Merge branch 'main' into dev

server/db/pg/schema/schema.ts

@@ -262,16 +262,20 @@ export const resourceAiModels = pgTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = pgTable("labels", {
+export const labels = pgTable(
-    labelId: serial("labelId").primaryKey(),
+    "labels",
-    name: varchar("name").notNull(),
+    {
-    color: varchar("color").notNull(),
+        labelId: serial("labelId").primaryKey(),
-    orgId: varchar("orgId")
+        name: varchar("name").notNull(),
-        .references(() => orgs.orgId, {
+        color: varchar("color").notNull(),
-            onDelete: "cascade"
+        orgId: varchar("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull()
+                onDelete: "cascade"
-});
+            })
+            .notNull()
+    },
+    (t) => [index("idx_labels_orgid").on(t.orgId)]
+);
 
 export const launcherViews = pgTable("launcherViews", {
     viewId: serial("viewId").primaryKey(),
@@ -693,15 +697,19 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
     codeHash: varchar("codeHash").notNull()
 });
 
-export const sessions = pgTable("session", {
+export const sessions = pgTable(
-    sessionId: varchar("id").primaryKey(),
+    "session",
-    userId: varchar("userId")
+    {
-        .notNull()
+        sessionId: varchar("id").primaryKey(),
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: varchar("userId")
-    expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
+            .notNull()
-    issuedAt: bigint("issuedAt", { mode: "number" }),
+            .references(() => users.userId, { onDelete: "cascade" }),
-    deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
+        expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
-});
+        issuedAt: bigint("issuedAt", { mode: "number" }),
+        deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
+    },
+    (t) => [index("idx_sessions_userid").on(t.userId)]
+);
 
 export const newtSessions = pgTable("newtSession", {
     sessionId: varchar("id").primaryKey(),
@@ -711,19 +719,26 @@ export const newtSessions = pgTable("newtSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const userOrgs = pgTable("userOrgs", {
+export const userOrgs = pgTable(
-    userId: varchar("userId")
+    "userOrgs",
-        .notNull()
+    {
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: varchar("userId")
-    orgId: varchar("orgId")
+            .notNull()
-        .references(() => orgs.orgId, {
+            .references(() => users.userId, { onDelete: "cascade" }),
-            onDelete: "cascade"
+        orgId: varchar("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    isOwner: boolean("isOwner").notNull().default(false),
+            })
-    autoProvisioned: boolean("autoProvisioned").default(false),
+            .notNull(),
-    pamUsername: varchar("pamUsername") // cleaned username for ssh and such
+        isOwner: boolean("isOwner").notNull().default(false),
-});
+        autoProvisioned: boolean("autoProvisioned").default(false),
+        pamUsername: varchar("pamUsername") // cleaned username for ssh and such
+    },
+    (t) => [
+        index("idx_userOrgs_userid").on(t.userId),
+        index("idx_userOrgs_orgid").on(t.orgId)
+    ]
+);
 
 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
     codeId: serial("id").primaryKey(),
@@ -751,22 +766,26 @@ export const actions = pgTable("actions", {
     description: varchar("description")
 });
 
-export const roles = pgTable("roles", {
+export const roles = pgTable(
-    roleId: serial("roleId").primaryKey(),
+    "roles",
-    orgId: varchar("orgId")
+    {
-        .references(() => orgs.orgId, {
+        roleId: serial("roleId").primaryKey(),
-            onDelete: "cascade"
+        orgId: varchar("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    isAdmin: boolean("isAdmin"),
+            })
-    name: varchar("name").notNull(),
+            .notNull(),
-    description: varchar("description"),
+        isAdmin: boolean("isAdmin"),
-    requireDeviceApproval: boolean("requireDeviceApproval").default(false),
+        name: varchar("name").notNull(),
-    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
+        description: varchar("description"),
-    sshSudoCommands: text("sshSudoCommands").default("[]"),
+        requireDeviceApproval: boolean("requireDeviceApproval").default(false),
-    sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
+        sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
-    sshUnixGroups: text("sshUnixGroups").default("[]")
+        sshSudoCommands: text("sshSudoCommands").default("[]"),
-});
+        sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
+        sshUnixGroups: text("sshUnixGroups").default("[]")
+    },
+    (t) => [index("idx_roles_orgid").on(t.orgId)]
+);
 
