.pubKey === publicKey) {
                logger.info(
-                    `ClientSitesAssociationsCache for client ${olm.clientId} and site ${site.siteId} endpoint changed from ${site.endpoint} to ${updatedClientSitesAssociationsCache.endpoint}`
+                    `ClientSitesAssociationsCache for client ${olm.clientId} endpoint changed to ${formattedEndpoint} for ${siteIdsToUpdate.length} site(s) on exit node ${exitNode.exitNodeId}`
                );
-                // Handle any additional logic for endpoint change
                handleClientEndpointChange(
+                    sitesWithNewtsToUpdate,
                    olm.clientId,
-                    updatedClientSitesAssociationsCache.endpoint!
-                );
+                    formattedEndpoint
+                ).catch((error) => {
+                    logger.error(
+                        `Failed to handle client endpoint change for client ${olm.clientId}: ${error}`
+                    );
+                });
            }
        }

@@ -336,59 +358,14 @@ export async function updateAndGenerateEndpointDestinations(
                `Site ${newt.siteId} endpoint changed from ${site.endpoint} to ${updatedSite.endpoint}`
            );
            // Handle any additional logic for endpoint change
-            handleSiteEndpointChange(newt.siteId, updatedSite.endpoint!);
+            handleSiteEndpointChange(newt.siteId, updatedSite.endpoint!).catch(
+                (error) => {
+                    logger.error(
+                        `Failed to handle site endpoint change for site ${newt.siteId}: ${error}`
+                    );
+                }
+            );
        }
-
-        // if (!updatedSite || !updatedSite.subnet) {
-        //     logger.warn(`Site not found: ${newt.siteId}`);
-        //     throw new Error("Site not found");
-        // }
-
-        // Find all clients that connect to this site
-        // const sitesClientPairs = await db
-        //     .select()
-        //     .from(clientSites)
-        //     .where(eq(clientSites.siteId, newt.siteId));
-
-        // THE NEWT IS NOT SENDING RAW WG TO THE GERBIL SO IDK IF WE REALLY NEED THIS - REMOVING
-        // Get client details for each client
-        // for (const pair of sitesClientPairs) {
-        //     const [client] = await db
-        //         .select()
-        //         .from(clients)
-        //         .where(eq(clients.clientId, pair.clientId));
-
-        //     if (client && client.endpoint) {
-        //         const [host, portStr] = client.endpoint.split(':');
-        //         if (host && portStr) {
-        //             destinations.push({
-        //                 destinationIP: host,
-        //                 destinationPort: parseInt(portStr, 10)
-        //             });
-        //         }
-        //     }
-        // }
-
-        // If this is a newt/site, also add other sites in the same org
-        //     if (updatedSite.orgId) {
-        //         const orgSites = await db
-        //             .select()
-        //             .from(sites)
-        //             .where(eq(sites.orgId, updatedSite.orgId));
-
-        //         for (const site of orgSites) {
-        //             // Don't add the current site to the destinations
-        //             if (site.siteId !== currentSiteId && site.subnet && site.endpoint && site.listenPort) {
-        //                 const [host, portStr] = site.endpoint.split(':');
-        //                 if (host && portStr) {
-        //                     destinations.push({
-        //                         destinationIP: host,
-        //                         destinationPort: site.listenPort
-        //                     });
-        //                 }
-        //             }
-        //         }
-        //     }
    }
    return destinations;
 }
@@ -408,12 +385,14 @@ async function handleSiteEndpointChange(siteId: number, newEndpoint: string) {
            return;
        }

-        // Get all non-relayed clients connected to this site
+        // Get all non-relayed and not jit clients connected to this site
        const connectedClients = await db
            .select({
+                online: clients.online,
                clientId: clients.clientId,
                olmId: olms.olmId,
-                isRelayed: clientSitesAssociationsCache.isRelayed
+                isRelayed: clientSitesAssociationsCache.isRelayed,
+                isJitMode: clientSitesAssociationsCache.isJitMode
            })
            .from(clientSitesAssociationsCache)
            .innerJoin(
@@ -423,32 +402,36 @@ async function handleSiteEndpointChange(siteId: number, newEndpoint: string) {
            .innerJoin(olms, eq(olms.clientId, clients.clientId))
            .where(
                and(
+                    eq(clients.online, true), // the client has to be online or it does not matter...
                    eq(clientSitesAssociationsCache.siteId, siteId),
-                    eq(clientSitesAssociationsCache.isRelayed, false)
+                    eq(clientSitesAssociationsCache.isRelayed, false),
+                    eq(clientSitesAssociationsCache.isJitMode, false)
                )
            );

-        // Update each non-relayed client with the new site endpoint
-        for (const client of connectedClients) {
-            try {
-                await updateOlmPeer(
-                    client.clientId,
-                    {
-                        siteId: siteId,
-                        publicKey: site.publicKey,
-                        endpoint: newEndpoint
-                    },
-                    client.olmId
-                );
-                logger.debug(
-                    `Updated client ${client.clientId} with new site ${siteId} endpoint: ${newEndpoint}`
-                );
-            } catch (error) {
-                logger.error(
-                    `Failed to update client ${client.clientId} with new site endpoint: ${error}`
-                );
-            }
-        }
+        // Update each non-relayed client with the new site endpoint (in parallel)
+        await Promise.allSettled(
+            connectedClients.map(async (client) => {
+                try {
+                    await updateOlmPeer(
+                        client.clientId,
+                        {
+                            siteId: siteId,
+                            publicKey: site.publicKey!,
+                            endpoint: newEndpoint
+                        },
+                        client.olmId
+                    );
+                    logger.debug(
+                        `Updated client ${client.clientId} with new site ${siteId} endpoint: ${newEndpoint}`
+                    );
+                } catch (error) {
+                    logger.error(
+                        `Failed to update client ${client.clientId} with new site endpoint: ${error}`
+                    );
+                }
+            })
+        );
    } catch (error) {
        logger.error(
            `Error handling site endpoint change for site ${siteId}: ${error}`
@@ -457,10 +440,11 @@ async function handleSiteEndpointChange(siteId: number, newEndpoint: string) {
 }

 async function handleClientEndpointChange(
+    sitesWithNewtsToUpdate: { siteId: number; newtId: string }[],
    clientId: number,
    newEndpoint: string
 ) {
-    // Alert all sites connected to this client that the endpoint has changed (only if NOT relayed)
+    // Alert all sites connected to this client that the endpoint has changed (only if NOT relayed and NOT JIT MODE)
    try {
        // Get client details
        const [client] = await db
@@ -474,58 +458,42 @@ async function handleClientEndpointChange(
            return;
        }

-        // Get all non-relayed sites connected to this client
-        const connectedSites = await db
-            .select({
-                siteId: sites.siteId,
-                newtId: newts.newtId,
-                isRelayed: clientSitesAssociationsCache.isRelayed,
-                subnet: clients.subnet
-            })
-            .from(clientSitesAssociationsCache)
-            .innerJoin(
-                sites,
-                eq(clientSitesAssociationsCache.siteId, sites.siteId)
-            )
-            .innerJoin(newts, eq(newts.siteId, sites.siteId))
-            .innerJoin(
-                clients,
-                eq(clientSitesAssociationsCache.clientId, clients.clientId)
-            )
-            .where(
-                and(
-                    eq(clientSitesAssociationsCache.clientId, clientId),
-                    eq(clientSitesAssociationsCache.isRelayed, false)
-                )
+        if (sitesWithNewtsToUpdate.length > 250) {
+            logger.warn(
+                `Client ${clientId} has ${sitesWithNewtsToUpdate.length} connected sites so the client will be in jit mode anyway, skipping endpoint updates`
            );
+            return;
+        }

-        // Update each non-relayed site with the new client endpoint
-        for (const siteData of connectedSites) {
-            try {
-                if (!siteData.subnet) {
+        // Update each non-relayed site with the new client endpoint (in parallel)
+        await Promise.allSettled(
+            sitesWithNewtsToUpdate.map(async ({ siteId, newtId }) => {
+                if (!client.pubKey) {
                    logger.warn(
-                        `Client ${clientId} has no subnet, skipping update for site ${siteData.siteId}`
+                        `Client ${clientId} has no public key, skipping update for site ${siteId}`
                    );
-                    continue;
+                    return;
                }

-                await updateNewtPeer(
-                    siteData.siteId,
-                    client.pubKey,
-                    {
-                        endpoint: newEndpoint
-                    },
-                    siteData.newtId
-                );
-                logger.debug(
-                    `Updated site ${siteData.siteId} with new client ${clientId} endpoint: ${newEndpoint}`
-                );
-            } catch (error) {
-                logger.error(
-                    `Failed to update site ${siteData.siteId} with new client endpoint: ${error}`
-                );
-            }
-        }
+                try {
+                    await updateNewtPeer(
+                        siteId,
+                        client.pubKey,
+                        {
+                            endpoint: newEndpoint
+                        },
+                        newtId
+                    );
+                    logger.debug(
+                        `Updated site ${siteId} with new client ${clientId} endpoint: ${newEndpoint}`
+                    );
+                } catch (error) {
+                    logger.error(
+                        `Failed to update site ${siteId} with new client endpoint: ${error}`
+                    );
+                }
+            })
+        );
    } catch (error) {
        logger.error(
            `Error handling client endpoint change for client ${clientId}: ${error}`
--- a/server/routers/integration.ts
+++ b/server/routers/integration.ts
@@ -2,7 +2,6 @@ import * as site from "./site";
 import * as org from "./org";
 import * as blueprints from "./blueprints";
 import * as resource from "./resource";
-import * as policy from "./policy";
 import * as domain from "./domain";
 import * as target from "./target";
 import * as user from "./user";
@@ -30,9 +29,7 @@ import {
    verifyApiKeySiteResourceAccess,
    verifyApiKeySetResourceClients,
    verifyLimits,
-    verifyApiKeyDomainAccess,
-    verifyApiKeyResourcePolicyAccess,
-    verifyUserHasAction
+    verifyApiKeyDomainAccess
 } from "@server/middlewares";
 import HttpCode from "@server/types/HttpCode";
 import { Router } from "express";
@@ -462,20 +459,6 @@ authenticated.get(
    resource.getResource
 );

-authenticated.get(
-    "/resource-policy/:resourcePolicyId",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
-    policy.getResourcePolicy
-);
-
-authenticated.get(
-    "/resource/:resourceId/policies",
-    verifyApiKeyResourceAccess,
-    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
-    resource.getResourcePolicies
-);
-
 authenticated.post(
    "/resource/:resourceId",
    verifyApiKeyResourceAccess,
@@ -485,13 +468,6 @@ authenticated.post(
    resource.updateResource
 );

-authenticated.put(
-    "/resource-policy/:resourcePolicyId",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
-    policy.updateResourcePolicy
-);
-
 authenticated.delete(
    "/resource/:resourceId",
    verifyApiKeyResourceAccess,
@@ -643,63 +619,6 @@ authenticated.post(
    resource.setResourceUsers
 );

-authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyRoleAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
-    logActionAudit(ActionsEnum.setResourcePolicyUsers),
-    logActionAudit(ActionsEnum.setResourcePolicyRoles),
-    policy.setResourcePolicyAccessControl
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
-    logActionAudit(ActionsEnum.setResourcePolicyPassword),
-    policy.setResourcePolicyPassword
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
-    logActionAudit(ActionsEnum.setResourcePolicyPincode),
-    policy.setResourcePolicyPincode
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
-    logActionAudit(ActionsEnum.setResourcePolicyHeaderAuth),
-    policy.setResourcePolicyHeaderAuth
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
-    logActionAudit(ActionsEnum.setResourcePolicyWhitelist),
-    policy.setResourcePolicyWhitelist
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
-    logActionAudit(ActionsEnum.setResourcePolicyRules),
-    policy.setResourcePolicyRules
-);
-
 authenticated.post(
    "/resource/:resourceId/roles/add",
    verifyApiKeyResourceAccess,
--- a/server/routers/labels/types.ts
+++ b/server/routers/labels/types.ts
@@ -0,0 +1,10 @@
+import type { Label } from "@server/db";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+export type ListOrgLabelsResponse = PaginatedResponse<{
+    labels: Omit<Label, "orgId">[];
+}>;
+
+export type CreateOrEditLabelResponse = {
+    label: Label;
+};
--- a/server/routers/olm/buildConfiguration.ts
+++ b/server/routers/olm/buildConfiguration.ts
@@ -5,6 +5,7 @@ import {
    db,
    exitNodes,
    networks,
+    SiteResource,
    siteNetworks,
    siteResources,
    sites
@@ -15,7 +16,7 @@ import {
    generateRemoteSubnets
 } from "@server/lib/ip";
 import logger from "@server/logger";
-import { and, eq } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
 import config from "@server/lib/config";

@@ -27,11 +28,11 @@ export async function buildSiteConfigurationForOlmClient(
 ) {
    const siteConfigurations: {
        siteId: number;
-        name?: string
-        endpoint?: string
-        publicKey?: string
-        serverIP?: string | null
-        serverPort?: number | null
+        name?: string;
+        endpoint?: string;
+        publicKey?: string;
+        serverIP?: string | null;
+        serverPort?: number | null;
        remoteSubnets?: string[];
        aliases: Alias[];
    }[] = [];
@@ -46,50 +47,79 @@ export async function buildSiteConfigurationForOlmClient(
        )
        .where(eq(clientSitesAssociationsCache.clientId, client.clientId));

