💬 update text

Fixes #3695

.github/ISSUE_TEMPLATE/1.bug_report.yml

@@ -34,6 +34,14 @@ body:
       validations:
           required: true
 
+    - type: textarea
+      attributes:
+          label: AI Disclosure
+          description: |
+              If you used AI to help write this issue, please disclose it here. This is important for transparency and helps maintain the integrity of the issue tracking process.
+      validations:
+          required: true
+
     - type: textarea
       attributes:
           label: Expected Behavior

README.md

@@ -37,11 +37,22 @@
 
 <p align="center">
     <strong>
-        Get started with Pangolin at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
+        Get started with Pangolin Cloud at <a href="https://app.pangolin.net/auth/signup">app.pangolin.net</a>
     </strong>
 </p>
 
-Pangolin is an open-source, identity-based remote access platform built on WireGuard® that enables secure connectivity to infrastructure anywhere. It combines reverse-proxy and VPN capabilities into one platform, providing browser-based access to web applications and client-based access to private resources with NAT traversal, all with granular access control.
+Pangolin is an open-source SASE platform, built on WireGuard®, with a simple mission: connect and protect your users, wherever they are. It brings networking and security together as one system including a zero-trust VPN, zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway, all sharing one identity and policy model. It's the same idea behind platforms like Cloudflare One, Zscaler, and Prisma but open, self-hostable, and built to stay light and easy to deploy.
+
+### Networking and security that's unified, open, and simple
+
+Legacy SASE platforms got the idea right: connectivity and security belong together. But they delivered it as a heavyweight, closed, cloud-locked stack assembled from years of patchwork. Pangolin exists to do that unification differently, in the open, self-hostable, and simple enough that administrators actually enjoy running it.
+
+* **Open source, not a black box**: the code is open and auditable, so you can see exactly how your traffic is handled and how access decisions get made, instead of trusting a closed cloud control plane.
+* **Networking and security as one platform**: sites, reverse proxy, client access, RBAC, and the AI gateway share one identity and policy model, so protecting users and connecting them are executed together.
+* **Lightweight by design**: the whole platform is built to stay small and fast: easy to self-host on a small server, with a lightweight, user-space connector that goes in your private networks.
+* **Enjoyable to use**: a clean, modern interface and a setup flow that gets out of your way, so managing access feels simple instead of like fighting a legacy admin console.
+* **Zero trust from day one**: access is granted per resource, not per network, with identity provider integration, role-based access control, and full audit logging.
+* **Run it your way**: self-host the Community Edition for free, step up to the Enterprise Edition for advanced features, or use Pangolin Cloud if you'd rather not manage infrastructure at all.
 
 ## Installation
 
@@ -53,9 +64,9 @@ Pangolin is an open-source, identity-based remote access platform built on WireG
 
 ## Deployment Options
 
-- **Pangolin Cloud** - Fully managed service - no infrastructure required.
-- **Self-Host: Community Edition** - Free, open source, and licensed under AGPL-3.
-- **Self-Host: Enterprise Edition** - Licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
+- **Pangolin Cloud** - Fully managed service with no infrastructure required.
+- **Self-Host: Community Edition** - Free, open-source, and licensed under AGPL-3.
+- **Self-Host: Enterprise Edition** - Open-core, and licensed under Fossorial Commercial License. Free for personal and hobbyist use, and for businesses making less than \$100K USD gross annual revenue.
 
 ## Key Features
 

cli/commands/generateOrgCaKeys.ts

@@ -5,7 +5,7 @@ import { encrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { generateCA } from "@server/lib/sshCA";
 import fs from "fs";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 
 type GenerateOrgCaKeysArgs = {
     orgId: string;

cli/commands/rotateServerSecret.ts

@@ -4,7 +4,7 @@ import { encrypt, decrypt } from "@server/lib/crypto";
 import { configFilePath1, configFilePath2 } from "@server/lib/consts";
 import { eq } from "drizzle-orm";
 import fs from "fs";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 
 type RotateServerSecretArgs = {
     "old-secret": string;

messages/en-US.json

@@ -2095,6 +2095,7 @@
     "resourceBudgetSettings": "Budget",
     "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
     "sidebarApiKeys": "API Keys",
+    "sidebarRedirects": "Redirects",
     "sidebarProvisioning": "Provisioning",
     "sidebarSettings": "Settings",
     "sidebarAllUsers": "All Users",
@@ -4363,5 +4364,52 @@
     "rdpUnicodeKeyboardMode": "Unicode keyboard mode",
     "sessionToolbarShow": "Show toolbar",
     "sessionToolbarHide": "Hide toolbar",
-    "actionUpdateSiteApprovals": "Update Site Approvals"
+    "actionUpdateSiteApprovals": "Update Site Approvals",
+    "redirectsTitle": "Manage Redirects",
+    "redirectsDescription": "Forward requests from a path on your domains or resources to another URL",
+    "redirectsSearch": "Search redirects...",
+    "redirectAdd": "Add Redirect",
+    "redirectSource": "Source",
+    "redirectDestination": "Destination",
+    "redirectAttachedTo": "Attached To",
+    "redirectType": "Type",
+    "redirectTypePermanent": "Permanent (308)",
+    "redirectTypeTemporary": "Temporary (307)",
+    "redirectUpdated": "Redirect updated successfully",
+    "redirectErrorUpdate": "Failed to update redirect",
+    "redirectDeleted": "Redirect deleted successfully",
+    "redirectErrorDelete": "Failed to delete redirect",
+    "redirectDelete": "Delete Redirect",
+    "redirectDeleteConfirm": "Confirm Delete Redirect",
+    "redirectQuestionRemove": "Are you sure you want to remove this redirect?",
+    "redirectMessageRemove": "Once removed, requests matching this redirect will no longer be forwarded.",
+    "redirectDestinationDomain": "Destination Domain",
+    "redirectDestinationDomainDescription": "The domain requests are sent to, such as example.com",
+    "redirectDestinationDomainRequired": "Enter a destination domain",
+    "redirectSameDomainAsSource": "Same domain as source",
+    "redirectSameDomainAsSourceDescription": "Keep the destination on the source domain and only change the path",
+    "redirectDestinationDomainInvalid": "Enter a valid domain, such as example.com",
+    "redirectMatchPathDescription": "Which incoming paths this redirect applies to",
+    "redirectRewritePathDescription": "Optionally change the path before redirecting. Leave unset to keep the original path.",
+    "redirectRewritePathRequired": "Enter a rewrite path, or choose Strip Prefix",
+    "redirectCreate": "Create Redirect",
+    "redirectCreateDescription": "Forward requests matching a path to another URL",
+    "redirectEditDescription": "Update how this redirect forwards incoming requests",
+    "redirectGoBack": "Back to Redirects",
+    "redirectCreated": "Redirect created successfully",
+    "redirectErrorCreate": "Failed to create redirect",
+    "redirectSettings": "Redirect Rule",
+    "selectedRedirectDomain": "Selected Domain",
+    "selectedRedirectResource": "Selected Resource",
+    "redirectResourceNoDomain": "This resource has no domain",
+    "redirectSourceSectionDescription": "Choose the domain or resource this redirect applies to",
+    "redirectSettingsDescription": "Set which paths to match and where to send them",
+    "redirectEnabledDescription": "Turn the redirect off to stop forwarding requests without deleting it",
+    "redirectAttachedToDescription": "Choose whether this redirect applies to a whole domain or a single resource",
+    "redirectAttachDomain": "Domain",
+    "redirectAttachResource": "Resource",
+    "redirectDomainRequired": "Select a domain to attach this redirect to",
+    "redirectResourceRequired": "Select a resource to attach this redirect to",
+    "redirectPermanent": "Permanent Redirect",
+    "redirectPermanentDescription": "Respond with 308 instead of 307. Permanent redirects are cached by browsers."
 }

server/auth/actions.ts

@@ -205,7 +205,12 @@ export enum ActionsEnum {
     deleteVirtualApiKey = "deleteVirtualApiKey",
     getVirtualApiKey = "getVirtualApiKey",
     listVirtualApiKeys = "listVirtualApiKeys",
-    updateVirtualApiKey = "updateVirtualApiKey"
+    updateVirtualApiKey = "updateVirtualApiKey",
+    createRedirect = "createRedirect",
+    deleteRedirect = "deleteRedirect",
+    getRedirect = "getRedirect",
+    listRedirects = "listRedirects",
+    updateRedirect = "updateRedirect"
 }
 
 export async function checkUserActionPermission(

server/db/names.ts

@@ -4,6 +4,7 @@ import {
     aiProviders,
     clients,
     db,
+    redirects,
     resourcePolicies,
     resources,
     siteResources
@@ -140,6 +141,30 @@ export async function getUniqueProviderName(orgId: string): Promise<string> {
     }
 }
 
+export async function getUniqueRedirectName(orgId: string): Promise<string> {
+    let loops = 0;
+    while (true) {
+        if (loops > 100) {
+            throw new Error("Could not generate a unique name");
+        }
+
+        const name = generateName();
+
+        const redirectCount = await db
+            .select({
+                niceId: redirects.niceId,
+                orgId: redirects.orgId
+            })
+            .from(redirects)
+            .where(and(eq(redirects.niceId, name), eq(redirects.orgId, orgId)));
+
+        if (redirectCount.length === 0) {
+            return name;
+        }
+        loops++;
+    }
+}
+
 export async function getUniqueResourcePolicyName(
     orgId: string
 ): Promise<string> {

server/db/pg/schema/schema.ts

@@ -227,6 +227,38 @@ export const resources = pgTable(
     ]
 );
 
+export const redirects = pgTable("redirects", {
+    redirectId: serial("redirectId").primaryKey(),
+    orgId: varchar("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        onDelete: "cascade"
+    }),
+    domainId: varchar("domainId").references(() => domains.domainId, {
+        onDelete: "cascade"
+    }),
+    niceId: text("niceId").notNull(),
+    name: varchar("name").notNull(),
+    subdomain: varchar("subdomain"),
+    destinationDomain: varchar("destinationDomain").notNull(),
+    pathMatchType: varchar("pathMatchType")
+        .$type<"exact" | "prefix" | "regex">()
+        .notNull()
+        .default("regex"), // exact, prefix, regex
+    matchPath: varchar("matchPath").notNull().default(".*"),
+    rewritePath: varchar("rewritePath"), // if set, rewrites the path to this value,
+    //  else, the original path will be kept
+    rewritePathType: varchar("rewritePathType").$type<
+        "exact" | "prefix" | "regex" | "stripPrefix"
+    >(), // exact, prefix, regex, stripPrefix
+
+    permanent: boolean("permanent").notNull().default(false),
+    enabled: boolean("enabled").notNull().default(true)
+});
+
 export const resourceAiProviders = pgTable(
     "resourceAiProviders",
     {
@@ -2065,6 +2097,7 @@ export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
 export type RolePolicy = InferSelectModel<typeof rolePolicies>;
 export type UserPolicy = InferSelectModel<typeof userPolicies>;
 export type ResourcePolicyRule = InferSelectModel<typeof resourcePolicyRules>;
+export type Redirect = InferSelectModel<typeof redirects>;
 export type AiProvider = InferSelectModel<typeof aiProviders>;
 export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;

server/db/sqlite/schema/schema.ts

@@ -243,6 +243,40 @@ export const resources = sqliteTable(
     (table) => [index("idx_resources_orgId").on(table.orgId)]
 );
 
+export const redirects = sqliteTable("redirects", {
+    redirectId: integer("redirectId").primaryKey({ autoIncrement: true }),
+    orgId: text("orgId")
+        .references(() => orgs.orgId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        onDelete: "cascade"
+    }),
+    domainId: text("domainId").references(() => domains.domainId, {
+        onDelete: "cascade"
+    }),
+    niceId: text("niceId").notNull(),
+    name: text("name").notNull(),
+    subdomain: text("subdomain"),
+    destinationDomain: text("destinationDomain").notNull(),
+    pathMatchType: text("pathMatchType")
+        .$type<"exact" | "prefix" | "regex">()
+        .notNull()
+        .default("regex"), // exact, prefix, regex
+    matchPath: text("matchPath").notNull().default("*"),
+    rewritePath: text("rewritePath"), // if set, rewrites the path to this value,
+    //  else, the original path will be kept
+    rewritePathType: text("rewritePathType").$type<
+        "exact" | "prefix" | "regex" | "stripPrefix"
+    >(), // exact, prefix, regex, stripPrefix
+
+    permanent: integer("permanent", { mode: "boolean" })
+        .notNull()
+        .default(false),
+    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true)
+});
+
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
     {
@@ -2104,6 +2138,7 @@ export type ResourcePolicyHeaderAuth = InferSelectModel<
 >;
 export type RolePolicy = InferSelectModel<typeof rolePolicies>;
 export type UserPolicy = InferSelectModel<typeof userPolicies>;
+export type Redirect = InferSelectModel<typeof redirects>;
 export type AiProvider = InferSelectModel<typeof aiProviders>;
 export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;

server/lib/config.ts

@@ -112,6 +112,11 @@ export class Config {
             ? "true"
             : "false";
 
