Bump nanoid from 3.3.12 to 3.3.18

Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.12 to 3.3.18.
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](https://github.com/ai/nanoid/compare/3.3.12...3.3.18)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

messages/en-US.json

@@ -1449,11 +1449,8 @@
     "actionSetResourcePincode": "Set Resource Pincode",
     "actionSetResourceEmailWhitelist": "Set Resource Email Whitelist",
     "actionGetResourceEmailWhitelist": "Get Resource Email Whitelist",
-    "actionListResourcePolicies": "List Resource Policies",
-    "actionCreateResourcePolicy": "Create Resource Policy",
     "actionGetResourcePolicy": "Get Resource Policy",
     "actionUpdateResourcePolicy": "Update Resource Policy",
-    "actionDeleteResourcePolicy": "Delete Resource Policy",
     "actionSetResourcePolicyUsers": "Set Resource Policy Users",
     "actionSetResourcePolicyRoles": "Set Resource Policy Roles",
     "actionSetResourcePolicyPassword": "Set Resource Policy Password",

package-lock.json

@@ -14537,9 +14537,9 @@
             }
         },
         "node_modules/nanoid": {
-            "version": "3.3.12",
-            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-            "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+            "version": "3.3.18",
+            "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+            "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
             "funding": [
                 {
                     "type": "github",

server/db/pg/schema/privateSchema.ts

@@ -95,8 +95,7 @@ export const subscriptions = pgTable("subscriptions", {
     billingCycleAnchor: bigint("billingCycleAnchor", { mode: "number" }),
     expiresAt: bigint("expiresAt", { mode: "number" }),
     trial: boolean("trial").default(false),
-    type: varchar("type", { length: 50 }), // tier1, tier2, tier3, or license
-    override: boolean("override").default(false)
+    type: varchar("type", { length: 50 }) // tier1, tier2, tier3, or license
 });
 
 export const subscriptionItems = pgTable("subscriptionItems", {

server/db/sqlite/schema/privateSchema.ts

@@ -89,8 +89,7 @@ export const subscriptions = sqliteTable("subscriptions", {
     expiresAt: integer("expiresAt"),
     trial: integer("trial", { mode: "boolean" }).default(false),
     billingCycleAnchor: integer("billingCycleAnchor"),
-    type: text("type"), // tier1, tier2, tier3, or license
-    override: integer("override", { mode: "boolean" }).default(false)
+    type: text("type") // tier1, tier2, tier3, or license
 });
 
 export const subscriptionItems = sqliteTable("subscriptionItems", {

server/lib/blueprints/types.ts

@@ -632,6 +632,7 @@ export const ResourcePolicySchema = z.object({
                 })
             )
         )
+        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
         .optional()
         .default([]),

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -53,15 +53,6 @@ export async function handleSubscriptionDeleted(
             return;
         }
 
-        // If the subscription has been manually overridden, we lock it down
-        // so Stripe can no longer change (or delete) its status locally.
-        if (existingSubscription.override === true) {
-            logger.info(
-                `Subscription ${subscription.id} is locked (override=true). Ignoring deletion event from Stripe.`
-            );
-            return;
-        }
-
         await db
             .delete(subscriptions)
             .where(eq(subscriptions.subscriptionId, subscription.id));

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -68,27 +68,13 @@ export async function handleSubscriptionUpdated(
         const type = getSubType(fullSubscription);
         const previousType = existingSubscription.type as SubscriptionType | null;
 
