Merge branch 'dev' into feat/ip-filtering

server/private/routers/aiGateway/logAiSession.ts

@@ -0,0 +1,288 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { logsDb, db, orgs, aiSessionLog, type AiProvider } from "@server/db";
+import type { InferInsertModel } from "drizzle-orm";
+import logger from "@server/logger";
+import { and, eq, lt } from "drizzle-orm";
+import cache from "#private/lib/cache";
+import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
+import { sanitizeString } from "@server/lib/sanitize";
+import type { AiCapability } from "@server/lib/aiCapabilities";
+import {
+    normalizeAiRequest,
+    normalizeAiResponse
+} from "@server/lib/aiMessageNormalization";
+
+// Caps how much of the request/response body we keep per row, so a single
+// huge multimodal payload can't blow up buffer memory or storage.
+const AI_SESSION_LOG_MAX_BODY_CHARS = 200_000;
+
+type AiSessionLogInsert = InferInsertModel<typeof aiSessionLog>;
+
+// In-memory buffer for batching AI session log inserts, mirroring the
+// approach in server/routers/badger/logRequestAudit.ts.
+const sessionLogBuffer: AiSessionLogInsert[] = [];
+
+const BATCH_SIZE = 100; // Write to DB every 100 logs
+const BATCH_INTERVAL_MS = 5000; // Or every 5 seconds, whichever comes first
+const MAX_BUFFER_SIZE = 10000; // Prevent unbounded memory growth
+let flushTimer: NodeJS.Timeout | null = null;
+let isFlushInProgress = false;
+
+/**
+ * Flush buffered logs to database
+ */
+async function flushSessionLogs() {
+    if (sessionLogBuffer.length === 0 || isFlushInProgress) {
+        return;
+    }
+
+    isFlushInProgress = true;
+
+    // Take all current logs and clear buffer
+    const logsToWrite = sessionLogBuffer.splice(0, sessionLogBuffer.length);
+
+    try {
+        // Use a transaction to ensure all inserts succeed or fail together
+        await logsDb.transaction(async (tx) => {
+            // Batch insert logs in groups of 25 to avoid overwhelming the database
+            const BATCH_DB_SIZE = 25;
+            for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
+                const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
+                await tx.insert(aiSessionLog).values(batch);
+            }
+        });
+        logger.debug(
+            `Flushed ${logsToWrite.length} AI session logs to database`
+        );
+    } catch (error) {
+        logger.error("Error flushing AI session logs:", error);
+        // On transaction error, put logs back at the front of the buffer to retry
+        // but only if buffer isn't too large
+        if (sessionLogBuffer.length < MAX_BUFFER_SIZE - logsToWrite.length) {
+            sessionLogBuffer.unshift(...logsToWrite);
+            logger.info(
+                `Re-queued ${logsToWrite.length} AI session logs for retry`
+            );
+        } else {
+            logger.error(
+                `Buffer full, dropped ${logsToWrite.length} AI session logs`
+            );
+        }
+    } finally {
+        isFlushInProgress = false;
+        // If buffer filled up while we were flushing, flush again
+        if (sessionLogBuffer.length >= BATCH_SIZE) {
+            flushSessionLogs().catch((err) =>
+                logger.error("Error in follow-up AI session log flush:", err)
+            );
+        }
+    }
+}
+
+/**
+ * Schedule a flush if not already scheduled
+ */
+function scheduleFlush() {
+    if (flushTimer === null) {
+        flushTimer = setTimeout(() => {
+            flushTimer = null;
+            flushSessionLogs().catch((err) =>
+                logger.error("Error in scheduled AI session log flush:", err)
+            );
+        }, BATCH_INTERVAL_MS);
+    }
+}
+
+/**
+ * Gracefully flush all pending logs (call this on shutdown)
+ */
+export async function shutdownAiSessionLogger() {
+    if (flushTimer) {
+        clearTimeout(flushTimer);
+        flushTimer = null;
+    }
+    // Force flush even if one is in progress by waiting and retrying
+    while (isFlushInProgress) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    await flushSessionLogs();
+}
+
+async function getRetentionDays(orgId: string): Promise<number> {
+    // check cache first
+    const cached = await cache.get<number>(`org_${orgId}_aiSessionsDays`);
+    if (cached !== undefined) {
+        return cached;
+    }
+
+    const [org] = await db
+        .select({
+            settingsLogRetentionDaysAISessions:
+                orgs.settingsLogRetentionDaysAISessions
+        })
+        .from(orgs)
+        .where(eq(orgs.orgId, orgId))
+        .limit(1);
+
+    if (!org) {
+        return 0;
+    }
+
+    // store the result in cache
+    await cache.set(
+        `org_${orgId}_aiSessionsDays`,
+        org.settingsLogRetentionDaysAISessions,
+        300
+    );
+
+    return org.settingsLogRetentionDaysAISessions;
+}
+
+export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
+    // calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
+    // requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
+    // match aiUsageRecords - convert before comparing.
+    const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
+
+    try {
+        await logsDb
+            .delete(aiSessionLog)
+            .where(
+                and(
+                    lt(aiSessionLog.createdAt, cutoffTimestampMs),
+                    eq(aiSessionLog.orgId, orgId)
+                )
+            );
+    } catch (error) {
+        logger.error("Error cleaning up old AI session logs:", error);
+    }
+}
+
+function truncateBody(value: string): { value: string; truncated: boolean } {
+    if (value.length <= AI_SESSION_LOG_MAX_BODY_CHARS) {
+        return { value, truncated: false };
+    }
+    return {
+        value: value.slice(0, AI_SESSION_LOG_MAX_BODY_CHARS),
+        truncated: true
+    };
+}
+
+export function logAiSession(data: {
+    sessionId: string;
+    capability: AiCapability;
+    provider: AiProvider;
+    requestedModel: string | undefined;
+    requestBody: unknown;
+    responseText: string;
+    isStream: boolean;
+    statusCode: number;
+    orgId: string | null;
+    resourceId: number | null;
+    siteResourceId: number | null;
+    requestUserId: string | null;
+    virtualApiKeyId: string | null;
+}): void {
+    (async () => {
+        try {
+            // Check retention before buffering any logs
+            if (data.orgId) {
+                const retentionDays = await getRetentionDays(data.orgId);
+                if (retentionDays === 0) {
+                    // do not log
+                    return;
+                }
+            } else {
+                // No org resolved for this request - nothing to govern
+                // retention with, so don't log it.
+                return;
+            }
+
+            const requestBodyText = truncateBody(
+                JSON.stringify(data.requestBody ?? "")
+            );
+            const responseBodyText = truncateBody(data.responseText ?? "");
+
+            // Uniform, capability-agnostic transcript for search/display -
+            // computed from the untruncated originals so normalization sees
+            // the full content; the normalized result gets its own
+            // (typically much smaller) truncation pass below.
+            const normalizedRequestMessages = normalizeAiRequest(
+                data.capability,
+                data.requestBody
+            );
+            const normalizedResponseMessages = normalizeAiResponse(
+                data.capability,
+                data.responseText ?? "",
+                data.isStream
+            );
+            const normalizedRequestText = normalizedRequestMessages
+                ? truncateBody(JSON.stringify(normalizedRequestMessages))
+                : null;
+            const normalizedResponseText = normalizedResponseMessages
+                ? truncateBody(JSON.stringify(normalizedResponseMessages))
+                : null;
+
+            // Prevent unbounded buffer growth - drop oldest entries if buffer is too large
+            if (sessionLogBuffer.length >= MAX_BUFFER_SIZE) {
+                const dropped = sessionLogBuffer.splice(0, BATCH_SIZE);
+                logger.warn(
+                    `AI session log buffer exceeded max size (${MAX_BUFFER_SIZE}), dropped ${dropped.length} oldest entries`
+                );
+            }
+
+            sessionLogBuffer.push({
+                sessionId: data.sessionId,
+                orgId: sanitizeString(data.orgId),
+                providerId: data.provider.providerId,
+                capability: data.capability,
+                resourceId: data.resourceId ?? undefined,
+                siteResourceId: data.siteResourceId ?? undefined,
+                userId: sanitizeString(data.requestUserId ?? undefined),
+                virtualApiKeyId: sanitizeString(
+                    data.virtualApiKeyId ?? undefined
+                ),
+                requestedModel: sanitizeString(data.requestedModel),
+                isStream: data.isStream,
+                requestBody: sanitizeString(requestBodyText.value),
+                responseBody: sanitizeString(responseBodyText.value),
+                normalizedRequest: normalizedRequestText
+                    ? sanitizeString(normalizedRequestText.value)
+                    : undefined,
+                normalizedResponse: normalizedResponseText
+                    ? sanitizeString(normalizedResponseText.value)
+                    : undefined,
+                truncated:
+                    requestBodyText.truncated ||
+                    responseBodyText.truncated ||
+                    (normalizedRequestText?.truncated ?? false) ||
+                    (normalizedResponseText?.truncated ?? false),
+                statusCode: data.statusCode,
+                createdAt: Date.now()
+            });
+
+            // Flush immediately if buffer is full, otherwise schedule a flush
+            if (sessionLogBuffer.length >= BATCH_SIZE) {
+                flushSessionLogs().catch((err) =>
+                    logger.error("Error flushing AI session logs:", err)
+                );
+            } else {
+                scheduleFlush();
+            }
+        } catch (error) {
+            logger.error("Failed to log AI session", { error });
+        }
+    })();
+}

server/private/routers/alertRule/createAlertRule.ts

@@ -191,7 +191,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/alert-rule",
     description: "Create an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/alertRule/deleteAlertRule.ts

@@ -34,7 +34,7 @@ registry.registerPath({
     method: "delete",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Delete an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
     request: {
         params: paramsSchema
     },

server/private/routers/alertRule/getAlertRule.ts

@@ -48,7 +48,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Get a specific alert rule for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
     request: {
         params: paramsSchema
     },

server/private/routers/alertRule/index.ts

@@ -15,4 +15,5 @@ export * from "./createAlertRule";
 export * from "./updateAlertRule";
 export * from "./deleteAlertRule";
 export * from "./listAlertRules";
-export * from "./getAlertRule";
+export * from "./getAlertRule";
+export * from "./testAlertRule";

server/private/routers/alertRule/listAlertRules.ts

@@ -90,7 +90,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/alert-rules",
     description: "List all alert rules for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
     request: {
         query: querySchema,
         params: paramsSchema

server/private/routers/alertRule/testAlertRule.ts

@@ -0,0 +1,196 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { getRandomItemInArray } from "@app/lib/getRandomItemInArray";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { processTestAlerts } from "@server/private/lib/alerts/processTestAlerts";
+import { type AlertAction } from "@server/routers/alertRule/types";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import type { TriggerSiteAlertResponse } from "../alertEvents";
+import {
+    HC_EVENT_TYPES,
+    SITE_EVENT_TYPES,
+    RESOURCE_EVENT_TYPES
+} from "./createAlertRule";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const webhookActionSchema = z.strictObject({
+    webhookUrl: z.url(),
+    config: z.string().optional(),
+    enabled: z.boolean().optional().default(true)
+});
+
+const bodySchema = z.object({
+    eventType: z.enum([
+        ...HC_EVENT_TYPES,
+        ...SITE_EVENT_TYPES,
+        ...RESOURCE_EVENT_TYPES
+    ]),
+    // Email recipients (flat)
+    userIds: z.array(z.string().nonempty()).optional().default([]),
+    roleIds: z.array(z.number()).optional().default([]),
+    emails: z.array(z.email()).optional().default([]),
+    // Webhook actions
+    webhookActions: z.array(webhookActionSchema).optional().default([])
+});
+
+export async function testAlertRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const body = parsedBody.data;
+        const collectedActions: AlertAction[] = [];
+        if (
+            body.emails.length > 0 ||
+            body.roleIds.length > 0 ||
+            body.userIds.length > 0
+        ) {
+            collectedActions.push({
+                type: "email",
+                emails: body.emails,
+                roleIds: body.roleIds,
+                userIds: body.userIds
+            });
+        }
+
+        for (const action of body.webhookActions) {
+            collectedActions.push({
+                type: "webhook",
+                ...action
+            });
+        }
+
+        let data: Record<string, any> = {};
+        switch (body.eventType) {
+            case "site_toggle":
+                data = {
+                    status: getRandomItemInArray(["online", "offline"]),
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "site_offline":
+                data = {
+                    status: "offline",
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "site_online":
+                data = {
+                    status: "online",
+                    siteName: "Test Site Alert"
+                };
+                break;
+            case "resource_toggle":
+                data = {
+                    status: getRandomItemInArray([
+                        "healthy",
+                        "unhealthy",
+                        "degraded"
+                    ]),
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_healthy":
+                data = {
+                    status: "healthy",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_unhealthy":
+                data = {
+                    status: "unhealthy",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "resource_degraded":
+                data = {
+                    status: "degraded",
+                    siteName: "Test Resource Alert"
+                };
+                break;
+            case "health_check_toggle":
+                data = {
+                    status: getRandomItemInArray(["healthy", "unhealthy"]),
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+            case "health_check_healthy":
+                data = {
+                    status: "healthy",
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+            case "health_check_unhealthy":
+                data = {
+                    status: "unhealthy",
+                    healthCheckName: "Test Health Check Alert"
+                };
+                break;
+
+            default:
+                break;
+        }
+
+        // TODO: process alert rule
+        await processTestAlerts({
+            eventType: body.eventType,
+            orgId,
+            actions: collectedActions,
+            data
+        });
+
+        return response<TriggerSiteAlertResponse>(res, {
+            data: { success: true },
+            success: true,
+            error: false,
+            message: "Alert triggered successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/alertRule/updateAlertRule.ts