+        process.env.FLAGS_DISABLE_VIRTUAL_API_KEYS_UI = parsedConfig.flags
+            ?.disable_virtual_api_keys_ui
+            ? "true"
+            : "false";
+
         this.rawConfig = parsedConfig;
     }
 

server/lib/dbRetry.ts

@@ -71,7 +71,7 @@ export async function withRetry<T>(
                 const jitter = Math.random() * baseDelay;
                 const delay = baseDelay + jitter;
                 logger.warn(
-                    `Transient DB error in ${context}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`,
+                    `Transient DB issue in ${context}, retrying attempt ${attempt}/${maxRetries} after ${delay.toFixed(0)}ms`,
                     { code: error?.code ?? error?.cause?.code }
                 );
                 await new Promise((resolve) => setTimeout(resolve, delay));

server/lib/readConfigFile.ts

@@ -348,8 +348,8 @@ export const configSchema = z
                     .optional()
                     .pipe(z.string())
                     .transform((url) => url.toLowerCase()),
-                subnet_group: z.string().optional().default("100.89.137.0/20"),
-                block_size: z.number().positive().gt(0).optional().default(24),
+                subnet_group: z.string().optional().default("100.89.137.0/18"),
+                block_size: z.number().positive().gt(0).optional().default(22),
                 site_block_size: z
                     .number()
                     .positive()
@@ -442,6 +442,7 @@ export const configSchema = z
                 disable_config_managed_domains: z.boolean().optional(),
                 disable_product_help_banners: z.boolean().optional(),
                 disable_enterprise_features: z.boolean().optional(),
+                disable_virtual_api_keys_ui: z.boolean().optional(),
                 enable_acme_cert_sync: z.boolean().optional().default(true),
                 disable_private_http_placeholder: z
                     .boolean()

server/openApi.ts

@@ -32,7 +32,8 @@ export enum OpenAPITags {
     AiProvider = "AI Provider",
     AiModel = "AI Model",
     AiBudget = "AI Budget",
-    VirtualApiKey = "Virtual API Key"
+    VirtualApiKey = "Virtual API Key",
+    Redirect = "Redirect"
 }
 
 // Order here controls the order tags are displayed in Swagger UI

server/private/routers/hybrid.ts

@@ -2478,7 +2478,12 @@ hybridRouter.post(
                 destinations: destinations
             });
         } catch (error) {
-            logger.error(error);
+            if (!(
+                error instanceof Error &&
+                error.message === "Exit node not allowed"
+            )) {
+                logger.error(error);
+            }
             return next(
                 createHttpError(
                     HttpCode.INTERNAL_SERVER_ERROR,

server/private/routers/remoteExitNode/exitNodeEvents.ts

@@ -0,0 +1,23 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { EventEmitter } from "events";
+
+export interface ExitNodeOnlineEvent {
+    exitNodeId: number;
+    endpoint: string;
+}
+
+export const EXIT_NODE_ONLINE_EVENT = "exit-node-online";
+
+export const exitNodeEvents = new EventEmitter();

server/private/routers/remoteExitNode/exitNodeReconnectScheduler.ts

@@ -12,11 +12,27 @@
  */
 
 import axios from "axios";
-import { db, exitNodes, newts, sites } from "@server/db";
+import { db, newts, sites } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
 import redisManager from "#private/lib/redis";
-// import { sendToClient } from "#private/routers/ws";
+import { sendToClient } from "../ws";
+import {
+    exitNodeEvents,
+    EXIT_NODE_ONLINE_EVENT,
+    ExitNodeOnlineEvent
+} from "./exitNodeEvents";
+
+exitNodeEvents.on(
+    EXIT_NODE_ONLINE_EVENT,
+    ({ exitNodeId, endpoint }: ExitNodeOnlineEvent) => {
+        scheduleExitNodeReconnect(exitNodeId, endpoint).catch((error) => {
+            logger.error("Failed to schedule exit node reconnect", {
+                error
+            });
+        });
+    }
+);
 
 const INITIAL_DELAY_MS = 15 * 1000; // 15 seconds before first check
 const CHECK_INTERVAL_MS = 10 * 1000; // Check every 10 seconds
@@ -26,7 +42,7 @@ const REDIS_HASH_PREFIX = "exit-node-reconnect:";
 
 interface PendingReconnect {
     startTime: number;
-    reachableAt: string;
+    endpoint: string;
 }
 
 // In-memory tracking for this node
@@ -40,15 +56,15 @@ let schedulerInterval: NodeJS.Timeout | null = null;
  */
 export async function scheduleExitNodeReconnect(
     exitNodeId: number,
-    reachableAt: string
+    endpoint: string
 ): Promise<void> {
     logger.info(
-        `Scheduling newt reconnect for exit node ${exitNodeId} (reachableAt: ${reachableAt})`
+        `Scheduling newt reconnect for exit node ${exitNodeId} (endpoint: ${endpoint})`
     );
 
     const entry: PendingReconnect = {
         startTime: Date.now(),
-        reachableAt
+        endpoint
     };
 
     pendingReconnects.set(exitNodeId, entry);
@@ -63,8 +79,8 @@ export async function scheduleExitNodeReconnect(
         );
         await redisManager.hset(
             `${REDIS_HASH_PREFIX}${exitNodeId}`,
-            "reachableAt",
-            reachableAt
+            "endpoint",
+            endpoint
         );
     }
 }
@@ -101,14 +117,14 @@ async function processPendingReconnects(): Promise<void> {
                     `${REDIS_HASH_PREFIX}${id}`,
                     "startTime"
                 );
-                const reachableAt = await redisManager.hget(
+                const endpoint = await redisManager.hget(
                     `${REDIS_HASH_PREFIX}${id}`,
-                    "reachableAt"
+                    "endpoint"
                 );
-                if (startTimeStr && reachableAt) {
+                if (startTimeStr && endpoint) {
                     toProcess.set(id, {
                         startTime: parseInt(startTimeStr, 10),
-                        reachableAt
+                        endpoint
                     });
                 }
             }
@@ -135,7 +151,7 @@ async function processPendingReconnects(): Promise<void> {
         }
 
         // Check if the exit node HTTP endpoint is reachable
-        const pingUrl = `${entry.reachableAt}/ping`;
+        const pingUrl = `http://${entry.endpoint}/ping`;
         try {
             await axios.get(pingUrl, { timeout: 5000 });
         } catch {
@@ -150,47 +166,47 @@ async function processPendingReconnects(): Promise<void> {
             `Exit node ${exitNodeId} is reachable. Sending newt/wg/reconnect to connected newts.`
         );
 
-        // await sendReconnectToNewts(exitNodeId);
+        await sendReconnectToNewts(exitNodeId);
         await removePending(exitNodeId);
     }
 }
 
-// async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
-// try {
-//         const connectedNewts = await db
-//             .select({ newtId: newts.newtId })
-//             .from(newts)
-//             .innerJoin(sites, eq(newts.siteId, sites.siteId))
-//             .where(eq(sites.exitNodeId, exitNodeId));
+async function sendReconnectToNewts(exitNodeId: number): Promise<void> {
+    try {
+        const connectedNewts = await db
+            .select({ newtId: newts.newtId })
+            .from(newts)
+            .innerJoin(sites, eq(newts.siteId, sites.siteId))
+            .where(eq(sites.exitNodeId, exitNodeId));
 
-//         if (connectedNewts.length === 0) {
-//             logger.debug(
-//                 `No newts found for exit node ${exitNodeId}, nothing to reconnect`
-//             );
-//             return;
-//         }
+        if (connectedNewts.length === 0) {
+            logger.debug(
+                `No newts found for exit node ${exitNodeId}, nothing to reconnect`
+            );
+            return;
+        }
 
-//         logger.info(
-//             `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
-//         );
+        logger.info(
+            `Sending newt/wg/reconnect to ${connectedNewts.length} newt(s) for exit node ${exitNodeId}`
+        );
 
-//         const reconnectMessage = {
-//             type: "newt/wg/reconnect",
-//             data: {}
-//         };
+        const reconnectMessage = {
+            type: "newt/wg/reconnect",
+            data: {}
+        };
 
-//         await Promise.allSettled(
-//             connectedNewts.map(({ newtId }) =>
-//                 sendToClient(newtId, reconnectMessage)
-//             )
-//         );
-//     } catch (error) {
-//         logger.error(
-//             `Failed to send reconnect messages for exit node ${exitNodeId}`,
-//             { error }
-//         );
-//     }
-// }
+        await Promise.allSettled(
+            connectedNewts.map(({ newtId }) =>
+                sendToClient(newtId, reconnectMessage)
+            )
+        );
+    } catch (error) {
+        logger.error(
+            `Failed to send reconnect messages for exit node ${exitNodeId}`,
+            { error }
+        );
+    }
+}
 
 async function removePending(exitNodeId: number): Promise<void> {
     pendingReconnects.delete(exitNodeId);

server/private/routers/remoteExitNode/handleRemoteExitNodePingMessage.ts

@@ -16,7 +16,7 @@ import { MessageHandler } from "@server/routers/ws";
 import { RemoteExitNode } from "@server/db";
 import { eq } from "drizzle-orm";
 import logger from "@server/logger";
-import { scheduleExitNodeReconnect } from "./exitNodeReconnectScheduler";
+import { exitNodeEvents, EXIT_NODE_ONLINE_EVENT } from "./exitNodeEvents";
 
 /**
  * Handles ping messages from clients and responds with pong
@@ -40,7 +40,7 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
     try {
         // Fetch the current state before updating so we can detect the offline→online transition
         const [currentExitNode] = await db
-            .select({ online: exitNodes.online, reachableAt: exitNodes.reachableAt })
+            .select({ online: exitNodes.online, endpoint: exitNodes.endpoint })
             .from(exitNodes)
             .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId))
             .limit(1);
@@ -55,12 +55,14 @@ export const handleRemoteExitNodePingMessage: MessageHandler = async (
             .where(eq(exitNodes.exitNodeId, remoteExitNode.exitNodeId));
 
         // If the exit node was offline and is now coming online, schedule newt reconnects
-        if (currentExitNode && !currentExitNode.online && currentExitNode.reachableAt) {
-            scheduleExitNodeReconnect(
-                remoteExitNode.exitNodeId,
-                currentExitNode.reachableAt
-            ).catch((error) => {
-                logger.error("Failed to schedule exit node reconnect", { error });
+        if (
+            currentExitNode &&
+            !currentExitNode.online &&
+            currentExitNode.endpoint
+        ) {
+            exitNodeEvents.emit(EXIT_NODE_ONLINE_EVENT, {
+                exitNodeId: remoteExitNode.exitNodeId,
+                endpoint: currentExitNode.endpoint
             });
         }
     } catch (error) {

server/private/routers/ws/ws.ts

@@ -104,7 +104,8 @@ const processMessage = async (
 
         const handler = messageHandlers[message.type];
         if (!handler) {
-            throw new Error(`Unsupported message type: ${message.type}`);
+            logger.debug(`No handler found for message type: ${message.type}`);
+            return;
         }
 
         const response = await handler({

server/routers/external.ts

@@ -62,6 +62,7 @@ import { createStore } from "#dynamic/lib/rateLimitStore";
 import { checkRoundTripMessage } from "./ws";
 import * as labels from "@server/routers/labels";
 import * as aiProvider from "@server/routers/aiProvider";
+import * as redirect from "@server/routers/redirect";
 import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";
@@ -1622,6 +1623,50 @@ authenticated.delete(
     aiProvider.deleteAiProvider
 );
 
+authenticated.put(
+    "/org/:orgId/redirect",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.createRedirect),
+    logActionAudit(ActionsEnum.createRedirect),
+    redirect.createRedirect
+);
+
+authenticated.get(
+    "/org/:orgId/redirects",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listRedirects),
+    redirect.listRedirects
+);
+
+authenticated.get(
+    "/org/:orgId/redirects/:redirectId",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getRedirect),
+    redirect.getRedirect
+);
+authenticated.get(
+    "/org/:orgId/redirect/:niceId",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getRedirect),
+    redirect.getRedirect
+);
+
+authenticated.post(
+    "/org/:orgId/redirects/:redirectId",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.updateRedirect),
+    logActionAudit(ActionsEnum.updateRedirect),
+    redirect.updateRedirect
+);
+
+authenticated.delete(
+    "/org/:orgId/redirects/:redirectId",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.deleteRedirect),
+    logActionAudit(ActionsEnum.deleteRedirect),
+    redirect.deleteRedirect
+);
+
 authenticated.put(
     "/ai-provider/:providerId/model",
     verifyAiProviderAccess,

server/routers/olm/dnsConfig.ts

@@ -0,0 +1,20 @@
+import config from "@server/lib/config";
+
+// Mirrors the optional fields on the olm client's TunnelConfig - any field
+// present here overrides the value the olm client is otherwise locally
+// configured with; an absent field leaves the client's own config alone.
+export type OlmDnsConfig = {
+    upstreamDns?: string[];
+    overrideDns?: boolean;
+    tunnelDns?: boolean;
+    matchDomains?: string[];
+};
+
+export function buildOlmDnsConfig(): OlmDnsConfig | undefined {
+    return {
+        upstreamDns: undefined,
+        overrideDns: undefined,
+        tunnelDns: undefined,
+        matchDomains: undefined
+    };
+}

server/routers/olm/handleOlmRegisterMessage.ts

@@ -15,6 +15,7 @@ import { encodeHexLowerCase } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
 import { getUserDeviceName } from "@server/db/names";
 import { buildSiteConfigurationForOlmClient } from "./buildConfiguration";
+import { buildOlmDnsConfig } from "./dnsConfig";
 import { OlmErrorCodes, sendOlmError } from "./error";
 import { handleFingerprintInsertion } from "./fingerprintingUtils";
 import { build } from "@server/build";
@@ -512,6 +513,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                               tunnelIP: `${clientSubnet.split("/")[0]}/${exitNode.address.split("/")[1]}` // we need to use the exit node's subnet mask here because the client will be using the exit node's subnet mask for its routing table so we can address it
                           }
                         : undefined,
+                dnsConfig: buildOlmDnsConfig(),
                 chainId: chainId
             }
         },

server/routers/olm/handleOlmServerInitAddPeerHandshake.ts

@@ -85,7 +85,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             );
 
