Refactor out transactions and always call rebuild on update

Restrict admin role
Show warning about the .local aliases
2026-09-11 05:26:32 +02:00 · 2026-06-23 18:12:51 -04:00 · 2026-06-23 17:45:42 -04:00 · 2026-06-23 17:44:18 -04:00 · 2026-06-23 17:14:53 -04:00 · 2026-06-23 17:14:40 -04:00
80 changed files with 770 additions and 906 deletions
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Липсва идентификатор на организация или домейн",
    "loadingDNSRecords": "Зареждане на DNS записи...",
    "olmUpdateAvailableInfo": "Налична е актуализирана версия на Olm. Моля, актуализирайте до най-новата версия за най-добро преживяване.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Клиент",
    "proxyProtocol": "Настройки на прокси протокол",
    "proxyProtocolDescription": "Конфигурирайте Proxy Protocol, за да запазите IP адресите на клиентите за TCP услуги.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Chybí ID organizace nebo domény",
    "loadingDNSRecords": "Načítání DNS záznamů...",
    "olmUpdateAvailableInfo": "Je k dispozici aktualizovaná verze Olm. Pro nejlepší zážitek prosím aktualizujte na nejnovější verzi.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Zákazník",
    "proxyProtocol": "Nastavení proxy protokolu",
    "proxyProtocolDescription": "Konfigurace Proxy protokolu pro zachování klientských IP adres pro služby TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Organisation oder Domänen-ID fehlt",
    "loadingDNSRecords": "Lade DNS-Einträge...",
    "olmUpdateAvailableInfo": "Eine aktualisierte Version von Olm ist verfügbar. Bitte aktualisieren Sie auf die neueste Version für die beste Erfahrung.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Client",
    "proxyProtocol": "Proxy-Protokoll-Einstellungen",
    "proxyProtocolDescription": "Konfigurieren Sie das Proxy-Protokoll, um die IP-Adressen des Clients für TCP-Dienste zu erhalten.",
@@ -2338,6 +2338,7 @@
    "createInternalResourceDialogDestinationCidrDescription": "The CIDR range of the resource on the site's network.",
    "createInternalResourceDialogAlias": "Alias",
    "createInternalResourceDialogAliasDescription": "An optional internal DNS alias for this resource.",
+    "internalResourceAliasLocalWarning": "Aliases ending in .local can cause resolution issues due to mDNS on some networks.",
    "internalResourceDownstreamSchemeRequired": "Scheme is required for HTTP resources",
    "internalResourceHttpPortRequired": "Destination port is required for HTTP resources",
    "siteConfiguration": "Configuration",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Falta el ID de organización o dominio",
    "loadingDNSRecords": "Cargando registros DNS...",
    "olmUpdateAvailableInfo": "Una versión actualizada de Olm está disponible. Por favor, actualice a la última versión para obtener la mejor experiencia.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Cliente",
    "proxyProtocol": "Configuración del Protocolo Proxy",
    "proxyProtocolDescription": "Configurar el protocolo de proxy para preservar las direcciones IP del cliente para los servicios TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "L'organisation ou l'identifiant de domaine est manquant",
    "loadingDNSRecords": "Chargement des enregistrements DNS...",
    "olmUpdateAvailableInfo": "Une version mise à jour de Olm est disponible. Veuillez mettre à jour vers la dernière version pour la meilleure expérience.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Client",
    "proxyProtocol": "Paramètres du protocole proxy",
    "proxyProtocolDescription": "Configurer le protocole Proxy pour préserver les adresses IP du client pour les services TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Manca l'ID dell'organizzazione o del dominio",
    "loadingDNSRecords": "Caricamento record DNS...",
    "olmUpdateAvailableInfo": "È disponibile una versione aggiornata di Olm. Si prega di aggiornare all'ultima versione per la migliore esperienza.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Client",
    "proxyProtocol": "Impostazioni Protocollo Proxy",
    "proxyProtocolDescription": "Configurare il protocollo proxy per preservare gli indirizzi IP client per i servizi TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "조직 ID 또는 도메인 ID가 누락되었습니다",
    "loadingDNSRecords": "DNS 레코드를 로드하는 중...",
    "olmUpdateAvailableInfo": "올름의 새 버전이 이용 가능합니다. 최상의 경험을 위해 최신 버전으로 업데이트하세요.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "클라이언트",
    "proxyProtocol": "프록시 프로토콜 설정",
    "proxyProtocolDescription": "TCP 서비스에 대한 클라이언트 IP 주소를 유지하도록 프록시 프로토콜을 구성하세요.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "ID for organisasjon eller domene mangler",
    "loadingDNSRecords": "Laster DNS-poster...",
    "olmUpdateAvailableInfo": "En oppdatert versjon av Olm er tilgjengelig. Oppdater til den nyeste versjonen for å få den beste opplevelsen.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Klient",
    "proxyProtocol": "Protokoll innstillinger for Protokoll",
    "proxyProtocolDescription": "Konfigurer Proxy-protokoll for å bevare klientens IP-adresser til TCP-tjenester.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Organisatie of domein ID ontbreekt",
    "loadingDNSRecords": "DNS-records laden...",
    "olmUpdateAvailableInfo": "Er is een bijgewerkte versie van Olm beschikbaar. Update alstublieft naar de nieuwste versie voor de beste ervaring.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Klant",
    "proxyProtocol": "Proxy Protocol Instellingen",
    "proxyProtocolDescription": "Proxyprotocol configureren om de IP-adressen van de client voor TCP-diensten te bewaren.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Brakuje identyfikatora organizacji lub domeny",
    "loadingDNSRecords": "Ładowanie rekordów DNS...",
    "olmUpdateAvailableInfo": "Dostępna jest zaktualizowana wersja Olm. Zaktualizuj do najnowszej wersji, aby uzyskać najlepsze doświadczenia.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Klient",
    "proxyProtocol": "Ustawienia protokołu proxy",
    "proxyProtocolDescription": "Skonfiguruj protokół Proxy aby zachować adresy IP klienta dla usług TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "ID da organização ou domínio está faltando",
    "loadingDNSRecords": "Carregando registros DNS...",
    "olmUpdateAvailableInfo": "Uma versão atualizada do Olm está disponível. Atualize para a versão mais recente para ter a melhor experiência.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Cliente",
    "proxyProtocol": "Configurações de Protocolo Proxy",
    "proxyProtocolDescription": "Configurar o protocolo proxy para preservar endereços IP do cliente para serviços TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Отсутствует организация или ID домена",
    "loadingDNSRecords": "Загрузка записей DNS...",
    "olmUpdateAvailableInfo": "Доступна обновленная версия Олма. Пожалуйста, обновитесь до последней версии.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "Клиент",
    "proxyProtocol": "Настройки протокола прокси",
    "proxyProtocolDescription": "Настроить Прокси-протокол для сохранения IP-адресов клиента для служб TCP.",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "Organizasyon veya Alan Adı Kimliği eksik",
    "loadingDNSRecords": "DNS kayıtları yükleniyor...",
    "olmUpdateAvailableInfo": "Olm'nin güncellenmiş bir sürümü mevcut. En iyi deneyim için lütfen en son sürüme güncelleyin.",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "İstemci",
    "proxyProtocol": "Proxy Protokol Ayarları",
    "proxyProtocolDescription": "TCP hizmetleri için istemci IP adreslerini korumak amacıyla Proxy Protokolünü yapılandırın.",
@@ -17,7 +17,7 @@
    "componentsErrorNoMemberCreate": "您目前不是任何组织的成员。创建组织以开始操作。",
    "componentsErrorNoMember": "您目前不是任何组织的成员。",
    "welcome": "欢迎使用 Pangolin",
-    "welcomeTo": "欢迎来到",
+    "welcomeTo": "欢迎使用",
    "componentsCreateOrg": "创建组织",
    "componentsMember": "您属于{count, plural, =0 {没有组织} one {一个组织} other {# 个组织}}。",
    "componentsInvalidKey": "检测到无效或过期的许可证密钥。按照许可证条款操作以继续使用所有功能。",
@@ -35,7 +35,7 @@
    "trialDaysRemaining": "{count, plural, other {# 天剩余}}",
    "trialDaysLeftShort": "试用期剩余 {days} 天",
    "trialGoToBilling": "转到账单页面",
-    "subscriptionViolationViewBilling": "查看计费",
+    "subscriptionViolationViewBilling": "查看账单",
    "componentsLicenseViolation": "许可证超限：该服务器使用了 {usedSites} 个站点，已超过授权的 {maxSites} 个。请遵守许可证条款以继续使用全部功能。",
    "componentsSupporterMessage": "感谢您的支持！您现在是 Pangolin 的 {tier} 用户。",
    "inviteErrorNotValid": "很抱歉，但看起来你试图访问的邀请尚未被接受或不再有效。",
@@ -58,21 +58,21 @@
    "name": "名称",
    "online": "在线",
    "offline": "离线的",
-    "site": "站点",
+    "site": "节点",
    "dataIn": "数据输入",
    "dataOut": "数据输出",
    "connectionType": "连接类型",
    "tunnelType": "隧道类型",
    "local": "本地的",
    "edit": "编辑",
-    "siteConfirmDelete": "确认删除站点",
-    "siteDelete": "删除站点",
-    "siteMessageRemove": "一旦移除，站点将无法访问。与站点相关的所有目标也将被移除。",
-    "siteQuestionRemove": "您确定要从组织中删除该站点吗？",
+    "siteConfirmDelete": "确认删除节点",
+    "siteDelete": "删除节点",
+    "siteMessageRemove": "一旦移除，节点将无法访问。与节点相关的所有目标也将被移除。",
+    "siteQuestionRemove": "您确定要从组织中删除该节点吗？",
    "siteManageSites": "管理站点",
    "siteDescription": "创建和管理站点，启用与私人网络的连接",
    "sitesBannerTitle": "连接任何网络",
-    "sitesBannerDescription": "站点是连接到远程网络的链接，允许Pangolin为用户提供资源访问，无论是公共还是私人。可以在任何可以运行二进制文件或容器的地方安装站点网络连接器（Newt）以建立连接。",
+    "sitesBannerDescription": "站点是到远程网络的连接，使 Pangolin 能够向任何位置的用户提提供公共或私有的资源访问。你可以在任何能够运行二进制文件或容器的地方安装站点网络连接器（Newt），以建立连接。",
    "sitesBannerButtonText": "安装站点",
    "approvalsBannerTitle": "批准或拒绝设备访问",
    "approvalsBannerDescription": "审核、批准或拒绝用户的设备访问请求。 当需要设备批准时，用户必须先获得管理员批准，然后他们的设备才能连接到您的组织资源。",
@@ -134,7 +134,7 @@
    "siteResourcesHowToAccess": "如何访问",
    "siteResourcesTargetsOnSite": "此站点上的目标",
    "siteSetting": "{siteName} 设置",
-    "siteNewtTunnel": "新站点 (推荐)",
+    "siteNewtTunnel": "新节点 (推荐)",
    "siteNewtTunnelDescription": "最简单的方式来创建任何网络的入口。没有额外的设置。",
    "siteWg": "基本 WireGuard",
    "siteWgDescription": "使用任何 WireGuard 客户端来建立隧道。需要手动配置 NAT。",
@@ -143,23 +143,23 @@
    "siteLocalDescriptionSaas": "仅本地资源。没有隧道。仅在远程节点上可用。",
    "siteSeeAll": "查看所有站点",
    "siteTunnelDescription": "确定如何连接到站点",
-    "siteNewtCredentials": "全权证书",
-    "siteNewtCredentialsDescription": "站点如何通过服务器进行身份验证",
+    "siteNewtCredentials": "凭证",
+    "siteNewtCredentialsDescription": "节点如何与服务器进行身份验证",
    "remoteNodeCredentialsDescription": "这是远程节点如何与服务器进行身份验证",
    "siteCredentialsSave": "保存证书",
    "siteCredentialsSaveDescription": "您只能看到一次。请确保将其复制并保存到一个安全的地方。",
    "siteInfo": "站点信息",
    "status": "状态",
-    "shareTitle": "管理可共享链接",
+    "shareTitle": "管理共享链接",
    "shareDescription": "创建可共享的链接，允许临时或永久访问代理资源",
-    "shareSearch": "搜索可共享链接……",
-    "shareCreate": "创建可共享链接",
+    "shareSearch": "搜索共享链接……",
+    "shareCreate": "创建共享链接",
    "shareErrorDelete": "删除链接失败",
    "shareErrorDeleteMessage": "删除链接时出错",
    "shareDeleted": "链接已删除",
    "shareDeletedDescription": "链接已删除",
-    "shareDelete": "删除可共享链接",
-    "shareDeleteConfirm": "确认删除可共享链接",
+    "shareDelete": "删除共享链接",
+    "shareDeleteConfirm": "确认删除共享链接",
    "shareQuestionRemove": "您确定要删除这个共享链接吗？",
    "shareMessageRemove": "删除后，该链接将不再可用，使用它的任何人将失去对资源的访问权限。",
    "shareTokenDescription": "访问令牌可以通过两种方式传递：作为查询参数或请求标题。 每次验证访问请求都必须从客户端传递。",
@@ -204,11 +204,11 @@
    "proxyResourceTitle": "管理公共资源",
    "proxyResourceDescription": "创建和管理可通过 Web 浏览器公开访问的资源",
    "publicResourcesBannerTitle": "基于 Web 的公共访问",
-    "publicResourcesBannerDescription": "公共资源是 HTTPS 代理，可以通过网络浏览器在互联网上的任何人访问。与私人资源不同，它们不需要客户端软件，并且可以包含身份和上下文感知的访问策略。",