@@ -158,7 +158,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Update an alert rule for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.AlertRule],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/billing/featureLifecycle.ts

@@ -134,6 +134,17 @@ async function capRetentionDays(
         );
     }
 
+    if (
+        org.settingsLogRetentionDaysAISessions !== null &&
+        org.settingsLogRetentionDaysAISessions > maxRetentionDays
+    ) {
+        updates.settingsLogRetentionDaysAISessions = maxRetentionDays;
+        needsUpdate = true;
+        logger.info(
+            `Capping AI session log retention from ${org.settingsLogRetentionDaysAISessions} to ${maxRetentionDays} days for org ${orgId}`
+        );
+    }
+
     // Apply updates if needed
     if (needsUpdate) {
         await db.update(orgs).set(updates).where(eq(orgs.orgId, orgId));
@@ -280,12 +291,16 @@ async function disableFeature(
                 await disableConnectionLogs(orgId);
                 break;
 
+            case TierFeature.AISessionLogs:
+                await disableAISessionLogs(orgId);
+                break;
+
             case TierFeature.RotateCredentials:
                 await disableRotateCredentials(orgId);
                 break;
 
-            case TierFeature.MaintencePage:
-                await disableMaintencePage(orgId);
+            case TierFeature.MaintenancePage:
+                await disablemaintenancePage(orgId);
                 break;
 
             case TierFeature.DevicePosture:
@@ -308,10 +323,6 @@ async function disableFeature(
                 await disableAutoProvisioning(orgId);
                 break;
 
-            case TierFeature.AdvancedPrivateResources:
-                await disableAdvancedPrivateResources(orgId);
-                break;
-
             case TierFeature.FullRbac:
                 await disableFullRbac(orgId);
                 break;
@@ -357,13 +368,6 @@ async function disableDeviceApprovals(orgId: string): Promise<void> {
     logger.info(`Disabled device approvals on all roles for org ${orgId}`);
 }
 
-async function disableAdvancedPrivateResources(orgId: string): Promise<void> {
-    // TODO: implement logic to disable advanced private resourcs like ssh and ssh pam
-    // logger.info(
-    //     `Disabled advanced private resources on all roles and site resources for org ${orgId}`
-    // );
-}
-
 async function disableFullRbac(orgId: string): Promise<void> {
     logger.info(`Disabled full RBAC for org ${orgId}`);
 }
@@ -493,9 +497,18 @@ async function disableConnectionLogs(orgId: string): Promise<void> {
     logger.info(`Disabled connection logs for org ${orgId}`);
 }
 
+async function disableAISessionLogs(orgId: string): Promise<void> {
+    await db
+        .update(orgs)
+        .set({ settingsLogRetentionDaysAISessions: 0 })
+        .where(eq(orgs.orgId, orgId));
+
+    logger.info(`Disabled AI session logs for org ${orgId}`);
+}
+
 async function disableRotateCredentials(orgId: string): Promise<void> {}
 
-async function disableMaintencePage(orgId: string): Promise<void> {
+async function disablemaintenancePage(orgId: string): Promise<void> {
     await db
         .update(resources)
         .set({

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -53,6 +53,15 @@ export async function handleSubscriptionDeleted(
             return;
         }
 
+        // If the subscription has been manually overridden, we lock it down
+        // so Stripe can no longer change (or delete) its status locally.
+        if (existingSubscription.override === true) {
+            logger.info(
+                `Subscription ${subscription.id} is locked (override=true). Ignoring deletion event from Stripe.`
+            );
+            return;
+        }
+
         await db
             .delete(subscriptions)
             .where(eq(subscriptions.subscriptionId, subscription.id));

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -68,13 +68,27 @@ export async function handleSubscriptionUpdated(
         const type = getSubType(fullSubscription);
         const previousType = existingSubscription.type as SubscriptionType | null;
 
+        // If the subscription has been manually overridden, we lock the
+        // status down so Stripe webhooks can no longer change it.
+        const isLocked = existingSubscription.override === true;
+        if (isLocked) {
+            logger.info(
+                `Subscription ${subscription.id} is locked (override=true). Ignoring status change from Stripe (would have been ${subscription.status}).`
+            );
+        }
+        const effectiveStatus = isLocked
+            ? existingSubscription.status
+            : subscription.status;
+
         await db
             .update(subscriptions)
             .set({
-                status: subscription.status,
-                canceledAt: subscription.canceled_at
-                    ? subscription.canceled_at
-                    : null,
+                status: effectiveStatus,
+                canceledAt: isLocked
+                    ? existingSubscription.canceledAt
+                    : subscription.canceled_at
+                      ? subscription.canceled_at
+                      : null,
                 updatedAt: Math.floor(Date.now() / 1000),
                 billingCycleAnchor: subscription.billing_cycle_anchor,
                 type: type
@@ -275,23 +289,23 @@ export async function handleSubscriptionUpdated(
                 // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
                 await handleSubscriptionLifesycle(
                     customer.orgId,
-                    subscription.status,
+                    effectiveStatus,
                     type
                 );
 
                 // Handle feature lifecycle when subscription is canceled or becomes unpaid
                 if (
-                    subscription.status === "canceled" ||
-                    subscription.status === "unpaid" ||
-                    subscription.status === "incomplete_expired"
+                    effectiveStatus === "canceled" ||
+                    effectiveStatus === "unpaid" ||
+                    effectiveStatus === "incomplete_expired"
                 ) {
                     logger.info(
-                        `Subscription ${subscription.id} for org ${customer.orgId} is ${subscription.status}, disabling paid features`
+                        `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
                     );
                     await handleTierChange(customer.orgId, null, previousType ?? undefined);
                 }
             } else if (type === "license") {
-                if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") {
+                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
                     try {
                         // WARNING:
                         // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId

server/private/routers/browserGatewayTarget/getBrowserTarget.ts

@@ -1,115 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resources, targets } from "@server/db";
-import { eq, and, inArray } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import logger from "@server/logger";
-import { decrypt } from "@server/lib/crypto";
-import config from "@server/lib/config";
-import { GetBrowserTargetResponse } from "@server/routers/browserGatewayTarget";
-
-const getBrowserTargetSchema = z
-    .object({
-        fullDomain: z.string().min(1, "fullDomain is required")
-    })
-    .strict();
-
-export async function getBrowserTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsed = getBrowserTargetSchema.safeParse(req.query);
-        if (!parsed.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsed.error).toString()
-                )
-            );
-        }
-
-        const { fullDomain } = parsed.data;
-
-        logger.info(`Retrieving browser target for domain: ${fullDomain}`);
-
-        const [row] = await db
-            .select({
-                ip: targets.ip,
-                port: targets.port,
-                authToken: targets.authToken,
-                resourceId: resources.resourceId,
-                niceId: resources.niceId,
-                name: resources.name,
-                orgId: resources.orgId,
-                pamMode: resources.pamMode,
-                authDaemonMode: resources.authDaemonMode
-            })
-            .from(targets)
-            .innerJoin(resources, eq(targets.resourceId, resources.resourceId))
-            .where(
-                and(
-                    eq(resources.fullDomain, fullDomain),
-                    eq(targets.enabled, true),
-                    inArray(targets.mode, ["ssh", "rdp", "vnc"])
-                )
-            )
-            .limit(1);
-
-        if (!row) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "No resource found for this domain"
-                )
-            );
-        }
-
-        const decryptedAuthToken = row.authToken
-            ? decrypt(row.authToken, config.getRawConfig().server.secret!)
-            : "";
-
-        return response<GetBrowserTargetResponse>(res, {
-            data: {
-                ip: row.ip,
-                port: row.port,
-                authToken: decryptedAuthToken,
-                pamMode: row.pamMode,
-                authDaemonMode: row.authDaemonMode,
-                orgId: row.orgId,
-                resourceId: row.resourceId,
-                niceId: row.niceId,
-                name: row.name ?? ""
-            },
-            success: true,
-            error: false,
-            message: "Browser target retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "An error occurred while retrieving the browser target"
-            )
-        );
-    }
-}

server/private/routers/browserGatewayTarget/index.ts

@@ -1,14 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./getBrowserTarget";

server/private/routers/certificates/createCertificate.ts

@@ -1,115 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Certificate, certificates, db, domains } from "@server/db";
-import logger from "@server/logger";
-import { Transaction } from "@server/db";
-import { eq, or, and, like } from "drizzle-orm";
-
-/**
- * Checks if a certificate exists for the given domain.
- * If not, creates a new certificate in 'pending' state.
- * Wildcard certs cover subdomains.
- */
-export async function createCertificate(
-    domainId: string,
-    domain: string,
-    trx: Transaction | typeof db
-) {
-    const [domainRecord] = await trx
-        .select()
-        .from(domains)
-        .where(eq(domains.domainId, domainId))
-        .limit(1);
-
-    if (!domainRecord) {
-        throw new Error(`Domain with ID ${domainId} not found`);
-    }
-
-    let existing: Certificate[] = [];
-    if (domainRecord.type == "ns" || domainRecord.type == "wildcard") {
-        const domainLevelDown = domain.split(".").slice(1).join(".");
-        const wildcardPrefixed = `*.${domainLevelDown}`;
-
-        existing = await trx
-            .select()
-            .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    or(
-                        eq(certificates.domain, domain),
-                        and(
-                            eq(certificates.wildcard, true),
-                            or(
-                                eq(certificates.domain, domainLevelDown),
-                                eq(certificates.domain, wildcardPrefixed)
-                            )
-                        )
-                    )
-                )
-            );
-    } else {
-        // For non-NS domains, we only match exact domain names
-        existing = await trx
-            .select()
-            .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    eq(certificates.domain, domain) // exact match for non-NS domains
-                )
-            );
-    }
-
-    if (existing.length > 0) {
-        logger.info(`Certificate already exists for domain ${domain}`);
-        return;
-    }
-
-    let domainToWrite = domain;
-    if (
-        domainRecord.type == "wildcard" && // this is to fix the wildcard certs for traefik in self hosted NOT ON THE CLOUD
-        domainRecord.preferWildcardCert &&
-        !domain.startsWith("*.")
-    ) {
-        // in this case traefik is going to generate a domain one level down so we need to store it that way
-        const parts = domain.split(".");
-        if (parts.length > 2) {
-            domainToWrite = parts.slice(1).join(".");
-            domainToWrite = `*.${domainToWrite}`;
-        }
-    } else if (domainRecord.type == "ns") {
-        if (domain == domainRecord.baseDomain) {
-            domainToWrite = domainRecord.baseDomain;
-        } else {
-            const parts = domain.split(".");
-            if (parts.length > 2) {
-                domainToWrite = parts.slice(1).join(".");
-            }
-        }
-    }
-
-    // No cert found, create a new one in pending state
-    await trx.insert(certificates).values({
-        domain: domainToWrite,
-        domainId,
-        wildcard:
-            domainRecord.type == "ns" ||
-            (domainRecord.type == "wildcard" &&
-                domainRecord.preferWildcardCert), // we can only create wildcard certs for NS domains
-        status: "pending",
-        updatedAt: Math.floor(Date.now() / 1000),
-        createdAt: Math.floor(Date.now() / 1000)
-    });
-}

