Merge pull request #3645 from fosrl/dev

Dev

.github/workflows/cicd.yml

@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-stale: 14
           days-before-close: 14

package.json

@@ -94,12 +94,12 @@
         "input-otp": "1.4.2",
         "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "4.3.0",
+        "js-yaml": "4.3.1",
         "jsonwebtoken": "9.0.3",
         "lucide-react": "1.17.0",
         "maxmind": "5.0.6",
         "moment": "2.30.1",
-        "next": "16.2.11",
+        "next": "16.3.1",
         "next-intl": "4.13.0",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
@@ -139,7 +139,7 @@
     "devDependencies": {
         "@dotenvx/dotenvx": "1.69.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.5.0",
+        "@react-email/ui": "^6.9.2",
         "@tailwindcss/postcss": "4.3.0",
         "@tanstack/react-query-devtools": "5.100.14",
         "@types/better-sqlite3": "7.6.13",
@@ -170,7 +170,7 @@
         "esbuild-node-externals": "1.22.0",
         "eslint": "10.4.0",
         "eslint-config-next": "16.2.6",
-        "postcss": "8.5.15",
+        "postcss": "8.5.23",
         "prettier": "3.8.3",
         "react-email": "6.5.0",
         "tailwindcss": "4.3.0",
@@ -182,6 +182,6 @@
     "overrides": {
         "esbuild": "0.28.0",
         "dompurify": "3.4.0",
-        "postcss": "8.5.15"
+        "postcss": "8.5.23"
     }
 }

server/lib/telemetry.ts

@@ -3,8 +3,6 @@ import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
 import {
-    aiProviders,
-    aiUsageRecords,
     alertRules,
     apiKeys,
     blueprints,
@@ -13,16 +11,7 @@ import {
     siteResources
 } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
-import {
+import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
-    eq,
-    count,
-    countDistinct,
-    notInArray,
-    and,
-    isNotNull,
-    isNull,
-    gte
-} from "drizzle-orm";
 import { APP_VERSION } from "./consts";
 import crypto from "crypto";
 import { UserType } from "@server/types/UserTypes";
@@ -183,25 +172,6 @@ class TelemetryClient {
                 .select({ count: count() })
                 .from(blueprints);
 
-            const [aiProvidersCount] = await db
-                .select({ count: count() })
-                .from(aiProviders);
-            const [orgsWithAiProviders] = await db
-                .select({ count: countDistinct(aiProviders.orgId) })
-                .from(aiProviders);
-
-            const usageWindowStart =
-                Math.floor(Date.now() / 1000) -
-                this.collectionIntervalDays * 24 * 60 * 60;
-            const [aiUsageRecordsRecent] = await db
-                .select({ count: count() })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-            const [orgsWithRecentAiUsage] = await db
-                .select({ count: countDistinct(aiUsageRecords.orgId) })
-                .from(aiUsageRecords)
-                .where(gte(aiUsageRecords.createdAt, usageWindowStart));
-
             const supporterKey = config.getSupporterData();
 
             const allPrivateResources = await db.select().from(siteResources);
@@ -212,7 +182,6 @@ class TelemetryClient {
             let numPrivResourceCidr = 0;
             let numPrivResourceHttp = 0;
             let numPrivResourceSsh = 0;
-            let numPrivResourceInference = 0;
             for (const res of allPrivateResources) {
                 if (res.mode === "host") {
                     numPrivResourceHosts += 1;
@@ -222,8 +191,6 @@ class TelemetryClient {
                     numPrivResourceHttp += 1;
                 } else if (res.mode === "ssh") {
                     numPrivResourceSsh += 1;
-                } else if (res.mode === "inference") {
-                    numPrivResourceInference += 1;
                 }
 