+    "publicResourcesBannerDescription": "公共资源是 HTTPS 代理，可供互联网上的任何人通过 Web 浏览器访问。与私人资源不同，它们不需要客户端软件，并且可以包含身份和上下文感知的访问策略。",
    "clientResourceTitle": "管理私有资源",
    "clientResourceDescription": "创建和管理只能通过连接客户端访问的资源",
-    "privateResourcesBannerTitle": "零信任的私人访问",
-    "privateResourcesBannerDescription": "私人资源使用零信任安全性，确保只允许明确授予的用户和机器访问资源。可以连接用户设备或机器客户端，通过安全的虚拟专用网络访问这些资源。",
+    "privateResourcesBannerTitle": "零信任私有访问",
+    "privateResourcesBannerDescription": "私有资源采用零信任安全机制，确保只有获得明确授权的用户和机器才能访问。用户设备或机器客户端连接后，即可通过安全的虚拟专用网络访问这些资源。",
    "resourcesSearch": "搜索资源...",
    "resourceAdd": "添加资源",
    "resourceErrorDelte": "删除资源时出错",
@@ -327,7 +327,7 @@
    "passToAuth": "传递至认证",
    "orgSettingsDescription": "配置组织设置",
    "orgGeneralSettings": "组织设置",
-    "orgGeneralSettingsDescription": "管理机构的详细信息和配置",
+    "orgGeneralSettingsDescription": "管理组织的详细信息和配置",
    "saveGeneralSettings": "保存常规设置",
    "saveSettings": "保存设置",
    "orgDangerZone": "危险区域",
@@ -381,7 +381,7 @@
    "accessApprovalsDescription": "查看和管理待审批的组织访问权限",
    "description": "描述",
    "inviteTitle": "打开邀请",
-    "inviteDescription": "管理其他用户加入机构的邀请",
+    "inviteDescription": "管理其他用户加入组织的邀请",
    "inviteSearch": "搜索邀请...",
    "minutes": "分钟",
    "hours": "小时",
@@ -425,24 +425,24 @@
    "apiKeysDelete": "删除 API 密钥",
    "apiKeysManage": "管理 API 密钥",
    "apiKeysDescription": "API 密钥用于认证集成 API",
-    "provisioningKeysTitle": "置备密钥",
-    "provisioningKeysManage": "管理置备键",
+    "provisioningKeysTitle": "预配密钥",
+    "provisioningKeysManage": "管理预配密钥",
    "provisioningKeysDescription": "置备密钥用于验证您组织的自动站点配置。",
-    "provisioningManage": "置备中",
-    "provisioningDescription": "管理预配键和审查等待批准的站点。",
-    "pendingSites": "待定站点",
+    "provisioningManage": "预配",
+    "provisioningDescription": "管理预配密钥，并审核待批准的站点。",
+    "pendingSites": "待审批站点",
    "siteApproveSuccess": "站点批准成功",
    "siteApproveError": "批准站点出错",
    "provisioningKeys": "置备键",
    "searchProvisioningKeys": "搜索配备密钥...",
-    "provisioningKeysAdd": "生成置备键",
+    "provisioningKeysAdd": "生成预配密钥",
    "provisioningKeysErrorDelete": "删除预配键时出错",
    "provisioningKeysErrorDeleteMessage": "删除预配键时出错",
    "provisioningKeysQuestionRemove": "您确定要从组织中删除此预配键吗？",
    "provisioningKeysMessageRemove": "一旦移除，密钥不能再用于站点预配。",
    "provisioningKeysDeleteConfirm": "确认删除置备键",
    "provisioningKeysDelete": "删除置备键",
-    "provisioningKeysCreate": "生成置备键",
+    "provisioningKeysCreate": "生成预配密钥",
    "provisioningKeysCreateDescription": "为组织生成一个新的预置密钥",
    "provisioningKeysSeeAll": "查看所有预配键",
    "provisioningKeysSave": "保存预配键",
@@ -462,16 +462,16 @@
    "provisioningKeysNeverUsed": "永不过期",
    "provisioningKeysEdit": "编辑置备键",
    "provisioningKeysEditDescription": "更新此密钥的最大批量大小和过期时间。",
-    "provisioningKeysApproveNewSites": "批准新站点",
-    "provisioningKeysApproveNewSitesDescription": "自动批准使用此密钥注册的站点。",
+    "provisioningKeysApproveNewSites": "批准新节点",
+    "provisioningKeysApproveNewSitesDescription": "自动批准使用此密钥注册的节点。",
    "provisioningKeysUpdateError": "更新预配键时出错",
    "provisioningKeysUpdated": "置备密钥已更新",
    "provisioningKeysUpdatedDescription": "您的更改已保存。",
-    "provisioningKeysBannerTitle": "站点置备密钥",
-    "provisioningKeysBannerDescription": "生成一个供应密钥，并将其与 Newt 连接器一起使用，以在首次启动时自动创建站点 - 无需为每个站点设置单独的凭据。",
+    "provisioningKeysBannerTitle": "站点预配密钥",
+    "provisioningKeysBannerDescription": "生成预配密钥，并将其与 Newt 连接器配合使用，即可在首次启动时自动创建站点，无需为每个站点单独配置凭据。",
    "provisioningKeysBannerButtonText": "了解更多",
-    "pendingSitesBannerTitle": "待定站点",
-    "pendingSitesBannerDescription": "使用供应密钥连接的站点将在此显示以供审核。",
+    "pendingSitesBannerTitle": "待审批站点",
+    "pendingSitesBannerDescription": "使用预配密钥连接的网站会在这里以供审核。",
    "pendingSitesBannerButtonText": "了解更多",
    "apiKeysSettings": "{apiKeyName} 设置",
    "userTitle": "管理所有用户",
@@ -883,11 +883,11 @@
    "resourcesErrorUpdateDescription": "更新资源时出错",
    "access": "访问权限",
    "accessControl": "访问控制",
-    "shareLink": "{resource} 可共享链接",
+    "shareLink": "{resource} 的共享链接",
    "resourceSelect": "选择资源",
-    "shareLinks": "可共享链接",
+    "shareLinks": "共享链接",
    "share": "分享链接",
-    "shareDescription2": "创建资源的可共享链接。链接提供了对您资源的临时或无限制访问。 当您创建链接时，您可以配置链接的到期时间。",
+    "shareDescription2": "创建资源的共享链接。链接提供了对您资源的临时或无限制访问。 当您创建链接时，您可以配置链接的到期时间。",
    "shareEasyCreate": "轻松创建和分享",
    "shareConfigurableExpirationDuration": "可配置的过期时间",
    "shareSecureAndRevocable": "安全和可撤销的",
@@ -1059,7 +1059,7 @@
    "network": "网络",
    "manage": "管理",
    "sitesNotFound": "未找到站点。",
-    "pangolinServerAdmin": "服务器管理员 - Pangolin",
+    "pangolinServerAdmin": "服务器管理 - Pangolin",
    "licenseTierProfessional": "专业许可证",
    "licenseTierEnterprise": "企业许可证",
    "licenseTierPersonal": "个人许可证",
@@ -1366,7 +1366,7 @@
    "supportKeyBuy": "购买支持者密钥",
    "logoutError": "注销错误",
    "signingAs": "登录为",
-    "serverAdmin": "服务器管理员",
+    "serverAdmin": "服务器管理",
    "managedSelfhosted": "托管自托管",
    "otpEnable": "启用双因子认证",
    "otpDisable": "禁用双因子认证",
@@ -1536,8 +1536,8 @@
    "sidebarSites": "站点",
    "sidebarApprovals": "审批请求",
    "sidebarResources": "资源",
-    "sidebarProxyResources": "公开的",
-    "sidebarClientResources": "非公开的",
+    "sidebarProxyResources": "公开资源",
+    "sidebarClientResources": "私有资源",
    "sidebarPolicies": "共享策略",
    "sidebarResourcePolicies": "公共资源",
    "sidebarAccessControl": "访问控制",
@@ -1547,17 +1547,17 @@
    "sidebarAdmin": "管理员",
    "sidebarInvitations": "邀请",
    "sidebarRoles": "角色",
-    "sidebarShareableLinks": "可共享链接",
+    "sidebarShareableLinks": "共享链接",
    "sidebarApiKeys": "API密钥",
-    "sidebarProvisioning": "置备中",
+    "sidebarProvisioning": "预配",
    "sidebarSettings": "设置",
    "sidebarAllUsers": "所有用户",
    "sidebarIdentityProviders": "身份提供商",
    "sidebarLicense": "证书",
    "sidebarClients": "客户端",
    "sidebarUserDevices": "用户设备",
-    "sidebarMachineClients": "机",
-    "sidebarDomains": "域",
+    "sidebarMachineClients": "机器身份",
+    "sidebarDomains": "域名",
    "sidebarGeneral": "管理",
    "sidebarLogAndAnalytics": "日志与分析",
    "sidebarBluePrints": "蓝图",
@@ -1689,8 +1689,8 @@
    "alertingTabHealthChecks": "健康检查",
    "alertingRulesBannerTitle": "获取通知",
    "alertingRulesBannerDescription": "每条规则都连接要监视的对象（站点、健康检查或资源），触发时间（例如离线或不健康），以及如何通过电子邮件、Webhooks 或集成将通知发送给团队。使用此列表创建、启用和管理这些规则。",
-    "alertingHealthChecksBannerTitle": "监视健康和资源",
-    "alertingHealthChecksBannerDescription": "健康检查是您一次定义的 HTTP 或 TCP 监控。然后可以将它们用作告警规则中的来源，以便目标变得正常或不正常时得到通知。资源上的健康检查也会出现在此处。",
+    "alertingHealthChecksBannerTitle": "资源与健康监控",
+    "alertingHealthChecksBannerDescription": "通过 HTTP 或 TCP 检查目标状态，并在服务异常或恢复时发送通知。资源中配置的健康检查也会显示在这里。",
    "standaloneHcTableTitle": "健康检查",
    "standaloneHcSearchPlaceholder": "搜索健康检查…",
    "standaloneHcAddButton": "创建健康检查",
@@ -1791,17 +1791,17 @@
    "theme": "主题",
    "subnetRequired": "子网是必填项",
    "initialSetupTitle": "初始服务器设置",
-    "initialSetupDescription": "创建初始服务器管理员帐户。 只能存在一个服务器管理员。 您可以随时更改这些凭据。",
+    "initialSetupDescription": "创建初始的管理员帐户。 只能存在一个服务器管理员。 您可以随时更改这些凭据。",
    "createAdminAccount": "创建管理员帐户",
-    "setupErrorCreateAdmin": "创建服务器管理员账户时发生错误。",
+    "setupErrorCreateAdmin": "创建管理员账户时发生错误。",
    "certificateStatus": "证书",
    "certificateStatusAutoRefreshHint": "状态自动刷新。",
    "loading": "加载中",
    "loadingEllipsis": "加载中……",
    "loadingAnalytics": "加载分析",
    "restart": "重启",
-    "domains": "域",
-    "domainsDescription": "创建和管理组织中可用的域",
+    "domains": "域名",
+    "domainsDescription": "创建和管理组织中可用的域名",
    "domainsSearch": "搜索域...",
    "domainAdd": "添加域",
    "domainAddDescription": "注册一个新域名到组织",
@@ -2165,12 +2165,12 @@
    "sshSudoMode": "Sudo 访问",
    "sshSudoModeNone": "无",
    "sshSudoModeNoneDescription": "用户不能用sudo运行命令。",
-    "sshSudoModeFull": "全苏多",
+    "sshSudoModeFull": "完整 Sudo 权限",
    "sshSudoModeFullDescription": "用户可以用 sudo 运行任何命令。",
    "sshSudoModeCommands": "命令",
    "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
    "sshSudo": "允许Sudo",
-    "sshSudoCommands": "Sudo 命令",
+    "sshSudoCommands": "可用 Sudo 命令",
    "sshSudoCommandsDescription": "用户可以使用 sudo 运行的命令列表，以逗号、空格或新行分隔。必须使用绝对路径。",
    "sshCreateHomeDir": "创建主目录",
    "sshUnixGroups": "Unix 组",
@@ -2183,7 +2183,7 @@
    "roleTextImportAppend": "附加到现有",
    "roleTextImportMode": "导入模式",
    "roleTextImportPreview": "预览",
-    "roleTextImportItemCount": "{count, plural, =0 {No items to import} one {1 item to import} other {# items to import}}",
+    "roleTextImportItemCount": "{count, plural, =0 {没有可导入的项目} one {1 个可导入项目} other {# 个可导入项目}}",
    "roleTextImportTotalCount": "{existing} 个现有 + {imported} 个导入 = {total} 个总计",
    "roleTextImportConfirm": "导入",
    "roleTextImportInvalidFile": "不支持的文件类型",
@@ -2235,8 +2235,8 @@
    "resourceEditDomain": "编辑域名",
    "siteName": "站点名称",
    "proxyPort": "端口",
-    "resourcesTableProxyResources": "公开的",
-    "resourcesTableClientResources": "非公开的",
+    "resourcesTableProxyResources": "",
+    "resourcesTableClientResources": "私有资源",
    "resourcesTableNoProxyResourcesFound": "未找到代理资源。",
    "resourcesTableNoInternalResourcesFound": "未找到内部资源。",
    "resourcesTableDestination": "目标",
@@ -2925,7 +2925,7 @@
    "logRetentionRequestDescription": "保留请求日志的时间",
    "logRetentionAccessLabel": "访问日志保留",
    "logRetentionAccessDescription": "保留访问日志的时间",
-    "logRetentionActionLabel": "动作日志保留",
+    "logRetentionActionLabel": "审计日志保留",
    "logRetentionActionDescription": "保留操作日志的时间",
    "logRetentionConnectionLabel": "连接日志保留",
    "logRetentionConnectionDescription": "保留连接日志的时间",
@@ -2938,11 +2938,11 @@
    "logRetentionForever": "永远的",
    "logRetentionEndOfFollowingYear": "下一年结束",
    "actionLogsDescription": "查看此机构执行的操作历史",
-    "accessLogsDescription": "查看此机构资源的访问认证请求",
+    "accessLogsDescription": "查看此组织资源的访问认证请求",
    "connectionLogs": "连接日志",
    "connectionLogsDescription": "查看此机构隧道的连接日志",
    "sidebarLogsConnection": "连接日志",
-    "sidebarLogsStreaming": "流流",
+    "sidebarLogsStreaming": "事件流",
    "sourceAddress": "源地址",
    "destinationAddress": "目的地址",
    "duration": "期限",
@@ -2967,6 +2967,7 @@
    "orgOrDomainIdMissing": "缺少机构或域 ID",
    "loadingDNSRecords": "正在载入DNS记录...",
    "olmUpdateAvailableInfo": "有最新版本的 Olm 可用。请更新到最新版本以获取最佳体验。",
+    "updateAvailableInfo": "An updated version is available. Please update to the latest version for the best experience.",
    "client": "客户端：",
    "proxyProtocol": "代理协议设置",
    "proxyProtocolDescription": "配置代理协议以保留TCP服务的客户端 IP 地址。",
@@ -70,7 +70,7 @@
                "input-otp": "1.4.2",
                "ioredis": "5.11.0",
                "jmespath": "0.16.0",
-                "js-yaml": "4.1.1",
+                "js-yaml": "4.2.0",
                "jsonwebtoken": "9.0.3",
                "lucide-react": "1.17.0",
                "maxmind": "5.0.6",
@@ -13389,9 +13389,19 @@
            "license": "MIT"
        },
        "node_modules/js-yaml": {
-            "version": "4.1.1",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-            "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+            "version": "4.2.0",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+            "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
            "license": "MIT",
            "dependencies": {
                "argparse": "^2.0.1"
@@ -93,7 +93,7 @@
        "input-otp": "1.4.2",
        "ioredis": "5.11.0",
        "jmespath": "0.16.0",
-        "js-yaml": "4.1.1",
+        "js-yaml": "4.2.0",
        "jsonwebtoken": "9.0.3",
        "lucide-react": "1.17.0",
        "maxmind": "5.0.6",
@@ -3,7 +3,6 @@ import {
    newts,
    blueprints,
    Blueprint,
-    Site,
    siteResources,
    roleSiteResources,
    userSiteResources,
@@ -60,30 +59,26 @@ export async function applyBlueprint({