 export const userOrgRoles = pgTable(
     "userOrgRoles",
@@ -1409,7 +1428,10 @@ export const olms = pgTable(
         }),
         archived: boolean("archived").notNull().default(false)
     },
-    (t) => [index("idx_olms_clientid").on(t.clientId)]
+    (t) => [
+        index("idx_olms_clientid").on(t.clientId),
+        index("idx_olms_userid").on(t.userId)
+    ]
 );
 
 export const currentFingerprint = pgTable("currentFingerprint", {

server/db/sqlite/schema/schema.ts

@@ -99,131 +99,147 @@ export const orgDomains = sqliteTable("orgDomains", {
         .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
-export const sites = sqliteTable("sites", {
+export const sites = sqliteTable(
-    siteId: integer("siteId").primaryKey({ autoIncrement: true }),
+    "sites",
-    orgId: text("orgId")
+    {
-        .references(() => orgs.orgId, {
+        siteId: integer("siteId").primaryKey({ autoIncrement: true }),
-            onDelete: "cascade"
+        orgId: text("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    niceId: text("niceId").notNull(),
+            })
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+            .notNull(),
-        onDelete: "set null"
+        niceId: text("niceId").notNull(),
-    }),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-    networkId: integer("networkId").references(() => networks.networkId, {
+            onDelete: "set null"
-        onDelete: "set null"
+        }),
-    }),
+        networkId: integer("networkId").references(() => networks.networkId, {
-    name: text("name").notNull(),
+            onDelete: "set null"
-    pubKey: text("pubKey"),
+        }),
-    exitNodeSubnet: text("exitNodeSubnet"),
+        name: text("name").notNull(),
-    megabytesIn: integer("bytesIn").default(0),
+        pubKey: text("pubKey"),
-    megabytesOut: integer("bytesOut").default(0),
+        exitNodeSubnet: text("exitNodeSubnet"),
-    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+        megabytesIn: integer("bytesIn").default(0),
-    type: text("type").notNull(), // "newt" or "wireguard"
+        megabytesOut: integer("bytesOut").default(0),
-    online: integer("online", { mode: "boolean" }).notNull().default(false),
+        lastBandwidthUpdate: text("lastBandwidthUpdate"),
-    lastPing: integer("lastPing"),
+        type: text("type").notNull(), // "newt" or "wireguard"
+        online: integer("online", { mode: "boolean" }).notNull().default(false),
+        lastPing: integer("lastPing"),
 