+    if (sitesData.length === 0) {
+        return siteConfigurations;
+    }
+
+    // Batch-fetch every site resource this client has access to across ALL sites
+    // in a single query, then group by siteId in memory. This avoids issuing one
+    // query per site (which would be N round-trips for N sites).
+    const allClientSiteResources = await db
+        .select({
+            siteResource: siteResources,
+            siteId: siteNetworks.siteId
+        })
+        .from(siteResources)
+        .innerJoin(
+            clientSiteResourcesAssociationsCache,
+            eq(
+                siteResources.siteResourceId,
+                clientSiteResourcesAssociationsCache.siteResourceId
+            )
+        )
+        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
+        .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
+        .where(
+            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
+        );
+
+    const siteResourcesBySiteId = new Map<number, SiteResource[]>();
+    for (const row of allClientSiteResources) {
+        const arr = siteResourcesBySiteId.get(row.siteId);
+        if (arr) {
+            arr.push(row.siteResource);
+        } else {
+            siteResourcesBySiteId.set(row.siteId, [row.siteResource]);
+        }
+    }
+
+    // Batch-fetch exit nodes for all sites in one query (only needed in relay mode).
+    const exitNodesById = new Map<number, typeof exitNodes.$inferSelect>();
+    if (!jitMode && relay) {
+        const exitNodeIds = Array.from(
+            new Set(
+                sitesData
+                    .map(({ sites: s }) => s.exitNodeId)
+                    .filter((id): id is number => id != null)
+            )
+        );
+        if (exitNodeIds.length > 0) {
+            const nodes = await db
+                .select()
+                .from(exitNodes)
+                .where(inArray(exitNodes.exitNodeId, exitNodeIds));
+            for (const n of nodes) {
+                exitNodesById.set(n.exitNodeId, n);
+            }
+        }
+    }
+
+    const clientsStartPort = config.getRawConfig().gerbil.clients_start_port;
+    const peerOps: Promise<unknown>[] = [];
+
    // Process each site
    for (const {
        sites: site,
        clientSitesAssociationsCache: association
    } of sitesData) {
-        const allSiteResources = await db // only get the site resources that this client has access to
-            .select()
-            .from(siteResources)
-            .innerJoin(
-                clientSiteResourcesAssociationsCache,
-                eq(
-                    siteResources.siteResourceId,
-                    clientSiteResourcesAssociationsCache.siteResourceId
-                )
-            )
-            .innerJoin(
-                networks,
-                eq(siteResources.networkId, networks.networkId)
-            )
-            .innerJoin(
-                siteNetworks,
-                eq(networks.networkId, siteNetworks.networkId)
-            )
-            .where(
-                and(
-                    eq(siteNetworks.siteId, site.siteId),
-                    eq(
-                        clientSiteResourcesAssociationsCache.clientId,
-                        client.clientId
-                    )
-                )
-            );
-
+        const allSiteResources = siteResourcesBySiteId.get(site.siteId) ?? [];

        if (jitMode) {
            // Add site configuration to the array
            siteConfigurations.push({
                siteId: site.siteId,
-                // remoteSubnets: generateRemoteSubnets(
-                //     allSiteResources.map(({ siteResources }) => siteResources)
-                // ),
-                aliases: generateAliasConfig(
-                    allSiteResources.map(({ siteResources }) => siteResources)
-                )
+                // remoteSubnets: generateRemoteSubnets(allSiteResources),
+                aliases: generateAliasConfig(allSiteResources)
            });
            continue;
        }
@@ -109,10 +139,9 @@ export async function buildSiteConfigurationForOlmClient(
            continue;
        }

-        if (!site.publicKey || site.publicKey == "") { // the site is not ready to accept new peers
-            logger.warn(
-                `Site ${site.siteId} has no public key, skipping`
-            );
+        if (!site.publicKey || site.publicKey == "") {
+            // the site is not ready to accept new peers
+            logger.warn(`Site ${site.siteId} has no public key, skipping`);
            continue;
        }

@@ -128,7 +157,7 @@ export async function buildSiteConfigurationForOlmClient(
            logger.info(
                `Public key mismatch. Deleting old peer from site ${site.siteId}...`
            );
-            await deletePeer(site.siteId, client.pubKey!);
+            peerOps.push(deletePeer(site.siteId, client.pubKey!));
        }

        if (!site.subnet) {
@@ -136,27 +165,19 @@ export async function buildSiteConfigurationForOlmClient(
            continue;
        }

-        const [clientSite] = await db
-            .select()
-            .from(clientSitesAssociationsCache)
-            .where(
-                and(
-                    eq(clientSitesAssociationsCache.clientId, client.clientId),
-                    eq(clientSitesAssociationsCache.siteId, site.siteId)
-                )
-            )
-            .limit(1);
-
-        // Add the peer to the exit node for this site
-        if (clientSite.endpoint && publicKey) {
+        // Add the peer to the exit node for this site. The endpoint comes from
+        // the already-joined association row above, so no extra query needed.
+        if (association.endpoint && publicKey) {
            logger.info(
-                `Adding peer ${publicKey} to site ${site.siteId} with endpoint ${clientSite.endpoint}`
+                `Adding peer ${publicKey} to site ${site.siteId} with endpoint ${association.endpoint}`
+            );
+            peerOps.push(
+                addPeer(site.siteId, {
+                    publicKey: publicKey,
+                    allowedIps: [`${client.subnet.split("/")[0]}/32`], // we want to only allow from that client
+                    endpoint: relay ? "" : association.endpoint
+                })
            );
-            await addPeer(site.siteId, {
-                publicKey: publicKey,
-                allowedIps: [`${client.subnet.split("/")[0]}/32`], // we want to only allow from that client
-                endpoint: relay ? "" : clientSite.endpoint
-            });
        } else {
            logger.warn(
                `Client ${client.clientId} has no endpoint, skipping peer addition`
@@ -165,16 +186,12 @@ export async function buildSiteConfigurationForOlmClient(

        let relayEndpoint: string | undefined = undefined;
        if (relay) {
-            const [exitNode] = await db
-                .select()
-                .from(exitNodes)
-                .where(eq(exitNodes.exitNodeId, site.exitNodeId))
-                .limit(1);
+            const exitNode = exitNodesById.get(site.exitNodeId);
            if (!exitNode) {
                logger.warn(`Exit node not found for site ${site.siteId}`);
                continue;
            }
-            relayEndpoint = `${exitNode.endpoint}:${config.getRawConfig().gerbil.clients_start_port}`;
+            relayEndpoint = `${exitNode.endpoint}:${clientsStartPort}`;
        }

        // Add site configuration to the array
@@ -186,12 +203,16 @@ export async function buildSiteConfigurationForOlmClient(
            publicKey: site.publicKey,
            serverIP: site.address,
            serverPort: site.listenPort,
-            remoteSubnets: generateRemoteSubnets(
-                allSiteResources.map(({ siteResources }) => siteResources)
-            ),
-            aliases: generateAliasConfig(
-                allSiteResources.map(({ siteResources }) => siteResources)
-            )
+            remoteSubnets: generateRemoteSubnets(allSiteResources),
+            aliases: generateAliasConfig(allSiteResources)
+        });
+    }
+
+    // Run all peer add/delete operations concurrently rather than serially per
+    // site, so total time is bounded by the slowest call instead of the sum.
+    if (peerOps.length > 0) {
+        Promise.allSettled(peerOps).catch((err) => {
+            logger.error("Error processing peer operations: ", err);
        });
    }

--- a/server/routers/olm/getOlmToken.ts
+++ b/server/routers/olm/getOlmToken.ts
@@ -8,7 +8,7 @@ import {
    ExitNode,
    exitNodes,
    sites,
-    clientSitesAssociationsCache,
+    clientSitesAssociationsCache
 } from "@server/db";
 import { olms } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
@@ -28,6 +28,7 @@ import { verifyPassword } from "@server/auth/password";
 import logger from "@server/logger";
 import config from "@server/lib/config";
 import { APP_VERSION } from "@server/lib/consts";
+import { build } from "@server/build";

 export const olmGetTokenBodySchema = z.object({
    olmId: z.string(),
@@ -220,6 +221,22 @@ export async function getOlmToken(
            )
            .where(eq(clientSitesAssociationsCache.clientId, clientIdToUse!));

+        if (clientSites.length > 250 && build == "saas") {
+            // set all of the cache rows isJitMode to true
+            await db
+                .update(clientSitesAssociationsCache)
+                .set({ isJitMode: true })
+                .where(
+                    and(
+                        eq(
+                            clientSitesAssociationsCache.clientId,
+                            clientIdToUse!
+                        ),
+                        eq(clientSitesAssociationsCache.isJitMode, false)
+                    )
+                );
+        }
+
        // Extract unique exit node IDs
        const exitNodeIds = Array.from(
            new Set(
--- a/server/routers/olm/handleOlmRegisterMessage.ts
+++ b/server/routers/olm/handleOlmRegisterMessage.ts
@@ -1,4 +1,4 @@
-import { db, orgs } from "@server/db";
+import { db, orgs, primaryDb } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import {
    clients,
@@ -7,7 +7,7 @@ import {
    olms,
    sites
 } from "@server/db";
-import { count, eq } from "drizzle-orm";
+import { and, count, eq, ne, or } from "drizzle-orm";
 import logger from "@server/logger";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { validateSessionToken } from "@server/auth/sessions/app";
@@ -81,7 +81,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
            .where(eq(olms.olmId, olm.olmId));
    }

-    const [client] = await db
+    const [client] = await primaryDb // read from the primary here so there is no latency with the last update on the holepunch
        .select()
        .from(clients)
        .where(eq(clients.clientId, olm.clientId))
@@ -98,7 +98,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    if (client.blocked) {
        logger.debug(
            `[handleOlmRegisterMessage] Client ${client.clientId} is blocked. Ignoring register.`,
-            { orgId: client.orgId }
+            { orgId: client.orgId, clientId: client.clientId }
        );
        sendOlmError(OlmErrorCodes.CLIENT_BLOCKED, olm.olmId);
        return;
@@ -107,7 +107,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    if (client.approvalState == "pending") {
        logger.debug(
            `[handleOlmRegisterMessage] Client ${client.clientId} approval is pending. Ignoring register.`,
-            { orgId: client.orgId }
+            { orgId: client.orgId, clientId: client.clientId }
        );
        sendOlmError(OlmErrorCodes.CLIENT_PENDING, olm.olmId);
        return;
@@ -136,7 +136,8 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {

    if (!org) {
        logger.warn("[handleOlmRegisterMessage] Org not found", {
-            orgId: client.orgId
+            orgId: client.orgId,
+            clientId: client.clientId
        });
        sendOlmError(OlmErrorCodes.ORG_NOT_FOUND, olm.olmId);
        return;
@@ -145,7 +146,8 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    if (orgId) {
        if (!olm.userId) {
            logger.warn("[handleOlmRegisterMessage] Olm has no user ID", {
-                orgId: client.orgId
+                orgId: client.orgId,
+                clientId: client.clientId
            });
            sendOlmError(OlmErrorCodes.USER_ID_NOT_FOUND, olm.olmId);
            return;
@@ -156,7 +158,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        if (!userSession || !user) {
            logger.warn(
                "[handleOlmRegisterMessage] Invalid user session for olm register",
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(OlmErrorCodes.INVALID_USER_SESSION, olm.olmId);
            return;
@@ -164,7 +166,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        if (user.userId !== olm.userId) {
            logger.warn(
                "[handleOlmRegisterMessage] User ID mismatch for olm register",
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(OlmErrorCodes.USER_ID_MISMATCH, olm.olmId);
            return;
@@ -182,13 +184,14 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {

        logger.debug("[handleOlmRegisterMessage] Policy check result", {
            orgId: client.orgId,
+            clientId: client.clientId,
            policyCheck
        });

        if (policyCheck?.error) {
            logger.error(
                `[handleOlmRegisterMessage] Error checking access policies for olm user ${olm.userId} in org ${orgId}: ${policyCheck?.error}`,
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(OlmErrorCodes.ORG_ACCESS_POLICY_DENIED, olm.olmId);
            return;
@@ -197,7 +200,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        if (policyCheck.policies?.passwordAge?.compliant === false) {
            logger.warn(
                `[handleOlmRegisterMessage] Olm user ${olm.userId} has non-compliant password age for org ${orgId}`,
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(
                OlmErrorCodes.ORG_ACCESS_POLICY_PASSWORD_EXPIRED,
@@ -209,7 +212,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        ) {
            logger.warn(
                `[handleOlmRegisterMessage] Olm user ${olm.userId} has non-compliant session length for org ${orgId}`,
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(
                OlmErrorCodes.ORG_ACCESS_POLICY_SESSION_EXPIRED,
@@ -219,7 +222,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        } else if (policyCheck.policies?.requiredTwoFactor === false) {
            logger.warn(
                `[handleOlmRegisterMessage] Olm user ${olm.userId} does not have 2FA enabled for org ${orgId}`,
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(
                OlmErrorCodes.ORG_ACCESS_POLICY_2FA_REQUIRED,
@@ -229,7 +232,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        } else if (!policyCheck.allowed) {
            logger.warn(
                `[handleOlmRegisterMessage] Olm user ${olm.userId} does not pass access policies for org ${orgId}: ${policyCheck.error}`,
-                { orgId: client.orgId }
+                { orgId: client.orgId, clientId: client.clientId }
            );
            sendOlmError(OlmErrorCodes.ORG_ACCESS_POLICY_DENIED, olm.olmId);
            return;
@@ -253,7 +256,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    // Prepare an array to store site configurations
    logger.debug(
        `[handleOlmRegisterMessage] Found ${sitesCount} sites for client ${client.clientId}`,
-        { orgId: client.orgId }
+        { orgId: client.orgId, clientId: client.clientId }
    );

    let jitMode = false;
@@ -263,19 +266,20 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
        // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
        logger.info(
            `[handleOlmRegisterMessage] Too many sites (${sitesCount}), dropping into JIT mode`,
-            { orgId: client.orgId }
+            { orgId: client.orgId, clientId: client.clientId }
        );
        jitMode = true;
    }

    logger.debug(
        `[handleOlmRegisterMessage] Olm client ID: ${client.clientId}, Public Key: ${publicKey}, Relay: ${relay}`,
-        { orgId: client.orgId }
+        { orgId: client.orgId, clientId: client.clientId }
    );

    if (!publicKey) {
        logger.warn("[handleOlmRegisterMessage] Public key not provided", {
-            orgId: client.orgId
+            orgId: client.orgId,
+            clientId: client.clientId
        });
        return;
    }
@@ -283,7 +287,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    if (client.pubKey !== publicKey || client.archived) {
        logger.info(
            "[handleOlmRegisterMessage] Public key mismatch. Updating public key and clearing session info...",
-            { orgId: client.orgId }
+            { orgId: client.orgId, clientId: client.clientId }
        );
        // Update the client's public key
        await db
@@ -301,7 +305,18 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                isRelayed: relay == true,
                isJitMode: jitMode
            })
-            .where(eq(clientSitesAssociationsCache.clientId, client.clientId));
+            .where(
+                and(
+                    eq(clientSitesAssociationsCache.clientId, client.clientId),
+                    or(
+                        ne(
+                            clientSitesAssociationsCache.isRelayed,
+                            relay == true
+                        ),
+                        ne(clientSitesAssociationsCache.isJitMode, jitMode)
+                    )
+                )
+            );
    }

    // this prevents us from accepting a register from an olm that has not hole punched yet.
@@ -310,7 +325,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
    if (now - (client.lastHolePunch || 0) > 5 && sitesCount > 0) {
        logger.warn(
            `[handleOlmRegisterMessage] Client last hole punch is too old and we have sites to send; skipping this register. The client is failing to hole punch and identify its network address with the server. Can the client reach the server on UDP port ${config.getRawConfig().gerbil.clients_start_port}?`,
-            { orgId: client.orgId }
+            { orgId: client.orgId, clientId: client.clientId }
        );
        return;
    }
--- a/server/routers/olm/handleOlmServerInitAddPeerHandshake.ts
+++ b/server/routers/olm/handleOlmServerInitAddPeerHandshake.ts
@@ -17,7 +17,7 @@ import { initPeerAddHandshake } from "./peers";
 export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
    context
 ) => {
-    logger.info("Handling register olm message!");
+    logger.info("Handle Olm Server Init Add Peer Handshake Message");
    const { message, client: c, sendToClient } = context;
    const olm = c as Olm;