        const config: Config = validationResult.data;

-        let proxyResourcesResults: PublicResourcesResults = [];
-        let clientResourcesResults: ClientResourcesResults = [];
+        let publicResourcesResults: PublicResourcesResults = [];
+        let privateResourcesResults: ClientResourcesResults = [];
        await db.transaction(async (trx) => {
            await updateResourcePolicies(orgId, config, trx);

-            proxyResourcesResults = await updatePublicResources(
+            publicResourcesResults = await updatePublicResources(
                orgId,
                config,
                trx,
                siteId
            );
-            clientResourcesResults = await updatePrivateResources(
+            privateResourcesResults = await updatePrivateResources(
                orgId,
                config,
                trx,
                siteId
            );

-            logger.debug(
-                `Successfully updated proxy resources for org ${orgId}: ${JSON.stringify(proxyResourcesResults)}`
-            );
-
            // We need to update the targets on the newts from the successfully updated information
-            for (const result of proxyResourcesResults) {
+            for (const result of publicResourcesResults) {
                for (const target of result.targetsToUpdate) {
                    const [site] = await trx
                        .select()
@@ -136,166 +131,38 @@ export async function applyBlueprint({
            }

            logger.debug(
-                `Successfully updated client resources for org ${orgId}: ${JSON.stringify(clientResourcesResults)}`
+                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
            );

            // We need to update the targets on the newts from the successfully updated information
-            for (const result of clientResourcesResults) {
-                if (
-                    result.oldSiteResource &&
-                    JSON.stringify(result.newSites?.sort()) !==
-                        JSON.stringify(result.oldSites?.sort())
-                ) {
-                    // query existing associations
-                    const existingRoleIds = await trx
-                        .select()
-                        .from(roleSiteResources)
-                        .where(
-                            eq(
-                                roleSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
-                        )
-                        .then((rows) => rows.map((row) => row.roleId));
-
-                    const existingUserIds = await trx
-                        .select()
-                        .from(userSiteResources)
-                        .where(
-                            eq(
-                                userSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
-                        )
-                        .then((rows) => rows.map((row) => row.userId));
-
-                    const existingClientIds = await trx
-                        .select()
-                        .from(clientSiteResources)
-                        .where(
-                            eq(
-                                clientSiteResources.siteResourceId,
-                                result.oldSiteResource.siteResourceId
-                            )
-                        )
-                        .then((rows) => rows.map((row) => row.clientId));
-
-                    // delete the existing site resource
-                    await trx
-                        .delete(siteResources)
-                        .where(
-                            and(
-                                eq(
-                                    siteResources.siteResourceId,
-                                    result.oldSiteResource.siteResourceId
-                                )
-                            )
-                        );
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        result.oldSiteResource,
-                        trx
+            for (const result of privateResourcesResults) {
+                rebuildClientAssociationsFromSiteResource(
+                    result.newSiteResource
+                ).catch((e) => {
+                    logger.error(
+                        `Failed to rebuild client associations for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
                    );
+                });

-                    const [insertedSiteResource] = await trx
-                        .insert(siteResources)
-                        .values({
-                            ...result.newSiteResource
-                        })
-                        .returning();
-
-                    // wait some time to allow for messages to be handled
-                    await new Promise((resolve) => setTimeout(resolve, 750));
-
-                    //////////////////// update the associations ////////////////////
-
-                    if (existingRoleIds.length > 0) {
-                        await trx.insert(roleSiteResources).values(
-                            existingRoleIds.map((roleId) => ({
-                                roleId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingUserIds.length > 0) {
-                        await trx.insert(userSiteResources).values(
-                            existingUserIds.map((userId) => ({
-                                userId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    if (existingClientIds.length > 0) {
-                        await trx.insert(clientSiteResources).values(
-                            existingClientIds.map((clientId) => ({
-                                clientId,
-                                siteResourceId:
-                                    insertedSiteResource!.siteResourceId
-                            }))
-                        );
-                    }
-
-                    await rebuildClientAssociationsFromSiteResource(
-                        insertedSiteResource,
-                        trx
+                handleMessagingForUpdatedSiteResource(
+                    result.oldSiteResource,
+                    result.newSiteResource,
+                    result.oldSites.map((site) => ({
+                        // only need to run this on the old sites because the new sites are added above
+                        siteId: site.siteId,
+                        orgId: result.newSiteResource.orgId
+                    }))
+                ).catch((err) => {
+                    logger.error(
+                        `Error handling messaging for updated site resource ${result.newSiteResource.siteResourceId}:`,
+                        err
                    );
-                } else {
-                    let good = true;
-                    for (const newSite of result.newSites) {
-                        const [site] = await trx
-                            .select()
-                            .from(sites)
-                            .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                            .where(
-                                and(
-                                    eq(sites.siteId, newSite.siteId),
-                                    eq(sites.orgId, orgId),
-                                    eq(sites.type, "newt"),
-                                    isNotNull(sites.pubKey)
-                                )
-                            )
-                            .limit(1);
-
-                        if (!site) {
-                            logger.debug(
-                                `No newt sites found for client resource ${result.newSiteResource.siteResourceId}, skipping target update`
-                            );
-                            good = false;
-                            break;
-                        }
-
-                        logger.debug(
-                            `Updating client resource ${result.newSiteResource.siteResourceId} on site ${newSite.siteId}`
-                        );
-                    }
-
-                    if (!good) {
-                        continue;
-                    }
-
-                    await handleMessagingForUpdatedSiteResource(
-                        result.oldSiteResource,
-                        result.newSiteResource,
-                        result.newSites.map((site) => ({
-                            siteId: site.siteId,
-                            orgId: result.newSiteResource.orgId
-                        })),
-                        trx
-                    );
-                }
-
-                // await addClientTargets(
-                //     site.newt.newtId,
-                //     result.resource.destination,
-                //     result.resource.destinationPort,
-                //     result.resource.protocol,
-                //     result.resource.proxyPort
-                // );
+                });
            }
+
+            logger.debug(
+                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+            );
        });

        blueprintSucceeded = true;
@@ -6,6 +6,7 @@ import {
    db,
    olms,
    orgs,
+    primaryDb,
    roleClients,
    roles,
    Transaction,
@@ -23,10 +24,44 @@ import { rebuildClientAssociationsFromClient } from "./rebuildClientAssociations
 import { OlmErrorCodes } from "@server/routers/olm/error";
 import { tierMatrix } from "./billing/tierMatrix";