         if (!resources || resources.length === 0) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Resource not found`
             );
             await sendCancel();
@@ -94,7 +94,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
 
         if (resources.length > 1) {
             // error but this should not happen because the nice id cant contain a dot and the alias has to have a dot and both have to be unique within the org so there should never be multiple matches
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Multiple resources found matching the criteria`
             );
             return;
@@ -119,7 +119,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             );
 
         if (currentResourceAssociationCaches.length === 0) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Client ${client.clientId} does not have access to resource ${resource.siteResourceId}`
             );
             await sendCancel();
@@ -127,7 +127,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
         }
 
         if (!resource.networkId) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Resource ${resource.siteResourceId} has no network`
             );
             await sendCancel();
@@ -141,7 +141,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             .where(eq(siteNetworks.networkId, resource.networkId));
 
         if (!siteRows || siteRows.length === 0) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: No sites found for resource ${resource.siteResourceId}`
             );
             await sendCancel();
@@ -164,9 +164,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
     }
 
     if (sitesToProcess.length === 0) {
-        logger.error(
-            `handleOlmServerInitAddPeerHandshake: No sites to process`
-        );
+        logger.warn(`handleOlmServerInitAddPeerHandshake: No sites to process`);
         await sendCancel();
         return;
     }
@@ -193,7 +191,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
         }
 
         if (!site.exitNodeId) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Site ${site.siteId} has no exit node, skipping`
             );
             continue;
@@ -205,7 +203,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
             .where(eq(exitNodes.exitNodeId, site.exitNodeId));
 
         if (!exitNode) {
-            logger.error(
+            logger.warn(
                 `handleOlmServerInitAddPeerHandshake: Exit node not found for site ${site.siteId}, skipping`
             );
             continue;
@@ -229,7 +227,7 @@ export const handleOlmServerInitAddPeerHandshake: MessageHandler = async (
     }
 
     if (!handshakeInitiated) {
-        logger.error(
+        logger.warn(
             `handleOlmServerInitAddPeerHandshake: No accessible sites with valid exit nodes found, cancelling chain`
         );
         await sendCancel();

server/routers/redirect/createRedirect.ts

@@ -0,0 +1,202 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, domains, orgDomains, redirects, resources } from "@server/db";
+import type { Redirect } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, eq } from "drizzle-orm";
+import {
+    redirectDestinationDomainSchema,
+    redirectMatchPathSchema,
+    redirectPathMatchTypeSchema,
+    redirectRewritePathSchema,
+    redirectRewritePathTypeSchema
+} from "@server/routers/redirect/validation";
+import { getUniqueRedirectName } from "@server/db/names";
+
+export type CreateRedirectResponse = {
+    redirect: Redirect;
+};
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const bodySchema = z.strictObject({
+    name: z.string().nonempty(),
+    resourceId: z.number().int().positive().optional().nullable(),
+    domainId: z.string().nonempty().optional().nullable(),
+    subdomain: z.string().nonempty().optional().nullable(),
+    destinationDomain: redirectDestinationDomainSchema,
+    pathMatchType: redirectPathMatchTypeSchema.optional(),
+    matchPath: redirectMatchPathSchema,
+    rewritePath: redirectRewritePathSchema.optional().nullable(),
+    rewritePathType: redirectRewritePathTypeSchema.optional().nullable(),
+    permanent: z.boolean().optional(),
+    enabled: z.boolean().optional()
+}).refine(
+    (data) =>
+        // stripPrefix removes the matched prefix and needs no replacement
+        // value; every other rewrite type is meaningless without one.
+        !data.rewritePathType ||
+        data.rewritePathType === "stripPrefix" ||
+        Boolean(data.rewritePath),
+    {
+        message:
+            "rewritePath is required unless rewritePathType is stripPrefix",
+        path: ["rewritePath"]
+    }
+);
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/redirect",
+    description: "Create a redirect for an organization.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        201: {
+            description: "Successful response"
+        }
+    }
+});
+
+export async function createRedirect(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+        const {
+            name,
+            resourceId,
+            domainId,
+            subdomain,
+            destinationDomain,
+            pathMatchType,
+            matchPath,
+            rewritePath,
+            rewritePathType,
+            permanent,
+            enabled
+        } = parsedBody.data;
+
+        if (resourceId) {
+            const [resource] = await db
+                .select({ resourceId: resources.resourceId })
+                .from(resources)
+                .where(
+                    and(
+                        eq(resources.resourceId, resourceId),
+                        eq(resources.orgId, orgId)
+                    )
+                )
+                .limit(1);
+
+            if (!resource) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource with ID ${resourceId} not found`
+                    )
+                );
+            }
+        }
+
+        if (domainId) {
+            const [domain] = await db
+                .select({ domainId: domains.domainId })
+                .from(domains)
+                .innerJoin(
+                    orgDomains,
+                    eq(orgDomains.domainId, domains.domainId)
+                )
+                .where(
+                    and(
+                        eq(domains.domainId, domainId),
+                        eq(orgDomains.orgId, orgId)
+                    )
+                )
+                .limit(1);
+
+            if (!domain) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Domain with ID ${domainId} not found`
+                    )
+                );
+            }
+        }
+
+        const niceId = await getUniqueRedirectName(orgId);
+
+        const [redirect] = await db
+            .insert(redirects)
+            .values({
+                orgId,
+                name,
+                niceId,
+                resourceId: resourceId ?? null,
+                domainId: domainId ?? null,
+                subdomain: subdomain ?? null,
+                destinationDomain,
+                pathMatchType: pathMatchType ?? "regex",
+                matchPath,
+                rewritePath: rewritePath ?? null,
+                rewritePathType: rewritePathType ?? null,
+                permanent: permanent ?? false,
+                enabled: enabled ?? true
+            })
+            .returning();
+
+        return response<CreateRedirectResponse>(res, {
+            data: {
+                redirect
+            },
+            success: true,
+            error: false,
+            message: "Redirect created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/redirect/deleteRedirect.ts

@@ -0,0 +1,92 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { redirects, db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, eq } from "drizzle-orm";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    redirectId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/redirects/{redirectId}",
+    description: "Delete a redirect.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: paramsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response"
+        }
+    }
+});
+
+export async function deleteRedirect(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, redirectId } = parsedParams.data;
+
+        const [existing] = await db
+            .select({ redirectId: redirects.redirectId })
+            .from(redirects)
+            .where(
+                and(
+                    eq(redirects.redirectId, redirectId),
+                    eq(redirects.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Redirect with ID ${redirectId} not found`
+                )
+            );
+        }
+
+        await db
+            .delete(redirects)
+            .where(
+                and(
+                    eq(redirects.redirectId, redirectId),
+                    eq(redirects.orgId, orgId)
+                )
+            );
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Redirect deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/redirect/getRedirect.ts

@@ -0,0 +1,182 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { domains, redirects, resources, db } from "@server/db";
+import response from "@server/lib/response";
+import stoi from "@server/lib/stoi";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, eq } from "drizzle-orm";
+
+export type GetRedirectResponse = {
+    redirect: {
+        redirectId: number;
+        orgId: string;
+        niceId: string;
+        name: string;
+        subdomain: string | null;
+        destinationDomain: string;
+        pathMatchType: "exact" | "prefix" | "regex";
+        matchPath: string;
+        rewritePath: string | null;
+        rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
+        permanent: boolean;
+        enabled: boolean;
+        resourceId: number | null;
+        resourceName: string | null;
+        resourceNiceId: string | null;
+        resourceFullDomain: string | null;
+        resourceSsl: boolean | null;
+        resourceWildcard: boolean | null;
+        domainId: string | null;
+        baseDomain: string | null;
+    };
+};
+
+const redirectColumns = {
+    redirectId: redirects.redirectId,
+    orgId: redirects.orgId,
+    niceId: redirects.niceId,
+    name: redirects.name,
+    subdomain: redirects.subdomain,
+    destinationDomain: redirects.destinationDomain,
+    pathMatchType: redirects.pathMatchType,
+    matchPath: redirects.matchPath,
+    rewritePath: redirects.rewritePath,
+    rewritePathType: redirects.rewritePathType,
+    permanent: redirects.permanent,
+    enabled: redirects.enabled,
+    resourceId: redirects.resourceId,
+    resourceName: resources.name,
+    resourceNiceId: resources.niceId,
+    resourceFullDomain: resources.fullDomain,
+    resourceSsl: resources.ssl,
+    resourceWildcard: resources.wildcard,
+    domainId: redirects.domainId,
+    baseDomain: domains.baseDomain
+};
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    redirectId: z
+        .string()
+        .optional()
+        .transform(stoi)
+        .pipe(z.int().positive().optional())
+        .optional(),
+    niceId: z.string().optional()
+});
+
+async function query(orgId: string, redirectId?: number, niceId?: string) {
+    if (redirectId) {
+        const [res] = await db
+            .select(redirectColumns)
+            .from(redirects)
+            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
+            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
+            .where(
+                and(
+                    eq(redirects.redirectId, redirectId),
+                    eq(redirects.orgId, orgId)
+                )
+            )
+            .limit(1);
+        return res;
+    } else if (niceId) {
+        const [res] = await db
+            .select(redirectColumns)
+            .from(redirects)
+            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
+            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
+            .where(
+                and(eq(redirects.niceId, niceId), eq(redirects.orgId, orgId))
+            )
+            .limit(1);
+        return res;
+    }
+}
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/redirects/{redirectId}",
+    description: "Get a redirect by ID.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: z.object({
+            orgId: z.string(),
+            redirectId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response"
+        }
+    }
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/redirect/{niceId}",
+    description:
+        "Get a redirect by orgId and niceId. NiceId is a readable ID for the redirect and unique on a per org basis.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: z.object({
+            orgId: z.string(),
+            niceId: z.string()
+        })
+    },
+    responses: {
+        200: {
+            description: "Successful response"
+        }
+    }
+});
+
+export async function getRedirect(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, redirectId, niceId } = parsedParams.data;
+
+        const redirect = await query(orgId, redirectId, niceId);
+
+        if (!redirect) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Redirect with ID ${redirectId || niceId} not found`
+                )
+            );
+        }
+
+        return response<GetRedirectResponse>(res, {
+            data: {
+                redirect
+            },
+            success: true,
+            error: false,
+            message: "Redirect retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/redirect/index.ts

@@ -0,0 +1,5 @@
+export * from "./createRedirect";
+export * from "./listRedirects";
+export * from "./getRedirect";
+export * from "./updateRedirect";
+export * from "./deleteRedirect";

server/routers/redirect/listRedirects.ts

@@ -0,0 +1,197 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { domains, redirects, resources, db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, asc, desc, eq, like, or, sql } from "drizzle-orm";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+export type ListRedirectsResponse = PaginatedResponse<{
+    redirects: Array<{
+        redirectId: number;
+        orgId: string;
+        niceId: string;
+        name: string;
+        subdomain: string | null;
+        destinationDomain: string;
+        pathMatchType: "exact" | "prefix" | "regex";
+        matchPath: string;
+        rewritePath: string | null;
+        rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
+        permanent: boolean;
+        enabled: boolean;
+        resourceId: number | null;
+        resourceName: string | null;
+        resourceNiceId: string | null;
+        resourceFullDomain: string | null;
+        domainId: string | null;
+        baseDomain: string | null;
+    }>;
+}>;
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+const listSchema = z.object({
+    pageSize: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>()
+        .int()
+        .min(0)
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional()
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/redirects",
+    description: "List redirects for an organization.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: paramsSchema,
+        query: listSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response"
+        }
+    }
+});
+
+export async function listRedirects(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        if (req.user && orgId && orgId !== req.userOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        const { pageSize, page, query } = parsedQuery.data;
+        const conditions = [eq(redirects.orgId, orgId)];
+
+        if (query) {
+            const term = "%" + query.toLowerCase() + "%";
+            conditions.push(
+                or(
+                    like(sql`LOWER(${redirects.name})`, term),
+                    like(sql`LOWER(${redirects.matchPath})`, term),
+                    like(sql`LOWER(${redirects.destinationDomain})`, term)
+                )!
+            );
+        }
+
+        const baseQuery = db
+            .select({
+                redirectId: redirects.redirectId,
+                orgId: redirects.orgId,
+                niceId: redirects.niceId,
+                name: redirects.name,
+                subdomain: redirects.subdomain,
+                destinationDomain: redirects.destinationDomain,
+                pathMatchType: redirects.pathMatchType,
+                matchPath: redirects.matchPath,
+                rewritePath: redirects.rewritePath,
+                rewritePathType: redirects.rewritePathType,
+                permanent: redirects.permanent,
+                enabled: redirects.enabled,
+                resourceId: redirects.resourceId,
+                resourceName: resources.name,
+                resourceNiceId: resources.niceId,
+                resourceFullDomain: resources.fullDomain,
+                domainId: redirects.domainId,
+                baseDomain: domains.baseDomain
+            })
+            .from(redirects)
+            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
+            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
+            .where(and(...conditions));
+
+        const countQuery = db.$count(
+            db
+                .select()
+                .from(redirects)
+                .where(and(...conditions))
+                .as("filtered_redirects")
+        );
+
+        const [totalCount, rows] = await Promise.all([
+            countQuery,
+            baseQuery
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(desc(redirects.redirectId))
+        ]);
+
+        return response<ListRedirectsResponse>(res, {
+            data: {
+                redirects: rows,
+                pagination: {
+                    total: totalCount,
+                    pageSize,
+                    page
+                }
+            },
+            success: true,
+            error: false,
+            message: "Redirects retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/redirect/updateRedirect.ts