--- a/server/routers/olm/sync.ts
+++ b/server/routers/olm/sync.ts
@@ -9,16 +9,50 @@ import {
 import { buildSiteConfigurationForOlmClient } from "./buildConfiguration";
 import { sendToClient } from "#dynamic/routers/ws";
 import logger from "@server/logger";
-import { eq, inArray } from "drizzle-orm";
+import { count, eq, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
 import { canCompress } from "@server/lib/clientVersionChecks";
+import { build } from "@server/build";

 export async function sendOlmSyncMessage(olm: Olm, client: Client) {
+    // Get all sites data
+    const sitesCountResult = await db
+        .select({ count: count() })
+        .from(sites)
+        .innerJoin(
+            clientSitesAssociationsCache,
+            eq(sites.siteId, clientSitesAssociationsCache.siteId)
+        )
+        .where(eq(clientSitesAssociationsCache.clientId, client.clientId));
+
+    // Extract the count value from the result array
+    const sitesCount =
+        sitesCountResult.length > 0 ? sitesCountResult[0].count : 0;
+
+    // Prepare an array to store site configurations
+    logger.debug(
+        `[handleOlmRegisterMessage] Found ${sitesCount} sites for client ${client.clientId}`,
+        { orgId: client.orgId }
+    );
+
+    let jitMode = false;
+    if (sitesCount > 250 && build == "saas") {
+        // THIS IS THE MAX ON THE BUSINESS TIER
+        // we have too many sites
+        // If we have too many sites we need to drop into fully JIT mode by not sending any of the sites
+        logger.info(
+            `[handleOlmRegisterMessage] Too many sites (${sitesCount}), dropping into JIT mode`,
+            { orgId: client.orgId }
+        );
+        jitMode = true;
+    }
+
    // NOTE: WE ARE HARDCODING THE RELAY PARAMETER TO FALSE HERE BUT IN THE REGISTER MESSAGE ITS DEFINED BY THE CLIENT
    const siteConfigurations = await buildSiteConfigurationForOlmClient(
        client,
        client.pubKey,
-        false
+        false,
+        jitMode
    );

    // Get all exit nodes from sites where the client has peers
@@ -82,7 +116,6 @@ export async function sendOlmSyncMessage(olm: Olm, client: Client) {
                exitNodes: exitNodesData
            }
        },
-
        {
            compress: canCompress(olm.version, "olm")
        }
--- a/server/routers/policy/getResourcePolicy.ts
+++ b/server/routers/policy/getResourcePolicy.ts
@@ -1,231 +0,0 @@
-import {
-    db,
-    idp,
-    resourcePolicyRules,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
-    resourcePolicyWhiteList,
-    rolePolicies,
-    roles,
-    userPolicies,
-    users
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, isNull, not, or, type SQL } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const getResourcePolicySchema = z
-    .strictObject({
-        niceId: z.string(),
-        orgId: z.string()
-    })
-    .or(
-        z.strictObject({
-            resourcePolicyId: z.coerce
-                .number<string>()
-                .int()
-                .positive()
-                .openapi({
-                    type: "integer",
-                    description: "Resource policy ID"
-                })
-        })
-    );
-
-export async function queryResourcePolicy(
-    params: z.infer<typeof getResourcePolicySchema>
-) {
-    const conditions: SQL<unknown>[] = [];
-    if ("resourcePolicyId" in params) {
-        conditions.push(
-            eq(resourcePolicies.resourcePolicyId, params.resourcePolicyId)
-        );
-    } else {
-        conditions.push(
-            eq(resourcePolicies.niceId, params.niceId),
-            eq(resourcePolicies.orgId, params.orgId)
-        );
-    }
-
-    const [res] = await db
-        .select({
-            resourcePolicyId: resourcePolicies.resourcePolicyId,
-            sso: resourcePolicies.sso,
-            applyRules: resourcePolicies.applyRules,
-            emailWhitelistEnabled: resourcePolicies.emailWhitelistEnabled,
-            idpId: resourcePolicies.idpId,
-            niceId: resourcePolicies.niceId,
-            name: resourcePolicies.name,
-            passwordId: resourcePolicyPassword.passwordId,
-            pincodeId: resourcePolicyPincode.pincodeId,
-            headerAuth: {
-                id: resourcePolicyHeaderAuth.headerAuthId,
-                extendedCompability:
-                    resourcePolicyHeaderAuth.extendedCompatibility
-            }
-        })
-        .from(resourcePolicies)
-        .leftJoin(
-            resourcePolicyPassword,
-            eq(
-                resourcePolicyPassword.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            resourcePolicyPincode,
-            eq(
-                resourcePolicyPincode.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            resourcePolicyHeaderAuth,
-            eq(
-                resourcePolicyHeaderAuth.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .where(and(...conditions))
-        .limit(1);
-
-    if (!res) return null;
-
-    const policyUsers = await db
-        .select({
-            userId: userPolicies.userId,
-            email: users.email,
-            name: users.name,
-            username: users.username,
-            type: users.type,
-            idpName: idp.name
-        })
-        .from(userPolicies)
-        .innerJoin(users, eq(userPolicies.userId, users.userId))
-        .leftJoin(idp, eq(idp.idpId, users.idpId))
-        .where(eq(userPolicies.resourcePolicyId, res.resourcePolicyId));
-
-    const policyRoles = await db
-        .select({
-            roleId: rolePolicies.roleId,
-            name: roles.name
-        })
-        .from(rolePolicies)
-        .innerJoin(
-            roles,
-            and(
-                eq(rolePolicies.roleId, roles.roleId),
-                or(isNull(roles.isAdmin), not(roles.isAdmin))
-            )
-        )
-        .where(eq(rolePolicies.resourcePolicyId, res.resourcePolicyId));
-
-    const policyEmailWhiteList = await db
-        .select({
-            whiteListId: resourcePolicyWhiteList.whitelistId,
-            email: resourcePolicyWhiteList.email
-        })
-        .from(resourcePolicyWhiteList)
-        .where(
-            eq(resourcePolicyWhiteList.resourcePolicyId, res.resourcePolicyId)
-        );
-
-    const policyRules = await db
-        .select({
-            ruleId: resourcePolicyRules.ruleId,
-            enabled: resourcePolicyRules.enabled,
-            priority: resourcePolicyRules.priority,
-            action: resourcePolicyRules.action,
-            match: resourcePolicyRules.match,
-            value: resourcePolicyRules.value
-        })
-        .from(resourcePolicyRules)
-        .where(eq(resourcePolicyRules.resourcePolicyId, res.resourcePolicyId));
-
-    return {
-        ...res,
-        roles: policyRoles,
-        users: policyUsers,
-        emailWhiteList: policyEmailWhiteList,
-        rules: policyRules
-    };
-}
-
-export type GetResourcePolicyResponse = NonNullable<
-    Awaited<ReturnType<typeof queryResourcePolicy>>
->;
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/resource-policy/{niceId}",
-    description:
-        "Get a resource policy by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            orgId: z.string(),
-            niceId: z.string()
-        })
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            resourcePolicyId: z.number()
-        })
-    },
-    responses: {}
-});
-
-export async function getResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getResourcePolicySchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const policy = await queryResourcePolicy(parsedParams.data);
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        return response<GetResourcePolicyResponse>(res, {
-            data: policy,
-            success: true,
-            error: false,
-            message: "Resource Policy retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/index.ts
+++ b/server/routers/policy/index.ts
@@ -1,8 +0,0 @@
-export * from "./getResourcePolicy";
-export * from "./updateResourcePolicy";
-export * from "./setResourcePolicyAccessControl";
-export * from "./setResourcePolicyPassword";
-export * from "./setResourcePolicyPincode";
-export * from "./setResourcePolicyHeaderAuth";
-export * from "./setResourcePolicyWhitelist";
-export * from "./setResourcePolicyRules";
--- a/server/routers/policy/setResourcePolicyAccessControl.ts
+++ b/server/routers/policy/setResourcePolicyAccessControl.ts
@@ -1,237 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    db,
-    idp,
-    idpOrg,
-    resourcePolicies,
-    rolePolicies,
-    roles,
-    userOrgs,
-    users
-} from "@server/db";
-import { userPolicies } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { and, eq, inArray, ne } from "drizzle-orm";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyAcccessControlBodySchema = z.strictObject({
-    sso: z.boolean(),
-    userIds: z.array(z.string()),
-    roleIds: z.array(z.int().positive()).openapi({
-        type: "array"
-    }),
-    skipToIdpId: z.int().positive().optional().nullable().openapi({
-        type: "integer",
-        description: "Page number to retrieve"
-    })
-});
-
-const setResourcePolicyAccessControlParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/resource-policy/{resourceId}/access-control",
-    description:
-        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.Policy, OpenAPITags.User],
-    request: {
-        params: setResourcePolicyAccessControlParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyAcccessControlBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyAccessControl(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedBody = setResourcePolicyAcccessControlBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { userIds, roleIds, sso, skipToIdpId: idpId } = parsedBody.data;
-
-        const parsedParams =
-            setResourcePolicyAccessControlParamsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Resource policy not found"
-                )
-            );
-        }
-
-        // Check if Identity provider in `skipToIdpId` exists
-        if (idpId) {
-            const [provider] = await db
-                .select()
-                .from(idp)
-                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
-                .where(
-                    and(eq(idp.idpId, idpId), eq(idpOrg.orgId, policy.orgId))
-                )
-                .limit(1);
-
-            if (!provider) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Identity provider not found in this organization"
-                    )
-                );
-            }
-        }
-
-        // Check if any of the roleIds are admin roles
-        const rolesToCheck = await db
-            .select()
-            .from(roles)
-            .where(
-                and(
-                    inArray(roles.roleId, roleIds),
-                    eq(roles.orgId, policy.orgId)
-                )
-            );
-
-        const hasAdminRole = rolesToCheck.some((role) => role.isAdmin);
-
-        if (hasAdminRole) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Admin role cannot be assigned to resources"
-                )
-            );
-        }
-
-        // Get all admin role IDs for this org to exclude from deletion
-        const adminRoles = await db
-            .select()
-            .from(roles)
-            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, policy.orgId)));
-        const adminRoleIds = adminRoles.map((role) => role.roleId);
-
-        const existingUsers = await db
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(userOrgs.userId, users.userId))
-            .where(
-                and(
-                    eq(userOrgs.orgId, policy.orgId),
-                    inArray(users.userId, userIds)
-                )
-            );
-
-        const existingRoles = await db
-            .select()
-            .from(roles)
-            .where(
-                and(
-                    eq(roles.orgId, policy.orgId),
-                    inArray(roles.roleId, roleIds)
-                )
-            );
-
-        await db.transaction(async (trx) => {
-            // Update SSO status
-            await trx
-                .update(resourcePolicies)
-                .set({
-                    sso,
-                    idpId
-                })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            // Update roles
-            if (adminRoleIds.length > 0) {
-                await trx.delete(rolePolicies).where(
-                    and(
-                        eq(rolePolicies.resourcePolicyId, resourcePolicyId),
-                        ne(rolePolicies.roleId, adminRoleIds[0]) // delete all but the admin role
-                    )
-                );
-            } else {
-                await trx
-                    .delete(rolePolicies)
-                    .where(eq(rolePolicies.resourcePolicyId, resourcePolicyId));
-            }
-
-            const rolesToAdd = existingRoles.map(({ roleId }) => ({
-                roleId,
-                resourcePolicyId
-            }));
-
-            if (rolesToAdd.length > 0) {
-                await trx.insert(rolePolicies).values(rolesToAdd);
-            }
-
-            // Update users
-            await trx
-                .delete(userPolicies)
-                .where(eq(userPolicies.resourcePolicyId, resourcePolicyId));
-
-            const usersToAdd = existingUsers.map(({ user }) => ({
-                userId: user.userId,
-                resourcePolicyId: resourcePolicyId
-            }));
-
-            if (usersToAdd.length > 0) {
-                await trx.insert(userPolicies).values(usersToAdd);
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy succesfully updated",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/setResourcePolicyHeaderAuth.ts
+++ b/server/routers/policy/setResourcePolicyHeaderAuth.ts
@@ -1,117 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicyHeaderAuth } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyHeaderAuthParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyHeaderAuthBodySchema = z.strictObject({
-    headerAuth: z
-        .object({
-            user: z.string().min(4).max(100),
-            password: z.string().min(4).max(100),
-            extendedCompatibility: z.boolean()
-        })
-        .nullable()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/header-auth",
-    description:
-        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyHeaderAuthParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyHeaderAuthBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyHeaderAuth(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyHeaderAuthParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyHeaderAuthBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { headerAuth } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyHeaderAuth)
-                .where(
-                    eq(
-                        resourcePolicyHeaderAuth.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (headerAuth !== null) {
-                const headerAuthHash = await hashPassword(
-                    Buffer.from(
-                        `${headerAuth.user}:${headerAuth.password}`
-                    ).toString("base64")
-                );
-
-                await trx.insert(resourcePolicyHeaderAuth).values({
-                    resourcePolicyId,
-                    headerAuthHash,
-                    extendedCompatibility: headerAuth.extendedCompatibility
-                });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Header Authentication set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/setResourcePolicyPassword.ts
+++ b/server/routers/policy/setResourcePolicyPassword.ts
@@ -1,106 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { resourcePolicyPassword } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyPasswordParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyPasswordBodySchema = z.strictObject({
-    password: z.string().min(4).max(100).nullable()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/password",
-    description:
-        "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPasswordParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPasswordBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyPassword(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyPasswordParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyPasswordBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { password } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyPassword)
-                .where(
-                    eq(
-                        resourcePolicyPassword.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (password) {
-                const passwordHash = await hashPassword(password);
-
-                await trx
-                    .insert(resourcePolicyPassword)
-                    .values({ resourcePolicyId, passwordHash });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy password set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/setResourcePolicyPincode.ts
+++ b/server/routers/policy/setResourcePolicyPincode.ts
@@ -1,106 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { resourcePolicyPincode } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyPincodeParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyPincodeBodySchema = z.strictObject({
-    pincode: z
-        .string()
-        .regex(/^\d{6}$/)
-        .or(z.null())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/pincode",
-    description:
-        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPincodeParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPincodeBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyPincode(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyPincodeParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyPincodeBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { pincode } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyPincode)
-                .where(
-                    eq(resourcePolicyPincode.resourcePolicyId, resourcePolicyId)
-                );
-
-            if (pincode) {
-                const pincodeHash = await hashPassword(pincode);
-
-                await trx
-                    .insert(resourcePolicyPincode)
-                    .values({ resourcePolicyId, pincodeHash, digitLength: 6 });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy PIN code set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/setResourcePolicyRules.ts
+++ b/server/routers/policy/setResourcePolicyRules.ts
@@ -1,167 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicyRules, resourcePolicies } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
-} from "@server/lib/validators";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const ruleSchema = z.strictObject({
-    action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
-        type: "string",
-        enum: ["ACCEPT", "DROP", "PASS"],
-        description: "rule action"
-    }),
-    match: z.enum(["CIDR", "IP", "PATH"]).openapi({
-        type: "string",
-        enum: ["CIDR", "IP", "PATH"],
-        description: "rule match"
-    }),
-    value: z.string().min(1),
-    priority: z.int().openapi({
-        type: "integer",
-        description: "Rule priority"
-    }),
-    enabled: z.boolean().optional()
-});
-
-const setResourcePolicyRulesBodySchema = z.strictObject({
-    applyRules: z.boolean(),
-    rules: z.array(ruleSchema)
-});
-
-const setResourcePolicyRulesParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/rules",
-    description:
-        "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyRulesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyRulesBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyRules(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyRulesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyRulesBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { applyRules, rules } = parsedBody.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        for (const rule of rules) {
-            if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            } else if (rule.match === "IP" && !isValidIP(rule.value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            } else if (
-                rule.match === "PATH" &&
-                !isValidUrlGlobPattern(rule.value)
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        }
-
-        await db.transaction(async (trx) => {
-            await trx
-                .update(resourcePolicies)
-                .set({ applyRules })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            await trx
-                .delete(resourcePolicyRules)
-                .where(
-                    eq(resourcePolicyRules.resourcePolicyId, resourcePolicyId)
-                );
-
-            if (rules.length > 0) {
-                await trx.insert(resourcePolicyRules).values(
-                    rules.map((rule) => ({
-                        resourcePolicyId,
-                        ...rule
-                    }))
-                );
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy rules set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/setResourcePolicyWhitelist.ts
+++ b/server/routers/policy/setResourcePolicyWhitelist.ts
@@ -1,132 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicies, resourcePolicyWhiteList } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { and, eq } from "drizzle-orm";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyWhitelistBodySchema = z.strictObject({
-    emailWhitelistEnabled: z.boolean(),
-    emails: z
-        .array(
-            z.email().or(
-                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
-                    error: "Invalid email address. Wildcard (*) must be the entire local part."
-                })
-            )
-        )
-        .max(50)
-        .transform((v) => v.map((e) => e.toLowerCase()))
-});
-
-const setResourcePolicyWhitelistParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/whitelist",
-    description:
-        "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyWhitelist(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedBody = setResourcePolicyWhitelistBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const parsedParams = setResourcePolicyWhitelistParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { emailWhitelistEnabled, emails } = parsedBody.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        await db.transaction(async (trx) => {
-            await trx
-                .update(resourcePolicies)
-                .set({ emailWhitelistEnabled })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            // delete all whitelist emails
-            await trx
-                .delete(resourcePolicyWhiteList)
-                .where(
-                    eq(
-                        resourcePolicyWhiteList.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (emailWhitelistEnabled && emails.length > 0) {
-                await trx.insert(resourcePolicyWhiteList).values(
-                    emails.map((email) => ({
-                        email,
-                        resourcePolicyId
-                    }))
-                );
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Whitelist set for resource policy successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/policy/updateResourcePolicy.ts
+++ b/server/routers/policy/updateResourcePolicy.ts
@@ -1,157 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import z from "zod";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { db, orgs, resourcePolicies, type ResourcePolicy } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import logger from "@server/logger";
-import response from "@server/lib/response";
-
-const updateResourcePolicyParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const updateResourcePolicyBodySchema = z.strictObject({
-    name: z.string().min(1).max(255).optional(),
-    niceId: z.string().min(1).max(255).optional()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Update a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: updateResourcePolicyParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateResourcePolicyBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function updateResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = updateResourcePolicyParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        if (req.user && req.userOrgRoleIds?.length === 0) {
-            return next(
-                createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const [result] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .leftJoin(orgs, eq(resourcePolicies.orgId, orgs.orgId));
-
-        const policy = result?.resourcePolicies;
-        const org = result?.orgs;
-
-        if (!policy || !org) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource Policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        const parsedBody = updateResourcePolicyBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const updateData = parsedBody.data;
-
-        if (updateData.niceId) {
-            const [existingPolicy] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    and(
-                        eq(resourcePolicies.niceId, updateData.niceId),
-                        eq(resourcePolicies.orgId, policy.orgId)
-                    )
-                );
-
-            if (
-                existingPolicy &&
-                existingPolicy.resourcePolicyId !== policy.resourcePolicyId
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        `A resource policy with niceId "${updateData.niceId}" already exists`
-                    )
-                );
-            }
-        }
-
-        const updatedPolicy = await db.transaction(async (trx) => {
-            const [updated] = await trx
-                .update(resourcePolicies)
-                .set({
-                    ...updateData
-                })
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        policy.resourcePolicyId
-                    )
-                )
-                .returning();
-
-            return updated;
-        });
-
-        if (!updatedPolicy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Failed to update policy"
-                )
-            );
-        }
-
-        return response<ResourcePolicy>(res, {
-            data: updatedPolicy,
-            success: true,
-            error: false,
-            message: "Resource policy updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/resource/createResource.ts
+++ b/server/routers/resource/createResource.ts
@@ -1,19 +1,15 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { build } from "@server/build";
+import { db, domainNamespaces, loginPage } from "@server/db";
 import {
-    db,
-    loginPage,
+    domains,
+    orgDomains,
    orgs,
    Resource,
    resources,
-    resourcePolicies,
    roleResources,
-    rolePolicies,
    roles,
-    userPolicies,
-    userResources,
-    domainNamespaces
+    userResources
 } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -24,18 +20,13 @@ import logger from "@server/logger";
 import { subdomainSchema, wildcardSubdomainSchema } from "@server/lib/schemas";
 import config from "@server/lib/config";
 import { OpenAPITags, registry } from "@server/openApi";
+import { build } from "@server/build";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
-import {
-    validateAndConstructDomain,
-    checkWildcardDomainConflict
-} from "@server/lib/domainUtils";
+import { getUniqueResourceName } from "@server/db/names";
+import { validateAndConstructDomain, checkWildcardDomainConflict } from "@server/lib/domainUtils";
 import { isSubscribed } from "#dynamic/lib/isSubscribed";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import {
-    getUniqueResourceName,
-    getUniqueResourcePolicyName
-} from "@server/db/names";

