Bump node in the docker-dependencies group across 1 directory

Bumps the docker-dependencies group with 1 update in the / directory: node.


Updates `node` from 24.18.1-alpine to 26.7.0-alpine

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26.7.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/cicd.yml

@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-stale: 14
           days-before-close: 14

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:26.7.0-alpine
 
 WORKDIR /app
 

package.json

@@ -94,12 +94,12 @@
         "input-otp": "1.4.2",
         "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "4.3.0",
+        "js-yaml": "4.3.1",
         "jsonwebtoken": "9.0.3",
         "lucide-react": "1.17.0",
         "maxmind": "5.0.6",
         "moment": "2.30.1",
-        "next": "16.2.11",
+        "next": "16.3.1",
         "next-intl": "4.13.0",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
@@ -139,7 +139,7 @@
     "devDependencies": {
         "@dotenvx/dotenvx": "1.69.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.5.0",
+        "@react-email/ui": "^6.9.2",
         "@tailwindcss/postcss": "4.3.0",
         "@tanstack/react-query-devtools": "5.100.14",
         "@types/better-sqlite3": "7.6.13",
@@ -170,7 +170,7 @@
         "esbuild-node-externals": "1.22.0",
         "eslint": "10.4.0",
         "eslint-config-next": "16.2.6",
-        "postcss": "8.5.15",
+        "postcss": "8.5.23",
         "prettier": "3.8.3",
         "react-email": "6.5.0",
         "tailwindcss": "4.3.0",
@@ -182,6 +182,6 @@
     "overrides": {
         "esbuild": "0.28.0",
         "dompurify": "3.4.0",
-        "postcss": "8.5.15"
+        "postcss": "8.5.23"
     }
 }

server/db/pg/schema/schema.ts

@@ -1984,7 +1984,7 @@ export const aiSessionLog = pgTable(
         // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
         truncated: boolean("truncated").notNull().default(false),
         statusCode: integer("statusCode"),
-        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch seconds
+        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch ms
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/db/sqlite/schema/schema.ts

@@ -1980,7 +1980,7 @@ export const aiSessionLog = sqliteTable(
             .notNull()
             .default(false),
         statusCode: integer("statusCode"),
-        createdAt: integer("createdAt").notNull() // epoch seconds
+        createdAt: integer("createdAt").notNull() // epoch ms
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/lib/aiBudgetEnforcement.ts

@@ -580,8 +580,6 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             );
         }
 
-        const timestamp = Math.floor(Date.now() / 1000);
-
         usageRecordBuffer.push({
             orgId: input.orgId,
             providerId: input.providerId,
@@ -599,7 +597,7 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             totalTokens,
             costUsd: input.costUsd,
             estimated: usage.estimated,
-            createdAt: input.createdAt ?? timestamp
+            createdAt: input.createdAt ?? Date.now()
         });
 
         // Flush immediately if buffer is full, otherwise schedule a flush

server/lib/domainUtils.ts

@@ -52,7 +52,8 @@ export async function validateAndConstructDomain(
             };
         }
 
-        if (!domainRes.orgDomains) {
+        // Check if organization has access to domain
+        if (domainRes.orgDomains && domainRes.orgDomains.orgId !== orgId) {
             return {
                 success: false,
                 error: `Organization does not have access to domain with ID ${domainId}`

server/lib/textCompression.ts

@@ -1,15 +0,0 @@
-import { gzipSync, gunzipSync } from "zlib";
-
-/**
- * Gzip a string and return it as base64 so it can be stored in a TEXT column.
- */
-export function compressText(value: string): string {
-    return gzipSync(Buffer.from(value, "utf8")).toString("base64");
-}
-
-/**
- * Reverse of compressText - base64-decode and gunzip back to the original string.
- */
-export function decompressText(value: string): string {
-    return gunzipSync(Buffer.from(value, "base64")).toString("utf8");
-}

server/private/lib/logStreaming/LogStreamingManager.ts

@@ -25,7 +25,6 @@ import {
 import logger from "@server/logger";
 import { and, eq, gt, desc, max, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
-import { decompressText } from "@server/lib/textCompression";
 import config from "@server/lib/config";
 import {
     LogType,
@@ -681,8 +680,8 @@ export class LogStreamingManager {
                     Record<string, unknown> & { id: number }
                 >;
 
