Bump fast-uri from 3.1.4 to 3.1.5

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

package-lock.json

@@ -12169,9 +12169,9 @@
             "license": "MIT"
         },
         "node_modules/fast-uri": {
-            "version": "3.1.4",
-            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-            "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+            "version": "3.1.5",
+            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+            "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
             "dev": true,
             "funding": [
                 {

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domains, orgDomains } from "@server/db";
+import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,14 +63,28 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .innerJoin(
+        .leftJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .where(and(inArray(certificates.domain, domainList)));
+        .leftJoin(
+            domainNamespaces,
+            eq(domains.domainId, domainNamespaces.domainId)
+        )
+        .where(
+            and(
+                inArray(certificates.domain, domainList),
+                // Namespace domains are shared across all orgs, so they skip
+                // the org-ownership check (mirrors verifyCertificateAccess).
+                or(
+                    isNotNull(orgDomains.orgId),
+                    isNotNull(domainNamespaces.domainNamespaceId)
+                )
+            )
+        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -110,19 +124,27 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .innerJoin(
+            .leftJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
+            .leftJoin(
+                domainNamespaces,
+                eq(domains.domainId, domainNamespaces.domainId)
+            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
+                    ),
+                    or(
+                        isNotNull(orgDomains.orgId),
+                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || initialCertValue === null) {
+    } else if (isError || (!isLoading && data === null)) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }