add resources overview column to pending sites table

z#

messages/en-US.json

@@ -449,8 +449,14 @@
     "provisioningManage": "Provisioning",
     "provisioningDescription": "Manage provisioning keys and review pending sites awaiting approval.",
     "pendingSites": "Pending Sites",
-    "siteApproveSuccess": "Site approved successfully",
+    "siteApproveSuccess": "Site and associated resources approved successfully",
     "siteApproveError": "Error approving site",
+    "siteReject": "Reject Site",
+    "siteQuestionReject": "Are you sure you want to reject this site?",
+    "siteMessageReject": "This will permanently delete the site and any associated resources that are still pending.",
+    "siteConfirmReject": "Confirm Reject Site",
+    "siteRejectSuccess": "Site rejected successfully",
+    "siteRejectError": "Error rejecting site",
     "provisioningKeys": "Provisioning Keys",
     "searchProvisioningKeys": "Search provisioning keys...",
     "provisioningKeysAdd": "Generate Provisioning Key",
@@ -1420,6 +1426,8 @@
     "setupTokenDescription": "Enter the setup token from the server console.",
     "setupTokenRequired": "Setup token is required",
     "actionUpdateSite": "Update Site",
+    "actionApproveSite": "Approve Site",
+    "actionRejectSite": "Reject Site",
     "actionResetSiteBandwidth": "Reset Organization Bandwidth",
     "actionListSiteRoles": "List Allowed Site Roles",
     "actionCreateResource": "Create Resource",

server/auth/actions.ts

@@ -21,6 +21,7 @@ export enum ActionsEnum {
     getSite = "getSite",
     listSites = "listSites",
     updateSite = "updateSite",
+    updateSiteApprovals = "updateSiteApprovals",
     restartSite = "restartSite",
     resetSiteBandwidth = "resetSiteBandwidth",
     reGenerateSecret = "reGenerateSecret",

server/db/pg/schema/schema.ts

@@ -200,7 +200,10 @@ export const resources = pgTable(
         authDaemonMode: varchar("authDaemonMode", { length: 32 })
             .$type<"site" | "remote" | "native">()
             .default("site"),
-        authDaemonPort: integer("authDaemonPort").default(22123)
+        authDaemonPort: integer("authDaemonPort").default(22123),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
     },
     (t) => [
         index("idx_resources_fulldomain")
@@ -451,7 +454,10 @@ export const siteResources = pgTable(
             onDelete: "set null"
         }),
         subdomain: varchar("subdomain"),
-        fullDomain: varchar("fullDomain")
+        fullDomain: varchar("fullDomain"),
+        status: varchar("status")
+            .$type<"pending" | "approved">()
+            .default("approved")
     },
     (t) => [index("idx_siteresources_orgid_niceid").on(t.orgId, t.niceId)]
 );

server/db/sqlite/schema/schema.ts

@@ -209,7 +209,8 @@ export const resources = sqliteTable("resources", {
     authDaemonMode: text("authDaemonMode")
         .$type<"site" | "remote" | "native">()
         .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    authDaemonPort: integer("authDaemonPort").default(22123),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const labels = sqliteTable("labels", {
@@ -447,7 +448,8 @@ export const siteResources = sqliteTable("siteResources", {
         onDelete: "set null"
     }),
     subdomain: text("subdomain"),
-    fullDomain: text("fullDomain")
+    fullDomain: text("fullDomain"),
+    status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const networks = sqliteTable("networks", {

server/integrationApiServer.ts

@@ -12,7 +12,7 @@ import { logIncomingMiddleware } from "./middlewares/logIncoming";
 import helmet from "helmet";
 import swaggerUi from "swagger-ui-express";
 import { OpenApiGeneratorV3 } from "@asteasolutions/zod-to-openapi";
-import { registry, openApiTags } from "./openApi";
+import { registry } from "./openApi";
 import fs from "fs";
 import path from "path";
 import { APP_PATH } from "./lib/consts";
@@ -181,8 +181,7 @@ function getOpenApiDocumentation() {
             version: "v1",
             title: "Pangolin Integration API"
         },
-        servers: [{ url: "/v1" }],
+        servers: [{ url: "/v1" }]
-        tags: openApiTags
     });
 
     if (!process.env.DISABLE_GEN_OPENAPI) {

server/lib/blueprints/applyBlueprint.ts

@@ -34,12 +34,6 @@ import {
     rebuildClientAssociationsFromSiteResource,
     waitForSiteResourceRebuildIdle
 } from "../rebuildClientAssociations";
-import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
-import { LimitId } from "../billing";
-import { usageService } from "../billing/usageService";
 
 type ApplyBlueprintArgs = {
     orgId: string;

server/lib/blueprints/privateResources.ts

@@ -26,9 +26,6 @@ import { createCertificate } from "#dynamic/routers/certificates/createCertifica
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "../billing/tierMatrix";
 import { build } from "@server/build";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import next from "next";
 import { LimitId } from "../billing";
 import { usageService } from "../billing/usageService";
 
@@ -201,17 +198,19 @@ export async function updatePrivateResources(
             }
         }
 
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
         if (siteId && allSites.length === 0) {
             // only add if there are not provided sites
             // Use the provided siteId directly, but verify it belongs to the org
             const [siteSingle] = await trx
-                .select({ siteId: sites.siteId })
+                .select({ siteId: sites.siteId, status: sites.status })
                 .from(sites)
                 .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
                 .limit(1);
             if (siteSingle) {
                 allSites.push(siteSingle);
             }
+            resourceStatusFromSite = siteSingle.status ?? "approved";
         }
 
         if (allSites.length === 0) {
@@ -220,6 +219,13 @@ export async function updatePrivateResources(
             );
         }
 
+        const resourceEnabled =
+            resourceData.enabled == undefined || resourceData.enabled == null
+                ? true
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         if (existingResource) {
             let domainInfo:
                 | { subdomain: string | null; domainId: string }
@@ -243,8 +249,7 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
+                    enabled: resourceEnabled,
-                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     disableIcmp:
                         resourceData["disable-icmp"] ||
@@ -263,7 +268,8 @@ export async function updatePrivateResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .where(
                     eq(
@@ -496,8 +502,7 @@ export async function updatePrivateResources(
                     scheme: resourceData.scheme,
                     destination: resourceData.destination,
                     destinationPort: resourceData["destination-port"],
-                    enabled: true, // hardcoded for now
+                    enabled: resourceEnabled,
-                    // enabled: resourceData.enabled ?? true,
                     alias: resourceData.alias || null,
                     aliasAddress: aliasAddress,
                     disableIcmp:
@@ -517,7 +522,8 @@ export async function updatePrivateResources(
                     pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
                     authDaemonMode:
                         resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
+                    status: resourceStatusFromSite
                 })
                 .returning();
 

server/lib/blueprints/publicResources.ts

@@ -25,6 +25,7 @@ import {
     rolePolicies,
     roleResources,
     roles,
+    Site,
     sites,
     Target,
     TargetHealthCheck,
@@ -74,19 +75,40 @@ export async function updatePublicResources(
     )) {
         const targetsToUpdate: Target[] = [];
         const healthchecksToUpdate: TargetHealthCheck[] = [];
+
         let resource: Resource;
+        let resourceStatusFromSite: "approved" | "pending" = "approved";
+        let providedSite: Partial<Site> | undefined;
+        if (siteId) {
+            // Use the provided siteId directly, but verify it belongs to the org
+            [providedSite] = await trx
+                .select({
+                    siteId: sites.siteId,
+                    type: sites.type,
+                    status: sites.status
+                })
+                .from(sites)
+                .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+                .limit(1);
+
+            resourceStatusFromSite = providedSite?.status ?? "approved";
+        }
 
         async function createTarget( // reusable function to create a target
             resourceId: number,
             targetData: TargetData
         ) {
             const targetSiteId = targetData.site;
-            let site;
+            let site: Partial<Site> | undefined;
 
             if (targetSiteId) {
                 // Look up site by niceId
                 [site] = await trx
-                    .select({ siteId: sites.siteId, type: sites.type })
+                    .select({
+                        siteId: sites.siteId,
+                        type: sites.type,
+                        status: sites.status
+                    })
                     .from(sites)
                     .where(
                         and(
@@ -95,15 +117,9 @@ export async function updatePublicResources(
                         )
                     )
                     .limit(1);
-            } else if (siteId) {
+            } else if (siteId && providedSite) {
                 // Use the provided siteId directly, but verify it belongs to the org
-                [site] = await trx
+                site = providedSite;
-                    .select({ siteId: sites.siteId, type: sites.type })
-                    .from(sites)
-                    .where(
-                        and(eq(sites.siteId, siteId), eq(sites.orgId, orgId))
-                    )
-                    .limit(1);
             } else {
                 throw new Error(`Target site is required`);
             }
@@ -139,7 +155,7 @@ export async function updatePublicResources(
                 .insert(targets)
                 .values({
                     resourceId: resourceId,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     ip: targetData.hostname,
                     mode: resourceData.mode as Target["mode"],
                     method: targetData.method,
@@ -172,7 +188,7 @@ export async function updatePublicResources(
                 .insert(targetHealthCheck)
                 .values({
                     name: `${targetData.hostname}:${targetData.port}`,
-                    siteId: site.siteId,
+                    siteId: site.siteId!,
                     targetId: newTarget.targetId,
                     orgId: orgId,
                     hcEnabled: healthcheckData?.enabled || false,
@@ -230,7 +246,10 @@ export async function updatePublicResources(
         const resourceEnabled =
             resourceData.enabled == undefined || resourceData.enabled == null
                 ? true
-                : resourceData.enabled;
+                : resourceStatusFromSite === "pending"
+                  ? false
+                  : resourceData.enabled;
+
         const resourceSsl =
             resourceData.ssl == undefined || resourceData.ssl == null
                 ? true
@@ -406,7 +425,8 @@ export async function updatePublicResources(
                                     ? (resourceData["proxy-protocol-version"] ??
                                       1)
                                     : 1,
-                            resourcePolicyId: sharedPolicy.resourcePolicyId
+                            resourcePolicyId: sharedPolicy.resourcePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -590,7 +610,8 @@ export async function updatePublicResources(
                             authDaemonPort:
                                 resourceData["auth-daemon"]?.port || 22123,
                             resourcePolicyId: null,
-                            defaultResourcePolicyId: inlinePolicyId
+                            defaultResourcePolicyId: inlinePolicyId,
+                            status: resourceStatusFromSite
                         })
                         .where(
                             eq(
@@ -1131,6 +1152,7 @@ export async function updatePublicResources(
                 .values({
                     orgId,
                     niceId: resourceNiceId,
+                    status: resourceStatusFromSite,
                     name: resourceData.name || "Unnamed Resource",
                     mode: resourceData.mode,
                     proxyPort: ["http", "ssh", "rdp", "vnc"].includes(

server/lib/blueprints/types.ts

@@ -470,7 +470,7 @@ export const PrivateResourceSchema = z
         // proxyPort: z.int().positive().optional(),
         "destination-port": z.int().positive().optional(),
         destination: z.string().min(1).optional(),
-        // enabled: z.boolean().default(true),
+        enabled: z.boolean().default(true),
         "tcp-ports": portRangeStringSchema.optional().default("*"),
         "udp-ports": portRangeStringSchema.optional().default("*"),
         "disable-icmp": z.boolean().optional().default(false),

server/lib/deleteResource.ts

@@ -14,8 +14,6 @@ import {
 } from "@server/db";
 import logger from "@server/logger";
 import { removeTargets } from "@server/routers/newt/targets";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
 
 export type DeleteResourceResult = {
     deletedResource: Resource;
@@ -117,10 +115,10 @@ export async function runResourceDeleteSideEffects(
             .limit(1);
 
         if (!site) {
-            throw createHttpError(
+            logger.debug(
-                HttpCode.NOT_FOUND,
+                `Site with ID ${target.siteId} not found during resource delete side effects; skipping target removal`
-                `Site with ID ${target.siteId} not found`
             );
+            continue;
         }
 
         if (site.pubKey && site.type === "newt") {

server/lib/deleteSiteAssociatedResources.ts

@@ -1,6 +1,7 @@
-import { and, eq, sql } from "drizzle-orm";
+import { and, eq, inArray, sql } from "drizzle-orm";
 import {
     db,
+    resources,
     siteNetworks,
     siteResources,
     targets,
@@ -97,6 +98,64 @@ export function exceedsSiteAssociatedResourceDeleteLimit(
     return resourceCount > MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE;
 }
 
