feat: enhance EnvironmentLayout and MainNavigation components with multi-organization support and new modals

- Added props for multi-organization features in EnvironmentLayout.
- Updated MainNavigation to include organization and project management modals.
- Introduced new translations for organization and workspace changes.

.env.example

@@ -185,11 +185,6 @@ ENTERPRISE_LICENSE_KEY=
 # Ignore Rate Limiting across the Formbricks app
 # RATE_LIMITING_DISABLED=1
 
-# Allow webhook URLs to point to internal/private network addresses (e.g. localhost, 192.168.x.x)
-# WARNING: Only enable this if you understand the SSRF risks. Useful for self-hosted instances
-# that need to send webhooks to internal services.
-# DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS=1
-
 # OpenTelemetry OTLP endpoint (base URL, exporters append /v1/traces and /v1/metrics)
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
 # OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf

apps/web/app/(app)/environments/[environmentId]/components/EnvironmentLayout.tsx

@@ -75,6 +75,10 @@ export const EnvironmentLayout = async ({ layoutData, children }: EnvironmentLay
           isDevelopment={IS_DEVELOPMENT}
           membershipRole={membership.role}
           publicDomain={publicDomain}
+          isMultiOrgEnabled={isMultiOrgEnabled}
+          organizationProjectsLimit={organizationProjectsLimit}
+          isLicenseActive={active}
+          isAccessControlAllowed={isAccessControlAllowed}
         />
         <div id="mainContent" className="flex flex-1 flex-col overflow-hidden bg-slate-50">
           <TopControlBar

apps/web/app/(app)/environments/[environmentId]/components/MainNavigation.tsx

@@ -2,13 +2,18 @@
 
 import {
   ArrowUpRightIcon,
+  Building2Icon,
   ChevronRightIcon,
   Cog,
+  HotelIcon,
+  Loader2,
   LogOutIcon,
   MessageCircle,
   PanelLeftCloseIcon,
   PanelLeftOpenIcon,
+  PlusIcon,
   RocketIcon,
+  SettingsIcon,
   UserCircleIcon,
   UserIcon,
   WorkflowIcon,
@@ -16,28 +21,40 @@ import {
 import Image from "next/image";
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useMemo, useState, useTransition } from "react";
 import { useTranslation } from "react-i18next";
 import { TEnvironment } from "@formbricks/types/environment";
 import { TOrganizationRole } from "@formbricks/types/memberships";
 import { TOrganization } from "@formbricks/types/organizations";
 import { TUser } from "@formbricks/types/user";
+import {
+  getOrganizationsForSwitcherAction,
+  getProjectsForSwitcherAction,
+} from "@/app/(app)/environments/[environmentId]/actions";
 import { NavigationLink } from "@/app/(app)/environments/[environmentId]/components/NavigationLink";
 import { isNewerVersion } from "@/app/(app)/environments/[environmentId]/lib/utils";
 import FBLogo from "@/images/formbricks-wordmark.svg";
 import { cn } from "@/lib/cn";
 import { getAccessFlags } from "@/lib/membership/utils";
+import { getFormattedErrorMessage } from "@/lib/utils/helper";
 import { useSignOut } from "@/modules/auth/hooks/use-sign-out";
 import { TrialAlert } from "@/modules/ee/billing/components/trial-alert";
+import { CreateOrganizationModal } from "@/modules/organization/components/CreateOrganizationModal";
+import { CreateProjectModal } from "@/modules/projects/components/create-project-modal";
+import { ProjectLimitModal } from "@/modules/projects/components/project-limit-modal";
 import { getLatestStableFbReleaseAction } from "@/modules/projects/settings/(setup)/app-connection/actions";
 import { ProfileAvatar } from "@/modules/ui/components/avatars";
 import { Button } from "@/modules/ui/components/button";
 import {
   DropdownMenu,
+  DropdownMenuCheckboxItem,
   DropdownMenuContent,
+  DropdownMenuGroup,
   DropdownMenuItem,
+  DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from "@/modules/ui/components/dropdown-menu";
+import { ModalButton } from "@/modules/ui/components/upgrade-prompt";
 import packageJson from "../../../../../package.json";
 
 interface NavigationProps {
@@ -49,8 +66,30 @@ interface NavigationProps {
   isDevelopment: boolean;
   membershipRole?: TOrganizationRole;
   publicDomain: string;
+  isMultiOrgEnabled: boolean;
+  organizationProjectsLimit: number;
+  isLicenseActive: boolean;
+  isAccessControlAllowed: boolean;
 }
 
+const isActiveProjectSetting = (pathname: string, settingId: string): boolean => {
+  if (pathname.includes("/settings/")) {
+    return false;
+  }
+
+  const pattern = new RegExp(`/workspace/${settingId}(?:/|$)`);
+  return pattern.test(pathname);
+};
+
+const isActiveOrganizationSetting = (pathname: string, settingId: string): boolean => {
+  if (pathname.includes("/(account)/")) {
+    return false;
+  }
+
+  const pattern = new RegExp(`/settings/${settingId}(?:/|$)`);
+  return pattern.test(pathname);
+};
+
 export const MainNavigation = ({
   environment,
   organization,
@@ -60,6 +99,10 @@ export const MainNavigation = ({
   isFormbricksCloud,
   isDevelopment,
   publicDomain,
+  isMultiOrgEnabled,
+  organizationProjectsLimit,
+  isLicenseActive,
+  isAccessControlAllowed,
 }: NavigationProps) => {
   const router = useRouter();
   const pathname = usePathname();
@@ -69,7 +112,8 @@ export const MainNavigation = ({
   const [latestVersion, setLatestVersion] = useState("");
   const { signOut: signOutWithAudit } = useSignOut({ id: user.id, email: user.email });
 
-  const { isManager, isOwner, isBilling } = getAccessFlags(membershipRole);
+  const [isPending, startTransition] = useTransition();
+  const { isManager, isOwner, isBilling, isMember } = getAccessFlags(membershipRole);
 
   const isOwnerOrManager = isManager || isOwner;
 
@@ -153,6 +197,143 @@ export const MainNavigation = ({
     },
   ];
 
