Merge branch 'main' into dev

server/db/pg/schema/schema.ts

@@ -262,7 +262,9 @@ export const resourceAiModels = pgTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = pgTable("labels", {
+export const labels = pgTable(
+    "labels",
+    {
         labelId: serial("labelId").primaryKey(),
         name: varchar("name").notNull(),
         color: varchar("color").notNull(),
@@ -271,7 +273,9 @@ export const labels = pgTable("labels", {
                 onDelete: "cascade"
             })
             .notNull()
-});
+    },
+    (t) => [index("idx_labels_orgid").on(t.orgId)]
+);
 
 export const launcherViews = pgTable("launcherViews", {
     viewId: serial("viewId").primaryKey(),
@@ -693,7 +697,9 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
     codeHash: varchar("codeHash").notNull()
 });
 
-export const sessions = pgTable("session", {
+export const sessions = pgTable(
+    "session",
+    {
         sessionId: varchar("id").primaryKey(),
         userId: varchar("userId")
             .notNull()
@@ -701,7 +707,9 @@ export const sessions = pgTable("session", {
         expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
         issuedAt: bigint("issuedAt", { mode: "number" }),
         deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-});
+    },
+    (t) => [index("idx_sessions_userid").on(t.userId)]
+);
 
 export const newtSessions = pgTable("newtSession", {
     sessionId: varchar("id").primaryKey(),
@@ -711,7 +719,9 @@ export const newtSessions = pgTable("newtSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const userOrgs = pgTable("userOrgs", {
+export const userOrgs = pgTable(
+    "userOrgs",
+    {
         userId: varchar("userId")
             .notNull()
             .references(() => users.userId, { onDelete: "cascade" }),
@@ -723,7 +733,12 @@ export const userOrgs = pgTable("userOrgs", {
         isOwner: boolean("isOwner").notNull().default(false),
         autoProvisioned: boolean("autoProvisioned").default(false),
         pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-});
+    },
+    (t) => [
+        index("idx_userOrgs_userid").on(t.userId),
+        index("idx_userOrgs_orgid").on(t.orgId)
+    ]
+);
 
 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
     codeId: serial("id").primaryKey(),
@@ -751,7 +766,9 @@ export const actions = pgTable("actions", {
     description: varchar("description")
 });
 
-export const roles = pgTable("roles", {
+export const roles = pgTable(
+    "roles",
+    {
         roleId: serial("roleId").primaryKey(),
         orgId: varchar("orgId")
             .references(() => orgs.orgId, {
@@ -766,7 +783,9 @@ export const roles = pgTable("roles", {
         sshSudoCommands: text("sshSudoCommands").default("[]"),
         sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
         sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+    },
+    (t) => [index("idx_roles_orgid").on(t.orgId)]
+);
 
 export const userOrgRoles = pgTable(
     "userOrgRoles",
@@ -1409,7 +1428,10 @@ export const olms = pgTable(
         }),
         archived: boolean("archived").notNull().default(false)
     },
-    (t) => [index("idx_olms_clientid").on(t.clientId)]
+    (t) => [
+        index("idx_olms_clientid").on(t.clientId),
+        index("idx_olms_userid").on(t.userId)
+    ]
 );
 
 export const currentFingerprint = pgTable("currentFingerprint", {

server/db/sqlite/schema/schema.ts

@@ -99,7 +99,9 @@ export const orgDomains = sqliteTable("orgDomains", {
         .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
-export const sites = sqliteTable("sites", {
+export const sites = sqliteTable(
+    "sites",
+    {
         siteId: integer("siteId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -141,10 +143,18 @@ export const sites = sqliteTable("sites", {
         })
             .notNull()
             .default(false),
-    status: text("status").$type<"pending" | "approved">().default("approved")
+        status: text("status")
-});
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [
+        index("idx_sites_orgId").on(table.orgId)
+    ]
+);
 