+export async function getPendingResourceIdsForSite(
+    siteId: number,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const resourceIds = await getResourceIdsForSite(siteId, trx);
+    if (resourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ resourceId: resources.resourceId })
+        .from(resources)
+        .where(
+            and(
+                inArray(resources.resourceId, resourceIds),
+                eq(resources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.resourceId);
+}
+
+export async function getPendingSiteResourceIdsForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number[]> {
+    const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
+    if (siteResourceIds.length === 0) {
+        return [];
+    }
+
+    const rows = await trx
+        .select({ siteResourceId: siteResources.siteResourceId })
+        .from(siteResources)
+        .where(
+            and(
+                inArray(siteResources.siteResourceId, siteResourceIds),
+                eq(siteResources.status, "pending")
+            )
+        );
+
+    return rows.map((row) => row.siteResourceId);
+}
+
+export async function getPendingAssociatedResourceCountForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<number> {
+    const [resourceIds, siteResourceIds] = await Promise.all([
+        getPendingResourceIdsForSite(siteId, trx),
+        getPendingSiteResourceIdsForSite(siteId, orgId, trx)
+    ]);
+
+    return resourceIds.length + siteResourceIds.length;
+}
+
 export async function deleteAssociatedResourcesForSite(
     siteId: number,
     orgId: string,
@@ -105,12 +164,32 @@ export async function deleteAssociatedResourcesForSite(
     const resourceIds = await getResourceIdsForSite(siteId, trx);
     const siteResourceIds = await getSiteResourceIdsForSite(siteId, orgId, trx);
 
-    const [resources, siteResourcesDeleted] = await Promise.all([
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
         performDeleteResources(resourceIds, trx),
         performDeleteSiteResources(siteResourceIds, trx)
     ]);
 
-    return { resources, siteResources: siteResourcesDeleted };
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
+}
+
+export async function deletePendingAssociatedResourcesForSite(
+    siteId: number,
+    orgId: string,
+    trx: Transaction | typeof db = db
+): Promise<DeleteSiteAssociatedResourcesSideEffects> {
+    const resourceIds = await getPendingResourceIdsForSite(siteId, trx);
+    const siteResourceIds = await getPendingSiteResourceIdsForSite(
+        siteId,
+        orgId,
+        trx
+    );
+
+    const [deletedResources, siteResourcesDeleted] = await Promise.all([
+        performDeleteResources(resourceIds, trx),
+        performDeleteSiteResources(siteResourceIds, trx)
+    ]);
+
+    return { resources: deletedResources, siteResources: siteResourcesDeleted };
 }
 
 export async function runDeleteSiteAssociatedResourcesSideEffects(

server/lib/ip.ts

@@ -496,6 +496,7 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
+            if (!sr.enabled) return false;
             if (!sr.destination) return false;
 
             if (sr.mode === "cidr") {
@@ -530,6 +531,7 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
     return allSiteResources
         .filter(
             (sr) =>
+                sr.enabled &&
                 sr.aliasAddress &&
                 ((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
                     (sr.fullDomain && sr.mode == "http"))
@@ -662,6 +664,13 @@ export async function generateSubnetProxyTargetV2(
         subnet: string | null;
     }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
+    if (!siteResource.enabled) {
+        logger.debug(
+            `Site resource ${siteResource.siteResourceId} is disabled, skipping target generation.`
+        );
+        return;
+    }
+
     if (clients.length === 0) {
         logger.debug(
             `No clients have access to site resource ${siteResource.siteResourceId}, skipping target generation.`

server/lib/rebuildClientAssociations.ts

@@ -1561,9 +1561,19 @@ export async function handleMessagingForUpdatedSiteResource(
                 updatedSiteResource.udpPortRangeString ||
             existingSiteResource.disableIcmp !==
                 updatedSiteResource.disableIcmp);
+    // Toggling enabled on/off doesn't change any of the fields above, but it
+    // does change whether targets/peer data should exist at all, so it needs
+    // to drive the same old->new diff machinery: going enabled->disabled
+    // diffs "real data" against "nothing" (a remove), and disabled->enabled
+    // diffs "nothing" against "real data" (an add). generateSubnetProxyTargetV2/
+    // generateRemoteSubnets/generateAliasConfig already return nothing for a
+    // disabled resource, so no other changes are needed here.
+    const enabledChanged =
+        existingSiteResource &&
+        existingSiteResource.enabled !== updatedSiteResource.enabled;
 
     logger.debug(
-        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)}`
+        `handleMessagingForUpdatedSiteResource: change flags destinationChanged=${Boolean(destinationChanged)} destinationPortChanged=${Boolean(destinationPortChanged)} aliasChanged=${Boolean(aliasChanged)} fullDomainChanged=${Boolean(fullDomainChanged)} sslChanged=${Boolean(sslChanged)} portRangesChanged=${Boolean(portRangesChanged)} enabledChanged=${Boolean(enabledChanged)}`
     );
 
     // if the existingSiteResource is undefined (new resource) we don't need to do anything here, the rebuild above handled it all
@@ -1574,14 +1584,16 @@ export async function handleMessagingForUpdatedSiteResource(
         fullDomainChanged ||
         sslChanged ||
         portRangesChanged ||
-        destinationPortChanged
+        destinationPortChanged ||
+        enabledChanged
     ) {
         const shouldUpdateTargets =
             destinationChanged ||
             sslChanged ||
             portRangesChanged ||
             fullDomainChanged ||
-            destinationPortChanged;
+            destinationPortChanged ||
+            enabledChanged;
 
         logger.debug(
             `handleMessagingForUpdatedSiteResource: entering unchanged-site update path shouldUpdateTargets=${shouldUpdateTargets}`
@@ -1657,20 +1669,22 @@ export async function handleMessagingForUpdatedSiteResource(
                 peerDataUpdateBatch.push({
                     clientId: client.clientId,
                     siteId,
-                    remoteSubnets: destinationChanged
+                    remoteSubnets:
-                        ? {
+                        destinationChanged || enabledChanged
-                              oldRemoteSubnets: !oldDestinationStillInUseBySite
+                            ? {
-                                  ? generateRemoteSubnets([
+                                  oldRemoteSubnets:
-                                        existingSiteResource
+                                      !oldDestinationStillInUseBySite
-                                    ])
+                                          ? generateRemoteSubnets([
-                                  : [],
+                                                existingSiteResource
-                              newRemoteSubnets: generateRemoteSubnets([
+                                            ])
-                                  updatedSiteResource
+                                          : [],
-                              ])
+                                  newRemoteSubnets: generateRemoteSubnets([
-                          }
+                                      updatedSiteResource
-                        : undefined,
+                                  ])
+                              }
+                            : undefined,
                     aliases:
-                        aliasChanged || fullDomainChanged // the full domain is sent down as an alias
+                        aliasChanged || fullDomainChanged || enabledChanged // the full domain is sent down as an alias
                             ? {
                                   oldAliases: generateAliasConfig([
                                       existingSiteResource

server/openApi.ts

@@ -4,33 +4,22 @@ export const registry = new OpenAPIRegistry();
 
 export enum OpenAPITags {
     Site = "Site",
-    PublicResource = "Public Resource",
-    Target = "Resource Target",
-    PrivateResource = "Private Resource",
-    Client = "Client",
     Org = "Organization",
-    Domain = "Domain",
+    PublicResource = "Public Resource",
-    PublicResourcePolicy = "Public Resource Policy",
+    PrivateResource = "Private Resource",
+    Policy = "Policy",
     Role = "Role",
     User = "User",
-    Rule = "Rule",
     Invitation = "User Invitation",
+    Target = "Resource Target",
+    Rule = "Rule",
     AccessToken = "Access Token",
     GlobalIdp = "Identity Provider (Global)",
     OrgIdp = "Identity Provider (Organization Only)",
+    Client = "Client",
     ApiKey = "API Key",
+    Domain = "Domain",
     Blueprint = "Blueprint",
     Ssh = "SSH",
-    Logs = "Logs",
+    Logs = "Logs"
-    EventStreamingDestination = "Event Streaming Destination",
-    AlertRule = "Alert Rule",
-    HealthCheck = "Health Check",
-    PublicResourcePolicyLegacy = "Public Resource Policy (Legacy)",
-    PublicResourceLegacy = "Public Resource (Legacy)",
-    PrivateResourceLegacy = "Private Resource (Legacy)"
 }
-
-// Order here controls the order tags are displayed in Swagger UI
-export const openApiTags = Object.values(OpenAPITags).map((name) => ({
-    name
-}));

server/private/routers/alertRule/createAlertRule.ts

@@ -191,7 +191,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/alert-rule",
     description: "Create an alert rule for a specific organization.",
-    tags: [OpenAPITags.AlertRule],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/alertRule/deleteAlertRule.ts

@@ -34,7 +34,7 @@ registry.registerPath({
     method: "delete",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Delete an alert rule for a specific organization.",
-    tags: [OpenAPITags.AlertRule],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema
     },

server/private/routers/alertRule/getAlertRule.ts

@@ -48,7 +48,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Get a specific alert rule for an organization.",
-    tags: [OpenAPITags.AlertRule],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema
     },

server/private/routers/alertRule/listAlertRules.ts

@@ -90,7 +90,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/alert-rules",
     description: "List all alert rules for a specific organization.",
-    tags: [OpenAPITags.AlertRule],
+    tags: [OpenAPITags.Org],
     request: {
         query: querySchema,
         params: paramsSchema

server/private/routers/alertRule/updateAlertRule.ts

@@ -158,7 +158,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
     description: "Update an alert rule for a specific organization.",
-    tags: [OpenAPITags.AlertRule],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/eventStreamingDestination/createEventStreamingDestination.ts

@@ -52,7 +52,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/event-streaming-destination",
     description: "Create an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.EventStreamingDestination],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts

@@ -35,7 +35,7 @@ registry.registerPath({
     path: "/org/{orgId}/event-streaming-destination/{destinationId}",
     description:
         "Delete an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.EventStreamingDestination],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema
     },

server/private/routers/eventStreamingDestination/listEventStreamingDestinations.ts

@@ -109,7 +109,7 @@ registry.registerPath({
     path: "/org/{orgId}/event-streaming-destination",
     description:
         "List all event streaming destinations for a specific organization.",
-    tags: [OpenAPITags.EventStreamingDestination],
+    tags: [OpenAPITags.Org],
     request: {
         query: querySchema,
         params: paramsSchema

server/private/routers/eventStreamingDestination/updateEventStreamingDestination.ts

