Merge branch 'dev' into feat/ip-filtering

messages/en-US.json

@@ -1573,6 +1573,8 @@
     "search": "Search…",
     "searchPlaceholder": "Search...",
     "emptySearchOptions": "No options found",
+    "ipFilterSearchPlaceholder": "Enter an IP address…",
+    "ipFilterEmptyMessage": "Enter an IP address to filter by",
     "create": "Create",
     "orgs": "Organizations",
     "loginError": "An unexpected error occurred. Please try again.",
@@ -2596,6 +2598,7 @@
     "createDomainType": "Type:",
     "createDomainName": "Name:",
     "createDomainValue": "Value:",
+    "multiSelectFilterCount": "{count} selected",
     "createDomainCnameRecords": "CNAME Records",
     "createDomainARecords": "A Records",
     "createDomainRecordNumber": "Record {number}",

server/db/pg/schema/schema.ts

@@ -1984,7 +1984,7 @@ export const aiSessionLog = pgTable(
         // were cut short at AI_SESSION_LOG_MAX_BODY_CHARS before storage.
         truncated: boolean("truncated").notNull().default(false),
         statusCode: integer("statusCode"),
-        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch seconds
+        createdAt: bigint("createdAt", { mode: "number" }).notNull() // epoch ms
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/db/sqlite/schema/schema.ts

@@ -1980,7 +1980,7 @@ export const aiSessionLog = sqliteTable(
             .notNull()
             .default(false),
         statusCode: integer("statusCode"),
-        createdAt: integer("createdAt").notNull() // epoch seconds
+        createdAt: integer("createdAt").notNull() // epoch ms
     },
     (t) => [
         index("idx_ai_session_log_org_created").on(t.orgId, t.createdAt),

server/lib/aiBudgetEnforcement.ts

@@ -580,8 +580,6 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             );
         }
 
-        const timestamp = Math.floor(Date.now() / 1000);
-
         usageRecordBuffer.push({
             orgId: input.orgId,
             providerId: input.providerId,
@@ -599,7 +597,7 @@ export async function recordUsage(input: UsageRecordInput): Promise<void> {
             totalTokens,
             costUsd: input.costUsd,
             estimated: usage.estimated,
-            createdAt: input.createdAt ?? timestamp
+            createdAt: input.createdAt ?? Date.now()
         });
 
         // Flush immediately if buffer is full, otherwise schedule a flush

server/lib/blueprints/applyBlueprint.ts

@@ -1,6 +1,5 @@
 import {
     db,
-    primaryDb,
     newts,
     blueprints,
     Blueprint,
@@ -81,103 +80,93 @@ export async function applyBlueprint({
                 trx,
                 siteId
             );
-        });
 
-        // Push updates to newts/clients only after the transaction has
-        // committed. Doing this while the transaction is still open can
-        // race with the writes (e.g. newts requesting config before the
-        // new targets/resources are actually visible), leaving them out
-        // of sync until manually toggled.
-
-        // We need to update the targets on the newts from the successfully updated information
-        for (const result of publicResourcesResults) {
-            for (const target of result.targetsToUpdate) {
-                // read from the primary: this determines whether/how we push
-                // the just-created target to the newt, so a lagging replica
-                // returning stale or missing data here would silently skip
-                // the push
-                const [site] = await primaryDb
-                    .select()
-                    .from(sites)
-                    .innerJoin(newts, eq(sites.siteId, newts.siteId))
-                    .where(
-                        and(
-                            eq(sites.siteId, target.siteId),
-                            eq(sites.orgId, orgId),
-                            eq(sites.type, "newt"),
-                            isNotNull(sites.pubKey)
+            // We need to update the targets on the newts from the successfully updated information
+            for (const result of publicResourcesResults) {
+                for (const target of result.targetsToUpdate) {
+                    const [site] = await trx
+                        .select()
+                        .from(sites)
+                        .innerJoin(newts, eq(sites.siteId, newts.siteId))
+                        .where(
+                            and(
+                                eq(sites.siteId, target.siteId),
+                                eq(sites.orgId, orgId),
+                                eq(sites.type, "newt"),
+                                isNotNull(sites.pubKey)
+                            )
                         )
-                    )
-                    .limit(1);
+                        .limit(1);
 
-                if (site) {
-                    logger.debug(
-                        `Updating target ${target.targetId} on site ${site.sites.siteId}`
-                    );
-
-                    // see if you can find a matching target health check from the healthchecksToUpdate array
-                    const matchingHealthcheck =
-                        result.healthchecksToUpdate.find(
-                            (hc) => hc.targetId === target.targetId
+                    if (site) {
+                        logger.debug(
+                            `Updating target ${target.targetId} on site ${site.sites.siteId}`
                         );
 
-                    if (["http", "tcp", "udp"].includes(target.mode)) {
-                        await addProxyTargets(
-                            site.newt.newtId,
-                            [target],
-                            matchingHealthcheck
-                                ? [matchingHealthcheck]
-                                : [],
-                            result.proxyResource.mode === "udp"
-                                ? "udp"
-                                : "tcp",
-                            site.newt.version
-                        );
-                    } else if (
-                        ["ssh", "rdp", "vnc"].includes(target.mode)
-                    ) {
-                        await sendBrowserGatewayTargets(
-                            site.newt.newtId,
-                            [target],
-                            site.newt.version
-                        );
+                        // see if you can find a matching target health check from the healthchecksToUpdate array
+                        const matchingHealthcheck =
+                            result.healthchecksToUpdate.find(
+                                (hc) => hc.targetId === target.targetId
+                            );
+
+                        if (["http", "tcp", "udp"].includes(target.mode)) {
+                            await addProxyTargets(
+                                site.newt.newtId,
+                                [target],
+                                matchingHealthcheck
+                                    ? [matchingHealthcheck]
+                                    : [],
+                                result.proxyResource.mode === "udp"
+                                    ? "udp"
+                                    : "tcp",
+                                site.newt.version
+                            );
+                        } else if (
+                            ["ssh", "rdp", "vnc"].includes(target.mode)
+                        ) {
+                            await sendBrowserGatewayTargets(
+                                site.newt.newtId,
+                                [target],
+                                site.newt.version
+                            );
+                        }
                     }
                 }
             }
-        }
 