server/private/routers/certificates/getCertificate.ts

@@ -1,176 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { certificates, db, domains } from "@server/db";
-import { eq, and, or, like } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { registry } from "@server/openApi";
-import { GetCertificateResponse } from "@server/routers/certificates/types";
-
-const getCertificateSchema = z.strictObject({
-    domainId: z.string(),
-    domain: z.string().min(1).max(255),
-    orgId: z.string()
-});
-
-async function query(domainId: string, domain: string) {
-    const [domainRecord] = await db
-        .select()
-        .from(domains)
-        .where(eq(domains.domainId, domainId))
-        .limit(1);
-
-    if (!domainRecord) {
-        throw new Error(`Domain with ID ${domainId} not found`);
-    }
-
-    const domainType = domainRecord.type;
-
-    let existing: any[] = [];
-    if (domainRecord.type == "ns" || domainRecord.type == "wildcard") {
-        const domainLevelDown = domain.split(".").slice(1).join(".");
-        const wildcardPrefixed = `*.${domainLevelDown}`;
-
-        existing = await db
-            .select({
-                certId: certificates.certId,
-                domain: certificates.domain,
-                wildcard: certificates.wildcard,
-                status: certificates.status,
-                expiresAt: certificates.expiresAt,
-                lastRenewalAttempt: certificates.lastRenewalAttempt,
-                createdAt: certificates.createdAt,
-                updatedAt: certificates.updatedAt,
-                errorMessage: certificates.errorMessage,
-                renewalCount: certificates.renewalCount
-            })
-            .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    or(
-                        eq(certificates.domain, domain),
-                        and(
-                            eq(certificates.wildcard, true),
-                            or(
-                                eq(certificates.domain, domainLevelDown),
-                                eq(certificates.domain, wildcardPrefixed)
-                            )
-                        )
-                    )
-                )
-            );
-    } else {
-        // For non-NS domains, we only match exact domain names
-        existing = await db
-            .select({
-                certId: certificates.certId,
-                domain: certificates.domain,
-                wildcard: certificates.wildcard,
-                status: certificates.status,
-                expiresAt: certificates.expiresAt,
-                lastRenewalAttempt: certificates.lastRenewalAttempt,
-                createdAt: certificates.createdAt,
-                updatedAt: certificates.updatedAt,
-                errorMessage: certificates.errorMessage,
-                renewalCount: certificates.renewalCount
-            })
-            .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    eq(certificates.domain, domain) // exact match for non-NS domains
-                )
-            );
-    }
-
-    return existing.length > 0 ? { ...existing[0], domainType } : null;
-}
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/certificate/{domainId}/{domain}",
-    description: "Get a certificate by domain.",
-    tags: ["Certificate"],
-    request: {
-        params: z.object({
-            domainId: z.string(),
-            domain: z.string().min(1).max(255),
-            orgId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-export async function getCertificate(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getCertificateSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { domainId, domain } = parsedParams.data;
-
-        const cert = await query(domainId, domain);
-
-        if (!cert) {
-            logger.warn(`Certificate not found for domain: ${domainId}`);
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Certificate not found")
-            );
-        }
-
-        return response<GetCertificateResponse>(res, {
-            data: cert,
-            success: true,
-            error: false,
-            message: "Certificate retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/certificates/index.ts

@@ -1,16 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./getCertificate";
-export * from "./restartCertificate";
-export * from "./syncCertToNewts";

server/private/routers/certificates/restartCertificate.ts

@@ -1,126 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { certificates, db } from "@server/db";
-import { sites } from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import stoi from "@server/lib/stoi";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const restartCertificateParamsSchema = z.strictObject({
-    certId: z.coerce.number().int().positive(),
-    orgId: z.string()
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/certificate/{certId}",
-    description: "Restart a certificate by ID.",
-    tags: ["Certificate"],
-    request: {
-        params: z.object({
-            certId: z.coerce.number().int().positive(),
-            orgId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-export async function restartCertificate(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = restartCertificateParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { certId } = parsedParams.data;
-
-        // get the certificate by ID
-        const [cert] = await db
-            .select()
-            .from(certificates)
-            .where(eq(certificates.certId, certId))
-            .limit(1);
-
-        if (!cert) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Certificate not found")
-            );
-        }
-
-        if (cert.status != "failed" && cert.status != "expired") {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Certificate is already valid, no need to restart"
-                )
-            );
-        }
-
-        // update the certificate status to 'pending'
-        await db
-            .update(certificates)
-            .set({
-                status: "pending",
-                errorMessage: null,
-                lastRenewalAttempt: Math.floor(Date.now() / 1000)
-            })
-            .where(eq(certificates.certId, certId));
-
-        return response<null>(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Certificate restarted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/certificates/syncCertToNewts.ts

@@ -1,68 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { pushCertUpdateToAffectedNewts } from "#private/lib/acmeCertSync";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-
-const bodySchema = z.object({
-    domain: z.string().min(1),
-    domainId: z.string().nullable().optional().default(null)
-});
-
-export async function syncCertToNewts(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<void> {
-    const parsed = bodySchema.safeParse(req.body);
-    if (!parsed.success) {
-        return next(
-            createHttpError(
-                HttpCode.BAD_REQUEST,
-                fromError(parsed.error).toString()
-            )
-        );
-    }
-
-    const { domain, domainId } = parsed.data;
-
-    logger.debug(
-        `syncCertToNewts: received request to push cert update for domain "${domain}" (domainId: ${domainId ?? "none"})`
-    );
-
-    try {
-        await pushCertUpdateToAffectedNewts(domain, domainId, null, null);
-
-        res.status(HttpCode.OK).json({
-            data: null,
-            success: true,
-            error: false,
-            message: `Certificate update pushed to affected newts for domain "${domain}"`
-        });
-    } catch (err) {
-        logger.error(
-            `syncCertToNewts: error pushing cert update for domain "${domain}": ${err}`
-        );
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to push certificate update to affected newts"
-            )
-        );
-    }
-}

server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts

@@ -52,7 +52,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/event-streaming-destination",
     description: "Create an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts

@@ -35,7 +35,7 @@ registry.registerPath({
     path: "/org/{orgId}/event-streaming-destination/{destinationId}",
     description:
         "Delete an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
     request: {
         params: paramsSchema
     },

server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts

@@ -109,7 +109,7 @@ registry.registerPath({
     path: "/org/{orgId}/event-streaming-destination",
     description:
         "List all event streaming destinations for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
     request: {
         query: querySchema,
         params: paramsSchema

server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts

@@ -55,7 +55,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/event-streaming-destination/{destinationId}",
     description: "Update an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.EventStreamingDestination],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/external.ts

@@ -11,7 +11,6 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import * as certificates from "#private/routers/certificates";
 import { createStore } from "#private/lib/rateLimitStore";
 import * as billing from "#private/routers/billing";
 import * as remoteExitNode from "#private/routers/remoteExitNode";
@@ -20,19 +19,20 @@ import * as orgIdp from "#private/routers/orgIdp";
 import * as domain from "#private/routers/domain";
 import * as auth from "#private/routers/auth";
 import * as license from "#private/routers/license";
-import * as generateLicense from "./generatedLicense";
+import * as generateLicense from "#private/routers/generatedLicense";
 import * as logs from "#private/routers/auditLogs";
+import {
+    queryAiSessionLogs,
+    exportAiSessionLogs
+} from "@server/routers/auditLogs";
 import * as misc from "#private/routers/misc";
 import * as reKey from "#private/routers/re-key";
 import * as approval from "#private/routers/approvals";
-import * as ssh from "#private/routers/ssh";
 import * as user from "#private/routers/user";
 import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
-import * as client from "@server/routers/client";
-import * as resource from "#private/routers/resource";
 import * as policy from "#private/routers/policy";
 
 import {
@@ -53,7 +53,6 @@ import {
 import { ActionsEnum } from "@server/auth/actions";
 import {
     logActionAudit,
-    verifyCertificateAccess,
     verifyIdpAccess,
     verifyLoginPageAccess,
     verifyRemoteExitNodeAccess,
@@ -167,25 +166,6 @@ authenticated.get(
     orgIdp.listUserAdminOrgIdps
 );
 
-authenticated.get(
-    "/org/:orgId/certificate/:domainId/:domain",
-    verifyOrgAccess,
-    verifyCertificateAccess,
-    verifyUserHasAction(ActionsEnum.getCertificate),
-    certificates.getCertificate
-);
-
-authenticated.post(
-    "/org/:orgId/certificate/:certId/restart",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyCertificateAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.restartCertificate),
-    logActionAudit(ActionsEnum.restartCertificate),
-    certificates.restartCertificate
-);
-
 if (build === "saas") {
     authenticated.post(
         "/org/:orgId/billing/create-checkout-session",
@@ -615,6 +595,25 @@ authenticated.get(
     logs.exportConnectionAuditLogs
 );
 
+authenticated.get(
+    "/org/:orgId/logs/ai",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.viewLogs),
+    queryAiSessionLogs
+);
+
+authenticated.get(
+    "/org/:orgId/logs/ai/export",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.exportLogs),
+    logActionAudit(ActionsEnum.exportLogs),
+    exportAiSessionLogs
+);
+
 authenticated.post(
     "/re-key/:clientId/regenerate-client-secret",
     verifyClientAccess, // this is first to set the org id
@@ -645,17 +644,6 @@ authenticated.put(
     reKey.reGenerateExitNodeSecret
 );
 
-authenticated.post(
-    "/org/:orgId/ssh/sign-key",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.advancedPrivateResources),
-    verifyOrgAccess,
-    verifyLimits,
-    // verifyUserHasAction(ActionsEnum.signSshKey), // this check happens inside of the function now
-    // logActionAudit(ActionsEnum.signSshKey), // it is handled inside of the function below so we can include more metadata
-    ssh.signSshKey
-);
-
 authenticated.post(
     "/user/:userId/add-role/:roleId",
     verifyRoleAccess,
@@ -801,6 +789,14 @@ authenticated.get(
     alertRule.listAlertRules
 );
 
+authenticated.post(
+    "/org/:orgId/test-alert-rule",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.testAlertRule),
+    alertRule.testAlertRule
+);
+
 authenticated.get(
     "/org/:orgId/alert-rule/:alertRuleId",
     verifyValidLicense,
@@ -854,15 +850,11 @@ authenticated.get(
 );
 
 authenticated.get(
-    "/client/:clientId/verify-associations-cache",
-    verifyClientAccess,
-    client.verifyClientAssociationsCache
-);
-
-authenticated.post(
-    "/client/:clientId/rebuild-associations-cache",
-    verifyClientAccess,
-    client.rebuildClientAssociationsCacheRoute
+    "/org/:orgId/health-check-status-histories",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getTarget),
+    healthChecks.getBatchedHealthCheckStatusHistory
 );
 
 authenticated.post(

server/private/routers/gerbil/createExitNode.ts

@@ -34,10 +34,6 @@ export async function createExitNode(
             // TODO: eventually we will want to get the next available port so that we can multiple exit nodes
             // const listenPort = await getNextAvailablePort();
             const listenPort = config.getRawConfig().gerbil.start_port;
-            let subEndpoint = "";
-            if (config.getRawConfig().gerbil.use_subdomain) {
-                subEndpoint = await getUniqueExitNodeEndpointName();
-            }
 
             const exitNodeName =
                 config.getRawConfig().gerbil.exit_node_name ||
@@ -48,7 +44,7 @@ export async function createExitNode(
                 .insert(exitNodes)
                 .values({
                     publicKey,
-                    endpoint: `${subEndpoint}${subEndpoint != "" ? "." : ""}${config.getRawConfig().gerbil.base_endpoint}`,
+                    endpoint: config.getRawConfig().gerbil.base_endpoint,
                     address,
                     listenPort,
                     online: true,

server/private/routers/healthChecks/createHealthCheck.ts

@@ -75,7 +75,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/health-check",
     description: "Create a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/healthChecks/deleteHealthCheck.ts

