Bump node in the docker-dependencies group across 1 directory

Bumps the docker-dependencies group with 1 update in the / directory: node. Updates `node` from 24-alpine to 26-alpine --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine dependency-type: direct:production dependency-group: docker-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3450 from fosrl/dev
2026-07-16 18:46:35 +02:00 · 2026-07-16 01:33:01 +00:00 · 2026-07-15 20:55:40 -04:00 · 2026-07-15 20:54:40 -04:00 · 2026-07-15 20:54:17 -04:00 · 2026-07-15 20:54:15 -04:00
91 changed files with 1908 additions and 346 deletions
@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM node:26-alpine

 WORKDIR /app

@@ -41,7 +41,7 @@
    </strong>
 </p>

-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure, seamless connectivity to private and public resources. Pangolin combines reverse proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to any private resources with NAT traversal, all with granular access controls.
+Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.

 ## Installation

@@ -63,11 +63,26 @@ Pangolin is an open-source, identity-based remote access platform built on WireG

 Pangolin's site connectors provide gateways into networks so you can access any networked resources. Sites use outbound tunnels and intelligent NAT traversal to make networks behind restrictive firewalls available for authorized access without public IPs or open ports. Easily deploy a site as a binary or container on any platform.

+* Lightweight user-space connector runs anywhere
+* Punches through any firewall
+* Doesn't require open ports or a public IP
+* Strict network segmentation
+* WireGuard-based
+* Get alerts when a device or network resource goes down
+
 <img src="public/screenshots/sites.png" alt="Sites" width="100%" />

 ### Browser-based reverse proxy access

-Expose web applications through identity and context-aware tunneled reverse proxies. Users access applications through any web browser with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+Expose HTTPS web applications and connect to VNC, RDP, and SSH entirely in the browser through identity and context-aware tunneled reverse proxies. Users access resources with authentication and granular access control without installing a client. Pangolin handles routing, load balancing, health checking, and automatic SSL certificates without exposing your network directly to the internet.
+
+* Expose a web panel anywhere
+* Access via any web browser
+* Single sign-on across all resources
+* HTTPS resources
+* Remote desktop in the browser with VNC and RDP
+* In-browser SSH terminal with privileged access management (PAM)
+* PIN codes, passcodes, email OTP, geoblocking, allow-lists, and more

 <img src="public/clip.gif" alt="Reverse proxy access" width="100%" />

@@ -75,14 +90,35 @@ Expose web applications through identity and context-aware tunneled reverse prox

 Access private resources like SSH servers, databases, RDP, and entire network ranges through Pangolin clients. Intelligent NAT traversal enables connections even through restrictive firewalls, while DNS aliases provide friendly names and fast connections to resources across all your sites. Add redundancy by routing traffic through multiple connectors in your network.

+* Peer-to-peer with intelligent NAT traversal
+* Hosts/IPs and port ranges
+* Network ranges/CIDRs
+* Friendly DNS aliases for network addresses
+* Privileged access management (PAM) with SSH resources
+* Private HTTPS resources only accessible on the private network
+
 <img src="public/screenshots/private-resources.png" alt="Private resources" width="100%" />

 ### Give users and roles access to resources

-Use Pangolin's built in users or bring your own identity provider and set up role based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+Use Pangolin's built-in users or bring your own identity provider and set up role-based access control (RBAC). Grant users access to specific resources, not entire networks. Unlike traditional VPNs that expose full network access, Pangolin's zero-trust model ensures users can only reach the applications, services, and routes you explicitly define.
+
+* Bring your existing identity provider (IdP) or use Pangolin identities
+* Sync users and roles from your IdP
+* User- and role-based access control
+* Full network audit and access logs

 <img src="public/screenshots/users.png" alt="Users from identity provider with roles" width="100%" />

+### Find and launch resources from a personalized home page
+
+Give users a landing page to quickly find and open the resources they can access. Resources are grouped by site or label, searchable, and filterable, with grid or list views. Saved views capture filters, grouping, and layout as personal or organization-wide defaults.
+
+* Single place for admins and non-admins to see accessible resources
+* Create reusable views for common access patterns
+
+<img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+
 ## Download Clients

