dont fingerprint machine clients

Ref #2222

.github/workflows/cicd.yml

@@ -62,7 +62,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Monitor storage space
               run: |
@@ -134,7 +134,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Monitor storage space
               run: |
@@ -201,7 +201,7 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Log in to Docker Hub
               uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -256,7 +256,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Extract tag name
               id: get-tag

.github/workflows/linting.yml

@@ -21,7 +21,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Set up Node.js
               uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0

.github/workflows/saas.yml

@@ -54,7 +54,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
             - name: Monitor storage space
               run: |

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Install Node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Build Docker image sqlite
         run: make dev-build-sqlite
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Build Docker image pg
         run: make dev-build-pg

messages/de-DE.json

@@ -97,7 +97,7 @@
     "siteGeneralDescription": "Allgemeine Einstellungen für diesen Standort konfigurieren",
     "siteSettingDescription": "Standorteinstellungen konfigurieren",
     "siteSetting": "{siteName} Einstellungen",
-    "siteNewtTunnel": "Newt Standort (empfohlen)",
+    "siteNewtTunnel": "Neuer Standort (empfohlen)",
     "siteNewtTunnelDescription": "Einfachster Weg, einen Einstiegspunkt in jedes Netzwerk zu erstellen. Keine zusätzliche Einrichtung.",
     "siteWg": "Einfacher WireGuard Tunnel",
     "siteWgDescription": "Verwende jeden WireGuard-Client, um einen Tunnel einzurichten. Manuelles NAT-Setup erforderlich.",
@@ -107,7 +107,7 @@
     "siteSeeAll": "Alle Standorte anzeigen",
     "siteTunnelDescription": "Legen Sie fest, wie Sie sich mit dem Standort verbinden möchten",
     "siteNewtCredentials": "Zugangsdaten",
-    "siteNewtCredentialsDescription": "So wird sich der Standort mit dem Server authentifizieren",
+    "siteNewtCredentialsDescription": "So wird sich die Seite mit dem Server authentifizieren",
     "remoteNodeCredentialsDescription": "So wird sich der entfernte Node mit dem Server authentifizieren",
     "siteCredentialsSave": "Anmeldedaten speichern",
     "siteCredentialsSaveDescription": "Du kannst das nur einmal sehen. Stelle sicher, dass du es an einen sicheren Ort kopierst.",
@@ -2503,7 +2503,7 @@
     "deviceModel": "Gerätemodell",
     "serialNumber": "Seriennummer",
     "hostname": "Hostname",
-    "firstSeen": "Zuerst gesehen",
+    "firstSeen": "Erster Blick",
     "lastSeen": "Zuletzt gesehen",
     "biometricsEnabled": "Biometrie aktiviert",
     "diskEncrypted": "Festplatte verschlüsselt",

messages/en-US.json

@@ -55,7 +55,7 @@
     "siteDescription": "Create and manage sites to enable connectivity to private networks",
     "sitesBannerTitle": "Connect Any Network",
     "sitesBannerDescription": "A site is a connection to a remote network that allows Pangolin to provide access to resources, whether public or private, to users anywhere. Install the site network connector (Newt) anywhere you can run a binary or container to establish the connection.",
-    "sitesBannerButtonText": "Install Site",
+    "sitesBannerButtonText": "Install Site Connector",
     "approvalsBannerTitle": "Approve or Deny Device Access",
     "approvalsBannerDescription": "Review and approve or deny device access requests from users. When device approvals are required, users must get admin approval before their devices can connect to your organization's resources.",
     "approvalsBannerButtonText": "Learn More",
@@ -79,8 +79,8 @@
     "siteConfirmCopy": "I have copied the config",
     "searchSitesProgress": "Search sites...",
     "siteAdd": "Add Site",
-    "siteInstallNewt": "Install Newt",
+    "siteInstallNewt": "Install Site",
-    "siteInstallNewtDescription": "Get Newt running on your system",
+    "siteInstallNewtDescription": "Install the site connector for your system",
     "WgConfiguration": "WireGuard Configuration",
     "WgConfigurationDescription": "Use the following configuration to connect to the network",
     "operatingSystem": "Operating System",
@@ -1545,8 +1545,8 @@
     "addressDescription": "The internal address of the client. Must fall within the organization's subnet.",
     "selectSites": "Select sites",
     "sitesDescription": "The client will have connectivity to the selected sites",
-    "clientInstallOlm": "Install Olm",
+    "clientInstallOlm": "Install Machine Client",
-    "clientInstallOlmDescription": "Get Olm running on your system",
+    "clientInstallOlmDescription": "Install the machine client for your system",
     "clientOlmCredentials": "Credentials",
     "clientOlmCredentialsDescription": "This is how the client will authenticate with the server",
     "olmEndpoint": "Endpoint",
@@ -2247,6 +2247,7 @@
     "actionLogsDescription": "View a history of actions performed in this organization",
     "accessLogsDescription": "View access auth requests for resources in this organization",
     "licenseRequiredToUse": "An Enterprise license is required to use this feature.",
+    "ossEnterpriseEditionRequired": "The <enterpriseEditionLink>Enterprise Edition</enterpriseEditionLink> is required to use this feature.",
     "certResolver": "Certificate Resolver",
     "certResolverDescription": "Select the certificate resolver to use for this resource.",
     "selectCertResolver": "Select Certificate Resolver",

server/routers/badger/logRequestAudit.ts

@@ -1,6 +1,6 @@
 import { db, orgs, requestAuditLog } from "@server/db";
 import logger from "@server/logger";
-import { and, eq, lt } from "drizzle-orm";
+import { and, eq, lt, sql } from "drizzle-orm";
 import cache from "@server/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { stripPortFromHost } from "@server/lib/ip";
@@ -67,17 +67,27 @@ async function flushAuditLogs() {
     const logsToWrite = auditLogBuffer.splice(0, auditLogBuffer.length);
 
     try {
-        // Batch insert logs in groups of 25 to avoid overwhelming the database
+        // Use a transaction to ensure all inserts succeed or fail together
-        const BATCH_DB_SIZE = 25;
+        // This prevents index corruption from partial writes
-        for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
+        await db.transaction(async (tx) => {
-            const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
+            // Batch insert logs in groups of 25 to avoid overwhelming the database
-            await db.insert(requestAuditLog).values(batch);
+            const BATCH_DB_SIZE = 25;
-        }
+            for (let i = 0; i < logsToWrite.length; i += BATCH_DB_SIZE) {
+                const batch = logsToWrite.slice(i, i + BATCH_DB_SIZE);
+                await tx.insert(requestAuditLog).values(batch);
+            }
+        });
         logger.debug(`Flushed ${logsToWrite.length} audit logs to database`);
     } catch (error) {
         logger.error("Error flushing audit logs:", error);
-        // On error, we lose these logs - consider a fallback strategy if needed
+        // On transaction error, put logs back at the front of the buffer to retry
-        // (e.g., write to file, or put back in buffer with retry limit)
+        // but only if buffer isn't too large
+        if (auditLogBuffer.length < MAX_BUFFER_SIZE - logsToWrite.length) {
+            auditLogBuffer.unshift(...logsToWrite);
+            logger.info(`Re-queued ${logsToWrite.length} audit logs for retry`);
+        } else {
+            logger.error(`Buffer full, dropped ${logsToWrite.length} audit logs`);
+        }
     } finally {
         isFlushInProgress = false;
         // If buffer filled up while we were flushing, flush again

server/routers/client/getClient.ts

@@ -56,19 +56,29 @@ async function query(clientId?: number, niceId?: string, orgId?: string) {
 }
 
 type PostureData = {
-    biometricsEnabled?: boolean | null;
+    biometricsEnabled?: boolean | null | "-";
-    diskEncrypted?: boolean | null;
+    diskEncrypted?: boolean | null | "-";
-    firewallEnabled?: boolean | null;
+    firewallEnabled?: boolean | null | "-";
-    autoUpdatesEnabled?: boolean | null;
+    autoUpdatesEnabled?: boolean | null | "-";
-    tpmAvailable?: boolean | null;
+    tpmAvailable?: boolean | null | "-";
-    windowsAntivirusEnabled?: boolean | null;
+    windowsAntivirusEnabled?: boolean | null | "-";
-    macosSipEnabled?: boolean | null;
+    macosSipEnabled?: boolean | null | "-";
-    macosGatekeeperEnabled?: boolean | null;
+    macosGatekeeperEnabled?: boolean | null | "-";
-    macosFirewallStealthMode?: boolean | null;
+    macosFirewallStealthMode?: boolean | null | "-";
-    linuxAppArmorEnabled?: boolean | null;
+    linuxAppArmorEnabled?: boolean | null | "-";
-    linuxSELinuxEnabled?: boolean | null;
+    linuxSELinuxEnabled?: boolean | null | "-";
 };
 
+function maskPostureDataWithPlaceholder(posture: PostureData): PostureData {
+    const masked: PostureData = {};
+    for (const key of Object.keys(posture) as (keyof PostureData)[]) {
+        if (posture[key] !== undefined && posture[key] !== null) {
+            (masked as Record<keyof PostureData, "-">)[key] = "-";
+        }
+    }
+    return masked;
+}
+
 function getPlatformPostureData(
     platform: string | null | undefined,
     fingerprint: typeof currentFingerprint.$inferSelect | null
@@ -284,9 +294,11 @@ export async function getClient(
             );
         }
 
