🚧 wip

Move rate linmit to file

messages/en-US.json

@@ -1804,6 +1804,10 @@
     "alertingRulesBannerDescription": "Each rule ties together what to watch (a site, health check, or resource), when to fire (for example offline or unhealthy), and how to notify your team via email, webhooks, or integrations. Use this list to create, enable, and manage those rules.",
     "alertingHealthChecksBannerTitle": "Monitor Health & Resources",
     "alertingHealthChecksBannerDescription": "Health checks are HTTP or TCP monitors you define once. You can then use them as sources in alert rules so you get notified when a target becomes healthy or unhealthy. Health checks on resources also appear here.",
+    "alertingTestRule": "Test Alert Rule",
+    "alertingNoActionsTitle": "No actions configured",
+    "alertingNoActionsSaveDescription": "Add at least one action so this rule can notify someone when it fires.",
+    "alertingNoActionsTestDescription": "Add at least one action before you can test this rule.",
     "standaloneHcTableTitle": "Health Checks",
     "standaloneHcSearchPlaceholder": "Search health checks…",
     "standaloneHcAddButton": "Create Health Check",

server/auth/actions.ts

@@ -151,6 +151,7 @@ export enum ActionsEnum {
     createAlertRule = "createAlertRule",
     updateAlertRule = "updateAlertRule",
     deleteAlertRule = "deleteAlertRule",
+    testAlertRule = "testAlertRule",
     listAlertRules = "listAlertRules",
     listOrgLabels = "listOrgLabels",
     createOrgLabel = "createOrgLabel",

server/private/lib/alerts/processTestAlerts.ts

@@ -0,0 +1,73 @@
+import logger from "@server/logger";
+import type {
+    EmailAlertAction,
+    TestAlertContext
+} from "@server/routers/alertRule/types";
+import { sendAlertEmail } from "./sendAlertEmail";
+import type { db, alertEmailRecipients, users, userOrgRoles } from "@server/db";
+import type { eq } from "drizzle-orm";
+
+export async function processTestAlerts(context: TestAlertContext) {
+    const emailActions = context.actions.filter(
+        (action) => action.type === "email"
+    );
+    // Process email actions
+    for (const action of emailActions) {
+        try {
+            const recipients = await resolveEmailRecipients(action);
+            if (recipients.length > 0) {
+                await sendAlertEmail(recipients, context);
+            }
+        } catch (err) {
+            logger.error(`processAlerts: failed to send alert email`, err);
+        }
+    }
+}
+
+/**
+ * Resolves all email addresses for a given `emailActionId`.
+ *
+ * Recipients may be:
+ * - Direct users (by `userId`)
+ * - All users in a role (by `roleId`, resolved via `userOrgRoles`)
+ * - Direct external email addresses
+ */
+async function resolveEmailRecipients(
+    action: EmailAlertAction
+): Promise<string[]> {
+    const emailSet = new Set<string>();
+
+    // for (const row of rows) {
+    //     if (row.email) {
+    //         emailSet.add(row.email);
+    //     }
+
+    //     if (row.userId) {
+    //         const [user] = await db
+    //             .select({ email: users.email })
+    //             .from(users)
+    //             .where(eq(users.userId, row.userId))
+    //             .limit(1);
+    //         if (user?.email) {
+    //             emailSet.add(user.email);
+    //         }
+    //     }
+
+    //     if (row.roleId) {
+    //         // Find all users with this role via userOrgRoles
+    //         const roleUsers = await db
+    //             .select({ email: users.email })
+    //             .from(userOrgRoles)
+    //             .innerJoin(users, eq(userOrgRoles.userId, users.userId))
+    //             .where(eq(userOrgRoles.roleId, Number(row.roleId)));
+
+    //         for (const u of roleUsers) {
+    //             if (u.email) {
+    //                 emailSet.add(u.email);
+    //             }
+    //         }
+    //     }
+    // }
+
+    return Array.from(emailSet);
+}

server/private/routers/alertRule/index.ts

@@ -16,3 +16,4 @@ export * from "./updateAlertRule";
 export * from "./deleteAlertRule";
 export * from "./listAlertRules";
 export * from "./getAlertRule";
+export * from "./testAlertRule";