-            case "aiSession": {
+            case "aiSession":
-                const rows = (await logsDb
+                return (await logsDb
                     .select()
                     .from(aiSessionLog)
                     .where(
@@ -695,33 +694,6 @@ export class LogStreamingManager {
                     .limit(limit)) as Array<
                     Record<string, unknown> & { id: number }
                 >;
-
-                const compressedFields = [
-                    "requestBody",
-                    "responseBody",
-                    "normalizedRequest",
-                    "normalizedResponse"
-                ] as const;
-
-                for (const row of rows) {
-                    for (const field of compressedFields) {
-                        const value = row[field];
-                        if (typeof value !== "string") {
-                            continue;
-                        }
-                        try {
-                            row[field] = decompressText(value);
-                        } catch (error) {
-                            logger.error(
-                                `Failed to decompress AI session log field ${field}`,
-                                { error }
-                            );
-                        }
-                    }
-                }
-
-                return rows;
-            }
         }
     }
 

server/private/routers/aiGateway/logAiSession.ts

@@ -18,7 +18,6 @@ import { and, eq, lt } from "drizzle-orm";
 import cache from "#private/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { sanitizeString } from "@server/lib/sanitize";
-import { compressText } from "@server/lib/textCompression";
 import type { AiCapability } from "@server/lib/aiCapabilities";
 import {
     normalizeAiRequest,
@@ -152,14 +151,17 @@ async function getRetentionDays(orgId: string): Promise<number> {
 }
 
 export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
-    const cutoffTimestamp = calculateCutoffTimestamp(retentionDays);
+    // calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
+    // requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
+    // match aiUsageRecords - convert before comparing.
+    const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
 
     try {
         await logsDb
             .delete(aiSessionLog)
             .where(
                 and(
-                    lt(aiSessionLog.createdAt, cutoffTimestamp),
+                    lt(aiSessionLog.createdAt, cutoffTimestampMs),
                     eq(aiSessionLog.orgId, orgId)
                 )
             );
@@ -241,8 +243,6 @@ export function logAiSession(data: {
                 );
             }
 
-            const timestamp = Math.floor(Date.now() / 1000);
-
             sessionLogBuffer.push({
                 sessionId: data.sessionId,
                 orgId: sanitizeString(data.orgId),
@@ -256,19 +256,13 @@ export function logAiSession(data: {
                 ),
                 requestedModel: sanitizeString(data.requestedModel),
                 isStream: data.isStream,
-                requestBody: compressText(
+                requestBody: sanitizeString(requestBodyText.value),
-                    sanitizeString(requestBodyText.value)
+                responseBody: sanitizeString(responseBodyText.value),
-                ),
-                responseBody: compressText(
-                    sanitizeString(responseBodyText.value)
-                ),
                 normalizedRequest: normalizedRequestText
-                    ? compressText(sanitizeString(normalizedRequestText.value))
+                    ? sanitizeString(normalizedRequestText.value)
                     : undefined,
                 normalizedResponse: normalizedResponseText
-                    ? compressText(
+                    ? sanitizeString(normalizedResponseText.value)
-                          sanitizeString(normalizedResponseText.value)
-                      )
                     : undefined,
                 truncated:
                     requestBodyText.truncated ||
@@ -276,7 +270,7 @@ export function logAiSession(data: {
                     (normalizedRequestText?.truncated ?? false) ||
                     (normalizedResponseText?.truncated ?? false),
                 statusCode: data.statusCode,
-                createdAt: timestamp
+                createdAt: Date.now()
             });
 
             // Flush immediately if buffer is full, otherwise schedule a flush

server/routers/auditLogs/aiUsageAnalyticsShared.ts

@@ -18,7 +18,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -31,7 +31,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",
@@ -122,12 +122,12 @@ export function buildAiUsageWhere(
     );
 }
 