@@ -37,7 +37,7 @@ registry.registerPath({
     method: "delete",
     path: "/org/{orgId}/health-check/{healthCheckId}",
     description: "Delete a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
     request: {
         params: paramsSchema
     },

server/private/routers/healthChecks/getBatchedStatusHistory.ts

@@ -0,0 +1,96 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import response from "@server/lib/response";
+import {
+    getBatchedStatusHistory,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const healthCheckIdParamsSchema = z.object({
+    days: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 90)),
+    // Minutes to add to UTC to get the requesting client's local time
+    // (e.g. Australia/Sydney standard time is 600). Optional and
+    // defaults to 0 (UTC) so older clients keep the prior behavior.
+    tzOffsetMinutes: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 0)),
+    healthCheckIds: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val) ? val : [val];
+            const nums = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            const unique = [...new Set(nums)];
+            return unique.length ? unique : undefined;
+        }, z.array(z.number().int().positive()))
+        .openapi({
+            description: "Filter by healthCheckIds (repeat query param)"
+        })
+});
+
+export async function getBatchedHealthCheckStatusHistory(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = healthCheckIdParamsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const entityType = "health_check";
+        const { days, healthCheckIds, tzOffsetMinutes } = parsedQuery.data;
+
+        const data = await getBatchedStatusHistory(
+            entityType,
+            healthCheckIds,
+            days,
+            tzOffsetMinutes
+        );
+
+        return response<BatchedStatusHistoryResponse>(res, {
+            data,
+            success: true,
+            error: false,
+            message: "Status history retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/healthChecks/getStatusHistory.ts

@@ -55,9 +55,14 @@ export async function getHealthCheckStatusHistory(
 
         const entityType = "health_check";
         const entityId = parsedParams.data.healthCheckId;
-        const { days } = parsedQuery.data;
+        const { days, tzOffsetMinutes } = parsedQuery.data;
 
-        const data = await getCachedStatusHistory(entityType, entityId, days);
+        const data = await getCachedStatusHistory(
+            entityType,
+            entityId,
+            days,
+            tzOffsetMinutes
+        );
 
         return response<StatusHistoryResponse>(res, {
             data,

server/private/routers/healthChecks/index.ts

@@ -16,3 +16,4 @@ export * from "./createHealthCheck";
 export * from "./updateHealthCheck";
 export * from "./deleteHealthCheck";
 export * from "./getStatusHistory";
+export * from "./getBatchedStatusHistory";

server/private/routers/healthChecks/listHealthChecks.ts

@@ -63,7 +63,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/health-checks",
     description: "List health checks for an organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
     request: {
         params: paramsSchema,
         query: querySchema

server/private/routers/healthChecks/updateHealthCheck.ts

@@ -109,7 +109,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/health-check/{healthCheckId}",
     description: "Update a health check for a specific organization.",
-    tags: [OpenAPITags.Org],
+    tags: [OpenAPITags.HealthCheck],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/hybrid.ts

@@ -58,7 +58,8 @@ import {
     resourceRules,
     resourcePolicyRules,
     userOrgRoles,
-    roles
+    roles,
+    resourceAccessToken
 } from "@server/db";
 import { eq, and, inArray, isNotNull, isNull, ne, or, sql } from "drizzle-orm";
 import { alias } from "@server/db";
@@ -81,11 +82,16 @@ import config from "@server/lib/config";
 import { exchangeSession } from "@server/routers/badger";
 import {
     ResourceSessionValidationResult,
+    createResourceSession,
+    serializeResourceSessionCookie,
     validateResourceSessionToken
 } from "@server/auth/sessions/resource";
 import { checkExitNodeOrg, resolveExitNodes } from "#private/lib/exitNodes";
 import { maxmindLookup } from "@server/db/maxmind";
 import { verifyResourceAccessToken } from "@server/auth/verifyResourceAccessToken";
+import { generateSessionToken } from "@server/auth/sessions/app";
+import { logAccessAudit } from "#private/lib/logAccessAudit";
+import { getUserOrgRoles } from "@server/lib/userOrgRoles";
 import semver from "semver";
 import { maxmindAsnLookup } from "@server/db/maxmindAsn";
 import { checkOrgAccessPolicy } from "@server/lib/checkOrgAccessPolicy";
@@ -178,6 +184,73 @@ const validateResourceAccessTokenBodySchema = z.strictObject({
     accessToken: z.string()
 });
 
+const createAccessTokenSessionParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createAccessTokenSessionBodySchema = z.strictObject({
+    accessTokenId: z.string().min(1)
+});
+
+const getAccessTokenParamsSchema = z.strictObject({
+    accessTokenId: z.string().min(1)
+});
+
+const logAccessAuditBodySchema = z.strictObject({
+    action: z.boolean(),
+    type: z.string(),
+    orgId: z.string(),
+    resourceId: z.number().optional(),
+    siteResourceId: z.number().optional(),
+    user: z
+        .object({
+            username: z.string(),
+            userId: z.string()
+        })
+        .optional(),
+    apiKey: z
+        .object({
+            name: z.string().nullable(),
+            apiKeyId: z.string()
+        })
+        .optional(),
+    metadata: z.any().optional(),
+    userAgent: z.string().optional(),
+    requestIp: z.string().optional()
+});
+
+type AccessTokenUserData = {
+    userId: string;
+    username: string;
+    email: string | null;
+    name: string | null;
+    role: string | null;
+};
+
+async function resolveAccessTokenUserData(
+    userId: string,
+    orgId: string
+): Promise<AccessTokenUserData | undefined> {
+    const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.userId, userId))
+        .limit(1);
+
+    if (!user) {
+        return undefined;
+    }
+
+    const userOrgRoles = await getUserOrgRoles(user.userId, orgId);
+    return {
+        userId: user.userId,
+        username: user.username,
+        email: user.email,
+        name: user.name,
+        role: userOrgRoles.map((r) => r.roleName).join(", ") || null
+    };
+}
+
 // Certificates by domains query validation
 const getCertificatesByDomainsQuerySchema = z.strictObject({
     // Accept domains as string or array (domains or domains[])
@@ -278,6 +351,7 @@ hybridRouter.get(
         }
 
         const pangolinUIUrl = config.getRawConfig().app.dashboard_url; // points to the dashboard to serve from there
+        const aiGatewayUrl = `${config.getRawConfig().app.dashboard_url}/api/v1/ai-gateway`;
 
         try {
             const traefikConfig = await getTraefikConfig(
@@ -286,8 +360,9 @@ hybridRouter.get(
                 true, // But don't allow domain namespace resources
                 false, // Dont include login pages,
                 true, // allow raw resources
-                pangolinUIUrl, // dont generate maintenance page
-                pangolinUIUrl // generate browser gateway targets
+                pangolinUIUrl, // generate maintenance page
+                pangolinUIUrl, // generate browser gateway targets
+                null // dont generate ai gateway resources
             );
 
             return response(res, {
@@ -1829,8 +1904,23 @@ hybridRouter.post(
                 resourceId
             });
 
+            let userData: AccessTokenUserData | undefined;
+            if (
+                result.valid &&
+                result.tokenItem?.userId &&
+                result.tokenItem.orgId
+            ) {
+                userData = await resolveAccessTokenUserData(
+                    result.tokenItem.userId,
+                    result.tokenItem.orgId
+                );
+            }
+
             return response(res, {
-                data: result,
+                data: {
+                    ...result,
+                    userData
+                },
                 success: true,
                 error: false,
                 message: result.valid
@@ -1850,6 +1940,233 @@ hybridRouter.post(
     }
 );
 
+// Create a resource session from a valid access token (for remote nodes)
+hybridRouter.post(
+    "/resource/:resourceId/session/create-access-token",
+    async (req: Request, res: Response, next: NextFunction) => {
+        try {
+            const parsedParams = createAccessTokenSessionParamsSchema.safeParse(
+                req.params
+            );
+            if (!parsedParams.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        fromError(parsedParams.error).toString()
+                    )
+                );
+            }
+
+            const parsedBody = createAccessTokenSessionBodySchema.safeParse(
+                req.body
+            );
+            if (!parsedBody.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        fromError(parsedBody.error).toString()
+                    )
+                );
+            }
+
+            const { resourceId } = parsedParams.data;
+            const { accessTokenId } = parsedBody.data;
+
+            const [tokenItem] = await db
+                .select()
+                .from(resourceAccessToken)
+                .where(eq(resourceAccessToken.accessTokenId, accessTokenId))
+                .limit(1);
+
+            if (!tokenItem || tokenItem.resourceId !== resourceId) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "Access token not found"
+                    )
+                );
+            }
+
+            if (!tokenItem.persistSession) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Access token does not allow session persistence"
+                    )
+                );
+            }
+
+            const [resource] = await db
+                .select()
+                .from(resources)
+                .where(eq(resources.resourceId, resourceId))
+                .limit(1);
+
+            if (!resource || !resource.fullDomain) {
+                return next(
+                    createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+                );
+            }
+
+            const token = generateSessionToken();
+            const sess = await createResourceSession({
+                resourceId: resource.resourceId,
+                token,
+                accessTokenId: tokenItem.accessTokenId,
+                sessionLength: tokenItem.sessionLength,
+                expiresAt: tokenItem.expiresAt,
+                doNotExtend: tokenItem.expiresAt ? true : false
+            });
+
+            const cookieName = config.getRawConfig().server.session_cookie_name;
+            const cookie = serializeResourceSessionCookie(
+                cookieName,
+                resource.fullDomain,
+                token,
+                !resource.ssl,
+                new Date(sess.expiresAt)
+            );
+
+            return response(res, {
+                data: { cookie },
+                success: true,
+                error: false,
+                message: "Access token session created successfully",
+                status: HttpCode.OK
+            });
+        } catch (error) {
+            logger.error(error);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Failed to create access token session"
+                )
+            );
+        }
+    }
+);
+
+// Resolve access token metadata for remote nodes (cookie session path)
+hybridRouter.get(
+    "/resource/access-token/:accessTokenId",
+    async (req: Request, res: Response, next: NextFunction) => {
+        try {
+            const parsedParams = getAccessTokenParamsSchema.safeParse(
+                req.params
+            );
+            if (!parsedParams.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        fromError(parsedParams.error).toString()
+                    )
+                );
+            }
+
+            const { accessTokenId } = parsedParams.data;
+
+            const [tokenItem] = await db
+                .select()
+                .from(resourceAccessToken)
+                .where(eq(resourceAccessToken.accessTokenId, accessTokenId))
+                .limit(1);
+
+            if (!tokenItem) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        "Access token not found"
+                    )
+                );
+            }
+
+            let userData: AccessTokenUserData | undefined;
+            if (tokenItem.userId) {
+                userData = await resolveAccessTokenUserData(
+                    tokenItem.userId,
+                    tokenItem.orgId
+                );
+            }
+
+            return response(res, {
+                data: { tokenItem, userData },
+                success: true,
+                error: false,
+                message: "Access token retrieved successfully",
+                status: HttpCode.OK
+            });
+        } catch (error) {
+            logger.error(error);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Failed to get access token"
+                )
+            );
+        }
+    }
+);
+
+// Access audit log from remote nodes
+hybridRouter.post(
+    "/logs/access",
+    async (req: Request, res: Response, next: NextFunction) => {
+        try {
+            const parsedBody = logAccessAuditBodySchema.safeParse(req.body);
+            if (!parsedBody.success) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        fromError(parsedBody.error).toString()
+                    )
+                );
+            }
+
+            const remoteExitNode = req.remoteExitNode;
+            if (!remoteExitNode || !remoteExitNode.exitNodeId) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Remote exit node not found"
+                    )
+                );
+            }
+
+            if (
+                await checkExitNodeOrg(
+                    remoteExitNode.exitNodeId,
+                    parsedBody.data.orgId
+                )
+            ) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Exit node not allowed for this organization"
+                    )
+                );
+            }
+
+            await logAccessAudit(parsedBody.data);
+
+            return response(res, {
+                data: null,
+                success: true,
+                error: false,
+                message: "Access audit log saved successfully",
+                status: HttpCode.OK
+            });
+        } catch (error) {
+            logger.error(error);
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Failed to save access audit log"
+                )
+            );
+        }
+    }
+);
+
 const geoIpLookupParamsSchema = z.object({
     ip: z.union([z.ipv4(), z.ipv6()])
 });

server/private/routers/integration.ts

@@ -15,7 +15,12 @@ import * as orgIdp from "#private/routers/orgIdp";
 import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
-import * as certificates from "#private/routers/certificates";
+import * as certificates from "@server/routers/certificates";
+import * as siteProvisioning from "#private/routers/siteProvisioning";
+import * as policy from "#private/routers/policy";
+import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
+import * as alertRule from "#private/routers/alertRule";
+import * as healthChecks from "#private/routers/healthChecks";
 
 import {
     verifyApiKeyHasAction,
@@ -24,6 +29,8 @@ import {
     verifyApiKeyIdpAccess,
     verifyApiKeyRoleAccess,
     verifyApiKeyUserAccess,
+    verifyApiKeySiteProvisioningKeyAccess,
+    verifyApiKeyResourcePolicyAccess,
     verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
@@ -36,6 +43,10 @@ import {
     unauthenticated as ua,
     authenticated as a
 } from "@server/routers/integration";
+import {
+    queryAiSessionLogs,
+    exportAiSessionLogs
+} from "@server/routers/auditLogs";
 import { logActionAudit } from "#private/middlewares";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { build } from "@server/build";
@@ -146,6 +157,25 @@ authenticated.get(
     logs.exportConnectionAuditLogs
 );
 