-    // exit node stuff that is how to connect to the site when it has a wg server
+        // exit node stuff that is how to connect to the site when it has a wg server
-    address: text("address"), // this is the address of the wireguard interface in newt
+        address: text("address"), // this is the address of the wireguard interface in newt
-    endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+        endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
-    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
+        localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
-    publicKey: text("publicKey"), // TODO: Fix typo in publicKey
+        publicKey: text("publicKey"), // TODO: Fix typo in publicKey
-    lastHolePunch: integer("lastHolePunch"),
+        lastHolePunch: integer("lastHolePunch"),
-    listenPort: integer("listenPort"),
+        listenPort: integer("listenPort"),
-    dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
+        dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
-        .notNull()
+            .notNull()
-        .default(true),
+            .default(true),
-    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
+        autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-        .notNull()
+            .notNull()
-        .default(false),
+            .default(false),
-    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
+        autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-        mode: "boolean"
+            mode: "boolean"
-    })
-        .notNull()
-        .default(false),
-    status: text("status").$type<"pending" | "approved">().default("approved")
-});
-
-export const resources = sqliteTable("resources", {
-    resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
-    resourceGuid: text("resourceGuid", { length: 36 })
-        .unique()
-        .notNull()
-        .$defaultFn(() => randomUUID()),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
         })
-        .notNull(),
+            .notNull()
-    niceId: text("niceId").notNull(),
+            .default(false),
-    name: text("name").notNull(),
+        status: text("status")
-    subdomain: text("subdomain"),
+            .$type<"pending" | "approved">()
-    fullDomain: text("fullDomain"),
+            .default("approved")
-    domainId: text("domainId").references(() => domains.domainId, {
+    },
-        onDelete: "set null"
+    (table) => [
-    }),
+        index("idx_sites_orgId").on(table.orgId)
-    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
+    ]
-    blockAccess: integer("blockAccess", { mode: "boolean" })
+);
-        .notNull()
+
-        .default(false),
+export const resources = sqliteTable(
-    proxyPort: integer("proxyPort"),
+    "resources",
-    sso: integer("sso", { mode: "boolean" }),
+    {
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", {
+        resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-        mode: "boolean"
+        resourcePolicyId: integer("resourcePolicyId").references(
-    }),
+            () => resourcePolicies.resourcePolicyId,
-    applyRules: integer("applyRules", { mode: "boolean" }),
+            { onDelete: "set null" }
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+        ),
-    stickySession: integer("stickySession", { mode: "boolean" })
+        defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        .notNull()
+            () => resourcePolicies.resourcePolicyId,
-        .default(false),
+            {
-    tlsServerName: text("tlsServerName"),
+                onDelete: "restrict"
-    setHostHeader: text("setHostHeader"),
+            }
-    enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
+        ),
-    skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
+        resourceGuid: text("resourceGuid", { length: 36 })
-        onDelete: "set null"
+            .unique()
-    }),
+            .notNull()
-    headers: text("headers"), // comma-separated list of headers to add to the request
+            .$defaultFn(() => randomUUID()),
-    proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
+        orgId: text("orgId")
-        .notNull()
+            .references(() => orgs.orgId, {
-        .default(false),
+                onDelete: "cascade"
-    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+            })
-    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
+            .notNull(),
-        mode: "boolean"
+        niceId: text("niceId").notNull(),
-    })
+        name: text("name").notNull(),
-        .notNull()
+        subdomain: text("subdomain"),
-        .default(false),
+        fullDomain: text("fullDomain"),
-    maintenanceModeType: text("maintenanceModeType", {
+        domainId: text("domainId").references(() => domains.domainId, {
-        enum: ["forced", "automatic"]
+            onDelete: "set null"
-    }).default("forced"), // "forced" = always show, "automatic" = only when down
+        }),
-    maintenanceTitle: text("maintenanceTitle"),
+        ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    maintenanceMessage: text("maintenanceMessage"),
+        blockAccess: integer("blockAccess", { mode: "boolean" })
-    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+            .notNull()
-    postAuthPath: text("postAuthPath"),
+            .default(false),
-    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+        proxyPort: integer("proxyPort"),
-    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
+        sso: integer("sso", { mode: "boolean" }),
-    mode: text("mode")
+        emailWhitelistEnabled: integer("emailWhitelistEnabled", {
-        .default("http")
+            mode: "boolean"
-        .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
+        }),
-        .notNull(), // rdp, ssh, http, vnc, inference
+        applyRules: integer("applyRules", { mode: "boolean" }),
-    pamMode: text("pamMode")
+        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-        .$type<"passthrough" | "push">()
+        stickySession: integer("stickySession", { mode: "boolean" })
-        .default("passthrough"),
+            .notNull()
-    authDaemonMode: text("authDaemonMode")
+            .default(false),
-        .$type<"site" | "remote" | "native">()
+        tlsServerName: text("tlsServerName"),
-        .default("site"),
+        setHostHeader: text("setHostHeader"),
-    authDaemonPort: integer("authDaemonPort").default(22123),
+        enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
-    status: text("status").$type<"pending" | "approved">().default("approved")
+        skipToIdpId: integer("skipToIdpId").references(() => idp.idpId, {
-});
+            onDelete: "set null"
+        }),
+        headers: text("headers"), // comma-separated list of headers to add to the request
+        proxyProtocol: integer("proxyProtocol", { mode: "boolean" })
+            .notNull()
+            .default(false),
+        proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+        maintenanceModeEnabled: integer("maintenanceModeEnabled", {
+            mode: "boolean"
+        })
+            .notNull()
+            .default(false),
+        maintenanceModeType: text("maintenanceModeType", {
+            enum: ["forced", "automatic"]
+        }).default("forced"), // "forced" = always show, "automatic" = only when down
+        maintenanceTitle: text("maintenanceTitle"),
+        maintenanceMessage: text("maintenanceMessage"),
+        maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
+        postAuthPath: text("postAuthPath"),
+        health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
+        wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
+        mode: text("mode")
+            .default("http")
+            .$type<"rdp" | "ssh" | "http" | "vnc" | "inference" | "tcp" | "udp">()
+            .notNull(), // rdp, ssh, http, vnc, inference
+        pamMode: text("pamMode")
+            .$type<"passthrough" | "push">()
+            .default("passthrough"),
+        authDaemonMode: text("authDaemonMode")
+            .$type<"site" | "remote" | "native">()
+            .default("site"),
+        authDaemonPort: integer("authDaemonPort").default(22123),
+        status: text("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [
+        index("idx_resources_orgId").on(table.orgId)
+    ]
+);
 