-        // If the subscription has been manually overridden, we lock the
-        // status down so Stripe webhooks can no longer change it.
-        const isLocked = existingSubscription.override === true;
-        if (isLocked) {
-            logger.info(
-                `Subscription ${subscription.id} is locked (override=true). Ignoring status change from Stripe (would have been ${subscription.status}).`
-            );
-        }
-        const effectiveStatus = isLocked
-            ? existingSubscription.status
-            : subscription.status;
-
         await db
             .update(subscriptions)
             .set({
-                status: effectiveStatus,
-                canceledAt: isLocked
-                    ? existingSubscription.canceledAt
-                    : subscription.canceled_at
-                      ? subscription.canceled_at
-                      : null,
+                status: subscription.status,
+                canceledAt: subscription.canceled_at
+                    ? subscription.canceled_at
+                    : null,
                 updatedAt: Math.floor(Date.now() / 1000),
                 billingCycleAnchor: subscription.billing_cycle_anchor,
                 type: type
@@ -289,23 +275,23 @@ export async function handleSubscriptionUpdated(
                 // we only need to handle the limit lifecycle for saas subscriptions not for the licenses
                 await handleSubscriptionLifesycle(
                     customer.orgId,
-                    effectiveStatus,
+                    subscription.status,
                     type
                 );
 
                 // Handle feature lifecycle when subscription is canceled or becomes unpaid
                 if (
-                    effectiveStatus === "canceled" ||
-                    effectiveStatus === "unpaid" ||
-                    effectiveStatus === "incomplete_expired"
+                    subscription.status === "canceled" ||
+                    subscription.status === "unpaid" ||
+                    subscription.status === "incomplete_expired"
                 ) {
                     logger.info(
-                        `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
+                        `Subscription ${subscription.id} for org ${customer.orgId} is ${subscription.status}, disabling paid features`
                     );
                     await handleTierChange(customer.orgId, null, previousType ?? undefined);
                 }
             } else if (type === "license") {
-                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
+                if (subscription.status === "canceled" || subscription.status == "unpaid" || subscription.status == "incomplete_expired") {
                     try {
                         // WARNING:
                         // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId

server/private/routers/policy/createResourcePolicy.ts

@@ -107,6 +107,7 @@ const createResourcePolicyBodySchema = z.strictObject({
                 })
             )
         )
+        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
         .optional()
         .default([]),

server/routers/integration.ts

@@ -726,8 +726,8 @@ authenticated.post(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl
@@ -742,8 +742,8 @@ authenticated.put(
     verifyApiKeyResourcePolicyAccess,
     verifyApiKeyRoleAccess,
     verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRoles),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
+    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
     logActionAudit(ActionsEnum.setResourcePolicyUsers),
     logActionAudit(ActionsEnum.setResourcePolicyRoles),
     policy.setResourcePolicyAccessControl

server/routers/policy/setResourcePolicyWhitelist.ts

@@ -19,6 +19,7 @@ const setResourcePolicyWhitelistBodySchema = z.strictObject({
                 })
             )
         )
+        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
 });
 

server/routers/resource/setResourceWhitelist.ts

@@ -24,6 +24,7 @@ const setResourceWhitelistBodySchema = z.strictObject({
                 })
             )
         )
+        .max(50)
         .transform((v) => v.map((e) => e.toLowerCase()))
 });
 

server/routers/user/listUsers.ts

@@ -107,7 +107,7 @@ const listUsersSchema = z.strictObject({
                 .filter((n) => Number.isInteger(n) && n > 0);
             const unique = [...new Set(nums)];
             return unique.length ? unique : undefined;
-        }, z.array(z.number().int().positive()).optional())
+        }, z.array(z.number().int().positive()).max(50).optional())
         .openapi({
             description:
                 "Filter users who have any of these role ids in the organization (repeat query param)"

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx

@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                     <SettingsSectionDescription>
                         {t("remoteExitNodeNetworkingDescription")}
                         <a
-                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
+                            href="https://docs.pangolin.net/placeholder"
                             target="_blank"
                             rel="noopener noreferrer"
                             className="text-primary hover:underline inline-flex items-center gap-1"

src/app/[orgId]/settings/access/users/[userId]/access-controls/page.tsx

@@ -38,6 +38,18 @@ import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
+const accessControlsFormSchema = z.object({
+    username: z.string(),
+    autoProvisioned: z.boolean(),
+    roles: z.array(
+        z.object({
+            id: z.string(),
+            text: z.string(),
+            isAdmin: z.boolean().optional()
+        })
+    )
+});
+
 export default function AccessControlsPage() {
     const { orgUser: user, updateOrgUser } = userOrgUserContext();
     const { user: sessionUser } = useUserContext();
@@ -57,20 +69,6 @@ export default function AccessControlsPage() {
             (build === "enterprise" && !isPaid) ||
             (build === "oss" && !isPaid));
 