+authenticated.get(
+    "/org/:orgId/logs/ai",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.viewLogs),
+    queryAiSessionLogs
+);
+
+authenticated.get(
+    "/org/:orgId/logs/ai/export",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.aiSessionLogs),
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.exportLogs),
+    logActionAudit(ActionsEnum.exportLogs),
+    exportAiSessionLogs
+);
+
 authenticated.put(
     "/org/:orgId/idp/oidc",
     verifyValidLicense,
@@ -215,3 +245,192 @@ authenticated.delete(
     logActionAudit(ActionsEnum.removeUserRole),
     user.removeUserRole
 );
+
+authenticated.put(
+    "/org/:orgId/site-provisioning-key",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createSiteProvisioningKey),
+    logActionAudit(ActionsEnum.createSiteProvisioningKey),
+    siteProvisioning.createSiteProvisioningKey
+);
+
+authenticated.get(
+    "/org/:orgId/site-provisioning-keys",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listSiteProvisioningKeys),
+    siteProvisioning.listSiteProvisioningKeys
+);
+
+authenticated.delete(
+    "/org/:orgId/site-provisioning-key/:siteProvisioningKeyId",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
+    verifyApiKeyOrgAccess,
+    verifyApiKeySiteProvisioningKeyAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteSiteProvisioningKey),
+    logActionAudit(ActionsEnum.deleteSiteProvisioningKey),
+    siteProvisioning.deleteSiteProvisioningKey
+);
+
+authenticated.patch(
+    "/org/:orgId/site-provisioning-key/:siteProvisioningKeyId",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.siteProvisioningKeys),
+    verifyApiKeyOrgAccess,
+    verifyApiKeySiteProvisioningKeyAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateSiteProvisioningKey),
+    logActionAudit(ActionsEnum.updateSiteProvisioningKey),
+    siteProvisioning.updateSiteProvisioningKey
+);
+
+authenticated.get(
+    ["/org/:orgId/resource-policies", "/org/:orgId/public-resource-policies"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.listResourcePolicies),
+    logActionAudit(ActionsEnum.listResourcePolicies),
+    policy.listResourcePolicies
+);
+
+authenticated.post(
+    ["/org/:orgId/resource-policy", "/org/:orgId/public-resource-policy"],
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourcePolicy),
+    logActionAudit(ActionsEnum.createResourcePolicy),
+    policy.createResourcePolicy
+);
+
+authenticated.delete(
+    [
+        "/resource-policy/:resourcePolicyId",
+        "/public-resource-policy/:resourcePolicyId"
+    ],
+    verifyApiKeyResourcePolicyAccess,
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.resourcePolicies),
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.deleteResourcePolicy),
+    logActionAudit(ActionsEnum.deleteResourcePolicy),
+    policy.deleteResourcePolicy
+);
+
+authenticated.put(
+    "/org/:orgId/event-streaming-destination",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createEventStreamingDestination),
+    logActionAudit(ActionsEnum.createEventStreamingDestination),
+    eventStreamingDestination.createEventStreamingDestination
+);
+
+authenticated.post(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateEventStreamingDestination),
+    logActionAudit(ActionsEnum.updateEventStreamingDestination),
+    eventStreamingDestination.updateEventStreamingDestination
+);
+
+authenticated.delete(
+    "/org/:orgId/event-streaming-destination/:destinationId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteEventStreamingDestination),
+    logActionAudit(ActionsEnum.deleteEventStreamingDestination),
+    eventStreamingDestination.deleteEventStreamingDestination
+);
+
+authenticated.get(
+    "/org/:orgId/event-streaming-destinations",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listEventStreamingDestinations),
+    eventStreamingDestination.listEventStreamingDestinations
+);
+
+authenticated.put(
+    "/org/:orgId/alert-rule",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createAlertRule),
+    logActionAudit(ActionsEnum.createAlertRule),
+    alertRule.createAlertRule
+);
+
+authenticated.post(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateAlertRule),
+    logActionAudit(ActionsEnum.updateAlertRule),
+    alertRule.updateAlertRule
+);
+
+authenticated.delete(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteAlertRule),
+    logActionAudit(ActionsEnum.deleteAlertRule),
+    alertRule.deleteAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rules",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listAlertRules),
+    alertRule.listAlertRules
+);
+
+authenticated.get(
+    "/org/:orgId/alert-rule/:alertRuleId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getAlertRule),
+    alertRule.getAlertRule
+);
+
+authenticated.get(
+    "/org/:orgId/health-checks",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listHealthChecks),
+    healthChecks.listHealthChecks
+);
+
+authenticated.put(
+    "/org/:orgId/health-check",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createHealthCheck),
+    logActionAudit(ActionsEnum.createHealthCheck),
+    healthChecks.createHealthCheck
+);
+
+authenticated.post(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.updateHealthCheck),
+    logActionAudit(ActionsEnum.updateHealthCheck),
+    healthChecks.updateHealthCheck
+);
+
+authenticated.delete(
+    "/org/:orgId/health-check/:healthCheckId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteHealthCheck),
+    logActionAudit(ActionsEnum.deleteHealthCheck),
+    healthChecks.deleteHealthCheck
+);
+
+authenticated.get(
+    "/org/:orgId/health-check/:healthCheckId/status-history",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getTarget),
+    healthChecks.getHealthCheckStatusHistory
+);

server/private/routers/internal.ts

@@ -17,14 +17,8 @@ import * as orgIdp from "#private/routers/orgIdp";
 import * as billing from "#private/routers/billing";
 import * as license from "#private/routers/license";
 import * as resource from "#private/routers/resource";
-import * as ssh from "#private/routers/ssh";
-import * as ws from "@server/routers/ws";
-import * as browserTarget from "#private/routers/browserGatewayTarget";
 
-import {
-    verifySessionUserMiddleware,
-    verifyUserFromResourceSessionMiddleware
-} from "@server/middlewares";
+import { verifySessionUserMiddleware } from "@server/middlewares";
 
 import { internalRouter as ir } from "@server/routers/internal";
 
@@ -46,17 +40,3 @@ internalRouter.post(
 internalRouter.get(`/license/status`, license.getLicenseStatus);
 
 internalRouter.get("/maintenance/info", resource.getMaintenanceInfo);
-
-internalRouter.post(
-    "/org/:orgId/ssh/sign-key",
-    verifyUserFromResourceSessionMiddleware,
-    ssh.signSshKey
-);
-
-internalRouter.get(
-    "/ws/round-trip-message/:messageId",
-    verifyUserFromResourceSessionMiddleware,
-    ws.checkRoundTripMessage
-);
-
-internalRouter.get("/resource/browser-target", browserTarget.getBrowserTarget);

server/private/routers/loginPage/createLoginPage.ts

@@ -29,7 +29,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq, and } from "drizzle-orm";
 import { validateAndConstructDomain } from "@server/lib/domainUtils";
-import { createCertificate } from "#private/routers/certificates/createCertificate";
+import { createCertificate } from "@server/routers/certificates/createCertificate";
 
 import { CreateLoginPageResponse } from "@server/routers/loginPage/types";
 

server/private/routers/loginPage/updateLoginPage.ts

@@ -22,7 +22,7 @@ import { fromError } from "zod-validation-error";
 import { eq, and } from "drizzle-orm";
 import { validateAndConstructDomain } from "@server/lib/domainUtils";
 import { subdomainSchema } from "@server/lib/schemas";
-import { createCertificate } from "#private/routers/certificates/createCertificate";
+import { createCertificate } from "@server/routers/certificates/createCertificate";
 
 import { UpdateLoginPageResponse } from "@server/routers/loginPage/types";
 
@@ -85,7 +85,6 @@ export async function updateLoginPage(
 
         const { loginPageId, orgId } = parsedParams.data;
 
-
         const [existingLoginPage] = await db
             .select()
             .from(loginPage)

server/private/routers/newt/handleRequestLogMessage.ts

@@ -1,238 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db } from "@server/db";
-import { MessageHandler } from "@server/routers/ws";
-import { sites, Newt, orgs, clients, clientSitesAssociationsCache } from "@server/db";
-import { and, eq, inArray } from "drizzle-orm";
-import logger from "@server/logger";
-import { inflate } from "zlib";
-import { promisify } from "util";
-import { logRequestAudit } from "@server/routers/badger/logRequestAudit";
-import { getCountryCodeForIp } from "@server/lib/geoip";
-
-export async function flushRequestLogToDb(): Promise<void> {
-    return;
-}
-
-const zlibInflate = promisify(inflate);
-
-interface HTTPRequestLogData {
-    requestId: string;
-    resourceId: number; // siteResourceId
-    timestamp: string; // ISO 8601
-    method: string;
-    scheme: string; // "http" or "https"
-    host: string;
-    path: string;
-    rawQuery?: string;
-    userAgent?: string;
-    sourceAddr: string; // ip:port
-    tls: boolean;
-}
-
-/**
- * Decompress a base64-encoded zlib-compressed string into parsed JSON.
- */
-async function decompressRequestLog(
-    compressed: string
-): Promise<HTTPRequestLogData[]> {
-    const compressedBuffer = Buffer.from(compressed, "base64");
-    const decompressed = await zlibInflate(compressedBuffer);
-    const jsonString = decompressed.toString("utf-8");
-    const parsed = JSON.parse(jsonString);
-
-    if (!Array.isArray(parsed)) {
-        throw new Error("Decompressed request log data is not an array");
-    }
-
-    return parsed;
-}
-
-export const handleRequestLogMessage: MessageHandler = async (context) => {
-    const { message, client } = context;
-    const newt = client as Newt;
-
-    if (!newt) {
-        logger.warn("Request log received but no newt client in context");
-        return;
-    }
-
-    if (!newt.siteId) {
-        logger.warn("Request log received but newt has no siteId");
-        return;
-    }
-
-    if (!message.data?.compressed) {
-        logger.warn("Request log message missing compressed data");
-        return;
-    }
-
-    // Look up the org for this site and check retention settings
-    const [site] = await db
-        .select({
-            orgId: sites.orgId,
-            orgSubnet: orgs.subnet,
-            settingsLogRetentionDaysRequest:
-                orgs.settingsLogRetentionDaysRequest
-        })
-        .from(sites)
-        .innerJoin(orgs, eq(sites.orgId, orgs.orgId))
-        .where(eq(sites.siteId, newt.siteId));
-
-    if (!site) {
-        logger.warn(
-            `Request log received but site ${newt.siteId} not found in database`
-        );
-        return;
-    }
-
-    const orgId = site.orgId;
-
-    if (site.settingsLogRetentionDaysRequest === 0) {
-        logger.debug(
-            `Request log retention is disabled for org ${orgId}, skipping`
-        );
-        return;
-    }
-
-    let entries: HTTPRequestLogData[];
-    try {
-        entries = await decompressRequestLog(message.data.compressed);
-    } catch (error) {
-        logger.error("Failed to decompress request log data:", error);
-        return;
-    }
-
-    if (entries.length === 0) {
-        return;
-    }
-
-    logger.debug(`Request log entries: ${JSON.stringify(entries)}`);
-
-    // Build a map from sourceIp → external endpoint string by joining clients
-    // with clientSitesAssociationsCache. The endpoint is the real-world IP:port
-    // of the client device and is used for GeoIP lookup.
-    const ipToEndpoint = new Map<string, string>();
-
-    const cidrSuffix = site.orgSubnet?.includes("/")
-        ? site.orgSubnet.substring(site.orgSubnet.indexOf("/"))
-        : null;
-
-    if (cidrSuffix) {
-        const uniqueSourceAddrs = new Set<string>();
-        for (const entry of entries) {
-            if (entry.sourceAddr) {
-                uniqueSourceAddrs.add(entry.sourceAddr);
-            }
-        }
-
-        if (uniqueSourceAddrs.size > 0) {
-            const subnetQueries = Array.from(uniqueSourceAddrs).map((addr) => {
-                const ip = addr.includes(":") ? addr.split(":")[0] : addr;
-                return `${ip}${cidrSuffix}`;
-            });
-
-            const matchedClients = await db
-                .select({
-                    subnet: clients.subnet,
-                    endpoint: clientSitesAssociationsCache.endpoint
-                })
-                .from(clients)
-                .innerJoin(
-                    clientSitesAssociationsCache,
-                    and(
-                        eq(
-                            clientSitesAssociationsCache.clientId,
-                            clients.clientId
-                        ),
-                        eq(clientSitesAssociationsCache.siteId, newt.siteId)
-                    )
-                )
-                .where(
-                    and(
-                        eq(clients.orgId, orgId),
-                        inArray(clients.subnet, subnetQueries)
-                    )
-                );
-
-            for (const c of matchedClients) {
-                if (c.endpoint) {
-                    const ip = c.subnet.split("/")[0];
-                    ipToEndpoint.set(ip, c.endpoint);
-                }
-            }
-        }
-    }
-
-    for (const entry of entries) {
-        if (
-            !entry.requestId ||
-            !entry.resourceId ||
-            !entry.method ||
-            !entry.scheme ||
-            !entry.host ||
-            !entry.path ||
-            !entry.sourceAddr
-        ) {
-            logger.debug(
-                `Skipping request log entry with missing required fields: ${JSON.stringify(entry)}`
-            );
-            continue;
-        }
-
-        const originalRequestURL =
-            entry.scheme +
-            "://" +
-            entry.host +
-            entry.path +
-            (entry.rawQuery ? "?" + entry.rawQuery : "");
-
-        // Resolve the client's external endpoint for GeoIP lookup.
-        // sourceAddr is the WireGuard IP (possibly ip:port), so strip the port.
-        const sourceIp = entry.sourceAddr.includes(":")
-            ? entry.sourceAddr.split(":")[0]
-            : entry.sourceAddr;
-        const endpoint = ipToEndpoint.get(sourceIp);
-        let location: string | undefined;
-        if (endpoint) {
-            const endpointIp = endpoint.includes(":")
-                ? endpoint.split(":")[0]
-                : endpoint;
-            location = await getCountryCodeForIp(endpointIp);
-        }
-
-        await logRequestAudit(
-            {
-                action: true,
-                reason: 108,
-                siteResourceId: entry.resourceId,
-                orgId,
-                location
-            },
-            {
-                path: entry.path,
-                originalRequestURL,
-                scheme: entry.scheme,
-                host: entry.host,
-                method: entry.method,
-                tls: entry.tls,
-                requestIp: entry.sourceAddr
-            }
-        );
-    }
-
-    logger.debug(
-        `Buffered ${entries.length} request log entry/entries from newt ${newt.newtId} (site ${newt.siteId})`
-    );
-};