@@ -0,0 +1,252 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, domains, orgDomains, redirects, resources } from "@server/db";
+import type { Redirect } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, eq, ne } from "drizzle-orm";
+import {
+    redirectNiceIdSchema,
+    redirectDestinationDomainSchema,
+    redirectMatchPathSchema,
+    redirectPathMatchTypeSchema,
+    redirectRewritePathSchema,
+    redirectRewritePathTypeSchema
+} from "@server/routers/redirect/validation";
+
+export type UpdateRedirectResponse = {
+    redirect: Redirect;
+};
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    redirectId: z.coerce.number().int().positive()
+});
+
+const bodySchema = z.strictObject({
+    name: z.string().nonempty().optional(),
+    niceId: redirectNiceIdSchema.optional(),
+    resourceId: z.number().int().positive().optional().nullable(),
+    domainId: z.string().nonempty().optional().nullable(),
+    subdomain: z.string().nonempty().optional().nullable(),
+    destinationDomain: redirectDestinationDomainSchema.optional(),
+    pathMatchType: redirectPathMatchTypeSchema.optional(),
+    matchPath: redirectMatchPathSchema.optional(),
+    rewritePath: redirectRewritePathSchema.optional().nullable(),
+    rewritePathType: redirectRewritePathTypeSchema.optional().nullable(),
+    permanent: z.boolean().optional(),
+    enabled: z.boolean().optional()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/redirects/{redirectId}",
+    description: "Update a redirect.",
+    tags: [OpenAPITags.Redirect],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response"
+        }
+    }
+});
+
+export async function updateRedirect(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { orgId, redirectId } = parsedParams.data;
+        const body = parsedBody.data;
+
+        const [existing] = await db
+            .select()
+            .from(redirects)
+            .where(
+                and(
+                    eq(redirects.redirectId, redirectId),
+                    eq(redirects.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Redirect with ID ${redirectId} not found`
+                )
+            );
+        }
+
+        if (body.resourceId) {
+            const [resource] = await db
+                .select({ resourceId: resources.resourceId })
+                .from(resources)
+                .where(
+                    and(
+                        eq(resources.resourceId, body.resourceId),
+                        eq(resources.orgId, existing.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (!resource) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Resource with ID ${body.resourceId} not found`
+                    )
+                );
+            }
+        }
+
+        if (body.domainId) {
+            const [domain] = await db
+                .select({ domainId: domains.domainId })
+                .from(domains)
+                .innerJoin(
+                    orgDomains,
+                    eq(orgDomains.domainId, domains.domainId)
+                )
+                .where(
+                    and(
+                        eq(domains.domainId, body.domainId),
+                        eq(orgDomains.orgId, existing.orgId)
+                    )
+                )
+                .limit(1);
+
+            if (!domain) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Domain with ID ${body.domainId} not found`
+                    )
+                );
+            }
+        }
+
+        if (body.niceId) {
+            const [existingNiceId] = await db
+                .select()
+                .from(redirects)
+                .where(
+                    and(
+                        eq(redirects.niceId, body.niceId),
+                        eq(redirects.orgId, existing.orgId),
+                        ne(redirects.redirectId, existing.redirectId) // exclude the current redirect from the search
+                    )
+                )
+                .limit(1);
+
+            if (existingNiceId) {
+                return next(
+                    createHttpError(
+                        HttpCode.CONFLICT,
+                        `A redirect with niceId "${body.niceId}" already exists`
+                    )
+                );
+            }
+        }
+
+        const updateData: Partial<typeof redirects.$inferInsert> = {};
+
+        if (body.name !== undefined) {
+            updateData.name = body.name;
+        }
+        if (body.niceId !== undefined) {
+            updateData.niceId = body.niceId;
+        }
+        if (body.resourceId !== undefined) {
+            updateData.resourceId = body.resourceId;
+        }
+        if (body.domainId !== undefined) {
+            updateData.domainId = body.domainId;
+        }
+        if (body.subdomain !== undefined) {
+            updateData.subdomain = body.subdomain;
+        }
+        if (body.destinationDomain !== undefined) {
+            updateData.destinationDomain = body.destinationDomain;
+        }
+        if (body.pathMatchType !== undefined) {
+            updateData.pathMatchType = body.pathMatchType;
+        }
+        if (body.matchPath !== undefined) {
+            updateData.matchPath = body.matchPath;
+        }
+        if (body.rewritePath !== undefined) {
+            updateData.rewritePath = body.rewritePath;
+        }
+        if (body.rewritePathType !== undefined) {
+            updateData.rewritePathType = body.rewritePathType;
+        }
+        if (body.permanent !== undefined) {
+            updateData.permanent = body.permanent;
+        }
+        if (body.enabled !== undefined) {
+            updateData.enabled = body.enabled;
+        }
+
+        const [redirect] = await db
+            .update(redirects)
+            .set(updateData)
+            .where(
+                and(
+                    eq(redirects.redirectId, redirectId),
+                    eq(redirects.orgId, orgId)
+                )
+            )
+            .returning();
+
+        return response<UpdateRedirectResponse>(res, {
+            data: {
+                redirect
+            },
+            success: true,
+            error: false,
+            message: "Redirect updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/redirect/validation.ts

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { isValidDomain } from "@server/lib/validators";
+
+export const redirectNiceIdSchema = z
+    .string()
+    .min(1)
+    .max(255)
+    .regex(
+        /^[a-zA-Z0-9-]+$/,
+        "niceId can only contain letters, numbers, and dashes"
+    );
+
+export const redirectPathMatchTypeSchema = z.enum(["exact", "prefix", "regex"]);
+
+export const redirectRewritePathTypeSchema = z.enum([
+    "exact",
+    "prefix",
+    "regex",
+    "stripPrefix"
+]);
+
+export const redirectMatchPathSchema = z.string().nonempty().default("*");
+
+export const redirectRewritePathSchema = z.string().nonempty();
+
+export const redirectDestinationDomainSchema = z
+    .string()
+    .nonempty()
+    .refine(isValidDomain, {
+        message: "Invalid domain"
+    });

server/routers/ws/ws.ts

@@ -353,7 +353,10 @@ const setupConnection = async (
 
             const handler = messageHandlers[message.type];
             if (!handler) {
-                throw new Error(`Unsupported message type: ${message.type}`);
+                logger.debug(
+                    `No handler found for message type: ${message.type}`
+                );
+                return;
             }
 
             const response = await handler({

src/app/[orgId]/keys/page.tsx

@@ -76,6 +76,11 @@ export default async function KeysPage(props: KeysPageProps) {
         redirect("/");
     }
 
+    const env = pullEnv();
+    if (env.flags.disableVirtualApiKeysUi) {
+        redirect(`/${orgId}`);
+    }
+
     let keysData: ListMyVirtualApiKeysResponse | null = null;
     try {
         const res = await internal.get<
@@ -90,7 +95,6 @@ export default async function KeysPage(props: KeysPageProps) {
         redirect(`/${orgId}`);
     }
 
-    const env = pullEnv();
     const primaryOrg = orgs.find((o) => o.orgId === orgId)?.isPrimaryOrg;
     const isAdminOrOwner = Boolean(overview?.isAdmin || overview?.isOwner);
 
@@ -106,6 +110,7 @@ export default async function KeysPage(props: KeysPageProps) {
                 showSidebar={false}
                 launcherMode
                 showViewAsAdmin={isAdminOrOwner}
+                env={env}
             >
                 <UserVirtualApiKeys orgId={orgId} initialData={keysData} />
             </Layout>

src/app/[orgId]/layout.tsx

@@ -104,7 +104,7 @@ export default async function OrgLayout(props: {
             subscriptionStatus = subRes.data.data;
         } catch (error) {
             // If subscription fetch fails, keep subscriptionStatus as null
-            console.error("Failed to fetch subscription status:", error);
+            // console.error("Failed to fetch subscription status:", error);
         }
     }
 

src/app/[orgId]/page.tsx

@@ -83,6 +83,7 @@ export default async function OrgPage(props: OrgPageProps) {
                 showSidebar={false}
                 launcherMode
                 showViewAsAdmin={isAdminOrOwner}
+                env={env}
             >
                 {overview && launcherData ? (
                     <ResourceLauncher

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -13,7 +13,12 @@ import { StrategyOption, StrategySelect } from "@app/components/StrategySelect";
 import HeaderTitle from "@app/components/SettingsSectionTitle";
 import { Button } from "@app/components/ui/button";
 import { useParams, useRouter } from "next/navigation";
-import { useActionState, useRef, useState } from "react";
+import {
+    useActionState,
+    useRef,
+    useState,
+    startTransition
+} from "react";
 import {
     Form,
     FormControl,
@@ -518,9 +523,12 @@ export default function Page() {
                                         <SettingsSectionForm>
                                             <Form {...internalForm}>
                                                 <form
-                                                    action={
-                                                        submitInternalAction
-                                                    }
+                                                    onSubmit={(e) => {
+                                                        e.preventDefault();
+                                                        startTransition(() => {
+                                                            submitInternalAction();
+                                                        });
+                                                    }}
                                                     className="space-y-4"
                                                     id="create-user-form"
                                                 >

src/app/[orgId]/settings/general/page.tsx

@@ -3,7 +3,12 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { Button } from "@app/components/ui/button";
 import { useOrgContext } from "@app/hooks/useOrgContext";
 import { toast } from "@app/hooks/useToast";
-import { useState, useTransition, useActionState } from "react";
+import {
+    useState,
+    useTransition,
+    useActionState,
+    startTransition
+} from "react";
 import {
     Form,
     FormControl,
@@ -243,7 +248,12 @@ function GeneralSectionForm({ org }: SectionFormProps) {
                 <SettingsSectionForm>
                     <Form {...form}>
                         <form
-                            action={formAction}
+                            onSubmit={(e) => {
+                                e.preventDefault();
+                                startTransition(() => {
+                                    formAction();
+                                });
+                            }}
                             className="grid gap-4"
                             id="org-general-settings-form"
                         >

src/app/[orgId]/settings/general/security/page.tsx

@@ -3,7 +3,13 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { Button } from "@app/components/ui/button";
 import { useOrgContext } from "@app/hooks/useOrgContext";
 import { toast } from "@app/hooks/useToast";
-import { useState, useRef, useActionState, type ComponentRef } from "react";
+import {
+    useState,
+    useRef,
+    useActionState,
+    startTransition,
+    type ComponentRef
+} from "react";
 import {
     Form,
     FormControl,
@@ -117,6 +123,7 @@ export default function SecurityPage() {
 }
 
 function LogRetentionSectionForm({ org }: SectionFormProps) {
+    const { updateOrg } = useOrgContext();
     const form = useForm({
         resolver: zodResolver(
             SecurityFormSchema.pick({
@@ -173,6 +180,11 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
             // Update organization
             await api.post(`/org/${org.orgId}`, reqData);
 
+            // Update the org context immediately so the dropdowns reflect
+            // the saved values without waiting on a re-fetch that could
+            // race a lagging read replica
+            updateOrg(reqData);
+
             toast({
                 title: t("orgUpdated"),
                 description: t("orgUpdatedDescription")
@@ -199,7 +211,12 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
                 <SettingsSectionForm>
                     <Form {...form}>
                         <form
-                            action={formAction}
+                            onSubmit={(e) => {
+                                e.preventDefault();
+                                startTransition(() => {
+                                    formAction();
+                                });
+                            }}
                             className="grid gap-4"
                             id="org-log-retention-settings-form"
                         >
@@ -827,6 +844,7 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
 
 function SecuritySettingsSectionForm({ org }: SectionFormProps) {
     const router = useRouter();
+    const { updateOrg } = useOrgContext();
     const form = useForm({
         resolver: zodResolver(
             SecurityFormSchema.pick({
@@ -899,6 +917,11 @@ function SecuritySettingsSectionForm({ org }: SectionFormProps) {
             // Update organization
             await api.post(`/org/${org.orgId}`, reqData);
 