-        logger.debug(
-            `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
-        );
+            logger.debug(
+                `Successfully updated public resources for org ${orgId}: ${JSON.stringify(publicResourcesResults)}`
+            );
 
-        // We need to update the targets on the newts from the successfully updated information
-        for (const result of privateResourcesResults) {
-            rebuildClientAssociationsFromSiteResource(
-                result.newSiteResource
-            )
-                .then(() =>
-                    waitForSiteResourceRebuildIdle(
-                        result.newSiteResource.siteResourceId
-                    )
+            // We need to update the targets on the newts from the successfully updated information
+            for (const result of privateResourcesResults) {
+                rebuildClientAssociationsFromSiteResource(
+                    result.newSiteResource
                 )
-                .then(() =>
-                    handleMessagingForUpdatedSiteResource(
-                        result.oldSiteResource,
-                        result.newSiteResource,
-                        result.oldSites.map((s) => s.siteId),
-                        result.newSites.map((s) => s.siteId)
+                    .then(() =>
+                        waitForSiteResourceRebuildIdle(
+                            result.newSiteResource.siteResourceId
+                        )
                     )
-                )
-                .catch((e) => {
-                    logger.error(
-                        `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
-                    );
-                });
-        }
+                    .then(() =>
+                        handleMessagingForUpdatedSiteResource(
+                            result.oldSiteResource,
+                            result.newSiteResource,
+                            result.oldSites.map((s) => s.siteId),
+                            result.newSites.map((s) => s.siteId)
+                        )
+                    )
+                    .catch((e) => {
+                        logger.error(
+                            `Failed to rebuild and handle messaging for site resource ${result.newSiteResource.siteResourceId}. Error: ${e}`
+                        );
+                    });
+            }
 
-        logger.debug(
-            `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
-        );
+            logger.debug(
+                `Successfully updated private resources for org ${orgId}: ${JSON.stringify(privateResourcesResults)}`
+            );
+        });
 
         blueprintSucceeded = true;
         blueprintMessage = "Blueprint applied successfully";

server/lib/domainUtils.ts

@@ -52,7 +52,8 @@ export async function validateAndConstructDomain(
             };
         }
 
-        if (!domainRes.orgDomains) {
+        // Check if organization has access to domain
+        if (domainRes.orgDomains && domainRes.orgDomains.orgId !== orgId) {
             return {
                 success: false,
                 error: `Organization does not have access to domain with ID ${domainId}`

server/lib/textCompression.ts

@@ -1,15 +0,0 @@
-import { gzipSync, gunzipSync } from "zlib";
-
-/**
- * Gzip a string and return it as base64 so it can be stored in a TEXT column.
- */
-export function compressText(value: string): string {
-    return gzipSync(Buffer.from(value, "utf8")).toString("base64");
-}
-
-/**
- * Reverse of compressText - base64-decode and gunzip back to the original string.
- */
-export function decompressText(value: string): string {
-    return gunzipSync(Buffer.from(value, "base64")).toString("utf8");
-}

server/private/lib/logStreaming/LogStreamingManager.ts

@@ -25,7 +25,6 @@ import {
 import logger from "@server/logger";
 import { and, eq, gt, desc, max, sql } from "drizzle-orm";
 import { decrypt } from "@server/lib/crypto";
-import { decompressText } from "@server/lib/textCompression";
 import config from "@server/lib/config";
 import {
     LogType,
@@ -681,8 +680,8 @@ export class LogStreamingManager {
                     Record<string, unknown> & { id: number }
                 >;
 
-            case "aiSession": {
-                const rows = (await logsDb
+            case "aiSession":
+                return (await logsDb
                     .select()
                     .from(aiSessionLog)
                     .where(
@@ -695,33 +694,6 @@ export class LogStreamingManager {
                     .limit(limit)) as Array<
                     Record<string, unknown> & { id: number }
                 >;
-
-                const compressedFields = [
-                    "requestBody",
-                    "responseBody",
-                    "normalizedRequest",
-                    "normalizedResponse"
-                ] as const;
-
-                for (const row of rows) {
-                    for (const field of compressedFields) {
-                        const value = row[field];
-                        if (typeof value !== "string") {
-                            continue;
-                        }
-                        try {
-                            row[field] = decompressText(value);
-                        } catch (error) {
-                            logger.error(
-                                `Failed to decompress AI session log field ${field}`,
-                                { error }
-                            );
-                        }
-                    }
-                }
-
-                return rows;
-            }
         }
     }
 

server/private/routers/aiGateway/logAiSession.ts

@@ -18,7 +18,6 @@ import { and, eq, lt } from "drizzle-orm";
 import cache from "#private/lib/cache";
 import { calculateCutoffTimestamp } from "@server/lib/cleanupLogs";
 import { sanitizeString } from "@server/lib/sanitize";
-import { compressText } from "@server/lib/textCompression";
 import type { AiCapability } from "@server/lib/aiCapabilities";
 import {
     normalizeAiRequest,
@@ -152,14 +151,17 @@ async function getRetentionDays(orgId: string): Promise<number> {
 }
 
 export async function cleanUpOldLogs(orgId: string, retentionDays: number) {
-    const cutoffTimestamp = calculateCutoffTimestamp(retentionDays);
+    // calculateCutoffTimestamp returns a seconds-epoch cutoff (built for
+    // requestAuditLog.timestamp), but aiSessionLog.createdAt is ms-epoch to
+    // match aiUsageRecords - convert before comparing.
+    const cutoffTimestampMs = calculateCutoffTimestamp(retentionDays) * 1000;
 
     try {
         await logsDb
             .delete(aiSessionLog)
             .where(
                 and(
-                    lt(aiSessionLog.createdAt, cutoffTimestamp),
+                    lt(aiSessionLog.createdAt, cutoffTimestampMs),
                     eq(aiSessionLog.orgId, orgId)
                 )
             );
@@ -241,8 +243,6 @@ export function logAiSession(data: {
                 );
             }
 