server/private/routers/newt/index.ts

@@ -12,4 +12,3 @@
  */
 
 export * from "./handleConnectionLogMessage";
-export * from "./handleRequestLogMessage";

server/private/routers/policy/createResourcePolicy.ts

@@ -14,8 +14,6 @@
 import { hashPassword } from "@server/auth/password";
 import {
     db,
-    idp,
-    idpOrg,
     orgs,
     resourcePolicies,
     resourcePolicyHeaderAuth,
@@ -31,6 +29,7 @@ import {
     type ResourcePolicy
 } from "@server/db";
 import { getUniqueResourcePolicyName } from "@server/db/names";
+import { idpExistsForOrg } from "@server/lib/idp/idpExistsForOrg";
 import response from "@server/lib/response";
 import {
     getResourceRuleValueValidationError,
@@ -108,7 +107,6 @@ const createResourcePolicyBodySchema = z.strictObject({
                 })
             )
         )
-        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
         .optional()
         .default([]),
@@ -121,7 +119,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/resource-policy",
     description: "Create a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: createResourcePolicyParamsSchema,
         body: {
@@ -204,14 +202,9 @@ export async function createResourcePolicy(
 
         // Check if Identity provider in `skipToIdpId` exists
         if (skipToIdpId) {
-            const [provider] = await db
-                .select()
-                .from(idp)
-                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
-                .where(and(eq(idp.idpId, skipToIdpId), eq(idpOrg.orgId, orgId)))
-                .limit(1);
+            const providerExists = await idpExistsForOrg(skipToIdpId, orgId);
 
-            if (!provider) {
+            if (!providerExists) {
                 return next(
                     createHttpError(
                         HttpCode.INTERNAL_SERVER_ERROR,

server/private/routers/policy/deleteResourcePolicy.ts

@@ -31,7 +31,7 @@ registry.registerPath({
     method: "delete",
     path: "/resource-policy/{resourcePolicyId}",
     description: "Delete a resource policy.",
-    tags: [OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: deleteResourcePolicySchema
     },

server/private/routers/policy/listResourcePolicies.ts

@@ -79,7 +79,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/resource-policies",
     description: "List resource policies for an organization.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
+    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: z.object({
             orgId: z.string()

server/private/routers/re-key/reGenerateSiteSecret.ts

@@ -178,7 +178,7 @@ export async function reGenerateSiteSecret(
                     );
                 }
 
-                if (site.exitNodeId && site.subnet) {
+                if (site.exitNodeId && site.exitNodeSubnet) {
                     await deletePeer(site.exitNodeId, site.pubKey!); // the old pubkey
                     await addPeer(site.exitNodeId, {
                         publicKey: pubKey,

server/private/routers/remoteExitNode/exitNodeReconnectScheduler.ts

@@ -16,7 +16,7 @@ import { db, exitNodes, newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
 import redisManager from "#private/lib/redis";
-import { sendToClient } from "#private/routers/ws";
+// import { sendToClient } from "#private/routers/ws";
 
 const INITIAL_DELAY_MS = 15 * 1000; // 15 seconds before first check
 const CHECK_INTERVAL_MS = 10 * 1000; // Check every 10 seconds
@@ -150,47 +150,47 @@ async function processPendingReconnects(): Promise<void> {
             `Exit node ${exitNodeId} is reachable. Sending newt/wg/reconnect to connected newts.`
         );
 
-        await sendReconnectToNewts(exitNodeId);
+        // await sendReconnectToNewts(exitNodeId);
         await removePending(exitNodeId);
     }
 }
 
-async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
-    try {
-        const connectedNewts = await db
-            .select({ newtId: newts.newtId })
-            .from(newts)
-            .innerJoin(sites, eq(newts.siteId, sites.siteId))
-            .where(eq(sites.exitNodeId, exitNodeId));
+// async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
+// try {
+//         const connectedNewts = await db
+//             .select({ newtId: newts.newtId })
+//             .from(newts)
+//             .innerJoin(sites, eq(newts.siteId, sites.siteId))
+//             .where(eq(sites.exitNodeId, exitNodeId));
 
-        if (connectedNewts.length === 0) {
-            logger.debug(
-                `No newts found for exit node ${exitNodeId}, nothing to reconnect`
-            );
-            return;
-        }
+//         if (connectedNewts.length === 0) {
+//             logger.debug(
+//                 `No newts found for exit node ${exitNodeId}, nothing to reconnect`
+//             );
+//             return;
+//         }
 
-        logger.info(
-            `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
-        );
+//         logger.info(
+//             `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
+//         );
 
-        const reconnectMessage = {
-            type: "newt/wg/reconnect",
-            data: {}
-        };
+//         const reconnectMessage = {
+//             type: "newt/wg/reconnect",
+//             data: {}
+//         };
 
-        await Promise.allSettled(
-            connectedNewts.map(({ newtId }) =>
-                sendToClient(newtId, reconnectMessage)
-            )
-        );
-    } catch (error) {
-        logger.error(
-            `Failed to send reconnect messages for exit node ${exitNodeId}`,
-            { error }
-        );
-    }
-}
+//         await Promise.allSettled(
+//             connectedNewts.map(({ newtId }) =>
+//                 sendToClient(newtId, reconnectMessage)
+//             )
+//         );
+//     } catch (error) {
+//         logger.error(
+//             `Failed to send reconnect messages for exit node ${exitNodeId}`,
+//             { error }
+//         );
+//     }
+// }
 
 async function removePending(exitNodeId: number): Promise<void> {
     pendingReconnects.delete(exitNodeId);

server/private/routers/siteProvisioning/createSiteProvisioningKey.ts

@@ -26,6 +26,8 @@ import {
 import logger from "@server/logger";
 import { hashPassword } from "@server/auth/password";
 import type { CreateSiteProvisioningKeyResponse } from "@server/routers/siteProvisioning/types";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     orgId: z.string().nonempty()
@@ -34,10 +36,17 @@ const paramsSchema = z.object({
 const bodySchema = z
     .strictObject({
         name: z.string().min(1).max(255),
-        maxBatchSize: z.union([
-            z.null(),
-            z.coerce.number().int().positive().max(1_000_000)
-        ]),
+        maxBatchSize: z
+            .union([
+                z.null(),
+                z.coerce.number().int().positive().max(1_000_000)
+            ])
+            .openapi({
+                type: "number",
+                default: null,
+                description:
+                    "Maximum number of sites that can be provisioned in a single batch. If null, there is no limit."
+            }),
         validUntil: z.string().max(255).optional(),
         approveNewSites: z.boolean().optional().default(true)
     })
@@ -57,6 +66,49 @@ const bodySchema = z
 
 export type CreateSiteProvisioningKeyBody = z.infer<typeof bodySchema>;
 
+const CreateSiteProvisioningKeyResponseDataSchema = z.object({
+    siteProvisioningKeyId: z.string(),
+    orgId: z.string(),
+    name: z.string(),
+    siteProvisioningKey: z.string(),
+    lastChars: z.string(),
+    createdAt: z.string(),
+    lastUsed: z.string().nullable(),
+    maxBatchSize: z.number().nullable(),
+    numUsed: z.number(),
+    validUntil: z.string().nullable(),
+    approveNewSites: z.boolean()
+});
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/site-provisioning-key",
+    description: "Create a new site provisioning key for the organization.",
+    tags: [OpenAPITags.SiteProvisioningKey],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        201: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        CreateSiteProvisioningKeyResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
 export async function createSiteProvisioningKey(
     req: Request,
     res: Response,

server/private/routers/siteProvisioning/deleteSiteProvisioningKey.ts

@@ -13,23 +13,46 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
-    db,
-    siteProvisioningKeyOrg,
-    siteProvisioningKeys
-} from "@server/db";
+import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     siteProvisioningKeyId: z.string().nonempty(),
     orgId: z.string().nonempty()
 });
 
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/site-provisioning-key/{siteProvisioningKeyId}",
+    description: "Delete a site provisioning key.",
+    tags: [OpenAPITags.SiteProvisioningKey],
+    request: {
+        params: paramsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
 export async function deleteSiteProvisioningKey(
     req: Request,
     res: Response,

server/private/routers/siteProvisioning/listSiteProvisioningKeys.ts

@@ -11,11 +11,7 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import {
-    db,
-    siteProvisioningKeyOrg,
-    siteProvisioningKeys
-} from "@server/db";
+import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
@@ -25,6 +21,8 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
 import type { ListSiteProvisioningKeysResponse } from "@server/routers/siteProvisioning/types";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     orgId: z.string().nonempty()
@@ -45,11 +43,55 @@ const querySchema = z.object({
         .pipe(z.int().nonnegative())
 });
 