@@ -55,7 +55,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/event-streaming-destination/{destinationId}",
     description: "Update an event streaming destination for a specific organization.",
-    tags: [OpenAPITags.EventStreamingDestination],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/healthChecks/createHealthCheck.ts

@@ -75,7 +75,7 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/health-check",
     description: "Create a health check for a specific organization.",
-    tags: [OpenAPITags.HealthCheck],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/healthChecks/deleteHealthCheck.ts

@@ -37,7 +37,7 @@ registry.registerPath({
     method: "delete",
     path: "/org/{orgId}/health-check/{healthCheckId}",
     description: "Delete a health check for a specific organization.",
-    tags: [OpenAPITags.HealthCheck],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema
     },

server/private/routers/healthChecks/listHealthChecks.ts

@@ -63,7 +63,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/health-checks",
     description: "List health checks for an organization.",
-    tags: [OpenAPITags.HealthCheck],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         query: querySchema

server/private/routers/healthChecks/updateHealthCheck.ts

@@ -109,7 +109,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/health-check/{healthCheckId}",
     description: "Update a health check for a specific organization.",
-    tags: [OpenAPITags.HealthCheck],
+    tags: [OpenAPITags.Org],
     request: {
         params: paramsSchema,
         body: {

server/private/routers/integration.ts

@@ -16,10 +16,6 @@ import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
-import * as policy from "#private/routers/policy";
-import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
-import * as alertRule from "#private/routers/alertRule";
-import * as healthChecks from "#private/routers/healthChecks";
 
 import {
     verifyApiKeyHasAction,
@@ -28,7 +24,6 @@ import {
     verifyApiKeyIdpAccess,
     verifyApiKeyRoleAccess,
     verifyApiKeyUserAccess,
-    verifyApiKeyResourcePolicyAccess,
     verifyLimits
 } from "@server/middlewares";
 import * as user from "#private/routers/user";
@@ -220,147 +215,3 @@ authenticated.delete(
     logActionAudit(ActionsEnum.removeUserRole),
     user.removeUserRole
 );
-
-authenticated.get(
-    ["/org/:orgId/resource-policies", "/org/:orgId/public-resource-policies"],
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.listResourcePolicies),
-    logActionAudit(ActionsEnum.listResourcePolicies),
-    policy.listResourcePolicies
-);
-
-authenticated.post(
-    ["/org/:orgId/resource-policy", "/org/:orgId/public-resource-policy"],
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createResourcePolicy),
-    logActionAudit(ActionsEnum.createResourcePolicy),
-    policy.createResourcePolicy
-);
-
-authenticated.delete(
-    ["/resource-policy/:resourcePolicyId", "/public-resource-policy/:resourcePolicyId"],
-    verifyApiKeyResourcePolicyAccess,
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.deleteResourcePolicy),
-    logActionAudit(ActionsEnum.deleteResourcePolicy),
-    policy.deleteResourcePolicy
-);
-
-authenticated.put(
-    "/org/:orgId/event-streaming-destination",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createEventStreamingDestination),
-    logActionAudit(ActionsEnum.createEventStreamingDestination),
-    eventStreamingDestination.createEventStreamingDestination
-);
-
-authenticated.post(
-    "/org/:orgId/event-streaming-destination/:destinationId",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.updateEventStreamingDestination),
-    logActionAudit(ActionsEnum.updateEventStreamingDestination),
-    eventStreamingDestination.updateEventStreamingDestination
-);
-
-authenticated.delete(
-    "/org/:orgId/event-streaming-destination/:destinationId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteEventStreamingDestination),
-    logActionAudit(ActionsEnum.deleteEventStreamingDestination),
-    eventStreamingDestination.deleteEventStreamingDestination
-);
-
-authenticated.get(
-    "/org/:orgId/event-streaming-destinations",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listEventStreamingDestinations),
-    eventStreamingDestination.listEventStreamingDestinations
-);
-
-authenticated.put(
-    "/org/:orgId/alert-rule",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createAlertRule),
-    logActionAudit(ActionsEnum.createAlertRule),
-    alertRule.createAlertRule
-);
-
-authenticated.post(
-    "/org/:orgId/alert-rule/:alertRuleId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateAlertRule),
-    logActionAudit(ActionsEnum.updateAlertRule),
-    alertRule.updateAlertRule
-);
-
-authenticated.delete(
-    "/org/:orgId/alert-rule/:alertRuleId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteAlertRule),
-    logActionAudit(ActionsEnum.deleteAlertRule),
-    alertRule.deleteAlertRule
-);
-
-authenticated.get(
-    "/org/:orgId/alert-rules",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listAlertRules),
-    alertRule.listAlertRules
-);
-
-authenticated.get(
-    "/org/:orgId/alert-rule/:alertRuleId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.getAlertRule),
-    alertRule.getAlertRule
-);
-
-authenticated.get(
-    "/org/:orgId/health-checks",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listHealthChecks),
-    healthChecks.listHealthChecks
-);
-
-authenticated.put(
-    "/org/:orgId/health-check",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createHealthCheck),
-    logActionAudit(ActionsEnum.createHealthCheck),
-    healthChecks.createHealthCheck
-);
-
-authenticated.post(
-    "/org/:orgId/health-check/:healthCheckId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateHealthCheck),
-    logActionAudit(ActionsEnum.updateHealthCheck),
-    healthChecks.updateHealthCheck
-);
-
-authenticated.delete(
-    "/org/:orgId/health-check/:healthCheckId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteHealthCheck),
-    logActionAudit(ActionsEnum.deleteHealthCheck),
-    healthChecks.deleteHealthCheck
-);
-
-authenticated.get(
-    "/org/:orgId/health-check/:healthCheckId/status-history",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.getTarget),
-    healthChecks.getHealthCheckStatusHistory
-);

server/private/routers/policy/createResourcePolicy.ts

@@ -121,7 +121,7 @@ registry.registerPath({
     method: "post",
     path: "/org/{orgId}/resource-policy",
     description: "Create a resource policy.",
-    tags: [OpenAPITags.PublicResourcePolicy],
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
     request: {
         params: createResourcePolicyParamsSchema,
         body: {

server/private/routers/policy/deleteResourcePolicy.ts

@@ -31,7 +31,7 @@ registry.registerPath({
     method: "delete",
     path: "/resource-policy/{resourcePolicyId}",
     description: "Delete a resource policy.",
-    tags: [OpenAPITags.PublicResourcePolicy],
+    tags: [OpenAPITags.Policy],
     request: {
         params: deleteResourcePolicySchema
     },

server/private/routers/policy/listResourcePolicies.ts

@@ -79,7 +79,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/resource-policies",
     description: "List resource policies for an organization.",
-    tags: [OpenAPITags.PublicResourcePolicy],
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
     request: {
         params: z.object({
             orgId: z.string()

server/routers/accessToken/generateAccessToken.ts

@@ -44,39 +44,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/access-token",
     description: "Generate a new access token for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: generateAccssTokenParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: generateAccessTokenBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/access-token",
-    description: "Generate a new access token for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
     request: {
         params: generateAccssTokenParamsSchema,

server/routers/accessToken/listAccessTokens.ts

@@ -151,35 +151,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/access-tokens",
     description: "List all access tokens for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: z.object({
-            resourceId: z.number()
-        }),
-        query: listAccessTokensSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/access-tokens",
-    description: "List all access tokens for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.AccessToken],
     request: {
         params: z.object({

server/routers/external.ts

@@ -248,6 +248,22 @@ authenticated.post(
     site.updateSite
 );
 
+authenticated.post(
+    "/site/:siteId/approve",
+    verifySiteAccess,
+    verifyUserHasAction(ActionsEnum.updateSiteApprovals),
+    logActionAudit(ActionsEnum.updateSiteApprovals),
+    site.approveSite
+);
+
+authenticated.post(
+    "/site/:siteId/reject",
+    verifySiteAccess,
+    verifyUserHasAction(ActionsEnum.updateSiteApprovals),
+    logActionAudit(ActionsEnum.updateSiteApprovals),
+    site.rejectSite
+);
+
 authenticated.delete(
     "/site/:siteId",
     verifySiteAccess,

server/routers/integration.ts

@@ -138,6 +138,7 @@ authenticated.post(
     logActionAudit(ActionsEnum.updateSite),
     site.updateSite
 );
+
 authenticated.post(
     "/org/:orgId/reset-bandwidth",
     verifyApiKeyOrgAccess,
@@ -162,7 +163,7 @@ authenticated.get(
 
 // Site Resource endpoints
 authenticated.put(
-    ["/org/:orgId/site-resource", "/org/:orgId/private-resource"],
+    "/org/:orgId/site-resource",
     verifyApiKeyOrgAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.createSiteResource),
@@ -171,10 +172,7 @@ authenticated.put(
 );
 
 authenticated.get(
-    [
+    "/org/:orgId/site/:siteId/resources",
-        "/org/:orgId/site/:siteId/resources",
-        "/org/:orgId/site/:siteId/private-resources"
-    ],
     verifyApiKeyOrgAccess,
     verifyApiKeySiteAccess,
     verifyApiKeyHasAction(ActionsEnum.listSiteResources),
@@ -182,21 +180,21 @@ authenticated.get(
 );
 
 authenticated.get(
-    ["/org/:orgId/site-resources", "/org/:orgId/private-resources"],
+    "/org/:orgId/site-resources",
     verifyApiKeyOrgAccess,
     verifyApiKeyHasAction(ActionsEnum.listSiteResources),
     siteResource.listAllSiteResourcesByOrg
 );
 
 authenticated.get(
-    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
+    "/site-resource/:siteResourceId",
     verifyApiKeySiteResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.getSiteResource),
     siteResource.getSiteResource
 );
 
 authenticated.post(
-    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
+    "/site-resource/:siteResourceId",
     verifyApiKeySiteResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.updateSiteResource),
@@ -205,7 +203,7 @@ authenticated.post(
 );
 
 authenticated.delete(
-    ["/site-resource/:siteResourceId", "/private-resource/:siteResourceId"],
+    "/site-resource/:siteResourceId",
     verifyApiKeySiteResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.deleteSiteResource),
     logActionAudit(ActionsEnum.deleteSiteResource),
@@ -213,40 +211,28 @@ authenticated.delete(
 );
 
 authenticated.get(
-    [
+    "/site-resource/:siteResourceId/roles",
-        "/site-resource/:siteResourceId/roles",
-        "/private-resource/:siteResourceId/roles"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
     siteResource.listSiteResourceRoles
 );
 
 authenticated.get(
-    [
+    "/site-resource/:siteResourceId/users",
-        "/site-resource/:siteResourceId/users",
-        "/private-resource/:siteResourceId/users"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
     siteResource.listSiteResourceUsers
 );
 