-            const timestamp = Math.floor(Date.now() / 1000);
-
             sessionLogBuffer.push({
                 sessionId: data.sessionId,
                 orgId: sanitizeString(data.orgId),
@@ -256,19 +256,13 @@ export function logAiSession(data: {
                 ),
                 requestedModel: sanitizeString(data.requestedModel),
                 isStream: data.isStream,
-                requestBody: compressText(
-                    sanitizeString(requestBodyText.value)
-                ),
-                responseBody: compressText(
-                    sanitizeString(responseBodyText.value)
-                ),
+                requestBody: sanitizeString(requestBodyText.value),
+                responseBody: sanitizeString(responseBodyText.value),
                 normalizedRequest: normalizedRequestText
-                    ? compressText(sanitizeString(normalizedRequestText.value))
+                    ? sanitizeString(normalizedRequestText.value)
                     : undefined,
                 normalizedResponse: normalizedResponseText
-                    ? compressText(
-                          sanitizeString(normalizedResponseText.value)
-                      )
+                    ? sanitizeString(normalizedResponseText.value)
                     : undefined,
                 truncated:
                     requestBodyText.truncated ||
@@ -276,7 +270,7 @@ export function logAiSession(data: {
                     (normalizedRequestText?.truncated ?? false) ||
                     (normalizedResponseText?.truncated ?? false),
                 statusCode: data.statusCode,
-                createdAt: timestamp
+                createdAt: Date.now()
             });
 
             // Flush immediately if buffer is full, otherwise schedule a flush

server/private/routers/auditLogs/queryAccessAuditLog.ts

@@ -88,7 +88,27 @@ export const queryAccessAuditLogsQuery = z.object({
         .optional()
         .default("0")
         .transform(Number)
-        .pipe(z.int().nonnegative())
+        .pipe(z.int().nonnegative()),
+    ip: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            if (Array.isArray(val)) {
+                return val;
+            }
+            // the array is returned as this
+            if (typeof val === "string") {
+                return val.split(",");
+            }
+            return undefined;
+        }, z.array(z.string()))
+        .optional()
+        .catch([])
+        .openapi({
+            type: "array",
+            description: "Filter by IP adresses"
+        })
 });
 
 export const queryAccessAuditLogsParams = z.object({
@@ -134,6 +154,9 @@ function getWhere(data: Q) {
         data.type ? eq(accessAuditLog.type, data.type) : undefined,
         data.action !== undefined
             ? eq(accessAuditLog.action, data.action)
+            : undefined,
+        data.ip && data.ip.length > 0
+            ? inArray(accessAuditLog.ip, data.ip)
             : undefined
     );
 }

server/private/routers/ws/messageHandlers.ts

@@ -16,12 +16,10 @@ import {
     handleRemoteExitNodePingMessage
 } from "#private/routers/remoteExitNode";
 import { MessageHandler } from "@server/routers/ws";
-import {
-    handleConnectionLogMessage,
-} from "#private/routers/newt";
+import { handleConnectionLogMessage } from "#private/routers/newt";
 
 export const messageHandlers: Record<string, MessageHandler> = {
     "remoteExitNode/register": handleRemoteExitNodeRegisterMessage,
     "remoteExitNode/ping": handleRemoteExitNodePingMessage,
-    "newt/access-log": handleConnectionLogMessage,
+    "newt/access-log": handleConnectionLogMessage
 };

server/routers/auditLogs/aiUsageAnalyticsShared.ts

@@ -18,7 +18,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -31,7 +31,7 @@ export const aiUsageAnalyticsFiltersQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",
@@ -122,12 +122,12 @@ export function buildAiUsageWhere(
     );
 }
 
-// Buckets createdAt (epoch seconds) down to a per-day string, dialect-aware,
-// same approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
+// Buckets createdAt (epoch ms) down to a per-day string, dialect-aware, same
+// approach as the DATE_TRUNC/DATE branch in queryRequestAnalytics.ts.
 export function dayBucketExpr() {
     return driver === "pg"
-        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt}))`
-        : sql<string>`DATE(${aiUsageRecords.createdAt}, 'unixepoch')`;
+        ? sql<string>`DATE_TRUNC('day', TO_TIMESTAMP(${aiUsageRecords.createdAt} / 1000.0))`
+        : sql<string>`DATE(${aiUsageRecords.createdAt} / 1000, 'unixepoch')`;
 }
 
 export type DailyMetricRow<K extends string> = {

server/routers/auditLogs/exportAiSessionLog.ts

@@ -11,8 +11,7 @@ import {
     queryAiSessionLogsQuery,
     queryAiSessionLogsParams,
     queryAiSession,
-    countAiSessionQuery,
-    decompressAiSessionLogRow
+    countAiSessionQuery
 } from "./queryAiSessionLog";
 import { generateCSV } from "./generateCSV";
 