+const ListSiteProvisioningKeysResponseDataSchema = z.object({
+    siteProvisioningKeys: z.array(
+        z.object({
+            siteProvisioningKeyId: z.string(),
+            orgId: z.string(),
+            lastChars: z.string(),
+            createdAt: z.string(),
+            name: z.string(),
+            lastUsed: z.string().nullable(),
+            maxBatchSize: z.number().nullable(),
+            numUsed: z.number(),
+            validUntil: z.string().nullable(),
+            approveNewSites: z.boolean()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        limit: z.number(),
+        offset: z.number()
+    })
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/site-provisioning-keys",
+    description: "List all site provisioning keys for an organization.",
+    tags: [OpenAPITags.SiteProvisioningKey],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        ListSiteProvisioningKeysResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
 function querySiteProvisioningKeys(orgId: string) {
     return db
         .select({
-            siteProvisioningKeyId:
-                siteProvisioningKeys.siteProvisioningKeyId,
+            siteProvisioningKeyId: siteProvisioningKeys.siteProvisioningKeyId,
             orgId: siteProvisioningKeyOrg.orgId,
             lastChars: siteProvisioningKeys.lastChars,
             createdAt: siteProvisioningKeys.createdAt,

server/private/routers/siteProvisioning/updateSiteProvisioningKey.ts

@@ -13,11 +13,7 @@
 
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import {
-    db,
-    siteProvisioningKeyOrg,
-    siteProvisioningKeys
-} from "@server/db";
+import { db, siteProvisioningKeyOrg, siteProvisioningKeys } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -25,6 +21,8 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import type { UpdateSiteProvisioningKeyResponse } from "@server/routers/siteProvisioning/types";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const paramsSchema = z.object({
     siteProvisioningKeyId: z.string().nonempty(),
@@ -38,7 +36,13 @@ const bodySchema = z
                 z.null(),
                 z.coerce.number().int().positive().max(1_000_000)
             ])
-            .optional(),
+            .optional()
+            .openapi({
+                type: "number",
+                default: null,
+                description:
+                    "Maximum number of sites that can be provisioned in a single batch. If null, there is no limit."
+            }),
         validUntil: z.string().max(255).optional(),
         approveNewSites: z.boolean().optional()
     })
@@ -50,7 +54,8 @@ const bodySchema = z
         ) {
             ctx.addIssue({
                 code: "custom",
-                message: "Provide maxBatchSize and/or validUntil and/or approveNewSites",
+                message:
+                    "Provide maxBatchSize and/or validUntil and/or approveNewSites",
                 path: ["maxBatchSize"]
             });
         }
@@ -69,6 +74,48 @@ const bodySchema = z
 
 export type UpdateSiteProvisioningKeyBody = z.infer<typeof bodySchema>;
 
+const UpdateSiteProvisioningKeyResponseDataSchema = z.object({
+    siteProvisioningKeyId: z.string(),
+    orgId: z.string(),
+    name: z.string(),
+    lastChars: z.string(),
+    createdAt: z.string(),
+    lastUsed: z.string().nullable(),
+    maxBatchSize: z.number().nullable(),
+    numUsed: z.number(),
+    validUntil: z.string().nullable(),
+    approveNewSites: z.boolean()
+});
+
+registry.registerPath({
+    method: "patch",
+    path: "/org/{orgId}/site-provisioning-key/{siteProvisioningKeyId}",
+    description: "Update a site provisioning key.",
+    tags: [OpenAPITags.SiteProvisioningKey],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        UpdateSiteProvisioningKeyResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
 export async function updateSiteProvisioningKey(
     req: Request,
     res: Response,

server/private/routers/ssh/index.ts

@@ -1,14 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./signSshKey";