 authenticated.get(
-    [
+    "/site-resource/:siteResourceId/clients",
-        "/site-resource/:siteResourceId/clients",
-        "/private-resource/:siteResourceId/clients"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
     siteResource.listSiteResourceClients
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/roles",
-        "/site-resource/:siteResourceId/roles",
-        "/private-resource/:siteResourceId/roles"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -256,10 +242,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/users",
-        "/site-resource/:siteResourceId/users",
-        "/private-resource/:siteResourceId/users"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -269,10 +252,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/roles/add",
-        "/site-resource/:siteResourceId/roles/add",
-        "/private-resource/:siteResourceId/roles/add"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -282,10 +262,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/roles/remove",
-        "/site-resource/:siteResourceId/roles/remove",
-        "/private-resource/:siteResourceId/roles/remove"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -295,10 +272,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/users/add",
-        "/site-resource/:siteResourceId/users/add",
-        "/private-resource/:siteResourceId/users/add"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -308,10 +282,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/users/remove",
-        "/site-resource/:siteResourceId/users/remove",
-        "/private-resource/:siteResourceId/users/remove"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -321,10 +292,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/clients",
-        "/site-resource/:siteResourceId/clients",
-        "/private-resource/:siteResourceId/clients"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceClients,
     verifyLimits,
@@ -334,10 +302,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/clients/add",
-        "/site-resource/:siteResourceId/clients/add",
-        "/private-resource/:siteResourceId/clients/add"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceClients,
     verifyLimits,
@@ -347,10 +312,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/site-resource/:siteResourceId/clients/remove",
-        "/site-resource/:siteResourceId/clients/remove",
-        "/private-resource/:siteResourceId/clients/remove"
-    ],
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceClients,
     verifyLimits,
@@ -360,7 +322,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    ["/client/:clientId/site-resources", "/client/:clientId/private-resources"],
+    "/client/:clientId/site-resources",
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourceUsers),
     logActionAudit(ActionsEnum.setResourceUsers),
@@ -368,7 +330,7 @@ authenticated.post(
 );
 
 authenticated.put(
-    ["/org/:orgId/resource", "/org/:orgId/public-resource"],
+    "/org/:orgId/resource",
     verifyApiKeyOrgAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -377,10 +339,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/org/:orgId/site/:siteId/resource",
-        "/org/:orgId/site/:siteId/resource",
-        "/org/:orgId/site/:siteId/public-resource"
-    ],
     verifyApiKeyOrgAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.createResource),
@@ -389,14 +348,14 @@ authenticated.put(
 );
 
 authenticated.get(
-    ["/site/:siteId/resources", "/site/:siteId/public-resources"],
+    "/site/:siteId/resources",
     verifyApiKeySiteAccess,
     verifyApiKeyHasAction(ActionsEnum.listResources),
     resource.listResources
 );
 
 authenticated.get(
-    ["/org/:orgId/resources", "/org/:orgId/public-resources"],
+    "/org/:orgId/resources",
     verifyApiKeyOrgAccess,
     verifyApiKeyHasAction(ActionsEnum.listResources),
     resource.listResources
@@ -484,45 +443,42 @@ authenticated.delete(
 );
 
 authenticated.get(
-    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
+    "/resource/:resourceId/roles",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceRoles),
     resource.listResourceRoles
 );
 
 authenticated.get(
-    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
+    "/resource/:resourceId/users",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceUsers),
     resource.listResourceUsers
 );
 
 authenticated.get(
-    ["/resource/:resourceId", "/public-resource/:resourceId"],
+    "/resource/:resourceId",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.getResource),
     resource.getResource
 );
 
 authenticated.get(
-    [
+    "/resource-policy/:resourcePolicyId",
-        "/resource-policy/:resourcePolicyId",
-        "/public-resource-policy/:resourcePolicyId"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
     policy.getResourcePolicy
 );
 
 authenticated.get(
-    ["/resource/:resourceId/policies", "/public-resource/:resourceId/policies"],
+    "/resource/:resourceId/policies",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
     resource.getResourcePolicies
 );
 
 authenticated.post(
-    ["/resource/:resourceId", "/public-resource/:resourceId"],
+    "/resource/:resourceId",
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.updateResource),
@@ -531,17 +487,14 @@ authenticated.post(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId",
-        "/resource-policy/:resourcePolicyId",
-        "/public-resource-policy/:resourcePolicyId"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
     policy.updateResourcePolicy
 );
 
 authenticated.delete(
-    ["/resource/:resourceId", "/public-resource/:resourceId"],
+    "/resource/:resourceId",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.deleteResource),
     logActionAudit(ActionsEnum.deleteResource),
@@ -549,7 +502,7 @@ authenticated.delete(
 );
 
 authenticated.put(
-    ["/resource/:resourceId/target", "/public-resource/:resourceId/target"],
+    "/resource/:resourceId/target",
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.createTarget),
@@ -558,14 +511,14 @@ authenticated.put(
 );
 
 authenticated.get(
-    ["/resource/:resourceId/targets", "/public-resource/:resourceId/targets"],
+    "/resource/:resourceId/targets",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listTargets),
     target.listTargets
 );
 
 authenticated.put(
-    ["/resource/:resourceId/rule", "/public-resource/:resourceId/rule"],
+    "/resource/:resourceId/rule",
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.createResourceRule),
@@ -574,17 +527,14 @@ authenticated.put(
 );
 
 authenticated.get(
-    ["/resource/:resourceId/rules", "/public-resource/:resourceId/rules"],
+    "/resource/:resourceId/rules",
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listResourceRules),
     resource.listResourceRules
 );
 
 authenticated.post(
-    [
+    "/resource/:resourceId/rule/:ruleId",
-        "/resource/:resourceId/rule/:ruleId",
-        "/public-resource/:resourceId/rule/:ruleId"
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.updateResourceRule),
@@ -593,10 +543,7 @@ authenticated.post(
 );
 
 authenticated.delete(
-    [
+    "/resource/:resourceId/rule/:ruleId",
-        "/resource/:resourceId/rule/:ruleId",
-        "/public-resource/:resourceId/rule/:ruleId"
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.deleteResourceRule),
     logActionAudit(ActionsEnum.deleteResourceRule),
@@ -678,7 +625,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    ["/resource/:resourceId/roles", "/public-resource/:resourceId/roles"],
+    "/resource/:resourceId/roles",
     verifyApiKeyResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -688,7 +635,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    ["/resource/:resourceId/users", "/public-resource/:resourceId/users"],
+    "/resource/:resourceId/users",
     verifyApiKeyResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -698,10 +645,7 @@ authenticated.post(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/access-control",
-        "/resource-policy/:resourcePolicyId/access-control",
-        "/public-resource-policy/:resourcePolicyId/access-control"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -713,10 +657,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/password",
-        "/resource-policy/:resourcePolicyId/password",
-        "/public-resource-policy/:resourcePolicyId/password"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
@@ -725,10 +666,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/pincode",
-        "/resource-policy/:resourcePolicyId/pincode",
-        "/public-resource-policy/:resourcePolicyId/pincode"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
@@ -737,10 +675,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/header-auth",
-        "/resource-policy/:resourcePolicyId/header-auth",
-        "/public-resource-policy/:resourcePolicyId/header-auth"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
@@ -749,10 +684,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/whitelist",
-        "/resource-policy/:resourcePolicyId/whitelist",
-        "/public-resource-policy/:resourcePolicyId/whitelist"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
@@ -761,10 +693,7 @@ authenticated.put(
 );
 
 authenticated.put(
-    [
+    "/resource-policy/:resourcePolicyId/rules",
-        "/resource-policy/:resourcePolicyId/rules",
-        "/public-resource-policy/:resourcePolicyId/rules"
-    ],
     verifyApiKeyResourcePolicyAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
@@ -773,10 +702,7 @@ authenticated.put(
 );
 
 authenticated.post(
-    [
+    "/resource/:resourceId/roles/add",
-        "/resource/:resourceId/roles/add",
-        "/public-resource/:resourceId/roles/add"
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -786,10 +712,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/resource/:resourceId/roles/remove",
-        "/resource/:resourceId/roles/remove",
-        "/public-resource/:resourceId/roles/remove"
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
@@ -799,10 +722,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/resource/:resourceId/users/add",
-        "/resource/:resourceId/users/add",
-        "/public-resource/:resourceId/users/add"
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -812,10 +732,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    "/resource/:resourceId/users/remove",
-        "/resource/:resourceId/users/remove",
-        "/public-resource/:resourceId/users/remove"
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeySetResourceUsers,
     verifyLimits,
@@ -825,7 +742,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [`/resource/:resourceId/password`, `/public-resource/:resourceId/password`],
+    `/resource/:resourceId/password`,
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePassword),
@@ -834,7 +751,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [`/resource/:resourceId/pincode`, `/public-resource/:resourceId/pincode`],
+    `/resource/:resourceId/pincode`,
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourcePincode),
@@ -843,10 +760,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/header-auth`,
-        `/resource/:resourceId/header-auth`,
-        `/public-resource/:resourceId/header-auth`
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourceHeaderAuth),
@@ -855,10 +769,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/whitelist`,
-        `/resource/:resourceId/whitelist`,
-        `/public-resource/:resourceId/whitelist`
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -867,10 +778,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/whitelist/add`,
-        `/resource/:resourceId/whitelist/add`,
-        `/public-resource/:resourceId/whitelist/add`
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -878,10 +786,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/whitelist/remove`,
-        `/resource/:resourceId/whitelist/remove`,
-        `/public-resource/:resourceId/whitelist/remove`
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.setResourceWhitelist),
@@ -889,20 +794,14 @@ authenticated.post(
 );
 
 authenticated.get(
-    [
+    `/resource/:resourceId/whitelist`,
-        `/resource/:resourceId/whitelist`,
-        `/public-resource/:resourceId/whitelist`
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.getResourceWhitelist),
     resource.getResourceWhitelist
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/access-token`,
-        `/resource/:resourceId/access-token`,
-        `/public-resource/:resourceId/access-token`
-    ],
     verifyApiKeyResourceAccess,
     verifyLimits,
     verifyApiKeyHasAction(ActionsEnum.generateAccessToken),
@@ -911,10 +810,7 @@ authenticated.post(
 );
 
 authenticated.post(
-    [
+    `/resource/:resourceId/session-token`,
-        `/resource/:resourceId/session-token`,
-        `/public-resource/:resourceId/session-token`
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyUserAccess,
     verifyLimits,
@@ -939,10 +835,7 @@ authenticated.get(
 );
 
 authenticated.get(
-    [
+    `/resource/:resourceId/access-tokens`,
-        `/resource/:resourceId/access-tokens`,
-        `/public-resource/:resourceId/access-tokens`
-    ],
     verifyApiKeyResourceAccess,
     verifyApiKeyHasAction(ActionsEnum.listAccessTokens),
     accessToken.listAccessTokens
@@ -1272,7 +1165,7 @@ authenticated.get(
 );
 
 authenticated.get(
-    ["/org/:orgId/resource-names", "/org/:orgId/public-resource-names"],
+    "/org/:orgId/resource-names",
     verifyApiKeyOrgAccess,
     verifyApiKeyHasAction(ActionsEnum.listResources),
     resource.listAllResourceNames

server/routers/launcher/launcherResourceAccess.ts

@@ -157,7 +157,8 @@ async function resolveAccessibleIdsUncached(
             .where(
                 and(
                     eq(userResources.userId, userId),
-                    eq(resources.orgId, orgId)
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
                 )
             ),
         userRoleIds.length > 0
@@ -171,7 +172,8 @@ async function resolveAccessibleIdsUncached(
                   .where(
                       and(
                           inArray(roleResources.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                       )
                   )
             : Promise.resolve([]),
@@ -183,7 +185,11 @@ async function resolveAccessibleIdsUncached(
                 eq(effectiveResourcePolicyId, userPolicies.resourcePolicyId)
             )
             .where(
-                and(eq(userPolicies.userId, userId), eq(resources.orgId, orgId))
+                and(
+                    eq(userPolicies.userId, userId),
+                    eq(resources.orgId, orgId),
+                    eq(resources.status, "approved")
+                )
             ),
         userRoleIds.length > 0
             ? db
@@ -199,21 +205,48 @@ async function resolveAccessibleIdsUncached(
                   .where(
                       and(
                           inArray(rolePolicies.roleId, userRoleIds),
-                          eq(resources.orgId, orgId)
+                          eq(resources.orgId, orgId),
+                          eq(resources.status, "approved")
                       )
                   )
             : Promise.resolve([]),
         db
             .select({ siteResourceId: userSiteResources.siteResourceId })
             .from(userSiteResources)
-            .where(eq(userSiteResources.userId, userId)),
+            .innerJoin(
+                siteResources,
+                eq(
+                    userSiteResources.siteResourceId,
+                    siteResources.siteResourceId
+                )
+            )
+            .where(
+                and(
+                    eq(userSiteResources.userId, userId),
+                    eq(siteResources.orgId, orgId),
+                    eq(siteResources.status, "approved")
+                )
+            ),
         userRoleIds.length > 0
             ? db
                   .select({
                       siteResourceId: roleSiteResources.siteResourceId
                   })
                   .from(roleSiteResources)
-                  .where(inArray(roleSiteResources.roleId, userRoleIds))
+                  .innerJoin(
+                      siteResources,
+                      eq(
+                          roleSiteResources.siteResourceId,
+                          siteResources.siteResourceId
+                      )
+                  )
+                  .where(
+                      and(
+                          inArray(roleSiteResources.roleId, userRoleIds),
+                          eq(siteResources.orgId, orgId),
+                          eq(siteResources.status, "approved")
+                      )
+                  )
             : Promise.resolve([])
     ]);
 