-export async function calculateUserClientsForOrgs(
+type ClientRow = typeof clients.$inferSelect;
+
+function runQueuedClientAssociationRebuilds(
    userId: string,
-    trx: Transaction | typeof db = db
+    queuedClients: ClientRow[]
+): void {
+    if (queuedClients.length === 0) {
+        return;
+    }
+
+    const uniqueClientsById = new Map<number, ClientRow>();
+    for (const client of queuedClients) {
+        uniqueClientsById.set(client.clientId, client);
+    }
+
+    void (async () => {
+        for (const client of uniqueClientsById.values()) {
+            try {
+                await rebuildClientAssociationsFromClient(client);
+            } catch (error) {
+                logger.error(
+                    `Failed rebuilding associations for client ${client.clientId} (user ${userId}): ${String(error)}`
+                );
+            }
+        }
+
+        logger.debug(
+            `Queued association rebuild completed for ${uniqueClientsById.size} client(s) (user ${userId})`
+        );
+    })();
+}
+
+export async function calculateUserClientsForOrgs(
+    userId: string
 ): Promise<void> {
+    const trx = primaryDb;
+    const queuedAssociationRebuilds: ClientRow[] = [];
+
    const execute = async (transaction: Transaction | typeof db) => {
        const orgCache = new Map<string, typeof orgs.$inferSelect | null>();
        const adminRoleCache = new Map<
@@ -189,7 +224,12 @@ export async function calculateUserClientsForOrgs(

        if (userOlms.length === 0) {
            // No OLMs for this user, but we should still clean up any orphaned clients
-            await cleanupOrphanedClients(userId, transaction);
+            await cleanupOrphanedClients(
+                userId,
+                transaction,
+                [],
+                queuedAssociationRebuilds
+            );
            return;
        }

@@ -382,10 +422,7 @@ export async function calculateUserClientsForOrgs(
                        .returning();
                }

-                await rebuildClientAssociationsFromClient(
-                    newClient,
-                    transaction
-                );
+                queuedAssociationRebuilds.push(newClient);

                // Grant admin role access to the client
                await transaction.insert(roleClients).values({
@@ -414,24 +451,22 @@ export async function calculateUserClientsForOrgs(
        }

        // Clean up clients in orgs the user is no longer in
-        await cleanupOrphanedClients(userId, transaction, userOrgIds);
+        await cleanupOrphanedClients(
+            userId,
+            transaction,
+            userOrgIds,
+            queuedAssociationRebuilds
+        );
    };

-    if (trx) {
-        // Use provided transaction
-        await execute(trx);
-    } else {
-        // Create new transaction
-        await db.transaction(async (transaction) => {
-            await execute(transaction);
-        });
-    }
+    runQueuedClientAssociationRebuilds(userId, queuedAssociationRebuilds);
 }

 async function cleanupOrphanedClients(
    userId: string,
    trx: Transaction | typeof db,
-    userOrgIds: string[] = []
+    userOrgIds: string[] = [],
+    queuedAssociationRebuilds: ClientRow[] = []
 ): Promise<void> {
    // Find all OLM clients for this user that should be deleted
    // If userOrgIds is empty, delete all OLM clients (user has no orgs)
@@ -461,9 +496,9 @@ async function cleanupOrphanedClients(
            )
            .returning();

-        // Rebuild associations for each deleted client to clean up related data
+        // Queue deleted clients for post-transaction association cleanup.
        for (const deletedClient of deletedClients) {
-            await rebuildClientAssociationsFromClient(deletedClient, trx);
+            queuedAssociationRebuilds.push(deletedClient);

            if (deletedClient.olmId) {
                await sendTerminateClient(
@@ -160,9 +160,9 @@ export async function getClientSiteResourceAccess(
 }

 export async function rebuildClientAssociationsFromSiteResource(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
+    siteResource: SiteResource
 ) {
+    const trx = primaryDb;
    try {
        return await lockManager.withLock(
            `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
@@ -1043,9 +1043,9 @@ async function handleSubnetProxyTargetUpdates(
 }

 export async function rebuildClientAssociationsFromClient(
-    client: Client,
-    trx: Transaction | typeof db = db
+    client: Client
 ): Promise<void> {
+    const trx = primaryDb;
    try {
        return await lockManager.withLock(
            `rebuild-client-associations:client:${client.clientId}`,
@@ -2119,10 +2119,7 @@ export function startRebuildQueueProcessor(): void {
                return;
            }

-            await rebuildClientAssociationsFromSiteResource(
-                siteResource,
-                primaryDb
-            );
+            await rebuildClientAssociationsFromSiteResource(siteResource);
        },
        onClient: async (clientId: number) => {
            const [client] = await primaryDb
@@ -2137,7 +2134,7 @@ export function startRebuildQueueProcessor(): void {
                return;
            }

-            await rebuildClientAssociationsFromClient(client, primaryDb);
+            await rebuildClientAssociationsFromClient(client);
        }
    });
 }
@@ -12,7 +12,7 @@
 */

 import { redis } from "#private/lib/redis";
-import { lockManager } from "#dynamic/lib/lock";
+import { lockManager } from "#private/lib/lock";
 import logger from "@server/logger";

 export type RebuildJobType = "site-resource" | "client";
@@ -29,26 +29,40 @@ const paramsSchema = z.strictObject({
    orgId: z.string().nonempty()
 });

-const bodySchema = z.strictObject({
-    name: z.string().nonempty(),
-    siteId: z.number().int().positive(),
-    hcEnabled: z.boolean().default(false),
-    hcMode: z.string().default("http"),
-    hcHostname: z.string().optional(),
-    hcPort: z.number().int().min(1).max(65535).optional(),
-    hcPath: z.string().optional(),
-    hcScheme: z.string().optional(),
-    hcMethod: z.string().default("GET"),
-    hcInterval: z.number().int().positive().default(30),
-    hcUnhealthyInterval: z.number().int().positive().default(30),
-    hcTimeout: z.number().int().positive().default(1),
-    hcHeaders: z.string().optional().nullable(),
-    hcFollowRedirects: z.boolean().default(true),
-    hcStatus: z.number().int().optional().nullable(),
-    hcTlsServerName: z.string().optional(),
-    hcHealthyThreshold: z.number().int().positive().default(1),
-    hcUnhealthyThreshold: z.number().int().positive().default(1)
-});
+const bodySchema = z
+    .strictObject({
+        name: z.string().nonempty(),
+        siteId: z.number().int().positive(),
+        hcEnabled: z.boolean().default(false),
+        hcMode: z.string().default("http"),
+        hcHostname: z.string().optional(),
+        hcPort: z.number().int().min(1).max(65535).optional(),
+        hcPath: z.string().optional(),
+        hcScheme: z.string().optional(),
+        hcMethod: z.string().default("GET"),
+        hcInterval: z.number().int().positive().default(30),
+        hcUnhealthyInterval: z.number().int().positive().default(30),
+        hcTimeout: z.number().int().positive().default(1),
+        hcHeaders: z.string().optional().nullable(),
+        hcFollowRedirects: z.boolean().default(true),
+        hcStatus: z.number().int().optional().nullable(),
+        hcTlsServerName: z.string().optional(),
+        hcHealthyThreshold: z.number().int().positive().default(1),
+        hcUnhealthyThreshold: z.number().int().positive().default(1)
+    })
+    .superRefine((data, ctx) => {
+        const hcHostnameMissing =
+            data.hcHostname === undefined ||
+            data.hcHostname.trim().length === 0;
+
+        if (data.hcEnabled === true && hcHostnameMissing) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["hcHostname"],
+                message: "hcHostname is required when hcEnabled is true"
+            });
+        }
+    });

 export type CreateHealthCheckResponse = {
    targetHealthCheckId: number;
@@ -57,7 +71,6 @@ const CreateHealthCheckResponseDataSchema = z.object({
    targetHealthCheckId: z.number()
 });

-
 registry.registerPath({
    method: "put",
    path: "/org/{orgId}/health-check",
@@ -78,7 +91,9 @@ registry.registerPath({
            description: "Successful response",
            content: {
                "application/json": {
-                    schema: createApiResponseSchema(CreateHealthCheckResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        CreateHealthCheckResponseDataSchema
+                    )
                }
            }
        }
@@ -105,7 +105,6 @@ const UpdateHealthCheckResponseDataSchema = z.object({
    hcUnhealthyThreshold: z.number().nullable()
 });

-
 registry.registerPath({
    method: "post",
    path: "/org/{orgId}/health-check/{healthCheckId}",
@@ -126,7 +125,9 @@ registry.registerPath({
            description: "Successful response",
            content: {
                "application/json": {
-                    schema: createApiResponseSchema(UpdateHealthCheckResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        UpdateHealthCheckResponseDataSchema
+                    )
                }
            }
        }
@@ -215,6 +216,32 @@ export async function updateHealthCheck(
            )
            .limit(1);

+        if (!existingHealthCheck) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Standalone health check not found"
+                )
+            );
+        }
+
+        const nextHcEnabled = hcEnabled ?? existingHealthCheck.hcEnabled;
+        const nextHcHostname =
+            hcHostname !== undefined
+                ? hcHostname
+                : existingHealthCheck.hcHostname;
+        const hcHostnameMissing =
+            !nextHcHostname || nextHcHostname.trim().length === 0;
+
+        if (nextHcEnabled && hcHostnameMissing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "hcHostname is required when hcEnabled is true"
+                )
+            );
+        }
+
        if (name !== undefined) updateData.name = name;
        if (siteId !== undefined) updateData.siteId = siteId;
        if (hcEnabled !== undefined) updateData.hcEnabled = hcEnabled;
@@ -121,7 +121,7 @@ export async function unassociateOrgIdp(
        });

        for (const userId of userIdsToRemove) {
-            calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+            calculateUserClientsForOrgs(userId).catch((e) => {
                logger.error(
                    `Failed to calculate user clients after removing user ${userId} from org ${orgId} during IdP unassociation: ${e}`
                );
@@ -163,13 +163,11 @@ export async function addUserRole(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
+                );
+            });
        }

        return response(res, {
@@ -170,13 +170,11 @@ export async function removeUserRole(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after removing role: ${e}`
+                );
+            });
        }

        return response(res, {
@@ -150,13 +150,11 @@ export async function setUserOrgRoles(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after setting roles: ${e}`
+                );
+            });
        }

        return response(res, {
@@ -30,7 +30,7 @@ const listAccessTokensParamsSchema = z
        error: "Either resourceId or orgId must be provided, but not both"
    });

-const listAccessTokensSchema = z.object({
+const listAccessTokensSchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -15,7 +15,7 @@ const paramsSchema = z.object({
    apiKeyId: z.string().nonempty()
 });

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -11,7 +11,7 @@ import { eq, and } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
 import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -9,7 +9,7 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -20,7 +20,7 @@ import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";