+        const isUserDevice = client.user !== null && client.user !== undefined;
+
         // Replace name with device name if OLM exists
         let clientName = client.clients.name;
-        if (client.olms) {
+        if (client.olms && isUserDevice) {
             const model = client.currentFingerprint?.deviceModel || null;
             clientName = getUserDeviceName(model, client.clients.name);
         }
@@ -294,32 +306,34 @@ export async function getClient(
         // Build fingerprint data if available
         const fingerprintData = client.currentFingerprint
             ? {
-                  username: client.currentFingerprint.username || null,
+                username: client.currentFingerprint.username || null,
-                  hostname: client.currentFingerprint.hostname || null,
+                hostname: client.currentFingerprint.hostname || null,
-                  platform: client.currentFingerprint.platform || null,
+                platform: client.currentFingerprint.platform || null,
-                  osVersion: client.currentFingerprint.osVersion || null,
+                osVersion: client.currentFingerprint.osVersion || null,
-                  kernelVersion:
+                kernelVersion:
-                      client.currentFingerprint.kernelVersion || null,
+                    client.currentFingerprint.kernelVersion || null,
-                  arch: client.currentFingerprint.arch || null,
+                arch: client.currentFingerprint.arch || null,
-                  deviceModel: client.currentFingerprint.deviceModel || null,
+                deviceModel: client.currentFingerprint.deviceModel || null,
-                  serialNumber: client.currentFingerprint.serialNumber || null,
+                serialNumber: client.currentFingerprint.serialNumber || null,
-                  firstSeen: client.currentFingerprint.firstSeen || null,
+                firstSeen: client.currentFingerprint.firstSeen || null,
-                  lastSeen: client.currentFingerprint.lastSeen || null
+                lastSeen: client.currentFingerprint.lastSeen || null
-              }
+            }
             : null;
 
         // Build posture data if available (platform-specific)
-        // Only return posture data if org is licensed/subscribed
+        // Licensed: real values; not licensed: same keys but values set to "-"
-        let postureData: PostureData | null = null;
+        const rawPosture = getPlatformPostureData(
+            client.currentFingerprint?.platform || null,
+            client.currentFingerprint
+        );
         const isOrgLicensed = await isLicensedOrSubscribed(
             client.clients.orgId
         );
-        if (isOrgLicensed) {
+        const postureData: PostureData | null = rawPosture
-            postureData = getPlatformPostureData(
+            ? isOrgLicensed
-                client.currentFingerprint?.platform || null,
+                ? rawPosture
-                client.currentFingerprint
+                : maskPostureDataWithPlaceholder(rawPosture)
-            );
+            : null;
-        }
 
         const data: GetClientResponse = {
             ...client.clients,

server/routers/client/listClients.ts

@@ -320,7 +320,10 @@ export async function listClients(
         // Merge clients with their site associations and replace name with device name
         const clientsWithSites = clientsList.map((client) => {
             const model = client.deviceModel || null;
-            const newName = getUserDeviceName(model, client.name);
+            let newName = client.name;
+            if (filter === "user") {
+                newName = getUserDeviceName(model, client.name);
+            }
             return {
                 ...client,
                 name: newName,

server/routers/olm/handleOlmPingMessage.ts

@@ -117,6 +117,8 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
         return;
     }
 
+    const isUserDevice = olm.userId !== null && olm.userId !== undefined;
+
     try {
         // get the client
         const [client] = await db
@@ -219,7 +221,9 @@ export const handleOlmPingMessage: MessageHandler = async (context) => {
         logger.error("Error handling ping message", { error });
     }
 
-    await handleFingerprintInsertion(olm, fingerprint, postures);
+    if (isUserDevice) {
+        await handleFingerprintInsertion(olm, fingerprint, postures);
+    }
 
     return {
         message: {

server/routers/olm/handleOlmRegisterMessage.ts

@@ -53,7 +53,11 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         postures
     });
 
-    await handleFingerprintInsertion(olm, fingerprint, postures);
+    const isUserDevice = olm.userId !== null && olm.userId !== undefined;
+
+    if (isUserDevice) {
+        await handleFingerprintInsertion(olm, fingerprint, postures);
+    }
 
     if (
         (olmVersion && olm.version !== olmVersion) ||

server/routers/site/createSite.ts

@@ -17,6 +17,7 @@ import { hashPassword } from "@server/auth/password";
 import { isValidIP } from "@server/lib/validators";
 import { isIpInCidr } from "@server/lib/ip";
 import { verifyExitNodeOrgAccess } from "#dynamic/lib/exitNodes";
+import { build } from "@server/build";
 
 const createSiteParamsSchema = z.strictObject({
     orgId: z.string()
@@ -258,19 +259,7 @@ export async function createSite(
         let newSite: Site;
 
         await db.transaction(async (trx) => {
-            if (type == "newt") {
+            if (type == "wireguard" || type == "newt") {
-                [newSite] = await trx
-                    .insert(sites)
-                    .values({
-                        orgId,
-                        name,
-                        niceId,
-                        address: updatedAddress || null,
-                        type,
-                        dockerSocketEnabled: true
-                    })
-                    .returning();
-            } else if (type == "wireguard") {
                 // we are creating a site with an exit node (tunneled)
                 if (!subnet) {
                     return next(
@@ -322,9 +311,11 @@ export async function createSite(
                         exitNodeId,
                         name,
                         niceId,
+                        address: updatedAddress || null,
                         subnet,
                         type,
-                        pubKey: pubKey || null
+                        dockerSocketEnabled: type == "newt",
+                        ...(pubKey && type == "wireguard" && { pubKey })
                     })
                     .returning();
             } else if (type == "local") {

src/app/[orgId]/settings/(private)/idp/create/page.tsx

@@ -27,6 +27,7 @@ import {
 import { Input } from "@app/components/ui/input";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -51,6 +52,7 @@ export default function Page() {
     >("role");
     const { isUnlocked } = useLicenseStatusContext();
     const t = useTranslations();
+    const { isPaidUser } = usePaidStatus();
 
     const params = useParams();
 
@@ -806,7 +808,7 @@ export default function Page() {
                 </Button>
                 <Button
                     type="submit"
-                    disabled={createLoading}
+                    disabled={createLoading || !isPaidUser}
                     loading={createLoading}
                     onClick={() => {
                         // log any issues with the form

src/app/[orgId]/settings/(private)/idp/layout.tsx

@@ -1,18 +1,8 @@
-import { pullEnv } from "@app/lib/pullEnv";
-import { build } from "@server/build";
-import { redirect } from "next/navigation";
-
 interface LayoutProps {
     children: React.ReactNode;
     params: Promise<{}>;
 }
 
 export default async function Layout(props: LayoutProps) {
-    const env = pullEnv();
-
-    if (build !== "saas" && !env.flags.useOrgOnlyIdp) {
-        redirect("/");
-    }
-
     return props.children;
 }

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/credentials/page.tsx

@@ -195,29 +195,27 @@ export default function CredentialsPage() {
                             </Alert>
                         )}
                     </SettingsSectionBody>
-                    {build !== "oss" && (
+                    <SettingsSectionFooter>
-                        <SettingsSectionFooter>
+                        <Button
-                            <Button
+                            variant="outline"
-                                variant="outline"
+                            onClick={() => {
-                                onClick={() => {
+                                setShouldDisconnect(false);
-                                    setShouldDisconnect(false);
+                                setModalOpen(true);
-                                    setModalOpen(true);
+                            }}
-                                }}
+                            disabled={isSecurityFeatureDisabled()}
-                                disabled={isSecurityFeatureDisabled()}
+                        >
-                            >
+                            {t("regenerateCredentialsButton")}
-                                {t("regenerateCredentialsButton")}
+                        </Button>
-                            </Button>
+                        <Button
-                            <Button
+                            onClick={() => {
-                                onClick={() => {
+                                setShouldDisconnect(true);
-                                    setShouldDisconnect(true);
+                                setModalOpen(true);
-                                    setModalOpen(true);
+                            }}
-                                }}
+                            disabled={isSecurityFeatureDisabled()}
-                                disabled={isSecurityFeatureDisabled()}
+                        >
-                            >
+                            {t("remoteExitNodeRegenerateAndDisconnect")}
-                                {t("remoteExitNodeRegenerateAndDisconnect")}
+                        </Button>
-                            </Button>
+                    </SettingsSectionFooter>
-                        </SettingsSectionFooter>
-                    )}
                 </SettingsSection>
             </SettingsContainer>
 

src/app/[orgId]/settings/clients/machine/[niceId]/credentials/page.tsx

@@ -61,7 +61,9 @@ export default function CredentialsPage() {
         const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
         const isSaasNotSubscribed =
             build === "saas" && !subscription?.isSubscribed();
-        return isEnterpriseNotLicensed || isSaasNotSubscribed;
+        return (
+            isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss"
+        );
     };
 