 Download the Pangolin client for your platform:
@@ -449,8 +449,14 @@
    "provisioningManage": "Осигуряване",
    "provisioningDescription": "Управление на ключовете за осигуряване и преглед на чаканещите сайтове за одобрение.",
    "pendingSites": "Чаканещи сайтове",
-    "siteApproveSuccess": "Сайтът е одобрен успешно",
+    "siteApproveSuccess": "Сайтът и свързаните ресурси са одобрени успешно",
    "siteApproveError": "Грешка при одобряването на сайта",
+    "siteReject": "Отказ на сайт",
+    "siteQuestionReject": "Сигурни ли сте, че искате да откажете този сайт?",
+    "siteMessageReject": "Това ще изтрие окончателно сайта и всички свързани ресурси, които все още са на изчакване.",
+    "siteConfirmReject": "Потвърдете отказ на сайт",
+    "siteRejectSuccess": "Сайтът беше успешно отхвърлен",
+    "siteRejectError": "Грешка при отхвърляне на сайта",
    "provisioningKeys": "Ключове за осигуряване",
    "searchProvisioningKeys": "Търсене на ключове за осигуряване...",
    "provisioningKeysAdd": "Генериране на ключ за осигуряване",
@@ -466,8 +472,8 @@
    "provisioningKeysSave": "Запазете ключа за осигуряване",
    "provisioningKeysSaveDescription": "Ще можете да видите това само веднъж. Копирайте го на сигурно място.",
    "provisioningKeysErrorCreate": "Грешка при създаване на ключ за осигуряване",
-    "provisioningKeysList": "Нов ключ за осигуряване",
-    "provisioningKeysMaxBatchSize": "Максимален размер на пакет",
+    "provisioningKeysList": "Нов ключ за разпределяне",
+    "provisioningKeysMaxBatchSize": "Максимален размер на пакета",
    "provisioningKeysUnlimitedBatchSize": "Неограничен размер на партида (без лимит)",
    "provisioningKeysMaxBatchUnlimited": "Неограничено",
    "provisioningKeysMaxBatchSizeInvalid": "Въведете валиден максимален размер на партида (1–1,000,000).",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Никога",
    "provisioningKeysEdit": "Редактиране на ключ за осигуряване",
    "provisioningKeysEditDescription": "Актуализирайте максималния размер на партида и времето на изтичане за този ключ.",
-    "provisioningKeysApproveNewSites": "Одобрете нови сайтове",
+    "provisioningKeysApproveNewSites": "Одобряване на нови сайтове",
    "provisioningKeysApproveNewSitesDescription": "Автоматично одобряване на сайтове, които се регистрират с този ключ.",
    "provisioningKeysUpdateError": "Грешка при актуализирането на ключа за осигуряване",
    "provisioningKeysUpdated": "Ключът за осигуряване е актуализиран",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Създаване на Организационна Потребител",
    "actionUpdateOrg": "Актуализиране на организацията",
    "actionRemoveInvitation": "Премахване на поканата.",
+    "actionRemoveUserRole": "Премахване на роля на потребител",
    "actionUpdateUser": "Актуализиране на потребител",
    "actionGetUser": "Получаване на потребител",
    "actionGetOrgUser": "Вземете потребител на организация",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Въведете конфигурационния токен от сървърната конзола.",
    "setupTokenRequired": "Необходим е конфигурационен токен",
    "actionUpdateSite": "Актуализиране на сайт",
+    "actionApproveSite": "Одобряване на сайт",
+    "actionRejectSite": "Отказ на сайт",
    "actionResetSiteBandwidth": "Нулиране на честотната лента на организацията",
    "actionListSiteRoles": "Изброяване на позволените роли за сайта",
    "actionCreateResource": "Създаване на ресурс",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Генериране на токен за достъп",
    "actionDeleteAccessToken": "Изтриване на токен за достъп",
    "actionListAccessTokens": "Изброяване на токени за достъп",
+    "actionCreateResourceSessionToken": "Създаване на токен за сесия на ресурс",
    "actionCreateResourceRule": "Създаване на правило за ресурс",
    "actionDeleteResourceRule": "Изтрийте правило за ресурс",
    "actionListResourceRules": "Изброяване на правила за ресурс",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Въведете кода от приложението за удостоверяване или един от вашите резервни кодове за еднократна употреба.",
    "otpAuthSubmit": "Изпрати код",
    "idpContinue": "Или продължете със",
+    "idpLastUsed": "Последно използвано",
    "otpAuthBack": "Назад към парола",
    "navbar": "Навигационно меню",
    "navbarDescription": "Главно навигационно меню за приложението",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Затвори",
    "createInternalResourceDialogCreateClientResource": "Създаване на частен ресурс",
    "createInternalResourceDialogCreateClientResourceDescription": "Създайте нов ресурс, който ще бъде достъпен само за клиенти, свързани към организацията",
+    "privateResourceGeneralDescription": "Конфигурирайте името, идентификатора и другите общи настройки на ресурса.",
    "privateResourceCreatePageSeeAll": "Вижте всички частни ресурси",
    "privateResourceAllowIcmpPing": "Разрешете ICMP Ping",
    "privateResourceNetworkAccess": "Достъп до мрежата",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Добавяне на потребители.",
    "editInternalResourceDialogAddClients": "Добавяне на клиенти.",
    "editInternalResourceDialogDestinationLabel": "Дестинация.",
-    "editInternalResourceDialogDestinationDescription": "Изберете къде работи този ресурс и как клиентите го достигат",
+    "editInternalResourceDialogDestinationDescription": "Конфигурирайте как клиентите да достигнат до този ресурс.",
    "internalResourceFormMultiSiteRoutingHelp": "Избирайки няколко сайта, се осигурява сигурен път и пренасочване при висока достъпност.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Научете повече",
    "editInternalResourceDialogPortRestrictionsDescription": "Ограничете достъпа до конкретни TCP/UDP портове или позволете/блокирайте всички портове.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Zajištění",
    "provisioningDescription": "Spravovat klíče pro nastavení a zkontrolovat čekající stránky čekající na schválení.",
    "pendingSites": "Nevyřízené weby",
-    "siteApproveSuccess": "Web byl úspěšně schválen",
+    "siteApproveSuccess": "Stránka a přidružené zdroje byly úspěšně schváleny",
    "siteApproveError": "Chyba při schvalování webu",
+    "siteReject": "Odmítnout stránku",
+    "siteQuestionReject": "Opravdu chcete tuto stránku odmítnout?",
+    "siteMessageReject": "Toto trvale odstraní stránku a všechny přidružené zdroje, které jsou stále nevyřízené.",
+    "siteConfirmReject": "Potvrdit odmítnutí stránky",
+    "siteRejectSuccess": "Stránka byla úspěšně odmítnuta",
+    "siteRejectError": "Chyba při odmítání stránky",
    "provisioningKeys": "Poskytovací klíče",
    "searchProvisioningKeys": "Hledat klíče k zajišťování...",
    "provisioningKeysAdd": "Generovat zajišťovací klíč",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Uložit konfigurační klíč",
    "provisioningKeysSaveDescription": "Toto můžete vidět pouze jednou. Zkopírujte ho na bezpečné místo.",
    "provisioningKeysErrorCreate": "Chyba při vytváření doplňovacího klíče",
-    "provisioningKeysList": "Nový klíč pro poskytování informací",
+    "provisioningKeysList": "Nový provisioning klíč",
    "provisioningKeysMaxBatchSize": "Maximální velikost dávky",
    "provisioningKeysUnlimitedBatchSize": "Neomezená velikost šarže (bez omezení)",
    "provisioningKeysMaxBatchUnlimited": "Bez omezení",
    "provisioningKeysMaxBatchSizeInvalid": "Zadejte platnou maximální velikost šarže (1–1,000,000).",
-    "provisioningKeysValidUntil": "Platné do",
+    "provisioningKeysValidUntil": "Platná do",
    "provisioningKeysValidUntilHint": "Ponechte prázdné, pokud vyprší platnost.",
    "provisioningKeysValidUntilInvalid": "Zadejte platné datum a čas.",
    "provisioningKeysNumUsed": "Časy použití",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Vytvořit Org uživatele",
    "actionUpdateOrg": "Aktualizovat organizaci",
    "actionRemoveInvitation": "Odstranit pozvání",
+    "actionRemoveUserRole": "Odstranit uživatelskou roli",
    "actionUpdateUser": "Aktualizovat uživatele",
    "actionGetUser": "Získat uživatele",
    "actionGetOrgUser": "Získat uživatele organizace",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Zadejte nastavovací token z konzole serveru.",
    "setupTokenRequired": "Je vyžadován token nastavení",
    "actionUpdateSite": "Aktualizovat stránku",
+    "actionApproveSite": "Schválit stránku",
+    "actionRejectSite": "Odmítnout stránku",
    "actionResetSiteBandwidth": "Resetovat šířku pásma organizace",
    "actionListSiteRoles": "Seznam povolených rolí webu",
    "actionCreateResource": "Vytvořit zdroj",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Generovat přístupový token",
    "actionDeleteAccessToken": "Odstranit přístupový token",
    "actionListAccessTokens": "Seznam přístupových tokenů",
+    "actionCreateResourceSessionToken": "Vytvořit token relace prostředku",
    "actionCreateResourceRule": "Vytvořit pravidlo pro zdroj",
    "actionDeleteResourceRule": "Odstranit pravidlo pro dokument",
    "actionListResourceRules": "Seznam pravidel zdrojů",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Zadejte kód z vaší autentizační aplikace nebo jeden z vlastních záložních kódů.",
    "otpAuthSubmit": "Odeslat kód",
    "idpContinue": "Nebo pokračovat s",
+    "idpLastUsed": "Naposled použito",
    "otpAuthBack": "Zpět na heslo",
    "navbar": "Navigation Menu",
    "navbarDescription": "Hlavní navigační menu aplikace",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Zavřít",
    "createInternalResourceDialogCreateClientResource": "Vytvořit soukromý zdroj",
    "createInternalResourceDialogCreateClientResourceDescription": "Vytvořte nový zdroj, který bude přístupný pouze klientům připojeným k organizaci",
+    "privateResourceGeneralDescription": "Nastavte název, identifikátor a další obecná nastavení zdroje.",
    "privateResourceCreatePageSeeAll": "Zobrazit všechny privátní zdroje",
    "privateResourceAllowIcmpPing": "Povolit ICMP ping",
    "privateResourceNetworkAccess": "Přístup k síti",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Přidat uživatele",
    "editInternalResourceDialogAddClients": "Přidat klienty",
    "editInternalResourceDialogDestinationLabel": "Cíl",
-    "editInternalResourceDialogDestinationDescription": "Vyberte, kde bude tento zdroj spuštěn a jak ho klienti dosáhnou",
+    "editInternalResourceDialogDestinationDescription": "Nakonfigurujte, jak klienti dosáhnou tohoto zdroje.",
    "internalResourceFormMultiSiteRoutingHelp": "Výběrem více webů se povolí odolné směrování a přepojení pro vysokou dostupnost.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Zjistit více",
    "editInternalResourceDialogPortRestrictionsDescription": "Omezte přístup na specifické TCP/UDP porty nebo povolte/blokujte všechny porty.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Provisionering",
    "provisioningDescription": "Administrer provisioneringsnøgler og gennemgå ventende sites som venter på godkendelse.",
    "pendingSites": "Ventende sites",
-    "siteApproveSuccess": "Med succes godkendelse af site",
+    "siteApproveSuccess": "Site og tilknyttede ressourcer godkendt med succes",
    "siteApproveError": "Fejl ved godkendelse af side",
+    "siteReject": "Afvis Site",
+    "siteQuestionReject": "Er du sikker på, at du vil afvise dette site?",
+    "siteMessageReject": "Dette vil permanent slette sitet og enhver tilknyttet ressource, der stadig er i afventning.",
+    "siteConfirmReject": "Bekræft Afvis Site",
+    "siteRejectSuccess": "Site afvist med succes",
+    "siteRejectError": "Fejl ved afvisning af sitet",
    "provisioningKeys": "Provisioneringsnøgler",
    "searchProvisioningKeys": "Søg varer i provisioneringsnøgler...",
    "provisioningKeysAdd": "Generer provisioneringsnøgle",
@@ -467,7 +473,7 @@
    "provisioningKeysSaveDescription": "Du kan kun se denne én gang. Kopiér det til et sikkert sted.",
    "provisioningKeysErrorCreate": "Fejl under oprettelse af provisioneringsnøgle",
    "provisioningKeysList": "Ny provisioneringsnøgle",
-    "provisioningKeysMaxBatchSize": "Maks størrelse på bunt",
+    "provisioningKeysMaxBatchSize": "Maksimum Batch Størrelse",
    "provisioningKeysUnlimitedBatchSize": "Ubegrænset mengde bunt (ingen begrænsning)",
    "provisioningKeysMaxBatchUnlimited": "Ubegrænset",
    "provisioningKeysMaxBatchSizeInvalid": "Angiv en gyldig sjakkstørrelse (1–1 000.000).",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Opret organisationsbruger",
    "actionUpdateOrg": "Opdater organisation",
    "actionRemoveInvitation": "Fjern invitation",
+    "actionRemoveUserRole": "Fjern Brugers Rolle",
    "actionUpdateUser": "Opdater bruger",
    "actionGetUser": "Hent bruger",
    "actionGetOrgUser": "Hent organisationsbruger",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Indtast opsætningstoken fra serverkonsollen.",
    "setupTokenRequired": "Opsætningstoken er nødvendig",
    "actionUpdateSite": "Opdater site",
+    "actionApproveSite": "Godkend Site",
+    "actionRejectSite": "Afvis Site",
    "actionResetSiteBandwidth": "Nulstil organisationsbåndbredde",
    "actionListSiteRoles": "Vis tilladte områderoller",
    "actionCreateResource": "Opret ressource",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Generer adgangstoken",
    "actionDeleteAccessToken": "Slet adgangstoken",
    "actionListAccessTokens": "Vis adgangstokens",
+    "actionCreateResourceSessionToken": "Opret ressourcessession token",
    "actionCreateResourceRule": "Opret ressourceregel",
    "actionDeleteResourceRule": "Slet ressourceregel",
    "actionListResourceRules": "Vis ressourceregler",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Indtast koden fra autentiseringsappen din eller en af dine engangs reservekoder.",
    "otpAuthSubmit": "Send kode",
    "idpContinue": "Eller fortsæt med",
+    "idpLastUsed": "Sidst brugt",
    "otpAuthBack": "Tilbage til adgangskode",
    "navbar": "Navigationsmenu",
    "navbarDescription": "Hovednavigasjonsmeny for applikationen",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Luk",
    "createInternalResourceDialogCreateClientResource": "Opret privat ressource",
    "createInternalResourceDialogCreateClientResourceDescription": "Opret en ny ressource som kun vil være tilgængelig for kunder som er forbundet til organisationen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren, og andre generelle indstillinger for ressourcen.",
    "privateResourceCreatePageSeeAll": "Se alle private ressourcer",
    "privateResourceAllowIcmpPing": "Tillad ICMP-ping",
    "privateResourceNetworkAccess": "Netværksadgang",
@@ -2546,7 +2558,7 @@
    "noRemoteExitNodesAvailableDescription": "Ingen noder er tilgængelige for denne organisation. Opret en node først for at bruge lokale sites.",
    "exitNode": "Exitnode",
    "country": "Land",
-    "countryIsNot": "Country Is Not",
+    "countryIsNot": "Land er ikke",
    "rulesMatchCountry": "I øjeblikket baseret på kilde-IP",
    "region": "Fylke",
    "selectRegion": "Vælg region",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Tilføj brugere",
    "editInternalResourceDialogAddClients": "Tilføj klienter",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får adgang til denne ressource.",
    "internalResourceFormMultiSiteRoutingHelp": "Valg af flere sites muliggør robust routing og failover for høj tilgængelighed.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Læs mere",
    "editInternalResourceDialogPortRestrictionsDescription": "Begrens adgang til specifikke TCP/UDP-porte eller tillade/blokere alle porte.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Bereitstellung",
    "provisioningDescription": "Bereitstellungsschlüssel verwalten und ausstehende Standorte prüfen, die noch auf Genehmigung warten.",
    "pendingSites": "Ausstehende Standorte",
-    "siteApproveSuccess": "Standort erfolgreich freigegeben",
+    "siteApproveSuccess": "Site und zugehörige Ressourcen erfolgreich genehmigt",
    "siteApproveError": "Fehler beim Genehmigen des Standorts",
+    "siteReject": "Site ablehnen",
+    "siteQuestionReject": "Sind Sie sicher, dass Sie diese Site ablehnen möchten?",
+    "siteMessageReject": "Dies wird die Site und alle damit verbundenen, noch ausstehenden Ressourcen dauerhaft löschen.",
+    "siteConfirmReject": "Ablehnung der Site bestätigen",
+    "siteRejectSuccess": "Site erfolgreich abgelehnt",
+    "siteRejectError": "Fehler beim Ablehnen der Site",
    "provisioningKeys": "Bereitstellungsschlüssel",
    "searchProvisioningKeys": "Bereitstellungsschlüssel suchen...",
    "provisioningKeysAdd": "Bereitstellungsschlüssel generieren",
@@ -467,7 +473,7 @@
    "provisioningKeysSaveDescription": "Sie können dies nur einmal sehen. Kopieren Sie es an einen sicheren Ort.",
    "provisioningKeysErrorCreate": "Fehler beim Erstellen des Bereitstellungsschlüssels",
    "provisioningKeysList": "Neuer Bereitstellungsschlüssel",
-    "provisioningKeysMaxBatchSize": "Max. Batch-Größe",
+    "provisioningKeysMaxBatchSize": "Maximale Batch-Größe",
    "provisioningKeysUnlimitedBatchSize": "Unbegrenzte Batch-Größe (kein Limit)",
    "provisioningKeysMaxBatchUnlimited": "Unbegrenzt",
    "provisioningKeysMaxBatchSizeInvalid": "Geben Sie eine gültige maximale Batchgröße ein (1–1.000.000).",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Nie",
    "provisioningKeysEdit": "Bereitstellungsschlüssel bearbeiten",
    "provisioningKeysEditDescription": "Aktualisieren Sie die maximale Batch-Größe und Ablaufzeit für diesen Schlüssel.",
-    "provisioningKeysApproveNewSites": "Neuen Standort genehmigen",
+    "provisioningKeysApproveNewSites": "Neue Sites genehmigen",
    "provisioningKeysApproveNewSitesDescription": "Sites, die sich mit diesem Schlüssel registrieren, automatisch freigeben.",
    "provisioningKeysUpdateError": "Fehler beim Aktualisieren des Bereitstellungsschlüssels",
    "provisioningKeysUpdated": "Bereitstellungsschlüssel aktualisiert",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Org Benutzer erstellen",
    "actionUpdateOrg": "Organisation aktualisieren",
    "actionRemoveInvitation": "Einladung entfernen",
+    "actionRemoveUserRole": "Benutzerrolle entfernen",
    "actionUpdateUser": "Benutzer aktualisieren",
    "actionGetUser": "Benutzer abrufen",
    "actionGetOrgUser": "Organisationsbenutzer abrufen",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Geben Sie das Setup-Token von der Serverkonsole ein.",
    "setupTokenRequired": "Setup-Token ist erforderlich",
    "actionUpdateSite": "Standorte aktualisieren",
+    "actionApproveSite": "Site genehmigen",
+    "actionRejectSite": "Site ablehnen",
    "actionResetSiteBandwidth": "Organisations-Bandbreite zurücksetzen",
    "actionListSiteRoles": "Erlaubte Standort-Rollen auflisten",
    "actionCreateResource": "Ressource erstellen",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Zugriffstoken generieren",
    "actionDeleteAccessToken": "Zugriffstoken löschen",
    "actionListAccessTokens": "Zugriffstoken auflisten",
+    "actionCreateResourceSessionToken": "Ressourcensitzungstoken erstellen",
    "actionCreateResourceRule": "Ressourcenregel erstellen",
    "actionDeleteResourceRule": "Ressourcenregel löschen",
    "actionListResourceRules": "Ressourcenregeln auflisten",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Geben Sie den Code aus Ihrer Authenticator-App oder einen Ihrer einmaligen Backup-Codes ein.",
    "otpAuthSubmit": "Code absenden",
    "idpContinue": "Oder weiter mit",
+    "idpLastUsed": "Zuletzt verwendet",
    "otpAuthBack": "Zurück zum Passwort",
    "navbar": "Navigationsmenü",
    "navbarDescription": "Hauptnavigationsmenü für die Anwendung",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Schließen",
    "createInternalResourceDialogCreateClientResource": "Private Ressource erstellen",
    "createInternalResourceDialogCreateClientResourceDescription": "Erstelle eine neue Ressource, die nur für Clients zugänglich ist, die mit der Organisation verbunden sind",
+    "privateResourceGeneralDescription": "Konfigurieren Sie den Namen, die Kennung und andere allgemeine Ressourceneinstellungen.",
    "privateResourceCreatePageSeeAll": "Alle privaten Ressourcen anzeigen",
    "privateResourceAllowIcmpPing": "ICMP-Ping zulassen",
    "privateResourceNetworkAccess": "Netzwerkzugriff",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Nutzer hinzufügen",
    "editInternalResourceDialogAddClients": "Clients hinzufügen",
    "editInternalResourceDialogDestinationLabel": "Ziel",
-    "editInternalResourceDialogDestinationDescription": "Wählen Sie aus, wo diese Ressource läuft und wie Clients darauf zugreifen können",
+    "editInternalResourceDialogDestinationDescription": "Konfigurieren Sie, wie Clients diese Ressource erreichen.",
    "internalResourceFormMultiSiteRoutingHelp": "Durch die Auswahl mehrerer Seiten wird ein ausfallsicheres Routing und Failover für hohe Verfügbarkeit ermöglicht.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Mehr erfahren",
    "editInternalResourceDialogPortRestrictionsDescription": "Den Zugriff auf bestimmte TCP/UDP-Ports beschränken oder alle Ports erlauben/blockieren.",
@@ -3679,7 +3691,7 @@
    "resourceLauncherSaveForEveryoneDescription": "Teilen Sie diese Ansicht mit allen Organisationsmitgliedern. Wenn nicht aktiviert, ist die Ansicht nur für Sie sichtbar.",
    "resourceLauncherMakePersonal": "Persönlich machen",
    "resourceLauncherFilter": "Filter",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Filter, {count} angewendet",
    "resourceLauncherSort": "Sortieren",
    "resourceLauncherSortAscending": "Aufsteigend sortieren",
    "resourceLauncherSortDescending": "Absteigend sortieren",
@@ -449,8 +449,14 @@
    "provisioningManage": "Provisioning",
    "provisioningDescription": "Manage provisioning keys and review pending sites awaiting approval.",
    "pendingSites": "Pending Sites",
-    "siteApproveSuccess": "Site approved successfully",
+    "siteApproveSuccess": "Site and associated resources approved successfully",
    "siteApproveError": "Error approving site",
+    "siteReject": "Reject Site",
+    "siteQuestionReject": "Are you sure you want to reject this site?",
+    "siteMessageReject": "This will permanently delete the site and any associated resources that are still pending.",
+    "siteConfirmReject": "Confirm Reject Site",
+    "siteRejectSuccess": "Site rejected successfully",
+    "siteRejectError": "Error rejecting site",
    "provisioningKeys": "Provisioning Keys",
    "searchProvisioningKeys": "Search provisioning keys...",
    "provisioningKeysAdd": "Generate Provisioning Key",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Save the provisioning key",
    "provisioningKeysSaveDescription": "You will only be able to see this once. Copy it to a secure place.",
    "provisioningKeysErrorCreate": "Error creating provisioning key",
-    "provisioningKeysList": "New provisioning key",
-    "provisioningKeysMaxBatchSize": "Max batch size",
+    "provisioningKeysList": "New Provisioning Key",
+    "provisioningKeysMaxBatchSize": "Max Batch Size",
    "provisioningKeysUnlimitedBatchSize": "Unlimited batch size (no limit)",
    "provisioningKeysMaxBatchUnlimited": "Unlimited",
    "provisioningKeysMaxBatchSizeInvalid": "Enter a valid max batch size (1–1,000,000).",
-    "provisioningKeysValidUntil": "Valid until",
+    "provisioningKeysValidUntil": "Valid Until",
    "provisioningKeysValidUntilHint": "Leave empty for no expiration.",
    "provisioningKeysValidUntilInvalid": "Enter a valid date and time.",
    "provisioningKeysNumUsed": "Times used",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Never",
    "provisioningKeysEdit": "Edit Provisioning Key",
    "provisioningKeysEditDescription": "Update the max batch size and expiration time for this key.",
-    "provisioningKeysApproveNewSites": "Approve new sites",
+    "provisioningKeysApproveNewSites": "Approve New Sites",
    "provisioningKeysApproveNewSitesDescription": "Automatically approve sites that register with this key.",
    "provisioningKeysUpdateError": "Error updating provisioning key",
    "provisioningKeysUpdated": "Provisioning key updated",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Create Org User",
    "actionUpdateOrg": "Update Organization",
    "actionRemoveInvitation": "Remove Invitation",
+    "actionRemoveUserRole": "Remove User Role",
    "actionUpdateUser": "Update User",
    "actionGetUser": "Get User",
    "actionGetOrgUser": "Get Organization User",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Enter the setup token from the server console.",
    "setupTokenRequired": "Setup token is required",
    "actionUpdateSite": "Update Site",
+    "actionApproveSite": "Approve Site",
+    "actionRejectSite": "Reject Site",
    "actionResetSiteBandwidth": "Reset Organization Bandwidth",
    "actionListSiteRoles": "List Allowed Site Roles",
    "actionCreateResource": "Create Resource",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Generate Access Token",
    "actionDeleteAccessToken": "Delete Access Token",
    "actionListAccessTokens": "List Access Tokens",
+    "actionCreateResourceSessionToken": "Create Resource Session Token",
    "actionCreateResourceRule": "Create Resource Rule",
    "actionDeleteResourceRule": "Delete Resource Rule",
    "actionListResourceRules": "List Resource Rules",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Enter the code from your authenticator app or one of your single-use backup codes.",
    "otpAuthSubmit": "Submit Code",
    "idpContinue": "Or continue with",
+    "idpLastUsed": "Last Used",
    "otpAuthBack": "Back to Password",
    "navbar": "Navigation Menu",
    "navbarDescription": "Main navigation menu for the application",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Close",
    "createInternalResourceDialogCreateClientResource": "Create Private Resource",
    "createInternalResourceDialogCreateClientResourceDescription": "Create a new resource that will only be accessible to clients connected to the organization",
+    "privateResourceGeneralDescription": "Configure the name, identifier, and other general resource settings.",
    "privateResourceCreatePageSeeAll": "See All Private Resources",
    "privateResourceAllowIcmpPing": "Allow ICMP Ping",
    "privateResourceNetworkAccess": "Network Access",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Add Users",
    "editInternalResourceDialogAddClients": "Add Clients",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choose where this resource runs and how clients reach it",
+    "editInternalResourceDialogDestinationDescription": "Configure how clients reach this resource.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecting multiple sites enables resilient routing and failover for high availability.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Learn more",
    "editInternalResourceDialogPortRestrictionsDescription": "Restrict access to specific TCP/UDP ports or allow/block all ports.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Aprovisionamiento",
    "provisioningDescription": "Administrar las claves de aprovisionamiento y revisar los sitios pendientes de aprobación.",
    "pendingSites": "Sitios pendientes",
-    "siteApproveSuccess": "Sitio aprobado con éxito",
+    "siteApproveSuccess": "Sitio y recursos asociados aprobados correctamente",
    "siteApproveError": "Error al aprobar el sitio",
+    "siteReject": "Rechazar Sitio",
+    "siteQuestionReject": "¿Está seguro de que desea rechazar este sitio?",
+    "siteMessageReject": "Esto eliminará permanentemente el sitio y cualquier recurso asociado que aún esté pendiente.",
+    "siteConfirmReject": "Confirmar Rechazo del Sitio",
+    "siteRejectSuccess": "Sitio rechazado correctamente",
+    "siteRejectError": "Error al rechazar el sitio",
    "provisioningKeys": "Claves de aprovisionamiento",
    "searchProvisioningKeys": "Buscar claves de suministro...",
    "provisioningKeysAdd": "Generar clave de aprovisionamiento",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Guardar la clave de aprovisionamiento",
    "provisioningKeysSaveDescription": "Sólo podrás verlo una vez. Copítalo a un lugar seguro.",
    "provisioningKeysErrorCreate": "Error al crear la clave de provisioning",
-    "provisioningKeysList": "Nueva clave de aprovisionamiento",
-    "provisioningKeysMaxBatchSize": "Tamaño máximo de lote",
+    "provisioningKeysList": "Nueva Clave de Provisión",
+    "provisioningKeysMaxBatchSize": "Tamaño Máximo del Lote",
    "provisioningKeysUnlimitedBatchSize": "Tamaño ilimitado del lote (sin límite)",
    "provisioningKeysMaxBatchUnlimited": "Ilimitado",
    "provisioningKeysMaxBatchSizeInvalid": "Introduzca un tamaño máximo de lote válido (1–1,000,000).",
-    "provisioningKeysValidUntil": "Válido hasta",
+    "provisioningKeysValidUntil": "Válido Hasta",
    "provisioningKeysValidUntilHint": "Dejar vacío para no expirar.",
    "provisioningKeysValidUntilInvalid": "Introduzca una fecha y hora válidas.",
    "provisioningKeysNumUsed": "Tiempos usados",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Nunca",
    "provisioningKeysEdit": "Editar clave de aprovisionamiento",
    "provisioningKeysEditDescription": "Actualizar el tamaño máximo de lote y el tiempo de caducidad para esta clave.",
-    "provisioningKeysApproveNewSites": "Aprobar nuevos sitios",
+    "provisioningKeysApproveNewSites": "Aprobar Nuevos Sitios",
    "provisioningKeysApproveNewSitesDescription": "Aprobar automáticamente los sitios que se registran con esta clave.",
    "provisioningKeysUpdateError": "Error al actualizar la clave de aprovisionamiento",
    "provisioningKeysUpdated": "Clave de aprovisionamiento actualizada",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Crear usuario Org",
    "actionUpdateOrg": "Actualizar organización",
    "actionRemoveInvitation": "Eliminar invitación",
+    "actionRemoveUserRole": "Quitar Rol de Usuario",
    "actionUpdateUser": "Actualizar usuario",
    "actionGetUser": "Obtener usuario",
    "actionGetOrgUser": "Obtener usuario de la organización",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Ingrese el token de configuración desde la consola del servidor.",
    "setupTokenRequired": "Se requiere el token de configuración",
    "actionUpdateSite": "Actualizar sitio",
+    "actionApproveSite": "Aprobar Sitio",
+    "actionRejectSite": "Rechazar Sitio",
    "actionResetSiteBandwidth": "Restablecer ancho de banda de la organización",
    "actionListSiteRoles": "Lista de roles permitidos del sitio",
    "actionCreateResource": "Crear Recurso",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Generar token de acceso",
    "actionDeleteAccessToken": "Eliminar token de acceso",
    "actionListAccessTokens": "Lista de Tokens de Acceso",
+    "actionCreateResourceSessionToken": "Crear Token de Sesión de Recurso",
    "actionCreateResourceRule": "Crear Regla de Recursos",
    "actionDeleteResourceRule": "Eliminar Regla de Recurso",
    "actionListResourceRules": "Lista de Reglas de Recursos",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Introduzca el código de su aplicación de autenticación o uno de sus códigos de copia de seguridad de un solo uso.",
    "otpAuthSubmit": "Enviar código",
    "idpContinue": "O continuar con",
+    "idpLastUsed": "Último Uso",
    "otpAuthBack": "Volver a la contraseña",
    "navbar": "Menú de navegación",
    "navbarDescription": "Menú de navegación principal para la aplicación",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Cerrar",
    "createInternalResourceDialogCreateClientResource": "Crear recurso privado",
    "createInternalResourceDialogCreateClientResourceDescription": "Crear un nuevo recurso que sólo será accesible a los clientes conectados a la organización",
+    "privateResourceGeneralDescription": "Configura el nombre, identificador y otros ajustes generales del recurso.",
    "privateResourceCreatePageSeeAll": "Ver todos los recursos privados",
    "privateResourceAllowIcmpPing": "Permitir ping ICMP",
    "privateResourceNetworkAccess": "Acceso de red",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Agregar usuarios",
    "editInternalResourceDialogAddClients": "Agregar clientes",
    "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Elija dónde se ejecuta este recurso y cómo lo alcanzan los clientes",
+    "editInternalResourceDialogDestinationDescription": "Configura cómo los clientes acceden a este recurso.",
    "internalResourceFormMultiSiteRoutingHelp": "Seleccionar múltiples sitios habilita el enrutamiento resistente y la conmutación por error para alta disponibilidad.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Más información",
    "editInternalResourceDialogPortRestrictionsDescription": "Restringir el acceso a puertos TCP/UDP específicos o permitir/bloquear todos los puertos.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Mise en place",
    "provisioningDescription": "Gérer les clés de provisioning et examiner les sites en attente d'approbation.",
    "pendingSites": "Sites en attente",
-    "siteApproveSuccess": "Site approuvé avec succès",
+    "siteApproveSuccess": "Site et ressources associées approuvés avec succès",
    "siteApproveError": "Erreur lors de l'approbation du site",
+    "siteReject": "Rejeter le site",
+    "siteQuestionReject": "Êtes-vous sûr de vouloir rejeter ce site ?",
+    "siteMessageReject": "Cela supprimera définitivement le site et toutes les ressources associées qui sont encore en attente.",
+    "siteConfirmReject": "Confirmer le rejet du site",
+    "siteRejectSuccess": "Site rejeté avec succès",
+    "siteRejectError": "Erreur lors du rejet du site",
    "provisioningKeys": "Clés de provisionnement",
    "searchProvisioningKeys": "Recherche des clés de provision...",
    "provisioningKeysAdd": "Générer une clé de provisioning",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Enregistrer la clé de provisioning",
    "provisioningKeysSaveDescription": "Vous ne pourrez voir cela qu'une seule fois. Copiez-le dans un endroit sécurisé.",
    "provisioningKeysErrorCreate": "Erreur lors de la création de la clé de provisioning",
-    "provisioningKeysList": "Nouvelle clé de provisioning",
+    "provisioningKeysList": "Nouvelle clé d'approvisionnement",
    "provisioningKeysMaxBatchSize": "Taille maximale du lot",
    "provisioningKeysUnlimitedBatchSize": "Taille de lot illimitée (sans limite)",
    "provisioningKeysMaxBatchUnlimited": "Illimité",
    "provisioningKeysMaxBatchSizeInvalid": "Entrez une taille de lot maximale valide (1–1 000 000).",
-    "provisioningKeysValidUntil": "Valable jusqu'au",
+    "provisioningKeysValidUntil": "Valable jusqu'à",
    "provisioningKeysValidUntilHint": "Laisser vide pour ne pas expirer.",
    "provisioningKeysValidUntilInvalid": "Entrez une date et une heure valides.",
    "provisioningKeysNumUsed": "Nombre de fois utilisées",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Créer un utilisateur Org",
    "actionUpdateOrg": "Mettre à jour l'organisation",
    "actionRemoveInvitation": "Supprimer l'invitation",
+    "actionRemoveUserRole": "Supprimer le rôle d'utilisateur",
    "actionUpdateUser": "Mettre à jour l'utilisateur",
    "actionGetUser": "Obtenir l'utilisateur",
    "actionGetOrgUser": "Obtenir l'utilisateur de l'organisation",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Entrez le jeton de configuration depuis la console du serveur.",
    "setupTokenRequired": "Le jeton de configuration est requis.",
    "actionUpdateSite": "Mettre à jour un site",
+    "actionApproveSite": "Approuver le site",
+    "actionRejectSite": "Rejeter le site",
    "actionResetSiteBandwidth": "Réinitialiser la bande passante de l'organisation",
    "actionListSiteRoles": "Lister les rôles autorisés du site",
    "actionCreateResource": "Créer une ressource",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Générer un jeton d'accès",
    "actionDeleteAccessToken": "Supprimer un jeton d'accès",
    "actionListAccessTokens": "Lister les jetons d'accès",
+    "actionCreateResourceSessionToken": "Créer un jeton de session de ressource",
    "actionCreateResourceRule": "Créer une règle de ressource",
    "actionDeleteResourceRule": "Supprimer une règle de ressource",
    "actionListResourceRules": "Lister les règles de ressource",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Entrez le code de votre application d'authentification ou l'un de vos codes de secours à usage unique.",
    "otpAuthSubmit": "Soumettre le code",
    "idpContinue": "Ou continuer avec",
+    "idpLastUsed": "Dernière utilisation",
    "otpAuthBack": "Retour au mot de passe",
    "navbar": "Menu de navigation",
    "navbarDescription": "Menu de navigation principal de l'application",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Fermer",
    "createInternalResourceDialogCreateClientResource": "Créer une ressource privée",
    "createInternalResourceDialogCreateClientResourceDescription": "Créer une nouvelle ressource qui ne sera accessible qu'aux clients connectés à l'organisation",
+    "privateResourceGeneralDescription": "Configurez le nom, l'identifiant et d'autres paramètres généraux de la ressource.",
    "privateResourceCreatePageSeeAll": "Voir toutes les ressources privées",
    "privateResourceAllowIcmpPing": "Autoriser le ping ICMP",
    "privateResourceNetworkAccess": "Accès au réseau",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Ajouter des utilisateurs",
    "editInternalResourceDialogAddClients": "Ajouter des clients",
    "editInternalResourceDialogDestinationLabel": "Destination",
-    "editInternalResourceDialogDestinationDescription": "Choisissez où cette ressource fonctionne et comment les clients l'atteignent",
+    "editInternalResourceDialogDestinationDescription": "Configurez comment les clients accèdent à cette ressource.",
    "internalResourceFormMultiSiteRoutingHelp": "La sélection de plusieurs sites permet un routage résilient et un basculement pour une haute disponibilité.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "En savoir plus",
    "editInternalResourceDialogPortRestrictionsDescription": "Restreindre l'accès à des ports TCP/UDP spécifiques ou autoriser/bloquer tous les ports.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Accantonamento",
    "provisioningDescription": "Gestire le chiavi di provisioning e rivedere i siti in attesa di approvazione.",
    "pendingSites": "Siti In Attesa",
-    "siteApproveSuccess": "Sito approvato con successo",
+    "siteApproveSuccess": "Sito e risorse associate approvate con successo",
    "siteApproveError": "Errore nell'approvazione del sito",
+    "siteReject": "Rifiuta Sito",
+    "siteQuestionReject": "Sei sicuro di voler rifiutare questo sito?",
+    "siteMessageReject": "Questo eliminerà permanentemente il sito e tutte le risorse associate ancora in sospeso.",
+    "siteConfirmReject": "Conferma Rifiuto Sito",
+    "siteRejectSuccess": "Sito rifiutato con successo",
+    "siteRejectError": "Errore nel rifiutare il sito",
    "provisioningKeys": "Chiavi Di Provvedimento",
    "searchProvisioningKeys": "Cerca le chiavi di provisioning...",
    "provisioningKeysAdd": "Genera Chiave di provisioning",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Salva la chiave di provisioning",
    "provisioningKeysSaveDescription": "Sarai in grado di vedere solo una volta. Copiarlo in un posto sicuro.",
    "provisioningKeysErrorCreate": "Errore nella creazione della chiave di provisioning",
-    "provisioningKeysList": "Nuova chiave di provisioning",
-    "provisioningKeysMaxBatchSize": "Dimensione massima batch",
+    "provisioningKeysList": "Nuova Chiave di Provisioning",
+    "provisioningKeysMaxBatchSize": "Dimensione Massima Batch",
    "provisioningKeysUnlimitedBatchSize": "Dimensione illimitata del batch (nessun limite)",
    "provisioningKeysMaxBatchUnlimited": "Illimitato",
    "provisioningKeysMaxBatchSizeInvalid": "Inserisci una dimensione massima valida del batch (1–1.000.000).",
-    "provisioningKeysValidUntil": "Valido fino al",
+    "provisioningKeysValidUntil": "Valido Fino a",
    "provisioningKeysValidUntilHint": "Lasciare vuoto per nessuna scadenza.",
    "provisioningKeysValidUntilInvalid": "Inserisci una data e ora valide.",
    "provisioningKeysNumUsed": "Volte usate",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Mai",
    "provisioningKeysEdit": "Modifica Chiave di provisioning",
    "provisioningKeysEditDescription": "Aggiorna la dimensione massima del batch e il tempo di scadenza per questa chiave.",
-    "provisioningKeysApproveNewSites": "Approva nuovi siti",
+    "provisioningKeysApproveNewSites": "Approva Nuovi Siti",
    "provisioningKeysApproveNewSitesDescription": "Approvare automaticamente i siti che si registrano con questa chiave.",
    "provisioningKeysUpdateError": "Errore nell'aggiornamento della chiave di provisioning",
    "provisioningKeysUpdated": "Chiave di provisioning aggiornata",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Crea Utente Org",
    "actionUpdateOrg": "Aggiorna Organizzazione",
    "actionRemoveInvitation": "Rimuovi Invito",
+    "actionRemoveUserRole": "Rimuovi Ruolo Utente",
    "actionUpdateUser": "Aggiorna Utente",
    "actionGetUser": "Ottieni Utente",
    "actionGetOrgUser": "Ottieni Utente Organizzazione",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Inserisci il token di configurazione dalla console del server.",
    "setupTokenRequired": "Il token di configurazione è richiesto",
    "actionUpdateSite": "Aggiorna Sito",
+    "actionApproveSite": "Approva Sito",
+    "actionRejectSite": "Rifiuta Sito",
    "actionResetSiteBandwidth": "Reimposta Larghezza Banda Dell'Organizzazione",
    "actionListSiteRoles": "Elenca Ruoli Sito Consentiti",
    "actionCreateResource": "Crea Risorsa",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Genera Token di Accesso",
    "actionDeleteAccessToken": "Elimina Token di Accesso",
    "actionListAccessTokens": "Elenca Token di Accesso",
+    "actionCreateResourceSessionToken": "Crea Token di Sessione della Risorsa",
    "actionCreateResourceRule": "Crea Regola Risorsa",
    "actionDeleteResourceRule": "Elimina Regola Risorsa",
    "actionListResourceRules": "Elenca Regole Risorsa",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Inserisci il codice dalla tua app di autenticazione o uno dei tuoi codici di backup monouso.",
    "otpAuthSubmit": "Invia Codice",
    "idpContinue": "O continua con",
+    "idpLastUsed": "Ultimo Utilizzo",
    "otpAuthBack": "Torna alla Password",
    "navbar": "Menu di Navigazione",
    "navbarDescription": "Menu di navigazione principale dell'applicazione",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Chiudi",
    "createInternalResourceDialogCreateClientResource": "Crea Risorsa Privata",
    "createInternalResourceDialogCreateClientResourceDescription": "Crea una nuova risorsa che sarà accessibile solo ai client connessi all'organizzazione",
+    "privateResourceGeneralDescription": "Configura il nome, l'identificativo e altre impostazioni generali delle risorse.",
    "privateResourceCreatePageSeeAll": "Vedi Tutte le Risorse Private",
    "privateResourceAllowIcmpPing": "Consenti ICMP Ping",
    "privateResourceNetworkAccess": "Accesso alla Rete",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Aggiungi Utenti",
    "editInternalResourceDialogAddClients": "Aggiungi Clienti",
    "editInternalResourceDialogDestinationLabel": "Destinazione",
-    "editInternalResourceDialogDestinationDescription": "Scegli dove eseguire questa risorsa e come i client lo raggiungono",