-// Buckets createdAt (epoch seconds) down to a per-day string, dialect-aware,
+// Buckets createdAt (epoch ms) down to a per-day string, dialect-aware, same
-// same approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
+// approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
 export function dayBucketExpr() {
     return driver === "pg"
-        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt}))`
+        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt} / 1000.0))`
-        : sql<string>`DATE(${aiUsageRecords.createdAt}, 'unixepoch')`;
+        : sql<string>`DATE(${aiUsageRecords.createdAt} / 1000, 'unixepoch')`;
 }
 
 export type DailyMetricRow<K extends string> = {

server/routers/auditLogs/exportAiSessionLog.ts

@@ -11,8 +11,7 @@ import {
     queryAiSessionLogsQuery,
     queryAiSessionLogsParams,
     queryAiSession,
-    countAiSessionQuery,
+    countAiSessionQuery
-    decompressAiSessionLogRow
 } from "./queryAiSessionLog";
 import { generateCSV } from "./generateCSV";
 
@@ -88,9 +87,7 @@ export async function exportAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const log = (await baseQuery.limit(MAX_EXPORT_LIMIT)).map(
+        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);
-            decompressAiSessionLogRow
-        );
 
         const csvData = generateCSV(log);
 

server/routers/auditLogs/queryAiSessionLog.ts

@@ -24,7 +24,6 @@ import { AI_CAPABILITIES } from "@server/lib/aiCapabilities";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
-import { decompressText } from "@server/lib/textCompression";
 
 export const queryAiSessionLogsQuery = z.strictObject({
     // iso string just validate its a parseable date
@@ -33,7 +32,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -46,7 +45,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
@@ -167,35 +166,6 @@ export function queryAiSession(data: Q) {
         .orderBy(desc(aiSessionLog.createdAt));
 }
 
-function decompressField(value: string | null): string | null {
-    if (value == null) {
-        return value;
-    }
-    try {
-        return decompressText(value);
-    } catch (error) {
-        logger.error("Failed to decompress AI session log field", { error });
-        return value;
-    }
-}
-
-export function decompressAiSessionLogRow<
-    T extends {
-        requestBody: string | null;
-        responseBody: string | null;
-        normalizedRequest: string | null;
-        normalizedResponse: string | null;
-    }
->(row: T): T {
-    return {
-        ...row,
-        requestBody: decompressField(row.requestBody),
-        responseBody: decompressField(row.responseBody),
-        normalizedRequest: decompressField(row.normalizedRequest),
-        normalizedResponse: decompressField(row.normalizedResponse)
-    };
-}
-
 async function enrichWithDetails(
     logs: Awaited<ReturnType<typeof queryAiSession>>
 ) {
@@ -650,9 +620,7 @@ export async function queryAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const logsRaw = (
+        const logsRaw = await baseQuery.limit(data.limit).offset(data.offset);
-            await baseQuery.limit(data.limit).offset(data.offset)
-        ).map(decompressAiSessionLogRow);
 
         const log = await enrichWithDetails(logsRaw);
 

server/routers/auditLogs/queryAiUsageFilterOptions.ts

@@ -30,14 +30,14 @@ const queryAiUsageFilterOptionsQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString()),
     timeEnd: z
         .string()
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => new Date().toISOString())
 });
 

server/routers/auth/requestPasswordReset.ts

@@ -6,7 +6,7 @@ import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib/response";
 import { db } from "@server/db";
 import { passwordResetTokens, users } from "@server/db";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { alphabet, generateRandomString, sha256 } from "oslo/crypto";
 import { createDate } from "oslo";
 import logger from "@server/logger";
@@ -49,7 +49,12 @@ export async function requestPasswordReset(
         const existingUser = await db
             .select()
             .from(users)
-            .where(eq(users.email, email));
+            .where(
+                and(
+                    eq(users.email, email),
+                    eq(users.type, UserType.Internal)
+                )
+            );
 
         if (!existingUser || !existingUser.length) {
             await randomDelay(2000);

server/routers/external.ts

@@ -66,10 +66,6 @@ import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";
 
-function rateLimitIdentityKey(value: unknown): string {
-    return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
-
 // Root routes
 export const unauthenticated = Router();
 