@@ -88,9 +87,7 @@ export async function exportAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const log = (await baseQuery.limit(MAX_EXPORT_LIMIT)).map(
-            decompressAiSessionLogRow
-        );
+        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);
 
         const csvData = generateCSV(log);
 

server/routers/auditLogs/queryAiSessionLog.ts

@@ -24,7 +24,6 @@ import { AI_CAPABILITIES } from "@server/lib/aiCapabilities";
 import response from "@server/lib/response";
 import logger from "@server/logger";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
-import { decompressText } from "@server/lib/textCompression";
 
 export const queryAiSessionLogsQuery = z.strictObject({
     // iso string just validate its a parseable date
@@ -33,7 +32,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -46,7 +45,7 @@ export const queryAiSessionLogsQuery = z.strictObject({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
@@ -167,35 +166,6 @@ export function queryAiSession(data: Q) {
         .orderBy(desc(aiSessionLog.createdAt));
 }
 
-function decompressField(value: string | null): string | null {
-    if (value == null) {
-        return value;
-    }
-    try {
-        return decompressText(value);
-    } catch (error) {
-        logger.error("Failed to decompress AI session log field", { error });
-        return value;
-    }
-}
-
-export function decompressAiSessionLogRow<
-    T extends {
-        requestBody: string | null;
-        responseBody: string | null;
-        normalizedRequest: string | null;
-        normalizedResponse: string | null;
-    }
->(row: T): T {
-    return {
-        ...row,
-        requestBody: decompressField(row.requestBody),
-        responseBody: decompressField(row.responseBody),
-        normalizedRequest: decompressField(row.normalizedRequest),
-        normalizedResponse: decompressField(row.normalizedResponse)
-    };
-}
-
 async function enrichWithDetails(
     logs: Awaited<ReturnType<typeof queryAiSession>>
 ) {
@@ -650,9 +620,7 @@ export async function queryAiSessionLogs(
 
         const baseQuery = queryAiSession(data);
 
-        const logsRaw = (
-            await baseQuery.limit(data.limit).offset(data.offset)
-        ).map(decompressAiSessionLogRow);
+        const logsRaw = await baseQuery.limit(data.limit).offset(data.offset);
 
         const log = await enrichWithDetails(logsRaw);
 

server/routers/auditLogs/queryAiUsageFilterOptions.ts

@@ -30,14 +30,14 @@ const queryAiUsageFilterOptionsQuery = z.object({
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeStart must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => getSevenDaysAgo().toISOString()),
     timeEnd: z
         .string()
         .refine((val) => !isNaN(Date.parse(val)), {
             error: "timeEnd must be a valid ISO date string"
         })
-        .transform((val) => Math.floor(new Date(val).getTime() / 1000))
+        .transform((val) => new Date(val).getTime())
         .prefault(() => new Date().toISOString())
 });
 

server/routers/auditLogs/queryRequestAuditLog.ts

@@ -81,7 +81,27 @@ export const queryAccessAuditLogsQuery = z.strictObject({
         .optional()
         .default("0")
         .transform(Number)
-        .pipe(z.int().nonnegative())
+        .pipe(z.int().nonnegative()),
+    ip: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            if (Array.isArray(val)) {
+                return val;
+            }
+            // the array is returned as this
+            if (typeof val === "string") {
+                return val.split(",");
+            }
+            return undefined;
+        }, z.array(z.string()))
+        .optional()
+        .catch([])
+        .openapi({
+            type: "array",
+            description: "Filter by IP adresses"
+        })
 });
 
 export const queryRequestAuditLogsParams = z.object({
@@ -126,6 +146,9 @@ function getWhere(data: Q) {
         data.path ? eq(requestAuditLog.path, data.path) : undefined,
         data.action !== undefined
             ? eq(requestAuditLog.action, data.action)
+            : undefined,
+        data.ip && data.ip.length > 0
+            ? inArray(requestAuditLog.ip, data.ip)
             : undefined
     );
 }

server/routers/external.ts

@@ -66,10 +66,6 @@ import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";
 
-function rateLimitIdentityKey(value: unknown): string {
-    return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
-
 // Root routes
 export const unauthenticated = Router();
 
@@ -1931,7 +1927,7 @@ authRouter.put(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}`,
+            `signup:${ipKeyGenerator(req.ip || "")}:${req.body.email}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1946,7 +1942,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `login:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `login:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only log in ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -1963,7 +1959,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `lookupUser:${rateLimitIdentityKey(req.body.identifier) || ipKeyGenerator(req.ip || "")}`,
+            `lookupUser:${req.body.identifier || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only lookup users ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2041,7 +2037,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only enable 2FA ${15} times every ${15} minutes. Please try again later.`;
@@ -2057,7 +2053,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) => {
-            return `signup:${rateLimitIdentityKey(req.body.email) || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
+            return `signup:${req.body.email || req.user?.userId || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only request a 2FA code ${15} times every ${15} minutes. Please try again later.`;
@@ -2089,7 +2085,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `signup:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `signup:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only sign up ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2107,7 +2103,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestEmailVerificationCode:${rateLimitIdentityKey(req.user?.email) || ipKeyGenerator(req.ip || "")}`,
+            `requestEmailVerificationCode:${req.user?.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request an email verification code ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2129,7 +2125,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `requestPasswordReset:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `requestPasswordReset:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2145,7 +2141,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `resetPassword:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`,
+            `resetPassword:${req.body.email || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request a password reset ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2192,7 +2188,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 15,
         keyGenerator: (req) =>
-            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${rateLimitIdentityKey(req.body.email)}:${req.params.resourceId}`,
+            `authWithWhitelist:${ipKeyGenerator(req.ip || "")}:${req.body.email}:${req.params.resourceId}`,
         handler: (req, res, next) => {
             const message = `You can only request an email OTP ${15} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
@@ -2244,7 +2240,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000, // 15 minutes
         max: 10, // Allow 10 authentication attempts per 15 minutes per IP
         keyGenerator: (req) => {
-            return `securityKeyAuth:${rateLimitIdentityKey(req.body.email) || ipKeyGenerator(req.ip || "")}`;
+            return `securityKeyAuth:${req.body.email || ipKeyGenerator(req.ip || "")}`;
         },
         handler: (req, res, next) => {
             const message = `You can only attempt security key authentication ${10} times every ${15} minutes. Please try again later.`;

server/routers/org/getOrg.ts

@@ -16,12 +16,13 @@ const getOrgSchema = z.strictObject({
 });
 
 export type GetOrgResponse = {
-    org: Omit<Org, "sshCaPrivateKey">;
+    org: Org;
 };
 const GetOrgResponseDataSchema = z.object({
     org: z.object({}).passthrough()
 });
 
+
 registry.registerPath({
     method: "get",
     path: "/org/{orgId}",
@@ -75,12 +76,9 @@ export async function getOrg(
             );
         }
 
-        // sshCaPrivateKey is encrypted anyway but just to be safe
-        const { sshCaPrivateKey: _, ...orgWithoutPrivateKey } = org;
-
         return response<GetOrgResponse>(res, {
             data: {
-                org: orgWithoutPrivateKey
+                org
             },
             success: true,
             error: false,

server/routers/siteResource/getSiteResource.ts

@@ -18,7 +18,7 @@ const getSiteResourceParamsSchema = z.strictObject({
         .pipe(z.int().positive().optional())
         .optional(),
     niceId: z.string().optional(),
-    orgId: z.string().optional()
+    orgId: z.string()
 });
 
 async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
@@ -34,13 +34,6 @@ async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
             )
             .limit(1);
         return siteResource;
-    } else if (siteResourceId) {
-        const [siteResource] = await db
-            .select()
-            .from(siteResources)
-            .where(eq(siteResources.siteResourceId, siteResourceId))
-            .limit(1);
-        return siteResource;
     } else if (niceId && orgId) {
         const [siteResource] = await db
             .select()
@@ -67,7 +60,9 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResourceLegacy],
     request: {
         params: z.object({
-            siteResourceId: z.number()
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
         })
     },
     responses: {
@@ -95,7 +90,9 @@ registry.registerPath({
     tags: [OpenAPITags.PrivateResource],
     request: {
         params: z.object({
-            siteResourceId: z.number()
+            siteResourceId: z.number(),
+            siteId: z.number(),
+            orgId: z.string()
         })
     },
     responses: {

server/setup/scriptsPg/1.22.0.ts

@@ -223,7 +223,7 @@ export default async function migration() {
             sql`ALTER TABLE "subscriptions" ADD COLUMN "override" boolean DEFAULT false;`
         );
         await db.execute(
-            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 0 NOT NULL;`
+            sql`ALTER TABLE "orgs" ADD COLUMN "settingsLogRetentionDaysAISessions" integer DEFAULT 7 NOT NULL;`
         );
         await db.execute(
             sql`ALTER TABLE "siteResources" ADD COLUMN "requiresExitNodeConnection" boolean DEFAULT false NOT NULL;`
@@ -345,9 +345,6 @@ export default async function migration() {
         await db.execute(
             sql`ALTER TABLE "virtualApiKeys" ADD CONSTRAINT "virtualApiKeys_createdByUserId_user_id_fk" FOREIGN KEY ("createdByUserId") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;`
         );
-        await db.execute(
-            sql`ALTER TABLE "eventStreamingDestinations" ADD "sendAISessionLogs" boolean DEFAULT false NOT NULL;`
-        );
         await db.execute(
             sql`CREATE INDEX "idx_ai_budget_breach_events_budget_created" ON "aiBudgetBreachEvents" USING btree ("budgetId","createdAt");`
         );

server/setup/scriptsSqlite/1.22.0.ts

@@ -397,14 +397,11 @@ export default async function migration() {
                 `ALTER TABLE 'clients' ADD 'exitNodeSubnet' text;`
             ).run();
             db.prepare(
-                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 0 NOT NULL;`
+                `ALTER TABLE 'orgs' ADD 'settingsLogRetentionDaysAISessions' integer DEFAULT 7 NOT NULL;`
             ).run();
             db.prepare(
                 `ALTER TABLE 'siteResources' ADD 'requiresExitNodeConnection' integer DEFAULT false NOT NULL;`
             ).run();
-            db.prepare(
-                `ALTER TABLE 'eventStreamingDestinations' ADD 'sendAISessionLogs' integer DEFAULT false NOT NULL;`
-            ).run();
 
             const insertRoleAction = db.prepare(`
                 INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")

src/app/[orgId]/settings/logs/access/page.tsx

@@ -12,6 +12,7 @@ import { DateTimeValue } from "@app/components/DateTimePicker";
 import { ArrowUpRight, Key, User } from "lucide-react";
 import Link from "next/link";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
+import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { build } from "@server/build";
 import { getSevenDaysAgo } from "@app/lib/getSevenDaysAgo";
@@ -26,6 +27,7 @@ import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { logQueries } from "@app/lib/queries";
 import { useQuery } from "@tanstack/react-query";
 import type { QueryAccessAuditLogResponse } from "@server/routers/auditLogs/types";
+import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";
 
 export default function GeneralPage() {
     const router = useRouter();
@@ -45,12 +47,14 @@ export default function GeneralPage() {
         resourceId?: string;
         location?: string;
         actor?: string;
+        ip?: string[];
     }>({
         action: searchParams.get("action") || undefined,
         type: searchParams.get("type") || undefined,
         resourceId: searchParams.get("resourceId") || undefined,
         location: searchParams.get("location") || undefined,
-        actor: searchParams.get("actor") || undefined
+        actor: searchParams.get("actor") || undefined,
+        ip: searchParams.getAll("ip") || undefined
     });
 
     const [currentPage, setCurrentPage] = useState<number>(0);
@@ -176,7 +180,7 @@ export default function GeneralPage() {
 