     const handleConfirmRegenerate = async () => {
@@ -181,29 +183,27 @@ export default function CredentialsPage() {
                             </Alert>
                         )}
                     </SettingsSectionBody>
-                    {build !== "oss" && (
+                    <SettingsSectionFooter>
-                        <SettingsSectionFooter>
+                        <Button
-                            <Button
+                            variant="outline"
-                                variant="outline"
+                            onClick={() => {
-                                onClick={() => {
+                                setShouldDisconnect(false);
-                                    setShouldDisconnect(false);
+                                setModalOpen(true);
-                                    setModalOpen(true);
+                            }}
-                                }}
+                            disabled={isSecurityFeatureDisabled()}
-                                disabled={isSecurityFeatureDisabled()}
+                        >
-                            >
+                            {t("regenerateCredentialsButton")}
-                                {t("regenerateCredentialsButton")}
+                        </Button>
-                            </Button>
+                        <Button
-                            <Button
+                            onClick={() => {
-                                onClick={() => {
+                                setShouldDisconnect(true);
-                                    setShouldDisconnect(true);
+                                setModalOpen(true);
-                                    setModalOpen(true);
+                            }}
-                                }}
+                            disabled={isSecurityFeatureDisabled()}
-                                disabled={isSecurityFeatureDisabled()}
+                        >
-                            >
+                            {t("clientRegenerateAndDisconnect")}
-                                {t("clientRegenerateAndDisconnect")}
+                        </Button>
-                            </Button>
+                    </SettingsSectionFooter>
-                        </SettingsSectionFooter>
-                    )}
                 </SettingsSection>
 
                 <OlmInstallCommands

src/app/[orgId]/settings/clients/user/[niceId]/general/page.tsx

@@ -28,7 +28,15 @@ import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { toast } from "@app/hooks/useToast";
 import { useRouter } from "next/navigation";
 import { useState, useEffect, useTransition } from "react";
-import { Check, Ban, Shield, ShieldOff, Clock, CheckCircle2, XCircle } from "lucide-react";
+import {
+    Check,
+    Ban,
+    Shield,
+    ShieldOff,
+    Clock,
+    CheckCircle2,
+    XCircle
+} from "lucide-react";
 import { useParams } from "next/navigation";
 import { FaApple, FaWindows, FaLinux } from "react-icons/fa";
 import { SiAndroid } from "react-icons/si";
@@ -111,13 +119,13 @@ function getPlatformFieldConfig(
             osVersion: { show: true, labelKey: "iosVersion" },
             kernelVersion: { show: false, labelKey: "kernelVersion" },
             arch: { show: true, labelKey: "architecture" },
-            deviceModel: { show: true, labelKey: "deviceModel" },
+            deviceModel: { show: true, labelKey: "deviceModel" }
         },
         android: {
             osVersion: { show: true, labelKey: "androidVersion" },
             kernelVersion: { show: true, labelKey: "kernelVersion" },
             arch: { show: true, labelKey: "architecture" },
-            deviceModel: { show: true, labelKey: "deviceModel" },
+            deviceModel: { show: true, labelKey: "deviceModel" }
         },
         unknown: {
             osVersion: { show: true, labelKey: "osVersion" },
@@ -133,7 +141,6 @@ function getPlatformFieldConfig(
     return configs[normalizedPlatform] || configs.unknown;
 }
 
-
 export default function GeneralPage() {
     const { client, updateClient } = useClientContext();
     const { isPaidUser } = usePaidStatus();
@@ -423,7 +430,8 @@ export default function GeneralPage() {
                                                         {t(
                                                             fieldConfig
                                                                 .osVersion
-                                                                ?.labelKey || "osVersion"
+                                                                ?.labelKey ||
+                                                                "osVersion"
                                                         )}
                                                     </InfoSectionTitle>
                                                     <InfoSectionContent>
@@ -559,217 +567,231 @@ export default function GeneralPage() {
                 </SettingsSection>
             )}
 
-            {/* Device Security Section */}
+            <SettingsSection>
-            {build !== "oss" && (
+                <SettingsSectionHeader>
-                <SettingsSection>
+                    <SettingsSectionTitle>
-                    <SettingsSectionHeader>
+                        {t("deviceSecurity")}
-                        <SettingsSectionTitle>
+                    </SettingsSectionTitle>
-                            {t("deviceSecurity")}
+                    <SettingsSectionDescription>
-                        </SettingsSectionTitle>
+                        {t("deviceSecurityDescription")}
-                        <SettingsSectionDescription>
+                    </SettingsSectionDescription>
-                            {t("deviceSecurityDescription")}
+                </SettingsSectionHeader>
-                        </SettingsSectionDescription>
-                    </SettingsSectionHeader>
 
-                    <SettingsSectionBody>
+                <SettingsSectionBody>
-                        {client.posture && Object.keys(client.posture).length > 0 ? (
+                    <PaidFeaturesAlert />
-                            <>
+                    {client.posture &&
-                                {!isPaidUser && <PaidFeaturesAlert />}
+                    Object.keys(client.posture).length > 0 ? (
-                                <InfoSections cols={3}>
+                        <>
-                                    {client.posture.biometricsEnabled !== null &&
+                            <InfoSections cols={3}>
-                                        client.posture.biometricsEnabled !== undefined && (
+                                {client.posture.biometricsEnabled !== null &&
-                                            <InfoSection>
+                                    client.posture.biometricsEnabled !==
-                                                <InfoSectionTitle>
+                                        undefined && (
-                                                    {t("biometricsEnabled")}
+                                        <InfoSection>
-                                                </InfoSectionTitle>
+                                            <InfoSectionTitle>
-                                                <InfoSectionContent>
+                                                {t("biometricsEnabled")}
-                                                    {isPaidUser
+                                            </InfoSectionTitle>
-                                                        ? formatPostureValue(
+                                            <InfoSectionContent>
-                                                              client.posture.biometricsEnabled
+                                                {isPaidUser
-                                                          )
+                                                    ? formatPostureValue(
-                                                        : "-"}
+                                                          client.posture
-                                                </InfoSectionContent>
+                                                              .biometricsEnabled
-                                            </InfoSection>
+                                                      )
-                                        )}
+                                                    : "-"}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.diskEncrypted !== null &&
+                                {client.posture.diskEncrypted !== null &&
-                                        client.posture.diskEncrypted !== undefined && (
+                                    client.posture.diskEncrypted !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("diskEncrypted")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("diskEncrypted")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture.diskEncrypted
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .diskEncrypted
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.firewallEnabled !== null &&
+                                {client.posture.firewallEnabled !== null &&
-                                        client.posture.firewallEnabled !== undefined && (
+                                    client.posture.firewallEnabled !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("firewallEnabled")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("firewallEnabled")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture.firewallEnabled
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .firewallEnabled
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.autoUpdatesEnabled !== null &&
+                                {client.posture.autoUpdatesEnabled !== null &&
-                                        client.posture.autoUpdatesEnabled !== undefined && (
+                                    client.posture.autoUpdatesEnabled !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("autoUpdatesEnabled")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("autoUpdatesEnabled")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture.autoUpdatesEnabled
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .autoUpdatesEnabled
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.tpmAvailable !== null &&
+                                {client.posture.tpmAvailable !== null &&
-                                        client.posture.tpmAvailable !== undefined && (
+                                    client.posture.tpmAvailable !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("tpmAvailable")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("tpmAvailable")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture.tpmAvailable
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .tpmAvailable
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.windowsAntivirusEnabled !== null &&
+                                {client.posture.windowsAntivirusEnabled !==
-                                        client.posture.windowsAntivirusEnabled !== undefined && (
+                                    null &&
-                                            <InfoSection>
+                                    client.posture.windowsAntivirusEnabled !==
-                                                <InfoSectionTitle>
+                                        undefined && (
-                                                    {t("windowsAntivirusEnabled")}
+                                        <InfoSection>
-                                                </InfoSectionTitle>
+                                            <InfoSectionTitle>
-                                                <InfoSectionContent>
+                                                {t("windowsAntivirusEnabled")}
-                                                    {isPaidUser
+                                            </InfoSectionTitle>
-                                                        ? formatPostureValue(
+                                            <InfoSectionContent>
-                                                              client.posture
+                                                {isPaidUser
-                                                                  .windowsAntivirusEnabled
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .windowsAntivirusEnabled
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.macosSipEnabled !== null &&
+                                {client.posture.macosSipEnabled !== null &&
-                                        client.posture.macosSipEnabled !== undefined && (
+                                    client.posture.macosSipEnabled !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("macosSipEnabled")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("macosSipEnabled")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture.macosSipEnabled
+                                                    ? formatPostureValue(
-                                                          )
+                                                          client.posture
-                                                        : "-"}
+                                                              .macosSipEnabled
-                                                </InfoSectionContent>
+                                                      )
-                                            </InfoSection>
+                                                    : "-"}
-                                        )}
+                                            </InfoSectionContent>
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.macosGatekeeperEnabled !== null &&
+                                {client.posture.macosGatekeeperEnabled !==
-                                        client.posture.macosGatekeeperEnabled !==
+                                    null &&
-                                            undefined && (
+                                    client.posture.macosGatekeeperEnabled !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("macosGatekeeperEnabled")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("macosGatekeeperEnabled")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture
+                                                    ? formatPostureValue(
-                                                                  .macosGatekeeperEnabled
+                                                          client.posture
-                                                          )
+                                                              .macosGatekeeperEnabled
-                                                        : "-"}
+                                                      )
-                                                </InfoSectionContent>
+                                                    : "-"}
-                                            </InfoSection>
+                                            </InfoSectionContent>
-                                        )}
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.macosFirewallStealthMode !== null &&
+                                {client.posture.macosFirewallStealthMode !==
-                                        client.posture.macosFirewallStealthMode !==
+                                    null &&
-                                            undefined && (
+                                    client.posture.macosFirewallStealthMode !==
-                                            <InfoSection>
+                                        undefined && (
-                                                <InfoSectionTitle>
+                                        <InfoSection>
-                                                    {t("macosFirewallStealthMode")}
+                                            <InfoSectionTitle>
-                                                </InfoSectionTitle>
+                                                {t("macosFirewallStealthMode")}
-                                                <InfoSectionContent>
+                                            </InfoSectionTitle>
-                                                    {isPaidUser
+                                            <InfoSectionContent>
-                                                        ? formatPostureValue(
+                                                {isPaidUser
-                                                              client.posture
+                                                    ? formatPostureValue(
-                                                                  .macosFirewallStealthMode
+                                                          client.posture
-                                                          )
+                                                              .macosFirewallStealthMode
-                                                        : "-"}
+                                                      )
-                                                </InfoSectionContent>
+                                                    : "-"}
-                                            </InfoSection>
+                                            </InfoSectionContent>
-                                        )}
+                                        </InfoSection>
+                                    )}
 