-    const accessControlsFormSchema = z.object({
-        username: z.string(),
-        autoProvisioned: z.boolean(),
-        roles: z
-            .array(
-                z.object({
-                    id: z.string(),
-                    text: z.string(),
-                    isAdmin: z.boolean().optional()
-                })
-            )
-            .min(1, { message: t("accessRoleSelectPlease") })
-    });
-
     const form = useForm({
         resolver: zodResolver(accessControlsFormSchema),
         defaultValues: {
@@ -110,6 +108,15 @@ export default function AccessControlsPage() {
     async function executeSave() {
         const values = form.getValues();
 
+        if (values.roles.length === 0) {
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return;
+        }
+
         setIsSaving(true);
         try {
             const roleIds = values.roles.map((r) => parseInt(r.id, 10));
@@ -163,6 +170,15 @@ export default function AccessControlsPage() {
 
         const values = form.getValues();
 
+        if (values.roles.length === 0) {
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return;
+        }
+
         const willHaveAdminRole = values.roles.some((r) => r.isAdmin === true);
 
         const isRemovingOwnAdmin =

src/components/DomainPicker.tsx

@@ -53,7 +53,7 @@ import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { usePaidStatus } from "@/hooks/usePaidStatus";
 import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
 import { toUnicode } from "punycode";
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { useUserContext } from "@app/hooks/useUserContext";
 
 type AvailableOption = {
@@ -166,19 +166,8 @@ export default function DomainPicker({
     const [selectedProvidedDomain, setSelectedProvidedDomain] =
         useState<AvailableOption | null>(null);
 
-    // Only run the initial base-domain selection once the domains have
-    // loaded. This must not re-run on later `defaultDomainId`/`defaultSubdomain`
-    // changes, because selecting a provided (namespace) domain calls
-    // onDomainChange(null), which the parent form echoes back as
-    // defaultDomainId/defaultSubdomain becoming undefined — re-running this
-    // effect on that change would immediately snap the selector back to the
-    // organization domain, making provided domains unselectable whenever one
-    // was already set.
-    const didSelectInitialDomainRef = useRef(false);
-
     useEffect(() => {
-        if (!loadingDomains && !didSelectInitialDomainRef.current) {
-            didSelectInitialDomainRef.current = true;
+        if (!loadingDomains) {
             let domainOptionToSelect: DomainOption | null = null;
             if (organizationDomains.length > 0) {
                 // Select the first organization domain or the one provided from props

src/components/OrgInfoCard.tsx

@@ -8,7 +8,6 @@ import {
     InfoSections,
     InfoSectionTitle
 } from "@app/components/InfoSection";
-import CopyToClipboard from "@app/components/CopyToClipboard";
 import { useTranslations } from "next-intl";
 
 type OrgInfoCardProps = {};
@@ -27,9 +26,7 @@ export default function OrgInfoCard({}: OrgInfoCardProps) {
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("orgId")}</InfoSectionTitle>
-                        <InfoSectionContent>
-                            <CopyToClipboard text={org.org.orgId} />
-                        </InfoSectionContent>
+                        <InfoSectionContent>{org.org.orgId}</InfoSectionContent>
                     </InfoSection>
                     <InfoSection>
                         <InfoSectionTitle>{t("subnet")}</InfoSectionTitle>

src/components/OrgRolesTagField.tsx

@@ -9,15 +9,17 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 
+import { toast } from "@app/hooks/useToast";
 import { useTranslations } from "next-intl";
 