-export const resources = sqliteTable("resources", {
+export const resources = sqliteTable(
+    "resources",
+    {
         resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
         resourcePolicyId: integer("resourcePolicyId").references(
             () => resourcePolicies.resourcePolicyId,
@@ -222,8 +232,14 @@ export const resources = sqliteTable("resources", {
             .$type<"site" | "remote" | "native">()
             .default("site"),
         authDaemonPort: integer("authDaemonPort").default(22123),
-    status: text("status").$type<"pending" | "approved">().default("approved")
+        status: text("status")
-});
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [
+        index("idx_resources_orgId").on(table.orgId)
+    ]
+);
 
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
@@ -260,7 +276,9 @@ export const resourceAiModels = sqliteTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = sqliteTable("labels", {
+export const labels = sqliteTable(
+    "labels",
+    {
         labelId: integer("labelId").primaryKey({ autoIncrement: true }),
         name: text("name").notNull(),
         color: text("color").notNull(),
@@ -269,7 +287,11 @@ export const labels = sqliteTable("labels", {
                 onDelete: "cascade"
             })
             .notNull()
-});
+    },
+    (table) => [
+        index("idx_labels_orgId").on(table.orgId)
+    ]
+);
 
 export const launcherViews = sqliteTable("launcherViews", {
     viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -366,14 +388,18 @@ export const clientLabels = sqliteTable(
     (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );
 
-export const targets = sqliteTable("targets", {
+export const targets = sqliteTable(
+    "targets",
+    {
         targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        resourceId: integer("resourceId").references(
-        onDelete: "cascade"
+            () => resources.resourceId,
-    }),
+            { onDelete: "cascade" }
-    providerId: integer("providerId").references(() => aiProviders.providerId, {
+        ),
-        onDelete: "cascade"
+        providerId: integer("providerId").references(
-    }),
+            () => aiProviders.providerId,
+            { onDelete: "cascade" }
+        ),
         siteId: integer("siteId")
             .references(() => sites.siteId, {
                 onDelete: "cascade"
@@ -394,7 +420,12 @@ export const targets = sqliteTable("targets", {
             .notNull()
             .default("http"),
         authToken: text("authToken")
-});
+    },
+    (table) => [
+        index("idx_targets_resourceId").on(table.resourceId),
+        index("idx_targets_siteId").on(table.siteId)
+    ]
+);
 
 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
     targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -663,7 +694,9 @@ export const setupTokens = sqliteTable("setupTokens", {
     dateUsed: text("dateUsed")
 });
 
-export const newts = sqliteTable("newt", {
+export const newts = sqliteTable(
+    "newt",
+    {
         newtId: text("id").primaryKey(),
         secretHash: text("secretHash").notNull(),
         dateCreated: text("dateCreated").notNull(),
@@ -671,9 +704,15 @@ export const newts = sqliteTable("newt", {
         siteId: integer("siteId").references(() => sites.siteId, {
             onDelete: "cascade"
         })
-});
+    },
+    (table) => [
+        index("idx_newts_siteId").on(table.siteId)
+    ]
+);
 
-export const clients = sqliteTable("clients", {
+export const clients = sqliteTable(
+    "clients",
+    {
         clientId: integer("clientId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -706,7 +745,12 @@ export const clients = sqliteTable("clients", {
         approvalState: text("approvalState").$type<
             "pending" | "approved" | "denied"
         >()
-});
+    },
+    (table) => [
+        index("idx_clients_orgId").on(table.orgId),
+        index("idx_clients_userId").on(table.userId)
+    ]
+);
 
 export const clientSitesAssociationsCache = sqliteTable(
     "clientSitesAssociationsCache",
@@ -734,7 +778,9 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
     }
 );
 
-export const olms = sqliteTable("olms", {
+export const olms = sqliteTable(
+    "olms",
+    {
         olmId: text("id").primaryKey(),
         secretHash: text("secretHash").notNull(),
         dateCreated: text("dateCreated").notNull(),
@@ -750,7 +796,11 @@ export const olms = sqliteTable("olms", {
             onDelete: "cascade"
         }),
         archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-});
+    },
+    (table) => [
+        index("idx_olms_userId").on(table.userId)
+    ]
+);
 
 export const currentFingerprint = sqliteTable("currentFingerprint", {
     fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -912,7 +962,9 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
     codeHash: text("codeHash").notNull()
 });
 