     const handleFilterChange = (
         filterType: keyof typeof filters,
-        value: string | undefined
+        value: string | string[] | undefined
     ) => {
         const newFilters = { ...filters, [filterType]: value };
         setFilters(newFilters);
@@ -194,10 +198,13 @@ export default function GeneralPage() {
     ) => {
         const params = new URLSearchParams(searchParams);
         Object.entries(newFilters).forEach(([key, value]) => {
-            if (value) {
+            params.delete(key);
+            if (typeof value === "string") {
                 params.set(key, value);
-            } else {
-                params.delete(key);
+            } else if (typeof value !== "undefined" && "length" in value) {
+                for (const element of value) {
+                    params.append(key, element);
+                }
             }
         });
         router.replace(`?${params.toString()}`, { scroll: false });
@@ -205,6 +212,7 @@ export default function GeneralPage() {
 
     const exportData = async () => {
         try {
+            const { ip, ...restFilters } = filters;
             const params: any = {
                 timeStart: dateRange.startDate?.date
                     ? new Date(dateRange.startDate.date).toISOString()
@@ -212,13 +220,20 @@ export default function GeneralPage() {
                 timeEnd: dateRange.endDate?.date
                     ? new Date(dateRange.endDate.date).toISOString()
                     : undefined,
-                ...filters
+                ...restFilters
             };
 
-            const response = await api.get(`/org/${orgId}/logs/access/export`, {
-                responseType: "blob",
-                params
-            });
+            // axios serializes arrays as `ip[]=…`, which express's query
+            // parser does not read back as `ip`, so pass them in the URL
+            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
+
+            const response = await api.get(
+                `/org/${orgId}/logs/access/export?${sp.toString()}`,
+                {
+                    responseType: "blob",
+                    params
+                }
+            );
 
             const url = window.URL.createObjectURL(new Blob([response.data]));
             const link = document.createElement("a");
@@ -297,7 +312,24 @@ export default function GeneralPage() {
         },
         {
             accessorKey: "ip",
-            header: () => <span className="px-2">{t("ip")}</span>,
+            header: () => (
+                <span className="px-2">
+                    <ColumnMultiFilterButton
+                        options={(filters.ip ?? []).map((ip) => ({
+                            label: ip,
+                            value: ip
+                        }))}
+                        label={t("ip")}
+                        allowArbitraryValues
+                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
+                        emptyMessage={t("ipFilterEmptyMessage")}
+                        selectedValues={filters.ip ?? []}
+                        onSelectedValuesChange={(value) =>
+                            handleFilterChange("ip", value)
+                        }
+                    />
+                </span>
+            ),
             cell: ({ row }) => {
                 return row.original.ip ? (
                     row.original.ip
@@ -315,7 +347,7 @@ export default function GeneralPage() {
                             options={filterAttributes.locations.map(
                                 (location) => ({
                                     value: location,
-                                    label: location
+                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
                                 })
                             )}
                             label={t("location")}
@@ -334,7 +366,8 @@ export default function GeneralPage() {
                     <span className="flex items-center gap-1">
                         {row.original.location ? (
                             <span className="text-muted-foreground text-xs">
-                                {row.original.location}
+                                {row.original.location}{" "}
+                                {countryCodeToFlagEmoji(row.original.location)}
                             </span>
                         ) : (
                             <span className="text-muted-foreground text-xs">

src/app/[orgId]/settings/logs/request/page.tsx

@@ -23,6 +23,8 @@ import { useMemo, useState, useTransition } from "react";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import type { QueryRequestAuditLogResponse } from "@server/routers/auditLogs/types";
 import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
+import { countryCodeToFlagEmoji } from "@app/lib/countryCodeToFlagEmoji";
+import { ColumnMultiFilterButton } from "@app/components/ColumnMultiFilterButton";
 
 export default function GeneralPage() {
     const router = useRouter();
@@ -47,6 +49,7 @@ export default function GeneralPage() {
         method?: string;
         reason?: string;
         path?: string;
+        ip?: string[];
     }>({
         action: searchParams.get("action") || undefined,
         host: searchParams.get("host") || undefined,
@@ -55,7 +58,8 @@ export default function GeneralPage() {
         actor: searchParams.get("actor") || undefined,
         method: searchParams.get("method") || undefined,
         reason: searchParams.get("reason") || undefined,
-        path: searchParams.get("path") || undefined
+        path: searchParams.get("path") || undefined,
+        ip: searchParams.getAll("ip") || undefined
     });
 
     const getDefaultDateRange = () => {
@@ -179,7 +183,7 @@ export default function GeneralPage() {
 
     const handleFilterChange = (
         filterType: keyof typeof filters,
-        value: string | undefined
+        value: string | string[] | undefined
     ) => {
         const newFilters = { ...filters, [filterType]: value };
         setFilters(newFilters);
@@ -197,10 +201,13 @@ export default function GeneralPage() {
     ) => {
         const params = new URLSearchParams(searchParams);
         Object.entries(newFilters).forEach(([key, value]) => {
-            if (value) {
+            params.delete(key);
+            if (typeof value === "string") {
                 params.set(key, value);
-            } else {
-                params.delete(key);
+            } else if (typeof value !== "undefined" && "length" in value) {
+                for (const element of value) {
+                    params.append(key, element);
+                }
             }
         });
         router.replace(`?${params.toString()}`, { scroll: false });
@@ -209,6 +216,7 @@ export default function GeneralPage() {
     const exportData = async () => {
         try {
             // Prepare query params for export
+            const { ip, ...restFilters } = filters;
             const params: any = {
                 timeStart: dateRange.startDate?.date
                     ? new Date(dateRange.startDate.date).toISOString()
@@ -216,11 +224,15 @@ export default function GeneralPage() {
                 timeEnd: dateRange.endDate?.date
                     ? new Date(dateRange.endDate.date).toISOString()
                     : undefined,
-                ...filters
+                ...restFilters
             };
 