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
@@ -260,16 +276,22 @@ export const resourceAiModels = sqliteTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = sqliteTable("labels", {
+export const labels = sqliteTable(
-    labelId: integer("labelId").primaryKey({ autoIncrement: true }),
+    "labels",
-    name: text("name").notNull(),
+    {
-    color: text("color").notNull(),
+        labelId: integer("labelId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
+        name: text("name").notNull(),
-        .references(() => orgs.orgId, {
+        color: text("color").notNull(),
-            onDelete: "cascade"
+        orgId: text("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull()
+                onDelete: "cascade"
-});
+            })
+            .notNull()
+    },
+    (table) => [
+        index("idx_labels_orgId").on(table.orgId)
+    ]
+);
 
 export const launcherViews = sqliteTable("launcherViews", {
     viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -366,35 +388,44 @@ export const clientLabels = sqliteTable(
     (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );
 
-export const targets = sqliteTable("targets", {
+export const targets = sqliteTable(
-    targetId: integer("targetId").primaryKey({ autoIncrement: true }),
+    "targets",
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
+    {
-        onDelete: "cascade"
+        targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-    }),
+        resourceId: integer("resourceId").references(
-    providerId: integer("providerId").references(() => aiProviders.providerId, {
+            () => resources.resourceId,
-        onDelete: "cascade"
+            { onDelete: "cascade" }
-    }),
+        ),
-    siteId: integer("siteId")
+        providerId: integer("providerId").references(
-        .references(() => sites.siteId, {
+            () => aiProviders.providerId,
-            onDelete: "cascade"
+            { onDelete: "cascade" }
-        })
+        ),
-        .notNull(),
+        siteId: integer("siteId")
-    ip: text("ip").notNull(),
+            .references(() => sites.siteId, {
-    method: text("method"),
+                onDelete: "cascade"
-    port: integer("port").notNull(),
+            })
-    internalPort: integer("internalPort"),
+            .notNull(),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+        ip: text("ip").notNull(),
-    path: text("path"),
+        method: text("method"),
-    pathMatchType: text("pathMatchType"), // exact, prefix, regex
+        port: integer("port").notNull(),
-    rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
+        internalPort: integer("internalPort"),
-    rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
+        enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    priority: integer("priority").notNull().default(100),
+        path: text("path"),
-    mode: text("mode")
+        pathMatchType: text("pathMatchType"), // exact, prefix, regex
-        .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+        rewritePath: text("rewritePath"), // if set, rewrites the path to this value before sending to the target
-        .notNull()
+        rewritePathType: text("rewritePathType"), // exact, prefix, regex, stripPrefix
-        .default("http"),
+        priority: integer("priority").notNull().default(100),
-    authToken: text("authToken")
+        mode: text("mode")
-});
+            .$type<"http" | "tcp" | "udp" | "ssh" | "rdp" | "vnc">()
+            .notNull()
+            .default("http"),
+        authToken: text("authToken")
+    },
+    (table) => [
+        index("idx_targets_resourceId").on(table.resourceId),
+        index("idx_targets_siteId").on(table.siteId)
+    ]
+);
 