server/private/routers/alertRule/testAlertRule.ts

@@ -0,0 +1,107 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import {
+    alertRules,
+    alertSites,
+    alertHealthChecks,
+    alertResources
+} from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { and, asc, desc, eq, inArray, like, or, sql } from "drizzle-orm";
+import { ListAlertRulesResponse } from "@server/routers/alertRule/types";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty()
+});
+
+export const SITE_EVENT_TYPES = [
+    "site_online",
+    "site_offline",
+    "site_toggle"
+] as const;
+export const HC_EVENT_TYPES = [
+    "health_check_healthy",
+    "health_check_unhealthy",
+    "health_check_toggle"
+] as const;
+export const RESOURCE_EVENT_TYPES = [
+    "resource_healthy",
+    "resource_unhealthy",
+    "resource_degraded",
+    "resource_toggle"
+] as const;
+
+const webhookActionSchema = z.strictObject({
+    webhookUrl: z.string().url(),
+    config: z.string().optional(),
+    enabled: z.boolean().optional().default(true)
+});
+
+const bodySchema = z.strictObject({
+    eventType: z.enum([
+        ...HC_EVENT_TYPES,
+        ...SITE_EVENT_TYPES,
+        ...RESOURCE_EVENT_TYPES
+    ]),
+    // Email recipients (flat)
+    userIds: z.array(z.string().nonempty()).optional().default([]),
+    roleIds: z.array(z.number()).optional().default([]),
+    emails: z.array(z.email()).optional().default([]),
+    // Webhook actions
+    webhookActions: z.array(webhookActionSchema).optional().default([])
+});
+
+export async function testAlertRule(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        // TODO: process alert rule
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/certificates/getBatchedCertificates.ts

@@ -10,12 +10,12 @@
  *
  * This file is not licensed under the AGPLv3.
  */
-import { certificates, db, domains, orgDomains } from "@server/db";
+import { certificates, db, domainNamespaces, domains, orgDomains } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
 import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, or } from "drizzle-orm";
 import { NextFunction, Request, Response } from "express";
 import createHttpError from "http-errors";
 import { z } from "zod";
@@ -63,14 +63,28 @@ async function query(orgId: string, domainList: string[]) {
         })
         .from(certificates)
         .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .innerJoin(
+        .leftJoin(
             orgDomains,
             and(
                 eq(domains.domainId, orgDomains.domainId),
                 eq(orgDomains.orgId, orgId)
             )
         )
-        .where(and(inArray(certificates.domain, domainList)));
+        .leftJoin(
+            domainNamespaces,
+            eq(domains.domainId, domainNamespaces.domainId)
+        )
+        .where(
+            and(
+                inArray(certificates.domain, domainList),
+                // Namespace domains are shared across all orgs, so they skip
+                // the org-ownership check (mirrors verifyCertificateAccess).
+                or(
+                    isNotNull(orgDomains.orgId),
+                    isNotNull(domainNamespaces.domainNamespaceId)
+                )
+            )
+        );
 
     // All non resolved domain certificates might be `ns` or `wildcard`,
     // which means exact domain certificates do not exist
@@ -110,19 +124,27 @@ async function query(orgId: string, domainList: string[]) {
             })
             .from(certificates)
             .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .innerJoin(
+            .leftJoin(
                 orgDomains,
                 and(
                     eq(domains.domainId, orgDomains.domainId),
                     eq(orgDomains.orgId, orgId)
                 )
             )
+            .leftJoin(
+                domainNamespaces,
+                eq(domains.domainId, domainNamespaces.domainId)
+            )
             .where(
                 and(
                     eq(certificates.wildcard, true),
                     or(
                         inArray(certificates.domain, [...domainLevelDownSet]),
                         inArray(certificates.domain, [...wildcardDomainSet])
+                    ),
+                    or(
+                        isNotNull(orgDomains.orgId),
+                        isNotNull(domainNamespaces.domainNamespaceId)
                     )
                 )
             );

server/private/routers/external.ts

@@ -808,6 +808,14 @@ authenticated.get(
     alertRule.listAlertRules
 );
 
+authenticated.post(
+    "/org/:orgId/alert-rule/test",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.testAlertRule),
+    alertRule.testAlertRule
+);
+
 authenticated.get(
     "/org/:orgId/alert-rule/:alertRuleId",
     verifyValidLicense,

server/routers/alertRule/types.ts

@@ -124,3 +124,26 @@ export interface AlertContext {
     /** Human-readable context data included in emails and webhook payloads */
     data: Record<string, unknown>;
 }
+
+export type EmailAlertAction = {
+    type: "email";
+    userIds?: string[];
+    roleIds?: string[];
+    emails?: string[];
+};
+
+export type WebhookAlertAction = {
+    type: "webhook";
+    webhookUrl: string;
+    enabled: boolean;
+    config?: string | undefined;
+};
+
+type AlertAction = EmailAlertAction | WebhookAlertAction;
+export interface TestAlertContext {
+    eventType: AlertEventType;
+    actions: AlertAction[];
+    orgId: string;
+    /** Human-readable context data included in emails and webhook payloads */
+    data: Record<string, unknown>;
+}

server/routers/role/createRole.ts

@@ -34,7 +34,9 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources
+    ActionsEnum.listResources,
+    ActionsEnum.getSiteResource,
+    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,11 +3,13 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
+    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels
+    labels,
+    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        const conditions = [and(eq(siteResources.orgId, orgId))];
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
+        const conditions = [
+            and(
+                eq(siteResources.orgId, orgId),
+                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
+            )
+        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,11 +1,17 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, networks, siteNetworks } from "@server/db";
+import {
+    db,
+    networks,
+    roleSiteResources,
+    siteNetworks,
+    userSiteResources
+} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq } from "drizzle-orm";
+import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -159,10 +165,47 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId)
+            eq(siteResources.orgId, orgId),
+            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/setup/migrationsPg.ts