@@ -365,6 +398,7 @@ async function filterPublicResourceIdsByTextSearch(
                 inArray(resources.resourceId, resourceIds),
                 eq(resources.orgId, orgId),
                 eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                 textMatch
             )
         );
@@ -402,6 +436,7 @@ async function filterSiteResourceIdsByTextSearch(
                 inArray(siteResources.siteResourceId, siteResourceIds),
                 eq(siteResources.orgId, orgId),
                 eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                 textMatch
             )
         );
@@ -503,7 +538,8 @@ async function listSiteGroups(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (searchPublic) {
             publicConditions.push(searchPublic);
@@ -558,7 +594,8 @@ async function listSiteGroups(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (searchSite) {
             siteConditions.push(searchSite);
@@ -621,7 +658,8 @@ async function listSiteGroups(
         const noSitePublicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (searchPublic) {
             noSitePublicConditions.push(searchPublic);
@@ -655,7 +693,8 @@ async function listSiteGroups(
         const noSiteSiteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (searchSite) {
             noSiteSiteConditions.push(searchSite);
@@ -746,7 +785,8 @@ async function listLabelGroups(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         const searchPublic = buildSearchConditionForPublic(query.query);
         if (searchPublic) {
@@ -810,7 +850,8 @@ async function listLabelGroups(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         const searchSite = buildSearchConditionForSiteResource(query.query);
         if (searchSite) {
@@ -997,6 +1038,7 @@ async function mapPublicResources(
                 inArray(resources.resourceId, resourceIds),
                 eq(resources.orgId, orgId),
                 eq(resources.enabled, true),
+                eq(resources.status, "approved"),
                 siteIdFilter != null
                     ? eq(sites.siteId, siteIdFilter)
                     : undefined
@@ -1088,6 +1130,7 @@ async function mapSiteResources(
                 inArray(siteResources.siteResourceId, siteResourceIds),
                 eq(siteResources.orgId, orgId),
                 eq(siteResources.enabled, true),
+                eq(siteResources.status, "approved"),
                 siteIdFilter != null
                     ? eq(sites.siteId, siteIdFilter)
                     : undefined
@@ -1382,7 +1425,8 @@ async function collectAccessibleSites(
         const publicConditions = [
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
-            eq(resources.enabled, true)
+            eq(resources.enabled, true),
+            eq(resources.status, "approved")
         ];
         if (siteNameSearch) {
             publicConditions.push(siteNameSearch);
@@ -1422,7 +1466,8 @@ async function collectAccessibleSites(
         const siteConditions = [
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
-            eq(siteResources.enabled, true)
+            eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved")
         ];
         if (siteNameSearch) {
             siteConditions.push(siteNameSearch);
@@ -1476,6 +1521,7 @@ async function collectAccessibleLabels(
             inArray(resources.resourceId, accessible.resourceIds),
             eq(resources.orgId, orgId),
             eq(resources.enabled, true),
+            eq(resources.status, "approved"),
             eq(labels.orgId, orgId)
         ];
         if (labelNameSearch) {
@@ -1511,6 +1557,7 @@ async function collectAccessibleLabels(
             inArray(siteResources.siteResourceId, accessible.siteResourceIds),
             eq(siteResources.orgId, orgId),
             eq(siteResources.enabled, true),
+            eq(siteResources.status, "approved"),
             eq(labels.orgId, orgId)
         ];
         if (labelNameSearch) {

server/routers/newt/buildConfiguration.ts

@@ -148,7 +148,12 @@ export async function buildClientConfigurationForNewtClient(
         .from(siteResources)
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
-        .where(eq(siteNetworks.siteId, siteId))
+        .where(
+            and(
+                eq(siteNetworks.siteId, siteId),
+                eq(siteResources.enabled, true)
+            )
+        )
         .then((rows) => rows.map((r) => r.siteResources));
 
     const targetsToSend: SubnetProxyTargetV2[] = [];

server/routers/olm/buildConfiguration.ts

@@ -16,7 +16,7 @@ import {
     generateRemoteSubnets
 } from "@server/lib/ip";
 import logger from "@server/logger";
-import { eq, inArray } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { addPeer, deletePeer } from "../newt/peers";
 import config from "@server/lib/config";
 
@@ -70,7 +70,13 @@ export async function buildSiteConfigurationForOlmClient(
         .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
         .innerJoin(siteNetworks, eq(networks.networkId, siteNetworks.networkId))
         .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
+            and(
+                eq(
+                    clientSiteResourcesAssociationsCache.clientId,
+                    client.clientId
+                ),
+                eq(siteResources.enabled, true)
+            )
         );
 
     const siteResourcesBySiteId = new Map<number, SiteResource[]>();

server/routers/policy/getResourcePolicy.ts

@@ -168,7 +168,7 @@ registry.registerPath({
     path: "/org/{orgId}/resource-policy/{niceId}",
     description:
         "Get a resource policy by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.PublicResourcePolicy],
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
     request: {
         params: z.object({
             orgId: z.string(),
@@ -182,20 +182,7 @@ registry.registerPath({
     method: "get",
     path: "/resource-policy/{resourcePolicyId}",
     description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            resourcePolicyId: z.number()
-        })
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource-policy/{resourcePolicyId}",
-    description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: z.object({
             resourcePolicyId: z.number()

server/routers/policy/setResourcePolicyAccessControl.ts

@@ -40,26 +40,7 @@ registry.registerPath({
     path: "/resource-policy/{resourceId}/access-control",
     description:
         "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy, OpenAPITags.User],
-    request: {
-        params: setResourcePolicyAccessControlParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyAcccessControlBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource-policy/{resourceId}/access-control",
-    description:
-        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.PublicResourcePolicy, OpenAPITags.User],
     request: {
         params: setResourcePolicyAccessControlParamsSchema,
         body: {

server/routers/policy/setResourcePolicyHeaderAuth.ts

@@ -29,26 +29,7 @@ registry.registerPath({
     path: "/resource-policy/{resourcePolicyId}/header-auth",
     description:
         "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyHeaderAuthParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyHeaderAuthBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}/header-auth",
-    description:
-        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: setResourcePolicyHeaderAuthParamsSchema,
         body: {

server/routers/policy/setResourcePolicyPassword.ts

@@ -24,26 +24,7 @@ registry.registerPath({
     path: "/resource-policy/{resourcePolicyId}/password",
     description:
         "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPasswordParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPasswordBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}/password",
-    description:
-        "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: setResourcePolicyPasswordParamsSchema,
         body: {

server/routers/policy/setResourcePolicyPincode.ts

@@ -27,26 +27,7 @@ registry.registerPath({
     path: "/resource-policy/{resourcePolicyId}/pincode",
     description:
         "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPincodeParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPincodeBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}/pincode",
-    description:
-        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: setResourcePolicyPincodeParamsSchema,
         body: {

server/routers/policy/setResourcePolicyRules.ts

@@ -47,26 +47,7 @@ registry.registerPath({
     path: "/resource-policy/{resourcePolicyId}/rules",
     description:
         "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyRulesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyRulesBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}/rules",
-    description:
-        "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: setResourcePolicyRulesParamsSchema,
         body: {

server/routers/policy/setResourcePolicyWhitelist.ts

@@ -32,26 +32,7 @@ registry.registerPath({
     path: "/resource-policy/{resourcePolicyId}/whitelist",
     description:
         "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.PublicResourcePolicyLegacy],
+    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}/whitelist",
-    description:
-        "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: setResourcePolicyWhitelistParamsSchema,
         body: {

server/routers/policy/updateResourcePolicy.ts

@@ -22,25 +22,7 @@ registry.registerPath({
     method: "put",
     path: "/resource-policy/{resourcePolicyId}",
     description: "Update a resource policy.",
-    tags: [OpenAPITags.PublicResourcePolicy],
+    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: updateResourcePolicyParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateResourcePolicyBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource-policy/{resourcePolicyId}",
-    description: "Update a resource policy.",
-    tags: [OpenAPITags.PublicResourcePolicy],
     request: {
         params: updateResourcePolicyParamsSchema,
         body: {

server/routers/resource/addEmailToResourceWhitelist.ts

@@ -34,39 +34,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/whitelist/add",
     description: "Add a single email to the resource whitelist.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: addEmailToResourceWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addEmailToResourceWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/whitelist/add",
-    description: "Add a single email to the resource whitelist.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: addEmailToResourceWhitelistParamsSchema,
@@ -177,7 +144,10 @@ export async function addEmailToResourceWhitelist(
                 .from(resourcePolicyWhiteList)
                 .where(
                     and(
-                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
                         eq(resourcePolicyWhiteList.email, email)
                     )
                 );

server/routers/resource/addRoleToResource.ts

@@ -28,40 +28,6 @@ const addRoleToResourceParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/roles/add",
-    description:
-        "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: addRoleToResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addRoleToResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/roles/add",
     description:
         "Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Role],

server/routers/resource/addUserToResource.ts

@@ -28,40 +28,6 @@ const addUserToResourceParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/users/add",
-    description:
-        "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: addUserToResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addUserToResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/users/add",
     description:
         "Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.User],

server/routers/resource/createResource.ts

@@ -153,39 +153,6 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/resource",
     description: "Create a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: createResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createHttpResourceSchema.or(createRawResourceSchema)
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/public-resource",
-    description: "Create a resource.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: createResourceParamsSchema,

server/routers/resource/createResourceRule.ts

@@ -32,39 +32,6 @@ registry.registerPath({
     method: "put",
     path: "/resource/{resourceId}/rule",
     description: "Create a resource rule.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: createResourceRuleParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createResourceRuleSchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource/{resourceId}/rule",
-    description: "Create a resource rule.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
     request: {
         params: createResourceRuleParamsSchema,

server/routers/resource/deleteResource.ts

@@ -22,32 +22,6 @@ registry.registerPath({
     method: "delete",
     path: "/resource/{resourceId}",
     description: "Delete a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: deleteResourceSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/public-resource/{resourceId}",
-    description: "Delete a resource.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: deleteResourceSchema

server/routers/resource/deleteResourceRule.ts

@@ -19,32 +19,6 @@ registry.registerPath({
     method: "delete",
     path: "/resource/{resourceId}/rule/{ruleId}",
     description: "Delete a resource rule.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: deleteResourceRuleSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/public-resource/{resourceId}/rule/{ruleId}",
-    description: "Delete a resource rule.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
     request: {
         params: deleteResourceRuleSchema