+  const [isWorkspaceDropdownOpen, setIsWorkspaceDropdownOpen] = useState(false);
+  const [isOrganizationDropdownOpen, setIsOrganizationDropdownOpen] = useState(false);
+  const [projects, setProjects] = useState<{ id: string; name: string }[]>([]);
+  const [organizations, setOrganizations] = useState<{ id: string; name: string }[]>([]);
+  const [isLoadingProjects, setIsLoadingProjects] = useState(false);
+  const [isLoadingOrganizations, setIsLoadingOrganizations] = useState(false);
+  const [workspaceLoadError, setWorkspaceLoadError] = useState<string | null>(null);
+  const [organizationLoadError, setOrganizationLoadError] = useState<string | null>(null);
+  const [openCreateProjectModal, setOpenCreateProjectModal] = useState(false);
+  const [openCreateOrganizationModal, setOpenCreateOrganizationModal] = useState(false);
+  const [openProjectLimitModal, setOpenProjectLimitModal] = useState(false);
+
+  const projectSettings = [
+    {
+      id: "general",
+      label: t("common.general"),
+      href: `/environments/${environment.id}/workspace/general`,
+    },
+    {
+      id: "look",
+      label: t("common.look_and_feel"),
+      href: `/environments/${environment.id}/workspace/look`,
+    },
+    {
+      id: "app-connection",
+      label: t("common.website_and_app_connection"),
+      href: `/environments/${environment.id}/workspace/app-connection`,
+    },
+    {
+      id: "integrations",
+      label: t("common.integrations"),
+      href: `/environments/${environment.id}/workspace/integrations`,
+    },
+    {
+      id: "teams",
+      label: t("common.team_access"),
+      href: `/environments/${environment.id}/workspace/teams`,
+    },
+    {
+      id: "languages",
+      label: t("common.survey_languages"),
+      href: `/environments/${environment.id}/workspace/languages`,
+    },
+    {
+      id: "tags",
+      label: t("common.tags"),
+      href: `/environments/${environment.id}/workspace/tags`,
+    },
+  ];
+
+  const organizationSettings = [
+    {
+      id: "general",
+      label: t("common.general"),
+      href: `/environments/${environment.id}/settings/general`,
+    },
+    {
+      id: "teams",
+      label: t("common.members_and_teams"),
+      href: `/environments/${environment.id}/settings/teams`,
+    },
+    {
+      id: "api-keys",
+      label: t("common.api_keys"),
+      href: `/environments/${environment.id}/settings/api-keys`,
+      hidden: !isOwnerOrManager,
+    },
+    {
+      id: "domain",
+      label: t("common.domain"),
+      href: `/environments/${environment.id}/settings/domain`,
+      hidden: isFormbricksCloud,
+    },
+    {
+      id: "billing",
+      label: t("common.billing"),
+      href: `/environments/${environment.id}/settings/billing`,
+      hidden: !isFormbricksCloud,
+    },
+    {
+      id: "enterprise",
+      label: t("common.enterprise_license"),
+      href: `/environments/${environment.id}/settings/enterprise`,
+      hidden: isFormbricksCloud || isMember,
+    },
+  ];
+
+  useEffect(() => {
+    if (!isWorkspaceDropdownOpen || projects.length > 0 || isLoadingProjects || workspaceLoadError) {
+      return;
+    }
+
+    setIsLoadingProjects(true);
+    setWorkspaceLoadError(null);
+    getProjectsForSwitcherAction({ organizationId: organization.id }).then((result) => {
+      if (result?.data) {
+        const sorted = [...result.data].sort((a, b) => a.name.localeCompare(b.name));
+        setProjects(sorted);
+      } else {
+        setWorkspaceLoadError(getFormattedErrorMessage(result) || t("common.failed_to_load_workspaces"));
+      }
+      setIsLoadingProjects(false);
+    });
+  }, [isWorkspaceDropdownOpen, projects.length, isLoadingProjects, workspaceLoadError, organization.id, t]);
+
+  useEffect(() => {
+    if (
+      !isOrganizationDropdownOpen ||
+      organizations.length > 0 ||
+      isLoadingOrganizations ||
+      organizationLoadError
+    ) {
+      return;
+    }
+
+    setIsLoadingOrganizations(true);
+    setOrganizationLoadError(null);
+    getOrganizationsForSwitcherAction({ organizationId: organization.id }).then((result) => {
+      if (result?.data) {
+        const sorted = [...result.data].sort((a, b) => a.name.localeCompare(b.name));
+        setOrganizations(sorted);
+      } else {
+        setOrganizationLoadError(
+          getFormattedErrorMessage(result) || t("common.failed_to_load_organizations")
+        );
+      }
+      setIsLoadingOrganizations(false);
+    });
+  }, [
+    isOrganizationDropdownOpen,
+    organizations.length,
+    isLoadingOrganizations,
+    organizationLoadError,
+    organization.id,
+    t,
+  ]);
+
   useEffect(() => {
     async function loadReleases() {
       const res = await getLatestStableFbReleaseAction();
@@ -184,6 +365,71 @@ export const MainNavigation = ({
 
   const mainNavigationLink = `/environments/${environment.id}/${isBilling ? "settings/billing/" : "surveys/"}`;
 
+  const handleProjectChange = (projectId: string) => {
+    if (projectId === project.id) return;
+    startTransition(() => {
+      router.push(`/workspaces/${projectId}/`);
+    });
+  };
+
+  const handleOrganizationChange = (organizationId: string) => {
+    if (organizationId === organization.id) return;
+    startTransition(() => {
+      router.push(`/organizations/${organizationId}/`);
+    });
+  };
+
+  const handleSettingNavigation = (href: string) => {
+    startTransition(() => {
+      router.push(href);
+    });
+  };
+
+  const handleProjectCreate = () => {
+    if (projects.length >= organizationProjectsLimit) {
+      setOpenProjectLimitModal(true);
+      return;
+    }
+
+    setOpenCreateProjectModal(true);
+  };
+
+  const projectLimitModalButtons = (): [ModalButton, ModalButton] => {
+    if (isFormbricksCloud) {
+      return [
+        {
+          text: t("environments.settings.billing.upgrade"),
+          href: `/environments/${environment.id}/settings/billing`,
+        },
+        {
+          text: t("common.cancel"),
+          onClick: () => setOpenProjectLimitModal(false),
+        },
+      ];
+    }
+
+    return [
+      {
+        text: t("environments.settings.billing.upgrade"),
+        href: isLicenseActive
+          ? `/environments/${environment.id}/settings/enterprise`
+          : "https://formbricks.com/upgrade-self-hosted-license",
+      },
+      {
+        text: t("common.cancel"),
+        onClick: () => setOpenProjectLimitModal(false),
+      },
+    ];
+  };
+
+  const switcherTriggerClasses = cn(
+    "w-full border-t px-3 py-3 text-left transition-colors duration-200 hover:bg-slate-50 focus:outline-none",
+    isCollapsed ? "flex items-center justify-center" : ""
+  );
+
+  const switcherIconClasses =
+    "flex h-9 w-9 items-center justify-center rounded-full bg-slate-100 text-slate-600";
+
   return (
     <>
       {project && (
@@ -263,35 +509,215 @@ export const MainNavigation = ({
               </Link>
             )}
 