server/private/routers/ssh/signSshKey.ts

@@ -1,827 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { randomInt } from "crypto";
-import { z } from "zod";
-import {
-    actionAuditLog,
-    db,
-    logsDb,
-    newts,
-    roles,
-    roleActions,
-    rolePolicies,
-    roleResources,
-    roleSiteResources,
-    resources,
-    roundTripMessageTracker,
-    siteResources,
-    siteNetworks,
-    targets,
-    userOrgs,
-    sites,
-    Resource,
-    SiteResource
-} from "@server/db";
-import { logAccessAudit } from "#private/lib/logAccessAudit";
-import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { and, eq, inArray, isNull, or } from "drizzle-orm";
-import { canUserAccessResource } from "@server/auth/canUserAccessResource";
-import { canUserAccessSiteResource } from "@server/auth/canUserAccessSiteResource";
-import { signPublicKey, getOrgCAKeys } from "@server/lib/sshCA";
-import config from "@server/lib/config";
-import { sendToClient } from "#private/routers/ws";
-import { ActionsEnum } from "@server/auth/actions";
-import type { SignSshKeyResponse } from "@server/routers/ssh/types";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty()
-});
-
-const bodySchema = z
-    .strictObject({
-        publicKey: z.string().nonempty(),
-        resourceId: z.number().int().positive().optional(),
-        resource: z.string().nonempty().optional(), // this is either the nice id or the alias
-        username: z.string().nonempty().optional(),
-        type: z.enum(["public", "private"]).default("private")
-    })
-    .refine(
-        (data) => {
-            const fields = [data.resourceId, data.resource];
-            const definedFields = fields.filter((field) => field !== undefined);
-            return definedFields.length === 1;
-        },
-        {
-            message:
-                "Exactly one of resourceId, niceId, or alias must be provided"
-        }
-    );
-
-export async function signSshKey(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-        const {
-            publicKey,
-            resourceId,
-            type,
-            resource: resourceQueryString,
-            username
-        } = parsedBody.data;
-        const userId = req.user?.userId;
-        const roleIds = req.userOrgRoleIds ?? [];
-
-        if (!userId) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
-            );
-        }
-
-        if (roleIds.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User has no role in organization"
-                )
-            );
-        }
-
-        const [userOrg] = await db
-            .select()
-            .from(userOrgs)
-            .where(and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId)))
-            .limit(1);
-
-        if (!userOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not belong to the specified organization"
-                )
-            );
-        }
-
-        const roleActionPermission = await db
-            .select({ roleId: roleActions.roleId })
-            .from(roleActions)
-            .where(
-                and(
-                    eq(roleActions.actionId, ActionsEnum.signSshKey),
-                    inArray(roleActions.roleId, roleIds),
-                    eq(roleActions.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (roleActionPermission.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have permission perform this action"
-                )
-            );
-        }
-
-        const isLicensed = await isLicensedOrSubscribed(
-            orgId,
-            tierMatrix.advancedPrivateResources
-        );
-        if (!isLicensed) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "SSH key signing requires a paid plan"
-                )
-            );
-        }
-
-        // Get and decrypt the org's CA keys
-        const caKeys = await getOrgCAKeys(
-            orgId,
-            config.getRawConfig().server.secret!
-        );
-
-        if (!caKeys) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "SSH CA not configured for this organization"
-                )
-            );
-        }
-
-        let matchingResources: SiteResource[] | Resource[] = [];
-        // Verify the resource exists and belongs to the org.
-        // Build the where clause dynamically based on which field is provided.
-        let whereClause;
-        if (resourceId !== undefined) {
-            whereClause =
-                type === "private"
-                    ? eq(siteResources.siteResourceId, resourceId)
-                    : eq(resources.resourceId, resourceId);
-        } else if (resourceQueryString !== undefined) {
-            whereClause =
-                type === "private"
-                    ? or(
-                          eq(siteResources.niceId, resourceQueryString),
-                          eq(siteResources.alias, resourceQueryString)
-                      )
-                    : eq(resources.niceId, resourceQueryString);
-        } else {
-            // This should never happen due to the schema validation, but TypeScript doesn't know that.
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "One of resourceId, niceId, or alias must be provided"
-                )
-            );
-        }
-
-        if (type === "private") {
-            matchingResources = await db
-                .select()
-                .from(siteResources)
-                .where(and(whereClause, eq(siteResources.orgId, orgId)));
-        } else {
-            matchingResources = await db
-                .select()
-                .from(resources)
-                .where(and(whereClause, eq(resources.orgId, orgId)));
-        }
-
-        if (!matchingResources || matchingResources.length === 0) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, `Resource not found`)
-            );
-        }
-
-        if (matchingResources.length > 1) {
-            // error but this should not happen because the nice id cant contain a dot and the alias has to have a dot and both have to be unique within the org so there should never be multiple matches
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    `Multiple resources found matching the criteria`
-                )
-            );
-        }
-
-        const resource = matchingResources[0];
-        const normalizedResourceId =
-            type === "private"
-                ? (resource as SiteResource).siteResourceId
-                : (resource as Resource).resourceId;
-
-        if (resource.orgId !== orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Resource does not belong to the specified organization"
-                )
-            );
-        }
-
-        if (resource.mode == "cidr") {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "SSHing is not supported for CIDR resources"
-                )
-            );
-        }
-
-        // Check if the user has access to the resource
-        const hasAccess =
-            type === "private"
-                ? await canUserAccessSiteResource({
-                      userId: userId,
-                      resourceId: (resource as SiteResource).siteResourceId,
-                      roleIds
-                  })
-                : await canUserAccessResource({
-                      userId: userId,
-                      resourceId: (resource as Resource).resourceId,
-                      roleIds
-                  });
-
-        if (!hasAccess) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this resource"
-                )
-            );
-        }
-
-        const siteAgentHostMap = new Map<number, string>();
-        let siteIds: number[] = [];
-
-        if (type === "private") {
-            const privateResource = resource as SiteResource;
-            const sitesFromNetworks = await db
-                .select({ siteId: siteNetworks.siteId })
-                .from(siteNetworks)
-                .where(eq(siteNetworks.networkId, privateResource.networkId!));
-
-            siteIds = sitesFromNetworks.map((site) => site.siteId);
-            for (const siteId of siteIds) {
-                if (privateResource.destination) {
-                    siteAgentHostMap.set(siteId, privateResource.destination);
-                }
-            }
-        } else {
-            const publicResource = resource as Resource;
-            const targetRows = await db
-                .select({
-                    siteId: targets.siteId,
-                    ip: targets.ip
-                })
-                .from(targets)
-                .where(
-                    and(
-                        eq(targets.resourceId, publicResource.resourceId),
-                        eq(targets.enabled, true),
-                        eq(targets.mode, "ssh")
-                    )
-                );
-
-            if (targetRows.length === 0) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        "No enabled targets found for the resource"
-                    )
-                );
-            }
-
-            for (const targetRow of targetRows) {
-                if (!siteAgentHostMap.has(targetRow.siteId)) {
-                    siteAgentHostMap.set(targetRow.siteId, targetRow.ip);
-                }
-            }
-
-            siteIds = Array.from(siteAgentHostMap.keys());
-        }
-
-        let expiresIn: number | undefined;
-        let messageIds: number[] = [];
-        let cert:
-            | {
-                  certificate: string;
-                  keyId: string;
-                  validPrincipals: string[];
-                  validAfter: Date;
-                  validBefore: Date;
-              }
-            | undefined;
-        // if the pam mode is push then we generate the user's pam username and use that or pull it from the userOrgs table
-        // if the mode is passthrough then just use what was provided because the user will log in themselves
-        let usernameToUse;
-        if (resource.pamMode === "push") {
-            if (!userOrg.pamUsername) {
-                if (req.user?.email) {
-                    // Extract username from email (first part before @)
-                    usernameToUse = req.user?.email
-                        .split("@")[0]
-                        .replace(/[^a-zA-Z0-9_-]/g, "");
-                    if (!usernameToUse) {
-                        return next(
-                            createHttpError(
-                                HttpCode.BAD_REQUEST,
-                                "Unable to extract username from email"
-                            )
-                        );
-                    }
-                } else if (req.user?.username) {
-                    usernameToUse = req.user.username;
-                    // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
-                    usernameToUse = usernameToUse.replace(
-                        /[^a-zA-Z0-9_-]/g,
-                        "-"
-                    );
-                    if (!usernameToUse) {
-                        return next(
-                            createHttpError(
-                                HttpCode.BAD_REQUEST,
-                                "Username is not valid for SSH certificate"
-                            )
-                        );
-                    }
-                } else {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "User does not have a valid email or username for SSH certificate"
-                        )
-                    );
-                }
-
-                // prefix with p-
-                usernameToUse = `p-${usernameToUse}`;
-
-                // check if we have a existing user in this org with the same
-                const [existingUserWithSameName] = await db
-                    .select()
-                    .from(userOrgs)
-                    .where(
-                        and(
-                            eq(userOrgs.orgId, orgId),
-                            eq(userOrgs.pamUsername, usernameToUse)
-                        )
-                    )
-                    .limit(1);
-
-                if (existingUserWithSameName) {
-                    let foundUniqueUsername = false;
-                    for (let attempt = 0; attempt < 20; attempt++) {
-                        const randomNum = randomInt(0, 101); // 0 to 100
-                        const candidateUsername = `${usernameToUse}${randomNum}`;
-
-                        const [existingUser] = await db
-                            .select()
-                            .from(userOrgs)
-                            .where(
-                                and(
-                                    eq(userOrgs.orgId, orgId),
-                                    eq(userOrgs.pamUsername, candidateUsername)
-                                )
-                            )
-                            .limit(1);
-
-                        if (!existingUser) {
-                            usernameToUse = candidateUsername;
-                            foundUniqueUsername = true;
-                            break;
-                        }
-                    }
-
-                    if (!foundUniqueUsername) {
-                        return next(
-                            createHttpError(
-                                HttpCode.CONFLICT,
-                                "Unable to generate a unique username for SSH certificate"
-                            )
-                        );
-                    }
-                }
-
-                await db
-                    .update(userOrgs)
-                    .set({ pamUsername: usernameToUse })
-                    .where(
-                        and(
-                            eq(userOrgs.orgId, orgId),
-                            eq(userOrgs.userId, userId)
-                        )
-                    );
-            } else {
-                usernameToUse = userOrg.pamUsername;
-            }
-
-            type RoleSshMeta = {
-                roleId: number;
-                sshSudoCommands: string | null;
-                sshUnixGroups: string | null;
-                sshCreateHomeDir: boolean | null;
-                sshSudoMode: string | null;
-            };
-
-            let roleRows: RoleSshMeta[] = [];
-
-            if (type === "private") {
-                roleRows = await db
-                    .select({
-                        roleId: roles.roleId,
-                        sshSudoCommands: roles.sshSudoCommands,
-                        sshUnixGroups: roles.sshUnixGroups,
-                        sshCreateHomeDir: roles.sshCreateHomeDir,
-                        sshSudoMode: roles.sshSudoMode
-                    })
-                    .from(roles)
-                    .innerJoin(
-                        roleSiteResources,
-                        eq(roleSiteResources.roleId, roles.roleId)
-                    )
-                    .where(
-                        and(
-                            inArray(roles.roleId, roleIds),
-                            eq(
-                                roleSiteResources.siteResourceId,
-                                (resource as SiteResource).siteResourceId
-                            )
-                        )
-                    );
-            } else {
-                const publicResourceId = (resource as Resource).resourceId;
-                const [directRoleRows, policyRoleRows] = await Promise.all([
-                    db
-                        .select({
-                            roleId: roles.roleId,
-                            sshSudoCommands: roles.sshSudoCommands,
-                            sshUnixGroups: roles.sshUnixGroups,
-                            sshCreateHomeDir: roles.sshCreateHomeDir,
-                            sshSudoMode: roles.sshSudoMode
-                        })
-                        .from(roles)
-                        .innerJoin(
-                            roleResources,
-                            eq(roleResources.roleId, roles.roleId)
-                        )
-                        .where(
-                            and(
-                                inArray(roles.roleId, roleIds),
-                                eq(roleResources.resourceId, publicResourceId)
-                            )
-                        ),
-                    db
-                        .select({
-                            roleId: roles.roleId,
-                            sshSudoCommands: roles.sshSudoCommands,
-                            sshUnixGroups: roles.sshUnixGroups,
-                            sshCreateHomeDir: roles.sshCreateHomeDir,
-                            sshSudoMode: roles.sshSudoMode
-                        })
-                        .from(roles)
-                        .innerJoin(
-                            rolePolicies,
-                            eq(rolePolicies.roleId, roles.roleId)
-                        )
-                        .innerJoin(
-                            resources,
-                            or(
-                                eq(
-                                    resources.resourcePolicyId,
-                                    rolePolicies.resourcePolicyId
-                                ),
-                                and(
-                                    isNull(resources.resourcePolicyId),
-                                    eq(
-                                        resources.defaultResourcePolicyId,
-                                        rolePolicies.resourcePolicyId
-                                    )
-                                )
-                            )
-                        )
-                        .where(
-                            and(
-                                inArray(roles.roleId, roleIds),
-                                eq(resources.resourceId, publicResourceId)
-                            )
-                        )
-                ]);
-
-                const uniqueByRoleId = new Map<number, RoleSshMeta>();
-                for (const row of [...directRoleRows, ...policyRoleRows]) {
-                    if (!uniqueByRoleId.has(row.roleId)) {
-                        uniqueByRoleId.set(row.roleId, row);
-                    }
-                }
-                roleRows = Array.from(uniqueByRoleId.values());
-            }
-
-            const parsedSudoCommands: string[] = [];
-            const parsedGroupsSet = new Set<string>();
-            let homedir: boolean | null = null;
-            const sudoModeOrder = { none: 0, commands: 1, full: 2 };
-            let sudoMode: "none" | "commands" | "full" = "none";
-            for (const roleRow of roleRows) {
-                try {
-                    const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
-                    if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
-                } catch {
-                    // skip
-                }
-                try {
-                    const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                    if (Array.isArray(grps))
-                        grps.forEach((g: string) => parsedGroupsSet.add(g));
-                } catch {
-                    // skip
-                }
-                if (roleRow?.sshCreateHomeDir === true) homedir = true;
-                const m = roleRow?.sshSudoMode ?? "none";
-                if (
-                    sudoModeOrder[m as keyof typeof sudoModeOrder] >
-                    sudoModeOrder[sudoMode]
-                ) {
-                    sudoMode = m as "none" | "commands" | "full";
-                }
-            }
-            const parsedGroups = Array.from(parsedGroupsSet);
-            if (homedir === null && roleRows.length > 0) {
-                homedir = roleRows[0].sshCreateHomeDir ?? null;
-            }
-
-            // Sign the public key
-            const now = BigInt(Math.floor(Date.now() / 1000));
-            // only valid for 5 minutes
-            const validFor = 300n;
-            expiresIn = Number(validFor); // seconds
-
-            cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
-                keyId: `${usernameToUse}@${resource.niceId}`,
-                validPrincipals: [usernameToUse, resource.niceId],
-                validAfter: now - 60n, // Start 1 min ago for clock skew
-                validBefore: now + validFor
-            });
-
-            messageIds = [];
-            for (const siteId of siteIds) {
-                // get the site
-                const [newt] = await db
-                    .select()
-                    .from(newts)
-                    .where(eq(newts.siteId, siteId))
-                    .limit(1);
-
-                if (!newt) {
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Site associated with resource not found"
-                        )
-                    );
-                }
-
-                const [message] = await db
-                    .insert(roundTripMessageTracker)
-                    .values({
-                        wsClientId: newt.newtId,
-                        messageType: `newt/pam/connection`,
-                        sentAt: Math.floor(Date.now() / 1000)
-                    })
-                    .returning();
-
-                if (!message) {
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Failed to create message tracker entry"
-                        )
-                    );
-                }
-
-                messageIds.push(message.messageId);
-
-                const agentHost = siteAgentHostMap.get(siteId);
-
-                await sendToClient(newt.newtId, {
-                    type: `newt/pam/connection`,
-                    data: {
-                        messageId: message.messageId,
-                        orgId: orgId,
-                        agentPort: resource.authDaemonPort ?? 22123,
-                        authDaemonMode: resource.authDaemonMode, // site, remote, native where native is the pty mode
-                        externalAuthDaemon:
-                            resource.authDaemonMode === "remote", // keep this for backward compatibility but new newts are using the authDaemonMode field
-                        agentHost,
-                        caCert: caKeys.publicKeyOpenSSH,
-                        username: usernameToUse,
-                        niceId: resource.niceId,
-                        metadata: {
-                            sudoMode: sudoMode,
-                            sudoCommands: parsedSudoCommands,
-                            homedir: homedir,
-                            groups: parsedGroups
-                        }
-                    }
-                });
-            }
-        } else if (resource.pamMode === "passthrough") {
-            usernameToUse = username;
-            if (!usernameToUse) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Username must be provided when PAM mode is passthrough"
-                    )
-                );
-            }
-        } else {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Invalid PAM mode configured for resource"
-                )
-            );
-        }
-
-        let sshHost: string | undefined;
-        if (
-            resource.authDaemonMode === "site" ||
-            resource.authDaemonMode === "remote"
-        ) {
-            if (type === "private") {
-                const privateResource = resource as SiteResource;
-                if (privateResource.alias && privateResource.alias !== "") {
-                    sshHost = privateResource.alias;
-                } else {
-                    sshHost = privateResource.destination || "";
-                }
-            } else {
-                const publicResource = resource as Resource;
-                sshHost =
-                    publicResource.fullDomain ||
-                    publicResource.subdomain ||
-                    publicResource.niceId;
-            }
-        } else if (resource.authDaemonMode === "native") {
-            if (siteIds.length > 1) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Multiple sites associated with resource, unable to determine SSH host when in native mode"
-                    )
-                );
-            }
-
-            // get the site
-            const [site] = await db
-                .select()
-                .from(sites)
-                .where(eq(sites.siteId, siteIds[0]))
-                .limit(1);
-
-            if (!site) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Site associated with resource not found"
-                    )
-                );
-            }
-
-            if (!site.address) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Site address not configured, unable to determine SSH host when in native mode"
-                    )
-                );
-            }
-
-            // its the address but split off the cidr if there is one
-            sshHost = site.address.split("/")[0];
-        }
-
-        if (!sshHost) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Unable to determine SSH host for the resource"
-                )
-            );
-        }
-
-        await logsDb.insert(actionAuditLog).values({
-            timestamp: Math.floor(Date.now() / 1000),
-            orgId: orgId,
-            actorType: "user",
-            actor: req.user?.username ?? "",
-            actorId: req.user?.userId ?? "",
-            action: ActionsEnum.signSshKey,
-            metadata: JSON.stringify({
-                resourceId: normalizedResourceId,
-                resourceType: type,
-                resource: resource.name,
-                siteIds: siteIds
-            })
-        });
-
-        await logAccessAudit({
-            action: true,
-            type: "ssh",
-            orgId: orgId,
-            resourceId:
-                type === "public"
-                    ? (resource as Resource).resourceId
-                    : undefined,
-            siteResourceId:
-                type === "private"
-                    ? (resource as SiteResource).siteResourceId
-                    : undefined,
-            user: req.user
-                ? { username: req.user.username ?? "", userId: req.user.userId }
-                : undefined,
-            metadata: {
-                resourceName: resource.name,
-                siteIds: siteIds,
-                sshUsername: usernameToUse,
-                sshHost: sshHost
-            },
-            userAgent: req.headers["user-agent"],
-            requestIp: req.ip
-        });
-
-        return response<SignSshKeyResponse>(res, {
-            data: {
-                certificate: cert?.certificate,
-                messageIds: messageIds,
-                messageId: messageIds[0], // just pick the first one for backward compatibility with older olms
-                sshUsername: usernameToUse,
-                sshHost: sshHost, // just pick the first one for backward compatibility with older olms
-                resourceId: normalizedResourceId,
-                siteIds: siteIds,
-                siteId: siteIds[0], // just pick the first one for backward compatibility with older olms
-                keyId: cert?.keyId,
-                authDaemonMode: resource.authDaemonMode,
-                validPrincipals: cert?.validPrincipals,
-                validAfter: cert?.validAfter.toISOString(),
-                validBefore: cert?.validBefore.toISOString(),
-                expiresIn
-            },
-            success: true,
-            error: false,
-            message: "SSH key signed successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error("Error signing SSH key:", error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "An error occurred while signing the SSH key"
-            )
-        );
-    }
-}

server/private/routers/ws/messageHandlers.ts

@@ -13,22 +13,15 @@
 
 import {
     handleRemoteExitNodeRegisterMessage,
-    handleRemoteExitNodePingMessage,
-    startRemoteExitNodeOfflineChecker,
-    startExitNodeReconnectScheduler
+    handleRemoteExitNodePingMessage
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
-import { build } from "@server/build";
-import { handleConnectionLogMessage, handleRequestLogMessage } from "#private/routers/newt";
+import {
+    handleConnectionLogMessage,
+} from "#private/routers/newt";
 
 export const messageHandlers: Record<string, MessageHandler> = {
     "remoteExitNode/register": handleRemoteExitNodeRegisterMessage,
     "remoteExitNode/ping": handleRemoteExitNodePingMessage,
     "newt/access-log": handleConnectionLogMessage,
-    "newt/request-log": handleRequestLogMessage,
-};
-
-if (build != "saas") {
-    startRemoteExitNodeOfflineChecker(); // this is to handle the offline check for remote exit nodes
-    startExitNodeReconnectScheduler(); // check pending exit node reconnects and notify newts
-}
+;

server/private/routers/ws/ws.ts

@@ -139,7 +139,7 @@ const processMessage = async (
             }
         }
     } catch (error) {
-        logger.error("Message handling error:", error);
+        logger.warn("Message handling error:", error);
         // ws.send(JSON.stringify({
         //     type: "error",
         //     data: {