server/routers/resource/getResource.ts

@@ -63,7 +63,7 @@ registry.registerPath({
     path: "/org/{orgId}/resource/{niceId}",
     description:
         "Get a resource by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.PublicResourceLegacy],
+    tags: [OpenAPITags.PublicResource],
     request: {
         params: z.object({
             orgId: z.string(),
@@ -92,34 +92,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}",
     description: "Get a resource by resourceId.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: z.object({
-            resourceId: z.number()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}",
-    description: "Get a resource by resourceId.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: z.object({

server/routers/resource/getResourcePolicies.ts

@@ -25,21 +25,8 @@ export type GetResourcePoliciesResponse = {
 registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/policies",
-    description:
+    description: "Get the inline and shared policies associated with a resource.",
-        "Get the inline and shared policies associated with a resource.",
+    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: getResourcePoliciesParamsSchema
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/policies",
-    description:
-        "Get the inline and shared policies associated with a resource.",
-    tags: [OpenAPITags.PublicResource, OpenAPITags.PublicResourcePolicy],
     request: {
         params: getResourcePoliciesParamsSchema
     },

server/routers/resource/getResourceWhitelist.ts

@@ -44,32 +44,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/whitelist",
     description: "Get the whitelist of emails for a specific resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: getResourceWhitelistSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/whitelist",
-    description: "Get the whitelist of emails for a specific resource.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: getResourceWhitelistSchema

server/routers/resource/listAllResourceNames.ts

@@ -33,34 +33,6 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/resources-names",
     description: "List all resource names for an organization.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: z.object({
-            orgId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/public-resource-names",
-    description: "List all resource names for an organization.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: z.object({

server/routers/resource/listResourceRoles.ts

@@ -48,32 +48,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/roles",
     description: "List all roles for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: listResourceRolesSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/roles",
-    description: "List all roles for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
     request: {
         params: listResourceRolesSchema

server/routers/resource/listResourceRules.ts

@@ -71,33 +71,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/rules",
     description: "List rules for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: listResourceRulesParamsSchema,
-        query: listResourceRulesSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/rules",
-    description: "List rules for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
     request: {
         params: listResourceRulesParamsSchema,

server/routers/resource/listResourceUsers.ts

@@ -38,32 +38,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/users",
     description: "List all users for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: listResourceUsersSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/users",
-    description: "List all users for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.User],
     request: {
         params: listResourceUsersSchema

server/routers/resource/listResources.ts

@@ -138,6 +138,15 @@ const listResourcesSchema = z.strictObject({
         description:
             "When set, only resources that have at least one target on this site are returned"
     }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by resource status"
+        }),
     labels: z
         .preprocess((val) => {
             if (val === undefined || val === null || val === "") {
@@ -400,35 +409,6 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/resources",
     description: "List resources for an organization.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: z.object({
-            orgId: z.string()
-        }),
-        query: listResourcesSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/public-resources",
-    description: "List resources for an organization.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: z.object({
@@ -480,6 +460,7 @@ export async function listResources(
             sort_by,
             order,
             siteId,
+            status,
             labels: labelFilter
         } = parsedQuery.data;
 
@@ -689,6 +670,10 @@ export async function listResources(
             }
         }
 
+        if (typeof status !== "undefined") {
+            conditions.push(eq(resources.status, status));
+        }
+
         if (siteId != null) {
             const resourcesWithSite = db
                 .select({ resourceId: targets.resourceId })

server/routers/resource/listUserResourceAliases.ts

@@ -45,18 +45,19 @@ function userResourceAliasesCacheKey(
     page: number,
     pageSize: number,
     includeLabels: boolean,
-    labelFilter: string[]
+    labelFilter: string[],
+    status?: "pending" | "approved"
 ) {
     const labelsKey =
         labelFilter.length > 0 ? labelFilter.slice().sort().join(",") : "all";
-    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}`;
+    return `userResourceAliases:${orgId}:${userId}:${page}:${pageSize}:${includeLabels ? "labels" : "plain"}:${labelsKey}:${status ?? "all"}`;
 }
 
 const listUserResourceAliasesParamsSchema = z.strictObject({
     orgId: z.string()
 });
 
-const listUserResourceAliasesQuerySchema = z.strictObject({
+const listUserResourceAliasesQuerySchema = z.object({
     pageSize: z.coerce
         .number<string>()
         .int()
@@ -96,7 +97,16 @@ const listUserResourceAliasesQuerySchema = z.strictObject({
         type: "array",
         description:
             "Filter by resource labels. A resource matches when it has any of the given labels (OR)."
-    })
+    }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        })
 });
 
 export type UserResourceAliasItem = {
@@ -130,7 +140,8 @@ export async function listUserResourceAliases(
             page,
             pageSize,
             includeLabels,
-            labels: labelFilter
+            labels: labelFilter,
+            status
         } = parsedQuery.data;
 
         const parsedParams = listUserResourceAliasesParamsSchema.safeParse(
@@ -172,7 +183,8 @@ export async function listUserResourceAliases(
             page,
             pageSize,
             includeLabels,
-            labelFilter ?? []
+            labelFilter ?? [],
+            status
         );
         const cachedData: ListUserResourceAliasesResponse | undefined =
             await cache.get(cacheKey);
@@ -257,6 +269,10 @@ export async function listUserResourceAliases(
             inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
+        if (typeof status !== "undefined") {
+            whereConditions.push(eq(siteResources.status, status));
+        }
+
         if (labelFilter && labelFilter.length > 0) {
             whereConditions.push(
                 inArray(

server/routers/resource/removeEmailFromResourceWhitelist.ts

@@ -34,39 +34,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/whitelist/remove",
     description: "Remove a single email from the resource whitelist.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: removeEmailFromResourceWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeEmailFromResourceWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/whitelist/remove",
-    description: "Remove a single email from the resource whitelist.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: removeEmailFromResourceWhitelistParamsSchema,
@@ -176,7 +143,10 @@ export async function removeEmailFromResourceWhitelist(
                 .from(resourcePolicyWhiteList)
                 .where(
                     and(
-                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
                         eq(resourcePolicyWhiteList.email, email)
                     )
                 );
@@ -194,7 +164,10 @@ export async function removeEmailFromResourceWhitelist(
                 .delete(resourcePolicyWhiteList)
                 .where(
                     and(
-                        eq(resourcePolicyWhiteList.resourcePolicyId, policyId),
+                        eq(
+                            resourcePolicyWhiteList.resourcePolicyId,
+                            policyId
+                        ),
                         eq(resourcePolicyWhiteList.email, email)
                     )
                 );

server/routers/resource/removeRoleFromResource.ts

@@ -29,39 +29,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/roles/remove",
     description: "Remove a single role from a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: removeRoleFromResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeRoleFromResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/roles/remove",
-    description: "Remove a single role from a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
     request: {
         params: removeRoleFromResourceParamsSchema,

server/routers/resource/removeUserFromResource.ts

@@ -29,39 +29,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/users/remove",
     description: "Remove a single user from a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: removeUserFromResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeUserFromResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/users/remove",
-    description: "Remove a single user from a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.User],
     request: {
         params: removeUserFromResourceParamsSchema,

server/routers/resource/setResourceHeaderAuth.ts

@@ -29,40 +29,6 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/header-auth",
-    description:
-        "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setResourceAuthMethodsParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourceAuthMethodsBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/header-auth",
     description:
         "Set or update the header authentication for a resource. If user and password is not provided, it will remove the header authentication.",
     tags: [OpenAPITags.PublicResource],

server/routers/resource/setResourcePassword.ts

@@ -27,40 +27,6 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/password",
-    description:
-        "Set the password for a resource. Setting the password to null will remove it.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setResourceAuthMethodsParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourceAuthMethodsBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/password",
     description:
         "Set the password for a resource. Setting the password to null will remove it.",
     tags: [OpenAPITags.PublicResource],

server/routers/resource/setResourcePincode.ts

@@ -27,40 +27,6 @@ const setResourceAuthMethodsBodySchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/pincode",
-    description:
-        "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setResourceAuthMethodsParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourceAuthMethodsBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/pincode",
     description:
         "Set the PIN code for a resource. Setting the PIN code to null will remove it.",
     tags: [OpenAPITags.PublicResource],

server/routers/resource/setResourceRoles.ts

@@ -21,40 +21,6 @@ const setResourceRolesParamsSchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/roles",
-    description:
-        "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setResourceRolesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourceRolesBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/roles",
     description:
         "Set roles for a resource. This will replace all existing roles. When the resource has an inline policy defined (no shared resource policy assigned), roles are set on the inline policy instead of directly on the resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Role],

server/routers/resource/setResourceUsers.ts

@@ -21,40 +21,6 @@ const setUserResourcesParamsSchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/users",
-    description:
-        "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setUserResourcesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setUserResourcesBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/users",
     description:
         "Set users for a resource. This will replace all existing users. When the resource has an inline policy defined (no shared resource policy assigned), users are set on the inline policy instead of directly on the resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.User],

server/routers/resource/setResourceWhitelist.ts

@@ -35,40 +35,6 @@ const setResourceWhitelistParamsSchema = z.strictObject({
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/whitelist",
-    description:
-        "Set email whitelist for a resource. This will replace all existing emails.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: setResourceWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourceWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/whitelist",
     description:
         "Set email whitelist for a resource. This will replace all existing emails.",
     tags: [OpenAPITags.PublicResource],

server/routers/resource/updateResource.ts

@@ -240,42 +240,6 @@ const updateRawResourceBodySchema = z
 registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}",
-    description:
-        "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: updateResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateHttpResourceBodySchema.and(
-                        updateRawResourceBodySchema
-                    )
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}",
     description:
         "Update a resource. Policy fields (sso, mfa, pincode, password, whitelist) update the inline policy when no shared resource policy is assigned; when a shared policy is assigned those fields override the shared policy for this resource only.",
     tags: [OpenAPITags.PublicResource],

server/routers/resource/updateResourceRule.ts

@@ -49,39 +49,6 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/rule/{ruleId}",
     description: "Update a resource rule.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: updateResourceRuleParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateResourceRuleSchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/public-resource/{resourceId}/rule/{ruleId}",
-    description: "Update a resource rule.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Rule],
     request: {
         params: updateResourceRuleParamsSchema,