-            {/* User Switch */}
-            <div className="flex items-center">
+            <div className="flex flex-col">
+              <DropdownMenu onOpenChange={setIsWorkspaceDropdownOpen}>
+                <DropdownMenuTrigger asChild id="workspaceDropdownTrigger" className={switcherTriggerClasses}>
+                  <div
+                    className={cn(
+                      "flex w-full cursor-pointer items-center gap-3",
+                      isCollapsed && "justify-center"
+                    )}>
+                    <span className={switcherIconClasses}>
+                      <HotelIcon className="h-4 w-4" strokeWidth={1.5} />
+                    </span>
+                    {!isCollapsed && !isTextVisible && (
+                      <>
+                        <div className="grow overflow-hidden">
+                          <p className="truncate text-sm font-bold text-slate-700">{project.name}</p>
+                          <p className="text-sm text-slate-500">{t("common.workspace")}</p>
+                        </div>
+                        {isPending && (
+                          <Loader2 className="h-4 w-4 animate-spin text-slate-600" strokeWidth={1.5} />
+                        )}
+                        <ChevronRightIcon className="h-4 w-4 shrink-0 text-slate-600" strokeWidth={1.5} />
+                      </>
+                    )}
+                  </div>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent side="right" sideOffset={10} alignOffset={5} align="end">
+                  <div className="px-2 py-1.5 text-sm font-medium text-slate-500">
+                    <HotelIcon className="mr-2 inline h-4 w-4" strokeWidth={1.5} />
+                    {t("common.change_workspace")}
+                  </div>
+                  {isLoadingProjects && (
+                    <div className="flex items-center justify-center py-2">
+                      <Loader2 className="h-4 w-4 animate-spin" />
+                    </div>
+                  )}
+                  {!isLoadingProjects && workspaceLoadError && (
+                    <div className="px-2 py-4">
+                      <p className="mb-2 text-sm text-red-600">{workspaceLoadError}</p>
+                      <button
+                        onClick={() => {
+                          setWorkspaceLoadError(null);
+                          setProjects([]);
+                        }}
+                        className="text-xs text-slate-600 underline hover:text-slate-800">
+                        {t("common.try_again")}
+                      </button>
+                    </div>
+                  )}
+                  {!isLoadingProjects && !workspaceLoadError && (
+                    <>
+                      <DropdownMenuGroup className="max-h-[300px] overflow-y-auto">
+                        {projects.map((proj) => (
+                          <DropdownMenuCheckboxItem
+                            key={proj.id}
+                            checked={proj.id === project.id}
+                            onClick={() => handleProjectChange(proj.id)}
+                            className="cursor-pointer">
+                            {proj.name}
+                          </DropdownMenuCheckboxItem>
+                        ))}
+                      </DropdownMenuGroup>
+                      {isOwnerOrManager && (
+                        <DropdownMenuCheckboxItem
+                          onClick={handleProjectCreate}
+                          className="w-full cursor-pointer justify-between">
+                          <span>{t("common.add_new_workspace")}</span>
+                          <PlusIcon className="ml-2 h-4 w-4" strokeWidth={1.5} />
+                        </DropdownMenuCheckboxItem>
+                      )}
+                    </>
+                  )}
+                  <DropdownMenuSeparator />
+                  <DropdownMenuGroup>
+                    <div className="px-2 py-1.5 text-sm font-medium text-slate-500">
+                      <Cog className="mr-2 inline h-4 w-4" strokeWidth={1.5} />
+                      {t("common.workspace_configuration")}
+                    </div>
+                    {projectSettings.map((setting) => (
+                      <DropdownMenuCheckboxItem
+                        key={setting.id}
+                        checked={isActiveProjectSetting(pathname, setting.id)}
+                        onClick={() => handleSettingNavigation(setting.href)}
+                        className="cursor-pointer">
+                        {setting.label}
+                      </DropdownMenuCheckboxItem>
+                    ))}
+                  </DropdownMenuGroup>
+                </DropdownMenuContent>
+              </DropdownMenu>
+
+              <DropdownMenu onOpenChange={setIsOrganizationDropdownOpen}>
+                <DropdownMenuTrigger
+                  asChild
+                  id="organizationDropdownTriggerSidebar"
+                  className={switcherTriggerClasses}>
+                  <div
+                    className={cn(
+                      "flex w-full cursor-pointer items-center gap-3",
+                      isCollapsed && "justify-center"
+                    )}>
+                    <span className={switcherIconClasses}>
+                      <Building2Icon className="h-4 w-4" strokeWidth={1.5} />
+                    </span>
+                    {!isCollapsed && !isTextVisible && (
+                      <>
+                        <div className="grow overflow-hidden">
+                          <p className="truncate text-sm font-bold text-slate-700">{organization.name}</p>
+                          <p className="text-sm text-slate-500">{t("common.organization")}</p>
+                        </div>
+                        {isPending && (
+                          <Loader2 className="h-4 w-4 animate-spin text-slate-600" strokeWidth={1.5} />
+                        )}
+                        <ChevronRightIcon className="h-4 w-4 shrink-0 text-slate-600" strokeWidth={1.5} />
+                      </>
+                    )}
+                  </div>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent side="right" sideOffset={10} alignOffset={5} align="end">
+                  <div className="px-2 py-1.5 text-sm font-medium text-slate-500">
+                    <Building2Icon className="mr-2 inline h-4 w-4" strokeWidth={1.5} />
+                    {t("common.change_organization")}
+                  </div>
+                  {isLoadingOrganizations && (
+                    <div className="flex items-center justify-center py-2">
+                      <Loader2 className="h-4 w-4 animate-spin" />
+                    </div>
+                  )}
+                  {!isLoadingOrganizations && organizationLoadError && (
+                    <div className="px-2 py-4">
+                      <p className="mb-2 text-sm text-red-600">{organizationLoadError}</p>
+                      <button
+                        onClick={() => {
+                          setOrganizationLoadError(null);
+                          setOrganizations([]);
+                        }}
+                        className="text-xs text-slate-600 underline hover:text-slate-800">
+                        {t("common.try_again")}
+                      </button>
+                    </div>
+                  )}
+                  {!isLoadingOrganizations && !organizationLoadError && (
+                    <>
+                      <DropdownMenuGroup className="max-h-[300px] overflow-y-auto">
+                        {organizations.map((org) => (
+                          <DropdownMenuCheckboxItem
+                            key={org.id}
+                            checked={org.id === organization.id}
+                            onClick={() => handleOrganizationChange(org.id)}
+                            className="cursor-pointer">
+                            {org.name}
+                          </DropdownMenuCheckboxItem>
+                        ))}
+                      </DropdownMenuGroup>
+                      {isMultiOrgEnabled && (
+                        <DropdownMenuCheckboxItem
+                          onClick={() => setOpenCreateOrganizationModal(true)}
+                          className="w-full cursor-pointer justify-between">
+                          <span>{t("common.create_new_organization")}</span>
+                          <PlusIcon className="ml-2 h-4 w-4" strokeWidth={1.5} />
+                        </DropdownMenuCheckboxItem>
+                      )}
+                    </>
+                  )}
+                  <DropdownMenuSeparator />
+                  <DropdownMenuGroup>
+                    <div className="px-2 py-1.5 text-sm font-medium text-slate-500">
+                      <SettingsIcon className="mr-2 inline h-4 w-4" strokeWidth={1.5} />
+                      {t("common.organization_settings")}
+                    </div>
+                    {organizationSettings.map((setting) => {
+                      if (setting.hidden) return null;
+                      return (
+                        <DropdownMenuCheckboxItem
+                          key={setting.id}
+                          checked={isActiveOrganizationSetting(pathname, setting.id)}
+                          onClick={() => handleSettingNavigation(setting.href)}
+                          className="cursor-pointer">
+                          {setting.label}
+                        </DropdownMenuCheckboxItem>
+                      );
+                    })}
+                  </DropdownMenuGroup>
+                </DropdownMenuContent>
+              </DropdownMenu>
+
               <DropdownMenu>
                 <DropdownMenuTrigger
                   asChild
                   id="userDropdownTrigger"
-                  className="w-full rounded-br-xl border-t py-4 transition-colors duration-200 hover:bg-slate-50 focus:outline-none">
+                  className={cn(switcherTriggerClasses, "rounded-br-xl")}>
                   <div
                     className={cn(
-                      "flex cursor-pointer flex-row items-center gap-3",
-                      isCollapsed ? "justify-center px-2" : "px-4"
+                      "flex w-full cursor-pointer items-center gap-3",
+                      isCollapsed && "justify-center"
                     )}>
-                    <ProfileAvatar userId={user.id} />
+                    <span className={switcherIconClasses}>
+                      <ProfileAvatar userId={user.id} />
+                    </span>
                     {!isCollapsed && !isTextVisible && (
                       <>
-                        <div
-                          className={cn(isTextVisible ? "opacity-0" : "opacity-100", "grow overflow-hidden")}>
+                        <div className="grow overflow-hidden">
                           <p
                             title={user?.email}
-                            className={cn(
-                              "ph-no-capture ph-no-capture -mb-0.5 truncate text-sm font-bold text-slate-700"
-                            )}>
+                            className="ph-no-capture ph-no-capture -mb-0.5 truncate text-sm font-bold text-slate-700">
                             {user?.name ? <span>{user?.name}</span> : <span>{user?.email}</span>}
                           </p>
-                          <p className="text-sm text-slate-700">{t("common.account")}</p>
+                          <p className="text-sm text-slate-500">{t("common.account")}</p>
                         </div>
-                        <ChevronRightIcon
-                          className={cn("h-5 w-5 shrink-0 text-slate-700 hover:text-slate-500")}
-                        />
+                        <ChevronRightIcon className="h-4 w-4 shrink-0 text-slate-600" strokeWidth={1.5} />
                       </>
                     )}
                   </div>
@@ -303,8 +729,6 @@ export const MainNavigation = ({
                   sideOffset={10}
                   alignOffset={5}
                   align="end">
-                  {/* Dropdown Items */}
-
                   {dropdownNavigation.map((link) => (
                     <Link
                       href={link.href}
@@ -318,7 +742,6 @@ export const MainNavigation = ({
                       </DropdownMenuItem>
                     </Link>
                   ))}
-                  {/* Logout */}
                   <DropdownMenuItem
                     onClick={async () => {
                       const loginUrl = `${publicDomain}/auth/login`;
@@ -341,6 +764,28 @@ export const MainNavigation = ({
           </div>
         </aside>
       )}
+      {openProjectLimitModal && (
+        <ProjectLimitModal
+          open={openProjectLimitModal}
+          setOpen={setOpenProjectLimitModal}
+          buttons={projectLimitModalButtons()}
+          projectLimit={organizationProjectsLimit}
+        />
+      )}
+      {openCreateProjectModal && (
+        <CreateProjectModal
+          open={openCreateProjectModal}
+          setOpen={setOpenCreateProjectModal}
+          organizationId={organization.id}
+          isAccessControlAllowed={isAccessControlAllowed}
+        />
+      )}
+      {openCreateOrganizationModal && (
+        <CreateOrganizationModal
+          open={openCreateOrganizationModal}
+          setOpen={setOpenCreateOrganizationModal}
+        />
+      )}
     </>
   );
 };