 const createResourceParamsSchema = z.strictObject({
    orgId: z.string()
@@ -320,46 +311,8 @@ async function createHttpResource(
    let resource: Resource | undefined;

    const niceId = await getUniqueResourceName(orgId);
-    const policyNiceId = await getUniqueResourcePolicyName(orgId);

    await db.transaction(async (trx) => {
-        const adminRole = await trx
-            .select()
-            .from(roles)
-            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-            .limit(1);
-
-        if (adminRole.length === 0) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
-            );
-        }
-
-        const [defaultPolicy] = await trx
-            .insert(resourcePolicies)
-            .values({
-                niceId: policyNiceId,
-                orgId,
-                name: `default policy for ${niceId}`,
-                sso: true,
-                scope: "resource"
-            })
-            .returning();
-
-        // make this policy visible by the admin role
-        await trx.insert(rolePolicies).values({
-            roleId: adminRole[0].roleId,
-            resourcePolicyId: defaultPolicy.resourcePolicyId
-        });
-
-        // make this policy visible by the current user
-        if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
-            await trx.insert(userPolicies).values({
-                userId: req.user?.userId!,
-                resourcePolicyId: defaultPolicy.resourcePolicyId
-            });
-        }
-
        const newResource = await trx
            .insert(resources)
            .values({
@@ -375,11 +328,22 @@ async function createHttpResource(
                stickySession: stickySession,
                postAuthPath: postAuthPath,
                wildcard,
-                health: "unknown",
-                defaultResourcePolicyId: defaultPolicy.resourcePolicyId
+                health: "unknown"
            })
            .returning();

+        const adminRole = await db
+            .select()
+            .from(roles)
+            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+            .limit(1);
+
+        if (adminRole.length === 0) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
+            );
+        }
+
        await trx.insert(roleResources).values({
            roleId: adminRole[0].roleId,
            resourceId: newResource[0].resourceId
@@ -405,7 +369,7 @@ async function createHttpResource(
        );
    }

-    if (build !== "oss") {
+    if (build != "oss") {
        await createCertificate(domainId, fullDomain, db);
    }

@@ -446,10 +410,22 @@ async function createRawResource(
    let resource: Resource | undefined;

    const niceId = await getUniqueResourceName(orgId);
-    const policyNiceId = await getUniqueResourcePolicyName(orgId);

    await db.transaction(async (trx) => {
-        const adminRole = await trx
+        const newResource = await trx
+            .insert(resources)
+            .values({
+                niceId,
+                orgId,
+                name,
+                http,
+                protocol,
+                proxyPort
+                // enableProxy
+            })
+            .returning();
+
+        const adminRole = await db
            .select()
            .from(roles)
            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
@@ -461,44 +437,6 @@ async function createRawResource(
            );
        }

-        const [defaultPolicy] = await trx
-            .insert(resourcePolicies)
-            .values({
-                niceId: policyNiceId,
-                orgId,
-                name: `default policy for ${niceId}`,
-                sso: true,
-                scope: "resource"
-            })
-            .returning();
-
-        // make this policy visible by the admin role
-        await trx.insert(rolePolicies).values({
-            roleId: adminRole[0].roleId,
-            resourcePolicyId: defaultPolicy.resourcePolicyId
-        });
-
-        // make this policy visible by the current user
-        if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
-            await trx.insert(userPolicies).values({
-                userId: req.user?.userId!,
-                resourcePolicyId: defaultPolicy.resourcePolicyId
-            });
-        }
-
-        const newResource = await trx
-            .insert(resources)
-            .values({
-                niceId,
-                orgId,
-                name,
-                http,
-                protocol,
-                proxyPort,
-                defaultResourcePolicyId: defaultPolicy.resourcePolicyId
-            })
-            .returning();
-
        await trx.insert(roleResources).values({
            roleId: adminRole[0].roleId,
            resourceId: newResource[0].resourceId
--- a/server/routers/resource/deleteResource.ts
+++ b/server/routers/resource/deleteResource.ts
@@ -1,22 +1,17 @@
-import { eq, inArray } from "drizzle-orm";
-import {
-    db,
-    newts,
-    resourcePolicies,
-    resources,
-    sites,
-    targetHealthCheck,
-    targets
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
+import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { db, targetHealthCheck } from "@server/db";
+import { newts, resources, sites, targets } from "@server/db";
+import { eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import { addPeer } from "../gerbil/peers";
 import { removeTargets } from "../newt/targets";
+import { getAllowedIps } from "../target/helpers";
+import { OpenAPITags, registry } from "@server/openApi";

 // Define Zod schema for request parameters validation
 const deleteResourceSchema = z.strictObject({
@@ -118,18 +113,6 @@ export async function deleteResource(
            }
        }

-        // Also delete default resource policy
-        if (deletedResource.defaultResourcePolicyId) {
-            await db
-                .delete(resourcePolicies)
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        deletedResource.defaultResourcePolicyId
-                    )
-                );
-        }
-
        return response(res, {
            data: null,
            success: true,
--- a/server/routers/resource/getResourceAuthInfo.ts
+++ b/server/routers/resource/getResourceAuthInfo.ts
@@ -2,13 +2,13 @@ import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import {
    db,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
+    resourceHeaderAuth,
+    resourceHeaderAuthExtendedCompatibility,
+    resourcePassword,
+    resourcePincode,
    resources
 } from "@server/db";
-import { eq, or } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -60,53 +60,64 @@ export async function getResourceAuthInfo(

        const isGuidInteger = /^\d+$/.test(resourceGuid);

-        const buildQuery = (whereClause: ReturnType<typeof eq>) =>
-            db
-                .select()
-                .from(resources)
-                .leftJoin(
-                    resourcePolicies,
-                    or(
-                        eq(
-                            resourcePolicies.resourcePolicyId,
-                            resources.resourcePolicyId
-                        ),
-                        eq(
-                            resourcePolicies.resourcePolicyId,
-                            resources.defaultResourcePolicyId
-                        )
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyPincode,
-                    eq(
-                        resourcePolicyPincode.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyPassword,
-                    eq(
-                        resourcePolicyPassword.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyHeaderAuth,
-                    eq(
-                        resourcePolicyHeaderAuth.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .where(whereClause)
-                .limit(1);
-
        const [result] =
            isGuidInteger && build === "saas"
-                ? await buildQuery(
-                      eq(resources.resourceId, Number(resourceGuid))
-                  )
-                : await buildQuery(eq(resources.resourceGuid, resourceGuid));
+                ? await db
+                      .select()
+                      .from(resources)
+                      .leftJoin(
+                          resourcePincode,
+                          eq(resourcePincode.resourceId, resources.resourceId)
+                      )
+                      .leftJoin(
+                          resourcePassword,
+                          eq(resourcePassword.resourceId, resources.resourceId)
+                      )
+
+                      .leftJoin(
+                          resourceHeaderAuth,
+                          eq(
+                              resourceHeaderAuth.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .leftJoin(
+                          resourceHeaderAuthExtendedCompatibility,
+                          eq(
+                              resourceHeaderAuthExtendedCompatibility.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .where(eq(resources.resourceId, Number(resourceGuid)))
+                      .limit(1)
+                : await db
+                      .select()
+                      .from(resources)
+                      .leftJoin(
+                          resourcePincode,
+                          eq(resourcePincode.resourceId, resources.resourceId)
+                      )
+                      .leftJoin(
+                          resourcePassword,
+                          eq(resourcePassword.resourceId, resources.resourceId)
+                      )
+
+                      .leftJoin(
+                          resourceHeaderAuth,
+                          eq(
+                              resourceHeaderAuth.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .leftJoin(
+                          resourceHeaderAuthExtendedCompatibility,
+                          eq(
+                              resourceHeaderAuthExtendedCompatibility.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .where(eq(resources.resourceGuid, resourceGuid))
+                      .limit(1);

        const resource = result?.resources;
        if (!resource) {
@@ -115,10 +126,11 @@ export async function getResourceAuthInfo(
            );
        }