server/routers/site/approveSite.ts

@@ -0,0 +1,251 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    db,
+    resources,
+    siteNetworks,
+    siteResources,
+    sites,
+    type Site,
+    type SiteResource
+} from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    getResourceIdsForSite,
+    getSiteResourceIdsForSite
+} from "@server/lib/deleteSiteAssociatedResources";
+import {
+    handleMessagingForUpdatedSiteResource,
+    rebuildClientAssociationsFromSiteResource,
+    waitForSiteResourceRebuildIdle
+} from "@server/lib/rebuildClientAssociations";
+
+const approveSiteParamsSchema = z.strictObject({
+    siteId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/site/{siteId}/approve",
+    description:
+        "Approve a pending site and approve (and enable when needed) its associated resources.",
+    tags: [OpenAPITags.Site],
+    request: {
+        params: approveSiteParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+type SiteResourceEnableSideEffect = {
+    existing: SiteResource;
+    updated: SiteResource;
+    siteIds: number[];
+};
+
+export async function approveSite(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = approveSiteParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteId } = parsedParams.data;
+
+        const [existingSite] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (!existingSite) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!existingSite.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Site with ID ${siteId} has no organization`
+                )
+            );
+        }
+
+        const orgId = existingSite.orgId;
+        let updatedSite: Site | undefined;
+        const siteResourceEnableSideEffects: SiteResourceEnableSideEffect[] =
+            [];
+
+        await db.transaction(async (trx) => {
+            [updatedSite] = await trx
+                .update(sites)
+                .set({ status: "approved" })
+                .where(eq(sites.siteId, siteId))
+                .returning();
+
+            const resourceIds = await getResourceIdsForSite(siteId, trx);
+            const siteResourceIds = await getSiteResourceIdsForSite(
+                siteId,
+                orgId,
+                trx
+            );
+
+            if (resourceIds.length > 0) {
+                const pendingDisabledResources = await trx
+                    .select({ resourceId: resources.resourceId })
+                    .from(resources)
+                    .where(
+                        and(
+                            inArray(resources.resourceId, resourceIds),
+                            eq(resources.status, "pending"),
+                            eq(resources.enabled, false)
+                        )
+                    );
+
+                await trx
+                    .update(resources)
+                    .set({ status: "approved" })
+                    .where(inArray(resources.resourceId, resourceIds));
+
+                if (pendingDisabledResources.length > 0) {
+                    await trx
+                        .update(resources)
+                        .set({ enabled: true })
+                        .where(
+                            inArray(
+                                resources.resourceId,
+                                pendingDisabledResources.map(
+                                    (r) => r.resourceId
+                                )
+                            )
+                        );
+                }
+            }
+
+            if (siteResourceIds.length > 0) {
+                const existingSiteResources = await trx
+                    .select()
+                    .from(siteResources)
+                    .where(
+                        inArray(siteResources.siteResourceId, siteResourceIds)
+                    );
+
+                const pendingDisabledSiteResources =
+                    existingSiteResources.filter(
+                        (sr) => sr.status === "pending" && !sr.enabled
+                    );
+
+                await trx
+                    .update(siteResources)
+                    .set({ status: "approved" })
+                    .where(
+                        inArray(siteResources.siteResourceId, siteResourceIds)
+                    );
+
+                if (pendingDisabledSiteResources.length > 0) {
+                    const enableIds = pendingDisabledSiteResources.map(
+                        (sr) => sr.siteResourceId
+                    );
+
+                    const updatedEnabledSiteResources = await trx
+                        .update(siteResources)
+                        .set({ enabled: true })
+                        .where(inArray(siteResources.siteResourceId, enableIds))
+                        .returning();
+
+                    for (const updated of updatedEnabledSiteResources) {
+                        const existing = pendingDisabledSiteResources.find(
+                            (sr) => sr.siteResourceId === updated.siteResourceId
+                        );
+                        if (!existing || !updated.networkId) {
+                            continue;
+                        }
+
+                        const networkSites = await trx
+                            .select({ siteId: siteNetworks.siteId })
+                            .from(siteNetworks)
+                            .where(
+                                eq(siteNetworks.networkId, updated.networkId)
+                            );
+
+                        siteResourceEnableSideEffects.push({
+                            existing,
+                            updated,
+                            siteIds: networkSites.map((s) => s.siteId)
+                        });
+                    }
+                }
+            }
+        });
+
+        for (const sideEffect of siteResourceEnableSideEffects) {
+            rebuildClientAssociationsFromSiteResource(sideEffect.updated)
+                .then(() =>
+                    waitForSiteResourceRebuildIdle(
+                        sideEffect.updated.siteResourceId
+                    )
+                )
+                .then(() =>
+                    handleMessagingForUpdatedSiteResource(
+                        sideEffect.existing,
+                        sideEffect.updated,
+                        sideEffect.siteIds,
+                        sideEffect.siteIds
+                    )
+                )
+                .catch((e) => {
+                    logger.error(
+                        `Failed to rebuild and handle messaging for site resource ${sideEffect.updated.siteResourceId} after site approval:`,
+                        e
+                    );
+                });
+        }
+
+        return response(res, {
+            data: updatedSite ?? null,
+            success: true,
+            error: false,
+            message: "Site approved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/site/deleteSite.ts

@@ -159,15 +159,21 @@ export async function deleteSite(
             siteResources: []
         };
 
-        await db.transaction(async (trx) => {
+        if (deleteResources) {
-            if (deleteResources) {
+            await db.transaction(async (trx) => {
                 resourceSideEffects = await deleteAssociatedResourcesForSite(
                     siteId,
                     site.orgId,
                     trx
                 );
-            }
+            });
 
+            await runDeleteSiteAssociatedResourcesSideEffects(
+                resourceSideEffects
+            );
+        }
+
+        await db.transaction(async (trx) => {
             if (site.type == "wireguard") {
                 if (site.pubKey) {
                     await deletePeer(site.exitNodeId!, site.pubKey);
@@ -180,12 +186,6 @@ export async function deleteSite(
             await usageService.add(site.orgId, LimitId.SITES, -1, trx);
         });
 
-        if (deleteResources) {
-            await runDeleteSiteAssociatedResourcesSideEffects(
-                resourceSideEffects
-            );
-        }
-
         if (deletedNewt) {
             const payload = {
                 type: `newt/wg/terminate`,

server/routers/site/index.ts

@@ -3,6 +3,8 @@ export * from "./getStatusHistory";
 export * from "./createSite";
 export * from "./deleteSite";
 export * from "./updateSite";
+export * from "./approveSite";
+export * from "./rejectSite";
 export * from "./listSites";
 export * from "./listSiteRoles";
 export * from "./pickSiteDefaults";

server/routers/site/listSites.ts

@@ -177,7 +177,7 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/sites",
     description: "List all sites in an organization",
-    tags: [OpenAPITags.Site],
+    tags: [OpenAPITags.Org, OpenAPITags.Site],
     request: {
         params: listSitesParamsSchema,
         query: listSitesSchema

server/routers/site/rejectSite.ts

@@ -0,0 +1,178 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { newts, sites } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { deletePeer } from "../gerbil/peers";
+import { fromError } from "zod-validation-error";
+import { sendToClient } from "#dynamic/routers/ws";
+import { OpenAPITags, registry } from "@server/openApi";
+import { cleanupSiteAssociations } from "@server/lib/rebuildClientAssociations";
+import { usageService } from "@server/lib/billing/usageService";
+import { LimitId } from "@server/lib/billing";
+import {
+    deletePendingAssociatedResourcesForSite,
+    exceedsSiteAssociatedResourceDeleteLimit,
+    getPendingAssociatedResourceCountForSite,
+    runDeleteSiteAssociatedResourcesSideEffects,
+    MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE,
+    type DeleteSiteAssociatedResourcesSideEffects
+} from "@server/lib/deleteSiteAssociatedResources";
+
+const rejectSiteParamsSchema = z.strictObject({
+    siteId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/site/{siteId}/reject",
+    description:
+        "Reject a pending site by deleting it and any associated resources that are still pending.",
+    tags: [OpenAPITags.Site],
+    request: {
+        params: rejectSiteParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function rejectSite(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = rejectSiteParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { siteId } = parsedParams.data;
+
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, siteId))
+            .limit(1);
+
+        if (!site) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found`
+                )
+            );
+        }
+
+        if (!site.orgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Site with ID ${siteId} has no organization`
+                )
+            );
+        }
+
+        const pendingAssociatedResourceCount =
+            await getPendingAssociatedResourceCountForSite(siteId, site.orgId);
+
+        if (
+            exceedsSiteAssociatedResourceDeleteLimit(
+                pendingAssociatedResourceCount
+            )
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    `Cannot reject site and associated pending resources when the site has more than ${MAX_SITE_ASSOCIATED_RESOURCES_FOR_BULK_DELETE} pending resources`
+                )
+            );
+        }
+
+        const [deletedNewt] = await db
+            .select()
+            .from(newts)
+            .where(eq(newts.siteId, siteId))
+            .limit(1);
+
+        let resourceSideEffects: DeleteSiteAssociatedResourcesSideEffects = {
+            resources: [],
+            siteResources: []
+        };
+
+        await db.transaction(async (trx) => {
+            resourceSideEffects = await deletePendingAssociatedResourcesForSite(
+                siteId,
+                site.orgId,
+                trx
+            );
+        });
+
+        await runDeleteSiteAssociatedResourcesSideEffects(resourceSideEffects);
+
+        await db.transaction(async (trx) => {
+            if (site.type == "wireguard") {
+                if (site.pubKey) {
+                    await deletePeer(site.exitNodeId!, site.pubKey);
+                }
+            } else if (site.type == "newt") {
+                await cleanupSiteAssociations(site, trx);
+            }
+
+            await trx.delete(sites).where(eq(sites.siteId, siteId));
+            await usageService.add(site.orgId, LimitId.SITES, -1, trx);
+        });
+
+        if (deletedNewt) {
+            const payload = {
+                type: `newt/wg/terminate`,
+                data: {}
+            };
+            sendToClient(deletedNewt.newtId, payload).catch((error) => {
+                logger.error(
+                    "Failed to send termination message to newt:",
+                    error
+                );
+            });
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Site rejected successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/site/updateSite.ts

@@ -21,7 +21,6 @@ const updateSiteBodySchema = z
         name: z.string().min(1).max(255).optional(),
         niceId: z.string().min(1).max(255).optional(),
         dockerSocketEnabled: z.boolean().optional(),
-        status: z.enum(["pending", "approved"]).optional(),
         autoUpdateEnabled: z.boolean().optional(),
         autoUpdateOverrideOrg: z.boolean().optional()
     })

server/routers/siteResource/addClientToSiteResource.ts

@@ -31,40 +31,6 @@ const addClientToSiteResourceParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/clients/add",
-    description:
-        "Add a single client to a site resource. Clients with a userId cannot be added.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: addClientToSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addClientToSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/clients/add",
     description:
         "Add a single client to a site resource. Clients with a userId cannot be added.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],

server/routers/siteResource/addRoleToSiteResource.ts

@@ -33,39 +33,6 @@ registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/roles/add",
     description: "Add a single role to a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: addRoleToSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addRoleToSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/roles/add",
-    description: "Add a single role to a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
     request: {
         params: addRoleToSiteResourceParamsSchema,

server/routers/siteResource/addUserToSiteResource.ts

@@ -33,39 +33,6 @@ registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/users/add",
     description: "Add a single user to a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: addUserToSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: addUserToSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/users/add",
-    description: "Add a single user to a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
     request: {
         params: addUserToSiteResourceParamsSchema,

server/routers/siteResource/batchAddClientToSiteResources.ts

@@ -38,39 +38,6 @@ registry.registerPath({
     method: "post",
     path: "/client/{clientId}/site-resources",
     description: "Add a machine client to multiple site resources at once.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: batchAddClientToSiteResourcesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: batchAddClientToSiteResourcesBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/private-resources",
-    description: "Add a machine client to multiple site resources at once.",
     tags: [OpenAPITags.Client],
     request: {
         params: batchAddClientToSiteResourcesParamsSchema,

server/routers/siteResource/createSiteResource.ts

@@ -56,7 +56,6 @@ const createSiteResourceSchema = z
         siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
         destinationPort: z.int().positive().optional(),
         destination: z.string().min(1).nullish(),
-        enabled: z.boolean().default(true),
         alias: z
             .string()
             .regex(
@@ -208,39 +207,6 @@ registry.registerPath({
     method: "put",
     path: "/org/{orgId}/site-resource",
     description: "Create a new site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: createSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createSiteResourceSchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/private-resource",
-    description: "Create a new site resource.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: createSiteResourceParamsSchema,
@@ -308,7 +274,6 @@ export async function createSiteResource(
             scheme,
             destinationPort,
             destination,
-            enabled,
             ssl,
             alias,
             userIds,
@@ -572,7 +537,6 @@ export async function createSiteResource(
                     destination: destination, // the ssh can be null
                     scheme,
                     destinationPort,
-                    enabled,
                     alias: alias ? alias.trim() : null,
                     aliasAddress,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,

server/routers/siteResource/deleteSiteResource.ts

@@ -27,32 +27,6 @@ registry.registerPath({
     method: "delete",
     path: "/site-resource/{siteResourceId}",
     description: "Delete a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: deleteSiteResourceParamsSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/private-resource/{siteResourceId}",
-    description: "Delete a site resource.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: deleteSiteResourceParamsSchema

server/routers/siteResource/getSiteResource.ts

@@ -57,36 +57,6 @@ registry.registerPath({
     method: "get",
     path: "/site-resource/{siteResourceId}",
     description: "Get a specific site resource by siteResourceId.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: z.object({
-            siteResourceId: z.number(),
-            siteId: z.number(),
-            orgId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/private-resource/{siteResourceId}",
-    description: "Get a specific site resource by siteResourceId.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: z.object({