apps/web/app/api/auth/[...nextauth]/route.test.ts

@@ -1,139 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
-import { GET } from "./route";
-
-const mocks = vi.hoisted(() => {
-  const nextAuthHandler = vi.fn(async () => new Response(null, { status: 200 }));
-  const nextAuth = vi.fn(() => nextAuthHandler);
-
-  return {
-    nextAuth,
-    nextAuthHandler,
-    baseSignIn: vi.fn(async () => true),
-    baseSession: vi.fn(async ({ session }: { session: unknown }) => session),
-    baseEventSignIn: vi.fn(),
-    queueAuditEventBackground: vi.fn(),
-    captureException: vi.fn(),
-    loggerError: vi.fn(),
-  };
-});
-
-vi.mock("next-auth", () => ({
-  default: mocks.nextAuth,
-}));
-
-vi.mock("@/lib/constants", () => ({
-  IS_PRODUCTION: false,
-  SENTRY_DSN: undefined,
-}));
-
-vi.mock("@sentry/nextjs", () => ({
-  captureException: mocks.captureException,
-}));
-
-vi.mock("@formbricks/logger", () => ({
-  logger: {
-    withContext: vi.fn(() => ({
-      error: mocks.loggerError,
-    })),
-  },
-}));
-
-vi.mock("@/modules/auth/lib/authOptions", () => ({
-  authOptions: {
-    callbacks: {
-      signIn: mocks.baseSignIn,
-      session: mocks.baseSession,
-    },
-    events: {
-      signIn: mocks.baseEventSignIn,
-    },
-  },
-}));
-
-vi.mock("@/modules/ee/audit-logs/lib/handler", () => ({
-  queueAuditEventBackground: mocks.queueAuditEventBackground,
-}));
-
-const getWrappedAuthOptions = async (requestId: string = "req-123") => {
-  const request = new Request("http://localhost/api/auth/signin", {
-    headers: { "x-request-id": requestId },
-  });
-
-  await GET(request, {} as any);
-
-  expect(mocks.nextAuth).toHaveBeenCalledTimes(1);
-
-  return mocks.nextAuth.mock.calls[0][0];
-};
-
-describe("auth route audit logging", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.clearAllMocks();
-  });
-
-  test("logs successful sign-in from the NextAuth signIn event after session creation", async () => {
-    const authOptions = await getWrappedAuthOptions();
-    const user = { id: "user_1", email: "user@example.com", name: "User Example" };
-    const account = { provider: "keycloak" };
-
-    await expect(authOptions.callbacks.signIn({ user, account })).resolves.toBe(true);
-    expect(mocks.queueAuditEventBackground).not.toHaveBeenCalled();
-
-    await authOptions.events.signIn({ user, account, isNewUser: false });
-
-    expect(mocks.baseEventSignIn).toHaveBeenCalledWith({ user, account, isNewUser: false });
-    expect(mocks.queueAuditEventBackground).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: "signedIn",
-        targetType: "user",
-        userId: "user_1",
-        targetId: "user_1",
-        organizationId: "unknown",
-        status: "success",
-        userType: "user",
-        newObject: expect.objectContaining({
-          email: "user@example.com",
-          authMethod: "sso",
-          provider: "keycloak",
-          sessionStrategy: "database",
-          isNewUser: false,
-        }),
-      })
-    );
-  });
-
-  test("logs failed sign-in attempts from the callback stage with the request event id", async () => {
-    const error = new Error("Access denied");
-    mocks.baseSignIn.mockRejectedValueOnce(error);
-
-    const authOptions = await getWrappedAuthOptions("req-failure");
-    const user = { id: "user_2", email: "user2@example.com" };
-    const account = { provider: "credentials" };
-
-    await expect(authOptions.callbacks.signIn({ user, account })).rejects.toThrow("Access denied");
-
-    expect(mocks.baseEventSignIn).not.toHaveBeenCalled();
-    expect(mocks.queueAuditEventBackground).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: "signedIn",
-        targetType: "user",
-        userId: "user_2",
-        targetId: "user_2",
-        organizationId: "unknown",
-        status: "failure",
-        userType: "user",
-        eventId: "req-failure",
-        newObject: expect.objectContaining({
-          email: "user2@example.com",
-          authMethod: "password",
-          provider: "credentials",
-          errorMessage: "Access denied",
-        }),
-      })
-    );
-  });
-});

apps/web/app/api/auth/[...nextauth]/route.ts

@@ -6,26 +6,10 @@ import { logger } from "@formbricks/logger";
 import { IS_PRODUCTION, SENTRY_DSN } from "@/lib/constants";
 import { authOptions as baseAuthOptions } from "@/modules/auth/lib/authOptions";
 import { queueAuditEventBackground } from "@/modules/ee/audit-logs/lib/handler";
-import { UNKNOWN_DATA } from "@/modules/ee/audit-logs/types/audit-log";
+import { TAuditStatus, UNKNOWN_DATA } from "@/modules/ee/audit-logs/types/audit-log";
 
 export const fetchCache = "force-no-store";
 