-        const policy = result?.resourcePolicies;
-        const pincode = result?.resourcePolicyPincode;
-        const password = result?.resourcePolicyPassword;
-        const headerAuth = result?.resourcePolicyHeaderAuth;
+        const pincode = result?.resourcePincode;
+        const password = result?.resourcePassword;
+        const headerAuth = result?.resourceHeaderAuth;
+        const headerAuthExtendedCompatibility =
+            result?.resourceHeaderAuthExtendedCompatibility;

        const url = resource.fullDomain
            ? `${resource.ssl ? "https" : "http"}://${resource.fullDomain}`
@@ -134,13 +146,13 @@ export async function getResourceAuthInfo(
                pincode: pincode !== null,
                headerAuth: headerAuth !== null,
                headerAuthExtendedCompatibility:
-                    headerAuth?.extendedCompatibility ?? false,
-                sso: policy?.sso ?? false,
+                    headerAuthExtendedCompatibility !== null,
+                sso: resource.sso,
                blockAccess: resource.blockAccess,
                url: url ?? "",
                wildcard: resource.wildcard ?? false,
                fullDomain: resource.fullDomain,
-                whitelist: policy?.emailWhitelistEnabled ?? false,
+                whitelist: resource.emailWhitelistEnabled,
                skipToIdpId: resource.skipToIdpId,
                orgId: resource.orgId,
                postAuthPath: resource.postAuthPath ?? null
--- a/server/routers/resource/getResourcePolicies.ts
+++ b/server/routers/resource/getResourcePolicies.ts
@@ -1,109 +0,0 @@
-import { db, resources } from "@server/db";
-import {
-    queryResourcePolicy,
-    type GetResourcePolicyResponse
-} from "@server/routers/policy/getResourcePolicy";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const getResourcePoliciesParamsSchema = z.strictObject({
-    resourceId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-export type GetResourcePoliciesResponse = {
-    defaultPolicy: GetResourcePolicyResponse;
-    sharedPolicy: GetResourcePolicyResponse | null;
-};
-
-registry.registerPath({
-    method: "get",
-    path: "/resource/{resourceId}/policies",
-    description: "Get the inline and shared policies associated with a resource.",
-    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
-    request: {
-        params: getResourcePoliciesParamsSchema
-    },
-    responses: {}
-});
-
-export async function getResourcePolicies(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getResourcePoliciesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourceId } = parsedParams.data;
-
-        const [resource] = await db
-            .select({
-                defaultResourcePolicyId: resources.defaultResourcePolicyId,
-                resourcePolicyId: resources.resourcePolicyId
-            })
-            .from(resources)
-            .where(eq(resources.resourceId, resourceId))
-            .limit(1);
-
-        if (!resource) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
-            );
-        }
-
-        if (!resource.defaultResourcePolicyId) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "Resource has no default policy"
-                )
-            );
-        }
-
-        const [defaultPolicy, sharedPolicy] = await Promise.all([
-            queryResourcePolicy({
-                resourcePolicyId: resource.defaultResourcePolicyId
-            }),
-            resource.resourcePolicyId
-                ? queryResourcePolicy({
-                      resourcePolicyId: resource.resourcePolicyId
-                  })
-                : null
-        ]);
-
-        return response<GetResourcePoliciesResponse>(res, {
-            data: {
-                defaultPolicy:
-                    // the policy will always be non nullable
-                    defaultPolicy as unknown as GetResourcePolicyResponse,
-                sharedPolicy
-            },
-            success: true,
-            error: false,
-            message: "Resource policies retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}
--- a/server/routers/resource/getUserResources.ts
+++ b/server/routers/resource/getUserResources.ts
@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { and, eq, or, inArray } from "drizzle-orm";
+import { db, DB_TYPE } from "@server/db";
+import { and, eq, or, inArray, sql } from "drizzle-orm";
 import {
    resources,
    userResources,
@@ -12,7 +12,9 @@ import {
    resourceWhitelist,
    siteResources,
    userSiteResources,
-    roleSiteResources
+    roleSiteResources,
+    siteNetworks,
+    sites
 } from "@server/db";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
@@ -156,9 +158,24 @@ export async function getUserResources(
            enabled: boolean;
            alias: string | null;
            aliasAddress: string | null;
+            tcpPortRangeString: string | null;
+            udpPortRangeString: string | null;
+            disableIcmp: boolean | null;
+            siteIds: number[];
+            siteNames: string[];
+            siteNiceIds: string[];
+            siteAddresses: (string | null)[];
+            siteOnlines: boolean[];
        }> = [];
        if (accessibleSiteResourceIds.length > 0) {
-            siteResourcesData = await db
+            const aggCol = <T>(column: any) => {
+                if (DB_TYPE === "sqlite") {
+                    return sql<T>`json_group_array(${column})`;
+                }
+                return sql<T>`COALESCE(array_agg(${column}) FILTER (WHERE ${sites.siteId} IS NOT NULL), '{}')`;
+            };
+
+            const siteResourcesRaw = await db
                .select({
                    siteResourceId: siteResources.siteResourceId,
                    name: siteResources.name,
@@ -170,9 +187,22 @@ export async function getUserResources(
                    fullDomain: siteResources.fullDomain,
                    enabled: siteResources.enabled,
                    alias: siteResources.alias,
-                    aliasAddress: siteResources.aliasAddress
+                    aliasAddress: siteResources.aliasAddress,
+                    tcpPortRangeString: siteResources.tcpPortRangeString,
+                    udpPortRangeString: siteResources.udpPortRangeString,
+                    disableIcmp: siteResources.disableIcmp,
+                    siteIds: aggCol<number[]>(sites.siteId),
+                    siteNames: aggCol<string[]>(sites.name),
+                    siteNiceIds: aggCol<string[]>(sites.niceId),
+                    siteAddresses: aggCol<(string | null)[]>(sites.address),
+                    siteOnlines: aggCol<boolean[]>(sites.online)
                })
                .from(siteResources)
+                .leftJoin(
+                    siteNetworks,
+                    eq(siteResources.networkId, siteNetworks.networkId)
+                )
+                .leftJoin(sites, eq(siteNetworks.siteId, sites.siteId))
                .where(
                    and(
                        inArray(
@@ -182,7 +212,55 @@ export async function getUserResources(
                        eq(siteResources.orgId, orgId),
                        eq(siteResources.enabled, true)
                    )
-                );
+                )
+                .groupBy(siteResources.siteResourceId);
+
+            siteResourcesData = siteResourcesRaw.map((row: any) => {
+                if (DB_TYPE !== "sqlite") {
+                    return row;
+                }
+                const siteIdsRaw = JSON.parse(row.siteIds) as (number | null)[];
+                const siteNamesRaw = JSON.parse(row.siteNames) as (
+                    | string
+                    | null
+                )[];
+                const siteNiceIdsRaw = JSON.parse(row.siteNiceIds) as (
+                    | string
+                    | null
+                )[];
+                const siteAddressesRaw = JSON.parse(row.siteAddresses) as (
+                    | string
+                    | null
+                )[];
+                const siteOnlinesRaw = JSON.parse(row.siteOnlines) as (
+                    | 0
+                    | 1
+                    | null
+                )[];
+
+                const siteIds: number[] = [];
+                const siteNames: string[] = [];
+                const siteNiceIds: string[] = [];
+                const siteAddresses: (string | null)[] = [];
+                const siteOnlines: boolean[] = [];
+                for (let i = 0; i < siteIdsRaw.length; i++) {
+                    if (siteIdsRaw[i] == null) continue;
+                    siteIds.push(siteIdsRaw[i] as number);
+                    siteNames.push((siteNamesRaw[i] ?? "") as string);
+                    siteNiceIds.push((siteNiceIdsRaw[i] ?? "") as string);
+                    siteAddresses.push(siteAddressesRaw[i] ?? null);
+                    siteOnlines.push(siteOnlinesRaw[i] === 1);
+                }
+
+                return {
+                    ...row,
+                    siteIds,
+                    siteNames,
+                    siteNiceIds,
+                    siteAddresses,
+                    siteOnlines
+                };
+            });
        }

        // Check for password, pincode, and whitelist protection for each resource
@@ -260,6 +338,14 @@ export async function getUserResources(
                enabled: siteResource.enabled,
                alias: siteResource.alias,
                aliasAddress: siteResource.aliasAddress,
+                tcpPortRangeString: siteResource.tcpPortRangeString,
+                udpPortRangeString: siteResource.udpPortRangeString,
+                disableIcmp: siteResource.disableIcmp,
+                siteIds: siteResource.siteIds,
+                siteNames: siteResource.siteNames,
+                siteNiceIds: siteResource.siteNiceIds,
+                siteAddresses: siteResource.siteAddresses,
+                siteOnlines: siteResource.siteOnlines,
                type: "site" as const
            };
        });
@@ -302,11 +388,19 @@ export type GetUserResourcesResponse = {
            destination: string;
            mode: string;
            protocol: string | null;
+            tcpPortRangeString: string | null;
+            udpPortRangeString: string | null;
+            disableIcmp: boolean | null;
            ssl: boolean;
            fullDomain: string | null;
            enabled: boolean;
            alias: string | null;
            aliasAddress: string | null;
+            siteIds: number[];
+            siteNames: string[];
+            siteNiceIds: string[];
+            siteAddresses: (string | null)[];
+            siteOnlines: boolean[];
            type: "site";
        }>;
    };
--- a/server/routers/resource/index.ts
+++ b/server/routers/resource/index.ts
@@ -33,4 +33,3 @@ export * from "./removeUserFromResource";
 export * from "./listAllResourceNames";
 export * from "./removeEmailFromResourceWhitelist";
 export * from "./getStatusHistory";
-export * from "./getResourcePolicies";
--- a/server/routers/resource/listResources.ts
+++ b/server/routers/resource/listResources.ts
@@ -1,16 +1,21 @@
 import {
    db,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
+    labels,
+    resourceHeaderAuth,
+    resourceHeaderAuthExtendedCompatibility,
+    resourceLabels,
+    resourcePassword,
+    resourcePincode,
    resources,
    roleResources,
    sites,
    targetHealthCheck,
    targets,
-    userResources
+    userResources,
+    type Label
 } from "@server/db";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -154,6 +159,7 @@ export type ResourceWithTargets = {
        siteNiceId: string;
        online?: boolean; // undefined for local sites
    }>;
+    labels?: Array<Pick<Label, "color" | "labelId" | "name">>;
 };

 function queryResourcesBase() {
@@ -163,10 +169,10 @@ function queryResourcesBase() {
            name: resources.name,
            ssl: resources.ssl,
            fullDomain: resources.fullDomain,
-            passwordId: resourcePolicyPassword.passwordId,
-            sso: resourcePolicies.sso,
-            pincodeId: resourcePolicyPincode.pincodeId,
-            whitelist: resourcePolicies.emailWhitelistEnabled,
+            passwordId: resourcePassword.passwordId,
+            sso: resources.sso,
+            pincodeId: resourcePincode.pincodeId,
+            whitelist: resources.emailWhitelistEnabled,
            http: resources.http,
            protocol: resources.protocol,
            proxyPort: resources.proxyPort,
@@ -174,45 +180,29 @@ function queryResourcesBase() {
            domainId: resources.domainId,
            niceId: resources.niceId,
            wildcard: resources.wildcard,
-            health: resources.health,
-            headerAuthId: resourcePolicyHeaderAuth.headerAuthId,
-            headerAuthExtendedCompatibility:
-                resourcePolicyHeaderAuth.extendedCompatibility
+            headerAuthId: resourceHeaderAuth.headerAuthId,
+            headerAuthExtendedCompatibilityId:
+                resourceHeaderAuthExtendedCompatibility.headerAuthExtendedCompatibilityId,
+            health: resources.health
        })
        .from(resources)
        .leftJoin(
-            resourcePolicies,
-            or(
-                eq(
-                    resourcePolicies.resourcePolicyId,
-                    resources.resourcePolicyId
-                ),
-                eq(
-                    resourcePolicies.resourcePolicyId,
-                    resources.defaultResourcePolicyId
-                )
-            )
-        )
-
-        .leftJoin(
-            resourcePolicyPassword,
-            eq(
-                resourcePolicyPassword.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
+            resourcePassword,
+            eq(resourcePassword.resourceId, resources.resourceId)
        )
        .leftJoin(
-            resourcePolicyPincode,
-            eq(
-                resourcePolicyPincode.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
+            resourcePincode,
+            eq(resourcePincode.resourceId, resources.resourceId)
        )
        .leftJoin(
-            resourcePolicyHeaderAuth,
+            resourceHeaderAuth,
+            eq(resourceHeaderAuth.resourceId, resources.resourceId)
+        )
+        .leftJoin(
+            resourceHeaderAuthExtendedCompatibility,
            eq(
-                resourcePolicyHeaderAuth.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
+                resourceHeaderAuthExtendedCompatibility.resourceId,
+                resources.resourceId
            )
        )
        .leftJoin(targets, eq(targets.resourceId, resources.resourceId))
@@ -222,10 +212,10 @@ function queryResourcesBase() {
        )
        .groupBy(
            resources.resourceId,
-            resourcePolicies.resourcePolicyId,
-            resourcePolicyPassword.passwordId,
-            resourcePolicyPincode.pincodeId,
-            resourcePolicyHeaderAuth.headerAuthId
+            resourcePassword.passwordId,
+            resourcePincode.pincodeId,
+            resourceHeaderAuth.headerAuthId,
+            resourceHeaderAuthExtendedCompatibility.headerAuthExtendedCompatibilityId
        );
 }

@@ -304,6 +294,11 @@ export async function listResources(
            );
        }

+        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.labels
+        );
+
        let accessibleResources: Array<{ resourceId: number }>;
        if (req.user) {
            accessibleResources = await db
@@ -341,24 +336,6 @@ export async function listResources(
            )
        ];