+            // axios serializes arrays as `ip[]=…`, which express's query
+            // parser does not read back as `ip`, so pass them in the URL
+            const sp = new URLSearchParams((ip ?? []).map((ip) => ["ip", ip]));
+
             const response = await api.get(
-                `/org/${orgId}/logs/request/export`,
+                `/org/${orgId}/logs/request/export?${sp.toString()}`,
                 {
                     responseType: "blob",
                     params
@@ -351,7 +363,24 @@ export default function GeneralPage() {
         },
         {
             accessorKey: "ip",
-            header: ({ column }) => <span className="px-2">{t("ip")}</span>,
+            header: ({ column }) => (
+                <span className="px-2">
+                    <ColumnMultiFilterButton
+                        options={(filters.ip ?? []).map((ip) => ({
+                            label: ip,
+                            value: ip
+                        }))}
+                        label={t("ip")}
+                        allowArbitraryValues
+                        searchPlaceholder={t("ipFilterSearchPlaceholder")}
+                        emptyMessage={t("ipFilterEmptyMessage")}
+                        selectedValues={filters.ip ?? []}
+                        onSelectedValuesChange={(value) =>
+                            handleFilterChange("ip", value)
+                        }
+                    />
+                </span>
+            ),
             cell: ({ row }) => {
                 return row.original.ip ? (
                     row.original.ip
@@ -369,7 +398,7 @@ export default function GeneralPage() {
                             options={filterAttributes.locations.map(
                                 (location) => ({
                                     value: location,
-                                    label: location
+                                    label: `${location} ${countryCodeToFlagEmoji(location)}`
                                 })
                             )}
                             selectedValue={filters.location}
@@ -389,7 +418,8 @@ export default function GeneralPage() {
                     <span className="flex items-center gap-1">
                         {row.original.location ? (
                             <span className="text-muted-foreground text-xs">
-                                {row.original.location}
+                                {row.original.location}{" "}
+                                {countryCodeToFlagEmoji(row.original.location)}
                             </span>
                         ) : (
                             <span className="text-muted-foreground text-xs">

src/app/auth/login/page.tsx

@@ -100,7 +100,7 @@ export default async function Page(props: {
             loginIdps = idpsRes.data.data.idps.map((idp) => ({
                 idpId: idp.idpId,
                 name: idp.name,
-                variant: idp.variant ?? idp.type
+                variant: idp.type
             })) as LoginFormIDP[];
         }
     } else {

src/components/ColumnFilterButton.tsx

@@ -21,7 +21,7 @@ import { useTranslations } from "next-intl";
 
 interface FilterOption {
     value: string;
-    label: string;
+    label: React.ReactNode;
 }
 
 interface ColumnFilterButtonProps {
@@ -32,6 +32,7 @@ interface ColumnFilterButtonProps {
     emptyMessage?: string;
     className?: string;
     label: string;
+    allowArbitraryValues?: boolean;
 }
 
 export function ColumnFilterButton({
@@ -41,7 +42,8 @@ export function ColumnFilterButton({
     searchPlaceholder = "Search...",
     emptyMessage = "No options found",
     className,
-    label
+    label,
+    allowArbitraryValues
 }: ColumnFilterButtonProps) {
     const [open, setOpen] = useState(false);
 
@@ -101,7 +103,7 @@ export function ColumnFilterButton({
                             {options.map((option) => (
                                 <CommandItem
                                     key={option.value}
-                                    value={option.label}
+                                    value={option.value}
                                     onSelect={() => {
                                         onValueChange(
                                             selectedValue === option.value

src/components/ColumnMultiFilterButton.tsx

@@ -35,6 +35,7 @@ type ColumnMultiFilterButtonProps = {
     emptyMessage?: string;
     className?: string;
     label: string;
+    allowArbitraryValues?: boolean;
 };
 
 export function ColumnMultiFilterButton({
@@ -44,11 +45,26 @@ export function ColumnMultiFilterButton({
     searchPlaceholder = "Search...",
     emptyMessage = "No options found",
     className,
-    label
+    label,
+    allowArbitraryValues
 }: ColumnMultiFilterButtonProps) {
     const [open, setOpen] = useState(false);
+    const [searchQuery, setSearchQuery] = useState("");
     const t = useTranslations();
 
+    const visibleOptions = useMemo<FilterOption[]>(() => {
+        const newOptions = [...options];
+
+        if (allowArbitraryValues && searchQuery.trim().length > 0) {
+            newOptions.push({
+                label: searchQuery,
+                value: searchQuery
+            });
+        }
+
+        return newOptions;
+    }, [options, allowArbitraryValues, searchQuery]);
+
     const selectedSet = useMemo(
         () => new Set(selectedValues),
         [selectedValues]
@@ -64,7 +80,7 @@ export function ColumnMultiFilterButton({
                 selectedValues[0]
             );
         }
-        return t("accessUsersRoleFilterCount", {
+        return t("multiSelectFilterCount", {
             count: selectedValues.length
         });
     }, [selectedValues, options, t]);
@@ -108,7 +124,11 @@ export function ColumnMultiFilterButton({
                 align="start"
             >
                 <Command>
-                    <CommandInput placeholder={searchPlaceholder} />
+                    <CommandInput
+                        placeholder={searchPlaceholder}
+                        value={searchQuery}
+                        onValueChange={setSearchQuery}
+                    />
                     <CommandList>
                         <CommandEmpty>{emptyMessage}</CommandEmpty>
                         <CommandGroup>
@@ -123,7 +143,7 @@ export function ColumnMultiFilterButton({
                                     {t("accessFilterClear")}
                                 </CommandItem>
                             )}
-                            {options.map((option) => (
+                            {visibleOptions.map((option) => (
                                 <CommandItem
                                     key={option.value}
                                     value={option.label}