                 if (res.alias) {
@@ -244,11 +211,6 @@ class TelemetryClient {
                 numPrivateResourceCidr: numPrivResourceCidr,
                 numPrivateResourceHttp: numPrivResourceHttp,
                 numPrivateResourceSsh: numPrivResourceSsh,
-                numPrivateResourceInference: numPrivResourceInference,
-                numAiProviders: aiProvidersCount.count,
-                numOrgsWithAiProviders: orgsWithAiProviders.count,
-                numAiUsageRecordsRecent: aiUsageRecordsRecent.count,
-                numOrgsWithRecentAiUsage: orgsWithRecentAiUsage.count,
                 numAlertRules: numAlertRules.count,
                 numUserDevices: userDevicesCount.count,
                 numMachineClients: machineClients.count,
@@ -361,17 +323,6 @@ class TelemetryClient {
                     num_resources_non_http: stats.resources.filter(
                         (r) => r.mode !== "http"
                     ).length,
-                    num_resources_ai_gateway: stats.resources.filter(
-                        (r) => r.mode === "inference"
-                    ).length,
-                    num_private_resources_ai_gateway:
-                        stats.numPrivateResourceInference,
-                    num_ai_providers: stats.numAiProviders,
-                    num_orgs_with_ai_providers: stats.numOrgsWithAiProviders,
-                    num_ai_usage_records_recent:
-                        stats.numAiUsageRecordsRecent,
-                    num_orgs_with_recent_ai_usage:
-                        stats.numOrgsWithRecentAiUsage,
                     num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                         .length,
                     num_local_sites: stats.sites.filter(

server/routers/auth/requestPasswordReset.ts

@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib/response";
 import { db } from "@server/db";
 import { passwordResetTokens, users } from "@server/db";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
 import { createDate } from "oslo";
 import logger from "@server/logger";
@@ -49,7 +49,12 @@ export async function requestPasswordReset(
         const existingUser = await db
             .select()
             .from(users)
-            .where(eq(users.email, email));
+            .where(
+                and(
+                    eq(users.email, email),
+                    eq(users.type, UserType.Internal)
+                )
+            );
 
         if (!existingUser || !existingUser.length) {
             await randomDelay(2000);

src/app/[orgId]/settings/resources/public/create/page.tsx

@@ -50,6 +50,8 @@ import {
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { tierMatrix, TierFeature } from "@server/lib/billing/tierMatrix";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import {
     createBrowserGatewayTargetFormSchema,
@@ -57,6 +59,7 @@ import {
     selectedSiteSchema,
     type SshSettingsFormValues
 } from "@app/lib/browserGatewayTargetFormSchema";
+import { DockerManager, DockerState } from "@app/lib/docker";
 import { orgQueries } from "@app/lib/queries";
 import { finalizeSubdomainSanitize } from "@app/lib/subdomain-utils";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -325,20 +328,19 @@ export default function Page() {
     const rawResourcesAllowed =
         env.flags.allowRawResources &&
         (build !== "saas" || remoteExitNodes.length > 0);
+    const enterpriseModesAllowed =
+        !env.flags.disableEnterpriseFeatures;
 
     const availableTypes = useMemo((): NewResourceType[] => {
-        const base: NewResourceType[] = [
+        const base: NewResourceType[] = ["http", "inference"];
-            "http",
+        if (enterpriseModesAllowed) {
-            "inference",
+            base.push("ssh", "rdp", "vnc");
-            "ssh",
+        }
-            "rdp",
-            "vnc"
-        ];
         if (rawResourcesAllowed) {
             base.push("tcp", "udp");
         }
         return base;
-    }, [rawResourcesAllowed]);
+    }, [enterpriseModesAllowed, rawResourcesAllowed]);
 