-        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${resources.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${resources.niceId})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${resources.fullDomain})`,
-                        "%" + query.toLowerCase() + "%"
-                    )
-                )
-            );
-        }
        if (typeof enabled !== "undefined") {
            conditions.push(eq(resources.enabled, enabled));
        }
@@ -371,21 +348,21 @@ export async function listResources(
                case "protected":
                    conditions.push(
                        or(
-                            eq(resourcePolicies.sso, true),
-                            eq(resourcePolicies.emailWhitelistEnabled, true),
-                            not(isNull(resourcePolicyHeaderAuth.headerAuthId)),
-                            not(isNull(resourcePolicyPincode.pincodeId)),
-                            not(isNull(resourcePolicyPassword.passwordId))
+                            eq(resources.sso, true),
+                            eq(resources.emailWhitelistEnabled, true),
+                            not(isNull(resourceHeaderAuth.headerAuthId)),
+                            not(isNull(resourcePincode.pincodeId)),
+                            not(isNull(resourcePassword.passwordId))
                        )
                    );
                    break;
                case "not_protected":
                    conditions.push(
-                        not(eq(resourcePolicies.sso, true)),
-                        not(eq(resourcePolicies.emailWhitelistEnabled, true)),
-                        isNull(resourcePolicyHeaderAuth.headerAuthId),
-                        isNull(resourcePolicyPincode.pincodeId),
-                        isNull(resourcePolicyPassword.passwordId)
+                        not(eq(resources.sso, true)),
+                        not(eq(resources.emailWhitelistEnabled, true)),
+                        isNull(resourceHeaderAuth.headerAuthId),
+                        isNull(resourcePincode.pincodeId),
+                        isNull(resourcePassword.passwordId)
                    );
                    break;
            }
@@ -402,6 +379,32 @@ export async function listResources(
                .where(and(eq(sites.orgId, orgId), eq(sites.siteId, siteId)));
            conditions.push(inArray(resources.resourceId, resourcesWithSite));
        }
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            const queryList = [
+                like(sql`LOWER(${resources.name})`, q),
+                like(sql`LOWER(${resources.niceId})`, q),
+                like(sql`LOWER(${resources.fullDomain})`, q)
+            ];
+
+            if (isLabelFeatureEnabled) {
+                queryList.push(
+                    inArray(
+                        resources.resourceId,
+                        db
+                            .select({ id: resourceLabels.resourceId })
+                            .from(resourceLabels)
+                            .innerJoin(
+                                labels,
+                                eq(labels.labelId, resourceLabels.labelId)
+                            )
+                            .where(like(sql`LOWER(${labels.name})`, q))
+                    )
+                );
+            }
+
+            conditions.push(or(...queryList));
+        }

        const baseQuery = queryResourcesBase().where(and(...conditions));

@@ -423,6 +426,36 @@ export async function listResources(
        ]);

        const resourceIdList = rows.map((row) => row.resourceId);
+
+        let labelsForResources: Array<{
+            labelId: number;
+            name: string;
+            color: string;
+            resourceId: number;
+        }> = [];
+
+        if (isLabelFeatureEnabled) {
+            labelsForResources =
+                resourceIdList.length === 0
+                    ? []
+                    : await db
+                          .select({
+                              labelId: labels.labelId,
+                              name: labels.name,
+                              color: labels.color,
+                              resourceId: resourceLabels.resourceId
+                          })
+                          .from(labels)
+                          .innerJoin(
+                              resourceLabels,
+                              eq(resourceLabels.labelId, labels.labelId)
+                          )
+                          .where(
+                              inArray(resourceLabels.resourceId, resourceIdList)
+                          )
+                          .orderBy(asc(resourceLabels.resourceLabelId));
+        }
+
        const allResourceTargets =
            resourceIdList.length === 0
                ? []
@@ -462,9 +495,9 @@ export async function listResources(
                    ssl: row.ssl,
                    fullDomain: row.fullDomain,
                    passwordId: row.passwordId,
-                    sso: row.sso ?? false,
+                    sso: row.sso,
                    pincodeId: row.pincodeId,
-                    whitelist: row.whitelist ?? false,
+                    whitelist: row.whitelist,
                    http: row.http,
                    protocol: row.protocol,
                    proxyPort: row.proxyPort,
@@ -474,7 +507,10 @@ export async function listResources(
                    headerAuthId: row.headerAuthId,
                    health: row.health ?? null,
                    targets: [],
-                    sites: []
+                    sites: [],
+                    labels: labelsForResources.filter(
+                        (l) => l.resourceId === row.resourceId
+                    )
                };
                map.set(row.resourceId, entry);
            }
--- a/server/routers/resource/types.ts
+++ b/server/routers/resource/types.ts
@@ -1,6 +1,3 @@
-import type { Resource, ResourcePolicy } from "@server/db";
-import type { PaginatedResponse } from "@server/types/Pagination";
-
 export type GetMaintenanceInfoResponse = {
    resourceId: number;
    name: string;
@@ -11,19 +8,3 @@ export type GetMaintenanceInfoResponse = {
    maintenanceMessage: string | null;
    maintenanceEstimatedTime: string | null;
 };
-
-export type AttachedResource = Pick<
-    Resource,
-    "resourceId" | "name" | "fullDomain"
->;
-
-export type ResourcePolicyWithResources = Pick<
-    ResourcePolicy,
-    "resourcePolicyId" | "niceId" | "name" | "orgId"
-> & {
-    resources: Array<AttachedResource>;
-};
-
-export type ListResourcePoliciesResponse = PaginatedResponse<{
-    policies: Array<ResourcePolicyWithResources>;
-}>;
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -1,23 +1,12 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
-    db,
-    domainNamespaces,
-    loginPage,
-    resourceHeaderAuth,
-    resourceHeaderAuthExtendedCompatibility,
-    resourcePassword,
-    resourcePincode,
-    resourceRules,
-    resourceWhitelist
-} from "@server/db";
+import { db, domainNamespaces, loginPage } from "@server/db";
 import {
    domains,
    Org,
    orgDomains,
    orgs,
    Resource,
-    resourcePolicies,
    resources
 } from "@server/db";
 import { eq, and, ne } from "drizzle-orm";
@@ -35,10 +24,7 @@ import {
 import { registry } from "@server/openApi";
 import { OpenAPITags } from "@server/openApi";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
-import {
-    validateAndConstructDomain,
-    checkWildcardDomainConflict
-} from "@server/lib/domainUtils";
+import { validateAndConstructDomain, checkWildcardDomainConflict } from "@server/lib/domainUtils";
 import { build } from "@server/build";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -82,8 +68,7 @@ const updateHttpResourceBodySchema = z
        maintenanceTitle: z.string().max(255).nullable().optional(),
        maintenanceMessage: z.string().max(2000).nullable().optional(),
        maintenanceEstimatedTime: z.string().max(100).nullable().optional(),
-        postAuthPath: z.string().nullable().optional(),
-        resourcePolicyId: z.number().nullable().optional()
+        postAuthPath: z.string().nullable().optional()
    })
    .refine((data) => Object.keys(data).length > 0, {
        error: "At least one field must be provided for update"
@@ -180,8 +165,7 @@ const updateRawResourceBodySchema = z
        stickySession: z.boolean().optional(),
        enabled: z.boolean().optional(),
        proxyProtocol: z.boolean().optional(),
-        proxyProtocolVersion: z.int().min(1).optional(),
-        resourcePolicyId: z.number().nullable().optional()
+        proxyProtocolVersion: z.int().min(1).optional()
    })
    .refine((data) => Object.keys(data).length > 0, {
        error: "At least one field must be provided for update"
@@ -317,42 +301,6 @@ async function updateHttpResource(

    const updateData = parsedBody.data;

-    const isLicensed = await isLicensedOrSubscribed(
-        resource.orgId,
-        tierMatrix.wildcardSubdomain
-    );
-
-    if (updateData.resourcePolicyId != null) {
-        if (!isLicensed) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Resource policies are not supported on your current plan. Please upgrade to access this feature."
-                )
-            );
-        }
-
-        const [existingPolicy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(
-                eq(
-                    resourcePolicies.resourcePolicyId,
-                    updateData.resourcePolicyId
-                )
-            )
-            .limit(1);
-
-        if (!existingPolicy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${updateData.resourcePolicyId} not found`
-                )
-            );
-        }
-    }
-
    if (updateData.niceId) {
        const [existingResource] = await db
            .select()
@@ -378,6 +326,10 @@ async function updateHttpResource(

    // Wildcard subdomains are a paid feature
    if (updateData.subdomain && updateData.subdomain.includes("*")) {
+        const isLicensed = await isLicensedOrSubscribed(
+            resource.orgId,
+            tierMatrix.wildcardSubdomain
+        );
        if (!isLicensed) {
            return next(
                createHttpError(
@@ -522,6 +474,10 @@ async function updateHttpResource(
        headers = null;
    }

+    const isLicensed = await isLicensedOrSubscribed(
+        resource.orgId,
+        tierMatrix.maintencePage
+    );
    if (!isLicensed) {
        updateData.maintenanceModeEnabled = undefined;
        updateData.maintenanceModeType = undefined;
@@ -579,122 +535,38 @@ async function updateRawResource(
    }

    const updateData = parsedBody.data;
-    let updatedResource: Resource | null = null;

-    const [existingResource] = await db
-        .select()
-        .from(resources)
-        .where(eq(resources.resourceId, resource.resourceId))
-        .limit(1);
-
-    await db.transaction(async (trx) => {
-        if (updateData.resourcePolicyId != null) {
-            const [existingPolicy] = await trx
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        updateData.resourcePolicyId
-                    )
+    if (updateData.niceId) {
+        const [existingResource] = await db
+            .select()
+            .from(resources)
+            .where(
+                and(
+                    eq(resources.niceId, updateData.niceId),
+                    eq(resources.orgId, resource.orgId)
                )
-                .limit(1);
+            );

-            if (!existingPolicy) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Resource policy with ID ${updateData.resourcePolicyId} not found`
-                    )
-                );
-            }
-        } else {
-            // we are in an inline policy and we need to clear out the old tables
-            await Promise.all([
-                trx
-                    .delete(resourcePassword)
-                    .where(
-                        eq(
-                            resourcePassword.resourceId,
-                            existingResource.resourceId
-                        )
-                    ),
-                trx
-                    .delete(resourcePincode)
-                    .where(
-                        eq(
-                            resourcePincode.resourceId,
-                            existingResource.resourceId
-                        )
-                    ),
-                trx
-                    .delete(resourceHeaderAuth)
-                    .where(
-                        eq(
-                            resourceHeaderAuth.resourceId,
-                            existingResource.resourceId
-                        )
-                    ),
-                trx
-                    .delete(resourceHeaderAuthExtendedCompatibility)
-                    .where(
-                        eq(
-                            resourceHeaderAuthExtendedCompatibility.resourceId,
-                            existingResource.resourceId
-                        )
-                    ),
-                trx
-                    .delete(resourceWhitelist)
-                    .where(
-                        eq(
-                            resourceWhitelist.resourceId,
-                            existingResource.resourceId
-                        )
-                    ),
-
-                trx
-                    .delete(resourceRules)
-                    .where(
-                        eq(
-                            resourceRules.resourceId,
-                            existingResource.resourceId
-                        )
-                    )
-            ]);
+        if (
+            existingResource &&
+            existingResource.resourceId !== resource.resourceId
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    `A resource with niceId "${updateData.niceId}" already exists`
+                )
+            );
        }
+    }

-        if (updateData.niceId) {
-            const [existingResourceConflict] = await trx
-                .select()
-                .from(resources)
-                .where(
-                    and(
-                        eq(resources.niceId, updateData.niceId),
-                        eq(resources.orgId, resource.orgId)
-                    )
-                );
+    const updatedResource = await db
+        .update(resources)
+        .set(updateData)
+        .where(eq(resources.resourceId, resource.resourceId))
+        .returning();

-            if (
-                existingResourceConflict &&
-                existingResourceConflict.resourceId !== resource.resourceId
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        `A resource with niceId "${updateData.niceId}" already exists`
-                    )
-                );
-            }
-        }
-
-        [updatedResource] = await trx
-            .update(resources)
-            .set(updateData)
-            .where(eq(resources.resourceId, resource.resourceId))
-            .returning();
-    });
-
-    if (!updatedResource) {
+    if (updatedResource.length === 0) {
        return next(
            createHttpError(
                HttpCode.NOT_FOUND,
@@ -704,7 +576,7 @@ async function updateRawResource(
    }

    return response(res, {
-        data: updatedResource,
+        data: updatedResource[0],
        success: true,
        error: false,
        message: "Non-http Resource updated successfully",
--- a/server/routers/site/listSites.ts
+++ b/server/routers/site/listSites.ts
@@ -9,7 +9,10 @@ import {
    siteResources,
    targets,
    sites,
-    userSites
+    userSites,
+    labels,
+    siteLabels,
+    type Label
 } from "@server/db";
 import cache from "#dynamic/lib/cache";
 import response from "@server/lib/response";
@@ -23,6 +26,8 @@ import createHttpError from "http-errors";
 import semver from "semver";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";

 // Stale-while-revalidate: keeps the last successfully fetched version so that
 // a transient network failure / timeout does not flip every site back to
@@ -135,7 +140,7 @@ const listSitesSchema = z.object({
    page: z.coerce
        .number<string>() // for prettier formatting
        .int()
-        .positive()
+        .min(0)
        .optional()
        .catch(1)
        .default(1)
@@ -187,7 +192,7 @@ const listSitesSchema = z.object({

 function querySitesBase() {
    return db
-        .select({
+        .selectDistinct({
            siteId: sites.siteId,
            niceId: sites.niceId,
            name: sites.name,
@@ -233,6 +238,7 @@ type SiteRowBase = Awaited<ReturnType<typeof querySitesBase>>[0];
 type SiteWithUpdateAvailable = Omit<SiteRowBase, "online"> & {
    online?: SiteRowBase["online"]; // undefined for local sites
    newtUpdateAvailable?: boolean;
+    labels?: Array<Pick<Label, "color" | "labelId" | "name">>;
 };

 export type ListSitesResponse = PaginatedResponse<{
@@ -308,6 +314,11 @@ export async function listSites(
                .where(eq(sites.orgId, orgId));
        }

+        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.labels
+        );
+
        const { pageSize, page, query, sort_by, order, online, status } =
            parsedQuery.data;

@@ -319,33 +330,43 @@ export async function listSites(
                eq(sites.orgId, orgId)
            )
        ];
-        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${sites.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${sites.niceId})`,
-                        "%" + query.toLowerCase() + "%"
-                    )
-                )
-            );
-        }
+
        if (typeof online !== "undefined") {
            conditions.push(eq(sites.online, online));
        }
        if (typeof status !== "undefined") {
            conditions.push(eq(sites.status, status));
        }
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            const queryList = [
+                like(sql`LOWER(${sites.name})`, q),
+                like(sql`LOWER(${sites.niceId})`, q)
+            ];
+
+            if (isLabelFeatureEnabled) {
+                queryList.push(
+                    inArray(
+                        sites.siteId,
+                        db
+                            .select({ id: siteLabels.siteId })
+                            .from(siteLabels)
+                            .innerJoin(
+                                labels,
+                                eq(labels.labelId, siteLabels.labelId)
+                            )
+                            .where(like(sql`LOWER(${labels.name})`, q))
+                    )
+                );
+            }
+            conditions.push(or(...queryList));
+        }
+
        const baseQuery = querySitesBase().where(and(...conditions));