+    "editInternalResourceDialogDestinationDescription": "Configura come i client raggiungono questa risorsa.",
    "internalResourceFormMultiSiteRoutingHelp": "Selezionare più siti consente un routing resiliente e Failover per alta disponibilità.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Scopri di più",
    "editInternalResourceDialogPortRestrictionsDescription": "Limita l'accesso a porte TCP/UDP specifiche o consenti/blocca tutte le porte.",
@@ -449,8 +449,14 @@
    "provisioningManage": "프로비저닝",
    "provisioningDescription": "프로비저닝 키를 관리하고 승인을 기다리는 사이트를 검토합니다.",
    "pendingSites": "대기중인 사이트",
-    "siteApproveSuccess": "사이트가 성공적으로 승인되었습니다",
+    "siteApproveSuccess": "사이트 및 관련 리소스가 성공적으로 승인되었습니다",
    "siteApproveError": "사이트 승인 오류",
+    "siteReject": "사이트 거부",
+    "siteQuestionReject": "이 사이트를 거부하시겠습니까?",
+    "siteMessageReject": "이렇게 하면 펜딩 중인 사이트 및 관련 리소스가 영구적으로 삭제됩니다.",
+    "siteConfirmReject": "사이트 거부 확인",
+    "siteRejectSuccess": "사이트가 성공적으로 거부되었습니다",
+    "siteRejectError": "사이트 거부 오류",
    "provisioningKeys": "프로비저닝 키",
    "searchProvisioningKeys": "프로비저닝 키 검색...",
    "provisioningKeysAdd": "프로비저닝 키 생성",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "절대",
    "provisioningKeysEdit": "프로비저닝 키 수정",
    "provisioningKeysEditDescription": "이 키의 최대 배치 크기 및 만료 시간을 업데이트하세요.",
-    "provisioningKeysApproveNewSites": "새로운 사이트 승인",
+    "provisioningKeysApproveNewSites": "새 사이트 승인",
    "provisioningKeysApproveNewSitesDescription": "이 키를 등록하는 사이트를 자동으로 승인합니다.",
    "provisioningKeysUpdateError": "프로비저닝 키 업데이트 오류",
    "provisioningKeysUpdated": "프로비저닝 키가 업데이트되었습니다",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "조직 사용자 생성",
    "actionUpdateOrg": "조직 업데이트",
    "actionRemoveInvitation": "초대 제거",
+    "actionRemoveUserRole": "사용자 역할 제거",
    "actionUpdateUser": "사용자 업데이트",
    "actionGetUser": "사용자 조회",
    "actionGetOrgUser": "조직 사용자 가져오기",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "서버 콘솔에서 설정 토큰 입력.",
    "setupTokenRequired": "설정 토큰이 필요합니다",
    "actionUpdateSite": "사이트 업데이트",
+    "actionApproveSite": "사이트 승인",
+    "actionRejectSite": "사이트 거부",
    "actionResetSiteBandwidth": "조직 대역폭 재설정",
    "actionListSiteRoles": "허용된 사이트 역할 목록",
    "actionCreateResource": "리소스 생성",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "액세스 토큰 생성",
    "actionDeleteAccessToken": "액세스 토큰 삭제",
    "actionListAccessTokens": "액세스 토큰 목록",
+    "actionCreateResourceSessionToken": "리소스 세션 토큰 생성",
    "actionCreateResourceRule": "리소스 규칙 생성",
    "actionDeleteResourceRule": "리소스 규칙 삭제",
    "actionListResourceRules": "리소스 규칙 목록",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "인증 앱에서 코드를 입력하거나 단일 사용 백업 코드 중 하나를 입력하세요.",
    "otpAuthSubmit": "코드 제출",
    "idpContinue": "또는 계속 진행하십시오.",
+    "idpLastUsed": "마지막 사용",
    "otpAuthBack": "비밀번호로 돌아가기",
    "navbar": "탐색 메뉴",
    "navbarDescription": "애플리케이션의 주요 탐색 메뉴",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "닫기",
    "createInternalResourceDialogCreateClientResource": "사이트 리소스 생성",
    "createInternalResourceDialogCreateClientResourceDescription": "선택한 사이트에 연결된 클라이언트에 접근할 새 리소스를 생성합니다",
+    "privateResourceGeneralDescription": "이름, 식별자, 기타 일반 리소스 설정을 구성합니다.",
    "privateResourceCreatePageSeeAll": "모든 개인 리소스 보기",
    "privateResourceAllowIcmpPing": "ICMP 핑 허용",
    "privateResourceNetworkAccess": "네트워크 접근",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "사용자 추가",
    "editInternalResourceDialogAddClients": "클라이언트 추가",
    "editInternalResourceDialogDestinationLabel": "대상지",
-    "editInternalResourceDialogDestinationDescription": "이 리소스가 실행되는 위치와 고객이 도달하는 방법 선택",
+    "editInternalResourceDialogDestinationDescription": "클라이언트가 이 리소스에 어떻게 도달하는지 구성합니다.",
    "internalResourceFormMultiSiteRoutingHelp": "다중 사이트를 선택하면 높은 가용성을 위해 회복력 있는 라우팅 및 페일오버가 가능해집니다.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "자세히 알아보기",
    "editInternalResourceDialogPortRestrictionsDescription": "특정 TCP/UDP 포트에 대한 접근을 제한하거나 모든 포트를 허용/차단하십시오.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Levering",
    "provisioningDescription": "Administrer foreløpig nøkler og gjennomgå ventende nettsteder som venter på godkjenning.",
    "pendingSites": "Ventende nettsteder",
-    "siteApproveSuccess": "Vellykket godkjenning av nettsted",
+    "siteApproveSuccess": "Område og tilknyttede ressurser godkjent",
    "siteApproveError": "Feil ved godkjenning av side",
+    "siteReject": "Avvis Område",
+    "siteQuestionReject": "Er du sikker på at du vil avvise dette området?",
+    "siteMessageReject": "Dette vil permanent slette området og eventuelle tilknyttede ressurser som fortsatt venter.",
+    "siteConfirmReject": "Bekreft Avvisning av Område",
+    "siteRejectSuccess": "Område avvist",
+    "siteRejectError": "Feil ved avvisning av området",
    "provisioningKeys": "Foreløpig nøkler",
    "searchProvisioningKeys": "Søk varer i lagrings nøkler...",
    "provisioningKeysAdd": "Generer fremvisende nøkkel",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Lagre den midlertidig nøkkelen",
    "provisioningKeysSaveDescription": "Du kan bare se denne én gang. Kopier det til et sikkert sted.",
    "provisioningKeysErrorCreate": "Feil under oppretting av foreløpig nøkkel",
-    "provisioningKeysList": "Ny provisorisk nøkkel",
-    "provisioningKeysMaxBatchSize": "Maks størrelse på bunt",
+    "provisioningKeysList": "Ny Forsyningsnøkkel",
+    "provisioningKeysMaxBatchSize": "Maks Batch Størrelse",
    "provisioningKeysUnlimitedBatchSize": "Ubegrenset mengde bunt (ingen begrensning)",
    "provisioningKeysMaxBatchUnlimited": "Ubegrenset",
    "provisioningKeysMaxBatchSizeInvalid": "Angi en gyldig sjakkstørrelse (1–1 000.000).",
-    "provisioningKeysValidUntil": "Gyldig til",
+    "provisioningKeysValidUntil": "Gyldig Til",
    "provisioningKeysValidUntilHint": "La stå tomt for ingen utløp.",
    "provisioningKeysValidUntilInvalid": "Angi en gyldig dato og klokkeslett.",
    "provisioningKeysNumUsed": "Antall ganger brukt",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Aldri",
    "provisioningKeysEdit": "Rediger bestemmelsesnøkkel",
    "provisioningKeysEditDescription": "Oppdater maksimal størrelse for bunt og utløpstid for denne nøkkelen.",
-    "provisioningKeysApproveNewSites": "Godkjenn nye nettsteder",
+    "provisioningKeysApproveNewSites": "Godkjenn Nye Områder",
    "provisioningKeysApproveNewSitesDescription": "Godkjenn automatisk nettsteder som registrerer deg med denne nøkkelen.",
    "provisioningKeysUpdateError": "Feil under oppdatering av foreløpig nøkkel",
    "provisioningKeysUpdated": "Foreslå nøkkel oppdatert",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Opprett Org bruker",
    "actionUpdateOrg": "Oppdater organisasjon",
    "actionRemoveInvitation": "Fjern invitasjon",
+    "actionRemoveUserRole": "Fjern Brukerrolle",
    "actionUpdateUser": "Oppdater bruker",
    "actionGetUser": "Hent bruker",
    "actionGetOrgUser": "Hent organisasjonsbruker",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Skriv inn oppsetttoken fra serverkonsollen.",
    "setupTokenRequired": "Oppsetttoken er nødvendig",
    "actionUpdateSite": "Oppdater område",
+    "actionApproveSite": "Godkjenn Område",
+    "actionRejectSite": "Avvis Område",
    "actionResetSiteBandwidth": "Tilbakestill organisasjons-båndbredde",
    "actionListSiteRoles": "List opp tillatte områderoller",
    "actionCreateResource": "Opprett ressurs",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Generer tilgangstoken",
    "actionDeleteAccessToken": "Slett tilgangstoken",
    "actionListAccessTokens": "List opp tilgangstokener",
+    "actionCreateResourceSessionToken": "Opprett ressurs økt-token",
    "actionCreateResourceRule": "Opprett ressursregel",
    "actionDeleteResourceRule": "Slett ressursregel",
    "actionListResourceRules": "List opp ressursregler",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Skriv inn koden fra autentiseringsappen din eller en av dine engangs reservekoder.",
    "otpAuthSubmit": "Send inn kode",
    "idpContinue": "Eller fortsett med",
+    "idpLastUsed": "Sist brukt",
    "otpAuthBack": "Tilbake til passord",
    "navbar": "Navigasjonsmeny",
    "navbarDescription": "Hovednavigasjonsmeny for applikasjonen",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Lukk",
    "createInternalResourceDialogCreateClientResource": "Opprett privat ressurs",
    "createInternalResourceDialogCreateClientResourceDescription": "Opprett en ny ressurs som bare vil være tilgjengelig for kunder som er koblet til organisasjonen",
+    "privateResourceGeneralDescription": "Konfigurer navnet, identifikatoren og andre generelle ressursinnstillinger.",
    "privateResourceCreatePageSeeAll": "Se alle private ressurser",
    "privateResourceAllowIcmpPing": "Tillat ICMP Ping",
    "privateResourceNetworkAccess": "Nettverkstilgang",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Legg til brukere",
    "editInternalResourceDialogAddClients": "Legg til klienter",
    "editInternalResourceDialogDestinationLabel": "Destinasjon",
-    "editInternalResourceDialogDestinationDescription": "Velg hvor denne ressursen kjører og hvordan klienter når den",
+    "editInternalResourceDialogDestinationDescription": "Konfigurer hvordan klienter får tilgang til denne ressursen.",
    "internalResourceFormMultiSiteRoutingHelp": "Valg av flere nettsteder muliggjør motstandskraftig ruting og failover for høy tilgjengelighet.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Lær mer",
    "editInternalResourceDialogPortRestrictionsDescription": "Begrens tilgang til spesifikke TCP/UDP-porter eller tillate/blokkere alle porter.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Provisie",
    "provisioningDescription": "Voorzieningssleutels beheren en sites beoordelen in afwachting van goedkeuring.",
    "pendingSites": "Openstaande sites",
-    "siteApproveSuccess": "Site succesvol goedgekeurd",
+    "siteApproveSuccess": "Site en bijbehorende middelen succesvol goedgekeurd",
    "siteApproveError": "Fout bij goedkeuren website",
+    "siteReject": "Afwijzen Site",
+    "siteQuestionReject": "Weet u zeker dat u deze site wilt afwijzen?",
+    "siteMessageReject": "Hiermee wordt de site en alle bijbehorende middelen die nog in behandeling zijn permanent verwijderd.",
+    "siteConfirmReject": "Afwijzing van site bevestigen",
+    "siteRejectSuccess": "Site succesvol afgewezen",
+    "siteRejectError": "Fout bij het afwijzen van site",
    "provisioningKeys": "Verhelderende sleutels",
    "searchProvisioningKeys": "Zoek provisioningsleutels ...",
    "provisioningKeysAdd": "Genereer Provisioning Sleutel",
@@ -466,7 +472,7 @@
    "provisioningKeysSave": "Sla de provisioning sleutel op",
    "provisioningKeysSaveDescription": "Je kunt dit slechts één keer zien. Kopieer het naar een veilige plaats.",
    "provisioningKeysErrorCreate": "Fout bij aanmaken provisioning sleutel",
-    "provisioningKeysList": "Nieuwe provisioning sleutel",
+    "provisioningKeysList": "Nieuwe provisioning-sleutel",
    "provisioningKeysMaxBatchSize": "Maximale batchgrootte",
    "provisioningKeysUnlimitedBatchSize": "Onbeperkte batchgrootte (geen limiet)",
    "provisioningKeysMaxBatchUnlimited": "Onbeperkt",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Nooit",
    "provisioningKeysEdit": "Wijzig Provisioning Sleutel",
    "provisioningKeysEditDescription": "Werk de maximale batchgrootte en verlooptijd voor deze sleutel bij.",
-    "provisioningKeysApproveNewSites": "Goedkeuren van nieuwe sites",
+    "provisioningKeysApproveNewSites": "Nieuwe sites goedkeuren",
    "provisioningKeysApproveNewSitesDescription": "Automatisch sites goedkeuren die zich registreren met deze sleutel.",
    "provisioningKeysUpdateError": "Fout tijdens bijwerken provisioning sleutel",
    "provisioningKeysUpdated": "Provisie sleutel bijgewerkt",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Org gebruiker aanmaken",
    "actionUpdateOrg": "Organisatie bijwerken",
    "actionRemoveInvitation": "Verwijder uitnodiging",
+    "actionRemoveUserRole": "Gebruikersrol verwijderen",
    "actionUpdateUser": "Gebruiker bijwerken",
    "actionGetUser": "Gebruiker ophalen",
    "actionGetOrgUser": "Krijg organisatie-gebruiker",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Voer het setup-token in vanaf de serverconsole.",
    "setupTokenRequired": "Setup-token is vereist",
    "actionUpdateSite": "Site bijwerken",
+    "actionApproveSite": "Verleen site goedkeuring",
+    "actionRejectSite": "Afwijzen Site",
    "actionResetSiteBandwidth": "Reset organisatieschandbreedte",
    "actionListSiteRoles": "Toon toegestane sitenollen",
    "actionCreateResource": "Bron maken",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Genereer Toegangstoken",
    "actionDeleteAccessToken": "Verwijder toegangstoken",
    "actionListAccessTokens": "Lijst toegangstokens",
+    "actionCreateResourceSessionToken": "Maak Resource Sessie Token",
    "actionCreateResourceRule": "Bronregel aanmaken",
    "actionDeleteResourceRule": "Verwijder Resource Regel",
    "actionListResourceRules": "Bron regels weergeven",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Voer de code van je authenticator-app of een van je reservekopiecodes voor het eenmalig gebruik in.",
    "otpAuthSubmit": "Code indienen",
    "idpContinue": "Of ga verder met",
+    "idpLastUsed": "Laatst gebruikt",
    "otpAuthBack": "Terug naar wachtwoord",
    "navbar": "Navigatiemenu",
    "navbarDescription": "Hoofd navigatie menu voor de applicatie",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Sluiten",
    "createInternalResourceDialogCreateClientResource": "Privé bron maken",
    "createInternalResourceDialogCreateClientResourceDescription": "Maak een nieuwe bron aan die alleen toegankelijk is voor klanten die verbonden zijn met de organisatie",
+    "privateResourceGeneralDescription": "Configureer de naam, identificatie en andere algemene resource-instellingen.",
    "privateResourceCreatePageSeeAll": "Bekijk Alle Privébronnen",
    "privateResourceAllowIcmpPing": "Sta ICMP Ping toe",
    "privateResourceNetworkAccess": "Netwerktoegang",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Gebruikers toevoegen",
    "editInternalResourceDialogAddClients": "Clienten toevoegen",
    "editInternalResourceDialogDestinationLabel": "Bestemming",
-    "editInternalResourceDialogDestinationDescription": "Kies waar deze bron draait en hoe clients deze bereiken",
+    "editInternalResourceDialogDestinationDescription": "Configureer hoe klanten toegang krijgen tot deze resource.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecteren van meerdere sites maakt veerkrachtige routing en failover mogelijk voor hoge beschikbaarheid.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Meer informatie",
    "editInternalResourceDialogPortRestrictionsDescription": "Beperk toegang tot specifieke TCP/UDP-poorten of sta alle poorten toe/blokkeer.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Dostarczanie",
    "provisioningDescription": "Zarządzaj kluczami rezerwacji i sprawdzaj oczekujące strony oczekujące na zatwierdzenie.",
    "pendingSites": "Witryny oczekujące",
-    "siteApproveSuccess": "Witryna została pomyślnie zatwierdzona",
+    "siteApproveSuccess": "Witryna i powiązane zasoby zostały zatwierdzone pomyślnie",
    "siteApproveError": "Błąd zatwierdzania witryny",
+    "siteReject": "Odrzuć witrynę",
+    "siteQuestionReject": "Czy na pewno chcesz odrzucić tę witrynę?",
+    "siteMessageReject": "Spowoduje to trwałe usunięcie witryny i wszelkich powiązanych, nadal oczekujących zasobów.",
+    "siteConfirmReject": "Potwierdź odrzucenie witryny",
+    "siteRejectSuccess": "Witryna została odrzucona pomyślnie",
+    "siteRejectError": "Błąd podczas odrzucania witryny",
    "provisioningKeys": "Klucze Zaopatrzenia",
    "searchProvisioningKeys": "Szukaj kluczy zaopatrzenia...",
    "provisioningKeysAdd": "Wygeneruj klucz zaopatrzenia",
@@ -466,7 +472,7 @@
    "provisioningKeysSave": "Zapisz klucz zaopatrzenia",
    "provisioningKeysSaveDescription": "Możesz to zobaczyć tylko raz. Skopiuj je do bezpiecznego miejsca.",
    "provisioningKeysErrorCreate": "Błąd podczas tworzenia klucza zaopatrzenia",
-    "provisioningKeysList": "Nowy klucz rezerwacji",
+    "provisioningKeysList": "Nowy klucz aprowizacyjny",
    "provisioningKeysMaxBatchSize": "Maksymalny rozmiar partii",
    "provisioningKeysUnlimitedBatchSize": "Nieograniczony rozmiar partii (bez limitu)",
    "provisioningKeysMaxBatchUnlimited": "Nieograniczona",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Utwórz użytkownika Org",
    "actionUpdateOrg": "Aktualizuj organizację",
    "actionRemoveInvitation": "Usuń zaproszenie",
+    "actionRemoveUserRole": "Usuń rolę użytkownika",
    "actionUpdateUser": "Zaktualizuj użytkownika",
    "actionGetUser": "Pobierz użytkownika",
    "actionGetOrgUser": "Pobierz użytkownika organizacji",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Wprowadź token konfiguracji z konsoli serwera.",
    "setupTokenRequired": "Wymagany jest token konfiguracji",
    "actionUpdateSite": "Aktualizuj witrynę",
+    "actionApproveSite": "Zatwierdź witrynę",
+    "actionRejectSite": "Odrzuć witrynę",
    "actionResetSiteBandwidth": "Zresetuj przepustowość organizacji",
    "actionListSiteRoles": "Lista dozwolonych ról witryny",
    "actionCreateResource": "Utwórz zasób",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Wygeneruj token dostępu",
    "actionDeleteAccessToken": "Usuń token dostępu",
    "actionListAccessTokens": "Lista tokenów dostępu",
+    "actionCreateResourceSessionToken": "Utwórz token sesji zasobu",
    "actionCreateResourceRule": "Utwórz regułę zasobu",
    "actionDeleteResourceRule": "Usuń regułę zasobu",
    "actionListResourceRules": "Lista reguł zasobu",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Wprowadź kod z aplikacji uwierzytelniającej lub jeden z jednorazowych kodów zapasowych.",
    "otpAuthSubmit": "Wyślij kod",
    "idpContinue": "Lub kontynuuj z",
+    "idpLastUsed": "Ostatnio używany",
    "otpAuthBack": "Powrót do hasła",
    "navbar": "Menu nawigacyjne",
    "navbarDescription": "Główne menu nawigacyjne aplikacji",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Zamknij",
    "createInternalResourceDialogCreateClientResource": "Utwórz zasób prywatny",
    "createInternalResourceDialogCreateClientResourceDescription": "Utwórz nowy zasób, który będzie dostępny tylko dla klientów podłączonych do organizacji",
+    "privateResourceGeneralDescription": "Skonfiguruj nazwę, identyfikator i inne ogólne ustawienia zasobów.",
    "privateResourceCreatePageSeeAll": "Zobacz wszystkie zasoby prywatne",
    "privateResourceAllowIcmpPing": "Zezwalaj na ping ICMP",
    "privateResourceNetworkAccess": "Dostęp do sieci",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Dodaj użytkowników",
    "editInternalResourceDialogAddClients": "Dodaj klientów",
    "editInternalResourceDialogDestinationLabel": "Miejsce docelowe",
-    "editInternalResourceDialogDestinationDescription": "Wybierz, gdzie ten zasób działa i jak klienci go osiągają",
+    "editInternalResourceDialogDestinationDescription": "Skonfiguruj sposób, w jaki klienci docierają do tego zasobu.",
    "internalResourceFormMultiSiteRoutingHelp": "Wybór wielu stron umożliwia odporne trasowanie i awarię dla wysokiej dostępności.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Dowiedz się więcej",
    "editInternalResourceDialogPortRestrictionsDescription": "Ogranicz dostęp do konkretnych portów TCP/UDP lub zezwól/zablokuj wszystkie porty.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Provisionamento",
    "provisioningDescription": "Gerenciar chaves de provisionamento e revisar sites pendentes aguardando aprovação.",
    "pendingSites": "Sites pendentes",
-    "siteApproveSuccess": "Site aprovado com sucesso",
+    "siteApproveSuccess": "Site e recursos associados aprovados com sucesso",
    "siteApproveError": "Erro ao aprovar site",
+    "siteReject": "Rejeitar Site",
+    "siteQuestionReject": "Tem certeza de que deseja rejeitar este site?",
+    "siteMessageReject": "Isto eliminará permanentemente o site e quaisquer recursos associados que ainda estejam pendentes.",
+    "siteConfirmReject": "Confirmar Rejeição de Site",
+    "siteRejectSuccess": "Site rejeitado com sucesso",
+    "siteRejectError": "Erro ao rejeitar site",
    "provisioningKeys": "Posicionando chaves",
    "searchProvisioningKeys": "Pesquisar chaves de provisionamento...",
    "provisioningKeysAdd": "Gerar chave de provisionamento",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Salvar a chave de provisionamento",
    "provisioningKeysSaveDescription": "Você só será capaz de ver esta vez. Copiá-lo para um lugar seguro.",
    "provisioningKeysErrorCreate": "Erro ao criar chave de provisionamento",
-    "provisioningKeysList": "Nova chave de aprovisionamento",
-    "provisioningKeysMaxBatchSize": "Tamanho máximo do lote",
+    "provisioningKeysList": "Nova Chave de Provisionamento",
+    "provisioningKeysMaxBatchSize": "Tamanho Máximo do Lote",
    "provisioningKeysUnlimitedBatchSize": "Tamanho ilimitado em lote (sem limite)",
    "provisioningKeysMaxBatchUnlimited": "Ilimitado",
    "provisioningKeysMaxBatchSizeInvalid": "Informe um tamanho máximo válido em lote (1–1,000,000).",
-    "provisioningKeysValidUntil": "Valido ate",
+    "provisioningKeysValidUntil": "Válido Até",
    "provisioningKeysValidUntilHint": "Deixe em branco para nenhuma expiração.",
    "provisioningKeysValidUntilInvalid": "Informe uma data e hora válidas.",
    "provisioningKeysNumUsed": "Use percentual",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "nunca",
    "provisioningKeysEdit": "Editar chave de provisionamento",
    "provisioningKeysEditDescription": "Atualizar o tamanho máximo do lote e tempo de expiração para esta chave.",
-    "provisioningKeysApproveNewSites": "Aprovar novos sites",
+    "provisioningKeysApproveNewSites": "Aprovar Novos Sites",
    "provisioningKeysApproveNewSitesDescription": "Aprovar automaticamente sites que se registram com esta chave.",
    "provisioningKeysUpdateError": "Erro ao atualizar chave de provisionamento",
    "provisioningKeysUpdated": "Chave de provisionamento atualizada",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Criar utilizador Org",
    "actionUpdateOrg": "Atualizar Organização",
    "actionRemoveInvitation": "Remover Convite",
+    "actionRemoveUserRole": "Remover Função de Utilizador",
    "actionUpdateUser": "Atualizar Usuário",
    "actionGetUser": "Obter Usuário",
    "actionGetOrgUser": "Obter Utilizador da Organização",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Digite o token de configuração do console do servidor.",
    "setupTokenRequired": "Token de configuração é necessário",
    "actionUpdateSite": "Atualizar Site",
+    "actionApproveSite": "Aprovar Site",
+    "actionRejectSite": "Rejeitar Site",
    "actionResetSiteBandwidth": "Redefinir banda da organização",
    "actionListSiteRoles": "Listar Funções Permitidas do Site",
    "actionCreateResource": "Criar Recurso",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Gerar Token de Acesso",
    "actionDeleteAccessToken": "Eliminar Token de Acesso",
    "actionListAccessTokens": "Listar Tokens de Acesso",
+    "actionCreateResourceSessionToken": "Criar Token de Sessão de Recurso",
    "actionCreateResourceRule": "Criar Regra de Recurso",
    "actionDeleteResourceRule": "Eliminar Regra de Recurso",
    "actionListResourceRules": "Listar Regras de Recurso",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Insira o código da sua aplicação de autenticação ou um dos seus códigos de backup de uso único.",
    "otpAuthSubmit": "Submeter Código",
    "idpContinue": "Ou continuar com",
+    "idpLastUsed": "Última Utilização",
    "otpAuthBack": "Voltar à Palavra-passe",
    "navbar": "Menu de Navegação",
    "navbarDescription": "Menu de navegação principal da aplicação",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Fechar",
    "createInternalResourceDialogCreateClientResource": "Criar Recurso Privado",
    "createInternalResourceDialogCreateClientResourceDescription": "Criar um novo recurso que só será acessível para clientes conectados à organização",
+    "privateResourceGeneralDescription": "Configure o nome, identificador e outras configurações gerais de recursos.",
    "privateResourceCreatePageSeeAll": "Ver Todos os Recursos Privados",
    "privateResourceAllowIcmpPing": "Permitir ICMP Ping",
    "privateResourceNetworkAccess": "Acesso à Rede",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Adicionar Usuários",
    "editInternalResourceDialogAddClients": "Adicionar Clientes",
    "editInternalResourceDialogDestinationLabel": "Destino",
-    "editInternalResourceDialogDestinationDescription": "Escolha onde este recurso é executado e como os clientes o acessam",
+    "editInternalResourceDialogDestinationDescription": "Configure como os clientes acessam este recurso.",
    "internalResourceFormMultiSiteRoutingHelp": "Selecionar múltiplos sites permite roteamento resiliente e failover para alta disponibilidade.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Saiba mais",
    "editInternalResourceDialogPortRestrictionsDescription": "Restrinja o acesso a portas TCP/UDP específicas ou permita/bloqueie todas as portas.",
@@ -449,8 +449,14 @@
    "provisioningManage": "Подготовка",
    "provisioningDescription": "Управляйте предоставленными ключами и проверять непроверенные сайты, ожидающие утверждения.",
    "pendingSites": "Ожидающие сайты",
-    "siteApproveSuccess": "Сайт успешно утвержден",
+    "siteApproveSuccess": "Сайт и связанные ресурсы успешно одобрены",
    "siteApproveError": "Ошибка при утверждении сайта",
+    "siteReject": "Отклонить сайт",
+    "siteQuestionReject": "Вы уверены, что хотите отклонить этот сайт?",
+    "siteMessageReject": "Этот процесс окончательно удалит сайт и все связанные с ним ресурсы, которые еще ожидают.",
+    "siteConfirmReject": "Подтвердите отклонение сайта",
+    "siteRejectSuccess": "Сайт успешно отклонен",
+    "siteRejectError": "Ошибка при отклонении сайта",
    "provisioningKeys": "Ключи подготовки",
    "searchProvisioningKeys": "Поиск подготовительных ключей...",
    "provisioningKeysAdd": "Сгенерировать ключ подготовки",
@@ -466,8 +472,8 @@
    "provisioningKeysSave": "Сохранить ключ подготовки",
    "provisioningKeysSaveDescription": "Вы сможете увидеть это только один раз. Скопируйте его в безопасное место.",
    "provisioningKeysErrorCreate": "Ошибка при создании ключа подготовки",
-    "provisioningKeysList": "Новый подготовительный ключ",
-    "provisioningKeysMaxBatchSize": "Макс. размер партии",
+    "provisioningKeysList": "Новый ключ для подготовки",
+    "provisioningKeysMaxBatchSize": "Максимальный размер партии",
    "provisioningKeysUnlimitedBatchSize": "Неограниченный размер партии (без ограничений)",
    "provisioningKeysMaxBatchUnlimited": "Неограниченный",
    "provisioningKeysMaxBatchSizeInvalid": "Введите максимальный размер пакета (1–1,000,000).",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Создать пользователя Org",
    "actionUpdateOrg": "Обновить организацию",
    "actionRemoveInvitation": "Удалить приглашение",
+    "actionRemoveUserRole": "Удалить роль пользователя",
    "actionUpdateUser": "Обновить пользователя",
    "actionGetUser": "Получить пользователя",
    "actionGetOrgUser": "Получить пользователя организации",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Введите токен настройки из консоли сервера.",
    "setupTokenRequired": "Токен настройки обязателен",
    "actionUpdateSite": "Обновить сайт",
+    "actionApproveSite": "Одобрить сайт",
+    "actionRejectSite": "Отклонить сайт",
    "actionResetSiteBandwidth": "Сброс пропускной способности организации",
    "actionListSiteRoles": "Список разрешенных ролей сайта",
    "actionCreateResource": "Создать ресурс",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Сгенерировать токен доступа",
    "actionDeleteAccessToken": "Удалить токен доступа",
    "actionListAccessTokens": "Список токенов доступа",
+    "actionCreateResourceSessionToken": "Создать токен сеанса ресурса",
    "actionCreateResourceRule": "Создать правило ресурса",
    "actionDeleteResourceRule": "Удалить правило ресурса",
    "actionListResourceRules": "Список правил ресурса",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Введите код из вашего приложения-аутентификатора или один из ваших одноразовых резервных кодов.",
    "otpAuthSubmit": "Отправить код",
    "idpContinue": "Или продолжить с",
+    "idpLastUsed": "Последнее использование",
    "otpAuthBack": "Назад к паролю",
    "navbar": "Навигационное меню",
    "navbarDescription": "Главное навигационное меню приложения",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Закрыть",
    "createInternalResourceDialogCreateClientResource": "Создать приватный ресурс",
    "createInternalResourceDialogCreateClientResourceDescription": "Создать новый ресурс, который будет доступен только клиентам, подключенным к организации",
+    "privateResourceGeneralDescription": "Настройте имя, идентификатор и другие общие параметры ресурса.",
    "privateResourceCreatePageSeeAll": "Посмотреть все частные ресурсы",
    "privateResourceAllowIcmpPing": "Разрешить ICMP Ping",
    "privateResourceNetworkAccess": "Сетевой доступ",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Добавить пользователей",
    "editInternalResourceDialogAddClients": "Добавить клиентов",
    "editInternalResourceDialogDestinationLabel": "Пункт назначения",
-    "editInternalResourceDialogDestinationDescription": "Выберите, где этот ресурс работает и как к нему получают доступ клиенты",
+    "editInternalResourceDialogDestinationDescription": "Настройте, как клиенты получают доступ к этому ресурсу.",
    "internalResourceFormMultiSiteRoutingHelp": "Выбор нескольких сайтов позволяет обеспечить отказоустойчивую маршрутизацию и фейловер для высокой доступности.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Узнать больше",
    "editInternalResourceDialogPortRestrictionsDescription": "Ограничьте доступ к определенным TCP/UDP-портам или разрешите/заблокируйте все порты.",
@@ -3679,7 +3691,7 @@
    "resourceLauncherSaveForEveryoneDescription": "Поделитесь этим видом со всеми членами организации. Если не отмечено, видимость только для вас.",
    "resourceLauncherMakePersonal": "Сделать личным",
    "resourceLauncherFilter": "Фильтр",
-    "resourceLauncherFilterWithCount": "Filter, {count} applied",
+    "resourceLauncherFilterWithCount": "Фильтр, применено {count}",
    "resourceLauncherSort": "Сортировать",
    "resourceLauncherSortAscending": "Сортировать по возрастанию",
    "resourceLauncherSortDescending": "Сортировать по убыванию",
@@ -449,8 +449,14 @@
    "provisioningManage": "Tedarik",
    "provisioningDescription": "Tedarik anahtarlarını yönetin ve onay bekleyen siteleri gözden geçirin.",
    "pendingSites": "Bekleyen Siteler",
-    "siteApproveSuccess": "Site başarıyla onaylandı",
+    "siteApproveSuccess": "Site ve ilgili kaynaklar başarıyla onaylandı",
    "siteApproveError": "Site onaylanırken hata oluştu",
+    "siteReject": "Siteyi Reddet",
+    "siteQuestionReject": "Bu siteyi reddetmek istediğinizden emin misiniz?",
+    "siteMessageReject": "Bu işlem, siteyi ve hala beklemede olan herhangi bir ilgili kaynağı kalıcı olarak silecektir.",
+    "siteConfirmReject": "Site Reddetmeyi Onayla",
+    "siteRejectSuccess": "Site başarıyla reddedildi",
+    "siteRejectError": "Site reddedilirken hata oluştu",
    "provisioningKeys": "Tedarik Anahtarları",
    "searchProvisioningKeys": "Tedarik anahtarlarını ara...",
    "provisioningKeysAdd": "Tedarik Anahtarı Üret",
@@ -466,12 +472,12 @@
    "provisioningKeysSave": "Tedarik anahtarını kaydet",
    "provisioningKeysSaveDescription": "Bunu yalnızca bir kez görebileceksiniz. Güvenli bir yere kopyalayın.",
    "provisioningKeysErrorCreate": "Tedarik anahtarı oluşturulurken hata oluştu",
-    "provisioningKeysList": "Yeni tedarik anahtarı",
-    "provisioningKeysMaxBatchSize": "Maksimum toplu iş boyutu",
+    "provisioningKeysList": "Yeni Sağlama Anahtarı",
+    "provisioningKeysMaxBatchSize": "Maksimum Toplu İş Boyutu",
    "provisioningKeysUnlimitedBatchSize": "Sınırsız toplu iş boyutu (sınırlama yok)",
    "provisioningKeysMaxBatchUnlimited": "Sınırsız",
    "provisioningKeysMaxBatchSizeInvalid": "Geçerli bir maksimum toplu iş boyutu girin (1–1,000,000).",
-    "provisioningKeysValidUntil": "Geçerlilik tarihi",
+    "provisioningKeysValidUntil": "Geçerli Olma Süresi",
    "provisioningKeysValidUntilHint": "Son kullanım tarihi için boş bırakın.",
    "provisioningKeysValidUntilInvalid": "Geçerli bir tarih ve saat girin.",
    "provisioningKeysNumUsed": "Kullanım Sayısı",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "Asla",
    "provisioningKeysEdit": "Tedarik Anahtarını Düzenle",
    "provisioningKeysEditDescription": "Bu anahtar için maksimum toplu iş boyutunu ve son kullanma zamanını güncelleyin.",
-    "provisioningKeysApproveNewSites": "Yeni siteleri onayla",
+    "provisioningKeysApproveNewSites": "Yeni Siteleri Onayla",
    "provisioningKeysApproveNewSitesDescription": "Bu anahtar ile kayıt olan siteleri otomatik olarak onayla.",
    "provisioningKeysUpdateError": "Tedarik anahtarı güncellenirken hata oluştu",
    "provisioningKeysUpdated": "Tedarik anahtarı güncellendi",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "Organizasyon Kullanıcısı Oluştur",
    "actionUpdateOrg": "Kuruluşu Güncelle",
    "actionRemoveInvitation": "Daveti Kaldır",
+    "actionRemoveUserRole": "Kullanıcı Rolünü Kaldır",
    "actionUpdateUser": "Kullanıcıyı Güncelle",
    "actionGetUser": "Kullanıcıyı Getir",
    "actionGetOrgUser": "Kuruluş Kullanıcısını Al",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "Sunucu konsolundan kurulum simgesini girin.",
    "setupTokenRequired": "Kurulum simgesi gerekli",
    "actionUpdateSite": "Siteyi Güncelle",
+    "actionApproveSite": "Siteyi Onayla",
+    "actionRejectSite": "Siteyi Reddet",
    "actionResetSiteBandwidth": "Organizasyon Bant Genişliğini Sıfırla",
    "actionListSiteRoles": "İzin Verilen Site Rolleri Listele",
    "actionCreateResource": "Kaynak Oluştur",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "Erişim Jetonu Oluştur",
    "actionDeleteAccessToken": "Erişim Jetonunu Sil",
    "actionListAccessTokens": "Erişim Jetonlarını Listele",
+    "actionCreateResourceSessionToken": "Kaynak Oturum Otomasyonu Oluştur",
    "actionCreateResourceRule": "Kaynak Kuralı Oluştur",
    "actionDeleteResourceRule": "Kaynak Kuralını Sil",
    "actionListResourceRules": "Kaynak Kurallarını Listele",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "Authenticator uygulamanızdan veya tek kullanımlık yedek kodlarınızdan birini girin.",
    "otpAuthSubmit": "Kodu Gönder",
    "idpContinue": "Veya devam et:",
+    "idpLastUsed": "Son Kullanılan",
    "otpAuthBack": "Şifreye Geri Dön",
    "navbar": "Navigasyon Menüsü",
    "navbarDescription": "Uygulamanın ana navigasyon menüsü",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "Kapat",
    "createInternalResourceDialogCreateClientResource": "Özel Kaynak Oluştur",
    "createInternalResourceDialogCreateClientResourceDescription": "Seçilen siteye bağlı istemcilere erişilebilir olacak yeni bir kaynak oluşturun",
+    "privateResourceGeneralDescription": "Kaynağın adı, tanımlayıcı ve diğer genel ayarlarını yapılandırın.",
    "privateResourceCreatePageSeeAll": "Tüm Özel Kaynakları Gör",
    "privateResourceAllowIcmpPing": "ICMP Ping İzne Ver",
    "privateResourceNetworkAccess": "Ağ Erişimi",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "Kullanıcılar Ekle",
    "editInternalResourceDialogAddClients": "Müşteriler Ekle",
    "editInternalResourceDialogDestinationLabel": "Hedef",
-    "editInternalResourceDialogDestinationDescription": "Bu kaynağın nerede çalıştığını ve istemcilerin ona nasıl eriştiğini seçin",
+    "editInternalResourceDialogDestinationDescription": "Bu kaynağa müşterilerin nasıl erişeceğini yapılandırın.",
    "internalResourceFormMultiSiteRoutingHelp": "Birden fazla site seçmek, yüksek kullanılabilirlik için dirençli yönlendirme ve yedeklik sağlar.",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "Daha fazla bilgi",
    "editInternalResourceDialogPortRestrictionsDescription": "Belirtilen TCP/UDP portlarına erişimi kısıtlayın veya tüm portlara izin/engelleme verin.",
@@ -449,8 +449,14 @@
    "provisioningManage": "预配",
    "provisioningDescription": "管理预配密钥，并审核待批准的站点。",
    "pendingSites": "待审批站点",
-    "siteApproveSuccess": "站点批准成功",
+    "siteApproveSuccess": "站点及相关资源已成功审批",
    "siteApproveError": "批准站点出错",
+    "siteReject": "拒绝站点",
+    "siteQuestionReject": "您确定要拒绝此站点吗？",
+    "siteMessageReject": "这将永久删除站点及所有尚未处理的相关资源。",
+    "siteConfirmReject": "确认拒绝站点",
+    "siteRejectSuccess": "站点已被成功拒绝",
+    "siteRejectError": "拒绝站点时出错",
    "provisioningKeys": "置备键",
    "searchProvisioningKeys": "搜索配备密钥...",
    "provisioningKeysAdd": "生成预配密钥",
@@ -466,8 +472,8 @@
    "provisioningKeysSave": "保存预配键",
    "provisioningKeysSaveDescription": "您只能看到一次。复制它到一个安全的地方。",
    "provisioningKeysErrorCreate": "创建预配键时出错",
-    "provisioningKeysList": "新建预配键",
-    "provisioningKeysMaxBatchSize": "最大批量大小",
+    "provisioningKeysList": "新预配密钥",
+    "provisioningKeysMaxBatchSize": "最大批次大小",
    "provisioningKeysUnlimitedBatchSize": "无限批量大小(无限制)",
    "provisioningKeysMaxBatchUnlimited": "无限制",
    "provisioningKeysMaxBatchSizeInvalid": "输入一个有效的最大批处理大小(1-1,000,000)。",
@@ -480,7 +486,7 @@
    "provisioningKeysNeverUsed": "永不过期",
    "provisioningKeysEdit": "编辑置备键",
    "provisioningKeysEditDescription": "更新此密钥的最大批量大小和过期时间。",
-    "provisioningKeysApproveNewSites": "批准新节点",
+    "provisioningKeysApproveNewSites": "批准新站点",
    "provisioningKeysApproveNewSitesDescription": "自动批准使用此密钥注册的节点。",
    "provisioningKeysUpdateError": "更新预配键时出错",
    "provisioningKeysUpdated": "置备密钥已更新",
@@ -1397,6 +1403,7 @@
    "createOrgUser": "创建组织用户",
    "actionUpdateOrg": "更新组织",
    "actionRemoveInvitation": "移除邀请",
+    "actionRemoveUserRole": "移除用户角色",
    "actionUpdateUser": "更新用户",
    "actionGetUser": "获取用户",
    "actionGetOrgUser": "获取组织用户",
@@ -1419,6 +1426,8 @@
    "setupTokenDescription": "从服务器控制台输入设置令牌。",
    "setupTokenRequired": "需要设置令牌",
    "actionUpdateSite": "更新站点",
+    "actionApproveSite": "批准站点",
+    "actionRejectSite": "拒绝站点",
    "actionResetSiteBandwidth": "重置组织带宽",
    "actionListSiteRoles": "允许站点角色列表",
    "actionCreateResource": "创建资源",
@@ -1462,6 +1471,7 @@
    "actionGenerateAccessToken": "生成访问令牌",
    "actionDeleteAccessToken": "删除访问令牌",
    "actionListAccessTokens": "访问令牌",
+    "actionCreateResourceSessionToken": "创建资源会话令牌",
    "actionCreateResourceRule": "创建资源规则",
    "actionDeleteResourceRule": "删除资源规则",
    "actionListResourceRules": "列出资源规则",
@@ -1515,6 +1525,7 @@
    "otpAuthDescription": "从您的身份验证程序中输入代码或您的单次备份代码。",
    "otpAuthSubmit": "提交代码",
    "idpContinue": "或者继续",
+    "idpLastUsed": "上次使用",
    "otpAuthBack": "回到密码",
    "navbar": "导航菜单",
    "navbarDescription": "应用程序的主导航菜单",
@@ -2392,6 +2403,7 @@
    "createInternalResourceDialogClose": "关闭",
    "createInternalResourceDialogCreateClientResource": "创建私有资源",
    "createInternalResourceDialogCreateClientResourceDescription": "创建一个新资源只能为连接到组织的客户端访问",
+    "privateResourceGeneralDescription": "配置名称、标识符和其他一般资源设置。",
    "privateResourceCreatePageSeeAll": "查看所有私人资源",
    "privateResourceAllowIcmpPing": "允许 ICMP Ping",
    "privateResourceNetworkAccess": "网络访问",
@@ -3268,7 +3280,7 @@
    "editInternalResourceDialogAddUsers": "添加用户",
    "editInternalResourceDialogAddClients": "添加客户端",
    "editInternalResourceDialogDestinationLabel": "目标",
-    "editInternalResourceDialogDestinationDescription": "选择该资源运行位置及客户端访问方式",
+    "editInternalResourceDialogDestinationDescription": "配置客户端如何访问此资源。",
    "internalResourceFormMultiSiteRoutingHelp": "选择多个站点可以实现高可用性的弹性路由和故障转移。",
    "internalResourceFormMultiSiteRoutingHelpLearnMore": "了解更多",
    "editInternalResourceDialogPortRestrictionsDescription": "限制访问特定的TCP/UDP端口或允许/阻止所有端口。",
@@ -1099,6 +1099,7 @@
    "actionGenerateAccessToken": "生成訪問令牌",
    "actionDeleteAccessToken": "刪除訪問令牌",
    "actionListAccessTokens": "訪問令牌",
+    "actionCreateResourceSessionToken": "建立資源工作階段權杖",
    "actionCreateResourceRule": "創建資源規則",
    "actionDeleteResourceRule": "刪除資源規則",
    "actionListResourceRules": "列出資源規則",
@@ -12,7 +12,7 @@
                "@asteasolutions/zod-to-openapi": "8.5.0",
                "@aws-sdk/client-s3": "3.1056.0",
                "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+                "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
                "@headlessui/react": "2.2.10",
                "@hookform/resolvers": "5.4.0",
                "@monaco-editor/react": "4.7.0",
@@ -1124,9 +1124,9 @@
            "integrity": "sha512-9o7PkCw9fdvGTPs0hgsUJG10QleGgcdsSCw1ekLpUOlVXtWCuiuPH+0bPDFhLWxqbVA+8pyVhwqdOI+t1T3TNA=="
        },
        "node_modules/@devolutions/iron-remote-desktop-rdp": {
-            "version": "0.0.0",
-            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
-            "integrity": "sha512-O0YVpOJDwUzekH3N2QKj+48WP+56wI0sj4VmaJkGoW5XgyAj2ONn2k3i+vk17Eavx+Vg6vAg3lwYRAOK4kKIDQ=="
+            "version": "0.0.1",
+            "resolved": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
+            "integrity": "sha512-sIHllJ6rJfAgClsUFjJfVGFjIxm6ZQRyGfinwCzHYgwnHAMFE+Kvm0YzR9tg811Fhjm5F6gNUSLAll+7Eh0Deg=="
        },
        "node_modules/@dotenvx/dotenvx": {
            "version": "1.69.1",
@@ -34,7 +34,7 @@
    "dependencies": {
        "@asteasolutions/zod-to-openapi": "8.5.0",
        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
        "@aws-sdk/client-s3": "3.1056.0",
        "@headlessui/react": "2.2.10",
        "@hookform/resolvers": "5.4.0",
@@ -21,6 +21,7 @@ export enum ActionsEnum {
    getSite = "getSite",
    listSites = "listSites",
    updateSite = "updateSite",
+    updateSiteApprovals = "updateSiteApprovals",
    restartSite = "restartSite",
    resetSiteBandwidth = "resetSiteBandwidth",
    reGenerateSecret = "reGenerateSecret",
@@ -71,6 +72,7 @@ export enum ActionsEnum {
    setResourceWhitelist = "setResourceWhitelist",
    getResourceWhitelist = "getResourceWhitelist",
    generateAccessToken = "generateAccessToken",
+    createResourceSessionToken = "createResourceSessionToken",
    deleteAcessToken = "deleteAcessToken",
    listAccessTokens = "listAccessTokens",
    createResourceRule = "createResourceRule",
@@ -200,7 +200,10 @@ export const resources = pgTable(
        authDaemonMode: varchar("authDaemonMode", { length: 32 })
            .$type<"site" | "remote" | "native">()
            .default("site"),
-        authDaemonPort: integer("authDaemonPort").default(22123)
+        authDaemonPort: integer("authDaemonPort").default(22123),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
    },
    (t) => [
        index("idx_resources_fulldomain")
@@ -451,7 +454,10 @@ export const siteResources = pgTable(
            onDelete: "set null"
        }),
        subdomain: varchar("subdomain"),
-        fullDomain: varchar("fullDomain")
+        fullDomain: varchar("fullDomain"),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
    },
    (t) => [index("idx_siteresources_orgid_niceid").on(t.orgId, t.niceId)]
 );
@@ -209,7 +209,8 @@ export const resources = sqliteTable("resources", {
    authDaemonMode: text("authDaemonMode")
        .$type<"site" | "remote" | "native">()
        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });

 export const labels = sqliteTable("labels", {
@@ -447,7 +448,8 @@ export const siteResources = sqliteTable("siteResources", {
        onDelete: "set null"
    }),
    subdomain: text("subdomain"),
-    fullDomain: text("fullDomain")
+    fullDomain: text("fullDomain"),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });

 export const networks = sqliteTable("networks", {
@@ -34,12 +34,6 @@ import {
    rebuildClientAssociationsFromSiteResource,
    waitForSiteResourceRebuildIdle
 } from "../rebuildClientAssociations";
-import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
-import { LimitId } from "../billing";
-import { usageService } from "../billing/usageService";

 type ApplyBlueprintArgs = {
    orgId: string;
@@ -26,9 +26,6 @@ import { createCertificate } from "#dynamic/routers/certificates/createCertifica
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
 import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
 import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";

@@ -201,17 +198,19 @@ export async function updatePrivateResources(
            }
        }

+        let resourceStatusFromSite: "approved" | "pending" = "approved";
        if (siteId && allSites.length === 0) {
            // only add if there are not provided sites
            // Use the provided siteId directly, but verify it belongs to the org
            const [siteSingle] = await trx
-                .select({ siteId: sites.siteId })
+                .select({ siteId: sites.siteId, status: sites.status })
                .from(sites)
                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
                .limit(1);
            if (siteSingle) {
                allSites.push(siteSingle);
            }
+            resourceStatusFromSite = siteSingle.status ?? "approved";
        }

        if (allSites.length === 0) {
@@ -220,6 +219,13 @@ export async function updatePrivateResources(
            );
        }

+        const resourceEnabled =
+            resourceData.enabled == undefined || resourceData.enabled == null
+                ? true
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
        if (existingResource) {
            let domainInfo:
                | { subdomain: string | null; domainId: string }
@@ -243,8 +249,7 @@ export async function updatePrivateResources(
                    scheme: resourceData.scheme,
                    destination: resourceData.destination,
                    destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
-                    // enabled: resourceData.enabled ?? true,
+                    enabled: resourceEnabled,
                    alias: resourceData.alias || null,
                    disableIcmp:
                        resourceData["disable-icmp"] ||
@@ -263,7 +268,8 @@ export async function updatePrivateResources(
                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                    authDaemonMode:
                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                })
                .where(
                    eq(
@@ -496,8 +502,7 @@ export async function updatePrivateResources(
                    scheme: resourceData.scheme,
                    destination: resourceData.destination,
                    destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
-                    // enabled: resourceData.enabled ?? true,
+                    enabled: resourceEnabled,
                    alias: resourceData.alias || null,
                    aliasAddress: aliasAddress,
                    disableIcmp:
@@ -517,7 +522,8 @@ export async function updatePrivateResources(
                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                    authDaemonMode:
                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                })
                .returning();