+            // Update the org context immediately so the dropdowns reflect
+            // the saved values without waiting on a re-fetch that could
+            // race a lagging read replica
+            updateOrg(reqData);
+
             toast({
                 title: t("orgUpdated"),
                 description: t("orgUpdatedDescription")
@@ -942,7 +965,12 @@ function SecuritySettingsSectionForm({ org }: SectionFormProps) {
                     <SettingsSectionForm>
                         <Form {...form}>
                             <form
-                                action={formAction}
+                                onSubmit={(e) => {
+                                    e.preventDefault();
+                                    startTransition(() => {
+                                        formAction();
+                                    });
+                                }}
                                 ref={formRef}
                                 id="security-settings-section-form"
                                 className="space-y-4"

src/app/[orgId]/settings/redirects/[niceId]/page.tsx

@@ -0,0 +1,73 @@
+import RedirectForm from "@app/components/RedirectForm";
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import { Button } from "@app/components/ui/button";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { GetRedirectResponse } from "@server/routers/redirect";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+
+export const metadata: Metadata = {
+    title: "Edit Redirect"
+};
+
+export const dynamic = "force-dynamic";
+
+type EditRedirectPageProps = {
+    params: Promise<{ orgId: string; niceId: string }>;
+};
+
+export default async function EditRedirectPage(props: EditRedirectPageProps) {
+    const { orgId, niceId } = await props.params;
+    const t = await getTranslations();
+
+    let redirect: GetRedirectResponse["redirect"];
+    try {
+        const res = await internal.get<AxiosResponse<GetRedirectResponse>>(
+            `/org/${orgId}/redirect/${niceId}`,
+            await authCookieHeader()
+        );
+        redirect = res.data.data.redirect;
+    } catch {
+        notFound();
+    }
+
+    // The resource selector needs the resource's display fields up front so the
+    // trigger shows a name instead of a bare id before the list query resolves.
+    const initialResource =
+        redirect.resourceId && redirect.resourceNiceId
+            ? {
+                  resourceId: redirect.resourceId,
+                  niceId: redirect.resourceNiceId,
+                  name: redirect.resourceName ?? redirect.resourceNiceId,
+                  fullDomain: redirect.resourceFullDomain,
+                  ssl: redirect.resourceSsl ?? false,
+                  wildcard: redirect.resourceWildcard ?? false
+              }
+            : null;
+
+    return (
+        <>
+            <div className="flex gap-2 justify-between">
+                <SettingsSectionTitle
+                    title={redirect.name}
+                    description={t("redirectEditDescription")}
+                />
+                <Button variant="outline" asChild>
+                    <Link href={`/${orgId}/settings/redirects`}>
+                        {t("redirectGoBack")}
+                    </Link>
+                </Button>
+            </div>
+
+            <RedirectForm
+                orgId={orgId}
+                redirect={redirect}
+                initialResource={initialResource}
+            />
+        </>
+    );
+}

src/app/[orgId]/settings/redirects/create/page.tsx

@@ -0,0 +1,39 @@
+import RedirectForm from "@app/components/RedirectForm";
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import { Button } from "@app/components/ui/button";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import Link from "next/link";
+
+export const metadata: Metadata = {
+    title: "Create Redirect"
+};
+
+type CreateRedirectPageProps = {
+    params: Promise<{ orgId: string }>;
+};
+
+export default async function CreateRedirectPage(
+    props: CreateRedirectPageProps
+) {
+    const { orgId } = await props.params;
+    const t = await getTranslations();
+
+    return (
+        <>
+            <div className="flex gap-2 justify-between">
+                <SettingsSectionTitle
+                    title={t("redirectCreate")}
+                    description={t("redirectCreateDescription")}
+                />
+                <Button variant="outline" asChild>
+                    <Link href={`/${orgId}/settings/redirects`}>
+                        {t("redirectGoBack")}
+                    </Link>
+                </Button>
+            </div>
+
+            <RedirectForm orgId={orgId} />
+        </>
+    );
+}

src/app/[orgId]/settings/redirects/page.tsx

@@ -0,0 +1,81 @@
+import RedirectsTable from "@app/components/RedirectsTable";
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { ListRedirectsResponse } from "@server/routers/redirect";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Redirects"
+};
+
+type RedirectIndexPageProps = {
+    params: Promise<{ orgId: string }>;
+    searchParams: Promise<Record<string, string>>;
+};
+
+export const dynamic = "force-dynamic";
+
+export default async function RedirectIndexPage(props: RedirectIndexPageProps) {
+    const { orgId } = await props.params;
+    const searchParams = new URLSearchParams(await props.searchParams);
+    const t = await getTranslations();
+
+    let redirects: ListRedirectsResponse["redirects"] = [];
+    let pagination: ListRedirectsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<ListRedirectsResponse>>(
+            `/org/${orgId}/redirects?${searchParams.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        redirects = responseData.redirects;
+        pagination = responseData.pagination;
+    } catch {
+        // empty list on error
+    }
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("redirectsTitle")}
+                description={t("redirectsDescription")}
+            />
+
+            <RedirectsTable
+                orgId={orgId}
+                redirects={redirects.map((redirect) => ({
+                    redirectId: redirect.redirectId,
+                    niceId: redirect.niceId,
+                    name: redirect.name,
+                    subdomain: redirect.subdomain,
+                    destinationDomain: redirect.destinationDomain,
+                    pathMatchType: redirect.pathMatchType,
+                    matchPath: redirect.matchPath,
+                    rewritePath: redirect.rewritePath,
+                    rewritePathType: redirect.rewritePathType,
+                    permanent: redirect.permanent,
+                    enabled: redirect.enabled,
+                    resourceId: redirect.resourceId,
+                    resourceName: redirect.resourceName,
+                    resourceNiceId: redirect.resourceNiceId,
+                    resourceFullDomain: redirect.resourceFullDomain,
+                    domainId: redirect.domainId,
+                    baseDomain: redirect.baseDomain
+                }))}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}

src/app/[orgId]/settings/resources/private/[niceId]/ai-gateway/page.tsx

@@ -41,7 +41,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
-import { useActionState, useEffect, useMemo } from "react";
+import { useActionState, useEffect, useMemo, startTransition } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
@@ -232,7 +232,12 @@ export default function PrivateResourceInferencePage() {
                     <SettingsSectionForm variant="half">
                         <Form {...form}>
                             <form
-                                action={formAction}
+                                onSubmit={(e) => {
+                                    e.preventDefault();
+                                    startTransition(() => {
+                                        formAction();
+                                    });
+                                }}
                                 id="private-resource-providers-form"
                             >
                                 <SettingsFormGrid>

src/app/[orgId]/settings/resources/private/[niceId]/general/page.tsx

@@ -29,7 +29,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 import { ExternalLink } from "lucide-react";
-import { useActionState, useMemo } from "react";
+import { useActionState, useMemo, startTransition } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 import { useSaveSiteResource } from "@app/hooks/useSaveSiteResource";
@@ -97,7 +97,12 @@ export default function PrivateResourceGeneralPage() {
                     <SettingsSectionForm variant="half">
                         <Form {...form}>
                             <form
-                                action={formAction}
+                                onSubmit={(e) => {
+                                    e.preventDefault();
+                                    startTransition(() => {
+                                        formAction();
+                                    });
+                                }}
                                 id="private-resource-general-form"
                             >
                                 <SettingsFormGrid>

src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx

@@ -41,7 +41,13 @@ import { AxiosResponse } from "axios";
 import { useTranslations } from "next-intl";
 import { useParams, useRouter } from "next/navigation";
 import { toASCII, toUnicode } from "punycode";
-import { useActionState, useEffect, useMemo, useState } from "react";
+import {
+    useActionState,
+    useEffect,
+    useMemo,
+    useState,
+    startTransition
+} from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import z from "zod";
@@ -282,7 +288,12 @@ export default function GeneralForm() {
                         <SettingsSectionForm variant="half">
                             <Form {...form}>
                                 <form
-                                    action={formAction}
+                                    onSubmit={(e) => {
+                                        e.preventDefault();
+                                        startTransition(() => {
+                                            formAction();
+                                        });
+                                    }}
                                     id="general-settings-form"
                                 >
                                     <SettingsFormGrid>

src/app/[orgId]/settings/resources/public/[niceId]/http/page.tsx

@@ -41,7 +41,7 @@ import {
 import { AxiosResponse } from "axios";
 import { useTranslations } from "next-intl";
 import { useParams, useRouter } from "next/navigation";
-import { useActionState, useState } from "react";
+import { useActionState, useState, startTransition } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
@@ -209,7 +209,15 @@ function ProxyResourceHttpForm({
             <SettingsSectionBody>
                 <SettingsSectionForm variant="half">
                     <Form {...form}>
-                        <form action={formAction} id="http-settings-form">
+                        <form
+                            onSubmit={(e) => {
+                                e.preventDefault();
+                                startTransition(() => {
+                                    formAction();
+                                });
+                            }}
+                            id="http-settings-form"
+                        >
                             <SettingsFormGrid>
                                 {!env.flags.usePangolinDns && (
                                     <SettingsFormCell span="full">

src/app/[orgId]/settings/resources/public/[niceId]/maintenance/page.tsx

@@ -37,7 +37,7 @@ import { AxiosResponse } from "axios";
 import { AlertCircle } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useParams, useRouter } from "next/navigation";
-import { useActionState, useEffect } from "react";
+import { useActionState, useEffect, startTransition } from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import z from "zod";
@@ -203,7 +203,12 @@ export default function ResourceMaintenancePage() {
                     <SettingsSectionForm variant="half">
                         <Form {...maintenanceForm}>
                             <form
-                                action={maintenanceFormAction}
+                                onSubmit={(e) => {
+                                    e.preventDefault();
+                                    startTransition(() => {
+                                        maintenanceFormAction();
+                                    });
+                                }}
                                 id="maintenance-settings-form"
                             >
                                 <SettingsFormGrid>

src/app/[orgId]/settings/resources/public/[niceId]/tcp/page.tsx

@@ -48,7 +48,8 @@ import { useRouter } from "next/navigation";
 import {
     use,
     useActionState,
-    useMemo
+    useMemo,
+    startTransition
 } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
@@ -206,7 +207,12 @@ function ProxyResourceProtocolForm({
                 <SettingsSectionForm variant="half">
                     <Form {...proxySettingsForm}>
                         <form
-                            action={formAction}
+                            onSubmit={(e) => {
+                                e.preventDefault();
+                                startTransition(() => {
+                                    formAction();
+                                });
+                            }}
                             id="proxy-protocol-settings-form"
                         >
                             <SettingsFormGrid>

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -30,9 +30,15 @@ import { normalizePostAuthPath } from "@server/lib/normalizePostAuthPath";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type { Metadata } from "next";
 
-export const metadata: Metadata = {
-    title: "Resource Access"
-};
+export async function generateMetadata(): Promise<Metadata> {
+    const env = pullEnv();
+    const title =
+        env.branding.resourceAuthPage?.titleText ||
+        env.branding.appName ||
+        "Resource Access";
+
+    return { title };
+}
 
 export const dynamic = "force-dynamic";
 

src/app/navigation.tsx

@@ -25,6 +25,7 @@ import {
     MonitorUp,
     Plug,
     ReceiptText,
+    Repeat,
     ScanEye,
     Server,
     Settings,
@@ -53,17 +54,21 @@ export type OrgNavSectionsOptions = {
 };
 
 // Merged from 'user-management-and-resources' branch
-export const orgLangingNavItems: SidebarNavItem[] = [
+export const orgLangingNavItems = (env?: Env): SidebarNavItem[] => [
     {
         title: "sidebarAccount",
         href: "/{orgId}",
         icon: <LayoutGrid className="size-4 flex-none" />
     },
-    {
-        title: "sidebarMyApiKeys",
-        href: "/{orgId}/keys",
-        icon: <KeyRound className="size-4 flex-none" />
-    }
+    ...(!env?.flags.disableVirtualApiKeysUi
+        ? [
+              {
+                  title: "sidebarMyApiKeys",
+                  href: "/{orgId}/keys",
+                  icon: <KeyRound className="size-4 flex-none" />
+              }
+          ]
+        : [])
 ];
 
 export const orgNavSections = (
@@ -136,6 +141,11 @@ export const orgNavSections = (
                 href: "/{orgId}/settings/domains",
                 icon: <Globe className="size-4 flex-none" />
             },
+            {
+                title: "sidebarRedirects",
+                href: "/{orgId}/settings/redirects",
+                icon: <Repeat className="size-4 flex-none" />
+            },
             ...(build === "saas"
                 ? [
                       {
@@ -457,6 +467,11 @@ export const commandBarNavSections = (
                 title: "commandMachineClients",
                 icon: <Server className="size-4 flex-none" />
             },
+            {
+                title: "sidebarRedirects",
+                href: "/{orgId}/settings/redirects",
+                icon: <Repeat className="size-4 flex-none" />
+            },
             ...(build === "saas"
                 ? [
                       {

src/components/Layout.tsx

@@ -1,6 +1,7 @@
 import React from "react";
 import { cn } from "@app/lib/cn";
 import { ListUserOrgsResponse } from "@server/routers/org";
+import { Env } from "@app/lib/types/env";
 import {
     orgLangingNavItems,
     type CommandBarNavSection,
@@ -25,6 +26,7 @@ interface LayoutProps {
     defaultSidebarCollapsed?: boolean;
     launcherMode?: boolean;
     showViewAsAdmin?: boolean;
+    env?: Env;
 }
 
 export async function Layout({
@@ -38,7 +40,8 @@ export async function Layout({
     showTopBar = true,
     defaultSidebarCollapsed = false,
     launcherMode = false,
-    showViewAsAdmin = false
+    showViewAsAdmin = false,
+    env
 }: LayoutProps) {
     const allCookies = await cookies();
     const sidebarStateCookie = allCookies.get("pangolin-sidebar-state")?.value;
@@ -49,7 +52,7 @@ export async function Layout({
         (sidebarStateCookie !== "expanded" && defaultSidebarCollapsed);
 
     const launcherNavItems: SidebarNavItem[] = launcherMode
-        ? orgLangingNavItems
+        ? orgLangingNavItems(env)
         : [];
 
     return (

src/components/OrgLabelForm.tsx

@@ -62,7 +62,8 @@ export function OrgLabelForm({
             <form
                 id="org-label-form"
                 className="flex flex-col gap-4 px-0.5"
-                action={async () => {
+                onSubmit={async (e) => {
+                    e.preventDefault();
                     if (await form.trigger()) {
                         onSubmit(form.getValues());
                     }