 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
     targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -663,50 +694,63 @@ export const setupTokens = sqliteTable("setupTokens", {
     dateUsed: text("dateUsed")
 });
 
-export const newts = sqliteTable("newt", {
+export const newts = sqliteTable(
-    newtId: text("id").primaryKey(),
+    "newt",
-    secretHash: text("secretHash").notNull(),
+    {
-    dateCreated: text("dateCreated").notNull(),
+        newtId: text("id").primaryKey(),
-    version: text("version"),
+        secretHash: text("secretHash").notNull(),
-    siteId: integer("siteId").references(() => sites.siteId, {
+        dateCreated: text("dateCreated").notNull(),
-        onDelete: "cascade"
+        version: text("version"),
-    })
+        siteId: integer("siteId").references(() => sites.siteId, {
-});
-
-export const clients = sqliteTable("clients", {
-    clientId: integer("clientId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
             onDelete: "cascade"
         })
-        .notNull(),
+    },
-    exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
+    (table) => [
-        onDelete: "set null"
+        index("idx_newts_siteId").on(table.siteId)
-    }),
+    ]
-    userId: text("userId").references(() => users.userId, {
+);
-        // optionally tied to a user and in this case delete when the user deletes
+
-        onDelete: "cascade"
+export const clients = sqliteTable(
-    }),
+    "clients",
-    niceId: text("niceId").notNull(),
+    {
-    name: text("name").notNull(),
+        clientId: integer("clientId").primaryKey({ autoIncrement: true }),
-    pubKey: text("pubKey"),
+        orgId: text("orgId")
-    olmId: text("olmId"), // to lock it to a specific olm optionally
+            .references(() => orgs.orgId, {
-    subnet: text("subnet").notNull(),
+                onDelete: "cascade"
-    exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
+            })
-    megabytesIn: integer("bytesIn"),
+            .notNull(),
-    megabytesOut: integer("bytesOut"),
+        exitNodeId: integer("exitNode").references(() => exitNodes.exitNodeId, {
-    lastBandwidthUpdate: text("lastBandwidthUpdate"),
+            onDelete: "set null"
-    lastPing: integer("lastPing"),
+        }),
-    type: text("type").notNull(), // "olm"
+        userId: text("userId").references(() => users.userId, {
-    online: integer("online", { mode: "boolean" }).notNull().default(false),
+            // optionally tied to a user and in this case delete when the user deletes
-    // endpoint: text("endpoint"),
+            onDelete: "cascade"
-    lastHolePunch: integer("lastHolePunch"),
+        }),
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false),
+        niceId: text("niceId").notNull(),
-    blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
+        name: text("name").notNull(),
-    approvalState: text("approvalState").$type<
+        pubKey: text("pubKey"),
-        "pending" | "approved" | "denied"
+        olmId: text("olmId"), // to lock it to a specific olm optionally
-    >()
+        subnet: text("subnet").notNull(),
-});
+        exitNodeSubnet: text("exitNodeSubnet"), // this is the subnet when connecting to an exit node
+        megabytesIn: integer("bytesIn"),
+        megabytesOut: integer("bytesOut"),
+        lastBandwidthUpdate: text("lastBandwidthUpdate"),
+        lastPing: integer("lastPing"),
+        type: text("type").notNull(), // "olm"
+        online: integer("online", { mode: "boolean" }).notNull().default(false),
+        // endpoint: text("endpoint"),
+        lastHolePunch: integer("lastHolePunch"),
+        archived: integer("archived", { mode: "boolean" }).notNull().default(false),
+        blocked: integer("blocked", { mode: "boolean" }).notNull().default(false),
+        approvalState: text("approvalState").$type<
+            "pending" | "approved" | "denied"
+        >()
+    },
+    (table) => [
+        index("idx_clients_orgId").on(table.orgId),
+        index("idx_clients_userId").on(table.userId)
+    ]
+);
 
 export const clientSitesAssociationsCache = sqliteTable(
     "clientSitesAssociationsCache",
@@ -734,23 +778,29 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
     }
 );
 