@@ -25,6 +25,7 @@ import {
    rolePolicies,
    roleResources,
    roles,
+    Site,
    sites,
    Target,
    TargetHealthCheck,
@@ -74,19 +75,40 @@ export async function updatePublicResources(
    )) {
        const targetsToUpdate: Target[] = [];
        const healthchecksToUpdate: TargetHealthCheck[] = [];
+
        let resource: Resource;
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
+        let providedSite: Partial<Site> | undefined;
+        if (siteId) {
+            // Use the provided siteId directly, but verify it belongs to the org
+            [providedSite] = await trx
+                .select({
+                    siteId: sites.siteId,
+                    type: sites.type,
+                    status: sites.status
+                })
+                .from(sites)
+                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+                .limit(1);
+
+            resourceStatusFromSite = providedSite?.status ?? "approved";
+        }

        async function createTarget( // reusable function to create a target
            resourceId: number,
            targetData: TargetData
        ) {
            const targetSiteId = targetData.site;
-            let site;
+            let site: Partial<Site> | undefined;

            if (targetSiteId) {
                // Look up site by niceId
                [site] = await trx
-                    .select({ siteId: sites.siteId, type: sites.type })
+                    .select({
+                        siteId: sites.siteId,
+                        type: sites.type,
+                        status: sites.status
+                    })
                    .from(sites)
                    .where(
                        and(
@@ -95,15 +117,9 @@ export async function updatePublicResources(
                        )
                    )
                    .limit(1);
-            } else if (siteId) {
+            } else if (siteId && providedSite) {
                // Use the provided siteId directly, but verify it belongs to the org
-                [site] = await trx
-                    .select({ siteId: sites.siteId, type: sites.type })
-                    .from(sites)
-                    .where(
-                        and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-                    )
-                    .limit(1);
+                site = providedSite;
            } else {
                throw new Error(`Target site is required`);
            }
@@ -139,7 +155,7 @@ export async function updatePublicResources(
                .insert(targets)
                .values({
                    resourceId: resourceId,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                    ip: targetData.hostname,
                    mode: resourceData.mode as Target["mode"],
                    method: targetData.method,
@@ -172,7 +188,7 @@ export async function updatePublicResources(
                .insert(targetHealthCheck)
                .values({
                    name: `${targetData.hostname}:${targetData.port}`,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                    targetId: newTarget.targetId,
                    orgId: orgId,
                    hcEnabled: healthcheckData?.enabled || false,
@@ -230,7 +246,10 @@ export async function updatePublicResources(
        const resourceEnabled =
            resourceData.enabled == undefined || resourceData.enabled == null
                ? true
-                : resourceData.enabled;
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
        const resourceSsl =
            resourceData.ssl == undefined || resourceData.ssl == null
                ? true
@@ -406,7 +425,8 @@ export async function updatePublicResources(
                                    ? (resourceData["proxy-protocol-version"] ??
                                      1)
                                    : 1,
-                            resourcePolicyId: sharedPolicy.resourcePolicyId
+                            resourcePolicyId: sharedPolicy.resourcePolicyId,
+                            status: resourceStatusFromSite
                        })
                        .where(
                            eq(
@@ -590,7 +610,8 @@ export async function updatePublicResources(
                            authDaemonPort:
                                resourceData["auth-daemon"]?.port || 22123,
                            resourcePolicyId: null,
-                            defaultResourcePolicyId: inlinePolicyId
+                            defaultResourcePolicyId: inlinePolicyId,
+                            status: resourceStatusFromSite
                        })
                        .where(
                            eq(
@@ -1131,6 +1152,7 @@ export async function updatePublicResources(
                .values({
                    orgId,
                    niceId: resourceNiceId,
+                    status: resourceStatusFromSite,
                    name: resourceData.name || "Unnamed Resource",
                    mode: resourceData.mode,
                    proxyPort: ["http", "ssh", "rdp", "vnc"].includes(
@@ -470,7 +470,7 @@ export const PrivateResourceSchema = z
        // proxyPort: z.int().positive().optional(),
        "destination-port": z.int().positive().optional(),
        destination: z.string().min(1).optional(),
-        // enabled: z.boolean().default(true),
+        enabled: z.boolean().default(true),
        "tcp-ports": portRangeStringSchema.optional().default("*"),
        "udp-ports": portRangeStringSchema.optional().default("*"),
        "disable-icmp": z.boolean().optional().default(false),
@@ -14,8 +14,6 @@ import {
 } from "@server/db";
 import logger from "@server/logger";
 import { removeTargets } from "@server/routers/newt/targets";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";

 export type DeleteResourceResult = {
    deletedResource: Resource;
@@ -117,10 +115,10 @@ export async function runResourceDeleteSideEffects(
            .limit(1);

        if (!site) {
-            throw createHttpError(
-                HttpCode.NOT_FOUND,
-                `Site with ID ${target.siteId} not found`
+            logger.debug(
+                `Site with ID ${target.siteId} not found during resource delete side effects; skipping target removal`
            );
+            continue;
        }

        if (site.pubKey && site.type === "newt") {
@@ -1,6 +1,7 @@
-import { and, eq, sql } from "drizzle-orm";
+import { and, eq, inArray, sql } from "drizzle-orm";
 import {
    db,
+    resources,
    siteNetworks,
    siteResources,
    targets,
@@ -97,6 +98,64 @@ export function exceedsSiteAssociatedResourceDeleteLimit(
    return resourceCount > MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE;
 }

+export async function getPendingResourceIdsForSite(
+    siteId: number,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const resourceIds = await getResourceIdsForSite(siteId, trx);
+    if (resourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ resourceId: resources.resourceId })
+        .from(resources)
+        .where(
+            and(
+                inArray(resources.resourceId, resourceIds),
+                eq(resources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.resourceId);
+}
+
+export async function getPendingSiteResourceIdsForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
+    if (siteResourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ siteResourceId: siteResources.siteResourceId })
+        .from(siteResources)
+        .where(
+            and(
+                inArray(siteResources.siteResourceId, siteResourceIds),
+                eq(siteResources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
+export async function getPendingAssociatedResourceCountForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number> {
+    const [resourceIds, siteResourceIds] = await Promise.all([
+        getPendingResourceIdsForSite(siteId, trx),
+        getPendingSiteResourceIdsForSite(siteId, orgId, trx)
+    ]);
+
+    return resourceIds.length + siteResourceIds.length;
+}
+
 export async function deleteAssociatedResourcesForSite(
    siteId: number,
    orgId: string,
@@ -105,12 +164,32 @@ export async function deleteAssociatedResourcesForSite(
    const resourceIds = await getResourceIdsForSite(siteId, trx);
    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);

-    const [resources, siteResourcesDeleted] = await Promise.all([
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
        performDeleteResources(resourceIds, trx),
        performDeleteSiteResources(siteResourceIds, trx)
    ]);

-    return { resources, siteResources: siteResourcesDeleted };
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
+}
+
+export async function deletePendingAssociatedResourcesForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<DeleteSiteAssociatedResourcesSideEffects> {
+    const resourceIds = await getPendingResourceIdsForSite(siteId, trx);
+    const siteResourceIds = await getPendingSiteResourceIdsForSite(
+        siteId,
+        orgId,
+        trx
+    );
+
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
+        performDeleteResources(resourceIds, trx),
+        performDeleteSiteResources(siteResourceIds, trx)
+    ]);
+
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
 }

 export async function runDeleteSiteAssociatedResourcesSideEffects(
@@ -496,6 +496,7 @@ export function generateRemoteSubnets(
 ): string[] {
    const remoteSubnets = allSiteResources
        .filter((sr) => {
+            if (!sr.enabled) return false;
            if (!sr.destination) return false;

            if (sr.mode === "cidr") {
@@ -530,6 +531,7 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
    return allSiteResources
        .filter(
            (sr) =>
+                sr.enabled &&
                sr.aliasAddress &&
                ((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
                    (sr.fullDomain && sr.mode == "http"))
@@ -662,6 +664,13 @@ export async function generateSubnetProxyTargetV2(
        subnet: string | null;
    }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
+    if (!siteResource.enabled) {
+        logger.debug(
+            `Site resource ${siteResource.siteResourceId} is disabled, skipping target generation.`
+        );
+        return;
+    }
+
    if (clients.length === 0) {
        logger.debug(
            `No clients have access to site resource ${siteResource.siteResourceId}, skipping target generation.`
@@ -1561,9 +1561,19 @@ export async function handleMessagingForUpdatedSiteResource(
                updatedSiteResource.udpPortRangeString ||
            existingSiteResource.disableIcmp !==
                updatedSiteResource.disableIcmp);
+    // Toggling enabled on/off doesn't change any of the fields above, but it
+    // does change whether targets/peer data should exist at all, so it needs
+    // to drive the same old->new diff machinery: going enabled->disabled
+    // diffs "real data" against "nothing" (a remove), and disabled->enabled
+    // diffs "nothing" against "real data" (an add). generateSubnetProxyTargetV2/
+    // generateRemoteSubnets/generateAliasConfig already return nothing for a
+    // disabled resource, so no other changes are needed here.
+    const enabledChanged =
+        existingSiteResource &&
+        existingSiteResource.enabled !== updatedSiteResource.enabled;

    logger.debug(
-        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)}`
+        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)} enabledChanged=${Boolean(enabledChanged)}`
    );

    // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all
@@ -1574,14 +1584,16 @@ export async function handleMessagingForUpdatedSiteResource(
        fullDomainChanged ||
        sslChanged ||
        portRangesChanged ||
-        destinationPortChanged
+        destinationPortChanged ||
+        enabledChanged
    ) {
        const shouldUpdateTargets =
            destinationChanged ||
            sslChanged ||
            portRangesChanged ||
            fullDomainChanged ||
-            destinationPortChanged;
+            destinationPortChanged ||
+            enabledChanged;

        logger.debug(
            `handleMessagingForUpdatedSiteResource: entering unchanged-site update path shouldUpdateTargets=${shouldUpdateTargets}`
@@ -1657,20 +1669,22 @@ export async function handleMessagingForUpdatedSiteResource(
                peerDataUpdateBatch.push({
                    clientId: client.clientId,
                    siteId,
-                    remoteSubnets: destinationChanged
-                        ? {
-                              oldRemoteSubnets: !oldDestinationStillInUseBySite
-                                  ? generateRemoteSubnets([
-                                        existingSiteResource
-                                    ])
-                                  : [],
-                              newRemoteSubnets: generateRemoteSubnets([
-                                  updatedSiteResource
-                              ])
-                          }
-                        : undefined,
+                    remoteSubnets:
+                        destinationChanged || enabledChanged
+                            ? {
+                                  oldRemoteSubnets:
+                                      !oldDestinationStillInUseBySite
+                                          ? generateRemoteSubnets([
+                                                existingSiteResource
+                                            ])
+                                          : [],
+                                  newRemoteSubnets: generateRemoteSubnets([
+                                      updatedSiteResource
+                                  ])
+                              }
+                            : undefined,
                    aliases:
-                        aliasChanged || fullDomainChanged // the full domain is sent down as an alias
+                        aliasChanged || fullDomainChanged || enabledChanged // the full domain is sent down as an alias
                            ? {
                                  oldAliases: generateAliasConfig([
                                      existingSiteResource
@@ -736,11 +736,14 @@ export async function verifyResourceSession(
            }
        }

-        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge
+        // If headerAuthExtendedCompatibility is activated but no clientHeaderAuth provided, force client to challenge.
+        // Skip the challenge when SSO is also enabled so browsers get the SSO redirect instead of a native Basic
+        // Auth dialog; clients that proactively send Authorization: Basic are still accepted above.
        if (
            headerAuthExtendedCompatibility &&
            headerAuthExtendedCompatibility.extendedCompatibilityIsActivated &&
-            !clientHeaderAuth
+            !clientHeaderAuth &&
+            !sso
        ) {
            return headerAuthChallenged(res, redirectPath, resource.orgId);
        }
@@ -248,6 +248,22 @@ authenticated.post(
    site.updateSite
 );

+authenticated.post(
+    "/site/:siteId/approve",
+    verifySiteAccess,
+    verifyUserHasAction(ActionsEnum.updateSiteApprovals),
+    logActionAudit(ActionsEnum.updateSiteApprovals),
+    site.approveSite
+);
+
+authenticated.post(
+    "/site/:siteId/reject",
+    verifySiteAccess,
+    verifyUserHasAction(ActionsEnum.updateSiteApprovals),
+    logActionAudit(ActionsEnum.updateSiteApprovals),
+    site.rejectSite
+);
+
 authenticated.delete(
    "/site/:siteId",
    verifySiteAccess,
@@ -138,6 +138,7 @@ authenticated.post(
    logActionAudit(ActionsEnum.updateSite),
    site.updateSite
 );
+
 authenticated.post(
    "/org/:orgId/reset-bandwidth",
    verifyApiKeyOrgAccess,
@@ -808,6 +809,16 @@ authenticated.post(
    accessToken.generateAccessToken
 );

+authenticated.post(
+    `/resource/:resourceId/session-token`,
+    verifyApiKeyResourceAccess,
+    verifyApiKeyUserAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createResourceSessionToken),
+    logActionAudit(ActionsEnum.createResourceSessionToken),
+    resource.createResourceSessionToken
+);
+
 authenticated.delete(
    `/access-token/:accessTokenId`,
    verifyApiKeyAccessTokenAccess,
@@ -157,7 +157,8 @@ async function resolveAccessibleIdsUncached(
            .where(
                and(
                    eq(userResources.userId, userId),
-                    eq(resources.orgId, orgId)
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
                )
            ),
        userRoleIds.length > 0
@@ -171,7 +172,8 @@ async function resolveAccessibleIdsUncached(
                  .where(
                      and(
                          inArray(roleResources.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                      )
                  )
            : Promise.resolve([]),
@@ -183,7 +185,11 @@ async function resolveAccessibleIdsUncached(
                eq(effectiveResourcePolicyId, userPolicies.resourcePolicyId)
            )
            .where(
-                and(eq(userPolicies.userId, userId), eq(resources.orgId, orgId))
+                and(
+                    eq(userPolicies.userId, userId),
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
+                )
            ),
        userRoleIds.length > 0
            ? db
@@ -199,21 +205,48 @@ async function resolveAccessibleIdsUncached(
                  .where(
                      and(
                          inArray(rolePolicies.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                      )
                  )
            : Promise.resolve([]),
        db
            .select({ siteResourceId: userSiteResources.siteResourceId })
            .from(userSiteResources)
-            .where(eq(userSiteResources.userId, userId)),
+            .innerJoin(
+                siteResources,
+                eq(
+                    userSiteResources.siteResourceId,
+                    siteResources.siteResourceId
+                )
+            )
+            .where(
+                and(
+                    eq(userSiteResources.userId, userId),
+                    eq(siteResources.orgId, orgId),
+                    eq(siteResources.status, "approved")
+                )
+            ),
        userRoleIds.length > 0
            ? db
                  .select({
                      siteResourceId: roleSiteResources.siteResourceId
                  })
                  .from(roleSiteResources)
-                  .where(inArray(roleSiteResources.roleId, userRoleIds))
+                  .innerJoin(
+                      siteResources,
+                      eq(
+                          roleSiteResources.siteResourceId,
+                          siteResources.siteResourceId
+                      )
+                  )
+                  .where(
+                      and(
+                          inArray(roleSiteResources.roleId, userRoleIds),
+                          eq(siteResources.orgId, orgId),
+                          eq(siteResources.status, "approved")
+                      )
+                  )
            : Promise.resolve([])
    ]);

@@ -365,6 +398,7 @@ async function filterPublicResourceIdsByTextSearch(
                inArray(resources.resourceId, resourceIds),
                eq(resources.orgId, orgId),
                eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                textMatch
            )
        );
@@ -402,6 +436,7 @@ async function filterSiteResourceIdsByTextSearch(
                inArray(siteResources.siteResourceId, siteResourceIds),
                eq(siteResources.orgId, orgId),
                eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                textMatch
            )
        );
@@ -503,7 +538,8 @@ async function listSiteGroups(
        const publicConditions = [
            inArray(resources.resourceId, accessible.resourceIds),
            eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
        ];
        if (searchPublic) {
            publicConditions.push(searchPublic);
@@ -558,7 +594,8 @@ async function listSiteGroups(
        const siteConditions = [
            inArray(siteResources.siteResourceId, accessible.siteResourceIds),
            eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
        ];
        if (searchSite) {
            siteConditions.push(searchSite);
@@ -621,7 +658,8 @@ async function listSiteGroups(
        const noSitePublicConditions = [
            inArray(resources.resourceId, accessible.resourceIds),
            eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
        ];
        if (searchPublic) {
            noSitePublicConditions.push(searchPublic);
@@ -655,7 +693,8 @@ async function listSiteGroups(
        const noSiteSiteConditions = [
            inArray(siteResources.siteResourceId, accessible.siteResourceIds),
            eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
        ];
        if (searchSite) {
            noSiteSiteConditions.push(searchSite);
@@ -746,7 +785,8 @@ async function listLabelGroups(
        const publicConditions = [
            inArray(resources.resourceId, accessible.resourceIds),
            eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
        ];
        const searchPublic = buildSearchConditionForPublic(query.query);
        if (searchPublic) {
@@ -810,7 +850,8 @@ async function listLabelGroups(
        const siteConditions = [
            inArray(siteResources.siteResourceId, accessible.siteResourceIds),
            eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
        ];
        const searchSite = buildSearchConditionForSiteResource(query.query);
        if (searchSite) {
@@ -997,6 +1038,7 @@ async function mapPublicResources(
                inArray(resources.resourceId, resourceIds),
                eq(resources.orgId, orgId),
                eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                siteIdFilter != null
                    ? eq(sites.siteId, siteIdFilter)
                    : undefined
@@ -1088,6 +1130,7 @@ async function mapSiteResources(
                inArray(siteResources.siteResourceId, siteResourceIds),
                eq(siteResources.orgId, orgId),
                eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                siteIdFilter != null
                    ? eq(sites.siteId, siteIdFilter)
                    : undefined
@@ -1382,7 +1425,8 @@ async function collectAccessibleSites(
        const publicConditions = [
            inArray(resources.resourceId, accessible.resourceIds),
            eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
        ];
        if (siteNameSearch) {
            publicConditions.push(siteNameSearch);
@@ -1422,7 +1466,8 @@ async function collectAccessibleSites(
        const siteConditions = [
            inArray(siteResources.siteResourceId, accessible.siteResourceIds),
            eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
        ];
        if (siteNameSearch) {
            siteConditions.push(siteNameSearch);
@@ -1476,6 +1521,7 @@ async function collectAccessibleLabels(
            inArray(resources.resourceId, accessible.resourceIds),
            eq(resources.orgId, orgId),
            eq(resources.enabled, true),
+            eq(resources.status, "approved"),
            eq(labels.orgId, orgId)
        ];
        if (labelNameSearch) {
@@ -1511,6 +1557,7 @@ async function collectAccessibleLabels(
            inArray(siteResources.siteResourceId, accessible.siteResourceIds),
            eq(siteResources.orgId, orgId),
            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved"),
            eq(labels.orgId, orgId)
        ];
        if (labelNameSearch) {
@@ -148,7 +148,12 @@ export async function buildClientConfigurationForNewtClient(
        .from(siteResources)
        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
        .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
-        .where(eq(siteNetworks.siteId, siteId))
+        .where(
+            and(
+                eq(siteNetworks.siteId, siteId),
+                eq(siteResources.enabled, true)
+            )
+        )
        .then((rows) => rows.map((r) => r.siteResources));

    const targetsToSend: SubnetProxyTargetV2[] = [];
@@ -94,7 +94,13 @@ async function flushSitePingsToDb(): Promise<void> {
    const pingsToFlush = new Map(pendingSitePings);
    pendingSitePings.clear();

-    const entries = Array.from(pingsToFlush.entries());
+    // Sort by id ascending so concurrent writers (other app replicas, or
+    // unrelated single-row updates elsewhere in the app) always acquire row
+    // locks in the same order. Without this, overlapping batches/updates
+    // that touch the same rows in different orders can deadlock each other.
+    const entries = Array.from(pingsToFlush.entries()).sort(
+        ([a], [b]) => a - b
+    );

    const BATCH_SIZE = 50;
    for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -193,7 +199,11 @@ async function flushClientPingsToDb(): Promise<void> {

    // ── Flush client pings ─────────────────────────────────────────────
    if (pingsToFlush.size > 0) {
-        const entries = Array.from(pingsToFlush.entries());
+        // Sort ascending for consistent lock ordering (see note in
+        // flushSitePingsToDb).
+        const entries = Array.from(pingsToFlush.entries()).sort(
+            ([a], [b]) => a - b
+        );

        const BATCH_SIZE = 50;
        for (let i = 0; i < entries.length; i += BATCH_SIZE) {
@@ -16,7 +16,7 @@ import {
    generateRemoteSubnets
 } from "@server/lib/ip";
 import logger from "@server/logger";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
 import config from "@server/lib/config";

@@ -70,7 +70,13 @@ export async function buildSiteConfigurationForOlmClient(
        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
        .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
        .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
+            and(
+                eq(
+                    clientSiteResourcesAssociationsCache.clientId,
+                    client.clientId
+                ),
+                eq(siteResources.enabled, true)
+            )
        );

    const siteResourcesBySiteId = new Map<number, SiteResource[]>();
@@ -0,0 +1,133 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { resources, users, userOrgs } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { createResourceSession } from "@server/auth/sessions/resource";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createSession, generateSessionToken } from "@server/auth/sessions/app";
+import { response } from "@server/lib/response";
+
+const createResourceSessionTokenParams = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+const createResourceSessionTokenBody = z.strictObject({
+    userId: z.string().nonempty(),
+    idpId: z.coerce.number().int().positive().optional()
+});
+
+export type CreateResourceSessionTokenResponse = {
+    requestToken: string;
+};
+
+export async function createResourceSessionToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = createResourceSessionTokenParams.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = createResourceSessionTokenBody.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+        const { userId, idpId } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found`
+                )
+            );
+        }
+
+        const candidates = await db
+            .select({ userId: users.userId })
+            .from(userOrgs)
+            .innerJoin(users, eq(userOrgs.userId, users.userId))
+            .where(
+                and(
+                    eq(users.userId, userId),
+                    eq(userOrgs.orgId, resource.orgId)
+                )
+            );
+
+        if (candidates.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `User not found in the organization that owns this resource`
+                )
+            );
+        }
+
+        if (candidates.length > 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Multiple users match this username (external users from different identity providers). Specify idpId to disambiguate."
+                )
+            );
+        }
+
+        const targetUserId = candidates[0].userId;
+
+        const appSessionToken = generateSessionToken();
+        const appSession = await createSession(appSessionToken, targetUserId);
+
+        const requestToken = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token: requestToken,
+            userSessionId: appSession.sessionId,
+            isRequestToken: true,
+            expiresAt: Date.now() + 1000 * 30, // 30 seconds
+            sessionLength: 1000 * 30,
+            doNotExtend: true
+        });
+
+        logger.debug("Resource session token created successfully");
+
+        return response<CreateResourceSessionTokenResponse>(res, {
+            data: { requestToken },
+            success: true,
+            error: false,
+            message: "Resource session token created successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
@@ -17,6 +17,7 @@ export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
 export * from "./authWithAccessToken";
 export * from "./getExchangeToken";
+export * from "./createResourceSessionToken";
 export * from "./createResourceRule";
 export * from "./deleteResourceRule";
 export * from "./listResourceRules";
@@ -138,6 +138,15 @@ const listResourcesSchema = z.strictObject({
        description:
            "When set, only resources that have at least one target on this site are returned"
    }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by resource status"
+        }),
    labels: z
        .preprocess((val) => {
            if (val === undefined || val === null || val === "") {
@@ -451,6 +460,7 @@ export async function listResources(
            sort_by,
            order,
            siteId,
+            status,
            labels: labelFilter
        } = parsedQuery.data;

@@ -660,6 +670,10 @@ export async function listResources(
            }
        }

+        if (typeof status !== "undefined") {
+            conditions.push(eq(resources.status, status));
+        }
+
        if (siteId != null) {
            const resourcesWithSite = db
                .select({ resourceId: targets.resourceId })
@@ -45,18 +45,19 @@ function userResourceAliasesCacheKey(
    page: number,
    pageSize: number,
    includeLabels: boolean,
-    labelFilter: string[]
+    labelFilter: string[],
+    status?: "pending" | "approved"
 ) {
    const labelsKey =
        labelFilter.length > 0 ? labelFilter.slice().sort().join(",") : "all";
-    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}`;
+    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}:${status ?? "all"}`;
 }

 const listUserResourceAliasesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listUserResourceAliasesQuerySchema = z.strictObject({
+const listUserResourceAliasesQuerySchema = z.object({
    pageSize: z.coerce
        .number<string>()
        .int()
@@ -96,7 +97,16 @@ const listUserResourceAliasesQuerySchema = z.strictObject({
        type: "array",
        description:
            "Filter by resource labels. A resource matches when it has any of the given labels (OR)."
-    })
+    }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        })
 });

 export type UserResourceAliasItem = {
@@ -130,7 +140,8 @@ export async function listUserResourceAliases(
            page,
            pageSize,
            includeLabels,
-            labels: labelFilter
+            labels: labelFilter,
+            status
        } = parsedQuery.data;

        const parsedParams = listUserResourceAliasesParamsSchema.safeParse(
@@ -172,7 +183,8 @@ export async function listUserResourceAliases(
            page,
            pageSize,
            includeLabels,
-            labelFilter ?? []
+            labelFilter ?? [],
+            status
        );
        const cachedData: ListUserResourceAliasesResponse | undefined =
            await cache.get(cacheKey);
@@ -257,6 +269,10 @@ export async function listUserResourceAliases(
            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
        ];