-                                    {client.posture.linuxAppArmorEnabled !== null &&
+                                {client.posture.linuxAppArmorEnabled !== null &&
-                                        client.posture.linuxAppArmorEnabled !==
+                                    client.posture.linuxAppArmorEnabled !==
-                                            undefined && (
+                                        undefined && (
-                                            <InfoSection>
+                                        <InfoSection>
-                                                <InfoSectionTitle>
+                                            <InfoSectionTitle>
-                                                    {t("linuxAppArmorEnabled")}
+                                                {t("linuxAppArmorEnabled")}
-                                                </InfoSectionTitle>
+                                            </InfoSectionTitle>
-                                                <InfoSectionContent>
+                                            <InfoSectionContent>
-                                                    {isPaidUser
+                                                {isPaidUser
-                                                        ? formatPostureValue(
+                                                    ? formatPostureValue(
-                                                              client.posture
+                                                          client.posture
-                                                                  .linuxAppArmorEnabled
+                                                              .linuxAppArmorEnabled
-                                                          )
+                                                      )
-                                                        : "-"}
+                                                    : "-"}
-                                                </InfoSectionContent>
+                                            </InfoSectionContent>
-                                            </InfoSection>
+                                        </InfoSection>
-                                        )}
+                                    )}
 
-                                    {client.posture.linuxSELinuxEnabled !== null &&
+                                {client.posture.linuxSELinuxEnabled !== null &&
-                                        client.posture.linuxSELinuxEnabled !==
+                                    client.posture.linuxSELinuxEnabled !==
-                                            undefined && (
+                                        undefined && (
-                                            <InfoSection>
+                                        <InfoSection>
-                                                <InfoSectionTitle>
+                                            <InfoSectionTitle>
-                                                    {t("linuxSELinuxEnabled")}
+                                                {t("linuxSELinuxEnabled")}
-                                                </InfoSectionTitle>
+                                            </InfoSectionTitle>
-                                                <InfoSectionContent>
+                                            <InfoSectionContent>
-                                                    {isPaidUser
+                                                {isPaidUser
-                                                        ? formatPostureValue(
+                                                    ? formatPostureValue(
-                                                              client.posture
+                                                          client.posture
-                                                                  .linuxSELinuxEnabled
+                                                              .linuxSELinuxEnabled
-                                                          )
+                                                      )
-                                                        : "-"}
+                                                    : "-"}
-                                                </InfoSectionContent>
+                                            </InfoSectionContent>
-                                            </InfoSection>
+                                        </InfoSection>
-                                        )}
+                                    )}
-                                </InfoSections>
+                            </InfoSections>
-                            </>
+                        </>
-                        ) : (
+                    ) : (
-                            <div className="text-muted-foreground">
+                        <div className="text-muted-foreground">
-                                {t("noData")}
+                            {t("noData")}
-                            </div>
+                        </div>
-                        )}
+                    )}
-                    </SettingsSectionBody>
+                </SettingsSectionBody>
-                </SettingsSection>
+            </SettingsSection>
-            )}
         </SettingsContainer>
     );
 }

src/app/[orgId]/settings/general/auth-page/page.tsx

@@ -20,11 +20,6 @@ export interface AuthPageProps {
 export default async function AuthPage(props: AuthPageProps) {
     const orgId = (await props.params).orgId;
 
-    // custom auth branding is only available in enterprise and saas
-    if (build === "oss") {
-        redirect(`/${orgId}/settings/general/`);
-    }
-
     let subscriptionStatus: GetOrgTierResponse | null = null;
     try {
         const subRes = await getCachedSubscription(orgId);

src/app/[orgId]/settings/general/layout.tsx

@@ -55,14 +55,12 @@ export default async function GeneralSettingsPage({
         {
             title: t("security"),
             href: `/{orgId}/settings/general/security`
-        }
+        },
-    ];
+        {
-    if (build !== "oss") {
-        navItems.push({
             title: t("authPage"),
             href: `/{orgId}/settings/general/auth-page`
-        });
+        }
-    }
+    ];
 
     return (
         <>

src/app/[orgId]/settings/general/security/page.tsx

@@ -3,12 +3,7 @@ import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { Button } from "@app/components/ui/button";
 import { useOrgContext } from "@app/hooks/useOrgContext";
 import { toast } from "@app/hooks/useToast";
-import {
+import { useState, useRef, useActionState, type ComponentRef } from "react";
-    useState,
-    useRef,
-    useActionState,
-    type ComponentRef
-} from "react";
 import {
     Form,
     FormControl,
@@ -110,7 +105,7 @@ export default function SecurityPage() {
     return (
         <SettingsContainer>
             <LogRetentionSectionForm org={org.org} />
-            {build !== "oss" && <SecuritySettingsSectionForm org={org.org} />}
+            <SecuritySettingsSectionForm org={org.org} />
         </SettingsContainer>
     );
 }
@@ -243,144 +238,120 @@ function LogRetentionSectionForm({ org }: SectionFormProps) {
                                 )}
                             />
 
-                            {build !== "oss" && (
+                            <PaidFeaturesAlert />
-                                <>
-                                    <PaidFeaturesAlert />
 
-                                    <FormField
+                            <FormField
-                                        control={form.control}
+                                control={form.control}
-                                        name="settingsLogRetentionDaysAccess"
+                                name="settingsLogRetentionDaysAccess"
-                                        render={({ field }) => {
+                                render={({ field }) => {
-                                            const isDisabled = !isPaidUser;
+                                    const isDisabled = !isPaidUser;
 