@@ -1931,7 +1927,7 @@ authRouter.put(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}`,
+            `signup:${ipKeyGenerator(req.ip || "")}:${req.body.email}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1946,7 +1942,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `login:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `login:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only log in ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1963,7 +1959,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `lookupUser:${rateLimitIdentityKey(req.body.identifier) || ipKeyGenerator(req.ip || "")}`,
+            `lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2041,7 +2037,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only enable 2FA ${15} times every ${15} minutes. Please try again later.`;
@@ -2057,7 +2053,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only request a 2FA code ${15} times every ${15} minutes. Please try again later.`;
@@ -2089,7 +2085,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `signup:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2107,7 +2103,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestEmailVerificationCode:${rateLimitIdentityKey(req.user?.email) || ipKeyGenerator(req.ip || "")}`,
+            `requestEmailVerificationCode:${req.user?.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request an email verification code ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2129,7 +2125,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestPasswordReset:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `requestPasswordReset:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2145,7 +2141,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `resetPassword:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `resetPassword:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2192,7 +2188,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}:${req.params.resourceId}`,
+            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${req.body.email}:${req.params.resourceId}`,
         handler: (req, res, next) => {
             const message = `You can only request an email OTP ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2244,7 +2240,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000, // 15 minutes
         max: 10, // Allow 10 authentication attempts per 15 minutes per IP
         keyGenerator: (req) => {
-            return `securityKeyAuth:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`;
+            return `securityKeyAuth:${req.body.email || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only attempt security key authentication ${10} times every ${15} minutes. Please try again later.`;

server/routers/org/getOrg.ts

@@ -16,12 +16,13 @@ const getOrgSchema = z.strictObject({
 });
 
 export type GetOrgResponse = {
-    org: Omit<Org, "sshCaPrivateKey">;
+    org: Org;
 };
 const GetOrgResponseDataSchema = z.object({
     org: z.object({}).passthrough()
 });
 
+
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}",
@@ -75,12 +76,9 @@ export async function getOrg(
             );
         }
 
-        // sshCaPrivateKey is encrypted anyway but just to be safe
-        const { sshCaPrivateKey: _, ...orgWithoutPrivateKey } = org;
-
         return response<GetOrgResponse>(res, {
             data: {
-                org: orgWithoutPrivateKey
+                org
             },
             success: true,
             error: false,

server/routers/siteResource/getSiteResource.ts

@@ -18,7 +18,7 @@ const getSiteResourceParamsSchema = z.strictObject({
         .pipe(z.int().positive().optional())
         .optional(),
     niceId: z.string().optional(),
-    orgId: z.string().optional()
+    orgId: z.string()
 });
 
 async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
@@ -34,13 +34,6 @@ async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
             )
             .limit(1);
         return siteResource;
-    } else if (siteResourceId) {
-        const [siteResource] = await db
-            .select()
-            .from(siteResources)
-            .where(eq(siteResources.siteResourceId, siteResourceId))
-            .limit(1);
-        return siteResource;
     } else if (niceId && orgId) {
         const [siteResource] = await db
             .select()
@@ -67,7 +60,9 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResourceLegacy],
     request: {
         params: z.object({
-            siteResourceId: z.number()
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
         })
     },
     responses: {
@@ -95,7 +90,9 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: z.object({
-            siteResourceId: z.number()
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
         })
     },
     responses: {

server/setup/scriptsPg/1.22.0.ts

@@ -223,7 +223,7 @@ export default async function migration() {
             sql`ALTER TABLE "subscriptions" ADD COLUMN "override" boolean DEFAULT false;`
         );
         await db.execute(
-            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 0 NOT NULL;`
+            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 7 NOT NULL;`
         );
         await db.execute(
             sql`ALTER TABLE "siteResources" ADD COLUMN "requiresExitNodeConnection" boolean DEFAULT false NOT NULL;`

server/setup/scriptsSqlite/1.22.0.ts

@@ -397,7 +397,7 @@ export default async function migration() {
                 `ALTER TABLE 'clients' ADD 'exitNodeSubnet' text;`
             ).run();
             db.prepare(
-                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 0 NOT NULL;`
+                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 7 NOT NULL;`
             ).run();
             db.prepare(
                 `ALTER TABLE 'siteResources' ADD 'requiresExitNodeConnection' integer DEFAULT false NOT NULL;`