+        if (typeof status !== "undefined") {
+            whereConditions.push(eq(siteResources.status, status));
+        }
+
        if (labelFilter && labelFilter.length > 0) {
            whereConditions.push(
                inArray(
@@ -0,0 +1,251 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    db,
+    resources,
+    siteNetworks,
+    siteResources,
+    sites,
+    type Site,
+    type SiteResource
+} from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    getResourceIdsForSite,
+    getSiteResourceIdsForSite
+} from "@server/lib/deleteSiteAssociatedResources";
+import {
+    handleMessagingForUpdatedSiteResource,
+    rebuildClientAssociationsFromSiteResource,
+    waitForSiteResourceRebuildIdle
+} from "@server/lib/rebuildClientAssociations";
+
+const approveSiteParamsSchema = z.strictObject({
+    siteId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/site/{siteId}/approve",
+    description:
+        "Approve a pending site and approve (and enable when needed) its associated resources.",
+    tags: [OpenAPITags.Site],
+    request: {
+        params: approveSiteParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+type SiteResourceEnableSideEffect = {
+    existing: SiteResource;
+    updated: SiteResource;
+    siteIds: number[];
+};
+
+export async function approveSite(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = approveSiteParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteId } = parsedParams.data;
+
+        const [existingSite] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (!existingSite) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!existingSite.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Site with ID ${siteId} has no organization`
+                )
+            );
+        }
+
+        const orgId = existingSite.orgId;
+        let updatedSite: Site | undefined;
+        const siteResourceEnableSideEffects: SiteResourceEnableSideEffect[] =
+            [];
+
+        await db.transaction(async (trx) => {
+            [updatedSite] = await trx
+                .update(sites)
+                .set({ status: "approved" })
+                .where(eq(sites.siteId, siteId))
+                .returning();
+
+            const resourceIds = await getResourceIdsForSite(siteId, trx);
+            const siteResourceIds = await getSiteResourceIdsForSite(
+                siteId,
+                orgId,
+                trx
+            );
+
+            if (resourceIds.length > 0) {
+                const pendingDisabledResources = await trx
+                    .select({ resourceId: resources.resourceId })
+                    .from(resources)
+                    .where(
+                        and(
+                            inArray(resources.resourceId, resourceIds),
+                            eq(resources.status, "pending"),
+                            eq(resources.enabled, false)
+                        )
+                    );
+
+                await trx
+                    .update(resources)
+                    .set({ status: "approved" })
+                    .where(inArray(resources.resourceId, resourceIds));
+
+                if (pendingDisabledResources.length > 0) {
+                    await trx
+                        .update(resources)
+                        .set({ enabled: true })
+                        .where(
+                            inArray(
+                                resources.resourceId,
+                                pendingDisabledResources.map(
+                                    (r) => r.resourceId
+                                )
+                            )
+                        );
+                }
+            }
+
+            if (siteResourceIds.length > 0) {
+                const existingSiteResources = await trx
+                    .select()
+                    .from(siteResources)
+                    .where(
+                        inArray(siteResources.siteResourceId, siteResourceIds)
+                    );
+
+                const pendingDisabledSiteResources =
+                    existingSiteResources.filter(
+                        (sr) => sr.status === "pending" && !sr.enabled
+                    );
+
+                await trx
+                    .update(siteResources)
+                    .set({ status: "approved" })
+                    .where(
+                        inArray(siteResources.siteResourceId, siteResourceIds)
+                    );
+
+                if (pendingDisabledSiteResources.length > 0) {
+                    const enableIds = pendingDisabledSiteResources.map(
+                        (sr) => sr.siteResourceId
+                    );
+
+                    const updatedEnabledSiteResources = await trx
+                        .update(siteResources)
+                        .set({ enabled: true })
+                        .where(inArray(siteResources.siteResourceId, enableIds))
+                        .returning();
+
+                    for (const updated of updatedEnabledSiteResources) {
+                        const existing = pendingDisabledSiteResources.find(
+                            (sr) => sr.siteResourceId === updated.siteResourceId
+                        );
+                        if (!existing || !updated.networkId) {
+                            continue;
+                        }
+
+                        const networkSites = await trx
+                            .select({ siteId: siteNetworks.siteId })
+                            .from(siteNetworks)
+                            .where(
+                                eq(siteNetworks.networkId, updated.networkId)
+                            );
+
+                        siteResourceEnableSideEffects.push({
+                            existing,
+                            updated,
+                            siteIds: networkSites.map((s) => s.siteId)
+                        });
+                    }
+                }
+            }
+        });
+
+        for (const sideEffect of siteResourceEnableSideEffects) {
+            rebuildClientAssociationsFromSiteResource(sideEffect.updated)
+                .then(() =>
+                    waitForSiteResourceRebuildIdle(
+                        sideEffect.updated.siteResourceId
+                    )
+                )
+                .then(() =>
+                    handleMessagingForUpdatedSiteResource(
+                        sideEffect.existing,
+                        sideEffect.updated,
+                        sideEffect.siteIds,
+                        sideEffect.siteIds
+                    )
+                )
+                .catch((e) => {
+                    logger.error(
+                        `Failed to rebuild and handle messaging for site resource ${sideEffect.updated.siteResourceId} after site approval:`,
+                        e
+                    );
+                });
+        }
+
+        return response(res, {
+            data: updatedSite ?? null,
+            success: true,
+            error: false,
+            message: "Site approved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
@@ -159,15 +159,39 @@ export async function deleteSite(
            siteResources: []
        };

-        await db.transaction(async (trx) => {
-            if (deleteResources) {
+        if (deleteResources) {
+            await db.transaction(async (trx) => {
                resourceSideEffects = await deleteAssociatedResourcesForSite(
                    siteId,
                    site.orgId,
                    trx
                );
-            }

+                if (resourceSideEffects.resources.length > 0) {
+                    await usageService.add(
+                        site.orgId,
+                        LimitId.PUBLIC_RESOURCES,
+                        -resourceSideEffects.resources.length,
+                        trx
+                    );
+                }
+
+                if (resourceSideEffects.siteResources.length > 0) {
+                    await usageService.add(
+                        site.orgId,
+                        LimitId.PRIVATE_RESOURCES,
+                        -resourceSideEffects.siteResources.length,
+                        trx
+                    );
+                }
+            });
+
+            await runDeleteSiteAssociatedResourcesSideEffects(
+                resourceSideEffects
+            );
+        }
+
+        await db.transaction(async (trx) => {
            if (site.type == "wireguard") {
                if (site.pubKey) {
                    await deletePeer(site.exitNodeId!, site.pubKey);
@@ -180,12 +204,6 @@ export async function deleteSite(
            await usageService.add(site.orgId, LimitId.SITES, -1, trx);
        });

-        if (deleteResources) {
-            await runDeleteSiteAssociatedResourcesSideEffects(
-                resourceSideEffects
-            );
-        }
-
        if (deletedNewt) {
            const payload = {
                type: `newt/wg/terminate`,
@@ -3,6 +3,8 @@ export * from "./getStatusHistory";
 export * from "./createSite";
 export * from "./deleteSite";
 export * from "./updateSite";
+export * from "./approveSite";
+export * from "./rejectSite";
 export * from "./listSites";
 export * from "./listSiteRoles";
 export * from "./pickSiteDefaults";
@@ -0,0 +1,196 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { newts, sites } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { deletePeer } from "../gerbil/peers";
+import { fromError } from "zod-validation-error";
+import { sendToClient } from "#dynamic/routers/ws";
+import { OpenAPITags, registry } from "@server/openApi";
+import { cleanupSiteAssociations } from "@server/lib/rebuildClientAssociations";
+import { usageService } from "@server/lib/billing/usageService";
+import { LimitId } from "@server/lib/billing";
+import {
+    deletePendingAssociatedResourcesForSite,
+    exceedsSiteAssociatedResourceDeleteLimit,
+    getPendingAssociatedResourceCountForSite,
+    runDeleteSiteAssociatedResourcesSideEffects,
+    MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE,
+    type DeleteSiteAssociatedResourcesSideEffects
+} from "@server/lib/deleteSiteAssociatedResources";
+
+const rejectSiteParamsSchema = z.strictObject({
+    siteId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/site/{siteId}/reject",
+    description:
+        "Reject a pending site by deleting it and any associated resources that are still pending.",
+    tags: [OpenAPITags.Site],
+    request: {
+        params: rejectSiteParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function rejectSite(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = rejectSiteParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteId } = parsedParams.data;
+
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (!site) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!site.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Site with ID ${siteId} has no organization`
+                )
+            );
+        }
+
+        const pendingAssociatedResourceCount =
+            await getPendingAssociatedResourceCountForSite(siteId, site.orgId);
+
+        if (
+            exceedsSiteAssociatedResourceDeleteLimit(
+                pendingAssociatedResourceCount
+            )
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Cannot reject site and associated pending resources when the site has more than ${MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE} pending resources`
+                )
+            );
+        }
+
+        const [deletedNewt] = await db
+            .select()
+            .from(newts)
+            .where(eq(newts.siteId, siteId))
+            .limit(1);
+
+        let resourceSideEffects: DeleteSiteAssociatedResourcesSideEffects = {
+            resources: [],
+            siteResources: []
+        };
+
+        await db.transaction(async (trx) => {
+            resourceSideEffects = await deletePendingAssociatedResourcesForSite(
+                siteId,
+                site.orgId,
+                trx
+            );
+
+            if (resourceSideEffects.resources.length > 0) {
+                await usageService.add(
+                    site.orgId,
+                    LimitId.PUBLIC_RESOURCES,
+                    -resourceSideEffects.resources.length,
+                    trx
+                );
+            }
+
+            if (resourceSideEffects.siteResources.length > 0) {
+                await usageService.add(
+                    site.orgId,
+                    LimitId.PRIVATE_RESOURCES,
+                    -resourceSideEffects.siteResources.length,
+                    trx
+                );
+            }
+        });
+
+        await runDeleteSiteAssociatedResourcesSideEffects(resourceSideEffects);
+
+        await db.transaction(async (trx) => {
+            if (site.type == "wireguard") {
+                if (site.pubKey) {
+                    await deletePeer(site.exitNodeId!, site.pubKey);
+                }
+            } else if (site.type == "newt") {
+                await cleanupSiteAssociations(site, trx);
+            }
+
+            await trx.delete(sites).where(eq(sites.siteId, siteId));
+            await usageService.add(site.orgId, LimitId.SITES, -1, trx);
+        });
+
+        if (deletedNewt) {
+            const payload = {
+                type: `newt/wg/terminate`,
+                data: {}
+            };
+            sendToClient(deletedNewt.newtId, payload).catch((error) => {
+                logger.error(
+                    "Failed to send termination message to newt:",
+                    error
+                );
+            });
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Site rejected successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}
@@ -21,7 +21,6 @@ const updateSiteBodySchema = z
        name: z.string().min(1).max(255).optional(),
        niceId: z.string().min(1).max(255).optional(),
        dockerSocketEnabled: z.boolean().optional(),
-        status: z.enum(["pending", "approved"]).optional(),
        autoUpdateEnabled: z.boolean().optional(),
        autoUpdateOverrideOrg: z.boolean().optional()
    })
@@ -56,7 +56,6 @@ const createSiteResourceSchema = z
        siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
        destinationPort: z.int().positive().optional(),
        destination: z.string().min(1).nullish(),
-        enabled: z.boolean().default(true),
        alias: z
            .string()
            .regex(
@@ -275,7 +274,6 @@ export async function createSiteResource(
            scheme,
            destinationPort,
            destination,
-            enabled,
            ssl,
            alias,
            userIds,
@@ -539,7 +537,6 @@ export async function createSiteResource(
                    destination: destination, // the ssh can be null
                    scheme,
                    destinationPort,
-                    enabled,
                    alias: alias ? alias.trim() : null,
                    aliasAddress,
                    tcpPortRangeString: tcpPortRangeStringAdjusted,
@@ -86,6 +86,15 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
        description:
            "When set, only site resources associated with this site (via network) are returned"
    }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        }),
    labels: z
        .preprocess((val) => {
            if (val === undefined || val === null || val === "") {
@@ -283,6 +292,7 @@ export async function listAllSiteResourcesByOrg(
            sort_by,
            order,
            siteId,
+            status,
            labels: labelFilter
        } = parsedQuery.data;

@@ -315,6 +325,10 @@ export async function listAllSiteResourcesByOrg(
            conditions.push(eq(siteResources.mode, mode));
        }

+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
        if (labelFilter && labelFilter.length > 0) {
            conditions.push(
                inArray(
@@ -47,6 +47,15 @@ const listSiteResourcesQuerySchema = z.strictObject({
            enum: ["asc", "desc"],
            default: "asc",
            description: "Sort order"
+        }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
        })
 });

@@ -110,7 +119,7 @@ export async function listSiteResources(
        }

        const { siteId, orgId } = parsedParams.data;
-        const { limit, offset, sort_by, order } = parsedQuery.data;
+        const { limit, offset, sort_by, order, status } = parsedQuery.data;

        // Verify the site exists and belongs to the org
        const site = await db
@@ -124,6 +133,15 @@ export async function listSiteResources(
        }

        // Get site resources by joining networks to siteResources via siteNetworks
+        const conditions = [
+            eq(siteNetworks.siteId, siteId),
+            eq(siteResources.orgId, orgId)
+        ];
+
+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
        const siteResourcesList = await db
            .select()
            .from(siteNetworks)
@@ -132,12 +150,7 @@ export async function listSiteResources(
                siteResources,
                eq(siteResources.networkId, networks.networkId)
            )
-            .where(
-                and(
-                    eq(siteNetworks.siteId, siteId),
-                    eq(siteResources.orgId, orgId)
-                )
-            )
+            .where(and(...conditions))
            .orderBy(
                sort_by
                    ? order === "asc"
@@ -152,6 +152,11 @@ const updateSiteResourceSchema = z
    )
    .refine(
        (data) => {
+            // this is a partial update; only enforce destination when the
+            // caller is actually changing mode or destination
+            if (data.mode === undefined && data.destination === undefined) {
+                return true;
+            }
            // destination is only optional for ssh mode with native authDaemonMode
            if (data.mode === "ssh" && data.authDaemonMode === "native") {
                return true;
@@ -411,8 +416,10 @@ export async function updateSiteResource(
            : [];
        const existingSiteIds = existingSiteNetworks.map((sn) => sn.siteId);

-        let fullDomain: string | null = null;
-        let finalSubdomain: string | null = null;
+        // undefined means "leave unchanged" (partial update); only nulled out
+        // when the mode is explicitly being changed away from http
+        let fullDomain: string | null | undefined = undefined;
+        let finalSubdomain: string | null | undefined = undefined;
        if (domainId) {
            // Validate domain and construct full domain
            const domainResult = await validateAndConstructDomain(
@@ -448,6 +455,11 @@ export async function updateSiteResource(
                    )
                );
            }
+        } else if (mode !== undefined && mode !== "http") {
+            // mode is explicitly changing away from http, so the resource
+            // can no longer have a domain associated with it
+            fullDomain = null;
+            finalSubdomain = null;
        }

        // make sure the alias is unique within the org if provided
@@ -516,15 +528,28 @@ export async function updateSiteResource(
                    destination: destination,
                    destinationPort: destinationPort,
                    enabled: enabled,
-                    alias: alias ? alias.trim() : null,
+                    alias:
+                        alias !== undefined
+                            ? alias
+                                ? alias.trim()
+                                : null
+                            : mode !== undefined &&
+                                mode !== "host" &&
+                                mode !== "ssh"
+                              ? null
+                              : undefined,
                    tcpPortRangeString: tcpPortRangeStringAdjusted,
                    udpPortRangeString:
                        mode == "http" || mode == "ssh"
                            ? ""
                            : udpPortRangeString,
                    disableIcmp:
-                        disableIcmp ||
-                        (mode == "http" || mode == "ssh" ? true : false),
+                        mode !== undefined
+                            ? disableIcmp ||
+                              (mode == "http" || mode == "ssh"
+                                  ? true
+                                  : false)
+                            : disableIcmp,
                    domainId,
                    subdomain: finalSubdomain,
                    fullDomain,
@@ -29,7 +29,7 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
 import { useActionState, useEffect } from "react";
 import { useForm } from "react-hook-form";
-import { PrivateResourceAccessFields } from "../../PrivateResourceAccessFields";
+import { PrivateResourceAccessFields } from "@app/components/PrivateResourceAccessFields";

 export default function PrivateResourceAccessPage() {
    const t = useTranslations();
@@ -20,12 +20,12 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
-import { PrivateResourceCidrDestinationField } from "../../PrivateResourceDestinationFields";
-import { PrivateResourcePortRanges } from "../../PrivateResourcePortRanges";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
-import { asAnyControl, asAnySetValue } from "../../formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
+import { PrivateResourceCidrDestinationField } from "@app/components/PrivateResourceDestinationFields";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
+import { asAnyControl, asAnySetValue } from "@app/lib/formControlUtils";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";

 export default function PrivateResourceCidrPage() {
    const t = useTranslations();
@@ -16,19 +16,21 @@ import { Button } from "@app/components/ui/button";
 import {
    Form,
    FormControl,
+    FormDescription,
    FormField,
    FormItem,
    FormLabel,
    FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
+import { SwitchInput } from "@app/components/SwitchInput";
 import { createGeneralFormSchema } from "@app/lib/privateResourceForm";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useTranslations } from "next-intl";
 import { useActionState, useMemo } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";

 export default function PrivateResourceGeneralPage() {
    const t = useTranslations();
@@ -41,7 +43,8 @@ export default function PrivateResourceGeneralPage() {
        resolver: zodResolver(formSchema),
        defaultValues: {
            name: siteResource.name,
-            niceId: siteResource.niceId
+            niceId: siteResource.niceId,
+            enabled: siteResource.enabled
        }
    });

@@ -52,7 +55,8 @@ export default function PrivateResourceGeneralPage() {
        const data = form.getValues();
        await save({
            name: data.name,
-            niceId: data.niceId
+            niceId: data.niceId,
+            enabled: data.enabled
        });
    }, null);

@@ -64,7 +68,7 @@ export default function PrivateResourceGeneralPage() {
                        {t("resourceGeneral")}
                    </SettingsSectionTitle>
                    <SettingsSectionDescription>
-                        {t("resourceGeneralDescription")}
+                        {t("privateResourceGeneralDescription")}
                    </SettingsSectionDescription>
                </SettingsSectionHeader>

@@ -76,6 +80,42 @@ export default function PrivateResourceGeneralPage() {
                                id="private-resource-general-form"
                            >
                                <SettingsFormGrid>
+                                    <SettingsFormCell span="full">
+                                        <FormField
+                                            control={form.control}
+                                            name="enabled"
+                                            render={() => (
+                                                <FormItem>
+                                                    <FormControl>
+                                                        <SwitchInput
+                                                            id="enable-resource"
+                                                            defaultChecked={
+                                                                siteResource.enabled
+                                                            }
+                                                            label={t(
+                                                                "resourceEnable"
+                                                            )}
+                                                            onCheckedChange={(
+                                                                val
+                                                            ) =>
+                                                                form.setValue(
+                                                                    "enabled",
+                                                                    val
+                                                                )
+                                                            }
+                                                        />
+                                                    </FormControl>
+                                                    <FormDescription>
+                                                        {t(
+                                                            "disabledResourceDescription"
+                                                        )}
+                                                    </FormDescription>
+                                                    <FormMessage />
+                                                </FormItem>
+                                            )}
+                                        />
+                                    </SettingsFormCell>
+
                                    <SettingsFormCell span="half">
                                        <FormField
                                            control={form.control}
@@ -20,16 +20,16 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
-import { PrivateResourceHostDestinationFields } from "../../PrivateResourceDestinationFields";
-import { PrivateResourcePortRanges } from "../../PrivateResourcePortRanges";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
+import { PrivateResourceHostDestinationFields } from "@app/components/PrivateResourceDestinationFields";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
    asAnyControl,
    asAnySetValue,
    asAnyWatch
-} from "../../formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+} from "@app/lib/formControlUtils";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";

 export default function PrivateResourceHostPage() {
    const t = useTranslations();
@@ -22,15 +22,15 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../../PrivateResourceSitesField";
-import { PrivateResourceHttpFields } from "../../PrivateResourceHttpFields";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
+import { PrivateResourceHttpFields } from "@app/components/PrivateResourceHttpFields";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
    asAnyControl,
    asAnySetValue,
    asAnyWatch
-} from "../../formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
+} from "@app/lib/formControlUtils";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";

 export default function PrivateResourceHttpPage() {
    const t = useTranslations();
@@ -26,15 +26,15 @@ import { useTranslations } from "next-intl";
 import { useActionState, useMemo, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSshFields } from "../../PrivateResourceSshFields";
-import { buildSelectedSitesForResource } from "../../privateResourceUtils";
+import { PrivateResourceSshFields } from "@app/components/PrivateResourceSshFields";
+import type { Selectedsite } from "@app/components/site-selector";
+import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
 import {
    asAnyControl,
    asAnySetValue,
    asAnyWatch
-} from "../../formControlUtils";
-import { useSaveSiteResource } from "../../useSaveSiteResource";
-import type { Selectedsite } from "@app/components/site-selector";
+} from "@app/lib/formControlUtils";
+import { buildSelectedSitesForResource } from "@app/lib/privateResourceUtils";

 export default function PrivateResourceSshPage() {
    const t = useTranslations();
@@ -50,16 +50,20 @@ import { useParams, useRouter, useSearchParams } from "next/navigation";
 import { useEffect, useMemo, useState, useTransition } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import { PrivateResourceSitesField } from "../PrivateResourceSitesField";
-import { PrivateResourceHttpFields } from "../PrivateResourceHttpFields";
-import { PrivateResourceSshFields } from "../PrivateResourceSshFields";
-import { PrivateResourcePortRanges } from "../PrivateResourcePortRanges";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
+import { PrivateResourceHttpFields } from "@app/components/PrivateResourceHttpFields";
+import { PrivateResourceSshFields } from "@app/components/PrivateResourceSshFields";
+import { PrivateResourcePortRanges } from "@app/components/PrivateResourcePortRanges";
 import {
    PrivateResourceAliasField,
    PrivateResourceCidrDestinationField,
    PrivateResourceHostDestinationFields
-} from "../PrivateResourceDestinationFields";
-import { asAnyControl, asAnySetValue, asAnyWatch } from "../formControlUtils";
+} from "@app/components/PrivateResourceDestinationFields";
+import {
+    asAnyControl,
+    asAnySetValue,
+    asAnyWatch
+} from "@app/lib/formControlUtils";

 export default function CreatePrivateResourcePage() {
    const params = useParams();
@@ -27,6 +27,7 @@ export default async function ClientResourcesPage(
    const params = await props.params;
    const t = await getTranslations();
    const searchParams = new URLSearchParams(await props.searchParams);
+    searchParams.set("status", "approved");

    let siteResources: ListAllSiteResourcesByOrgResponse["siteResources"] = [];
    let pagination: ListAllSiteResourcesByOrgResponse["pagination"] = {
@@ -38,6 +38,7 @@ export default async function ProxyResourcesPage(
    const params = await props.params;
    const t = await getTranslations();
    const searchParams = new URLSearchParams(await props.searchParams);
+    searchParams.set("status", "approved");

    let resources: ListResourcesResponse["resources"] = [];
    let pagination: ListResourcesResponse["pagination"] = {
@@ -16,8 +16,11 @@ import LoginCardHeader from "@app/components/LoginCardHeader";
 import { priv } from "@app/lib/api";
 import { AxiosResponse } from "axios";
 import { LoginFormIDP } from "@app/components/LoginForm";
-import { ListIdpsResponse } from "@server/routers/idp";
+import { ListIdpsResponse, type GetIdpResponse } from "@server/routers/idp";
 import type { Metadata } from "next";
+import { cookies } from "next/headers";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import z from "zod";

 export const metadata: Metadata = {
    title: "Log In"
@@ -29,8 +32,9 @@ export default async function Page(props: {
    searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }) {
    const searchParams = await props.searchParams;
-    const getUser = cache(verifySession);
-    const user = await getUser({ skipCheckVerifyEmail: true });
+    const user = await verifySession({ skipCheckVerifyEmail: true });
+
+    const lastUsedIdpCookie = (await cookies()).get(LAST_USED_IDP_COOKIE_NAME);

    const isInvite = searchParams?.redirect?.includes("/invite");
    const forceLoginParam = searchParams?.forceLogin;
@@ -85,19 +89,47 @@ export default async function Page(props: {
        (build === "enterprise" && env.app.identityProviderMode === "org");

    let loginIdps: LoginFormIDP[] = [];
+    let lastUsedIdpForSmartLogin: (LoginFormIDP & { orgId?: string }) | null =
+        null;
    if (!useSmartLogin) {
        // Load IdPs for DashboardLoginForm (OSS or org-only IdP mode)
        if (build === "oss" || env.app.identityProviderMode !== "org") {
-            const idpsRes = await cache(
-                async () =>
-                    await priv.get<AxiosResponse<ListIdpsResponse>>("/idp")
-            )();
+            const idpsRes =
+                await priv.get<AxiosResponse<ListIdpsResponse>>("/idp");
            loginIdps = idpsRes.data.data.idps.map((idp) => ({
                idpId: idp.idpId,
                name: idp.name,
                variant: idp.type
            })) as LoginFormIDP[];
        }
+    } else {
+        if (lastUsedIdpCookie) {
+            const lastUsedIdpSchema = z.object({
+                orgId: z.string().optional(),
+                idpId: z.number()
+            });
+            try {
+                const persistedData = lastUsedIdpSchema.parse(
+                    JSON.parse(lastUsedIdpCookie.value)
+                );
+
+                const idpRes = await priv.get<AxiosResponse<GetIdpResponse>>(
+                    `/idp/${persistedData.idpId}`
+                );
+
+                const idp = idpRes.data.data.idp;
+
+                lastUsedIdpForSmartLogin = {
+                    idpId: idp.idpId,
+                    name: idp.name,
+                    variant: idp.type,
+                    orgId: persistedData.orgId,
+                    lastUsed: true
+                };
+            } catch (error) {
+                // the idp might not exist or the data is malformatted, skip this
+            }
+        }
    }

    const t = await getTranslations();
@@ -160,6 +192,7 @@ export default async function Page(props: {
                                redirect={redirectUrl}
                                forceLogin={forceLogin}
                                defaultUser={defaultUser}
+                                lastUsedIdp={lastUsedIdpForSmartLogin}
                                orgSignIn={
                                    !isInvite &&
                                    (build === "saas" ||
@@ -13,6 +13,8 @@ import { redirect } from "next/navigation";
 import OrgLoginPage from "@app/components/OrgLoginPage";
 import { pullEnv } from "@app/lib/pullEnv";
 import type { Metadata } from "next";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";

 export const metadata: Metadata = {
    title: "Organization Login"
@@ -68,15 +70,22 @@ export default async function OrgAuthPage(props: {
        variant: idp.variant
    })) as LoginFormIDP[];