-                                            return (
+                                    return (
-                                                <FormItem>
+                                        <FormItem>
-                                                    <FormLabel>
+                                            <FormLabel>
-                                                        {t(
+                                                {t("logRetentionAccessLabel")}
-                                                            "logRetentionAccessLabel"
+                                            </FormLabel>
-                                                        )}
+                                            <FormControl>
-                                                    </FormLabel>
+                                                <Select
-                                                    <FormControl>
+                                                    value={field.value.toString()}
-                                                        <Select
+                                                    onValueChange={(value) => {
-                                                            value={field.value.toString()}
+                                                        if (!isDisabled) {
-                                                            onValueChange={(
+                                                            field.onChange(
-                                                                value
+                                                                parseInt(
-                                                            ) => {
+                                                                    value,
-                                                                if (
+                                                                    10
-                                                                    !isDisabled
+                                                                )
-                                                                ) {
+                                                            );
-                                                                    field.onChange(
+                                                        }
-                                                                        parseInt(
+                                                    }}
-                                                                            value,
+                                                    disabled={isDisabled}
-                                                                            10
+                                                >
-                                                                        )
+                                                    <SelectTrigger>
-                                                                    );
+                                                        <SelectValue
-                                                                }
+                                                            placeholder={t(
-                                                            }}
+                                                                "selectLogRetention"
-                                                            disabled={
+                                                            )}
-                                                                isDisabled
+                                                        />
-                                                            }
+                                                    </SelectTrigger>
-                                                        >
+                                                    <SelectContent>
-                                                            <SelectTrigger>
+                                                        {LOG_RETENTION_OPTIONS.map(
-                                                                <SelectValue
+                                                            (option) => (
-                                                                    placeholder={t(
+                                                                <SelectItem
-                                                                        "selectLogRetention"
+                                                                    key={
+                                                                        option.value
+                                                                    }
+                                                                    value={option.value.toString()}
+                                                                >
+                                                                    {t(
+                                                                        option.label
                                                                     )}
-                                                                />
+                                                                </SelectItem>
-                                                            </SelectTrigger>
+                                                            )
-                                                            <SelectContent>
-                                                                {LOG_RETENTION_OPTIONS.map(
-                                                                    (
-                                                                        option
-                                                                    ) => (
-                                                                        <SelectItem
-                                                                            key={
-                                                                                option.value
-                                                                            }
-                                                                            value={option.value.toString()}
-                                                                        >
-                                                                            {t(
-                                                                                option.label
-                                                                            )}
-                                                                        </SelectItem>
-                                                                    )
-                                                                )}
-                                                            </SelectContent>
-                                                        </Select>
-                                                    </FormControl>
-                                                    <FormMessage />
-                                                </FormItem>
-                                            );
-                                        }}
-                                    />
-                                    <FormField
-                                        control={form.control}
-                                        name="settingsLogRetentionDaysAction"
-                                        render={({ field }) => {
-                                            const isDisabled = !isPaidUser;
-
-                                            return (
-                                                <FormItem>
-                                                    <FormLabel>
-                                                        {t(
-                                                            "logRetentionActionLabel"
                                                         )}
-                                                    </FormLabel>
+                                                    </SelectContent>
-                                                    <FormControl>
+                                                </Select>
-                                                        <Select
+                                            </FormControl>
-                                                            value={field.value.toString()}
+                                            <FormMessage />
-                                                            onValueChange={(
+                                        </FormItem>
-                                                                value
+                                    );
-                                                            ) => {
+                                }}
-                                                                if (
+                            />
-                                                                    !isDisabled
+                            <FormField
-                                                                ) {
+                                control={form.control}
-                                                                    field.onChange(
+                                name="settingsLogRetentionDaysAction"
-                                                                        parseInt(
+                                render={({ field }) => {
-                                                                            value,
+                                    const isDisabled = !isPaidUser;
-                                                                            10
+
-                                                                        )
+                                    return (
-                                                                    );
+                                        <FormItem>
-                                                                }
+                                            <FormLabel>
-                                                            }}
+                                                {t("logRetentionActionLabel")}
-                                                            disabled={
+                                            </FormLabel>
-                                                                isDisabled
+                                            <FormControl>
-                                                            }
+                                                <Select
-                                                        >
+                                                    value={field.value.toString()}
-                                                            <SelectTrigger>
+                                                    onValueChange={(value) => {
-                                                                <SelectValue
+                                                        if (!isDisabled) {
-                                                                    placeholder={t(
+                                                            field.onChange(
-                                                                        "selectLogRetention"
+                                                                parseInt(
+                                                                    value,
+                                                                    10
+                                                                )
+                                                            );
+                                                        }
+                                                    }}
+                                                    disabled={isDisabled}
+                                                >
+                                                    <SelectTrigger>
+                                                        <SelectValue
+                                                            placeholder={t(
+                                                                "selectLogRetention"
+                                                            )}
+                                                        />
+                                                    </SelectTrigger>
+                                                    <SelectContent>
+                                                        {LOG_RETENTION_OPTIONS.map(
+                                                            (option) => (
+                                                                <SelectItem
+                                                                    key={
+                                                                        option.value
+                                                                    }
+                                                                    value={option.value.toString()}
+                                                                >
+                                                                    {t(
+                                                                        option.label
                                                                     )}
-                                                                />
+                                                                </SelectItem>
-                                                            </SelectTrigger>
+                                                            )
-                                                            <SelectContent>
+                                                        )}
-                                                                {LOG_RETENTION_OPTIONS.map(
+                                                    </SelectContent>
-                                                                    (
+                                                </Select>
-                                                                        option
+                                            </FormControl>
-                                                                    ) => (
+                                            <FormMessage />
-                                                                        <SelectItem
+                                        </FormItem>
-                                                                            key={
+                                    );
-                                                                                option.value
+                                }}
-                                                                            }
+                            />
-                                                                            value={option.value.toString()}
-                                                                        >
-                                                                            {t(
-                                                                                option.label
-                                                                            )}
-                                                                        </SelectItem>
-                                                                    )
-                                                                )}
-                                                            </SelectContent>
-                                                        </Select>
-                                                    </FormControl>
-                                                    <FormMessage />
-                                                </FormItem>
-                                            );
-                                        }}
-                                    />
-                                </>
-                            )}
                         </form>
                     </Form>
                 </SettingsSectionForm>
@@ -740,7 +711,7 @@ function SecuritySettingsSectionForm({ org }: SectionFormProps) {
                         type="submit"
                         form="security-settings-section-form"
                         loading={loadingSave}
-                        disabled={loadingSave}
+                        disabled={loadingSave || !isPaidUser}
                     >
                         {t("saveSettings")}
                     </Button>

src/app/[orgId]/settings/logs/access/page.tsx

@@ -20,6 +20,7 @@ import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
 import axios from "axios";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 
 export default function GeneralPage() {
     const router = useRouter();
@@ -209,7 +210,8 @@ export default function GeneralPage() {
         console.log("Date range changed:", { startDate, endDate, page, size });
         if (
             (build == "saas" && !subscription?.subscribed) ||
-            (build == "enterprise" && !isUnlocked())
+            (build == "enterprise" && !isUnlocked()) ||
+            build === "oss"
         ) {
             console.log(
                 "Access denied: subscription inactive or license locked"
@@ -611,21 +613,7 @@ export default function GeneralPage() {
                 description={t("accessLogsDescription")}
             />
 
-            {build == "saas" && !subscription?.subscribed ? (
+            <PaidFeaturesAlert />
-                <Alert variant="info" className="mb-6">
-                    <AlertDescription>
-                        {t("subscriptionRequiredToUse")}
-                    </AlertDescription>
-                </Alert>
-            ) : null}
-
-            {build == "enterprise" && !isUnlocked() ? (
-                <Alert variant="info" className="mb-6">
-                    <AlertDescription>
-                        {t("licenseRequiredToUse")}
-                    </AlertDescription>
-                </Alert>
-            ) : null}
 
             <LogDataTable
                 columns={columns}
@@ -656,7 +644,8 @@ export default function GeneralPage() {
                 renderExpandedRow={renderExpandedRow}
                 disabled={
                     (build == "saas" && !subscription?.subscribed) ||
-                    (build == "enterprise" && !isUnlocked())
+                    (build == "enterprise" && !isUnlocked()) ||
+                    build === "oss"
                 }
             />
         </>

src/app/[orgId]/settings/logs/action/page.tsx

@@ -2,6 +2,7 @@
 import { ColumnFilter } from "@app/components/ColumnFilter";
 import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useEnvContext } from "@app/hooks/useEnvContext";
@@ -92,6 +93,9 @@ export default function GeneralPage() {
 
     // Trigger search with default values on component mount
     useEffect(() => {
+        if (build === "oss") {
+            return;
+        }
         const defaultRange = getDefaultDateRange();
         queryDateTime(
             defaultRange.startDate,
@@ -461,21 +465,7 @@ export default function GeneralPage() {
                 description={t("actionLogsDescription")}
             />
 
-            {build == "saas" && !subscription?.subscribed ? (
+            <PaidFeaturesAlert />
-                <Alert variant="info" className="mb-6">
-                    <AlertDescription>
-                        {t("subscriptionRequiredToUse")}
-                    </AlertDescription>
-                </Alert>
-            ) : null}
-
-            {build == "enterprise" && !isUnlocked() ? (
-                <Alert variant="info" className="mb-6">
-                    <AlertDescription>
-                        {t("licenseRequiredToUse")}
-                    </AlertDescription>
-                </Alert>
-            ) : null}
 
             <LogDataTable
                 columns={columns}
@@ -508,7 +498,8 @@ export default function GeneralPage() {
                 renderExpandedRow={renderExpandedRow}
                 disabled={
                     (build == "saas" && !subscription?.subscribed) ||
-                    (build == "enterprise" && !isUnlocked())
+                    (build == "enterprise" && !isUnlocked()) ||
+                    build === "oss"
                 }
             />
         </>

src/app/[orgId]/settings/logs/request/page.tsx

@@ -16,6 +16,7 @@ import Link from "next/link";
 import { useParams, useRouter, useSearchParams } from "next/navigation";
 import { useEffect, useState, useTransition } from "react";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
+import { build } from "@server/build";
 
 export default function GeneralPage() {
     const router = useRouter();
@@ -110,6 +111,9 @@ export default function GeneralPage() {
 
     // Trigger search with default values on component mount
     useEffect(() => {
+        if (build === "oss") {
+            return;
+        }
         const defaultRange = getDefaultDateRange();
         queryDateTime(
             defaultRange.startDate,

src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx

@@ -63,6 +63,7 @@ import {
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { GetResourceResponse } from "@server/routers/resource/getResource";
 import type { ResourceContextType } from "@app/contexts/resourceContext";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
 
 type MaintenanceSectionFormProps = {
     resource: GetResourceResponse;
@@ -78,6 +79,7 @@ function MaintenanceSectionForm({
     const api = createApiClient({ env });
     const { isUnlocked } = useLicenseStatusContext();
     const subscription = useSubscriptionStatusContext();
+    const { isPaidUser } = usePaidStatus();
 
     const MaintenanceFormSchema = z.object({
         maintenanceModeEnabled: z.boolean().optional(),
@@ -161,7 +163,7 @@ function MaintenanceSectionForm({
         const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
         const isSaasNotSubscribed =
             build === "saas" && !subscription?.isSubscribed();
-        return isEnterpriseNotLicensed || isSaasNotSubscribed;
+        return isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss";
     };
 
     if (!resource.http) {
@@ -413,7 +415,7 @@ function MaintenanceSectionForm({
                 <Button
                     type="submit"
                     loading={maintenanceSaveLoading}
-                    disabled={maintenanceSaveLoading}
+                    disabled={maintenanceSaveLoading || !isPaidUser }
                     form="maintenance-settings-form"
                 >
                     {t("saveSettings")}
@@ -739,12 +741,10 @@ export default function GeneralForm() {
                     </SettingsSectionFooter>
                 </SettingsSection>
 