-export const queryAccessAuditLogsQuery = z.object({
+export const queryAccessAuditLogsQuery = z.strictObject({
    // iso string just validate its a parseable date
    timeStart: z
        .string()
@@ -224,7 +224,7 @@ export async function deleteMyAccount(
            }
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            logger.error(
                `Failed to calculate user clients after deleting account for user ${userId}: ${e}`
            );
@@ -280,13 +280,11 @@ export async function createClient(
        });

        if (newClient) {
-            rebuildClientAssociationsFromClient(newClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after creating client: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(newClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after creating client: ${e}`
+                );
+            });
        }

        return response<CreateClientResponse>(res, {
@@ -255,13 +255,11 @@ export async function createUserClient(
        });

        if (newClient) {
-            rebuildClientAssociationsFromClient(newClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after creating user client: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(newClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after creating user client: ${e}`
+                );
+            });
        }

        return response<CreateClientAndOlmResponse>(res, {
@@ -109,13 +109,11 @@ export async function deleteClient(
        });

        if (deletedClient) {
-            rebuildClientAssociationsFromClient(deletedClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations after deleting client ${clientId}: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(deletedClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations after deleting client ${clientId}: ${e}`
+                );
+            });
            if (olm) {
                sendTerminateClient(
                    deletedClient.clientId,
@@ -41,7 +41,7 @@ const listClientsParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listClientsSchema = z.object({
+const listClientsSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -40,7 +40,7 @@ const listUserDevicesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listUserDevicesSchema = z.object({
+const listUserDevicesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -60,13 +60,17 @@ export async function rebuildClientAssociationsCacheRoute(
            );
        }

-        await rebuildClientAssociationsFromClient(client);
+        rebuildClientAssociationsFromClient(client).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for client ${clientId}: ${e}`
+            );
+        });

        return response(res, {
            data: null,
            success: true,
            error: false,
-            message: "Client association cache rebuilt successfully",
+            message: "Client association cache queued successfully",
            status: HttpCode.OK
        });
    } catch (error) {
@@ -635,7 +635,7 @@ export async function validateOidcCallback(
                }
            });

-            calculateUserClientsForOrgs(userId!, primaryDb).catch((err) => {
+            calculateUserClientsForOrgs(userId!).catch((err) => {
                logger.error(
                    "Error calculating user clients after syncing orgs and roles for OIDC user",
                    { error: err }
@@ -104,7 +104,7 @@ export async function createUserOlm(
            dateCreated: moment().toISOString()
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            console.error(
                "Error calculating user clients after creating olm:",
                e
@@ -86,13 +86,11 @@ export async function deleteUserOlm(
        });

        if (deletedClient) {
-            rebuildClientAssociationsFromClient(deletedClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client-site associations after deleting OLM ${olmId}: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(deletedClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client-site associations after deleting OLM ${olmId}: ${e}`
+                );
+            });
            sendTerminateClient(
                deletedClient.clientId,
                OlmErrorCodes.TERMINATED_DELETED,
@@ -11,7 +11,7 @@ import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
 import { getUserDeviceName } from "@server/db/names";

-const querySchema = z.object({
+const querySchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db } from "@server/db";
+import { db, primaryDb } from "@server/db";
 import { and, count, eq } from "drizzle-orm";
 import {
    domains,
@@ -233,6 +233,7 @@ export async function createOrg(
        let error = "";
        let org: Org | null = null;
        let numOrgs: number | null = null;
+        let ownerUserId: string | null = null;

        await db.transaction(async (trx) => {
            const allDomains = await trx
@@ -326,7 +327,6 @@ export async function createOrg(
                );
            }

-            let ownerUserId: string | null = null;
            if (req.user) {
                await trx.insert(userOrgs).values({
                    userId: req.user!.userId,
@@ -382,8 +382,6 @@ export async function createOrg(
                }))
            );

-            await calculateUserClientsForOrgs(ownerUserId, trx);
-
            if (billingOrgIdForNewOrg) {
                const [numOrgsResult] = await trx
                    .select({ count: count() })
@@ -396,6 +394,14 @@ export async function createOrg(
            }
        });

+        if (ownerUserId) {
+            calculateUserClientsForOrgs(ownerUserId).catch((e) => {
+                logger.error(
+                    `Failed to calculate user clients after creating org ${orgId} for user ${ownerUserId}: ${e}`
+                );
+            });
+        }
+
        if (!org) {
            return next(
                createHttpError(
@@ -11,7 +11,7 @@ import { fromZodError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";

-const listOrgsSchema = z.object({
+const listOrgsSchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -14,7 +14,7 @@ const listOrgsParamsSchema = z.object({
    userId: z.string()
 });

-const listOrgsSchema = z.object({
+const listOrgsSchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -14,7 +14,7 @@ const listResourceRulesParamsSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });

-const listResourceRulesSchema = z.object({
+const listResourceRulesSchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -48,7 +48,7 @@ const listResourcesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listResourcesSchema = z.object({
+const listResourcesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -32,7 +32,7 @@ const listUserResourceAliasesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listUserResourceAliasesQuerySchema = z.object({
+const listUserResourceAliasesQuerySchema = z.strictObject({
    pageSize: z.coerce
        .number<string>()
        .int()
@@ -15,7 +15,7 @@ const listRolesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listRolesSchema = z.object({
+const listRolesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -32,7 +32,7 @@ const listSitesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listSitesSchema = z.object({
+const listSitesSchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -148,13 +148,15 @@ export async function addClientToSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx.insert(clientSiteResources).values({
-                clientId,
-                siteResourceId
-            });
+        await db.insert(clientSiteResources).values({
+            clientId,
+            siteResourceId
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -155,13 +155,15 @@ export async function addRoleToSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx.insert(roleSiteResources).values({
-                roleId,
-                siteResourceId
-            });
+        await db.insert(roleSiteResources).values({
+            roleId,
+            siteResourceId
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -124,13 +124,15 @@ export async function addUserToSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx.insert(userSiteResources).values({
-                userId,
-                siteResourceId
-            });
+        await db.insert(userSiteResources).values({
+            userId,
+            siteResourceId
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -235,7 +235,7 @@ export async function batchAddClientToSiteResources(
            }
        });

-        rebuildClientAssociationsFromClient(client, primaryDb).catch((e) => {
+        rebuildClientAssociationsFromClient(client).catch((e) => {
            logger.error(
                `Failed to rebuild client associations after batch adding site resources for client ${clientId}: ${e}`
            );
@@ -625,15 +625,14 @@ export async function createSiteResource(
        // own transaction so it always executes on the primary — avoiding any
        // replica-lag issues while still allowing the HTTP response to return
        // early.
-        rebuildClientAssociationsFromSiteResource(
-            newSiteResource!,
-            primaryDb
-        ).catch((err) => {
-            logger.error(
-                `Error rebuilding client associations for site resource ${newSiteResource!.siteResourceId}:`,
-                err
-            );
-        });
+        rebuildClientAssociationsFromSiteResource(newSiteResource!).catch(
+            (err) => {
+                logger.error(
+                    `Error rebuilding client associations for site resource ${newSiteResource!.siteResourceId}:`,
+                    err
+                );
+            }
+        );

        return response(res, {
            data: newSiteResource,
@@ -88,15 +88,14 @@ export async function deleteSiteResource(
        // own transaction so it always executes on the primary — avoiding any
        // replica-lag issues while still allowing the HTTP response to return
        // early.
-        rebuildClientAssociationsFromSiteResource(
-            removedSiteResource,
-            primaryDb
-        ).catch((err) => {
-            logger.error(
-                `Error rebuilding client associations for site resource ${removedSiteResource!.siteResourceId}:`,
-                err
-            );
-        });
+        rebuildClientAssociationsFromSiteResource(removedSiteResource).catch(
+            (err) => {
+                logger.error(
+                    `Error rebuilding client associations for site resource ${removedSiteResource!.siteResourceId}:`,
+                    err
+                );
+            }
+        );

        logger.info(`Deleted site resource ${siteResourceId}`);

@@ -26,7 +26,7 @@ const listAllSiteResourcesByOrgParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listAllSiteResourcesByOrgQuerySchema = z.object({
+const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
    pageSize: z.coerce
        .number<string>() // for prettier formatting
        .int()
@@ -15,7 +15,7 @@ const listSiteResourcesParamsSchema = z.strictObject({
    orgId: z.string()
 });

-const listSiteResourcesQuerySchema = z.object({
+const listSiteResourcesQuerySchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -148,17 +148,19 @@ export async function removeClientFromSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx
-                .delete(clientSiteResources)
-                .where(
-                    and(
-                        eq(clientSiteResources.siteResourceId, siteResourceId),
-                        eq(clientSiteResources.clientId, clientId)
-                    )
-                );
+        await db
+            .delete(clientSiteResources)
+            .where(
+                and(
+                    eq(clientSiteResources.siteResourceId, siteResourceId),
+                    eq(clientSiteResources.clientId, clientId)
+                )
+            );

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -156,17 +156,19 @@ export async function removeRoleFromSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx
-                .delete(roleSiteResources)
-                .where(
-                    and(
-                        eq(roleSiteResources.siteResourceId, siteResourceId),
-                        eq(roleSiteResources.roleId, roleId)
-                    )
-                );
+        await db
+            .delete(roleSiteResources)
+            .where(
+                and(
+                    eq(roleSiteResources.siteResourceId, siteResourceId),
+                    eq(roleSiteResources.roleId, roleId)
+                )
+            );

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -126,17 +126,19 @@ export async function removeUserFromSiteResource(
            );
        }

-        await db.transaction(async (trx) => {
-            await trx
-                .delete(userSiteResources)
-                .where(
-                    and(
-                        eq(userSiteResources.siteResourceId, siteResourceId),
-                        eq(userSiteResources.userId, userId)
-                    )
-                );
+        await db
+            .delete(userSiteResources)
+            .where(
+                and(
+                    eq(userSiteResources.siteResourceId, siteResourceId),
+                    eq(userSiteResources.userId, userId)
+                )
+            );

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId} after removing user ${userId}: ${e}`
+            );
        });

        return response(res, {
@@ -141,8 +141,12 @@ export async function setSiteResourceClients(
                    }))
                );
            }
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -165,8 +165,12 @@ export async function setSiteResourceRoles(
                        roleIds.map((roleId) => ({ roleId, siteResourceId }))
                    );
            }
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -10,6 +10,7 @@ import { fromError } from "zod-validation-error";
 import { eq } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
 import { rebuildClientAssociationsFromSiteResource } from "@server/lib/rebuildClientAssociations";
+import { error } from "node:console";

 const setSiteResourceUsersBodySchema = z
    .object({
@@ -120,8 +121,12 @@ export async function setSiteResourceUsers(
                        userIds.map((userId) => ({ userId, siteResourceId }))
                    );
            }
+        });

-            await rebuildClientAssociationsFromSiteResource(siteResource, trx);
+        rebuildClientAssociationsFromSiteResource(siteResource).catch((e) => {
+            logger.error(
+                `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
+            );
        });

        return response(res, {
@@ -12,7 +12,8 @@ import {
    sites,
    networks,
    Transaction,
-    userSiteResources
+    userSiteResources,
+    primaryDb
 } from "@server/db";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -389,7 +390,6 @@ export async function updateSiteResource(
            );
        }