+    const hasLoginPageBranding = await isOrgSubscribed(
+        orgId,
+        tierMatrix.loginPageBranding
+    );
+
    let branding: LoadLoginPageBrandingResponse | null = null;
-    try {
-        const res = await priv.get<
-            AxiosResponse<LoadLoginPageBrandingResponse>
-        >(`/login-page-branding?orgId=${orgId}`);
-        if (res.status === 200) {
-            branding = res.data.data;
-        }
-    } catch (error) {}
+    if (hasLoginPageBranding) {
+        try {
+            const res = await priv.get<
+                AxiosResponse<LoadLoginPageBrandingResponse>
+            >(`/login-page-branding?orgId=${orgId}`);
+            if (res.status === 200) {
+                branding = res.data.data;
+            }
+        } catch (error) {}
+    }

    return (
        <OrgLoginPage
@@ -19,6 +19,7 @@ import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";
 import { OrgSelectionForm } from "@app/components/OrgSelectionForm";
 import OrgLoginPage from "@app/components/OrgLoginPage";
 import type { Metadata } from "next";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";

 export const metadata: Metadata = {
    title: "Choose Organization"
@@ -83,7 +84,10 @@ export default async function OrgAuthPage(props: {
            redirect(env.app.dashboardUrl);
        }

-        const subscribed = await isOrgSubscribed(loginPage.orgId);
+        const subscribed = await isOrgSubscribed(
+            loginPage.orgId,
+            tierMatrix.loginPageDomain
+        );

        if (build === "saas" && !subscribed) {
            console.log(
@@ -27,6 +27,7 @@ import { CheckOrgUserAccessResponse } from "@server/routers/org";
 import OrgPolicyRequired from "@app/components/OrgPolicyRequired";
 import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";
 import { normalizePostAuthPath } from "@server/lib/normalizePostAuthPath";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type { Metadata } from "next";

 export const metadata: Metadata = {
@@ -70,14 +71,25 @@ export default async function ResourceAuthPage(props: {
        );
    }

-    const subscribed = await isOrgSubscribed(authInfo.orgId);
+    const hasLoginPageDomain = await isOrgSubscribed(
+        authInfo.orgId,
+        tierMatrix.loginPageDomain
+    );
+    const hasOrgOidc = await isOrgSubscribed(
+        authInfo.orgId,
+        tierMatrix.orgOidc
+    );
+    const hasLoginPageBranding = await isOrgSubscribed(
+        authInfo.orgId,
+        tierMatrix.loginPageBranding
+    );

    const allHeaders = await headers();
    const host = allHeaders.get("host");

    const expectedHost = env.app.dashboardUrl.split("//")[1];
    if (host !== expectedHost) {
-        if (build === "saas" && !subscribed) {
+        if (build === "saas" && !hasLoginPageDomain) {
            redirect(env.app.dashboardUrl);
        }

@@ -106,7 +118,10 @@ export default async function ResourceAuthPage(props: {
            const redirectPort = new URL(searchParams.redirect).port;
            const serverResourceHostWithPort = `${serverResourceHost}:${redirectPort}`;

-            const wildcardMatchesRedirect = (wildcardDomain: string, host: string): boolean => {
+            const wildcardMatchesRedirect = (
+                wildcardDomain: string,
+                host: string
+            ): boolean => {
                if (!wildcardDomain.startsWith("*.")) return false;
                const suffix = wildcardDomain.slice(1); // e.g. ".wildcard.owen.fosrl.io"
                return host.endsWith(suffix) && host.length > suffix.length;
@@ -228,7 +243,7 @@ export default async function ResourceAuthPage(props: {

    let loginIdps: LoginFormIDP[] = [];
    if (build === "saas" || env.app.identityProviderMode === "org") {
-        if (subscribed) {
+        if (hasOrgOidc) {
            const idpsRes = await cache(
                async () =>
                    await priv.get<AxiosResponse<ListOrgIdpsResponse>>(
@@ -271,7 +286,7 @@ export default async function ResourceAuthPage(props: {

    let branding: LoadLoginPageBrandingResponse | null = null;
    try {
-        if (subscribed) {
+        if (hasLoginPageBranding) {
            const res = await priv.get<
                AxiosResponse<LoadLoginPageBrandingResponse>
            >(`/login-page-branding?orgId=${authInfo.orgId}`);
@@ -5,7 +5,6 @@ import UserProvider from "@app/providers/UserProvider";
 import { ListUserOrgsResponse } from "@server/routers/org";
 import { AxiosResponse } from "axios";
 import { redirect } from "next/navigation";
-import { cache } from "react";
 import OrganizationLanding from "@app/components/OrganizationLanding";
 import { pullEnv } from "@app/lib/pullEnv";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
@@ -13,7 +12,6 @@ import { Layout } from "@app/components/Layout";
 import RedirectToOrg from "@app/components/RedirectToOrg";
 import { InitialSetupCompleteResponse } from "@server/routers/auth";
 import { cookies } from "next/headers";
-import { build } from "@server/build";

 export const dynamic = "force-dynamic";

@@ -29,8 +27,7 @@ export default async function Page(props: {

    const env = pullEnv();

-    const getUser = cache(verifySession);
-    const user = await getUser({ skipCheckVerifyEmail: true });
+    const user = await verifySession({ skipCheckVerifyEmail: true });

    let complete = false;
    try {
@@ -1,26 +1,25 @@
 "use client";

-import { useEffect, useState } from "react";
-import { Button } from "@app/components/ui/button";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
-import { useTranslations } from "next-intl";
+import { generateOidcUrlProxy } from "@app/actions/server";
 import IdpTypeIcon from "@app/components/IdpTypeIcon";
-import {
-    generateOidcUrlProxy,
-    type GenerateOidcUrlResponse
-} from "@app/actions/server";
+import { Alert, AlertDescription } from "@app/components/ui/alert";
+import { Button } from "@app/components/ui/button";
+import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import { setClientCookie } from "@app/lib/setClientCookie";
+import { useTranslations } from "next-intl";
 import {
    redirect as redirectTo,
-    useParams,
+    useRouter,
    useSearchParams
 } from "next/navigation";
-import { useRouter } from "next/navigation";
-import { cleanRedirect } from "@app/lib/cleanRedirect";
+import { useEffect, useState, useTransition } from "react";

 export type LoginFormIDP = {
    idpId: number;
    name: string;
    variant?: string;
+    lastUsed?: boolean;
 };

 type IdpLoginButtonsProps = {
@@ -35,7 +34,6 @@ export default function IdpLoginButtons({
    orgId
 }: IdpLoginButtonsProps) {
    const [error, setError] = useState<string | null>(null);
-    const [loading, setLoading] = useState(false);
    const t = useTranslations();

    const params = useSearchParams();
@@ -52,10 +50,22 @@ export default function IdpLoginButtons({
        }
    }, []);

+    const [loading, startTransition] = useTransition();
+
    async function loginWithIdp(idpId: number) {
-        setLoading(true);
        setError(null);

+        setClientCookie(
+            LAST_USED_IDP_COOKIE_NAME,
+            JSON.stringify({
+                orgId,
+                idpId
+            }),
+            {
+                sameSite: "Lax"
+            }
+        );
+
        let redirectToUrl: string | undefined;
        try {
            console.log("generating", idpId, redirect || "/", orgId);
@@ -68,7 +78,6 @@ export default function IdpLoginButtons({

            if (response.error) {
                setError(response.message);
-                setLoading(false);
                return;
            }

@@ -84,7 +93,6 @@ export default function IdpLoginButtons({
                        "An unexpected error occurred. Please try again."
                })
            );
-            setLoading(false);
        }

        if (redirectToUrl) {
@@ -124,20 +132,38 @@ export default function IdpLoginButtons({
                                idp.variant || idp.name.toLowerCase();

                            return (
-                                <Button
+                                <div
+                                    className="w-full relative"
                                    key={idp.idpId}
-                                    type="button"
-                                    variant="outline"
-                                    className="w-full inline-flex items-center space-x-2"
-                                    onClick={() => {
-                                        loginWithIdp(idp.idpId);
-                                    }}
-                                    disabled={loading}
-                                    loading={loading}
                                >
-                                    <IdpTypeIcon type={effectiveType} size={16} />
-                                    <span>{idp.name}</span>
-                                </Button>
+                                    <Button
+                                        key={idp.idpId}
+                                        type="button"
+                                        variant="outline"
+                                        className="w-full inline-flex items-center space-x-2  after:absolute after:inset-0 after:z-10"
+                                        onClick={() => {
+                                            startTransition(() =>
+                                                loginWithIdp(idp.idpId)
+                                            );
+                                        }}
+                                        disabled={loading}
+                                        loading={loading}
+                                    >
+                                        <IdpTypeIcon
+                                            type={effectiveType}
+                                            size={16}
+                                        />
+                                        <span>{idp.name}</span>
+                                    </Button>
+
+                                    {idp.lastUsed && (
+                                        <div className="absolute inset-0">
+                                            <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
+                                                {t("idpLastUsed")}
+                                            </span>
+                                        </div>
+                                    )}
+                                </div>
                            );
                        })}
                    </>
@@ -30,10 +30,7 @@ import Link from "next/link";
 import { GenerateOidcUrlResponse } from "@server/routers/idp";
 import { Separator } from "./ui/separator";
 import { useTranslations } from "next-intl";
-import {
-    generateOidcUrlProxy,
-    loginProxy
-} from "@app/actions/server";
+import { generateOidcUrlProxy, loginProxy } from "@app/actions/server";
 import { redirect as redirectTo } from "next/navigation";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import IdpTypeIcon from "@app/components/IdpTypeIcon";
@@ -41,11 +38,13 @@ import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import { loadReoScript } from "reodotdev";
 import { build } from "@server/build";
 import MfaInputForm from "@app/components/MfaInputForm";
+import { useLocalStorage } from "@app/hooks/useLocalStorage";

 export type LoginFormIDP = {
    idpId: number;
    name: string;
    variant?: string;
+    lastUsed?: boolean;
 };

 type LoginFormProps = {
@@ -105,7 +104,6 @@ export default function LoginForm({
        }
    }, []);

-
    const formSchema = z.object({
        email: z.string().email({ message: t("emailInvalid") }),
        password: z.string().min(8, { message: t("passwordRequirementsChars") })
@@ -130,11 +128,16 @@ export default function LoginForm({
        }
    });

+    const [lastUsedIdpId, setLastUsedIdpId] = useLocalStorage<string | null>(
+        "login:last-used-idp",
+        null
+    );

    async function onSubmit(values: any) {
        const { email, password } = form.getValues();
        const { code } = mfaForm.getValues();

+        setLastUsedIdpId(null);
        setLoading(true);
        setError(null);

@@ -179,8 +182,7 @@ export default function LoginForm({
            if (data.useSecurityKey) {
                setError(
                    t("securityKeyRequired", {
-                        defaultValue:
-                            "Please use your security key to sign in."
+                        defaultValue: "Please use your security key to sign in."
                    })
                );
                return;
@@ -242,6 +244,8 @@ export default function LoginForm({

    async function loginWithIdp(idpId: number) {
        let redirectUrl: string | undefined;
+
+        setLastUsedIdpId(idpId.toString());
        try {
            const data = await generateOidcUrlProxy(
                idpId,
@@ -356,7 +360,6 @@ export default function LoginForm({
            )}

            <div className="space-y-4">
-
                {!mfaRequested && (
                    <>
                        <SecurityKeyAuthButton
@@ -385,25 +388,41 @@ export default function LoginForm({
                                        idp.variant || idp.name.toLowerCase();

                                    return (
-                                        <Button
+                                        <div
+                                            className="w-full relative"
                                            key={idp.idpId}
-                                            type="button"
-                                            variant="outline"
-                                            className="w-full inline-flex items-center space-x-2"
-                                            onClick={() => {
-                                                loginWithIdp(idp.idpId);
-                                            }}
                                        >
-                                            <IdpTypeIcon type={effectiveType} size={16} />
-                                            <span>{idp.name}</span>
-                                        </Button>
+                                            <Button
+                                                key={idp.idpId}
+                                                type="button"
+                                                variant="outline"
+                                                className="w-full inline-flex items-center space-x-2 after:absolute after:inset-0 after:z-10"
+                                                onClick={() => {
+                                                    loginWithIdp(idp.idpId);
+                                                }}
+                                            >
+                                                <IdpTypeIcon
+                                                    type={effectiveType}
+                                                    size={16}
+                                                />
+                                                <span>{idp.name}</span>
+                                            </Button>
+
+                                            {lastUsedIdpId ===
+                                                idp.idpId.toString() && (
+                                                <div className="absolute inset-0">
+                                                    <span className="absolute top-0 right-0 text-xs bg-primary text-primary-foreground rounded-bl-sm rounded-tr-sm px-2 py-0.5">
+                                                        {t("idpLastUsed")}
+                                                    </span>
+                                                </div>
+                                            )}
+                                        </div>
                                    );
                                })}
                            </>
                        )}
                    </>
                )}
-
            </div>
        </div>
    );
@@ -22,6 +22,8 @@ import Link from "next/link";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
 import MfaInputForm from "@app/components/MfaInputForm";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";
+import { setClientCookie } from "@app/lib/setClientCookie";

 type LoginPasswordFormProps = {
    identifier: string;
@@ -82,6 +84,12 @@ export default function LoginPasswordForm({
        const { password } = values;
        const { code } = mfaForm.getValues();

+        // delete last used auth cookie by setting it in the past
+        setClientCookie(LAST_USED_IDP_COOKIE_NAME, JSON.stringify(null), {
+            sameSite: "Lax",
+            days: -1
+        });
+
        setLoading(true);
        setError(null);

@@ -1,6 +1,16 @@
 "use client";

 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
+import {
+    Credenza,
+    CredenzaBody,
+    CredenzaContent,
+    CredenzaDescription,
+    CredenzaFooter,
+    CredenzaHeader,
+    CredenzaTitle
+} from "@app/components/Credenza";
+import SiteResourcesOverview from "@app/components/SiteResourcesOverview";
 import { Badge } from "@app/components/ui/badge";
 import { Button } from "@app/components/ui/button";
 import {
@@ -24,6 +34,7 @@ import {
    ArrowUp10Icon,
    ArrowUpRight,
    Check,
+    ChevronDown,
    ChevronsUpDownIcon,
    MoreHorizontal,
    X
@@ -65,8 +76,10 @@ export default function PendingSitesTable({
    const [isRefreshing, startTransition] = useTransition();
    const [approvingIds, setApprovingIds] = useState<Set<number>>(new Set());
    const [rejectingIds, setRejectingIds] = useState<Set<number>>(new Set());
-    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [isRejectModalOpen, setIsRejectModalOpen] = useState(false);
    const [selectedSite, setSelectedSite] = useState<SiteRow | null>(null);
+    const [resourcesDialogSite, setResourcesDialogSite] =
+        useState<SiteRow | null>(null);

    const api = createApiClient(useEnvContext());
    const t = useTranslations();
@@ -111,7 +124,7 @@ export default function PendingSitesTable({
    async function approveSite(siteId: number) {
        setApprovingIds((prev) => new Set(prev).add(siteId));
        try {
-            await api.post(`/site/${siteId}`, { status: "approved" });
+            await api.post(`/site/${siteId}/approve`);
            toast({
                title: t("success"),
                description: t("siteApproveSuccess"),
@@ -136,20 +149,20 @@ export default function PendingSitesTable({
    async function rejectSite(siteId: number) {
        setRejectingIds((prev) => new Set(prev).add(siteId));
        try {
-            await api.delete(`/site/${siteId}`);
+            await api.post(`/site/${siteId}/reject`);
            toast({
                title: t("success"),
-                description: t("siteDeleted"),
+                description: t("siteRejectSuccess"),
                variant: "default"
            });
-            setIsDeleteModalOpen(false);
+            setIsRejectModalOpen(false);
            setSelectedSite(null);
            router.refresh();
        } catch (e) {
            toast({
                variant: "destructive",
-                title: t("siteErrorDelete"),
-                description: formatAxiosError(e, t("siteErrorDelete"))
+                title: t("siteRejectError"),
+                description: formatAxiosError(e, t("siteRejectError"))
            });
        } finally {
            setRejectingIds((prev) => {
@@ -342,6 +355,29 @@ export default function PendingSitesTable({
                }
            }
        },
+        {
+            id: "resources",
+            accessorKey: "resourceCount",
+            friendlyName: t("resources"),
+            header: () => <span className="p-3">{t("resources")}</span>,
+            cell: ({ row }) => {
+                const siteRow = row.original;
+                return (
+                    <Button
+                        type="button"
+                        variant="ghost"
+                        size="sm"
+                        onClick={() => setResourcesDialogSite(siteRow)}
+                        className="flex h-8 items-center gap-2 px-0 font-normal"
+                    >
+                        <span className="text-sm tabular-nums">
+                            {siteRow.resourceCount} {t("resources")}
+                        </span>
+                        <ChevronDown className="h-3 w-3 shrink-0" />
+                    </Button>
+                );
+            }
+        },
        {
            accessorKey: "exitNode",
            friendlyName: t("exitNode"),
@@ -445,7 +481,7 @@ export default function PendingSitesTable({
                            disabled={isApproving || isRejecting}
                            onClick={() => {
                                setSelectedSite(siteRow);
-                                setIsDeleteModalOpen(true);
+                                setIsRejectModalOpen(true);
                            }}
                        >
                            <X className="mr-2 w-4 h-4" />
@@ -491,25 +527,63 @@ export default function PendingSitesTable({

    return (
        <>
+            <Credenza
+                open={Boolean(resourcesDialogSite)}
+                onOpenChange={(open) => {
+                    if (!open) setResourcesDialogSite(null);
+                }}
+            >
+                <CredenzaContent className="md:max-w-7xl">
+                    <CredenzaHeader>
+                        <CredenzaTitle>{t("siteResourcesTab")}</CredenzaTitle>
+                        <CredenzaDescription>
+                            {t("siteResourcesDialogDescription")}
+                        </CredenzaDescription>
+                    </CredenzaHeader>
+                    <CredenzaBody>
+                        {resourcesDialogSite != null && (
+                            <SiteResourcesOverview
+                                orgIdOverride={orgId}
+                                siteId={resourcesDialogSite.id}
+                                initialPublicData={null}
+                                initialPrivateData={null}
+                                initialPublicForbidden={false}
+                                initialPrivateForbidden={false}
+                                showViewAllLinks={false}
+                            />
+                        )}
+                    </CredenzaBody>
+                    <CredenzaFooter>
+                        <Button
+                            type="button"
+                            variant="outline"
+                            onClick={() => setResourcesDialogSite(null)}
+                        >
+                            {t("close")}
+                        </Button>
+                    </CredenzaFooter>
+                </CredenzaContent>
+            </Credenza>
+
            {selectedSite && (
                <ConfirmDeleteDialog
-                    open={isDeleteModalOpen}
+                    open={isRejectModalOpen}
                    setOpen={(val) => {
-                        setIsDeleteModalOpen(val);
+                        setIsRejectModalOpen(val);
                        if (!val) {
                            setSelectedSite(null);
                        }
                    }}
                    dialog={
                        <div className="space-y-2">
-                            <p>{t("siteQuestionRemove")}</p>
-                            <p>{t("siteMessageRemove")}</p>
+                            <p>{t("siteQuestionReject")}</p>
+                            <p>{t("siteMessageReject")}</p>
                        </div>
                    }
-                    buttonText={t("siteConfirmDelete")}
+                    buttonText={t("siteConfirmReject")}
                    onConfirm={async () => rejectSite(selectedSite.id)}
                    string={selectedSite.name}
-                    title={t("siteDelete")}
+                    title={t("siteReject")}
                />
            )}
            <ControlledDataTable
@@ -55,6 +55,7 @@ function getActionsCategories(root: boolean) {
            [t("actionGetSite")]: "getSite",
            [t("actionListSites")]: "listSites",
            [t("actionUpdateSite")]: "updateSite",
+            [t("actionUpdateSiteApprovals")]: "updateSiteApprovals",
            [t("actionListSiteRoles")]: "listSiteRoles"
        },

@@ -77,7 +78,9 @@ function getActionsCategories(root: boolean) {
            [t("actionDeleteSiteResource")]: "deleteSiteResource",
            [t("actionGetSiteResource")]: "getSiteResource",
            [t("actionListSiteResources")]: "listSiteResources",
-            [t("actionUpdateSiteResource")]: "updateSiteResource"
+            [t("actionUpdateSiteResource")]: "updateSiteResource",
+            [t("actionCreateResourceSessionToken")]:
+                "createResourceSessionToken"
        },