-                {build !== "oss" && (
+                <MaintenanceSectionForm
-                    <MaintenanceSectionForm
+                    resource={resource}
-                        resource={resource}
+                    updateResource={updateResource}
-                        updateResource={updateResource}
+                />
-                    />
-                )}
             </SettingsContainer>
 
             <Credenza

src/app/[orgId]/settings/sites/[niceId]/credentials/page.tsx

@@ -72,7 +72,9 @@ export default function CredentialsPage() {
         const isEnterpriseNotLicensed = build === "enterprise" && !isUnlocked();
         const isSaasNotSubscribed =
             build === "saas" && !subscription?.isSubscribed();
-        return isEnterpriseNotLicensed || isSaasNotSubscribed;
+        return (
+            isEnterpriseNotLicensed || isSaasNotSubscribed || build === "oss"
+        );
     };
 
     // Fetch site defaults for wireguard sites to show in obfuscated config
@@ -269,29 +271,27 @@ export default function CredentialsPage() {
                                     </Alert>
                                 )}
                             </SettingsSectionBody>
-                            {build !== "oss" && (
+                            <SettingsSectionFooter>
-                                <SettingsSectionFooter>
+                                <Button
-                                    <Button
+                                    variant="outline"
-                                        variant="outline"
+                                    onClick={() => {
-                                        onClick={() => {
+                                        setShouldDisconnect(false);
-                                            setShouldDisconnect(false);
+                                        setModalOpen(true);
-                                            setModalOpen(true);
+                                    }}
-                                        }}
+                                    disabled={isSecurityFeatureDisabled()}
-                                        disabled={isSecurityFeatureDisabled()}
+                                >
-                                    >
+                                    {t("regenerateCredentialsButton")}
-                                        {t("regenerateCredentialsButton")}
+                                </Button>
-                                    </Button>
+                                <Button
-                                    <Button
+                                    onClick={() => {
-                                        onClick={() => {
+                                        setShouldDisconnect(true);
-                                            setShouldDisconnect(true);
+                                        setModalOpen(true);
-                                            setModalOpen(true);
+                                    }}
-                                        }}
+                                    disabled={isSecurityFeatureDisabled()}
-                                        disabled={isSecurityFeatureDisabled()}
+                                >
-                                    >
+                                    {t("siteRegenerateAndDisconnect")}
-                                        {t("siteRegenerateAndDisconnect")}
+                                </Button>
-                                    </Button>
+                            </SettingsSectionFooter>
-                                </SettingsSectionFooter>
-                            )}
                         </SettingsSection>
 
                         <NewtSiteInstallCommands
@@ -383,16 +383,14 @@ export default function CredentialsPage() {
                                 </>
                             )}
                         </SettingsSectionBody>
-                        {build === "enterprise" && (
+                        <SettingsSectionFooter>
-                            <SettingsSectionFooter>
+                            <Button
-                                <Button
+                                onClick={() => setModalOpen(true)}
-                                    onClick={() => setModalOpen(true)}
+                                disabled={isSecurityFeatureDisabled()}
-                                    disabled={isSecurityFeatureDisabled()}
+                            >
-                                >
+                                {t("siteRegenerateAndDisconnect")}
-                                    {t("siteRegenerateAndDisconnect")}
+                            </Button>
-                                </Button>
+                        </SettingsSectionFooter>
-                            </SettingsSectionFooter>
-                        )}
                     </SettingsSection>
                 )}
             </SettingsContainer>

src/app/auth/login/device/page.tsx

@@ -7,22 +7,35 @@ import { cache } from "react";
 export const dynamic = "force-dynamic";
 
 type Props = {
-    searchParams: Promise<{ code?: string }>;
+    searchParams: Promise<{ code?: string; user?: string }>;
 };
 
+function deviceRedirectSearchParams(params: {
+    code?: string;
+    user?: string;
+}): string {
+    const search = new URLSearchParams();
+    if (params.code) search.set("code", params.code);
+    if (params.user) search.set("user", params.user);
+    const q = search.toString();
+    return q ? `?${q}` : "";
+}
+
 export default async function DeviceLoginPage({ searchParams }: Props) {
     const user = await verifySession({ forceLogin: true });
 
     const params = await searchParams;
     const code = params.code || "";
+    const defaultUser = params.user;
 
     if (!user) {
-        const redirectDestination = code
+        const redirectDestination = `/auth/login/device${deviceRedirectSearchParams({ code, user: params.user })}`;
-            ? `/auth/login/device?code=${encodeURIComponent(code)}`
+        const loginUrl = new URL("/auth/login", "http://x");
-            : "/auth/login/device";
+        loginUrl.searchParams.set("forceLogin", "true");
-        redirect(
+        loginUrl.searchParams.set("redirect", redirectDestination);
-            `/auth/login?forceLogin=true&redirect=${encodeURIComponent(redirectDestination)}`
+        if (defaultUser) loginUrl.searchParams.set("user", defaultUser);
-        );
+        console.log("loginUrl", loginUrl.pathname + loginUrl.search);
+        redirect(loginUrl.pathname + loginUrl.search);
     }
 
     const userName = user
@@ -37,6 +50,7 @@ export default async function DeviceLoginPage({ searchParams }: Props) {
             userEmail={user?.email || ""}
             userName={userName}
             initialCode={code}
+            userQueryParam={defaultUser}
         />
     );
 }

src/app/auth/login/page.tsx

@@ -72,6 +72,8 @@ export default async function Page(props: {
         searchParams.redirect = redirectUrl;
     }
 
+    const defaultUser = searchParams.user as string | undefined;
+
     // Only use SmartLoginForm if NOT (OSS build OR org-only IdP enabled)
     const useSmartLogin =
         build === "saas" || (build === "enterprise" && env.flags.useOrgOnlyIdp);
@@ -151,6 +153,7 @@ export default async function Page(props: {
                             <SmartLoginForm
                                 redirect={redirectUrl}
                                 forceLogin={forceLogin}
+                                defaultUser={defaultUser}
                             />
                         </CardContent>
                     </Card>
@@ -165,6 +168,7 @@ export default async function Page(props: {
                         (build === "saas" || env.flags.useOrgOnlyIdp)
                     }
                     searchParams={searchParams}
+                    defaultUser={defaultUser}
                 />
             )}
 

src/app/navigation.tsx

@@ -121,24 +121,16 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/{orgId}/settings/access/roles",
                 icon: <Users className="size-4 flex-none" />
             },
-            ...(build === "saas" || env?.flags.useOrgOnlyIdp
+            {
-                ? [
+                title: "sidebarIdentityProviders",
-                      {
+                href: "/{orgId}/settings/idp",
-                          title: "sidebarIdentityProviders",
+                icon: <Fingerprint className="size-4 flex-none" />
-                          href: "/{orgId}/settings/idp",
+            },
-                          icon: <Fingerprint className="size-4 flex-none" />
+            {
-                      }
+                title: "sidebarApprovals",
-                  ]
+                href: "/{orgId}/settings/access/approvals",
-                : []),
+                icon: <UserCog className="size-4 flex-none" />
-            ...(build !== "oss"
+            },
-                ? [
-                      {
-                          title: "sidebarApprovals",
-                          href: "/{orgId}/settings/access/approvals",
-                          icon: <UserCog className="size-4 flex-none" />
-                      }
-                  ]
-                : []),
             {
                 title: "sidebarShareableLinks",
                 href: "/{orgId}/settings/share-links",
@@ -155,20 +147,16 @@ export const orgNavSections = (env?: Env): SidebarNavSection[] => [
                     href: "/{orgId}/settings/logs/request",
                     icon: <SquareMousePointer className="size-4 flex-none" />
                 },
-                ...(build != "oss"
+                {
-                    ? [
+                    title: "sidebarLogsAccess",
-                          {
+                    href: "/{orgId}/settings/logs/access",
-                              title: "sidebarLogsAccess",
+                    icon: <ScanEye className="size-4 flex-none" />
-                              href: "/{orgId}/settings/logs/access",
+                },
-                              icon: <ScanEye className="size-4 flex-none" />
+                {
-                          },
+                    title: "sidebarLogsAction",
-                          {
+                    href: "/{orgId}/settings/logs/action",
-                              title: "sidebarLogsAction",
+                    icon: <Logs className="size-4 flex-none" />
-                              href: "/{orgId}/settings/logs/action",
+                }
-                              icon: <Logs className="size-4 flex-none" />
-                          }
-                      ]
-                    : [])
             ];
 
             const analytics = {

src/components/ApprovalFeed.tsx

@@ -30,6 +30,7 @@ import {
 import { Separator } from "./ui/separator";
 import { InfoPopup } from "./ui/info-popup";
 import { ApprovalsEmptyState } from "./ApprovalsEmptyState";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
 
 export type ApprovalFeedProps = {
     orgId: string;
@@ -50,9 +51,12 @@ export function ApprovalFeed({
         Object.fromEntries(searchParams.entries())
     );
 