        // we need to add `as` so that drizzle filters the result as a subquery
        const countQuery = db.$count(
-            querySitesBase()
-                .where(and(...conditions))
-                .as("filtered_sites")
+            querySitesBase().where(and(...conditions)).as("filtered_sites")
        );

        const siteListQuery = baseQuery
@@ -367,11 +388,46 @@ export async function listSites(
        // Get latest version asynchronously without blocking the response
        const latestNewtVersionPromise = getLatestNewtVersion();

+        const siteIds = rows.map((site) => site.siteId);
+
+        let labelsForSites: Array<{
+            labelId: number;
+            name: string;
+            color: string;
+            siteId: number;
+        }> = [];
+
+        if (isLabelFeatureEnabled) {
+            labelsForSites =
+                siteIds.length === 0
+                    ? []
+                    : await db
+                          .select({
+                              labelId: labels.labelId,
+                              name: labels.name,
+                              color: labels.color,
+                              siteId: siteLabels.siteId
+                          })
+                          .from(labels)
+                          .innerJoin(
+                              siteLabels,
+                              eq(siteLabels.labelId, labels.labelId)
+                          )
+                          .where(inArray(siteLabels.siteId, siteIds))
+                          .orderBy(asc(siteLabels.siteLabelId));
+        }
+
        const sitesWithUpdates: SiteWithUpdateAvailable[] = rows.map((site) => {
            const siteWithUpdate: SiteWithUpdateAvailable = { ...site };
            // Initially set to false, will be updated if version check succeeds
            siteWithUpdate.newtUpdateAvailable = false;
-            return siteWithUpdate;
+
+            // associate labels
+            const labelsForSite = labelsForSites.filter(
+                (label) => label.siteId === site.siteId
+            );
+
+            return { ...siteWithUpdate, labels: labelsForSite };
        });

        // Try to get the latest version, but don't block if it fails
--- a/server/routers/siteResource/listAllSiteResourcesByOrg.ts
+++ b/server/routers/siteResource/listAllSiteResourcesByOrg.ts
@@ -1,4 +1,14 @@
-import { db, DB_TYPE, SiteResource, siteNetworks, siteResources, sites } from "@server/db";
+import {
+    db,
+    DB_TYPE,
+    Label,
+    SiteResource,
+    siteNetworks,
+    siteResourceLabels,
+    siteResources,
+    sites,
+    labels
+} from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -9,6 +19,8 @@ import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
 import { fromError } from "zod-validation-error";
+import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";

 const listAllSiteResourcesByOrgParamsSchema = z.strictObject({
    orgId: z.string()
@@ -69,16 +81,11 @@ const listAllSiteResourcesByOrgQuerySchema = z.object({
            default: "asc",
            description: "Sort order"
        }),
-    siteId: z.coerce
-        .number<string>()
-        .int()
-        .positive()
-        .optional()
-        .openapi({
-            type: "integer",
-            description:
-                "When set, only site resources associated with this site (via network) are returned"
-        })
+    siteId: z.coerce.number<string>().int().positive().optional().openapi({
+        type: "integer",
+        description:
+            "When set, only site resources associated with this site (via network) are returned"
+    })
 });

 export type ListAllSiteResourcesByOrgResponse = PaginatedResponse<{
@@ -88,6 +95,7 @@ export type ListAllSiteResourcesByOrgResponse = PaginatedResponse<{
        siteNames: string[];
        siteNiceIds: string[];
        siteAddresses: (string | null)[];
+        labels?: Array<Pick<Label, "labelId" | "name" | "color">>;
    })[];
 }>;

@@ -234,6 +242,11 @@ export async function listAllSiteResourcesByOrg(
        const { page, pageSize, query, mode, sort_by, order, siteId } =
            parsedQuery.data;

+        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
+            orgId,
+            tierMatrix.labels
+        );
+
        const conditions = [and(eq(siteResources.orgId, orgId))];

        if (siteId != null) {
@@ -258,41 +271,41 @@ export async function listAllSiteResourcesByOrg(
                inArray(siteResources.siteResourceId, resourcesForSite)
            );
        }
-        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${siteResources.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${siteResources.niceId})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${siteResources.destination})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${siteResources.alias})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${siteResources.aliasAddress})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${sites.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    )
-                )
-            );
-        }

        if (mode) {
            conditions.push(eq(siteResources.mode, mode));
        }

+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            const queryList = [
+                like(sql`LOWER(${siteResources.name})`, q),
+                like(sql`LOWER(${siteResources.niceId})`, q),
+                like(sql`LOWER(${siteResources.destination})`, q),
+                like(sql`LOWER(${siteResources.alias})`, q),
+                like(sql`LOWER(${siteResources.aliasAddress})`, q),
+                like(sql`LOWER(${sites.name})`, q)
+            ];
+
+            if (isLabelFeatureEnabled) {
+                queryList.push(
+                    inArray(
+                        siteResources.siteResourceId,
+                        db
+                            .select({ id: siteResourceLabels.siteResourceId })
+                            .from(siteResourceLabels)
+                            .innerJoin(
+                                labels,
+                                eq(labels.labelId, siteResourceLabels.labelId)
+                            )
+                            .where(like(sql`LOWER(${labels.name})`, q))
+                    )
+                );
+            }
+
+            conditions.push(or(...queryList));
+        }
+
        const baseQuery = querySiteResourcesBase().where(and(...conditions));

        const countQuery = db.$count(
@@ -315,11 +328,51 @@ export async function listAllSiteResourcesByOrg(
            countQuery
        ]);

-        const siteResourcesList = siteResourcesRaw.map(transformSiteResourceRow);
+        const siteResourcesList = siteResourcesRaw.map(
+            transformSiteResourceRow
+        );
+
+        const siteResourceIdList = siteResourcesList.map(
+            (r) => r.siteResourceId
+        );
+
+        let labelsForSiteResources: Array<{
+            labelId: number;
+            name: string;
+            color: string;
+            siteResourceId: number;
+        }> = [];
+
+        if (isLabelFeatureEnabled && siteResourceIdList.length > 0) {
+            labelsForSiteResources = await db
+                .select({
+                    labelId: labels.labelId,
+                    name: labels.name,
+                    color: labels.color,
+                    siteResourceId: siteResourceLabels.siteResourceId
+                })
+                .from(labels)
+                .innerJoin(
+                    siteResourceLabels,
+                    eq(siteResourceLabels.labelId, labels.labelId)
+                )
+                .where(
+                    inArray(
+                        siteResourceLabels.siteResourceId,
+                        siteResourceIdList
+                    )
+                )
+                .orderBy(asc(siteResourceLabels.siteResourceLabelId));
+        }

        return response<ListAllSiteResourcesByOrgResponse>(res, {
            data: {
-                siteResources: siteResourcesList,
+                siteResources: siteResourcesList.map((r) => ({
+                    ...r,
+                    labels: labelsForSiteResources.filter(
+                        (l) => l.siteResourceId === r.siteResourceId
+                    )
+                })),
                pagination: {
                    total: totalCount,
                    pageSize,
@@ -340,4 +393,4 @@ export async function listAllSiteResourcesByOrg(
            )
        );
    }
-}
+}
--- a/server/routers/user/getOrgUser.ts
+++ b/server/routers/user/getOrgUser.ts
@@ -144,7 +144,7 @@ export async function getOrgUser(
                return next(
                    createHttpError(
                        HttpCode.FORBIDDEN,
-                        "User does not have permission to get organization user details"
+                        "User does not have permission perform this action"
                    )
                );
            }
--- a/src/app/[orgId]/settings/(private)/labels/page.tsx
+++ b/src/app/[orgId]/settings/(private)/labels/page.tsx
@@ -0,0 +1,63 @@
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import { AxiosResponse } from "axios";
+import OrgLabelsTable from "@app/components/OrgLabelsTable";
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Labels"
+};
+
+type Props = {
+    params: Promise<{ orgId: string }>;
+    searchParams: Promise<Record<string, string>>;
+};
+
+export const dynamic = "force-dynamic";
+
+export default async function LabelsPage({ params, searchParams }: Props) {
+    const { orgId } = await params;
+
+    const searchParamsObj = new URLSearchParams(await searchParams);
+
+    let labels: ListOrgLabelsResponse["labels"] = [];
+    let pagination: ListOrgLabelsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<ListOrgLabelsResponse>>(
+            `/org/${orgId}/labels?${searchParamsObj.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        labels = responseData.labels;
+        pagination = responseData.pagination;
+    } catch (e) {}
+
+    const t = await getTranslations();
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("labels")}
+                description={t("orgLabelsDescription")}
+            />
+
+            <OrgLabelsTable
+                labels={labels}
+                orgId={orgId}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}
--- a/src/app/[orgId]/settings/(private)/policies/layout.tsx
+++ b/src/app/[orgId]/settings/(private)/policies/layout.tsx
@@ -1,23 +0,0 @@
-import { getCachedOrg } from "@app/lib/api/getCachedOrg";
-import OrgProvider from "@app/providers/OrgProvider";
-import type { GetOrgResponse } from "@server/routers/org";
-import { redirect } from "next/navigation";
-
-export interface PolicyLayoutPageProps {
-    params: Promise<{ orgId: string }>;
-    children: React.ReactNode;
-}
-
-export default async function PolicyLayoutPage(props: PolicyLayoutPageProps) {
-    const params = await props.params;
-
-    let org: GetOrgResponse | null = null;
-    try {
-        const res = await getCachedOrg(params.orgId);
-        org = res.data.data;
-    } catch {
-        redirect(`/${params.orgId}/settings`);
-    }
-
-    return <OrgProvider org={org}>{props.children}</OrgProvider>;
-}
--- a/src/app/[orgId]/settings/(private)/policies/resource/[niceId]/page.tsx
+++ b/src/app/[orgId]/settings/(private)/policies/resource/[niceId]/page.tsx
@@ -1,60 +0,0 @@
-import { EditPolicyForm } from "@app/components/resource-policy/EditPolicyForm";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { Button } from "@app/components/ui/button";
-import { internal } from "@app/lib/api";
-import { authCookieHeader } from "@app/lib/api/cookies";
-import { ResourcePolicyProvider } from "@app/providers/ResourcePolicyProvider";
-import type { GetResourcePolicyResponse } from "@server/routers/policy";
-import type { AxiosResponse } from "axios";
-import { getTranslations } from "next-intl/server";
-import Link from "next/link";
-import { redirect } from "next/navigation";
-
-export interface EditPolicyPageProps {
-    params: Promise<{ niceId: string; orgId: string }>;
-}
-
-export default async function EditPolicyPage(props: EditPolicyPageProps) {
-    const params = await props.params;
-    const t = await getTranslations();
-
-    let policyResponse: GetResourcePolicyResponse | null = null;
-    try {
-        const res = await internal.get<
-            AxiosResponse<GetResourcePolicyResponse>
-        >(
-            `/org/${params.orgId}/resource-policy/${params.niceId}`,
-            await authCookieHeader()
-        );
-        policyResponse = res.data.data;
-    } catch {
-        redirect(`/${params.orgId}/settings/policies/resource`);
-    }
-
-    if (!policyResponse) {
-        redirect(`/${params.orgId}/settings/policies/resource`);
-    }
-
-    return (
-        <>
-            <div className="flex justify-between">
-                <SettingsSectionTitle
-                    title={t("resourcePolicySetting", {
-                        policyName: policyResponse.name
-                    })}
-                    description={t("resourcePolicySettingDescription")}
-                />
-
-                <Button asChild variant="outline">
-                    <Link href={`/${params.orgId}/settings/policies/resource`}>
-                        {t("resourcePoliciesSeeAll")}
-                    </Link>
-                </Button>
-            </div>
-
-            <ResourcePolicyProvider policy={policyResponse}>
-                <EditPolicyForm />
-            </ResourcePolicyProvider>
-        </>
-    );
-}
--- a/src/app/[orgId]/settings/(private)/policies/resource/create/page.tsx
+++ b/src/app/[orgId]/settings/(private)/policies/resource/create/page.tsx
@@ -1,35 +0,0 @@
-import { CreatePolicyForm } from "@app/components/resource-policy/CreatePolicyForm";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { Button } from "@app/components/ui/button";
-import { getTranslations } from "next-intl/server";
-import Link from "next/link";
-
-export interface CreateResourcePolicyPageProps {
-    params: Promise<{ orgId: string }>;
-}
-
-export default async function CreateResourcePolicyPage(
-    props: CreateResourcePolicyPageProps
-) {
-    const params = await props.params;
-    const t = await getTranslations();
-
-    return (
-        <>
-            <div className="flex justify-between">
-                <SettingsSectionTitle
-                    title={t("resourcePoliciesCreate")}
-                    description={t("resourcePoliciesCreateDescription")}
-                />
-
-                <Button asChild variant="outline">
-                    <Link href={`/${params.orgId}/settings/policies/resource`}>
-                        {t("resourcePoliciesSeeAll")}
-                    </Link>
-                </Button>
-            </div>
-
-            <CreatePolicyForm />
-        </>
-    );
-}
--- a/src/app/[orgId]/settings/(private)/policies/resource/page.tsx
+++ b/src/app/[orgId]/settings/(private)/policies/resource/page.tsx
@@ -1,68 +0,0 @@
-import { ResourcePoliciesTable } from "@app/components/ResourcePoliciesTable";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { internal } from "@app/lib/api";
-import { authCookieHeader } from "@app/lib/api/cookies";
-import { getCachedOrg } from "@app/lib/api/getCachedOrg";
-import type { GetOrgResponse } from "@server/routers/org";
-import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
-import type { AxiosResponse } from "axios";
-import { getTranslations } from "next-intl/server";
-import { redirect } from "next/navigation";
-
-export interface ResourcePoliciesPageProps {
-    params: Promise<{ orgId: string }>;
-    searchParams: Promise<Record<string, string>>;
-}
-
-export default async function ResourcePoliciesPage(
-    props: ResourcePoliciesPageProps
-) {
-    const params = await props.params;
-    const t = await getTranslations();
-    const searchParams = new URLSearchParams(await props.searchParams);
-
-    let org: GetOrgResponse | null = null;
-    try {
-        const res = await getCachedOrg(params.orgId);
-        org = res.data.data;
-    } catch {
-        redirect(`/${params.orgId}/settings/resources`);
-    }
-
-    let policies: ListResourcePoliciesResponse["policies"] = [];
-    let pagination: ListResourcePoliciesResponse["pagination"] = {
-        total: 0,
-        page: 1,
-        pageSize: 20
-    };
-    try {
-        const res = await internal.get<
-            AxiosResponse<ListResourcePoliciesResponse>
-        >(
-            `/org/${params.orgId}/resource-policies?${searchParams.toString()}`,
-            await authCookieHeader()
-        );
-        const responseData = res.data.data;
-        policies = responseData.policies;
-        pagination = responseData.pagination;
-    } catch (e) {}
-
-    return (
-        <>
-            <SettingsSectionTitle
-                title={t("resourcePoliciesTitle")}
-                description={t("resourcePoliciesDescription")}
-            />
-
-            <ResourcePoliciesTable
-                policies={policies}
-                orgId={params.orgId}
-                rowCount={pagination.total}
-                pagination={{
-                    pageIndex: pagination.page - 1,
-                    pageSize: pagination.pageSize
-                }}
-            />
-        </>
-    );
-}
--- a/src/app/[orgId]/settings/clients/machine/page.tsx
+++ b/src/app/[orgId]/settings/clients/machine/page.tsx
@@ -76,7 +76,8 @@ export default async function ClientsPage(props: ClientsPageProps) {
            agent: client.agent,
            archived: client.archived || false,
            blocked: client.blocked || false,
-            approvalState: client.approvalState ?? "approved"
+            approvalState: client.approvalState ?? "approved",
+            labels: client.labels ?? []
        };
    };