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -86,6 +86,15 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
         description:
             "When set, only site resources associated with this site (via network) are returned"
     }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
+        }),
     labels: z
         .preprocess((val) => {
             if (val === undefined || val === null || val === "") {
@@ -221,33 +230,6 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/site-resources",
     description: "List all site resources for an organization.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: listAllSiteResourcesByOrgParamsSchema,
-        query: listAllSiteResourcesByOrgQuerySchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/private-resources",
-    description: "List all site resources for an organization.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: listAllSiteResourcesByOrgParamsSchema,
@@ -310,6 +292,7 @@ export async function listAllSiteResourcesByOrg(
             sort_by,
             order,
             siteId,
+            status,
             labels: labelFilter
         } = parsedQuery.data;
 
@@ -342,6 +325,10 @@ export async function listAllSiteResourcesByOrg(
             conditions.push(eq(siteResources.mode, mode));
         }
 
+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
         if (labelFilter && labelFilter.length > 0) {
             conditions.push(
                 inArray(

server/routers/siteResource/listSiteResourceClients.ts

@@ -39,32 +39,6 @@ registry.registerPath({
     method: "get",
     path: "/site-resource/{siteResourceId}/clients",
     description: "List all clients for a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: listSiteResourceClientsSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/private-resource/{siteResourceId}/clients",
-    description: "List all clients for a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],
     request: {
         params: listSiteResourceClientsSchema

server/routers/siteResource/listSiteResourceRoles.ts

@@ -40,32 +40,6 @@ registry.registerPath({
     method: "get",
     path: "/site-resource/{siteResourceId}/roles",
     description: "List all roles for a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: listSiteResourceRolesSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/private-resource/{siteResourceId}/roles",
-    description: "List all roles for a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
     request: {
         params: listSiteResourceRolesSchema

server/routers/siteResource/listSiteResourceUsers.ts

@@ -43,32 +43,6 @@ registry.registerPath({
     method: "get",
     path: "/site-resource/{siteResourceId}/users",
     description: "List all users for a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: listSiteResourceUsersSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/private-resource/{siteResourceId}/users",
-    description: "List all users for a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
     request: {
         params: listSiteResourceUsersSchema

server/routers/siteResource/listSiteResources.ts

@@ -47,6 +47,15 @@ const listSiteResourcesQuerySchema = z.strictObject({
             enum: ["asc", "desc"],
             default: "asc",
             description: "Sort order"
+        }),
+    status: z
+        .enum(["pending", "approved"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["pending", "approved"],
+            description: "Filter by site resource status"
         })
 });
 
@@ -58,33 +67,6 @@ registry.registerPath({
     method: "get",
     path: "/org/{orgId}/site/{siteId}/resources",
     description: "List site resources for a site.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: listSiteResourcesParamsSchema,
-        query: listSiteResourcesQuerySchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/site/{siteId}/private-resources",
-    description: "List site resources for a site.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: listSiteResourcesParamsSchema,
@@ -137,7 +119,7 @@ export async function listSiteResources(
         }
 
         const { siteId, orgId } = parsedParams.data;
-        const { limit, offset, sort_by, order } = parsedQuery.data;
+        const { limit, offset, sort_by, order, status } = parsedQuery.data;
 
         // Verify the site exists and belongs to the org
         const site = await db
@@ -151,6 +133,15 @@ export async function listSiteResources(
         }
 
         // Get site resources by joining networks to siteResources via siteNetworks
+        const conditions = [
+            eq(siteNetworks.siteId, siteId),
+            eq(siteResources.orgId, orgId)
+        ];
+
+        if (typeof status !== "undefined") {
+            conditions.push(eq(siteResources.status, status));
+        }
+
         const siteResourcesList = await db
             .select()
             .from(siteNetworks)
@@ -159,12 +150,7 @@ export async function listSiteResources(
                 siteResources,
                 eq(siteResources.networkId, networks.networkId)
             )
-            .where(
+            .where(and(...conditions))
-                and(
-                    eq(siteNetworks.siteId, siteId),
-                    eq(siteResources.orgId, orgId)
-                )
-            )
             .orderBy(
                 sort_by
                     ? order === "asc"

server/routers/siteResource/removeClientFromSiteResource.ts

@@ -31,40 +31,6 @@ const removeClientFromSiteResourceParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/clients/remove",
-    description:
-        "Remove a single client from a site resource. Clients with a userId cannot be removed.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: removeClientFromSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeClientFromSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/clients/remove",
     description:
         "Remove a single client from a site resource. Clients with a userId cannot be removed.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],

server/routers/siteResource/removeRoleFromSiteResource.ts

@@ -33,39 +33,6 @@ registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/roles/remove",
     description: "Remove a single role from a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: removeRoleFromSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeRoleFromSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/roles/remove",
-    description: "Remove a single role from a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],
     request: {
         params: removeRoleFromSiteResourceParamsSchema,

server/routers/siteResource/removeUserFromSiteResource.ts

@@ -33,39 +33,6 @@ registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/users/remove",
     description: "Remove a single user from a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: removeUserFromSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: removeUserFromSiteResourceBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/users/remove",
-    description: "Remove a single user from a site resource.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.User],
     request: {
         params: removeUserFromSiteResourceParamsSchema,

server/routers/siteResource/setSiteResourceClients.ts

@@ -31,40 +31,6 @@ const setSiteResourceClientsParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/clients",
-    description:
-        "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: setSiteResourceClientsParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setSiteResourceClientsBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/clients",
     description:
         "Set clients for a site resource. This will replace all existing clients. Clients with a userId cannot be added.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Client],

server/routers/siteResource/setSiteResourceRoles.ts

@@ -32,40 +32,6 @@ const setSiteResourceRolesParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/roles",
-    description:
-        "Set roles for a site resource. This will replace all existing roles.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: setSiteResourceRolesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setSiteResourceRolesBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/roles",
     description:
         "Set roles for a site resource. This will replace all existing roles.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.Role],

server/routers/siteResource/setSiteResourceUsers.ts

@@ -33,40 +33,6 @@ const setSiteResourceUsersParamsSchema = z
 registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}/users",
-    description:
-        "Set users for a site resource. This will replace all existing users.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: setSiteResourceUsersParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setSiteResourceUsersBodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}/users",
     description:
         "Set users for a site resource. This will replace all existing users.",
     tags: [OpenAPITags.PrivateResource, OpenAPITags.User],

server/routers/siteResource/updateSiteResource.ts

@@ -152,6 +152,11 @@ const updateSiteResourceSchema = z
     )
     .refine(
         (data) => {
+            // this is a partial update; only enforce destination when the
+            // caller is actually changing mode or destination
+            if (data.mode === undefined && data.destination === undefined) {
+                return true;
+            }
             // destination is only optional for ssh mode with native authDaemonMode
             if (data.mode === "ssh" && data.authDaemonMode === "native") {
                 return true;
@@ -208,39 +213,6 @@ registry.registerPath({
     method: "post",
     path: "/site-resource/{siteResourceId}",
     description: "Update a site resource.",
-    tags: [OpenAPITags.PrivateResourceLegacy],
-    request: {
-        params: updateSiteResourceParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateSiteResourceSchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/private-resource/{siteResourceId}",
-    description: "Update a site resource.",
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: updateSiteResourceParamsSchema,
@@ -444,8 +416,10 @@ export async function updateSiteResource(
             : [];
         const existingSiteIds = existingSiteNetworks.map((sn) => sn.siteId);
 
-        let fullDomain: string | null = null;
+        // undefined means "leave unchanged" (partial update); only nulled out
-        let finalSubdomain: string | null = null;
+        // when the mode is explicitly being changed away from http
+        let fullDomain: string | null | undefined = undefined;
+        let finalSubdomain: string | null | undefined = undefined;
         if (domainId) {
             // Validate domain and construct full domain
             const domainResult = await validateAndConstructDomain(
@@ -481,6 +455,11 @@ export async function updateSiteResource(
                     )
                 );
             }
+        } else if (mode !== undefined && mode !== "http") {
+            // mode is explicitly changing away from http, so the resource
+            // can no longer have a domain associated with it
+            fullDomain = null;
+            finalSubdomain = null;
         }
 
         // make sure the alias is unique within the org if provided
@@ -549,15 +528,28 @@ export async function updateSiteResource(
                     destination: destination,
                     destinationPort: destinationPort,
                     enabled: enabled,
-                    alias: alias ? alias.trim() : null,
+                    alias:
+                        alias !== undefined
+                            ? alias
+                                ? alias.trim()
+                                : null
+                            : mode !== undefined &&
+                                mode !== "host" &&
+                                mode !== "ssh"
+                              ? null
+                              : undefined,
                     tcpPortRangeString: tcpPortRangeStringAdjusted,
                     udpPortRangeString:
                         mode == "http" || mode == "ssh"
                             ? ""
                             : udpPortRangeString,
                     disableIcmp:
-                        disableIcmp ||
+                        mode !== undefined
-                        (mode == "http" || mode == "ssh" ? true : false),
+                            ? disableIcmp ||
+                              (mode == "http" || mode == "ssh"
+                                  ? true
+                                  : false)
+                            : disableIcmp,
                     domainId,
                     subdomain: finalSubdomain,
                     fullDomain,

server/routers/target/createTarget.ts

@@ -93,39 +93,6 @@ registry.registerPath({
     method: "put",
     path: "/resource/{resourceId}/target",
     description: "Create a target for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: createTargetParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createTargetSchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/public-resource/{resourceId}/target",
-    description: "Create a target for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
     request: {
         params: createTargetParamsSchema,

server/routers/target/listTargets.ts

@@ -92,33 +92,6 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/targets",
     description: "List targets for a resource.",
-    tags: [OpenAPITags.PublicResourceLegacy],
-    request: {
-        params: listTargetsParamsSchema,
-        query: listTargetsSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response",
-            content: {
-                "application/json": {
-                    schema: z.object({
-                        data: z.record(z.string(), z.any()).nullable(),
-                        success: z.boolean(),
-                        error: z.boolean(),
-                        message: z.string(),
-                        status: z.number()
-                    })
-                }
-            }
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/public-resource/{resourceId}/targets",
-    description: "List targets for a resource.",
     tags: [OpenAPITags.PublicResource, OpenAPITags.Target],
     request: {
         params: listTargetsParamsSchema,