src/components/RedirectForm.tsx

@@ -0,0 +1,847 @@
+"use client";
+
+import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
+import {
+    SettingsContainer,
+    SettingsFormCell,
+    SettingsFormGrid,
+    SettingsSection,
+    SettingsSectionBody,
+    SettingsSectionDescription,
+    SettingsSectionFooter,
+    SettingsSectionForm,
+    SettingsSectionHeader,
+    SettingsSectionTitle
+} from "@app/components/Settings";
+import { SwitchInput } from "@app/components/SwitchInput";
+import { Button } from "@app/components/ui/button";
+import {
+    Form,
+    FormControl,
+    FormDescription,
+    FormField,
+    FormItem,
+    FormLabel,
+    FormMessage
+} from "@app/components/ui/form";
+import { Input } from "@app/components/ui/input";
+import {
+    Popover,
+    PopoverContent,
+    PopoverTrigger
+} from "@app/components/ui/popover";
+import {
+    Select,
+    SelectContent,
+    SelectItem,
+    SelectTrigger,
+    SelectValue
+} from "@app/components/ui/select";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { toast } from "@app/hooks/useToast";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { isValidDomain } from "@server/lib/validators";
+import { cn } from "@app/lib/cn";
+import { CaretSortIcon } from "@radix-ui/react-icons";
+import { zodResolver } from "@hookform/resolvers/zod";
+import type {
+    CreateRedirectResponse,
+    GetRedirectResponse
+} from "@server/routers/redirect";
+import type { AxiosResponse } from "axios";
+import { useTranslations } from "next-intl";
+import { useRouter } from "next/navigation";
+import { useActionState, useEffect, useMemo, useState } from "react";
+import { useForm } from "react-hook-form";
+import { z } from "zod";
+import { ResourceSelector, type SelectedResource } from "./resource-selector";
+import {
+    PathMatchDisplay,
+    PathMatchModal,
+    PathRewriteDisplay,
+    PathRewriteModal
+} from "@app/components/PathMatchRenameModal";
+import { Plus } from "lucide-react";
+import DomainPicker from "@app/components/DomainPicker";
+import Link from "next/link";
+
+const DEFAULT_MATCH_PATH = ".*";
+const DEFAULT_PATH_MATCH_TYPE = "regex" as const;
+
+export type ExistingRedirect = GetRedirectResponse["redirect"];
+
+type RedirectFormProps = {
+    orgId: string;
+    /** Omit to create a new redirect. */
+    redirect?: ExistingRedirect;
+    /** Name/domain of the resource the redirect is attached to, when there is one. */
+    initialResource?: SelectedResource | null;
+};
+
+export default function RedirectForm({
+    orgId,
+    redirect,
+    initialResource = null
+}: RedirectFormProps) {
+    const isEditing = Boolean(redirect);
+    const { env } = useEnvContext();
+    const api = createApiClient({ env });
+    const router = useRouter();
+    const t = useTranslations();
+
+    const [, formAction, saveLoading] = useActionState(onSubmit, null);
+    const [deleteLoading, setDeleteLoading] = useState(false);
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [selectedResource, setSelectedResource] =
+        useState<SelectedResource | null>(initialResource);
+
+    // DomainPicker only hands back the composed host through its callback, so
+    // keep it locally; seed from the saved redirect for the edit case.
+    const [domainFullDomain, setDomainFullDomain] = useState<string | null>(
+        redirect?.baseDomain
+            ? [redirect.subdomain, redirect.baseDomain]
+                  .filter(Boolean)
+                  .join(".")
+            : null
+    );
+
+    const formSchema = useMemo(
+        () =>
+            z
+                .object({
+                    name: z
+                        .string()
+                        .trim()
+                        .min(1, { message: t("nameRequired") }),
+                    attachTo: z.enum(["domain", "resource"]),
+                    domainId: z.string().nullable(),
+                    subdomain: z.string().nullable(),
+                    resourceId: z.number().int().positive().nullable(),
+                    destinationDomain: z
+                        .string()
+                        .trim()
+                        .min(1, {
+                            message: t("redirectDestinationDomainRequired")
+                        })
+                        .refine(isValidDomain, {
+                            message: t("redirectDestinationDomainInvalid")
+                        }),
+                    pathMatchType: z.enum(["exact", "prefix", "regex"]),
+                    matchPath: z.string().trim().min(1),
+                    rewritePath: z.string().nullable(),
+                    rewritePathType: z
+                        .enum(["exact", "prefix", "regex", "stripPrefix"])
+                        .nullable(),
+                    permanent: z.boolean(),
+                    enabled: z.boolean()
+                })
+                .superRefine((data, ctx) => {
+                    if (data.attachTo === "domain" && !data.domainId) {
+                        ctx.addIssue({
+                            code: "custom",
+                            message: t("redirectDomainRequired"),
+                            path: ["domainId"]
+                        });
+                    }
+                    if (data.attachTo === "resource" && !data.resourceId) {
+                        ctx.addIssue({
+                            code: "custom",
+                            message: t("redirectResourceRequired"),
+                            path: ["resourceId"]
+                        });
+                    }
+                    // stripPrefix drops the matched prefix outright, so it is
+                    // the one rewrite type that needs no replacement value.
+                    if (
+                        data.rewritePathType &&
+                        data.rewritePathType !== "stripPrefix" &&
+                        !data.rewritePath
+                    ) {
+                        ctx.addIssue({
+                            code: "custom",
+                            message: t("redirectRewritePathRequired"),
+                            path: ["rewritePath"]
+                        });
+                    }
+                }),
+        [t]
+    );
+
+    type RedirectFormValues = z.infer<typeof formSchema>;
+
+    const form = useForm<RedirectFormValues>({
+        resolver: zodResolver(formSchema),
+        defaultValues: {
+            name: redirect?.name ?? "",
+            attachTo: redirect?.resourceId ? "resource" : "domain",
+            domainId: redirect?.domainId ?? null,
+            subdomain: redirect?.subdomain ?? null,
+            resourceId: redirect?.resourceId ?? null,
+            destinationDomain: redirect?.destinationDomain ?? "",
+            pathMatchType: redirect?.pathMatchType ?? DEFAULT_PATH_MATCH_TYPE,
+            matchPath: redirect?.matchPath ?? DEFAULT_MATCH_PATH,
+            rewritePath: redirect?.rewritePath ?? null,
+            rewritePathType: redirect?.rewritePathType ?? null,
+            permanent: redirect?.permanent ?? false,
+            enabled: redirect?.enabled ?? true
+        }
+    });
+
+    const attachTo = form.watch("attachTo");
+
+    const sourceFullDomain =
+        attachTo === "domain"
+            ? domainFullDomain
+            : (selectedResource?.fullDomain ?? null);
+
+    // Mirror is UI-only state; on edit, infer it from whether the saved
+    // destination already equals the source host.
+    const [sameDomainAsSource, setSameDomainAsSource] = useState(
+        Boolean(
+            redirect &&
+                sourceFullDomain &&
+                redirect.destinationDomain === sourceFullDomain
+        )
+    );
+
+    useEffect(() => {
+        if (sameDomainAsSource && sourceFullDomain) {
+            form.setValue("destinationDomain", sourceFullDomain, {
+                shouldValidate: true
+            });
+        }
+    }, [sameDomainAsSource, sourceFullDomain, form]);
+    const pathMatchType = form.watch("pathMatchType");
+    const rewritePath = form.watch("rewritePath");
+    const rewritePathType = form.watch("rewritePathType");
+    // stripPrefix is a valid rewrite with no path value, so it counts as set.
+    const hasRewrite =
+        Boolean(rewritePath) || rewritePathType === "stripPrefix";
+
+    async function onSubmit() {
+        if (!(await form.trigger())) return;
+
+        const values = form.getValues();
+
+        // Only one of the two attachment points is ever persisted; clear the
+        // other so switching between them doesn't leave a stale reference.
+        const body = {
+            name: values.name.trim(),
+            domainId: values.attachTo === "domain" ? values.domainId : null,
+            subdomain:
+                values.attachTo === "domain" ? values.subdomain || null : null,
+            resourceId:
+                values.attachTo === "resource" ? values.resourceId : null,
+            destinationDomain: values.destinationDomain.trim(),
+            pathMatchType: values.pathMatchType,
+            matchPath: values.matchPath.trim(),
+            rewritePath: values.rewritePath?.trim() || null,
+            rewritePathType: values.rewritePathType,
+            permanent: values.permanent,
+            enabled: values.enabled
+        };
+
+        try {
+            if (isEditing) {
+                await api.post(
+                    `/org/${orgId}/redirects/${redirect!.redirectId}`,
+                    body
+                );
+                toast({
+                    title: t("success"),
+                    description: t("redirectUpdated")
+                });
+                router.refresh();
+            } else {
+                const res = await api.put<
+                    AxiosResponse<CreateRedirectResponse>
+                >(`/org/${orgId}/redirect`, body);
+                toast({
+                    title: t("success"),
+                    description: t("redirectCreated")
+                });
+                router.push(`/${orgId}/settings/redirects/`);
+            }
+        } catch (e) {
+            toast({
+                variant: "destructive",
+                title: isEditing
+                    ? t("redirectErrorUpdate")
+                    : t("redirectErrorCreate"),
+                description: formatAxiosError(
+                    e,
+                    isEditing
+                        ? t("redirectErrorUpdate")
+                        : t("redirectErrorCreate")
+                )
+            });
+        }
+    }
+
+    async function onDelete() {
+        setDeleteLoading(true);
+        try {
+            await api.delete(`/org/${orgId}/redirects/${redirect!.redirectId}`);
+            toast({
+                title: t("success"),
+                description: t("redirectDeleted")
+            });
+            router.push(`/${orgId}/settings/redirects`);
+        } catch (e) {
+            toast({
+                variant: "destructive",
+                title: t("redirectErrorDelete"),
+                description: formatAxiosError(e, t("redirectErrorDelete"))
+            });
+        } finally {
+            setDeleteLoading(false);
+            setIsDeleteModalOpen(false);
+        }
+    }
+
+    return (
+        <>
+            {isEditing && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={setIsDeleteModalOpen}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("redirectQuestionRemove")}</p>
+                            <p>{t("redirectMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("redirectDeleteConfirm")}
+                    onConfirm={onDelete}
+                    string={redirect!.name}
+                    title={t("redirectDelete")}
+                />
+            )}
+
+            <SettingsContainer>
+                <SettingsSection className="pb-10">
+                    <SettingsSectionHeader>
+                        <SettingsSectionTitle>
+                            {t("redirectSource")}
+                        </SettingsSectionTitle>
+                        <SettingsSectionDescription>
+                            {t("redirectSourceSectionDescription")}
+                        </SettingsSectionDescription>
+                    </SettingsSectionHeader>
+
+                    <SettingsSectionBody>
+                        <SettingsSectionForm variant="half">
+                            <Form {...form}>
+                                <form action={formAction} id="redirect-form">
+                                    <SettingsFormGrid>
+                                        <SettingsFormCell span="full">
+                                            <FormField
+                                                control={form.control}
+                                                name="enabled"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormControl>
+                                                            <SwitchInput
+                                                                id="redirect-enabled"
+                                                                label={t(
+                                                                    "enabled"
+                                                                )}
+                                                                description={t(
+                                                                    "redirectEnabledDescription"
+                                                                )}
+                                                                checked={
+                                                                    field.value
+                                                                }
+                                                                onCheckedChange={
+                                                                    field.onChange
+                                                                }
+                                                            />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="full">
+                                            <FormField
+                                                control={form.control}
+                                                name="name"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t("name")}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input
+                                                                autoComplete="off"
+                                                                {...field}
+                                                            />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="half">
+                                            <FormField
+                                                control={form.control}
+                                                name="attachTo"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "redirectAttachedTo"
+                                                            )}
+                                                        </FormLabel>
+                                                        <Select
+                                                            value={field.value}
+                                                            onValueChange={
+                                                                field.onChange
+                                                            }
+                                                        >
+                                                            <FormControl>
+                                                                <SelectTrigger>
+                                                                    <SelectValue />
+                                                                </SelectTrigger>
+                                                            </FormControl>
+                                                            <SelectContent>
+                                                                <SelectItem value="domain">
+                                                                    {t(
+                                                                        "redirectAttachDomain"
+                                                                    )}
+                                                                </SelectItem>
+                                                                <SelectItem value="resource">
+                                                                    {t(
+                                                                        "redirectAttachResource"
+                                                                    )}
+                                                                </SelectItem>
+                                                            </SelectContent>
+                                                        </Select>
+                                                        <FormDescription>
+                                                            {t(
+                                                                "redirectAttachedToDescription"
+                                                            )}
+                                                        </FormDescription>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+                                        {attachTo === "domain" ? (
+                                            <SettingsFormCell span="full">
+                                                <FormField
+                                                    control={form.control}
+                                                    name="domainId"
+                                                    render={() => (
+                                                        <FormItem>
+                                                            <DomainPicker
+                                                                orgId={orgId}
+                                                                cols={1}
+                                                                hideFreeDomain
+                                                                defaultDomainId={
+                                                                    redirect?.domainId
+                                                                }
+                                                                allowWildcard
+                                                                defaultSubdomain={
+                                                                    redirect?.subdomain
+                                                                }
+                                                                onDomainChange={(
+                                                                    res
+                                                                ) => {
+                                                                    form.setValue(
+                                                                        "domainId",
+                                                                        res?.domainId ??
+                                                                            null,
+                                                                        {
+                                                                            shouldValidate: true
+                                                                        }
+                                                                    );
+                                                                    form.setValue(
+                                                                        "subdomain",
+                                                                        res?.subdomain ||
+                                                                            null
+                                                                    );
+                                                                    setDomainFullDomain(
+                                                                        res?.fullDomain ??
+                                                                            null
+                                                                    );
+                                                                }}
+                                                            />
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </SettingsFormCell>
+                                        ) : (
+                                            <SettingsFormCell span="half">
+                                                <FormField
+                                                    control={form.control}
+                                                    name="resourceId"
+                                                    render={({ field }) => (
+                                                        <FormItem className="flex flex-col">
+                                                            <FormLabel>
+                                                                {t(
+                                                                    "selectedRedirectResource"
+                                                                )}
+                                                            </FormLabel>
+                                                            <Popover>
+                                                                <PopoverTrigger
+                                                                    asChild
+                                                                >
+                                                                    <FormControl>
+                                                                        <Button
+                                                                            variant="outline"
+                                                                            role="combobox"
+                                                                            className={cn(
+                                                                                "justify-between",
+                                                                                !field.value &&