-export const sessions = sqliteTable("session", {
+export const sessions = sqliteTable(
+    "session",
+    {
         sessionId: text("id").primaryKey(),
         userId: text("userId")
             .notNull()
@@ -922,7 +974,11 @@ export const sessions = sqliteTable("session", {
         deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
             .notNull()
             .default(false)
-});
+    },
+    (table) => [
+        index("idx_sessions_userId").on(table.userId)
+    ]
+);
 
 export const newtSessions = sqliteTable("newtSession", {
     sessionId: text("id").primaryKey(),
@@ -940,7 +996,9 @@ export const olmSessions = sqliteTable("clientSession", {
     expiresAt: integer("expiresAt").notNull()
 });
 
-export const userOrgs = sqliteTable("userOrgs", {
+export const userOrgs = sqliteTable(
+    "userOrgs",
+    {
         userId: text("userId")
             .notNull()
             .references(() => users.userId, { onDelete: "cascade" }),
@@ -954,7 +1012,12 @@ export const userOrgs = sqliteTable("userOrgs", {
             mode: "boolean"
         }).default(false),
         pamUsername: text("pamUsername") // cleaned username for ssh and such
-});
+    },
+    (table) => [
+        index("idx_userOrgs_userId").on(table.userId),
+        index("idx_userOrgs_orgId").on(table.orgId)
+    ]
+);
 
 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
     codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -982,7 +1045,9 @@ export const actions = sqliteTable("actions", {
     description: text("description")
 });
 
-export const roles = sqliteTable("roles", {
+export const roles = sqliteTable(
+    "roles",
+    {
         roleId: integer("roleId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -1001,7 +1066,11 @@ export const roles = sqliteTable("roles", {
             true
         ),
         sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+    },
+    (table) => [
+        index("idx_roles_orgId").on(table.orgId)
+    ]
+);
 
 export const userOrgRoles = sqliteTable(
     "userOrgRoles",

server/middlewares/integration/verifyAccessTokenAccess.ts

@@ -68,6 +68,11 @@ export async function verifyApiKeyAccessTokenAccess(
             );
         }
 
+        if (apiKey.isRoot) {
+            // Root keys can access any access token in any org
+            return next();
+        }
+
         if (!resource.orgId) {
             return next(
                 createHttpError(

server/private/license/license.ts

@@ -149,12 +149,8 @@ LQIDAQAB
         }
 
         // Count used sites and users for license comparison
-        const [siteCountRes] = await db
+        const [siteCountRes] = await db.select({ value: count() }).from(sites);
-            .select({ value: count() })
+        const [userCountRes] = await db.select({ value: count() }).from(users);
-            .from(sites);
-        const [userCountRes] = await db
-            .select({ value: count() })
-            .from(users);
 
         const status: LicenseStatus = {
             hostId: this.hostMeta.hostMetaId,
@@ -276,10 +272,13 @@ LQIDAQAB
                         logger.error(
                             `Allowing failure. Will retry one more time at next run interval.`
                         );
-                        // return last known good status
+                        // Fall back to last known good status if we have
-                        return this.statusCache.get(
+                        // one cached; otherwise return the freshly built
+                        // status (with defaults) rather than undefined.
+                        const lastKnownStatus = this.statusCache.get(
                             this.statusKey
-                        ) as LicenseStatus;
+                        ) as LicenseStatus | undefined;
+                        return lastKnownStatus ?? status;
                     } else {
                         // Subsequent failures: fail abruptly
                         throw e;
@@ -368,10 +367,7 @@ LQIDAQAB
                 }
 
                 // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (
+                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
-                    cached.quantity_2 !== undefined &&
-                    cached.quantity_2 >= 0
-                ) {
                     status.maxSites =
                         (status.maxSites ?? 0) + cached.quantity_2;
                 }