     useEffect(() => {
         if (!availableTypes.includes(resourceType)) {

src/i18n/detectLocale.test.ts

@@ -0,0 +1,74 @@
+import { assertEquals } from "@test/assert";
+import { detectLocale } from "./detectLocale";
+
+function runTests() {
+    assertEquals(
+        detectLocale("zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6"),
+        "zh-TW",
+        "An exact regional match should take precedence over a language fallback"
+    );
+    assertEquals(
+        detectLocale("ZH-tw"),
+        "zh-TW",
+        "Locale matching should be case-insensitive"
+    );
+    assertEquals(
+        detectLocale("  zh-TW ; q=1 , zh-CN;q=0.8 "),
+        "zh-TW",
+        "Whitespace and quality parameters should not prevent an exact match"
+    );
+    assertEquals(
+        detectLocale("zh-CN,zh-TW;q=0.9"),
+        "zh-CN",
+        "Simplified Chinese should still match exactly"
+    );
+    assertEquals(
+        detectLocale("zh"),
+        "zh-CN",
+        "A generic Chinese preference should retain the existing fallback"
+    );
+    assertEquals(
+        detectLocale("en-GB,en;q=0.9"),
+        "en-US",
+        "An unsupported region should fall back to a supported locale for the language"
+    );
+    assertEquals(
+        detectLocale("ja-JP,zh-TW;q=0.9"),
+        "zh-TW",
+        "The next preference should be used when a language is unsupported"
+    );
+    assertEquals(
+        detectLocale("zh-CN;q=0.5,zh-TW;q=0.9"),
+        "zh-TW",
+        "Preferences should be evaluated by quality"
+    );
+    assertEquals(
+        detectLocale("zh-TW;q=0,fr-FR;q=0.8"),
+        "fr-FR",
+        "Locales with zero quality should be excluded"
+    );
+    assertEquals(
+        detectLocale("*,de-DE;q=0.8"),
+        "de-DE",
+        "A wildcard should not obscure a supported preference"
+    );
+    assertEquals(
+        detectLocale("ja-JP"),
+        undefined,
+        "An unsupported language should not match"
+    );
+    assertEquals(
+        detectLocale(""),
+        undefined,
+        "An empty Accept-Language header should not match"
+    );
+
+    console.log("All locale detection tests passed!");
+}
+
+try {
+    runTests();
+} catch (error) {
+    console.error("Locale detection test failed:", error);
+    process.exit(1);
+}

src/i18n/detectLocale.ts

@@ -0,0 +1,48 @@
+import { Locale, locales } from "./config";
+
+export function detectLocale(acceptLanguage: string): Locale | undefined {
+    const browserLocales = acceptLanguage
+        .split(",")
+        .map((entry, index) => {
+            const [locale, ...parameters] = entry.trim().split(";");
+            const qualityParameter = parameters.find((parameter) =>
+                parameter.trim().toLowerCase().startsWith("q=")
+            );
+            const quality = qualityParameter
+                ? Number(qualityParameter.trim().slice(2))
+                : 1;
+
+            return {
+                locale: locale.trim().toLowerCase(),
+                quality,
+                index
+            };
+        })
+        .filter(
+            ({ locale, quality }) =>
+                locale && locale !== "*" && quality > 0 && quality <= 1
+        )
+        .sort(
+            (left, right) =>
+                right.quality - left.quality || left.index - right.index
+        );
+
+    for (const { locale: browserLocale } of browserLocales) {
+        const exactMatch = locales.find(
+            (locale) => locale.toLowerCase() === browserLocale
+        );
+        if (exactMatch) {
+            return exactMatch;
+        }
+
+        const browserLanguage = browserLocale.split("-")[0];
+        const languageMatch = locales.find(
+            (locale) => locale.split("-")[0].toLowerCase() === browserLanguage
+        );
+        if (languageMatch) {
+            return languageMatch;
+        }
+    }
+
+    return undefined;
+}

src/services/locale.ts

@@ -2,6 +2,7 @@
 
 import { cookies, headers } from "next/headers";
 import { Locale, defaultLocale, locales } from "@/i18n/config";
+import { detectLocale } from "@/i18n/detectLocale";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 
@@ -47,12 +48,7 @@ export async function getUserLocale(): Promise<Locale> {
     const acceptLang = headerList.get("accept-language");
 
     if (acceptLang) {
-        const browserLang = acceptLang.split(",")[0];
+        const matched = detectLocale(acceptLang);
-        const matched = locales.find((locale) =>
-            browserLang
-                .toLowerCase()
-                .startsWith(locale.split("-")[0].toLowerCase())
-        );
         if (matched) {
             return matched;
         }