-        let sitesChanged = false;
        const existingSiteIds = existingSiteResource.networkId
            ? await db
                  .select()
@@ -398,16 +398,7 @@ export async function updateSiteResource(
                      eq(siteNetworks.networkId, existingSiteResource.networkId)
                  )
            : [];
-
        const existingSiteIdSet = new Set(existingSiteIds.map((s) => s.siteId));
-        const newSiteIdSet = new Set(siteIds);
-
-        if (
-            existingSiteIdSet.size !== newSiteIdSet.size ||
-            ![...existingSiteIdSet].every((id) => newSiteIdSet.has(id))
-        ) {
-            sitesChanged = true;
-        }

        let fullDomain: string | null = null;
        let finalSubdomain: string | null = null;
@@ -474,345 +465,165 @@ export async function updateSiteResource(

        let updatedSiteResource: SiteResource | undefined;
        await db.transaction(async (trx) => {
-            // if the site is changed we need to delete and recreate the resource to avoid complications with the rebuild function otherwise we can just update in place
-            if (sitesChanged) {
-                // delete the existing site resource
-                await trx
-                    .delete(siteResources)
-                    .where(
-                        and(eq(siteResources.siteResourceId, siteResourceId))
-                    );
+            // Update the site resource
+            const sshPamSet =
+                isLicensedSshPam &&
+                (authDaemonPort !== undefined ||
+                    authDaemonMode !== undefined ||
+                    pamMode !== undefined)
+                    ? {
+                          ...(authDaemonPort !== undefined && {
+                              authDaemonPort
+                          }),
+                          ...(authDaemonMode !== undefined && {
+                              authDaemonMode
+                          }),
+                          ...(pamMode !== undefined && {
+                              pamMode
+                          })
+                      }
+                    : {};
+            let tcpPortRangeStringAdjusted = tcpPortRangeString;
+            if (mode === "http") {
+                tcpPortRangeStringAdjusted = "443,80";
+            } else if (mode === "ssh") {
+                tcpPortRangeStringAdjusted = destinationPort
+                    ? destinationPort.toString()
+                    : "22";
+            }

-                await rebuildClientAssociationsFromSiteResource(
-                    existingSiteResource,
-                    trx
+            [updatedSiteResource] = await trx
+                .update(siteResources)
+                .set({
+                    name: name,
+                    niceId: niceId,
+                    mode: mode,
+                    scheme,
+                    ssl,
+                    destination: destination,
+                    destinationPort: destinationPort,
+                    enabled: enabled,
+                    alias: alias ? alias.trim() : null,
+                    tcpPortRangeString: tcpPortRangeStringAdjusted,
+                    udpPortRangeString:
+                        mode == "http" || mode == "ssh"
+                            ? ""
+                            : udpPortRangeString,
+                    disableIcmp:
+                        disableIcmp ||
+                        (mode == "http" || mode == "ssh" ? true : false),
+                    domainId,
+                    subdomain: finalSubdomain,
+                    fullDomain,
+                    ...sshPamSet
+                })
+                .where(and(eq(siteResources.siteResourceId, siteResourceId)))
+                .returning();
+
+            //////////////////// update the associations ////////////////////
+
+            // delete the site - site resources associations
+            await trx
+                .delete(siteNetworks)
+                .where(
+                    eq(siteNetworks.networkId, updatedSiteResource.networkId!)
                );

-                // create the new site resource from the removed one - the ID should stay the same
-                const [insertedSiteResource] = await trx
-                    .insert(siteResources)
-                    .values({
-                        ...existingSiteResource
-                    })
-                    .returning();
-
-                const sshPamSet =
-                    isLicensedSshPam &&
-                    (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined ||
-                        pamMode !== undefined)
-                        ? {
-                              ...(authDaemonPort !== undefined && {
-                                  authDaemonPort
-                              }),
-                              ...(authDaemonMode !== undefined && {
-                                  authDaemonMode
-                              }),
-                              ...(pamMode !== undefined && {
-                                  pamMode
-                              })
-                          }
-                        : {};
-
-                let tcpPortRangeStringAdjusted = tcpPortRangeString;
-                if (mode === "http") {
-                    tcpPortRangeStringAdjusted = "443,80";
-                } else if (mode === "ssh") {
-                    tcpPortRangeStringAdjusted = destinationPort
-                        ? destinationPort.toString()
-                        : "22";
-                }
-
-                [updatedSiteResource] = await trx
-                    .update(siteResources)
-                    .set({
-                        name,
-                        niceId,
-                        mode,
-                        scheme,
-                        ssl,
-                        destination,
-                        destinationPort,
-                        enabled,
-                        alias: alias ? alias.trim() : null,
-                        tcpPortRangeString: tcpPortRangeStringAdjusted,
-                        udpPortRangeString:
-                            mode == "http" || mode == "ssh"
-                                ? ""
-                                : udpPortRangeString,
-                        disableIcmp:
-                            disableIcmp ||
-                            (mode == "http" || mode == "ssh" ? true : false), // default to true for http resources, otherwise false
-                        domainId,
-                        subdomain: finalSubdomain,
-                        fullDomain,
-                        ...sshPamSet
-                    })
-                    .where(
-                        and(
-                            eq(
-                                siteResources.siteResourceId,
-                                insertedSiteResource.siteResourceId
-                            )
-                        )
-                    )
-                    .returning();
-
-                if (!updatedSiteResource) {
-                    throw new Error(
-                        "Failed to create updated site resource after site change"
-                    );
-                }
-
-                //////////////////// update the associations ////////////////////
-
-                // delete the site - site resources associations
-                await trx
-                    .delete(siteNetworks)
-                    .where(
-                        eq(
-                            siteNetworks.networkId,
-                            updatedSiteResource.networkId!
-                        )
-                    );
-
-                for (const siteId of siteIds) {
-                    await trx.insert(siteNetworks).values({
-                        siteId: siteId,
-                        networkId: updatedSiteResource.networkId!
-                    });
-                }
-
-                const [adminRole] = await trx
-                    .select()
-                    .from(roles)
-                    .where(
-                        and(
-                            eq(roles.isAdmin, true),
-                            eq(roles.orgId, updatedSiteResource.orgId)
-                        )
-                    )
-                    .limit(1);
-
-                if (!adminRole) {
-                    return next(
-                        createHttpError(
-                            HttpCode.NOT_FOUND,
-                            `Admin role not found`
-                        )
-                    );
-                }
-
-                await trx.insert(roleSiteResources).values({
-                    roleId: adminRole.roleId,
-                    siteResourceId: updatedSiteResource.siteResourceId
+            for (const siteId of siteIds) {
+                await trx.insert(siteNetworks).values({
+                    siteId: siteId,
+                    networkId: updatedSiteResource.networkId!
                });
-
-                if (roleIds.length > 0) {
-                    await trx.insert(roleSiteResources).values(
-                        roleIds.map((roleId) => ({
-                            roleId,
-                            siteResourceId: updatedSiteResource!.siteResourceId
-                        }))
-                    );
-                }
-
-                if (userIds.length > 0) {
-                    await trx.insert(userSiteResources).values(
-                        userIds.map((userId) => ({
-                            userId,
-                            siteResourceId: updatedSiteResource!.siteResourceId
-                        }))
-                    );
-                }
-
-                if (clientIds.length > 0) {
-                    await trx.insert(clientSiteResources).values(
-                        clientIds.map((clientId) => ({
-                            clientId,
-                            siteResourceId: updatedSiteResource!.siteResourceId
-                        }))
-                    );
-                }
-            } else {
-                // Update the site resource
-                const sshPamSet =
-                    isLicensedSshPam &&
-                    (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined ||
-                        pamMode !== undefined)
-                        ? {
-                              ...(authDaemonPort !== undefined && {
-                                  authDaemonPort
-                              }),
-                              ...(authDaemonMode !== undefined && {
-                                  authDaemonMode
-                              }),
-                              ...(pamMode !== undefined && {
-                                  pamMode
-                              })
-                          }
-                        : {};
-                let tcpPortRangeStringAdjusted = tcpPortRangeString;
-                if (mode === "http") {
-                    tcpPortRangeStringAdjusted = "443,80";
-                } else if (mode === "ssh") {
-                    tcpPortRangeStringAdjusted = destinationPort
-                        ? destinationPort.toString()
-                        : "22";
-                }
-
-                [updatedSiteResource] = await trx
-                    .update(siteResources)
-                    .set({
-                        name: name,
-                        niceId: niceId,
-                        mode: mode,
-                        scheme,
-                        ssl,
-                        destination: destination,
-                        destinationPort: destinationPort,
-                        enabled: enabled,
-                        alias: alias ? alias.trim() : null,
-                        tcpPortRangeString: tcpPortRangeStringAdjusted,
-                        udpPortRangeString:
-                            mode == "http" || mode == "ssh"
-                                ? ""
-                                : udpPortRangeString,
-                        disableIcmp:
-                            disableIcmp ||
-                            (mode == "http" || mode == "ssh" ? true : false),
-                        domainId,
-                        subdomain: finalSubdomain,
-                        fullDomain,
-                        ...sshPamSet
-                    })
-                    .where(
-                        and(eq(siteResources.siteResourceId, siteResourceId))
-                    )
-                    .returning();
-
-                //////////////////// update the associations ////////////////////
-
-                // delete the site - site resources associations
-                await trx
-                    .delete(siteNetworks)
-                    .where(
-                        eq(
-                            siteNetworks.networkId,
-                            updatedSiteResource.networkId!
-                        )
-                    );
-
-                for (const siteId of siteIds) {
-                    await trx.insert(siteNetworks).values({
-                        siteId: siteId,
-                        networkId: updatedSiteResource.networkId!
-                    });
-                }
-
-                await trx
-                    .delete(clientSiteResources)
-                    .where(
-                        eq(clientSiteResources.siteResourceId, siteResourceId)
-                    );
-
-                if (clientIds.length > 0) {
-                    await trx.insert(clientSiteResources).values(
-                        clientIds.map((clientId) => ({
-                            clientId,
-                            siteResourceId
-                        }))
-                    );
-                }
-
-                await trx
-                    .delete(userSiteResources)
-                    .where(
-                        eq(userSiteResources.siteResourceId, siteResourceId)
-                    );
-
-                if (userIds.length > 0) {
-                    await trx.insert(userSiteResources).values(
-                        userIds.map((userId) => ({
-                            userId,
-                            siteResourceId
-                        }))
-                    );
-                }
-
-                // Get all admin role IDs for this org to exclude from deletion
-                const adminRoles = await trx
-                    .select()
-                    .from(roles)
-                    .where(
-                        and(
-                            eq(roles.isAdmin, true),
-                            eq(roles.orgId, updatedSiteResource.orgId)
-                        )
-                    );
-                const adminRoleIds = adminRoles.map((role) => role.roleId);
-
-                if (adminRoleIds.length > 0) {
-                    await trx.delete(roleSiteResources).where(
-                        and(
-                            eq(
-                                roleSiteResources.siteResourceId,
-                                siteResourceId
-                            ),
-                            ne(roleSiteResources.roleId, adminRoleIds[0]) // delete all but the admin role
-                        )
-                    );
-                } else {
-                    await trx
-                        .delete(roleSiteResources)
-                        .where(
-                            eq(roleSiteResources.siteResourceId, siteResourceId)
-                        );
-                }
-
-                if (roleIds.length > 0) {
-                    await trx.insert(roleSiteResources).values(
-                        roleIds.map((roleId) => ({
-                            roleId,
-                            siteResourceId
-                        }))
-                    );
-                }
-
-                logger.info(`Updated site resource ${siteResourceId}`);
            }
+
+            await trx
+                .delete(clientSiteResources)
+                .where(eq(clientSiteResources.siteResourceId, siteResourceId));
+
+            if (clientIds.length > 0) {
+                await trx.insert(clientSiteResources).values(
+                    clientIds.map((clientId) => ({
+                        clientId,
+                        siteResourceId
+                    }))
+                );
+            }
+
+            await trx
+                .delete(userSiteResources)
+                .where(eq(userSiteResources.siteResourceId, siteResourceId));
+
+            if (userIds.length > 0) {
+                await trx.insert(userSiteResources).values(
+                    userIds.map((userId) => ({
+                        userId,
+                        siteResourceId
+                    }))
+                );
+            }
+
+            // Get all admin role IDs for this org to exclude from deletion
+            const adminRoles = await trx
+                .select()
+                .from(roles)
+                .where(
+                    and(
+                        eq(roles.isAdmin, true),
+                        eq(roles.orgId, updatedSiteResource.orgId)
+                    )
+                );
+            const adminRoleIds = adminRoles.map((role) => role.roleId);
+
+            if (adminRoleIds.length > 0) {
+                await trx.delete(roleSiteResources).where(
+                    and(
+                        eq(roleSiteResources.siteResourceId, siteResourceId),
+                        ne(roleSiteResources.roleId, adminRoleIds[0]) // delete all but the admin role
+                    )
+                );
+            } else {
+                await trx
+                    .delete(roleSiteResources)
+                    .where(
+                        eq(roleSiteResources.siteResourceId, siteResourceId)
+                    );
+            }
+
+            if (roleIds.length > 0) {
+                await trx.insert(roleSiteResources).values(
+                    roleIds.map((roleId) => ({
+                        roleId,
+                        siteResourceId
+                    }))
+                );
+            }
+
+            logger.info(`Updated site resource ${siteResourceId}`);
        });