-export const olms = sqliteTable("olms", {
+export const olms = sqliteTable(
-    olmId: text("id").primaryKey(),
+    "olms",
-    secretHash: text("secretHash").notNull(),
+    {
-    dateCreated: text("dateCreated").notNull(),
+        olmId: text("id").primaryKey(),
-    version: text("version"),
+        secretHash: text("secretHash").notNull(),
-    agent: text("agent"),
+        dateCreated: text("dateCreated").notNull(),
-    name: text("name"),
+        version: text("version"),
-    clientId: integer("clientId").references(() => clients.clientId, {
+        agent: text("agent"),
-        // we will switch this depending on the current org it wants to connect to
+        name: text("name"),
-        onDelete: "set null"
+        clientId: integer("clientId").references(() => clients.clientId, {
-    }),
+            // we will switch this depending on the current org it wants to connect to
-    userId: text("userId").references(() => users.userId, {
+            onDelete: "set null"
-        // optionally tied to a user and in this case delete when the user deletes
+        }),
-        onDelete: "cascade"
+        userId: text("userId").references(() => users.userId, {
-    }),
+            // optionally tied to a user and in this case delete when the user deletes
-    archived: integer("archived", { mode: "boolean" }).notNull().default(false)
+            onDelete: "cascade"
-});
+        }),
+        archived: integer("archived", { mode: "boolean" }).notNull().default(false)
+    },
+    (table) => [
+        index("idx_olms_userId").on(table.userId)
+    ]
+);
 
 export const currentFingerprint = sqliteTable("currentFingerprint", {
     fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -912,17 +962,23 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
     codeHash: text("codeHash").notNull()
 });
 
-export const sessions = sqliteTable("session", {
+export const sessions = sqliteTable(
-    sessionId: text("id").primaryKey(),
+    "session",
-    userId: text("userId")
+    {
-        .notNull()
+        sessionId: text("id").primaryKey(),
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: text("userId")
-    expiresAt: integer("expiresAt").notNull(),
+            .notNull()
-    issuedAt: integer("issuedAt"),
+            .references(() => users.userId, { onDelete: "cascade" }),
-    deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
+        expiresAt: integer("expiresAt").notNull(),
-        .notNull()
+        issuedAt: integer("issuedAt"),
-        .default(false)
+        deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
-});
+            .notNull()
+            .default(false)
+    },
+    (table) => [
+        index("idx_sessions_userId").on(table.userId)
+    ]
+);
 
 export const newtSessions = sqliteTable("newtSession", {
     sessionId: text("id").primaryKey(),
@@ -940,21 +996,28 @@ export const olmSessions = sqliteTable("clientSession", {
     expiresAt: integer("expiresAt").notNull()
 });
 
-export const userOrgs = sqliteTable("userOrgs", {
+export const userOrgs = sqliteTable(
-    userId: text("userId")
+    "userOrgs",
-        .notNull()
+    {
-        .references(() => users.userId, { onDelete: "cascade" }),
+        userId: text("userId")
-    orgId: text("orgId")
+            .notNull()
-        .references(() => orgs.orgId, {
+            .references(() => users.userId, { onDelete: "cascade" }),
-            onDelete: "cascade"
+        orgId: text("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
+            })
-    autoProvisioned: integer("autoProvisioned", {
+            .notNull(),
-        mode: "boolean"
+        isOwner: integer("isOwner", { mode: "boolean" }).notNull().default(false),
-    }).default(false),
+        autoProvisioned: integer("autoProvisioned", {
-    pamUsername: text("pamUsername") // cleaned username for ssh and such
+            mode: "boolean"
-});
+        }).default(false),
+        pamUsername: text("pamUsername") // cleaned username for ssh and such
+    },
+    (table) => [
+        index("idx_userOrgs_userId").on(table.userId),
+        index("idx_userOrgs_orgId").on(table.orgId)
+    ]
+);
 
