From 7cda28d685fecdbba3925e48e71fe0485e16636c Mon Sep 17 00:00:00 2001
From: Alejandro Argueta <Alejandro Argueta>
Date: Thu, 27 Aug 2026 14:18:48 -0700
Subject: [PATCH 1/2] Update RuleSchema to allow COUNTRY_IS_NOT rules to be
 created via blueprints as well.

---
 server/lib/blueprints/types.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/lib/blueprints/types.ts b/server/lib/blueprints/types.ts
index 74c5d5ca2..4aaa0d2a8 100644
--- a/server/lib/blueprints/types.ts
+++ b/server/lib/blueprints/types.ts
@@ -101,7 +101,7 @@ export const AuthSchema = z.object({
 export const RuleSchema = z
     .object({
         action: z.enum(["allow", "deny", "pass"]),
-        match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
+        match: z.enum(["cidr", "path", "ip", "country", "country_is_not", "asn", "region"]),
         value: z.coerce.string(),
         priority: z.int().optional(),
         enabled: z.boolean().optional().default(true)
@@ -136,7 +136,7 @@ export const RuleSchema = z
     )
     .refine(
         (rule) => {
-            if (rule.match === "country") {
+            if (rule.match === "country" || rule.match === "country_is_not") {
                 if (!hasMaxmindCountryDb) {
                     return false;
                 }

From dd0a5a359a645159f3e60d26f05dd99955c0046e Mon Sep 17 00:00:00 2001
From: miloschwartz <mschwartz10612@gmail.com>
Date: Mon, 31 Aug 2026 10:55:17 -0400
Subject: [PATCH 2/2] check for namespace domain before blocking org check

---
 server/lib/domainUtils.ts | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/server/lib/domainUtils.ts b/server/lib/domainUtils.ts
index 1862e27b9..ffd452f36 100644
--- a/server/lib/domainUtils.ts
+++ b/server/lib/domainUtils.ts
@@ -31,7 +31,6 @@ export async function validateAndConstructDomain(
     subdomain?: string | null
 ): Promise<DomainValidationResult> {
     try {
-        // Query domain with organization access check
         const [domainRes] = await db
             .select()
             .from(domains)
@@ -42,6 +41,10 @@ export async function validateAndConstructDomain(
                     eq(orgDomains.orgId, orgId),
                     eq(orgDomains.domainId, domainId)
                 )
+            )
+            .leftJoin(
+                domainNamespaces,
+                eq(domainNamespaces.domainId, domainId)
             );
 
         // Check if domain exists
@@ -52,7 +55,7 @@ export async function validateAndConstructDomain(
             };
         }
 
-        if (!domainRes.orgDomains) {
+        if (!domainRes.orgDomains && !domainRes.domainNamespaces) {
             return {
                 success: false,
                 error: `Organization does not have access to domain with ID ${domainId}`
@@ -83,19 +86,11 @@ export async function validateAndConstructDomain(
         }
 
         // Wildcard subdomains are not allowed on namespace (provided/free) domains
-        if (isWildcard) {
-            const [namespaceDomain] = await db
-                .select()
-                .from(domainNamespaces)
-                .where(eq(domainNamespaces.domainId, domainId))
-                .limit(1);
-
-            if (namespaceDomain) {
-                return {
-                    success: false,
-                    error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
-                };
-            }
+        if (isWildcard && domainRes.domainNamespaces) {
+            return {
+                success: false,
+                error: "Wildcard subdomains are not supported for provided or free domains. Use a specific subdomain instead."
+            };
         }
 
         if (