-const getAuthMethod = (account: Account | null) => {
-  if (account?.provider === "credentials") {
-    return "password";
-  }
-
-  if (account?.provider === "token") {
-    return "email_verification";
-  }
-
-  if (account?.provider) {
-    return "sso";
-  }
-
-  return "unknown";
-};
-
 const handler = async (req: Request, ctx: any) => {
   const eventId = req.headers.get("x-request-id") ?? undefined;
 
@@ -33,6 +17,44 @@ const handler = async (req: Request, ctx: any) => {
     ...baseAuthOptions,
     callbacks: {
       ...baseAuthOptions.callbacks,
+      async jwt(params: any) {
+        let result: any = params.token;
+        let error: any = undefined;
+
+        try {
+          if (baseAuthOptions.callbacks?.jwt) {
+            result = await baseAuthOptions.callbacks.jwt(params);
+          }
+        } catch (err) {
+          error = err;
+          logger.withContext({ eventId, err }).error("JWT callback failed");
+
+          if (SENTRY_DSN && IS_PRODUCTION) {
+            Sentry.captureException(err);
+          }
+        }
+
+        // Audit JWT operations (token refresh, updates)
+        if (params.trigger && params.token?.profile?.id) {
+          const status: TAuditStatus = error ? "failure" : "success";
+          const auditLog = {
+            action: "jwtTokenCreated" as const,
+            targetType: "user" as const,
+            userId: params.token.profile.id,
+            targetId: params.token.profile.id,
+            organizationId: UNKNOWN_DATA,
+            status,
+            userType: "user" as const,
+            newObject: { trigger: params.trigger, tokenType: "jwt" },
+            ...(error ? { eventId } : {}),
+          };
+
+          queueAuditEventBackground(auditLog);
+        }
+
+        if (error) throw error;
+        return result;
+      },
       async session(params: any) {
         let result: any = params.session;
         let error: any = undefined;
@@ -68,7 +90,7 @@ const handler = async (req: Request, ctx: any) => {
       }) {
         let result: boolean | string = true;
         let error: any = undefined;
-        const authMethod = getAuthMethod(account);
+        let authMethod = "unknown";
 
         try {
           if (baseAuthOptions.callbacks?.signIn) {
@@ -80,6 +102,15 @@ const handler = async (req: Request, ctx: any) => {
               credentials,
             });
           }
+
+          // Determine authentication method for more detailed logging
+          if (account?.provider === "credentials") {
+            authMethod = "password";
+          } else if (account?.provider === "token") {
+            authMethod = "email_verification";
+          } else if (account?.provider && account.provider !== "credentials") {
+            authMethod = "sso";
+          }
         } catch (err) {
           error = err;
           result = false;
@@ -91,58 +122,28 @@ const handler = async (req: Request, ctx: any) => {
           }
         }
 
-        if (result === false) {
-          queueAuditEventBackground({
-            action: "signedIn",
-            targetType: "user",
-            userId: user?.id ?? UNKNOWN_DATA,
-            targetId: user?.id ?? UNKNOWN_DATA,
-            organizationId: UNKNOWN_DATA,
-            status: "failure",
-            userType: "user",
-            newObject: {
-              ...user,
-              authMethod,
-              provider: account?.provider,
-              ...(error instanceof Error ? { errorMessage: error.message } : {}),
-            },
-            eventId,
-          });
-        }
-
-        if (error) throw error;
-        return result;
-      },
-    },
-    events: {
-      ...baseAuthOptions.events,
-      async signIn({ user, account, isNewUser }: any) {
-        try {
-          await baseAuthOptions.events?.signIn?.({ user, account, isNewUser });
-        } catch (err) {
-          logger.withContext({ eventId, err }).error("Sign-in event callback failed");
-
-          if (SENTRY_DSN && IS_PRODUCTION) {
-            Sentry.captureException(err);
-          }
-        }
-
-        queueAuditEventBackground({
-          action: "signedIn",
-          targetType: "user",
+        const status: TAuditStatus = result === false ? "failure" : "success";
+        const auditLog = {
+          action: "signedIn" as const,
+          targetType: "user" as const,
           userId: user?.id ?? UNKNOWN_DATA,
           targetId: user?.id ?? UNKNOWN_DATA,
           organizationId: UNKNOWN_DATA,
-          status: "success",
-          userType: "user",
+          status,
+          userType: "user" as const,
           newObject: {
             ...user,
-            authMethod: getAuthMethod(account),
+            authMethod,
             provider: account?.provider,
-            sessionStrategy: "database",
-            isNewUser: isNewUser ?? false,
+            ...(error ? { errorMessage: error.message } : {}),
           },
-        });
+          ...(status === "failure" ? { eventId } : {}),
+        };
+
+        queueAuditEventBackground(auditLog);
+
+        if (error) throw error;
+        return result;
       },
     },
   };

apps/web/lib/account/service.test.ts

@@ -1,97 +0,0 @@
-import { Prisma } from "@prisma/client";
-import { beforeEach, describe, expect, test, vi } from "vitest";
-import { upsertAccount } from "./service";
-
-const { mockUpsert } = vi.hoisted(() => ({
-  mockUpsert: vi.fn(),
-}));
-
-vi.mock("@formbricks/database", () => ({
-  prisma: {
-    account: {
-      upsert: mockUpsert,
-    },
-  },
-}));
-
-describe("account service", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  test("upsertAccount keeps user ownership immutable on update", async () => {
-    const accountData = {
-      userId: "user-1",
-      type: "oauth",
-      provider: "google",
-      providerAccountId: "provider-1",
-      access_token: "access-token",
-      refresh_token: "refresh-token",
-      expires_at: 123,
-      scope: "openid email",
-      token_type: "Bearer",
-      id_token: "id-token",
-    };
-
-    mockUpsert.mockResolvedValue({
-      id: "account-1",
-      createdAt: new Date(),
-      updatedAt: new Date(),
-      ...accountData,
-    });
-
-    await upsertAccount(accountData);
-
-    expect(mockUpsert).toHaveBeenCalledWith({
-      where: {
-        provider_providerAccountId: {
-          provider: "google",
-          providerAccountId: "provider-1",
-        },
-      },
-      create: accountData,
-      update: {
-        access_token: "access-token",
-        refresh_token: "refresh-token",
-        expires_at: 123,
-        scope: "openid email",
-        token_type: "Bearer",
-        id_token: "id-token",
-      },
-    });
-  });
-
-  test("upsertAccount wraps Prisma known request errors", async () => {
-    const prismaError = Object.assign(Object.create(Prisma.PrismaClientKnownRequestError.prototype), {
-      message: "duplicate account",
-    });
-
-    mockUpsert.mockRejectedValue(prismaError);
-
-    await expect(
-      upsertAccount({
-        userId: "user-1",
-        type: "oauth",
-        provider: "google",
-        providerAccountId: "provider-1",
-      })
-    ).rejects.toMatchObject({
-      name: "DatabaseError",
-      message: "duplicate account",
-    });
-  });
-
-  test("upsertAccount rethrows non-Prisma errors", async () => {
-    const error = new Error("unexpected failure");
-    mockUpsert.mockRejectedValue(error);
-
-    await expect(
-      upsertAccount({
-        userId: "user-1",
-        type: "oauth",
-        provider: "google",
-        providerAccountId: "provider-1",
-      })
-    ).rejects.toThrow("unexpected failure");
-  });
-});