+                                                                                    "text-muted-foreground"
+                                                                            )}
+                                                                        >
+                                                                            {selectedResource?.name ??
+                                                                                t(
+                                                                                    "resourceSelect"
+                                                                                )}
+                                                                            <CaretSortIcon className="ml-2 h-4 w-4 shrink-0 opacity-50" />
+                                                                        </Button>
+                                                                    </FormControl>
+                                                                </PopoverTrigger>
+                                                                <PopoverContent className="p-0">
+                                                                    <ResourceSelector
+                                                                        orgId={
+                                                                            orgId
+                                                                        }
+                                                                        selectedResource={
+                                                                            selectedResource
+                                                                        }
+                                                                        onSelectResource={(
+                                                                            resource
+                                                                        ) => {
+                                                                            setSelectedResource(
+                                                                                resource
+                                                                            );
+                                                                            field.onChange(
+                                                                                resource.resourceId
+                                                                            );
+                                                                        }}
+                                                                    />
+                                                                </PopoverContent>
+                                                            </Popover>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
+                                            </SettingsFormCell>
+                                        )}
+
+                                        {attachTo === "resource" && (
+                                            <SettingsFormCell span="full">
+                                                <FormItem>
+                                                    <FormLabel>
+                                                        {t("resourceDomain")}
+                                                    </FormLabel>
+                                                    <Input
+                                                        disabled
+                                                        readOnly
+                                                        value={
+                                                            selectedResource?.fullDomain ??
+                                                            ""
+                                                        }
+                                                        placeholder={
+                                                            selectedResource
+                                                                ? t(
+                                                                      "redirectResourceNoDomain"
+                                                                  )
+                                                                : t(
+                                                                      "resourceSelect"
+                                                                  )
+                                                        }
+                                                    />
+                                                </FormItem>
+                                            </SettingsFormCell>
+                                        )}
+                                    </SettingsFormGrid>
+                                </form>
+                            </Form>
+                        </SettingsSectionForm>
+                    </SettingsSectionBody>
+                </SettingsSection>
+
+                <SettingsSection className="pb-10">
+                    <SettingsSectionHeader>
+                        <SettingsSectionTitle>
+                            {t("redirectSettings")}
+                        </SettingsSectionTitle>
+                        <SettingsSectionDescription>
+                            {t("redirectSettingsDescription")}
+                        </SettingsSectionDescription>
+                    </SettingsSectionHeader>
+
+                    <SettingsSectionBody>
+                        <SettingsSectionForm variant="half">
+                            <Form {...form}>
+                                <form action={formAction}>
+                                    <SettingsFormGrid>
+                                        <SettingsFormCell span="full">
+                                            <SwitchInput
+                                                id="redirect-same-domain"
+                                                label={t(
+                                                    "redirectSameDomainAsSource"
+                                                )}
+                                                description={t(
+                                                    "redirectSameDomainAsSourceDescription"
+                                                )}
+                                                checked={sameDomainAsSource}
+                                                onCheckedChange={
+                                                    setSameDomainAsSource
+                                                }
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="full">
+                                            <FormField
+                                                control={form.control}
+                                                name="destinationDomain"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormLabel>
+                                                            {t(
+                                                                "redirectDestinationDomain"
+                                                            )}
+                                                        </FormLabel>
+                                                        <FormControl>
+                                                            <Input
+                                                                autoComplete="off"
+                                                                placeholder="example.com"
+                                                                readOnly={
+                                                                    sameDomainAsSource
+                                                                }
+                                                                {...field}
+                                                            />
+                                                        </FormControl>
+                                                        <FormDescription>
+                                                            {t(
+                                                                "redirectDestinationDomainDescription"
+                                                            )}
+                                                        </FormDescription>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="half">
+                                            <FormField
+                                                control={form.control}
+                                                name="matchPath"
+                                                render={({ field }) => (
+                                                    <FormItem className="flex flex-col">
+                                                        <FormLabel>
+                                                            {t("matchPath")}
+                                                        </FormLabel>
+                                                        <PathMatchModal
+                                                            value={{
+                                                                path: field.value,
+                                                                pathMatchType:
+                                                                    pathMatchType
+                                                            }}
+                                                            onChange={(
+                                                                config
+                                                            ) => {
+                                                                // matchPath and
+                                                                // pathMatchType are
+                                                                // NOT NULL, so a
+                                                                // clear falls back
+                                                                // to the defaults
+                                                                // rather than null.
+                                                                field.onChange(
+                                                                    config.path ||
+                                                                        DEFAULT_MATCH_PATH
+                                                                );
+                                                                form.setValue(
+                                                                    "pathMatchType",
+                                                                    (config.pathMatchType as
+                                                                        | "exact"
+                                                                        | "prefix"
+                                                                        | "regex") ||
+                                                                        DEFAULT_PATH_MATCH_TYPE
+                                                                );
+                                                            }}
+                                                            trigger={
+                                                                <Button
+                                                                    type="button"
+                                                                    variant="outline"
+                                                                    className="flex items-center gap-2 p-2 w-full text-left cursor-pointer"
+                                                                >
+                                                                    <PathMatchDisplay
+                                                                        value={{
+                                                                            path: field.value,
+                                                                            pathMatchType:
+                                                                                pathMatchType
+                                                                        }}
+                                                                    />
+                                                                </Button>
+                                                            }
+                                                        />
+                                                        <FormDescription>
+                                                            {t(
+                                                                "redirectMatchPathDescription"
+                                                            )}
+                                                        </FormDescription>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="half">
+                                            <FormField
+                                                control={form.control}
+                                                name="rewritePath"
+                                                render={({ field }) => (
+                                                    <FormItem className="flex flex-col">
+                                                        <FormLabel>
+                                                            {t("rewritePath")}
+                                                        </FormLabel>
+                                                        <PathRewriteModal
+                                                            value={{
+                                                                rewritePath:
+                                                                    field.value,
+                                                                rewritePathType:
+                                                                    rewritePathType
+                                                            }}
+                                                            onChange={(
+                                                                config
+                                                            ) => {
+                                                                field.onChange(
+                                                                    config.rewritePath ||
+                                                                        null
+                                                                );
+                                                                form.setValue(
+                                                                    "rewritePathType",
+                                                                    (config.rewritePathType as
+                                                                        | "exact"
+                                                                        | "prefix"
+                                                                        | "regex"
+                                                                        | "stripPrefix"
+                                                                        | null) ??
+                                                                        null
+                                                                );
+                                                            }}
+                                                            trigger={
+                                                                hasRewrite ? (
+                                                                    <Button
+                                                                        type="button"
+                                                                        variant="outline"
+                                                                        className="flex items-center gap-2 p-2 w-full text-left cursor-pointer"
+                                                                    >
+                                                                        <PathRewriteDisplay
+                                                                            value={{
+                                                                                rewritePath:
+                                                                                    field.value,
+                                                                                rewritePathType:
+                                                                                    rewritePathType
+                                                                            }}
+                                                                        />
+                                                                    </Button>
+                                                                ) : (
+                                                                    <Button
+                                                                        type="button"
+                                                                        variant="outline"
+                                                                        className="w-full"
+                                                                    >
+                                                                        <Plus className="h-4 w-4 mr-2" />
+                                                                        {t(
+                                                                            "rewritePath"
+                                                                        )}
+                                                                    </Button>
+                                                                )
+                                                            }
+                                                        />
+                                                        <FormDescription>
+                                                            {t(
+                                                                "redirectRewritePathDescription"
+                                                            )}
+                                                        </FormDescription>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+
+                                        <SettingsFormCell span="full">
+                                            <FormField
+                                                control={form.control}
+                                                name="permanent"
+                                                render={({ field }) => (
+                                                    <FormItem>
+                                                        <FormControl>
+                                                            <SwitchInput
+                                                                id="redirect-permanent"
+                                                                label={t(
+                                                                    "redirectPermanent"
+                                                                )}
+                                                                description={t(
+                                                                    "redirectPermanentDescription"
+                                                                )}
+                                                                checked={
+                                                                    field.value
+                                                                }
+                                                                onCheckedChange={
+                                                                    field.onChange
+                                                                }
+                                                            />
+                                                        </FormControl>
+                                                        <FormMessage />
+                                                    </FormItem>
+                                                )}
+                                            />
+                                        </SettingsFormCell>
+                                    </SettingsFormGrid>
+                                </form>
+                            </Form>
+                        </SettingsSectionForm>
+                    </SettingsSectionBody>
+                </SettingsSection>
+
+                {isEditing && (
+                    <SettingsSection>
+                        <SettingsSectionHeader>
+                            <SettingsSectionTitle>
+                                {t("dangerSection")}
+                            </SettingsSectionTitle>
+                        </SettingsSectionHeader>
+                        <SettingsSectionFooter>
+                            <Button
+                                variant="destructive"
+                                onClick={() => setIsDeleteModalOpen(true)}
+                                loading={deleteLoading}
+                                disabled={deleteLoading}
+                            >
+                                {t("redirectDelete")}
+                            </Button>
+                        </SettingsSectionFooter>
+                    </SettingsSection>
+                )}
+
+                <div className="flex justify-end space-x-2 mt-8">
+                    <Button type="button" variant="outline" asChild>
+                        <Link href={`/${orgId}/settings/redirects`}>
+                            {t("cancel")}
+                        </Link>
+                    </Button>
+                    <Button
+                        type="submit"
+                        form="redirect-form"
+                        loading={saveLoading}
+                        disabled={saveLoading}
+                    >
+                        {isEditing ? t("saveSettings") : t("redirectAdd")}
+                    </Button>
+                </div>
+            </SettingsContainer>
+        </>
+    );
+}