-        // Background: wait for removal messages to propagate, then rebuild
-        // associations for the re-created resource. Own transaction ensures
-        // execution on the primary against fully committed state.
-        (async () => {
-            await db.transaction(async (trx) => {
-                if (!updatedSiteResource) {
-                    throw new Error("No updated resource found after update");
-                }
-                if (sitesChanged) {
-                    await new Promise((resolve) => setTimeout(resolve, 750));
-                    await rebuildClientAssociationsFromSiteResource(
-                        updatedSiteResource,
-                        trx
-                    );
-                }
-                await handleMessagingForUpdatedSiteResource(
-                    existingSiteResource,
-                    updatedSiteResource,
-                    siteIds.map((siteId) => ({
-                        siteId,
-                        orgId: existingSiteResource.orgId
-                    })),
-                    trx
+        if (!updatedSiteResource) {
+            throw new Error("No updated resource found after update");
+        }
+
+        rebuildClientAssociationsFromSiteResource(updatedSiteResource).catch(
+            (e) => {
+                logger.error(
+                    `Failed to rebuild client associations for site resource ${siteResourceId}. Error: ${e}`
                );
-            });
-        })().catch((err) => {
+            }
+        );
+
+        handleMessagingForUpdatedSiteResource(
+            existingSiteResource,
+            updatedSiteResource,
+            Array.from(existingSiteIdSet).map((siteId: number) => ({
+                // we already added to the new sites above in the rebuild function so we only need to update the ones that did not change
+                siteId,
+                orgId: existingSiteResource.orgId
+            }))
+        ).catch((e) => {
            logger.error(
-                `Error rebuilding client associations for site resource ${updatedSiteResource?.siteResourceId}:`,
-                err
+                `Failed to handle messaging for updated site resource ${siteResourceId}. Error: ${e}`
            );
        });

@@ -837,9 +648,9 @@ export async function updateSiteResource(
 export async function handleMessagingForUpdatedSiteResource(
    existingSiteResource: SiteResource | undefined,
    updatedSiteResource: SiteResource,
-    sites: { siteId: number; orgId: string }[],
-    trx: Transaction
+    sites: { siteId: number; orgId: string }[]
 ) {
+    const trx = primaryDb;
    logger.debug(
        "handleMessagingForUpdatedSiteResource: existingSiteResource is: ",
        existingSiteResource
@@ -849,17 +660,14 @@ export async function handleMessagingForUpdatedSiteResource(
        updatedSiteResource
    );

-    await rebuildClientAssociationsFromSiteResource(
-        existingSiteResource || updatedSiteResource, // we want to rebuild based on the existing resource then we will apply the change to the destination below
-        trx
-    );
-
    const { sitesList, mergedAllClients, mergedAllClientIds } =
        await getClientSiteResourceAccess(
            existingSiteResource || updatedSiteResource,
            trx
        );

+    const siteIds = sites.map((site) => site.siteId);
+
    // after everything is rebuilt above we still need to update the targets and remote subnets if the destination changed
    const destinationChanged =
        existingSiteResource &&
@@ -896,12 +704,86 @@ export async function handleMessagingForUpdatedSiteResource(
        portRangesChanged ||
        destinationPortChanged
    ) {
+        const newtsForSites =
+            siteIds.length > 0
+                ? await trx
+                      .select()
+                      .from(newts)
+                      .where(inArray(newts.siteId, siteIds))
+                : [];
+        const newtBySiteId = new Map(
+            newtsForSites.map((newt) => [newt.siteId, newt])
+        );
+
+        const oldDestinationStillInUseClientSitePairs = new Set<string>();
+        if (
+            existingSiteResource?.destination &&
+            siteIds.length > 0 &&
+            mergedAllClientIds.length > 0
+        ) {
+            const oldDestinationStillInUseRows = await trx
+                .select({
+                    clientId: clientSiteResourcesAssociationsCache.clientId,
+                    siteId: siteNetworks.siteId
+                })
+                .from(siteResources)
+                .innerJoin(
+                    clientSiteResourcesAssociationsCache,
+                    eq(
+                        clientSiteResourcesAssociationsCache.siteResourceId,
+                        siteResources.siteResourceId
+                    )
+                )
+                .innerJoin(
+                    siteNetworks,
+                    eq(siteNetworks.networkId, siteResources.networkId)
+                )
+                .where(
+                    and(
+                        inArray(
+                            clientSiteResourcesAssociationsCache.clientId,
+                            mergedAllClientIds
+                        ),
+                        inArray(siteNetworks.siteId, siteIds),
+                        eq(
+                            siteResources.destination,
+                            existingSiteResource.destination
+                        ),
+                        ne(
+                            siteResources.siteResourceId,
+                            existingSiteResource.siteResourceId
+                        )
+                    )
+                );
+
+            for (const row of oldDestinationStillInUseRows) {
+                oldDestinationStillInUseClientSitePairs.add(
+                    `${row.clientId}:${row.siteId}`
+                );
+            }
+        }
+
+        const shouldUpdateTargets =
+            destinationChanged ||
+            sslChanged ||
+            portRangesChanged ||
+            fullDomainChanged ||
+            destinationPortChanged;
+        const oldTargets = shouldUpdateTargets
+            ? await generateSubnetProxyTargetV2(
+                  existingSiteResource,
+                  mergedAllClients
+              )
+            : [];
+        const newTargets = shouldUpdateTargets
+            ? await generateSubnetProxyTargetV2(
+                  updatedSiteResource,
+                  mergedAllClients
+              )
+            : [];
+
        for (const site of sites) {
-            const [newt] = await trx
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, site.siteId))
-                .limit(1);
+            const newt = newtBySiteId.get(site.siteId);

            if (!newt) {
                throw new Error(
@@ -910,22 +792,7 @@ export async function handleMessagingForUpdatedSiteResource(
            }

            // Only update targets on newt if these items change
-            if (
-                destinationChanged ||
-                sslChanged || // we need to push a new cert if the ssl changed
-                portRangesChanged ||
-                fullDomainChanged || // if the domain changes we need to update the certs and stuff
-                destinationPortChanged
-            ) {
-                const oldTargets = await generateSubnetProxyTargetV2(
-                    existingSiteResource,
-                    mergedAllClients
-                );
-                const newTargets = await generateSubnetProxyTargetV2(
-                    updatedSiteResource,
-                    mergedAllClients
-                );
-
+            if (shouldUpdateTargets) {
                await updateTargets(
                    newt.newtId,
                    {
@@ -939,49 +806,19 @@ export async function handleMessagingForUpdatedSiteResource(
            const olmJobs: Promise<void>[] = [];
            for (const client of mergedAllClients) {
                // does this client have access to another resource on this site that has the same destination still? if so we dont want to remove it from their olm yet
-                // todo: optimize this query if needed
                if (!existingSiteResource.destination) {
                    continue;
                }

-                const oldDestinationStillInUseSites = await trx
-                    .select()
-                    .from(siteResources)
-                    .innerJoin(
-                        clientSiteResourcesAssociationsCache,
-                        eq(
-                            clientSiteResourcesAssociationsCache.siteResourceId,
-                            siteResources.siteResourceId
-                        )
-                    )
-                    .innerJoin(
-                        siteNetworks,
-                        eq(siteNetworks.networkId, siteResources.networkId)
-                    )
-                    .where(
-                        and(
-                            eq(
-                                clientSiteResourcesAssociationsCache.clientId,
-                                client.clientId
-                            ),
-                            eq(siteNetworks.siteId, site.siteId),
-                            eq(
-                                siteResources.destination,
-                                existingSiteResource.destination
-                            ),
-                            ne(
-                                siteResources.siteResourceId,
-                                existingSiteResource.siteResourceId
-                            )
-                        )
-                    );
-
                const oldDestinationStillInUseByASite =
-                    oldDestinationStillInUseSites.length > 0;
+                    oldDestinationStillInUseClientSitePairs.has(
+                        `${client.clientId}:${site.siteId}`
+                    );

                // we also need to update the remote subnets on the olms for each client that has access to this site
                olmJobs.push(
                    updatePeerData(
+                        // TODO: THIS SHOULD BE UPDATED TO WORK I A BATCH
                        client.clientId,
                        site.siteId,
                        destinationChanged
@@ -33,41 +33,59 @@ const createTargetParamsSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });

-const createTargetSchema = z.strictObject({
-    siteId: z.int().positive(),
-    ip: z.string().refine(isTargetValid),
-    mode: z.enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"]).optional(),
-    method: z.string().optional().nullable(),
-    port: z.int().min(1).max(65535),
-    enabled: z.boolean().default(true),
-    hcEnabled: z.boolean().optional(),
-    hcPath: z.string().min(1).optional().nullable(),
-    hcScheme: z.string().optional().nullable(),
-    hcMode: z.string().optional().nullable(),
-    hcHostname: z.string().optional().nullable(),
-    hcPort: z.int().positive().optional().nullable(),
-    hcInterval: z.int().positive().min(1).optional().nullable(),
-    hcUnhealthyInterval: z.int().positive().min(1).optional().nullable(),
-    hcTimeout: z.int().positive().min(1).optional().nullable(),
-    hcHeaders: z
-        .array(z.strictObject({ name: z.string(), value: z.string() }))
-        .nullable()
-        .optional(),
-    hcFollowRedirects: z.boolean().optional().nullable(),
-    hcMethod: z.string().min(1).optional().nullable(),
-    hcStatus: z.int().optional().nullable(),
-    hcTlsServerName: z.string().optional().nullable(),
-    hcHealthyThreshold: z.int().positive().min(1).optional().nullable(),
-    hcUnhealthyThreshold: z.int().positive().min(1).optional().nullable(),
-    path: z.string().optional().nullable(),
-    pathMatchType: z.enum(["exact", "prefix", "regex"]).optional().nullable(),
-    rewritePath: z.string().optional().nullable(),
-    rewritePathType: z
-        .enum(["exact", "prefix", "regex", "stripPrefix"])
-        .optional()
-        .nullable(),
-    priority: z.int().min(1).max(1000).optional().nullable()
-});
+const createTargetSchema = z
+    .strictObject({
+        siteId: z.int().positive(),
+        ip: z.string().refine(isTargetValid),
+        mode: z.enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"]).optional(),
+        method: z.string().optional().nullable(),
+        port: z.int().min(1).max(65535),
+        enabled: z.boolean().default(true),
+        hcEnabled: z.boolean().optional(),
+        hcPath: z.string().min(1).optional().nullable(),
+        hcScheme: z.string().optional().nullable(),
+        hcMode: z.string().optional().nullable(),
+        hcHostname: z.string().optional().nullable(),
+        hcPort: z.int().positive().optional().nullable(),
+        hcInterval: z.int().positive().min(1).optional().nullable(),
+        hcUnhealthyInterval: z.int().positive().min(1).optional().nullable(),
+        hcTimeout: z.int().positive().min(1).optional().nullable(),
+        hcHeaders: z
+            .array(z.strictObject({ name: z.string(), value: z.string() }))
+            .nullable()
+            .optional(),
+        hcFollowRedirects: z.boolean().optional().nullable(),
+        hcMethod: z.string().min(1).optional().nullable(),
+        hcStatus: z.int().optional().nullable(),
+        hcTlsServerName: z.string().optional().nullable(),
+        hcHealthyThreshold: z.int().positive().min(1).optional().nullable(),
+        hcUnhealthyThreshold: z.int().positive().min(1).optional().nullable(),
+        path: z.string().optional().nullable(),
+        pathMatchType: z
+            .enum(["exact", "prefix", "regex"])
+            .optional()
+            .nullable(),
+        rewritePath: z.string().optional().nullable(),
+        rewritePathType: z
+            .enum(["exact", "prefix", "regex", "stripPrefix"])
+            .optional()
+            .nullable(),
+        priority: z.int().min(1).max(1000).optional().nullable()
+    })
+    .superRefine((data, ctx) => {
+        const hcHostnameMissing =
+            data.hcHostname === undefined ||
+            data.hcHostname === null ||
+            data.hcHostname.trim().length === 0;
+
+        if (data.hcEnabled === true && hcHostnameMissing) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["hcHostname"],
+                message: "hcHostname is required when hcEnabled is true"
+            });
+        }
+    });

 export type CreateTargetResponse = Target & TargetHealthCheck;