apps/web/lib/account/service.ts

@@ -20,36 +20,3 @@ export const createAccount = async (accountData: TAccountInput): Promise<TAccoun
     throw error;
   }
 };
-
-export const upsertAccount = async (accountData: TAccountInput): Promise<TAccount> => {
-  const [validatedAccountData] = validateInputs([accountData, ZAccountInput]);
-  const updateAccountData: Omit<TAccountInput, "userId" | "type" | "provider" | "providerAccountId"> = {
-    access_token: validatedAccountData.access_token,
-    refresh_token: validatedAccountData.refresh_token,
-    expires_at: validatedAccountData.expires_at,
-    scope: validatedAccountData.scope,
-    token_type: validatedAccountData.token_type,
-    id_token: validatedAccountData.id_token,
-  };
-
-  try {
-    const account = await prisma.account.upsert({
-      where: {
-        provider_providerAccountId: {
-          provider: validatedAccountData.provider,
-          providerAccountId: validatedAccountData.providerAccountId,
-        },
-      },
-      create: validatedAccountData,
-      update: updateAccountData,
-    });
-
-    return account;
-  } catch (error) {
-    if (error instanceof Prisma.PrismaClientKnownRequestError) {
-      throw new DatabaseError(error.message);
-    }
-
-    throw error;
-  }
-};

apps/web/lib/constants.ts

@@ -26,7 +26,6 @@ export const TERMS_URL = env.TERMS_URL;
 export const IMPRINT_URL = env.IMPRINT_URL;
 export const IMPRINT_ADDRESS = env.IMPRINT_ADDRESS;
 
-export const DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS = env.DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS === "1";
 export const PASSWORD_RESET_DISABLED = env.PASSWORD_RESET_DISABLED === "1";
 export const EMAIL_VERIFICATION_DISABLED = env.EMAIL_VERIFICATION_DISABLED === "1";
 

apps/web/lib/env.ts

@@ -15,7 +15,6 @@ export const env = createEnv({
     BREVO_API_KEY: z.string().optional(),
     BREVO_LIST_ID: z.string().optional(),
     DATABASE_URL: z.url(),
-    DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: z.enum(["1", "0"]).optional(),
     DEBUG: z.enum(["1", "0"]).optional(),
     AUTH_DEFAULT_TEAM_ID: z.string().optional(),
     AUTH_SKIP_INVITE_FOR_SSO: z.enum(["1", "0"]).optional(),
@@ -142,7 +141,6 @@ export const env = createEnv({
     BREVO_LIST_ID: process.env.BREVO_LIST_ID,
     CRON_SECRET: process.env.CRON_SECRET,
     DATABASE_URL: process.env.DATABASE_URL,
-    DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: process.env.DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS,
     DEBUG: process.env.DEBUG,
     AUTH_DEFAULT_TEAM_ID: process.env.AUTH_SSO_DEFAULT_TEAM_ID,
     AUTH_SKIP_INVITE_FOR_SSO: process.env.AUTH_SKIP_INVITE_FOR_SSO,

apps/web/lib/utils/validate-webhook-url.test.ts

@@ -9,10 +9,6 @@ vi.mock("node:dns", () => ({
   },
 }));
 
-vi.mock("../constants", () => ({
-  DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: false,
-}));
-
 const mockResolve = vi.mocked(dns.resolve);
 const mockResolve6 = vi.mocked(dns.resolve6);
 
@@ -298,78 +294,4 @@ describe("validateWebhookUrl", () => {
       });
     });
   });
-
-  describe("DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS", () => {
-    test("allows private IP URLs when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("http://127.0.0.1/")).resolves.toBeUndefined();
-      await expect(validateWithFlag("http://192.168.1.1/test")).resolves.toBeUndefined();
-      await expect(validateWithFlag("http://10.0.0.1/webhook")).resolves.toBeUndefined();
-    });
-
-    test("allows localhost when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("http://localhost/webhook")).resolves.toBeUndefined();
-      await expect(validateWithFlag("http://localhost:3333/webhook")).resolves.toBeUndefined();
-    });
-
-    test("allows localhost.localdomain when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("http://localhost.localdomain/path")).resolves.toBeUndefined();
-    });
-
-    test("allows hostname resolving to private IP when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      setupDnsResolution(["192.168.1.1"]);
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("https://internal.company.com/webhook")).resolves.toBeUndefined();
-    });
-
-    test("still rejects unresolvable hostnames when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      setupDnsResolution(null, null);
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("https://typo-gibberish.invalid/hook")).rejects.toThrow(
-        "Could not resolve webhook URL hostname"
-      );
-    });
-
-    test("still rejects invalid URL format when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("not-a-url")).rejects.toThrow("Invalid webhook URL format");
-    });
-
-    test("still rejects non-HTTP protocols when enabled", async () => {
-      vi.doMock("../constants", () => ({
-        DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS: true,
-      }));
-
-      const { validateWebhookUrl: validateWithFlag } = await import("./validate-webhook-url");
-      await expect(validateWithFlag("ftp://192.168.1.1/")).rejects.toThrow(
-        "Webhook URL must use HTTPS or HTTP protocol"
-      );
-    });
-  });
 });

apps/web/lib/utils/validate-webhook-url.ts

@@ -1,7 +1,6 @@
 import "server-only";
 import dns from "node:dns";
 import { InvalidInputError } from "@formbricks/types/errors";
-import { DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS } from "../constants";
 
 const BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -140,10 +139,8 @@ export const validateWebhookUrl = async (url: string): Promise<void> => {
 
   const hostname = parsed.hostname;
 
-  if (!DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS) {
-    if (BLOCKED_HOSTNAMES.has(hostname.toLowerCase())) {
-      throw new InvalidInputError("Webhook URL must not point to localhost or internal services");
-    }
+  if (BLOCKED_HOSTNAMES.has(hostname.toLowerCase())) {
+    throw new InvalidInputError("Webhook URL must not point to localhost or internal services");
   }
 