-    const { data, isFetching, refetch } = useQuery(
+    const { isPaidUser } = usePaidStatus();
-        approvalQueries.listApprovals(orgId, filters)
+
-    );
+    const { data, isFetching, refetch } = useQuery({
+        ...approvalQueries.listApprovals(orgId, filters),
+        enabled: isPaidUser
+    });
 
     const approvals = data?.approvals ?? [];
 
@@ -209,19 +213,19 @@ function ApprovalRequest({ approval, orgId, onSuccess }: ApprovalRequestProps) {
                      
                     {approval.type === "user_device" && (
                         <span className="inline-flex items-center gap-1">
-                                    {approval.deviceName ? (
+                            {approval.deviceName ? (
-                                        <>
+                                <>
-                                            {t("requestingNewDeviceApproval")}:{" "}
+                                    {t("requestingNewDeviceApproval")}:{" "}
-                                            {approval.niceId ? (
+                                    {approval.niceId ? (
-                                                <Link
+                                        <Link
-                                                    href={`/${orgId}/settings/clients/user/${approval.niceId}/general`}
+                                            href={`/${orgId}/settings/clients/user/${approval.niceId}/general`}
-                                                    className="text-primary hover:underline cursor-pointer"
+                                            className="text-primary hover:underline cursor-pointer"
-                                                >
+                                        >
-                                                    {approval.deviceName}
+                                            {approval.deviceName}
-                                                </Link>
+                                        </Link>
-                                            ) : (
+                                    ) : (
-                                                <span>{approval.deviceName}</span>
+                                        <span>{approval.deviceName}</span>
-                                            )}
+                                    )}
                                     {approval.fingerprint && (
                                         <InfoPopup>
                                             <div className="space-y-1 text-sm">
@@ -229,7 +233,10 @@ function ApprovalRequest({ approval, orgId, onSuccess }: ApprovalRequestProps) {
                                                     {t("deviceInformation")}
                                                 </div>
                                                 <div className="text-muted-foreground whitespace-pre-line">
-                                                    {formatFingerprintInfo(approval.fingerprint, t)}
+                                                    {formatFingerprintInfo(
+                                                        approval.fingerprint,
+                                                        t
+                                                    )}
                                                 </div>
                                             </div>
                                         </InfoPopup>

src/components/CreateRoleForm.tsx

@@ -160,56 +160,51 @@ export default function CreateRoleForm({
                                         </FormItem>
                                     )}
                                 />
-                                {build !== "oss" && (
-                                    <div>
-                                        <PaidFeaturesAlert />
 
-                                        <FormField
+                                <PaidFeaturesAlert />
-                                            control={form.control}
+
-                                            name="requireDeviceApproval"
+                                <FormField
-                                            render={({ field }) => (
+                                    control={form.control}
-                                                <FormItem className="my-2">
+                                    name="requireDeviceApproval"
-                                                    <FormControl>
+                                    render={({ field }) => (
-                                                        <CheckboxWithLabel
+                                        <FormItem className="my-2">
-                                                            {...field}
+                                            <FormControl>
-                                                            disabled={
+                                                <CheckboxWithLabel
-                                                                !isPaidUser
+                                                    {...field}
-                                                            }
+                                                    disabled={!isPaidUser}
-                                                            value="on"
+                                                    value="on"
-                                                            checked={form.watch(
+                                                    checked={form.watch(
-                                                                "requireDeviceApproval"
+                                                        "requireDeviceApproval"
-                                                            )}
+                                                    )}
-                                                            onCheckedChange={(
+                                                    onCheckedChange={(
+                                                        checked
+                                                    ) => {
+                                                        if (
+                                                            checked !==
+                                                            "indeterminate"
+                                                        ) {
+                                                            form.setValue(
+                                                                "requireDeviceApproval",
                                                                 checked
-                                                            ) => {
+                                                            );
-                                                                if (
+                                                        }
-                                                                    checked !==
+                                                    }}
-                                                                    "indeterminate"
+                                                    label={t(
-                                                                ) {
+                                                        "requireDeviceApproval"
-                                                                    form.setValue(
+                                                    )}
-                                                                        "requireDeviceApproval",
+                                                />
-                                                                        checked
+                                            </FormControl>
-                                                                    );
-                                                                }
-                                                            }}
-                                                            label={t(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                        />
-                                                    </FormControl>
 
-                                                    <FormDescription>
+                                            <FormDescription>
-                                                        {t(
+                                                {t(
-                                                            "requireDeviceApprovalDescription"
+                                                    "requireDeviceApprovalDescription"
-                                                        )}
+                                                )}
-                                                    </FormDescription>
+                                            </FormDescription>
 
-                                                    <FormMessage />
+                                            <FormMessage />
-                                                </FormItem>
+                                        </FormItem>
-                                            )}
+                                    )}
-                                        />
+                                />
-                                    </div>
-                                )}
                             </form>
                         </Form>
                     </CredenzaBody>

src/components/DashboardLoginForm.tsx

@@ -29,6 +29,7 @@ type DashboardLoginFormProps = {
     searchParams?: {
         [key: string]: string | string[] | undefined;
     };
+    defaultUser?: string;
 };
 
 export default function DashboardLoginForm({
@@ -36,7 +37,8 @@ export default function DashboardLoginForm({
     idps,
     forceLogin,
     showOrgLogin,
-    searchParams
+    searchParams,
+    defaultUser
 }: DashboardLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -75,6 +77,7 @@ export default function DashboardLoginForm({
                     redirect={redirect}
                     idps={idps}
                     forceLogin={forceLogin}
+                    defaultEmail={defaultUser}
                     onLogin={(redirectUrl) => {
                         if (redirectUrl) {
                             const safe = cleanRedirect(redirectUrl);

src/components/DeviceLoginForm.tsx

@@ -55,12 +55,14 @@ type DeviceLoginFormProps = {
     userEmail: string;
     userName?: string;
     initialCode?: string;
+    userQueryParam?: string;
 };
 
 export default function DeviceLoginForm({
     userEmail,
     userName,
-    initialCode = ""
+    initialCode = "",
+    userQueryParam
 }: DeviceLoginFormProps) {
     const router = useRouter();
     const { env } = useEnvContext();
@@ -219,9 +221,12 @@ export default function DeviceLoginForm({
             const currentSearch =
                 typeof window !== "undefined" ? window.location.search : "";
             const redirectTarget = `/auth/login/device${currentSearch || ""}`;
-            router.push(
+            const loginUrl = new URL("/auth/login", "http://x");
-                `/auth/login?forceLogin=true&redirect=${encodeURIComponent(redirectTarget)}`
+            loginUrl.searchParams.set("forceLogin", "true");
-            );
+            loginUrl.searchParams.set("redirect", redirectTarget);
+            if (userQueryParam)
+                loginUrl.searchParams.set("user", userQueryParam);
+            router.push(loginUrl.pathname + loginUrl.search);
             router.refresh();
         }
     }

src/components/EditRoleForm.tsx

@@ -168,56 +168,50 @@ export default function EditRoleForm({
                                         </FormItem>
                                     )}
                                 />
-                                {build !== "oss" && (
+                                <PaidFeaturesAlert />
-                                    <div>
-                                        <PaidFeaturesAlert />
 
-                                        <FormField
+                                <FormField
-                                            control={form.control}
+                                    control={form.control}
-                                            name="requireDeviceApproval"
+                                    name="requireDeviceApproval"
-                                            render={({ field }) => (
+                                    render={({ field }) => (
-                                                <FormItem className="my-2">
+                                        <FormItem className="my-2">
-                                                    <FormControl>
+                                            <FormControl>
-                                                        <CheckboxWithLabel
+                                                <CheckboxWithLabel
-                                                            {...field}
+                                                    {...field}
-                                                            disabled={
+                                                    disabled={!isPaidUser}
-                                                                !isPaidUser
+                                                    value="on"
-                                                            }
+                                                    checked={form.watch(
-                                                            value="on"
+                                                        "requireDeviceApproval"
-                                                            checked={form.watch(
+                                                    )}
-                                                                "requireDeviceApproval"
+                                                    onCheckedChange={(
-                                                            )}
+                                                        checked
-                                                            onCheckedChange={(
+                                                    ) => {
+                                                        if (
+                                                            checked !==
+                                                            "indeterminate"
+                                                        ) {
+                                                            form.setValue(
+                                                                "requireDeviceApproval",
                                                                 checked
-                                                            ) => {
+                                                            );
-                                                                if (
+                                                        }
-                                                                    checked !==
+                                                    }}
-                                                                    "indeterminate"
+                                                    label={t(
-                                                                ) {
+                                                        "requireDeviceApproval"
-                                                                    form.setValue(
+                                                    )}
-                                                                        "requireDeviceApproval",
+                                                />
-                                                                        checked
+                                            </FormControl>
-                                                                    );
-                                                                }
-                                                            }}
-                                                            label={t(
-                                                                "requireDeviceApproval"
-                                                            )}
-                                                        />
-                                                    </FormControl>
 