src/lib/queries.ts

@@ -1,3 +1,8 @@
+import {
+    getAiBudgetScopeListPath,
+    type AiBudgetScope
+} from "@app/lib/aiBudgetScope";
+import type { AiProviderType } from "@app/lib/aiProviderDefaults";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
 import { build } from "@server/build";
@@ -5,15 +10,21 @@ import {
     StatusHistoryResponse,
     type BatchedStatusHistoryResponse
 } from "@server/lib/statusHistory";
+import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
+import type {
+    ListAiModelsResponse,
+    ListAiProvidersResponse,
+    ListCatalogModelsResponse
+} from "@server/routers/aiProvider/types";
 import type { ListAlertRulesResponse } from "@server/routers/alertRule/types";
 import type {
-    QueryRequestAnalyticsResponse,
     QueryAiUsageFilterOptionsResponse,
     QueryAiUsageOverviewResponse,
     QueryAiUsageProvidersResponse,
     QueryAiUsageResourcesResponse,
     QueryAiUsageUsersRolesResponse,
-    QueryAiUsageVirtualApiKeysResponse
+    QueryAiUsageVirtualApiKeysResponse,
+    QueryRequestAnalyticsResponse
 } from "@server/routers/auditLogs";
 import type {
     QueryAccessAuditLogResponse,
@@ -34,6 +45,7 @@ import type {
 import type { GetDomainResponse } from "@server/routers/domain/getDomain";
 import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
+import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
 import type {
     LauncherResource,
     ListLauncherGroupsResponse,
@@ -43,9 +55,8 @@ import type {
     ListLauncherSitesResponse,
     ListLauncherViewsResponse
 } from "@server/routers/launcher/types";
-import type { ListLauncherAiModelsResponse } from "@server/routers/launcher/listLauncherAiModels";
-import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type { GetResourcePolicyResponse } from "@server/routers/policy";
+import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type {
     GetResourcePoliciesResponse,
     GetResourceWhitelistResponse,
@@ -59,7 +70,6 @@ import type {
 import type { GetResourceResponse } from "@server/routers/resource/getResource";
 import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getResourceAuthInfo";
 import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
-import type { ListRemoteExitNodesResponse } from "@server/routers/remoteExitNode/types";
 import type { ListRolesResponse } from "@server/routers/role";
 import type { ListSitesResponse } from "@server/routers/site";
 import type {
@@ -71,18 +81,8 @@ import type {
 } from "@server/routers/siteResource";
 import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { ListTargetsResponse } from "@server/routers/target";
-import type {
-    ListAiModelsResponse,
-    ListAiProvidersResponse,
-    ListCatalogModelsResponse
-} from "@server/routers/aiProvider/types";
-import type { AiProviderType } from "@app/lib/aiProviderDefaults";
-import type { ListAiBudgetsByScopeResponse } from "@server/routers/aiBudget/types";
-import {
-    getAiBudgetScopeListPath,
-    type AiBudgetScope
-} from "@app/lib/aiBudgetScope";
 import type { ListUsersResponse } from "@server/routers/user";
+import type { ListMyVirtualApiKeysResponse } from "@server/routers/virtualApiKey/types";
 import type ResponseT from "@server/types/Response";
 import {
     infiniteQueryOptions,
@@ -1000,7 +1000,8 @@ export const httpLogsFiltersSchema = z.object({
     actor: z.string().optional().catch(undefined),
     method: z.string().optional().catch(undefined),
     reason: z.string().optional().catch(undefined),
-    path: z.string().optional().catch(undefined)
+    path: z.string().optional().catch(undefined),
+    ip: z.array(z.string()).optional().catch(undefined)
 });
 
 export type HttpLogFilters = z.output<typeof httpLogsFiltersSchema>;
@@ -1026,7 +1027,8 @@ export const accessLogsFiltersSchema = z.object({
     action: z.string().optional().catch(undefined),
     location: z.string().optional().catch(undefined),
     actor: z.string().optional().catch(undefined),
-    type: z.string().optional().catch(undefined)
+    type: z.string().optional().catch(undefined),
+    ip: z.array(z.string()).optional().catch(undefined)
 });
 
 export type AccessLogFilters = z.output<typeof accessLogsFiltersSchema>;
@@ -1139,10 +1141,13 @@ export const logQueries = {
         queryOptions({
             queryKey: ["REQUEST_LOGS", orgId, "ALL", filters] as const,
             queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ...rest } = filters;
+                const { page, pageSize, ip, ...rest } = filters;
+                const sp = new URLSearchParams(
+                    (ip ?? []).map((ip) => ["ip", ip])
+                );
                 const res = await meta!.api.get<
                     AxiosResponse<QueryRequestAuditLogResponse>
-                >(`/org/${orgId}/logs/request`, {
+                >(`/org/${orgId}/logs/request?${sp.toString()}`, {
                     params: {
                         ...rest,
                         limit: pageSize,
@@ -1164,10 +1169,13 @@ export const logQueries = {
         queryOptions({
             queryKey: ["ACCESS_LOGS", orgId, "ALL", filters] as const,
             queryFn: async ({ signal, meta }) => {
-                const { page, pageSize, ...rest } = filters;
+                const { page, pageSize, ip, ...rest } = filters;
+                const sp = new URLSearchParams(
+                    (ip ?? []).map((ip) => ["ip", ip])
+                );
                 const res = await meta!.api.get<
                     AxiosResponse<QueryAccessAuditLogResponse>
-                >(`/org/${orgId}/logs/access`, {
+                >(`/org/${orgId}/logs/access?${sp.toString()}`, {
                     params: {
                         ...rest,
                         limit: pageSize,