src/i18n/detectLocale.test.ts

@@ -0,0 +1,74 @@
+import { assertEquals } from "@test/assert";
+import { detectLocale } from "./detectLocale";
+
+function runTests() {
+    assertEquals(
+        detectLocale("zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6"),
+        "zh-TW",
+        "An exact regional match should take precedence over a language fallback"
+    );
+    assertEquals(
+        detectLocale("ZH-tw"),
+        "zh-TW",
+        "Locale matching should be case-insensitive"
+    );
+    assertEquals(
+        detectLocale("  zh-TW ; q=1 , zh-CN;q=0.8 "),
+        "zh-TW",
+        "Whitespace and quality parameters should not prevent an exact match"
+    );
+    assertEquals(
+        detectLocale("zh-CN,zh-TW;q=0.9"),
+        "zh-CN",
+        "Simplified Chinese should still match exactly"
+    );
+    assertEquals(
+        detectLocale("zh"),
+        "zh-CN",
+        "A generic Chinese preference should retain the existing fallback"
+    );
+    assertEquals(
+        detectLocale("en-GB,en;q=0.9"),
+        "en-US",
+        "An unsupported region should fall back to a supported locale for the language"
+    );
+    assertEquals(
+        detectLocale("ja-JP,zh-TW;q=0.9"),
+        "zh-TW",
+        "The next preference should be used when a language is unsupported"
+    );
+    assertEquals(
+        detectLocale("zh-CN;q=0.5,zh-TW;q=0.9"),
+        "zh-TW",
+        "Preferences should be evaluated by quality"
+    );
+    assertEquals(
+        detectLocale("zh-TW;q=0,fr-FR;q=0.8"),
+        "fr-FR",
+        "Locales with zero quality should be excluded"
+    );
+    assertEquals(
+        detectLocale("*,de-DE;q=0.8"),
+        "de-DE",
+        "A wildcard should not obscure a supported preference"
+    );
+    assertEquals(
+        detectLocale("ja-JP"),
+        undefined,
+        "An unsupported language should not match"
+    );
+    assertEquals(
+        detectLocale(""),
+        undefined,
+        "An empty Accept-Language header should not match"
+    );
+
+    console.log("All locale detection tests passed!");
+}
+
+try {
+    runTests();
+} catch (error) {
+    console.error("Locale detection test failed:", error);
+    process.exit(1);
+}

src/i18n/detectLocale.ts

@@ -0,0 +1,48 @@
+import { Locale, locales } from "./config";
+
+export function detectLocale(acceptLanguage: string): Locale | undefined {
+    const browserLocales = acceptLanguage
+        .split(",")
+        .map((entry, index) => {
+            const [locale, ...parameters] = entry.trim().split(";");
+            const qualityParameter = parameters.find((parameter) =>
+                parameter.trim().toLowerCase().startsWith("q=")
+            );
+            const quality = qualityParameter
+                ? Number(qualityParameter.trim().slice(2))
+                : 1;
+
+            return {
+                locale: locale.trim().toLowerCase(),
+                quality,
+                index
+            };
+        })
+        .filter(
+            ({ locale, quality }) =>
+                locale && locale !== "*" && quality > 0 && quality <= 1
+        )
+        .sort(
+            (left, right) =>
+                right.quality - left.quality || left.index - right.index
+        );
+
+    for (const { locale: browserLocale } of browserLocales) {
+        const exactMatch = locales.find(
+            (locale) => locale.toLowerCase() === browserLocale
+        );
+        if (exactMatch) {
+            return exactMatch;
+        }
+
+        const browserLanguage = browserLocale.split("-")[0];
+        const languageMatch = locales.find(
+            (locale) => locale.split("-")[0].toLowerCase() === browserLanguage
+        );
+        if (languageMatch) {
+            return languageMatch;
+        }
+    }
+
+    return undefined;
+}

src/services/locale.ts

@@ -2,6 +2,7 @@
 
 import { cookies, headers } from "next/headers";
 import { Locale, defaultLocale, locales } from "@/i18n/config";
+import { detectLocale } from "@/i18n/detectLocale";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 
@@ -47,12 +48,7 @@ export async function getUserLocale(): Promise<Locale> {
     const acceptLang = headerList.get("accept-language");
 
     if (acceptLang) {
-        const browserLang = acceptLang.split(",")[0];
+        const matched = detectLocale(acceptLang);
-        const matched = locales.find((locale) =>
-            browserLang
-                .toLowerCase()
-                .startsWith(locale.split("-")[0].toLowerCase())
-        );
         if (matched) {
             return matched;
         }