-                                                    <FormDescription>
+                                            <FormDescription>
-                                                        {t(
+                                                {t(
-                                                            "requireDeviceApprovalDescription"
+                                                    "requireDeviceApprovalDescription"
-                                                        )}
+                                                )}
-                                                    </FormDescription>
+                                            </FormDescription>
 
-                                                    <FormMessage />
+                                            <FormMessage />
-                                                </FormItem>
+                                        </FormItem>
-                                            )}
+                                    )}
-                                        />
+                                />
-                                    </div>
-                                )}
                             </form>
                         </Form>
                     </CredenzaBody>

src/components/LoginForm.tsx

@@ -54,6 +54,7 @@ type LoginFormProps = {
     idps?: LoginFormIDP[];
     orgId?: string;
     forceLogin?: boolean;
+    defaultEmail?: string;
 };
 
 export default function LoginForm({
@@ -61,7 +62,8 @@ export default function LoginForm({
     onLogin,
     idps,
     orgId,
-    forceLogin
+    forceLogin,
+    defaultEmail
 }: LoginFormProps) {
     const router = useRouter();
 
@@ -116,7 +118,7 @@ export default function LoginForm({
     const form = useForm({
         resolver: zodResolver(formSchema),
         defaultValues: {
-            email: "",
+            email: defaultEmail ?? "",
             password: ""
         }
     });

src/components/PaidFeaturesAlert.tsx

@@ -1,8 +1,16 @@
 "use client";
-import { Alert, AlertDescription } from "@app/components/ui/alert";
+import { Card, CardContent } from "@app/components/ui/card";
 import { build } from "@server/build";
-import { useTranslations } from "next-intl";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { ExternalLink, KeyRound, Sparkles } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+
+const bannerClassName =
+    "mb-6 border-primary/30 bg-linear-to-br from-primary/10 via-background to-background overflow-hidden";
+const bannerContentClassName = "py-3 px-4";
+const bannerRowClassName =
+    "flex items-center gap-2.5 text-sm text-muted-foreground";
 
 export function PaidFeaturesAlert() {
     const t = useTranslations();
@@ -10,19 +18,50 @@ export function PaidFeaturesAlert() {
     return (
         <>
             {build === "saas" && !hasSaasSubscription ? (
-                <Alert variant="info" className="mb-6">
+                <Card className={bannerClassName}>
-                    <AlertDescription>
+                    <CardContent className={bannerContentClassName}>
-                        {t("subscriptionRequiredToUse")}
+                        <div className={bannerRowClassName}>
-                    </AlertDescription>
+                            <KeyRound className="size-4 shrink-0 text-primary" />
-                </Alert>
+                            <span>{t("subscriptionRequiredToUse")}</span>
+                        </div>
+                    </CardContent>
+                </Card>
             ) : null}
 
             {build === "enterprise" && !hasEnterpriseLicense ? (
-                <Alert variant="info" className="mb-6">
+                <Card className={bannerClassName}>
-                    <AlertDescription>
+                    <CardContent className={bannerContentClassName}>
-                        {t("licenseRequiredToUse")}
+                        <div className={bannerRowClassName}>
-                    </AlertDescription>
+                            <KeyRound className="size-4 shrink-0 text-primary" />
-                </Alert>
+                            <span>{t("licenseRequiredToUse")}</span>
+                        </div>
+                    </CardContent>
+                </Card>
+            ) : null}
+
+            {build === "oss" && !hasEnterpriseLicense ? (
+                <Card className={bannerClassName}>
+                    <CardContent className={bannerContentClassName}>
+                        <div className={bannerRowClassName}>
+                            <KeyRound className="size-4 shrink-0 text-primary" />
+                            <span>
+                                {t.rich("ossEnterpriseEditionRequired", {
+                                    enterpriseEditionLink: (chunks) => (
+                                        <Link
+                                            href="https://docs.pangolin.net/self-host/enterprise-edition"
+                                            target="_blank"
+                                            rel="noopener noreferrer"
+                                            className="inline-flex items-center gap-1 font-medium text-foreground underline"
+                                        >
+                                            {chunks}
+                                            <ExternalLink className="size-3.5 shrink-0" />
+                                        </Link>
+                                    )
+                                })}
+                            </span>
+                        </div>
+                    </CardContent>
+                </Card>
             ) : null}
         </>
     );

src/components/SmartLoginForm.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import * as z from "zod";
@@ -42,6 +42,7 @@ const isValidEmail = (str: string): boolean => {
 type SmartLoginFormProps = {
     redirect?: string;
     forceLogin?: boolean;
+    defaultUser?: string;
 };
 
 type ViewState =
@@ -59,7 +60,8 @@ type ViewState =
 
 export default function SmartLoginForm({
     redirect,
-    forceLogin
+    forceLogin,
+    defaultUser
 }: SmartLoginFormProps) {
     const router = useRouter();
     const { lookup, loading, error } = useUserLookup();
@@ -72,10 +74,18 @@ export default function SmartLoginForm({
     const form = useForm<z.infer<typeof identifierSchema>>({
         resolver: zodResolver(identifierSchema),
         defaultValues: {
-            identifier: ""
+            identifier: defaultUser ?? ""
         }
     });
 
+    const hasAutoLookedUp = useRef(false);
+    useEffect(() => {
+        if (defaultUser?.trim() && !hasAutoLookedUp.current) {
+            hasAutoLookedUp.current = true;
+            void handleLookup({ identifier: defaultUser.trim() });
+        }
+    }, [defaultUser]);
+
     const handleLookup = async (values: z.infer<typeof identifierSchema>) => {
         const identifier = values.identifier.trim();
         const isEmail = isValidEmail(identifier);

src/components/UserDevicesTable.tsx

@@ -190,7 +190,7 @@ export default function UserDevicesTable({ userClients }: ClientTableProps) {
             const approvalsRes = await api.get<{
                 data: { approvals: Array<{ approvalId: number; clientId: number }> };
             }>(`/org/${clientRow.orgId}/approvals?approvalState=pending&clientId=${clientRow.id}`);
-            
+
             const approval = approvalsRes.data.data.approvals[0];
 
             if (!approval) {
@@ -232,7 +232,7 @@ export default function UserDevicesTable({ userClients }: ClientTableProps) {
             const approvalsRes = await api.get<{
                 data: { approvals: Array<{ approvalId: number; clientId: number }> };
             }>(`/org/${clientRow.orgId}/approvals?approvalState=pending&clientId=${clientRow.id}`);
-            
+
             const approval = approvalsRes.data.data.approvals[0];
 
             if (!approval) {
@@ -548,7 +548,7 @@ export default function UserDevicesTable({ userClients }: ClientTableProps) {
                                 </Button>
                             </DropdownMenuTrigger>
                             <DropdownMenuContent align="end">
-                                {clientRow.approvalState === "pending" && build !== "oss" && (
+                                {clientRow.approvalState === "pending" && (
                                     <>
                                         <DropdownMenuItem
                                             onClick={() => approveDevice(clientRow)}
@@ -652,17 +652,10 @@ export default function UserDevicesTable({ userClients }: ClientTableProps) {
             }
         ];
 
-        if (build === "oss") {
-            return allOptions.filter((option) => option.value !== "pending" && option.value !== "denied");
-        }
-
         return allOptions;
     }, [t]);
 
     const statusFilterDefaultValues = useMemo(() => {
-        if (build === "oss") {
-            return ["active"];
-        }
         return ["active", "pending"];
     }, []);
 

src/components/olm-install-commands.tsx

@@ -43,11 +43,11 @@ export function OlmInstallCommands({
             All: [
                 {
                     title: t("install"),
-                    command: `curl -fsSL https://static.pangolin.net/get-olm.sh | bash`
+                    command: `curl -fsSL https://static.pangolin.net/get-cli.sh | bash`
                 },
                 {
                     title: t("run"),
-                    command: `sudo olm --id ${id} --secret ${secret} --endpoint ${endpoint}`
+                    command: `sudo pangolin up --id ${id} --secret ${secret} --endpoint ${endpoint} --attach`
                 }
             ]
         },

src/middleware.ts

@@ -2,29 +2,6 @@ import { NextRequest, NextResponse } from "next/server";
 import { build } from "@server/build";
 
 export function middleware(request: NextRequest) {
-    // If build is OSS, block access to private routes
-    if (build === "oss") {
-        const pathname = request.nextUrl.pathname;
-
-        // Define private route patterns that should be blocked in OSS build
-        const privateRoutes = [
-            "/settings/billing",
-            "/settings/remote-exit-nodes",
-            "/settings/idp",
-            "/auth/org"
-        ];
-
-        // Check if current path matches any private route pattern
-        const isPrivateRoute = privateRoutes.some((route) =>
-            pathname.includes(route)
-        );
-
-        if (isPrivateRoute) {
-            // Return 404 to make it seem like the route doesn't exist
-            return new NextResponse(null, { status: 404 });
-        }
-    }
-
     return NextResponse.next();
 }