@@ -14,7 +14,7 @@ const listTargetsParamsSchema = z.strictObject({
    resourceId: z.coerce.number().int().positive()
 });

-const listTargetsSchema = z.object({
+const listTargetsSchema = z.strictObject({
    limit: z
        .string()
        .optional()
@@ -188,6 +188,38 @@ export async function updateTarget(
            );
        }

+        const [existingHc] = await db
+            .select()
+            .from(targetHealthCheck)
+            .where(eq(targetHealthCheck.targetId, targetId))
+            .limit(1);
+
+        if (!existingHc) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Health check for target with ID ${targetId} not found`
+                )
+            );
+        }
+
+        const nextHcEnabled = parsedBody.data.hcEnabled ?? existingHc.hcEnabled;
+        const nextHcHostname =
+            parsedBody.data.hcHostname !== undefined
+                ? parsedBody.data.hcHostname
+                : existingHc.hcHostname;
+        const hcHostnameMissing =
+            !nextHcHostname || nextHcHostname.trim().length === 0;
+
+        if (nextHcEnabled && hcHostnameMissing) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "hcHostname is required when hcEnabled is true"
+                )
+            );
+        }
+
        const pathMatchTypeRemoved = parsedBody.data.pathMatchType === null;
        const nextMode =
            parsedBody.data.mode === null ? undefined : parsedBody.data.mode;
@@ -218,21 +250,6 @@ export async function updateTarget(
                .where(eq(targets.targetId, targetId))
                .returning();

-            const [existingHc] = await trx
-                .select()
-                .from(targetHealthCheck)
-                .where(eq(targetHealthCheck.targetId, targetId))
-                .limit(1);
-
-            if (!existingHc) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Health check for target with ID ${targetId} not found`
-                    )
-                );
-            }
-
            let hcHeaders = null;
            if (parsedBody.data.hcHeaders) {
                hcHeaders = JSON.stringify(parsedBody.data.hcHeaders);
@@ -202,13 +202,11 @@ export async function acceptInvite(
            );
        });

-        calculateUserClientsForOrgs(existingUser[0].userId, primaryDb).catch(
-            (e) => {
-                logger.error(
-                    `Failed to calculate user clients after accepting invite for user ${existingUser[0].userId}: ${e}`
-                );
-            }
-        );
+        calculateUserClientsForOrgs(existingUser[0].userId).catch((e) => {
+            logger.error(
+                `Failed to calculate user clients after accepting invite for user ${existingUser[0].userId}: ${e}`
+            );
+        });

        return response<AcceptInviteResponse>(res, {
            data: { accepted: true, orgId: existingInvite.orgId },
@@ -159,13 +159,11 @@ export async function addUserRoleLegacy(
        });

        for (const orgClient of orgClientsToRebuild) {
-            rebuildClientAssociationsFromClient(orgClient, primaryDb).catch(
-                (e) => {
-                    logger.error(
-                        `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
-                    );
-                }
-            );
+            rebuildClientAssociationsFromClient(orgClient).catch((e) => {
+                logger.error(
+                    `Failed to rebuild client associations for client ${orgClient.clientId} after adding role: ${e}`
+                );
+            });
        }

        return response(res, {
@@ -55,7 +55,7 @@ export async function adminRemoveUser(
            await trx.delete(users).where(eq(users.userId, userId));
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            logger.error(
                `Failed to calculate user clients after removing user ${userId}: ${e}`
            );
@@ -56,7 +56,6 @@ const bodySchema = z
 export type CreateOrgUserResponse = {};
 const CreateOrgUserResponseDataSchema = z.object({});

-
 registry.registerPath({
    method: "put",
    path: "/org/{orgId}/user",
@@ -77,7 +76,9 @@ registry.registerPath({
            description: "Successful response",
            content: {
                "application/json": {
-                    schema: createApiResponseSchema(CreateOrgUserResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        CreateOrgUserResponseDataSchema
+                    )
                }
            }
        }
@@ -326,13 +327,11 @@ export async function createOrgUser(
            });

            if (userIdForClients) {
-                calculateUserClientsForOrgs(userIdForClients, primaryDb).catch(
-                    (e) => {
-                        logger.error(
-                            `Failed to calculate user clients after creating org user: ${e}`
-                        );
-                    }
-                );
+                calculateUserClientsForOrgs(userIdForClients).catch((e) => {
+                    logger.error(
+                        `Failed to calculate user clients after creating org user: ${e}`
+                    );
+                });
            }
        } else {
            return next(
@@ -109,7 +109,7 @@ export async function removeUserOrg(
            await removeUserFromOrg(org, userId, trx);
        });

-        calculateUserClientsForOrgs(userId, primaryDb).catch((e) => {
+        calculateUserClientsForOrgs(userId).catch((e) => {
            logger.error(
                `Failed to calculate user clients after removing user ${userId} from org ${orgId}: ${e}`
            );
@@ -580,6 +580,7 @@ export function PrivateResourceForm({
    });

    const mode = form.watch("mode");
+    const aliasValue = form.watch("alias");
    const httpConfigSubdomain = form.watch("httpConfigSubdomain");
    const httpConfigDomainId = form.watch("httpConfigDomainId");
    const httpConfigFullDomain = form.watch("httpConfigFullDomain");
@@ -595,6 +596,9 @@ export function PrivateResourceForm({
        !isNative &&
        pamMode === "push" &&
        authDaemonMode === "remote";
+    const aliasEndsWithLocal =
+        typeof aliasValue === "string" &&
+        aliasValue.trim().toLowerCase().endsWith(".local");
    const hasInitialized = useRef(false);
    const previousResourceId = useRef<number | null>(null);
    const initialSitesRef = useRef(initialSites);
@@ -1209,6 +1213,13 @@ export function PrivateResourceForm({
                                                            }
                                                        />
                                                    </FormControl>
+                                                    {aliasEndsWithLocal && (
+                                                        <p className="text-xs text-amber-700/80 mt-1">
+                                                            {t(
+                                                                "internalResourceAliasLocalWarning"
+                                                            )}
+                                                        </p>
+                                                    )}
                                                    <FormMessage />
                                                </FormItem>
                                            )}
@@ -1737,6 +1748,7 @@ export function PrivateResourceForm({
                                                        field.value ?? []
                                                    }
                                                    orgId={orgId}
+                                                    restrictAdminRole
                                                    onSelectRoles={(
                                                        newUsers
                                                    ) => {
Author	SHA1	Message	Date
Owen	bc63747efe	Refactor out transactions and always call rebuild on update	2026-06-23 18:12:51 -04:00
Owen	2a8ceeec1b	Restrict admin role	2026-06-23 17:45:42 -04:00
Owen	91ef0d0153	Show warning about the .local aliases	2026-06-23 17:44:18 -04:00
Owen	b8101402cd	Merge branch 'main' into dev	2026-06-23 17:14:53 -04:00
Owen	7731849a2f	Standardize db rebuildClientAssociationsFromClient	2026-06-23 17:14:40 -04:00
Owen	c11d24e10a	Standardize db rebuildClientAssociationsFromClient	2026-06-23 17:14:40 -04:00
Owen	a9b7cce49b	Improve efficiency of calculateUserClientsForOrgs	2026-06-23 17:14:40 -04:00
Owen	d78223b94f	Fix import to be private	2026-06-23 17:14:40 -04:00
Owen Schwartz	963e9da7dd	Merge pull request #3213 from ivenos/rename-to-compose-yaml Rename docker-compose.yml to compose.yaml	2026-06-23 12:03:56 -07:00
Owen Schwartz	2cbc88fa05	Merge pull request #3326 from fosrl/dependabot/npm_and_yarn/js-yaml-4.2.0 Bump js-yaml from 4.1.1 to 4.2.0	2026-06-23 12:02:49 -07:00
Owen Schwartz	65bad456cb	Merge pull request #3327 from fosrl/crowdin_dev New Crowdin updates	2026-06-23 12:02:11 -07:00
Owen	f48a4f7bc0	Enforce strick query params Fixes #3313	2026-06-23 12:22:47 -04:00
Owen	ce3c2f7583	Fix #3314	2026-06-23 12:05:47 -04:00
Owen Schwartz	babd90ae71	New translations en-us.json (Norwegian Bokmal) [ci skip]	2026-06-22 15:22:46 -07:00
Owen Schwartz	f7050ef989	New translations en-us.json (Chinese Simplified) [ci skip]	2026-06-22 15:22:44 -07:00
Owen Schwartz	b2778a2c49	New translations en-us.json (Turkish) [ci skip]	2026-06-22 15:22:42 -07:00
Owen Schwartz	096940a152	New translations en-us.json (Russian) [ci skip]	2026-06-22 15:22:40 -07:00
Owen Schwartz	73eb07de71	New translations en-us.json (Portuguese) [ci skip]	2026-06-22 15:22:38 -07:00
Owen Schwartz	74ef844e27	New translations en-us.json (Polish) [ci skip]	2026-06-22 15:22:36 -07:00
Owen Schwartz	c58968536d	New translations en-us.json (Dutch) [ci skip]	2026-06-22 15:22:34 -07:00
Owen Schwartz	228efacfe0	New translations en-us.json (Korean) [ci skip]	2026-06-22 15:22:32 -07:00
Owen Schwartz	1262030abb	New translations en-us.json (Italian) [ci skip]	2026-06-22 15:22:30 -07:00
Owen Schwartz	b07fe6d18b	New translations en-us.json (German) [ci skip]	2026-06-22 15:22:28 -07:00
Owen Schwartz	63c3ee623b	New translations en-us.json (Czech) [ci skip]	2026-06-22 15:22:26 -07:00
Owen Schwartz	18ec6c8d92	New translations en-us.json (Bulgarian) [ci skip]	2026-06-22 15:22:24 -07:00
Owen Schwartz	d8acccbde4	New translations en-us.json (Spanish) [ci skip]	2026-06-22 15:22:22 -07:00
Owen Schwartz	37eaf34e4d	New translations en-us.json (French) [ci skip]	2026-06-22 15:22:20 -07:00
dependabot[bot]	cfb63f9742	Bump js-yaml from 4.1.1 to 4.2.0 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.2.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-22 21:04:39 +00:00
ivenos	89f3f3c8cd	Rename docker-compose.yml to compose.yaml	2026-06-04 10:01:35 +02:00