 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
     codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -982,26 +1045,32 @@ export const actions = sqliteTable("actions", {
     description: text("description")
 });
 
-export const roles = sqliteTable("roles", {
+export const roles = sqliteTable(
-    roleId: integer("roleId").primaryKey({ autoIncrement: true }),
+    "roles",
-    orgId: text("orgId")
+    {
-        .references(() => orgs.orgId, {
+        roleId: integer("roleId").primaryKey({ autoIncrement: true }),
-            onDelete: "cascade"
+        orgId: text("orgId")
-        })
+            .references(() => orgs.orgId, {
-        .notNull(),
+                onDelete: "cascade"
-    isAdmin: integer("isAdmin", { mode: "boolean" }),
+            })
-    name: text("name").notNull(),
+            .notNull(),
-    description: text("description"),
+        isAdmin: integer("isAdmin", { mode: "boolean" }),
-    requireDeviceApproval: integer("requireDeviceApproval", {
+        name: text("name").notNull(),
-        mode: "boolean"
+        description: text("description"),
-    }).default(false),
+        requireDeviceApproval: integer("requireDeviceApproval", {
-    sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
+            mode: "boolean"
-    sshSudoCommands: text("sshSudoCommands").default("[]"),
+        }).default(false),
-    sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
+        sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
-        true
+        sshSudoCommands: text("sshSudoCommands").default("[]"),
-    ),
+        sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
-    sshUnixGroups: text("sshUnixGroups").default("[]")
+            true
-});
+        ),
+        sshUnixGroups: text("sshUnixGroups").default("[]")
+    },
+    (table) => [
+        index("idx_roles_orgId").on(table.orgId)
+    ]
+);
 
 export const userOrgRoles = sqliteTable(
     "userOrgRoles",

server/middlewares/integration/verifyAccessTokenAccess.ts

@@ -68,6 +68,11 @@ export async function verifyApiKeyAccessTokenAccess(
             );
         }
 
+        if (apiKey.isRoot) {
+            // Root keys can access any access token in any org
+            return next();
+        }
+
         if (!resource.orgId) {
             return next(
                 createHttpError(

server/private/license/license.ts

@@ -149,12 +149,8 @@ LQIDAQAB
         }
 
         // Count used sites and users for license comparison
-        const [siteCountRes] = await db
+        const [siteCountRes] = await db.select({ value: count() }).from(sites);
-            .select({ value: count() })
+        const [userCountRes] = await db.select({ value: count() }).from(users);
-            .from(sites);
-        const [userCountRes] = await db
-            .select({ value: count() })
-            .from(users);
 
         const status: LicenseStatus = {
             hostId: this.hostMeta.hostMetaId,
@@ -276,10 +272,13 @@ LQIDAQAB
                         logger.error(
                             `Allowing failure. Will retry one more time at next run interval.`
                         );
-                        // return last known good status
+                        // Fall back to last known good status if we have
-                        return this.statusCache.get(
+                        // one cached; otherwise return the freshly built
+                        // status (with defaults) rather than undefined.
+                        const lastKnownStatus = this.statusCache.get(
                             this.statusKey
-                        ) as LicenseStatus;
+                        ) as LicenseStatus | undefined;
+                        return lastKnownStatus ?? status;
                     } else {
                         // Subsequent failures: fail abruptly
                         throw e;
@@ -368,10 +367,7 @@ LQIDAQAB
                 }
 
                 // Only consider quantity if defined and >= 0 (quantity = users, quantity_2 = sites)
-                if (
+                if (cached.quantity_2 !== undefined && cached.quantity_2 >= 0) {
-                    cached.quantity_2 !== undefined &&
-                    cached.quantity_2 >= 0
-                ) {
                     status.maxSites =
                         (status.maxSites ?? 0) + cached.quantity_2;
                 }
@@ -561,7 +557,7 @@ LQIDAQAB
                     // Calculate exponential backoff delay
                     const retryDelay = Math.floor(
                         initialRetryDelay *
-                        Math.pow(exponentialFactor, attempt - 1)
+                            Math.pow(exponentialFactor, attempt - 1)
                     );
 
                     logger.debug(