src/components/RedirectsTable.tsx

@@ -0,0 +1,431 @@
+"use client";
+
+import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
+import { Badge } from "@app/components/ui/badge";
+import { Button } from "@app/components/ui/button";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger
+} from "@app/components/ui/dropdown-menu";
+import { Switch } from "@app/components/ui/switch";
+import {
+    ControlledDataTable,
+    type ExtendedColumnDef
+} from "@app/components/ui/controlled-data-table";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { toast } from "@app/hooks/useToast";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import type { PaginationState } from "@tanstack/react-table";
+import {
+    ArrowRight,
+    ArrowUpRight,
+    GlobeIcon,
+    MoreHorizontal,
+    WaypointsIcon
+} from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useMemo, useState, useTransition } from "react";
+import { useDebouncedCallback } from "use-debounce";
+
+export type RedirectRow = {
+    redirectId: number;
+    niceId: string;
+    name: string;
+    subdomain: string | null;
+    destinationDomain: string;
+    pathMatchType: "exact" | "prefix" | "regex";
+    matchPath: string;
+    rewritePath: string | null;
+    rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
+    permanent: boolean;
+    enabled: boolean;
+    resourceId: number | null;
+    resourceName: string | null;
+    resourceNiceId: string | null;
+    resourceFullDomain: string | null;
+    domainId: string | null;
+    baseDomain: string | null;
+};
+
+type RedirectsTableProps = {
+    redirects: RedirectRow[];
+    orgId: string;
+    pagination: PaginationState;
+    rowCount: number;
+};
+
+export default function RedirectsTable({
+    redirects,
+    orgId,
+    pagination,
+    rowCount
+}: RedirectsTableProps) {
+    const router = useRouter();
+    const t = useTranslations();
+    const api = createApiClient(useEnvContext());
+    const {
+        navigate: filter,
+        isNavigating: isFiltering,
+        searchParams
+    } = useNavigationContext();
+
+    const [rows, setRows] = useState(redirects);
+    const [selected, setSelected] = useState<RedirectRow | null>(null);
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [isRefreshing, startTransition] = useTransition();
+    const [isNavigatingToAddPage, startNavigation] = useTransition();
+
+    useEffect(() => {
+        setRows(redirects);
+    }, [redirects]);
+
+    function refreshData() {
+        startTransition(() => {
+            try {
+                router.refresh();
+            } catch {
+                toast({
+                    title: t("error"),
+                    description: t("refreshError"),
+                    variant: "destructive"
+                });
+            }
+        });
+    }
+
+    const handlePaginationChange = (newPage: PaginationState) => {
+        searchParams.set("page", (newPage.pageIndex + 1).toString());
+        searchParams.set("pageSize", newPage.pageSize.toString());
+        filter({ searchParams });
+    };
+
+    const handleSearchChange = useDebouncedCallback((query: string) => {
+        searchParams.set("query", query);
+        searchParams.delete("page");
+        filter({ searchParams });
+    }, 300);
+
+    // Prefix matches/rewrites cover everything beneath the path, so show the
+    // implied glob rather than the bare prefix.
+    function withPrefixGlob(path: string) {
+        return path.endsWith("/") ? `${path}*` : `${path}/*`;
+    }
+
+    async function toggleEnabled(row: RedirectRow, enabled: boolean) {
+        setRows((prev) =>
+            prev.map((r) =>
+                r.redirectId === row.redirectId ? { ...r, enabled } : r
+            )
+        );
+
+        try {
+            await api.post(`/org/${orgId}/redirects/${row.redirectId}`, {
+                enabled
+            });
+            toast({
+                title: t("success"),
+                description: t("redirectUpdated")
+            });
+            router.refresh();
+        } catch (e) {
+            setRows((prev) =>
+                prev.map((r) =>
+                    r.redirectId === row.redirectId
+                        ? { ...r, enabled: row.enabled }
+                        : r
+                )
+            );
+            toast({
+                variant: "destructive",
+                title: t("redirectErrorUpdate"),
+                description: formatAxiosError(e, t("redirectErrorUpdate"))
+            });
+        }
+    }
+
+    function deleteRedirect(row: RedirectRow) {
+        startTransition(async () => {
+            try {
+                await api.delete(`/org/${orgId}/redirects/${row.redirectId}`);
+                setRows((prev) =>
+                    prev.filter((r) => r.redirectId !== row.redirectId)
+                );
+                setIsDeleteModalOpen(false);
+                setSelected(null);
+                toast({
+                    title: t("success"),
+                    description: t("redirectDeleted")
+                });
+                router.refresh();
+            } catch (e) {
+                toast({
+                    variant: "destructive",
+                    title: t("redirectErrorDelete"),
+                    description: formatAxiosError(e, t("redirectErrorDelete"))
+                });
+            }
+        });
+    }
+
+    const columns = useMemo<ExtendedColumnDef<RedirectRow>[]>(
+        () => [
+            {
+                accessorKey: "name",
+                enableHiding: false,
+                header: () => <span className="p-3">{t("name")}</span>,
+                cell: ({ row }) => (
+                    <Link
+                        href={`/${orgId}/settings/redirects/${row.original.niceId}`}
+                        className="hover:underline"
+                    >
+                        {row.original.name}
+                    </Link>
+                )
+            },
+            {
+                id: "niceId",
+                accessorKey: "niceId",
+                friendlyName: t("identifier"),
+                header: () => <span className="p-3">{t("identifier")}</span>,
+                cell: ({ row }) => (
+                    <code className="text-sm">{row.original.niceId}</code>
+                )
+            },
+            {
+                id: "attachedTo",
+                friendlyName: t("redirectAttachedTo"),
+                header: () => (
+                    <span className="p-3">{t("redirectAttachedTo")}</span>
+                ),
+                cell: ({ row }) => {
+                    const redirect = row.original;
+
+                    if (redirect.resourceId && redirect.resourceNiceId) {
+                        return (
+                            <Button
+                                variant="outline"
+                                size="sm"
+                                asChild
+                                className="inline-flex items-center gap-1.5"
+                            >
+                                <Link
+                                    href={`/${orgId}/settings/resources/${redirect.resourceNiceId}`}
+                                >
+                                    <WaypointsIcon className="size-3 text-muted-foreground" />
+                                    {redirect.resourceName}
+                                    <ArrowUpRight className="size-3" />
+                                </Link>
+                            </Button>
+                        );
+                    }
+
+                    if (redirect.domainId) {
+                        return (
+                            <Button
+                                variant="outline"
+                                size="sm"
+                                asChild
+                                className="inline-flex items-center gap-1.5"
+                            >
+                                <Link
+                                    href={`/${orgId}/settings/domains/${redirect.domainId}`}
+                                >
+                                    <GlobeIcon className="size-3 text-muted-foreground" />
+                                    {redirect.baseDomain}
+                                    <ArrowUpRight className="size-3" />
+                                </Link>
+                            </Button>
+                        );
+                    }
+
+                    return <span>-</span>;
+                }
+            },
+
+            {
+                id: "source",
+                friendlyName: t("redirectSource"),
+                header: () => (
+                    <span className="p-3">{t("redirectSource")}</span>
+                ),
+                cell: ({ row }) => {
+                    const redirect = row.original;
+                    // A domain-attached redirect may target a specific host
+                    // under the base domain, e.g. old.example.com.
+                    const domainHost = redirect.baseDomain
+                        ? [redirect.subdomain, redirect.baseDomain]
+                              .filter(Boolean)
+                              .join(".")
+                        : null;
+                    const host = redirect.resourceFullDomain ?? domainHost;
+
+                    return (
+                        <code className="text-sm truncate">
+                            {host ?? ""}
+                            <span className="text-muted-foreground">
+                                {redirect.pathMatchType === "prefix"
+                                    ? withPrefixGlob(redirect.matchPath)
+                                    : redirect.matchPath}
+                            </span>
+                        </code>
+                    );
+                }
+            },
+            {
+                id: "destination",
+                accessorKey: "destinationDomain",
+                friendlyName: t("redirectDestination"),
+                header: () => (
+                    <span className="p-3">{t("redirectDestination")}</span>
+                ),
+                cell: ({ row }) => {
+                    const redirect = row.original;
+                    return (
+                        <code className="text-sm truncate">
+                            {redirect.destinationDomain}
+                            {redirect.rewritePath && (
+                                <span className="text-muted-foreground">
+                                    {redirect.rewritePathType === "prefix"
+                                        ? withPrefixGlob(redirect.rewritePath)
+                                        : redirect.rewritePath}
+                                </span>
+                            )}
+                        </code>
+                    );
+                }
+            },
+            {
+                accessorKey: "permanent",
+                friendlyName: t("redirectType"),
+                header: () => <span className="p-3">{t("redirectType")}</span>,
+                cell: ({ row }) => (
+                    <Badge variant="secondary">
+                        {row.original.permanent
+                            ? t("redirectTypePermanent")
+                            : t("redirectTypeTemporary")}
+                    </Badge>
+                )
+            },
+            {
+                accessorKey: "enabled",
+                friendlyName: t("enabled"),
+                header: () => <span className="p-3">{t("enabled")}</span>,
+                cell: ({ row }) => (
+                    <Switch
+                        checked={row.original.enabled}
+                        onCheckedChange={(checked) =>
+                            toggleEnabled(row.original, checked)
+                        }
+                    />
+                )
+            },
+            {
+                id: "actions",
+                enableHiding: false,
+                header: () => <span className="p-3" />,
+                cell: ({ row }) => (
+                    <div className="flex items-center gap-2 justify-end">
+                        <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                                <Button variant="ghost" className="h-8 w-8 p-0">
+                                    <span className="sr-only">
+                                        {t("openMenu")}
+                                    </span>
+                                    <MoreHorizontal className="h-4 w-4" />
+                                </Button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
+                                <DropdownMenuItem asChild>
+                                    <Link
+                                        href={`/${orgId}/settings/redirects/${row.original.niceId}`}
+                                    >
+                                        {t("edit")}
+                                    </Link>
+                                </DropdownMenuItem>
+                                <DropdownMenuItem
+                                    onClick={() => {
+                                        setSelected(row.original);
+                                        setIsDeleteModalOpen(true);
+                                    }}
+                                >
+                                    <span className="text-red-500">
+                                        {t("delete")}
+                                    </span>
+                                </DropdownMenuItem>
+                            </DropdownMenuContent>
+                        </DropdownMenu>
+                        <Link
+                            href={`/${orgId}/settings/redirects/${row.original.niceId}`}
+                        >
+                            <Button variant="outline">
+                                {t("edit")}
+                                <ArrowRight className="ml-2 w-4 h-4" />
+                            </Button>
+                        </Link>
+                    </div>
+                )
+            }
+        ],
+        [orgId, t]
+    );
+
+    return (
+        <>
+            {selected && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={(val) => {
+                        setIsDeleteModalOpen(val);
+                        if (!val) {
+                            setSelected(null);
+                        }
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("redirectQuestionRemove")}</p>
+                            <p>{t("redirectMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("redirectDeleteConfirm")}
+                    onConfirm={async () => deleteRedirect(selected)}
+                    string={selected.name}
+                    title={t("redirectDelete")}
+                />
+            )}
+
+            <ControlledDataTable
+                columns={columns}
+                rows={rows}
+                addButtonText={t("redirectAdd")}
+                onAdd={() =>
+                    startNavigation(() =>
+                        router.push(`/${orgId}/settings/redirects/create`)
+                    )
+                }
+                isNavigatingToAddPage={isNavigatingToAddPage}
+                tableId="redirects-table"
+                searchPlaceholder={t("redirectsSearch")}
+                pagination={pagination}
+                onPaginationChange={handlePaginationChange}
+                searchQuery={searchParams.get("query")?.toString()}
+                onSearch={handleSearchChange}
+                onRefresh={refreshData}
+                isRefreshing={isRefreshing || isFiltering}
+                rowCount={rowCount}
+                columnVisibility={{
+                    attachedTo: false,
+                    niceId: false,
+                    permanent: false
+                }}
+                enableColumnVisibility
+                stickyLeftColumn="name"
+                stickyRightColumn="actions"
+            />
+        </>
+    );
+}

src/components/Settings.tsx

@@ -1,23 +1,46 @@
 import { cn } from "@app/lib/cn";
 
-export function SettingsContainer({ children }: { children: React.ReactNode }) {
-    return <div className="space-y-6">{children}</div>;
+export function SettingsContainer({
+    children,
+    className
+}: {
+    children: React.ReactNode;
+    className?: string;
+}) {
+    return <div className={cn("space-y-6", className)}>{children}</div>;
 }
 
-export function SettingsSection({ children }: { children: React.ReactNode }) {
+export function SettingsSection({
+    children,
+    className
+}: {
+    children: React.ReactNode;
+    className?: string;
+}) {
     return (
-        <div className="border rounded-lg bg-card p-5 flex flex-col min-h-[200px]">
+        <div
+            className={cn(
+                "border rounded-lg bg-card p-5 flex flex-col min-h-[200px]",
+                className
+            )}
+        >
             {children}
         </div>
     );
 }
 
 export function SettingsSectionHeader({
-    children
+    children,
+    className
 }: {
     children: React.ReactNode;
+    className?: string;
 }) {
-    return <div className="text-lg space-y-0.5 pb-6">{children}</div>;
+    return (
+        <div className={cn("text-lg space-y-0.5 pb-6", className)}>
+            {children}
+        </div>
+    );
 }
 
 export function SettingsSectionForm({
@@ -77,7 +100,7 @@ export function SettingsFormCell({
                 "min-w-0",
                 span === "quarter" && "md:col-span-1",
                 span === "half" && "md:col-span-2",
-                span === "full" && "md:col-span-4",
+                span === "full" && "col-span-full",
                 className
             )}
         >
@@ -87,23 +110,36 @@ export function SettingsFormCell({
 }
 
 export function SettingsSectionTitle({
-    children
+    children,
+    className
 }: {
     children: React.ReactNode;
+    className?: string;
 }) {
     return (
-        <h2 className="text-1xl font-semibold tracking-tight flex items-center gap-2">
+        <h2
+            className={cn(
+                "text-1xl font-semibold tracking-tight flex items-center gap-2",
+                className
+            )}
+        >
             {children}
         </h2>
     );
 }
 
 export function SettingsSectionDescription({
-    children
+    children,
+    className
 }: {
     children: React.ReactNode;
+    className?: string;
 }) {
-    return <p className="text-muted-foreground text-sm">{children}</p>;
+    return (
+        <p className={cn("text-muted-foreground text-sm", className)}>
+            {children}
+        </p>
+    );
 }
 
 export function SettingsSubsectionHeader({
@@ -141,11 +177,15 @@ export function SettingsSubsectionDescription({
 }
 
 export function SettingsSectionBody({
-    children
+    children,
+    className
 }: {
     children: React.ReactNode;
+    className?: string;
 }) {
-    return <div className="space-y-5 flex-grow">{children}</div>;
+    return (
+        <div className={cn("space-y-5 flex-grow", className)}>{children}</div>
+    );
 }
 
 export function SettingsSectionFooter({
@@ -169,10 +209,22 @@ export function SettingsSectionFooter({
 
 export function SettingsSectionGrid({
     children,
-    cols
+    cols = 4,
+    className
 }: {
     children: React.ReactNode;
-    cols: number;
+    cols?: number;
+    className?: string;
 }) {
-    return <div className={`grid md:grid-cols-${cols} gap-6`}>{children}</div>;
+    return (
+        <div
+            style={{
+                // @ts-expect-error
+                "--cols": `repeat(${cols}, minmax(0, 1fr))`
+            }}
+            className={cn(`grid md:grid-cols-(--cols) gap-6`, className)}
+        >
+            {children}
+        </div>
+    );
 }

src/components/alert-rule-editor/AlertRuleGraphEditor.tsx

@@ -211,7 +211,15 @@ export default function AlertRuleGraphEditor({
 
     return (
         <Form {...form}>
-            <form id={FORM_ID} action={formAction}>
+            <form
+                id={FORM_ID}
+                onSubmit={(e) => {
+                    e.preventDefault();
+                    startTransition(() => {
+                        formAction();
+                    });
+                }}
+            >
                 <SettingsContainer>
                     <PaidFeaturesAlert tiers={tierMatrix.alertingRules} />
                     <div className="flex flex-col lg:flex-row gap-6 lg:gap-8 items-start">

src/components/ui/input.tsx

@@ -44,6 +44,7 @@ const Input = React.forwardRef<HTMLInputElement, InputProps>(
                 data-slot="input"
                 className={cn(
                     "file:text-foreground placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground border-input flex h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+                    "read-only:opacity-50",
                     "aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
                     "focus-visible:outline-none focus-visible:border-ring focus-visible:ring-offset-0",
                     className

src/lib/pullEnv.ts

@@ -70,6 +70,10 @@ export function pullEnv(): Env {
                     : false,
             disableEnterpriseFeatures:
                 process.env.DISABLE_ENTERPRISE_FEATURES === "true"
+                    ? true
+                    : false,
+            disableVirtualApiKeysUi:
+                process.env.FLAGS_DISABLE_VIRTUAL_API_KEYS_UI === "true"
                     ? true
                     : false
         },

src/lib/types/env.ts

@@ -36,6 +36,7 @@ export type Env = {
         usePangolinDns: boolean;
         disableProductHelpBanners: boolean;
         disableEnterpriseFeatures: boolean;
+        disableVirtualApiKeysUi: boolean;
     };
     branding: {
         appName?: string;

tsconfig.enterprise.json

@@ -14,7 +14,7 @@
         "moduleResolution": "bundler",
         "resolveJsonModule": true,
         "isolatedModules": true,
-        "jsx": "preserve",
+        "jsx": "react-jsx",
         "incremental": true,
         "paths": {
             "@server/*": [