+import { useRef } from "react";
 import type { FieldValues, Path, UseFormReturn } from "react-hook-form";
 import { RolesSelector, type SelectedRole } from "./roles-selector";
 
 type OrgRolesTagFieldProps<TFieldValues extends FieldValues> = {
     form: Pick<
         UseFormReturn<TFieldValues>,
-        "control" | "getValues" | "setValue" | "clearErrors"
+        "control" | "getValues" | "setValue"
     >;
     orgId: string;
     /** Field in the form that holds Tag[] (role tags). Default: `"roles"`. */
@@ -40,6 +42,46 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
     disabled
 }: OrgRolesTagFieldProps<TFieldValues>) {
     const t = useTranslations();
+    const isPopoverOpenRef = useRef(false);
+    const lastValidRolesRef = useRef<SelectedRole[]>(
+        (form.getValues(name) as SelectedRole[]) ?? []
+    );
+
+    function validateRolesSelection() {
+        const current = form.getValues(name) as SelectedRole[];
+
+        if (current.length === 0 && lastValidRolesRef.current.length > 0) {
+            form.setValue(name, lastValidRolesRef.current as never, {
+                shouldDirty: true
+            });
+            toast({
+                variant: "destructive",
+                title: t("accessRoleRequired"),
+                description: t("accessRoleSelectPlease")
+            });
+            return false;
+        }
+
+        if (current.length > 0) {
+            lastValidRolesRef.current = current;
+        }
+
+        return true;
+    }
+
+    function handlePopoverOpenChange(open: boolean) {
+        isPopoverOpenRef.current = open;
+
+        if (open) {
+            const current = form.getValues(name) as SelectedRole[];
+            if (current.length > 0) {
+                lastValidRolesRef.current = current;
+            }
+            return;
+        }
+
+        validateRolesSelection();
+    }
 
     function setRoleTags(nextValue: SelectedRole[]) {
         const prev = form.getValues(name) as SelectedRole[];
@@ -57,14 +99,15 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             form.setValue(name, [prev[prev.length - 1]] as never, {
                 shouldDirty: true
             });
-            form.clearErrors(name);
             return;
         }
 
         form.setValue(name, next as never, { shouldDirty: true });
 
-        if (next.length > 0) {
-            form.clearErrors(name);
+        if (next.length > 0 && !isPopoverOpenRef.current) {
+            lastValidRolesRef.current = next;
+        } else if (!isPopoverOpenRef.current) {
+            validateRolesSelection();
         }
     }
 
@@ -74,6 +117,9 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
             name={name}
             render={({ field }) => {
                 const selectedRoles = (field.value ?? []) as SelectedRole[];
+                if (!isPopoverOpenRef.current && selectedRoles.length > 0) {
+                    lastValidRolesRef.current = selectedRoles;
+                }
 
                 return (
                     <FormItem className="flex flex-col items-start">
@@ -83,6 +129,7 @@ export default function OrgRolesTagField<TFieldValues extends FieldValues>({
                                 orgId={orgId}
                                 selectedRoles={selectedRoles}
                                 onSelectRoles={setRoleTags}
+                                onPopoverOpenChange={handlePopoverOpenChange}
                                 disabled={disabled}
                             />
                         </FormControl>

src/components/PermissionsSelectBox.tsx

@@ -115,11 +115,8 @@ function getActionsCategories(root: boolean) {
         },
 
         "Resource Policy": {
-            [t("actionListResourcePolicies")]: "listResourcePolicies",
-            [t("actionCreateResourcePolicy")]: "createResourcePolicy",
             [t("actionGetResourcePolicy")]: "getResourcePolicy",
             [t("actionUpdateResourcePolicy")]: "updateResourcePolicy",
-            [t("actionDeleteResourcePolicy")]: "deleteResourcePolicy",
             [t("actionSetResourcePolicyUsers")]: "setResourcePolicyUsers",
             [t("actionSetResourcePolicyRoles")]: "setResourcePolicyRoles",
             [t("actionSetResourcePolicyPassword")]: "setResourcePolicyPassword",