   // Direct IP literal — validate without DNS resolution
@@ -152,17 +149,12 @@ export const validateWebhookUrl = async (url: string): Promise<void> => {
 
   if (isIPv4Literal || isIPv6Literal) {
     const ip = isIPv6Literal ? stripIPv6Brackets(hostname) : hostname;
-    if (!DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS && isPrivateIP(ip)) {
+    if (isPrivateIP(ip)) {
       throw new InvalidInputError("Webhook URL must not point to private or internal IP addresses");
     }
     return;
   }
 
-  // Skip DNS resolution for localhost-like hostnames when internal URLs are allowed since these are resolved via /etc/hosts and not DNS
-  if (DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS && BLOCKED_HOSTNAMES.has(hostname.toLowerCase())) {
-    return;
-  }
-
   // Domain name — resolve DNS and validate every resolved IP
   let resolvedIPs: string[];
   try {
@@ -176,11 +168,9 @@ export const validateWebhookUrl = async (url: string): Promise<void> => {
     );
   }
 
-  if (!DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS) {
-    for (const ip of resolvedIPs) {
-      if (isPrivateIP(ip)) {
-        throw new InvalidInputError("Webhook URL must not point to private or internal IP addresses");
-      }
+  for (const ip of resolvedIPs) {
+    if (isPrivateIP(ip)) {
+      throw new InvalidInputError("Webhook URL must not point to private or internal IP addresses");
     }
   }
 };

apps/web/locales/en-US.json

@@ -148,6 +148,8 @@
     "bottom_right": "Bottom Right",
     "cancel": "Cancel",
     "centered_modal": "Centered Modal",
+    "change_organization": "Change organization",
+    "change_workspace": "Change workspace",
     "choices": "Choices",
     "choose_environment": "Choose environment",
     "choose_organization": "Choose organization",

apps/web/modules/auth/lib/authOptions.test.ts

@@ -10,25 +10,6 @@ import { authOptions } from "./authOptions";
 import { mockUser } from "./mock-data";
 import { hashPassword } from "./utils";
 
-vi.mock("@next-auth/prisma-adapter", () => ({
-  PrismaAdapter: vi.fn(() => ({
-    createUser: vi.fn(),
-    getUser: vi.fn(),
-    getUserByEmail: vi.fn(),
-    getUserByAccount: vi.fn(),
-    updateUser: vi.fn(),
-    deleteUser: vi.fn(),
-    linkAccount: vi.fn(),
-    unlinkAccount: vi.fn(),
-    createSession: vi.fn(),
-    getSessionAndUser: vi.fn(),
-    updateSession: vi.fn(),
-    deleteSession: vi.fn(),
-    createVerificationToken: vi.fn(),
-    useVerificationToken: vi.fn(),
-  })),
-}));
-
 // Mock encryption utilities
 vi.mock("@/lib/encryption", () => ({
   symmetricEncrypt: vi.fn((value: string) => `encrypted_${value}`),
@@ -319,20 +300,51 @@ describe("authOptions", () => {
   });
 
   describe("Callbacks", () => {
-    describe("session callback", () => {
-      test("should add user id and isActive to session from database user", async () => {
-        const session = { user: { email: "user6@example.com" } };
-        const user = { id: "user6", isActive: false };
+    describe("jwt callback", () => {
+      test("should add profile information to token if user is found", async () => {
+        vi.spyOn(prisma.user, "findFirst").mockResolvedValue({
+          id: mockUser.id,
+          locale: mockUser.locale,
+          email: mockUser.email,
+          emailVerified: mockUser.emailVerified,
+        } as any);
 
+        const token = { email: mockUser.email };
+        if (!authOptions.callbacks?.jwt) {
+          throw new Error("jwt callback is not defined");
+        }
+        const result = await authOptions.callbacks.jwt({ token } as any);
+        expect(result).toEqual({
+          ...token,
+          profile: { id: mockUser.id },
+        });
+      });
+
+      test("should return token unchanged if no existing user is found", async () => {
+        vi.spyOn(prisma.user, "findFirst").mockResolvedValue(null);
+
+        const token = { email: "nonexistent@example.com" };
+        if (!authOptions.callbacks?.jwt) {
+          throw new Error("jwt callback is not defined");
+        }
+        const result = await authOptions.callbacks.jwt({ token } as any);
+        expect(result).toEqual(token);
+      });
+    });
+
+    describe("session callback", () => {
+      test("should add user profile to session", async () => {
+        const token = {
+          id: "user6",
+          profile: { id: "user6", email: "user6@example.com" },
+        };
+
+        const session = { user: {} };
         if (!authOptions.callbacks?.session) {
           throw new Error("session callback is not defined");
         }
-        const result = await authOptions.callbacks.session({ session, user } as any);
-        expect(result.user).toEqual({
-          email: "user6@example.com",
-          id: "user6",
-          isActive: false,
-        });
+        const result = await authOptions.callbacks.session({ session, token } as any);
+        expect(result.user).toEqual(token.profile);
       });
     });
 

apps/web/modules/auth/lib/authOptions.ts

@@ -1,4 +1,3 @@
-import { PrismaAdapter } from "@next-auth/prisma-adapter";
 import type { NextAuthOptions } from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { cookies } from "next/headers";
@@ -14,7 +13,7 @@ import {
 } from "@/lib/constants";
 import { symmetricDecrypt, symmetricEncrypt } from "@/lib/crypto";
 import { verifyToken } from "@/lib/jwt";
-import { updateUser, updateUserLastLoginAt } from "@/modules/auth/lib/user";
+import { getUserByEmail, updateUser, updateUserLastLoginAt } from "@/modules/auth/lib/user";
 import {
   logAuthAttempt,
   logAuthEvent,
@@ -32,7 +31,6 @@ import { handleSsoCallback } from "@/modules/ee/sso/lib/sso-handlers";
 import { createBrevoCustomer } from "./brevo";
 
 export const authOptions: NextAuthOptions = {
-  adapter: PrismaAdapter(prisma),
   providers: [
     CredentialsProvider({
       id: "credentials",
@@ -312,17 +310,30 @@ export const authOptions: NextAuthOptions = {
     ...(ENTERPRISE_LICENSE_KEY ? getSSOProviders() : []),
   ],
   session: {
-    strategy: "database",
     maxAge: SESSION_MAX_AGE,
   },
   callbacks: {
-    async session({ session, user }) {
-      if (session.user) {
-        session.user.id = user.id;
-        if ("isActive" in user && typeof user.isActive === "boolean") {
-          session.user.isActive = user.isActive;
-        }
+    async jwt({ token }) {
+      const existingUser = await getUserByEmail(token?.email!);
+
+      if (!existingUser) {
+        return token;
       }
+
+      return {
+        ...token,
+        profile: { id: existingUser.id },
+        isActive: existingUser.isActive,
+      };
+    },
+    async session({ session, token }) {
+      // @ts-expect-error
+      session.user.id = token?.id;
+      // @ts-expect-error
+      session.user = token.profile;
+      // @ts-expect-error
+      session.user.isActive = token.isActive;
+
       return session;
     },
     async signIn({ user, account }) {