@@ -28,6 +28,7 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
+import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -55,7 +56,8 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 }
+    { version: "1.21.0", run: m22 },
+    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,6 +47,7 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
+import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -91,7 +92,8 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 }
+    { version: "1.21.0", run: m44 },
+    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -0,0 +1,37 @@
+import { db } from "@server/db/pg/driver";
+import { sql } from "drizzle-orm";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        for (const actionId of actionsToGrant) {
+            await db.execute(sql`
+                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ${actionId}, r."orgId"
+                FROM "roles" r
+                WHERE COALESCE(r."isAdmin", false) = false
+                  AND NOT EXISTS (
+                    SELECT 1 FROM "roleActions" ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ${actionId}
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+        }
+
+        await db.execute(sql`COMMIT`);
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+}

server/setup/scriptsSqlite/1.21.1.ts

@@ -0,0 +1,43 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import path from "path";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.transaction(() => {
+            const insertRoleAction = db.prepare(`
+                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ?, r."orgId"
+                FROM 'roles' r
+                WHERE COALESCE(r."isAdmin", 0) = 0
+                  AND NOT EXISTS (
+                    SELECT 1 FROM 'roleActions' ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ?
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+
+            for (const actionId of actionsToGrant) {
+                insertRoleAction.run(actionId, actionId);
+            }
+        })();
+
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    } finally {
+        db.close();
+    }
+}

src/app/[orgId]/settings/(private)/remote-exit-nodes/[remoteExitNodeId]/networking/page.tsx

@@ -181,7 +181,7 @@ export default function NetworkingPage() {
                     <SettingsSectionDescription>
                         {t("remoteExitNodeNetworkingDescription")}
                         <a
-                            href="https://docs.pangolin.net/placeholder"
+                            href="https://docs.pangolin.net/manage/remote-node/backhaul"
                             target="_blank"
                             rel="noopener noreferrer"
                             className="text-primary hover:underline inline-flex items-center gap-1"

src/components/ContactSalesBanner.tsx

@@ -24,16 +24,18 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <Link
+                        <span className="whitespace-nowrap">
-                            href="https://pangolin.net/contact"
+                            <Link
-                            target="_blank"
+                                href="https://pangolin.net/contact"
-                            rel="noopener noreferrer"
+                                target="_blank"
-                            className="inline-flex items-center gap-1 font-medium text-black-600 underline"
+                                rel="noopener noreferrer"
-                        >
+                                className="inline-flex items-center gap-1 font-medium text-black-600 underline"
-                            {t("contactSalesContactUs")}
+                            >
-                            <ExternalLink className="size-3.5 shrink-0" />
+                                {t("contactSalesContactUs")}
-                        </Link>
+                                <ExternalLink className="size-3.5 shrink-0" />
-                        .
+                            </Link>
+                            .
+                        </span>
                     </span>
                 </div>
             </div>

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS } from "input-otp";
+import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,9 +82,11 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="numeric"
+                                            inputMode="text"
                                             autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS}
+                                            pattern={
+                                                REGEXP_ONLY_DIGITS_AND_CHARS
+                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {

src/components/alert-rule-editor/AlertRuleGraphEditor.tsx

@@ -6,7 +6,9 @@ import {
     AlertRuleSourceFields,
     AlertRuleTriggerFields
 } from "@app/components/alert-rule-editor/AlertRuleFields";
+import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { SettingsContainer } from "@app/components/Settings";
+import { SwitchInput } from "@app/components/SwitchInput";
 import { Button } from "@app/components/ui/button";
 import { Card, CardContent } from "@app/components/ui/card";
 import {
@@ -19,6 +21,7 @@ import {
     FormMessage
 } from "@app/components/ui/form";
 import { Input } from "@app/components/ui/input";
+import { useEnvContext } from "@app/hooks/useEnvContext";
 import { toast } from "@app/hooks/useToast";
 import {
     buildFormSchema,
@@ -27,19 +30,15 @@ import {
     type AlertRuleFormValues
 } from "@app/lib/alertRuleForm";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { useEnvContext } from "@app/hooks/useEnvContext";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import type { CreateAlertRuleResponse } from "@server/routers/alertRule/types";
 import type { AxiosResponse } from "axios";
-import { zodResolver } from "@hookform/resolvers/zod";
+import { Cog, Flag, Zap, ZapIcon } from "lucide-react";
-import { ChevronLeft, Cog, Flag, Zap } from "lucide-react";
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { useMemo, useState, type ReactNode } from "react";
-import { useFieldArray, useForm, type Resolver } from "react-hook-form";
 import { useTranslations } from "next-intl";
-import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import { useRouter } from "next/navigation";
-import { SwitchInput } from "@app/components/SwitchInput";
+import { useActionState, useMemo, useTransition, type ReactNode } from "react";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
+import { useFieldArray, useForm, type Resolver } from "react-hook-form";
 import { Badge } from "../ui/badge";
 