--- a/src/app/[orgId]/settings/layout.tsx
+++ b/src/app/[orgId]/settings/layout.tsx
@@ -13,7 +13,6 @@ import { Layout } from "@app/components/Layout";
 import { getTranslations } from "next-intl/server";
 import { pullEnv } from "@app/lib/pullEnv";
 import { orgNavSections } from "@app/app/navigation";
-import { getCachedOrgUser } from "@app/lib/api/getCachedOrgUser";

 export const dynamic = "force-dynamic";

@@ -49,7 +48,13 @@ export default async function SettingsLayout(props: SettingsLayoutProps) {
    const t = await getTranslations();

    try {
-        const orgUser = await getCachedOrgUser(params.orgId, user.userId);
+        const getOrgUser = cache(() =>
+            internal.get<AxiosResponse<GetOrgUserResponse>>(
+                `/org/${params.orgId}/user/${user.userId}`,
+                cookie
+            )
+        );
+        const orgUser = await getOrgUser();

        if (!orgUser.data.data.isAdmin && !orgUser.data.data.isOwner) {
            throw new Error(t("userErrorNotAdminOrOwner"));
--- a/src/app/[orgId]/settings/logs/connection/page.tsx
+++ b/src/app/[orgId]/settings/logs/connection/page.tsx
@@ -9,7 +9,7 @@ import { useEnvContext } from "@app/hooks/useEnvContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import { toast } from "@app/hooks/useToast";
-import { createApiClient } from "@app/lib/api";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -294,7 +294,7 @@ export default function ConnectionLogsPage() {
        } catch (error) {
            toast({
                title: t("error"),
-                description: t("Failed to filter logs"),
+                description: formatAxiosError(error),
                variant: "destructive"
            });
        } finally {
--- a/src/app/[orgId]/settings/resources/client/page.tsx
+++ b/src/app/[orgId]/settings/resources/client/page.tsx
@@ -127,7 +127,8 @@ export default async function ClientResourcesPage(
                authDaemonPort: siteResource.authDaemonPort ?? null,
                subdomain: siteResource.subdomain ?? null,
                domainId: siteResource.domainId ?? null,
-                fullDomain: siteResource.fullDomain ?? null
+                fullDomain: siteResource.fullDomain ?? null,
+                labels: siteResource.labels ?? []
            };
        }
    );
--- a/src/app/[orgId]/settings/resources/proxy/[niceId]/authentication/page.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/[niceId]/authentication/page.tsx
--- a/src/app/[orgId]/settings/resources/proxy/[niceId]/layout.tsx
+++ b/src/app/[orgId]/settings/resources/proxy/[niceId]/layout.tsx
@@ -96,10 +96,10 @@ export default async function ResourceLayout(props: ResourceLayoutProps) {
            title: t("authentication"),
            href: `/{orgId}/settings/resources/proxy/{niceId}/authentication`
        });
-        // navItems.push({
-        //     title: t("rules"),
-        //     href: `/{orgId}/settings/resources/proxy/{niceId}/rules`
-        // });
+        navItems.push({
+            title: t("rules"),
+            href: `/{orgId}/settings/resources/proxy/{niceId}/rules`
+        });
    }

    return (
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Owen	02c68b6cd3	Reconnect newts when a exit node comes back online	2026-05-20 15:38:40 -07:00
Owen Schwartz	c47c411161	Merge pull request #3114 from Fredkiss3/fix/tag-input-scroll fix: make tag input wrap around instead of scrolling	2026-05-19 20:03:59 -07:00
Owen Schwartz	e88e262abe	Merge pull request #3004 from Fredkiss3/feat/labels-on-sites-and-resources feat: site & resource labels	2026-05-19 20:03:22 -07:00
Fred KISSIE	6cacc9b83f	💄 limit tag width	2026-05-19 22:52:44 +02:00
Fred KISSIE	1f1791feb7	💄 make tag input wrap around instead of scrolling	2026-05-19 22:48:15 +02:00
Owen	08a08e73b3	derived only from roles that the user holds AND are assigned to the target resource	2026-05-19 10:53:54 -07:00
Fred KISSIE	2d9c082607	💄 UI	2026-05-18 22:17:49 +02:00
Fred KISSIE	7968c4357b	✨ edit org label	2026-05-18 22:14:49 +02:00
Fred KISSIE	25c08e7279	✨ Create label dialog	2026-05-18 21:57:44 +02:00
Owen	68e775659b	Merge branch 'main' into dev	2026-05-16 20:45:39 -07:00
Owen	1c5e3000b6	Merge branch 'dev' of github.com:fosrl/pangolin into dev	2026-05-16 20:45:31 -07:00
Owen	3b93fd99a1	Remove workflows	2026-05-16 20:44:36 -07:00
Owen Schwartz	159e91a07c	Merge pull request #3090 from fosrl/github-action-cosign Upgrade cosign installer to v4.1.2 and pin cosign version	2026-05-16 14:53:24 -07:00
miloschwartz	530b5082bd	make online/connected styling consistent	2026-05-16 12:34:17 -07:00
Marc Schäfer	3322f1ccb4	Update cosign installer version in CI workflow	2026-05-16 16:21:13 +02:00
Marc Schäfer	1b17fba19f	Upgrade cosign installer to v4.1.2 and pin cosign version Updated cosign installer to version 4.1.2 and specified cosign release version.	2026-05-16 16:17:45 +02:00
Owen	dd1f7ba544	Make crowdsec --crowdsec	2026-05-14 21:46:26 -07:00
Owen Schwartz	8c2e6965f1	Merge pull request #3081 from fosrl/dev Update sidebar	2026-05-14 21:21:03 -07:00
Owen	b414f04cce	Remove funding	2026-05-14 21:20:34 -07:00
Owen Schwartz	9c71922dda	Merge pull request #3079 from fosrl/dev Add site information to user api	2026-05-14 20:17:19 -07:00
Owen	6e4a28f227	Add site information as well	2026-05-14 18:02:42 -07:00
Owen Schwartz	64d8f035a2	Merge pull request #3077 from fosrl/dev 1.18.4-s.5	2026-05-14 17:41:51 -07:00
Owen	0a5780a3b3	Merge branch 'dev' of github.com:fosrl/pangolin into dev	2026-05-14 17:41:00 -07:00
Owen	d58b96f4b1	Add port and icmp information to api endpoint	2026-05-14 17:39:22 -07:00
Owen Schwartz	f778f5c941	Merge pull request #3071 from fosrl/crowdin_dev New Crowdin updates	2026-05-14 17:20:50 -07:00
Owen	6422208f69	Optimize get all relays	2026-05-14 16:59:15 -07:00
Owen	c3ebc423b5	Each node should only update its own sites	2026-05-14 16:51:09 -07:00
Fred KISSIE	68d7b0a416	🚧 wip: label	2026-05-14 22:43:29 +02:00
Fred KISSIE	43546c84eb	🚧 wip: create label dialog	2026-05-14 22:42:01 +02:00
Fred KISSIE	eac36ee442	✨ delete label	2026-05-14 22:15:43 +02:00
Owen Schwartz	92f992728f	Merge pull request #3074 from fosrl/dev Optimize building aliases in jit mode	2026-05-14 12:25:44 -07:00
Owen	78ad2d17c7	Optimize building aliases in jit mode	2026-05-14 12:25:05 -07:00
Fred KISSIE	9a88394efe	🛂 gate label endpoints behing subscription	2026-05-14 21:17:58 +02:00
Fred KISSIE	173562654b	✨ delete org label endpoint	2026-05-14 21:09:48 +02:00
Owen Schwartz	b29bb7384d	Merge pull request #3073 from fosrl/dev Further optimizations	2026-05-14 12:00:25 -07:00
Owen	5a8de8210b	Further optimizations	2026-05-14 11:59:59 -07:00
Owen Schwartz	d5181454f4	Merge pull request #3072 from fosrl/dev Optimize this	2026-05-14 11:34:56 -07:00
Owen	0e0666cacf	Optimize this	2026-05-14 11:34:09 -07:00
Owen Schwartz	02ba2393b9	New translations en-us.json (German) [ci skip]	2026-05-14 11:08:12 -07:00
Fred KISSIE	8f7e5ab1ed	🚧 wip: org labels page	2026-05-14 19:31:53 +02:00
Fred KISSIE	4334480675	♻️ refactor	2026-05-14 18:33:29 +02:00
Fred KISSIE	6aa406927a	🐛 fix error message	2026-05-14 18:20:26 +02:00
Fred KISSIE	5b50024712	Merge branch 'dev' into feat/labels-on-sites-and-resources	2026-05-14 18:15:14 +02:00
Owen Schwartz	daf260cf61	Merge pull request #3064 from fosrl/dev 1.18.4-s.1	2026-05-13 14:40:50 -07:00
Owen	92a06e0ea3	Handle jit mode with syncs	2026-05-13 14:00:43 -07:00
Owen	c16d2ff2ed	Fix log message	2026-05-13 13:52:35 -07:00
Owen	73a4d7d351	Quiet log message	2026-05-13 11:57:02 -07:00
Owen Schwartz	1860b4b862	Merge pull request #3061 from fosrl/dev Add 1.18.4 migration	2026-05-12 21:01:39 -07:00
Owen Schwartz	0601b55f22	Merge pull request #3060 from fosrl/dev Translations	2026-05-12 20:48:55 -07:00
Owen Schwartz	559cbeb7d5	Merge pull request #3058 from fosrl/dev 1.18.4	2026-05-12 20:20:10 -07:00
Owen Schwartz	e975f56445	Merge pull request #3008 from AstralDestiny/patch-2 Update references of SSL alone to be TLS to align with proper wording…	2026-05-12 13:57:11 -07:00
Fred KISSIE	ce746a2a21	✨ Handle labels for machine clients	2026-05-12 22:32:56 +02:00
Fred KISSIE	7120ab4b22	♻️ filter sites & resources by labels	2026-05-12 20:45:12 +02:00
Fred KISSIE	12e777b32e	✨ Add labels column to private resources table	2026-05-12 20:25:32 +02:00
Fred KISSIE	9378103ddd	✨ handle private resources filtering by labels	2026-05-12 20:24:34 +02:00
Fred KISSIE	ec794d5de2	✨ attach/detach private resources	2026-05-12 20:01:33 +02:00
Fred KISSIE	12b18a3e8c	✨ attach labels to private resources	2026-05-12 19:58:44 +02:00
Fred KISSIE	91e8a13e59	🗃️ Add site resource labels schema	2026-05-12 17:55:56 +02:00
Fred KISSIE	931ba0f540	💄 `px-2` button	2026-05-12 17:46:46 +02:00
Fred KISSIE	d321d7275c	🚧 tried to memo proxy resource table, failed	2026-05-11 21:06:20 +02:00
Fred KISSIE	3855486a00	⚡️ prevent `SitetableCell` from rerendering unnecessarily	2026-05-11 19:27:00 +02:00
Fred KISSIE	ab494521b1	✨ labels on proxy resources	2026-05-11 18:37:16 +02:00
Fred KISSIE	549e1ead1d	✨ handle labels in resources too	2026-05-11 18:30:23 +02:00
Fred KISSIE	a0759a79a1	🗃️ add unique indexes to site & resource labels in sqlite	2026-05-11 18:28:40 +02:00
Fred KISSIE	14e1a119d3	🚧 WIP: showing labels in proxy resources table	2026-05-11 18:24:47 +02:00
Fred KISSIE	6e066d38b0	🚚 Make label badge its own component	2026-05-11 18:17:29 +02:00
Fred KISSIE	21f72639b6	🚧 make labels column paid, and cleanup	2026-05-11 18:13:19 +02:00
Fred KISSIE	8a0c2031d4	✨ search list by labels too	2026-05-11 18:02:59 +02:00
Fred KISSIE	56d3a466e5	💄 make controlled data table input a search input	2026-05-11 18:02:44 +02:00
Fred KISSIE	563e505cc1	💸 add labels to paid features	2026-05-11 18:02:15 +02:00
Fred KISSIE	c44c02b8ba	💄 make site labels column design nicer	2026-05-11 17:04:44 +02:00
Fred KISSIE	b9ab35a05b	🐛 handle idempotency when adding/removing labels from sites/resources	2026-05-11 16:57:53 +02:00
Owen Schwartz	e253195fdd	Merge pull request #3035 from fosrl/dev Add new log streaming and client endpoint to connection log	2026-05-08 17:18:16 -07:00
Fred KISSIE	2fd519e102	✨ add and toggle site labels	2026-05-08 22:31:36 +02:00
Fred KISSIE	a63c1ec364	💄 label selector (with create label)	2026-05-08 21:49:20 +02:00
Fred KISSIE	e61ef2ca2a	🚧 wip: label selector	2026-05-08 20:06:42 +02:00
Fred KISSIE	39b09b7f3f	Merge branch 'dev' into feat/labels-on-sites-and-resources	2026-05-08 18:21:46 +02:00
Fred KISSIE	840cc214e3	🚧 wip	2026-05-08 18:21:09 +02:00
Fred KISSIE	72524db52d	💄 shrink button	2026-05-08 02:48:47 +02:00
Fred KISSIE	ab8fc11ab3	🚧 add labels button	2026-05-08 02:46:16 +02:00
Fred KISSIE	1831ca4e75	♻️ detach label from site/resoirce	2026-05-08 00:33:47 +02:00
AstralDestiny	9f67134ce2	Update references of SSL alone to be TLS to align with proper wording and terms.	2026-05-05 21:30:36 -04:00
Fred KISSIE	0d04cc365f	✨ attach label to item	2026-05-05 21:35:10 +02:00
Fred KISSIE	09baf2f32e	🗃️ add sqlite table for labels	2026-05-05 21:08:22 +02:00
Fred KISSIE	3253d60900	🚧 Add CRUD endpoints and tables for labels	2026-05-05 20:53:16 +02:00