        Target: {
@@ -106,17 +106,23 @@ export function PrivateResourceNetworkAccessFields({
    embedInParentGrid = false
 }: PrivateResourceNetworkAccessFieldsProps) {
    const t = useTranslations();
+    const resolvedInitialTcp = initialTcp !== undefined ? initialTcp : "*";
+    const resolvedInitialUdp = initialUdp !== undefined ? initialUdp : "*";
    const [tcpPortMode, setTcpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialTcp)
+        getPortModeFromString(resolvedInitialTcp)
    );
    const [udpPortMode, setUdpPortMode] = useState<PortMode>(() =>
-        getPortModeFromString(initialUdp)
+        getPortModeFromString(resolvedInitialUdp)
    );
    const [tcpCustomPorts, setTcpCustomPorts] = useState(() =>
-        initialTcp && initialTcp !== "*" ? initialTcp : ""
+        resolvedInitialTcp && resolvedInitialTcp !== "*"
+            ? resolvedInitialTcp
+            : ""
    );
    const [udpCustomPorts, setUdpCustomPorts] = useState(() =>
-        initialUdp && initialUdp !== "*" ? initialUdp : ""
+        resolvedInitialUdp && resolvedInitialUdp !== "*"
+            ? resolvedInitialUdp
+            : ""
    );

    useEffect(() => {
@@ -23,7 +23,7 @@ import {
 import { ChevronsUpDown } from "lucide-react";
 import { useTranslations } from "next-intl";
 import type { Control, FieldPath, FieldValues } from "react-hook-form";
-import { PrivateResourceMultiSiteRoutingHelp } from "./PrivateResourceMultiSiteRoutingHelp";
+import { PrivateResourceMultiSiteRoutingHelp } from "@app/components/PrivateResourceMultiSiteRoutingHelp";

 type PrivateResourceSitesFieldProps<T extends FieldValues> = {
    control: Control<T>;
@@ -9,10 +9,10 @@ import {
 } from "@app/components/Settings";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { SshServerSettingsFields } from "@app/components/SshServerSettingsFields";
-import { PrivateResourceAliasField } from "./PrivateResourceDestinationFields";
-import { PrivateResourceSitesField } from "./PrivateResourceSitesField";
-import { getSshUseMultiSiteTargetForm } from "./privateResourceUtils";
+import { PrivateResourceAliasField } from "@app/components/PrivateResourceDestinationFields";
+import { PrivateResourceSitesField } from "@app/components/PrivateResourceSitesField";
 import { inferSshPamMode } from "@app/lib/privateResourceForm";
+import { getSshUseMultiSiteTargetForm } from "@app/lib/privateResourceUtils";
 import {
    FormControl,
    FormField,
@@ -23,6 +23,7 @@ import {
    PopoverContent,
    PopoverTrigger
 } from "@app/components/ui/popover";
+import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
@@ -36,7 +37,9 @@ import { getPrivateResourceSettingsHref } from "@app/lib/launcherResourceAdminHr
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { UpdateSiteResourceResponse } from "@server/routers/siteResource";
 import type { PaginationState } from "@tanstack/react-table";
+import { AxiosResponse } from "axios";
 import {
    ArrowDown01Icon,
    ArrowRight,
@@ -49,8 +52,17 @@ import {
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
-import { startTransition, useMemo, useState, useTransition } from "react";
+import {
+    startTransition,
+    useMemo,
+    useOptimistic,
+    useRef,
+    useState,
+    useTransition,
+    type ComponentRef
+} from "react";
 import { useDebouncedCallback } from "use-debounce";
+import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
@@ -114,6 +126,11 @@ function isSafeUrlForLink(href: string): boolean {
    }
 }

+const booleanSearchFilterSchema = z
+    .enum(["true", "false"])
+    .optional()
+    .catch(undefined);
+
 type ClientResourcesTableProps = {
    internalResources: InternalResourceRow[];
    orgId: string;
@@ -174,6 +191,30 @@ export default function PrivateResourcesTable({
        });
    };

+    async function toggleInternalResourceEnabled(
+        val: boolean,
+        resourceId: number
+    ) {
+        try {
+            await api.post<AxiosResponse<UpdateSiteResourceResponse>>(
+                `site-resource/${resourceId}`,
+                {
+                    enabled: val
+                }
+            );
+            router.refresh();
+        } catch (e) {
+            toast({
+                variant: "destructive",
+                title: t("resourcesErrorUpdate"),
+                description: formatAxiosError(
+                    e,
+                    t("resourcesErrorUpdateDescription")
+                )
+            });
+        }
+    }
+
    const deleteInternalResource = async (
        resourceId: number,
        siteId: number
@@ -429,6 +470,36 @@ export default function PrivateResourcesTable({
                    );
                }
            },
+            {
+                accessorKey: "enabled",
+                friendlyName: t("enabled"),
+                header: () => (
+                    <ColumnFilterButton
+                        options={[
+                            { value: "true", label: t("enabled") },
+                            { value: "false", label: t("disabled") }
+                        ]}
+                        selectedValue={booleanSearchFilterSchema.parse(
+                            searchParams.get("enabled")
+                        )}
+                        onValueChange={(value) =>
+                            handleFilterChange("enabled", value)
+                        }
+                        searchPlaceholder={t("searchPlaceholder")}
+                        emptyMessage={t("emptySearchOptions")}
+                        label={t("enabled")}
+                        className="p-3"
+                    />
+                ),
+                cell: ({ row }) => (
+                    <InternalResourceEnabledForm
+                        resource={row.original}
+                        onToggleInternalResourceEnabled={
+                            toggleInternalResourceEnabled
+                        }
+                    />
+                )
+            },
            {
                id: "labels",
                accessorKey: "labels",
@@ -643,3 +714,39 @@ function ClientResourceLabelCell({
        />
    );
 }
+
+type InternalResourceEnabledFormProps = {
+    resource: InternalResourceRow;
+    onToggleInternalResourceEnabled: (
+        val: boolean,
+        resourceId: number
+    ) => Promise<void>;
+};
+
+function InternalResourceEnabledForm({
+    resource,
+    onToggleInternalResourceEnabled
+}: InternalResourceEnabledFormProps) {
+    const [optimisticEnabled, setOptimisticEnabled] = useOptimistic(
+        resource.enabled
+    );
+
+    const formRef = useRef<ComponentRef<"form">>(null);
+
+    async function submitAction(formData: FormData) {
+        const newEnabled = !(formData.get("enabled") === "on");
+        setOptimisticEnabled(newEnabled);
+        await onToggleInternalResourceEnabled(newEnabled, resource.id);
+    }
+
+    return (
+        <form action={submitAction} ref={formRef}>
+            <Switch
+                checked={optimisticEnabled}
+                disabled={optimisticEnabled !== resource.enabled}
+                name="enabled"
+                onCheckedChange={() => formRef.current?.requestSubmit()}
+            />
+        </form>
+    );
+}
@@ -174,8 +174,8 @@ type OverviewRow = {
 type OverviewColumnProps = {
    title: string;
    description: string;
-    viewAllHref: string;
-    viewAllLabel: string;
+    viewAllHref?: string;
+    viewAllLabel?: string;
    emptyLabel: string;
    isForbidden: boolean;
    isFetching: boolean;
@@ -212,12 +212,14 @@ function OverviewColumn({
                        {description}
                    </p>
                </div>
-                <Link
-                    href={viewAllHref}
-                    className="shrink-0 text-muted-foreground text-sm hover:underline"
-                >
-                    {viewAllLabel}
-                </Link>
+                {viewAllHref && viewAllLabel ? (
+                    <Link
+                        href={viewAllHref}
+                        className="shrink-0 text-muted-foreground text-sm hover:underline"
+                    >
+                        {viewAllLabel}
+                    </Link>
+                ) : null}
            </div>
        </div>
    );
@@ -319,6 +321,8 @@ type SiteResourcesOverviewProps = {
    initialPrivateForbidden: boolean;
    /** When not under `/[orgId]/...` routes, pass org id explicitly (e.g. credenza on sites list). */
    orgIdOverride?: string;
+    /** When false, hides links to the org resources tables filtered by this site. */
+    showViewAllLinks?: boolean;
 };

 export default function SiteResourcesOverview({
@@ -327,7 +331,8 @@ export default function SiteResourcesOverview({
    initialPrivateData,
    initialPublicForbidden,
    initialPrivateForbidden,
-    orgIdOverride
+    orgIdOverride,
+    showViewAllLinks = true
 }: SiteResourcesOverviewProps) {
    const t = useTranslations();
    const params = useParams<{ orgId: string }>();
@@ -467,8 +472,10 @@ export default function SiteResourcesOverview({
            key="public"
            title={t("siteResourcesSectionPublic")}
            description={t("siteResourcesSectionPublicDescription")}
-            viewAllHref={publicViewAllHref}
-            viewAllLabel={t("siteResourcesViewAllPublic")}
+            viewAllHref={showViewAllLinks ? publicViewAllHref : undefined}
+            viewAllLabel={
+                showViewAllLinks ? t("siteResourcesViewAllPublic") : undefined
+            }
            emptyLabel={t("siteResourcesEmptyPublic")}
            isForbidden={publicForbidden}
            isFetching={publicQuery.isFetching}
@@ -484,8 +491,10 @@ export default function SiteResourcesOverview({
            key="private"
            title={t("siteResourcesSectionPrivate")}
            description={t("siteResourcesSectionPrivateDescription")}
-            viewAllHref={privateViewAllHref}
-            viewAllLabel={t("siteResourcesViewAllPrivate")}
+            viewAllHref={showViewAllLinks ? privateViewAllHref : undefined}
+            viewAllLabel={
+                showViewAllLinks ? t("siteResourcesViewAllPrivate") : undefined
+            }
            emptyLabel={t("siteResourcesEmptyPrivate")}
            isForbidden={privateForbidden}
            isFetching={privateQuery.isFetching}
@@ -27,6 +27,8 @@ import UserProfileCard from "@app/components/UserProfileCard";
 import SecurityKeyAuthButton from "@app/components/SecurityKeyAuthButton";
 import { Separator } from "@app/components/ui/separator";
 import OrgSignInLink from "@app/components/OrgSignInLink";
+import type { LoginFormIDP } from "./LoginForm";
+import IdpLoginButtons from "./IdpLoginButtons";

 const identifierSchema = z.object({
    identifier: z.string().min(1, "Username or email is required")
@@ -53,6 +55,7 @@ type SmartLoginFormProps = {
    forceLogin?: boolean;
    defaultUser?: string;
    orgSignIn?: OrgSignInConfig;
+    lastUsedIdp?: (LoginFormIDP & { orgId?: string }) | null;
 };

 type ViewState =
@@ -89,7 +92,8 @@ export default function SmartLoginForm({
    redirect,
    forceLogin,
    defaultUser,
-    orgSignIn
+    orgSignIn,
+    lastUsedIdp
 }: SmartLoginFormProps) {
    const router = useRouter();
    const { env } = useEnvContext();
@@ -294,6 +298,15 @@ export default function SmartLoginForm({
                                </span>
                            </div>
                        </div>
+
+                        {lastUsedIdp && (
+                            <IdpLoginButtons
+                                idps={[lastUsedIdp]}
+                                orgId={lastUsedIdp.orgId}
+                                redirect={redirect}
+                            />
+                        )}
+
                        <OrgSignInLink
                            href={orgSignIn.href}
                            linkText={orgSignIn.linkText}
@@ -17,6 +17,8 @@ import {
 } from "next/navigation";
 import { cleanRedirect } from "@app/lib/cleanRedirect";
 import { Separator } from "@app/components/ui/separator";
+import { setClientCookie } from "@app/lib/setClientCookie";
+import { LAST_USED_IDP_COOKIE_NAME } from "@app/lib/consts";

 type SmartLoginOrgSelectorProps = {
    identifier: string;
@@ -141,6 +143,17 @@ export default function SmartLoginOrgSelector({
        setPendingIdpId(idpId);
        setError(null);

+        setClientCookie(
+            LAST_USED_IDP_COOKIE_NAME,
+            JSON.stringify({
+                orgId,
+                idpId
+            }),
+            {
+                sameSite: "Lax"
+            }
+        );
+
        let redirectToUrl: string | undefined;
        try {
            const safeRedirect = cleanRedirect(redirect || "/");
@@ -4,9 +4,13 @@ import { getCachedSubscription } from "./getCachedSubscription";
 import { priv } from ".";
 import { AxiosResponse } from "axios";
 import { GetLicenseStatusResponse } from "@server/routers/license/types";
+import { Tier } from "@server/types/Tiers";

-export const isOrgSubscribed = cache(async (orgId: string) => {
+const DEFAULT_PAID_TIERS: Tier[] = ["tier1", "tier2", "tier3", "enterprise"];
+
+export const isOrgSubscribed = cache(async (orgId: string, tiers?: Tier[]) => {
    let subscribed = false;
+    const allowedTiers = tiers ?? DEFAULT_PAID_TIERS;

    if (build === "enterprise") {
        try {
@@ -20,7 +24,8 @@ export const isOrgSubscribed = cache(async (orgId: string) => {
        try {
            const subRes = await getCachedSubscription(orgId);
            subscribed =
-                (subRes.data.data.tier == "tier1" || subRes.data.data.tier == "tier2" || subRes.data.data.tier == "tier3" || subRes.data.data.tier == "enterprise") &&
+                !!subRes.data.data.tier &&
+                allowedTiers.includes(subRes.data.data.tier as Tier) &&
                subRes.data.data.active;
        } catch {}
    }
@@ -0,0 +1 @@
+export const LAST_USED_IDP_COOKIE_NAME = "p__last_used_idp";
@@ -1,6 +1,7 @@
 import { priv } from "@app/lib/api";
 import { isOrgSubscribed } from "@app/lib/api/isOrgSubscribed";
 import { build } from "@server/build";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { LoadLoginPageBrandingResponse } from "@server/routers/loginPage/types";
 import { AxiosResponse } from "axios";

@@ -11,7 +12,10 @@ export async function loadOrgLoginPageBranding(orgId: string): Promise<{
        return { primaryColor: null };
    }

-    const subscribed = await isOrgSubscribed(orgId);
+    const subscribed = await isOrgSubscribed(
+        orgId,
+        tierMatrix.loginPageBranding
+    );
    if (!subscribed) {
        return { primaryColor: null };
    }
@@ -165,7 +165,6 @@ export function buildCreateSiteResourcePayload(
        siteIds: data.siteIds,
        mode: data.mode,
        destination: isNativeSsh ? undefined : (data.destination ?? undefined),
-        enabled: true,
        ...(data.mode === "http" && {
            scheme: data.scheme,
            ssl: data.ssl ?? false,
@@ -342,7 +341,8 @@ export function createGeneralFormSchema(t: TranslateFn) {
            .string()
            .min(1)
            .max(255)
-            .regex(/^[a-zA-Z0-9-]+$/)
+            .regex(/^[a-zA-Z0-9-]+$/),
+        enabled: z.boolean()
    });
 }

@@ -0,0 +1,32 @@
+/**
+ * Set a cookie on the client side in javascript code, not on the server
+ * @param name
+ * @param value
+ * @param days
+ * @param options
+ */
+export function setClientCookie(
+    name: string,
+    value: string,
+    options: {
+        days?: number;
+        path?: string;
+        secure?: boolean;
+        sameSite?: "Strict" | "Lax" | "None";
+    } = {}
+): void {
+    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+
+    if (options.days) {
+        const date = new Date();
+        date.setTime(date.getTime() + options.days * 864e5);
+        cookie += `; expires=${date.toUTCString()}`;
+    }
+
+    cookie += `; path=${options.path ?? "/"}`;
+
+    if (options.secure) cookie += "; Secure";
+    if (options.sameSite) cookie += `; SameSite=${options.sameSite}`;
+
+    document.cookie = cookie;
+}
Author	SHA1	Message	Date
dependabot[bot]	f1999c5089	Bump node in the docker-dependencies group across 1 directory Bumps the docker-dependencies group with 1 update in the / directory: node. Updates `node` from 24-alpine to 26-alpine --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine dependency-type: direct:production dependency-group: docker-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-16 01:33:01 +00:00
Owen Schwartz	5d20956a0e	Merge pull request #3450 from fosrl/dev 1.20.0-s.2	2026-07-15 20:55:40 -04:00
Owen Schwartz	29f91e8276	Merge pull request #3449 from fosrl/crowdin_dev New Crowdin updates	2026-07-15 20:54:40 -04:00
Owen Schwartz	4d9e38d022	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-07-15 20:54:17 -04:00
Owen Schwartz	d7d31b78f0	New translations en-us.json (Chinese Simplified) [ci skip]	2026-07-15 20:54:15 -04:00
Owen Schwartz	e8ed8fc7e9	New translations en-us.json (Turkish) [ci skip]	2026-07-15 20:54:13 -04:00
Owen Schwartz	5ee406c92e	New translations en-us.json (Russian) [ci skip]	2026-07-15 20:54:12 -04:00
Owen Schwartz	89f4f4ba6f	New translations en-us.json (Portuguese) [ci skip]	2026-07-15 20:54:10 -04:00
Owen Schwartz	4e5fd2f2b0	New translations en-us.json (French) [ci skip]	2026-07-15 20:54:08 -04:00
Owen Schwartz	22a5743817	New translations en-us.json (Polish) [ci skip]	2026-07-15 20:54:06 -04:00
Owen Schwartz	40e05f903a	New translations en-us.json (Dutch) [ci skip]	2026-07-15 20:54:04 -04:00
Owen Schwartz	6c1e1bc0ca	New translations en-us.json (Korean) [ci skip]	2026-07-15 20:54:02 -04:00
Owen Schwartz	cebbf9ca65	New translations en-us.json (Italian) [ci skip]	2026-07-15 20:54:00 -04:00
Owen Schwartz	e6646e5833	New translations en-us.json (German) [ci skip]	2026-07-15 20:53:59 -04:00
Owen Schwartz	00f7510195	New translations en-us.json (Danish) [ci skip]	2026-07-15 20:53:57 -04:00
Owen Schwartz	8d1f5e1096	New translations en-us.json (Czech) [ci skip]	2026-07-15 20:53:55 -04:00
Owen Schwartz	e497fcc3b9	New translations en-us.json (Bulgarian) [ci skip]	2026-07-15 20:53:53 -04:00
Owen Schwartz	a7010b2788	New translations en-us.json (Spanish) [ci skip]	2026-07-15 20:53:51 -04:00
Owen	abf58a70ee	Merge branch 'provisioning-resources' into dev	2026-07-15 20:45:39 -04:00
Owen	d4c602cf91	Update the counts when deleting resources	2026-07-15 17:22:12 -04:00
miloschwartz	d1b0bbb6d9	update translations	2026-07-15 16:05:53 -04:00
miloschwartz	ae0be3a4bc	add resources overview column to pending sites table	2026-07-12 17:53:57 -04:00
miloschwartz	a8f3f71021	add reject endpoint	2026-07-12 17:48:48 -04:00
miloschwartz	933ca71c16	add approve site endpoint	2026-07-12 17:16:08 -04:00
miloschwartz	591cb9cdc1	dont use strict query params in list alises	2026-07-10 18:05:16 -04:00
miloschwartz	34b18bdb53	only show approved resources in launcher	2026-07-10 17:24:10 -04:00
miloschwartz	7d475f5e91	filter out pending resources	2026-07-10 17:18:33 -04:00
miloschwartz	39c35fa539	reorganize components nad hooks for consistency	2026-07-10 17:05:45 -04:00
Milo Schwartz	bada1fdb97	Merge pull request #3394 from fosrl/feat/remember-last-idp-on-smart-login-form feat: Remember last used idp in login forms	2026-07-10 16:34:22 -04:00
miloschwartz	d9303f87c8	set last used cookie in smart login lookup	2026-07-10 16:34:02 -04:00
Owen	e1bc0b7efd	Make sure the enabled gets set to false	2026-07-10 15:36:05 -04:00
Owen	5ef068c8dc	Set the resource from the site	2026-07-10 15:31:37 -04:00
miloschwartz	14680df160	suse tiermatrix in server component susbcribed check	2026-07-10 15:23:09 -04:00
Owen	94c01a23a9	Merge branch 'private-resource-enable' into provisioning-resources	2026-07-10 15:17:06 -04:00
Owen	609fb357bb	Support enable in the blueprints	2026-07-10 15:16:50 -04:00
Owen	cf9a17cc2e	Add status filter	2026-07-10 15:04:28 -04:00
Owen	538b57941c	Makes sure patch works z#	2026-07-10 11:32:27 -04:00
Owen	f4bee6406a	Support partial updates	2026-07-10 10:11:47 -04:00
Owen	0b2693a317	Add toggle to the ui for enabled	2026-07-10 09:59:11 -04:00
Owen	3be2d928f6	Filter out disabled	2026-07-09 21:42:59 -04:00
Milo Schwartz	e5398d441e	Merge pull request #3425 from fosrl/dev Dev	2026-07-09 21:33:17 -04:00
miloschwartz	d38f9ac2bb	update readme	2026-07-09 21:32:35 -04:00
Owen	8d018fe47d	Clean up	2026-07-09 21:28:48 -04:00
Fred KISSIE	34d5c9535d	♻️ delete last used IDP coookie when logging in with email/password on smart login form	2026-07-10 03:22:28 +02:00
Fred KISSIE	dc60ef712f	Merge branch 'dev' into feat/remember-last-idp-on-smart-login-form	2026-07-10 02:38:38 +02:00
Owen	dc7eb630c3	Add missing action	2026-07-09 11:16:15 -04:00
Milo Schwartz	d4138e2141	Merge pull request #3421 from fosrl/dev 1.20.0	2026-07-09 10:40:35 -04:00
Owen Schwartz	bbcd352817	Merge pull request #3420 from fosrl/crowdin_dev New Crowdin updates	2026-07-09 10:35:21 -04:00
Owen Schwartz	21d9199978	New translations en-us.json (French) [ci skip]	2026-07-09 10:34:31 -04:00
Owen Schwartz	3e7b9d7bff	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-07-09 10:34:29 -04:00
Owen Schwartz	54acdbe282	New translations en-us.json (Chinese Simplified) [ci skip]	2026-07-09 10:34:27 -04:00
Owen Schwartz	11bbd028fc	New translations en-us.json (Turkish) [ci skip]	2026-07-09 10:34:24 -04:00
Owen Schwartz	7ae99731f4	New translations en-us.json (Russian) [ci skip]	2026-07-09 10:34:22 -04:00
Owen Schwartz	17b4fd9a44	New translations en-us.json (Portuguese) [ci skip]	2026-07-09 10:34:20 -04:00
Owen Schwartz	caa398ae54	New translations en-us.json (Polish) [ci skip]	2026-07-09 10:34:18 -04:00
Owen Schwartz	035e324e5a	New translations en-us.json (Dutch) [ci skip]	2026-07-09 10:34:16 -04:00
Owen Schwartz	272a5737b0	New translations en-us.json (Korean) [ci skip]	2026-07-09 10:34:14 -04:00
Owen Schwartz	be50fd4586	New translations en-us.json (Italian) [ci skip]	2026-07-09 10:34:12 -04:00
Owen Schwartz	8301511efe	New translations en-us.json (German) [ci skip]	2026-07-09 10:34:10 -04:00
Owen Schwartz	c527ce6562	New translations en-us.json (Danish) [ci skip]	2026-07-09 10:34:08 -04:00
Owen Schwartz	80bee900aa	New translations en-us.json (Czech) [ci skip]	2026-07-09 10:34:06 -04:00
Owen Schwartz	54209c2390	New translations en-us.json (Bulgarian) [ci skip]	2026-07-09 10:34:04 -04:00
Owen Schwartz	3b0ee8d9d4	New translations en-us.json (Spanish) [ci skip]	2026-07-09 10:34:02 -04:00
miloschwartz	7a0a877dc0	fix create private resource ports default to blocked	2026-07-09 10:28:06 -04:00
Owen	b6ed762724	Sort before inserting	2026-07-09 10:18:41 -04:00
Owen Schwartz	d1d58cf455	Merge pull request #3418 from fosrl/crowdin_dev New Crowdin updates	2026-07-09 10:00:30 -04:00
Owen Schwartz	e22f30c694	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-07-09 09:59:33 -04:00
Owen Schwartz	d71c112959	New translations en-us.json (Turkish) [ci skip]	2026-07-09 09:59:30 -04:00
Owen Schwartz	199e960f6d	New translations en-us.json (Portuguese) [ci skip]	2026-07-09 09:59:26 -04:00
Owen Schwartz	843b9a0b16	New translations en-us.json (Dutch) [ci skip]	2026-07-09 09:59:23 -04:00
Owen Schwartz	b9aedc65fe	New translations en-us.json (Italian) [ci skip]	2026-07-09 09:59:20 -04:00
Owen Schwartz	11f5cfd4f8	New translations en-us.json (German) [ci skip]	2026-07-09 09:59:18 -04:00
Owen Schwartz	2ff2e32e9c	New translations en-us.json (Danish) [ci skip]	2026-07-09 09:59:16 -04:00
Owen Schwartz	facb1e4cdf	New translations en-us.json (Spanish) [ci skip]	2026-07-09 09:59:11 -04:00
Owen	6d129c0738	Fix #3099	2026-07-08 21:44:20 -04:00
Owen	67a3d226f5	Add session creation	2026-07-08 21:17:40 -04:00
Owen	19a3773880	Update ironrdp Ref #3272	2026-07-08 16:23:53 -04:00
Fred KISSIE	2fe85ebda2	♻️ set last IDP to null if login with email + password	2026-07-08 03:11:12 +02:00
Fred KISSIE	3d13e9105c	🏷️ fix types	2026-07-03 22:33:58 +02:00
Fred KISSIE	289be30e6b	✨ show last used login idp in smart login form	2026-07-03 22:33:51 +02:00
Fred KISSIE	a74c0c227c	🌐 text	2026-07-03 21:05:53 +02:00
Fred KISSIE	05bf77da29	♻️ remove `cache` on `verifySession` calls as it's already wrapped in `cache`	2026-07-03 21:05:47 +02:00
Fred KISSIE	bb4deb1ae9	✨ remember last used idp in dashboard login form	2026-07-03 21:05:16 +02:00
				`@@ -0,0 +1 @@`
				`export const LAST_USED_IDP_COOKIE_NAME = "p__last_used_idp";`