 const FORM_ID = "alert-rule-form";
@@ -115,7 +114,6 @@ export default function AlertRuleGraphEditor({
     const t = useTranslations();
     const router = useRouter();
     const api = createApiClient(useEnvContext());
-    const [isSaving, setIsSaving] = useState(false);
     const schema = useMemo(() => buildFormSchema(t), [t]);
     const form = useForm<AlertRuleFormValues>({
         resolver: zodResolver(schema) as Resolver<AlertRuleFormValues>,
@@ -127,8 +125,22 @@ export default function AlertRuleGraphEditor({
         name: "actions"
     });
 
-    const onSubmit = form.handleSubmit(async (values) => {
+    const saveAlert = async () => {
-        setIsSaving(true);
+        const isValid = await form.trigger();
+        if (!isValid) {
+            const values = form.getValues();
+            if (values.actions.length === 0) {
+                toast({
+                    variant: "warning",
+                    title: t("alertingNoActionsTitle"),
+                    description: t("alertingNoActionsSaveDescription")
+                });
+            }
+            return;
+        }
+
+        const values = form.getValues();
+
         try {
             const payload = formValuesToApiPayload(values);
             if (isNew) {
@@ -158,14 +170,37 @@ export default function AlertRuleGraphEditor({
                 description: formatAxiosError(e),
                 variant: "destructive"
             });
-        } finally {
-            setIsSaving(false);
         }
-    });
+        // const submit = form.handleSubmit(async (values) => {
+
+        // });
+
+        // await submit();
+    };
+
+    const testAlert = async () => {
+        const isValid = await form.trigger();
+        if (!isValid) {
+            const values = form.getValues();
+            if (values.actions.length === 0) {
+                toast({
+                    variant: "warning",
+                    title: t("alertingNoActionsTitle"),
+                    description: t("alertingNoActionsTestDescription")
+                });
+            }
+            return;
+        }
+
+        const values = form.getValues();
+    };
+
+    const [, formAction, isSaving] = useActionState(saveAlert, null);
+    const [isTestingAlert, startTransition] = useTransition();
 
     return (
         <Form {...form}>
-            <form id={FORM_ID} onSubmit={onSubmit}>
+            <form id={FORM_ID} action={formAction}>
                 <SettingsContainer>
                     <PaidFeaturesAlert tiers={tierMatrix.alertingRules} />
                     <div className="flex flex-col lg:flex-row gap-6 lg:gap-8 items-start">
@@ -263,14 +298,29 @@ export default function AlertRuleGraphEditor({
                                                 </FormItem>
                                             )}
                                         />
-                                        <Button
+                                        <div className="flex flex-col items-center w-full gap-3">
-                                            type="submit"
+                                            <Button
-                                            className="w-full"
+                                                type="submit"
-                                            disabled={isSaving}
+                                                className="w-full"
-                                            loading={isSaving}
+                                                disabled={isSaving}
-                                        >
+                                                loading={isSaving}
-                                            {t("save")}
+                                            >
-                                        </Button>
+                                                {t("save")}
+                                            </Button>
+
+                                            <Button
+                                                type="button"
+                                                variant="outline"
+                                                className="w-full gap-1.5"
+                                                onClick={() =>
+                                                    startTransition(testAlert)
+                                                }
+                                                loading={isTestingAlert}
+                                            >
+                                                {t("alertingTestRule")}
+                                                <ZapIcon className="size-3.5 flex-none" />
+                                            </Button>
+                                        </div>
                                     </fieldset>
                                 </CardContent>
                             </Card>

src/hooks/useCertificate.ts

@@ -111,7 +111,7 @@ export function useCertificate({
     let certError: string | null = null;
     if (restartCert.isError) {
         certError = "Failed to restart";
-    } else if (isError || initialCertValue === null) {
+    } else if (isError || (!isLoading && data === null)) {
         // Null value means failed to get the certificate
         certError = "Failed";
     }