apps/web/modules/auth/lib/proxy-session.test.ts

@@ -1,115 +0,0 @@
-import { beforeEach, describe, expect, test, vi } from "vitest";
-import { getProxySession, getSessionTokenFromRequest } from "./proxy-session";
-
-const { mockFindUnique } = vi.hoisted(() => ({
-  mockFindUnique: vi.fn(),
-}));
-
-vi.mock("@formbricks/database", () => ({
-  prisma: {
-    session: {
-      findUnique: mockFindUnique,
-    },
-  },
-}));
-
-const createRequest = (cookies: Record<string, string> = {}) => ({
-  cookies: {
-    get: (name: string) => {
-      const value = cookies[name];
-      return value ? { value } : undefined;
-    },
-  },
-});
-
-describe("proxy-session", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  test("reads the secure session cookie when present", () => {
-    const request = createRequest({
-      "__Secure-next-auth.session-token": "secure-token",
-    });
-
-    expect(getSessionTokenFromRequest(request)).toBe("secure-token");
-  });
-
-  test("returns null when no session cookie is present", async () => {
-    const request = createRequest();
-
-    const session = await getProxySession(request);
-
-    expect(session).toBeNull();
-    expect(mockFindUnique).not.toHaveBeenCalled();
-  });
-
-  test("returns null when the session is expired", async () => {
-    mockFindUnique.mockResolvedValue({
-      userId: "user-1",
-      expires: new Date(Date.now() - 60_000),
-      user: {
-        isActive: true,
-      },
-    });
-
-    const request = createRequest({
-      "next-auth.session-token": "expired-token",
-    });
-
-    const session = await getProxySession(request);
-
-    expect(session).toBeNull();
-    expect(mockFindUnique).toHaveBeenCalledWith({
-      where: {
-        sessionToken: "expired-token",
-      },
-      select: {
-        userId: true,
-        expires: true,
-        user: {
-          select: {
-            isActive: true,
-          },
-        },
-      },
-    });
-  });
-
-  test("returns null when the session belongs to an inactive user", async () => {
-    mockFindUnique.mockResolvedValue({
-      userId: "user-1",
-      expires: new Date(Date.now() + 60_000),
-      user: {
-        isActive: false,
-      },
-    });
-
-    const request = createRequest({
-      "next-auth.session-token": "inactive-user-token",
-    });
-
-    const session = await getProxySession(request);
-
-    expect(session).toBeNull();
-  });
-
-  test("returns the session when the cookie maps to a valid session", async () => {
-    const validSession = {
-      userId: "user-1",
-      expires: new Date(Date.now() + 60_000),
-      user: {
-        isActive: true,
-      },
-    };
-    mockFindUnique.mockResolvedValue(validSession);
-
-    const request = createRequest({
-      "next-auth.session-token": "valid-token",
-    });
-
-    const session = await getProxySession(request);
-
-    expect(session).toEqual(validSession);
-  });
-});

apps/web/modules/auth/lib/proxy-session.ts

@@ -1,54 +0,0 @@
-import { prisma } from "@formbricks/database";
-
-const NEXT_AUTH_SESSION_COOKIE_NAMES = [
-  "__Secure-next-auth.session-token",
-  "next-auth.session-token",
-] as const;
-
-type TCookieStore = {
-  get: (name: string) => { value: string } | undefined;
-};
-
-type TRequestWithCookies = {
-  cookies: TCookieStore;
-};
-
-export const getSessionTokenFromRequest = (request: TRequestWithCookies): string | null => {
-  for (const cookieName of NEXT_AUTH_SESSION_COOKIE_NAMES) {
-    const cookie = request.cookies.get(cookieName);
-    if (cookie?.value) {
-      return cookie.value;
-    }
-  }
-
-  return null;
-};
-
-export const getProxySession = async (request: TRequestWithCookies) => {
-  const sessionToken = getSessionTokenFromRequest(request);
-
-  if (!sessionToken) {
-    return null;
-  }
-
-  const session = await prisma.session.findUnique({
-    where: {
-      sessionToken,
-    },
-    select: {
-      userId: true,
-      expires: true,
-      user: {
-        select: {
-          isActive: true,
-        },
-      },
-    },
-  });
-
-  if (!session || session.expires <= new Date() || session.user.isActive === false) {
-    return null;
-  }
-
-  return session;
-};

apps/web/modules/ee/billing/actions.test.ts

@@ -106,7 +106,10 @@ describe("billing actions", () => {
     });
     expect(mocks.getOrganization).toHaveBeenCalledWith("org_1");
     expect(mocks.ensureStripeCustomerForOrganization).toHaveBeenCalledWith("org_1");
-    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1");
+    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith(
+      "org_1",
+      "start-hobby"
+    );
     expect(mocks.syncOrganizationBillingFromStripe).toHaveBeenCalledWith("org_1");
     expect(result).toEqual({ success: true });
   });
@@ -125,7 +128,10 @@ describe("billing actions", () => {
     } as any);
 
     expect(mocks.ensureStripeCustomerForOrganization).not.toHaveBeenCalled();
-    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1");
+    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith(
+      "org_1",
+      "start-hobby"
+    );
     expect(mocks.syncOrganizationBillingFromStripe).toHaveBeenCalledWith("org_1");
     expect(result).toEqual({ success: true });
   });
@@ -139,7 +145,7 @@ describe("billing actions", () => {
     expect(mocks.getOrganization).toHaveBeenCalledWith("org_1");
     expect(mocks.ensureStripeCustomerForOrganization).toHaveBeenCalledWith("org_1");
     expect(mocks.createProTrialSubscription).toHaveBeenCalledWith("org_1", "cus_1");
-    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1");
+    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1", "pro-trial");
     expect(mocks.syncOrganizationBillingFromStripe).toHaveBeenCalledWith("org_1");
     expect(result).toEqual({ success: true });
   });
@@ -159,7 +165,7 @@ describe("billing actions", () => {
 
     expect(mocks.ensureStripeCustomerForOrganization).not.toHaveBeenCalled();
     expect(mocks.createProTrialSubscription).toHaveBeenCalledWith("org_1", "cus_existing");
-    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1");
+    expect(mocks.reconcileCloudStripeSubscriptionsForOrganization).toHaveBeenCalledWith("org_1", "pro-trial");
     expect(mocks.syncOrganizationBillingFromStripe).toHaveBeenCalledWith("org_1");
     expect(result).toEqual({ success: true });
   });

apps/web/modules/ee/billing/actions.ts

@@ -216,7 +216,7 @@ export const startHobbyAction = authenticatedActionClient
       throw new ResourceNotFoundError("OrganizationBilling", parsedInput.organizationId);
     }
 
-    await reconcileCloudStripeSubscriptionsForOrganization(parsedInput.organizationId);
+    await reconcileCloudStripeSubscriptionsForOrganization(parsedInput.organizationId, "start-hobby");
     await syncOrganizationBillingFromStripe(parsedInput.organizationId);
     return { success: true };
   });
@@ -248,7 +248,7 @@ export const startProTrialAction = authenticatedActionClient
     }
 
     await createProTrialSubscription(parsedInput.organizationId, customerId);
-    await reconcileCloudStripeSubscriptionsForOrganization(parsedInput.organizationId);
+    await reconcileCloudStripeSubscriptionsForOrganization(parsedInput.organizationId, "pro-trial");
     await syncOrganizationBillingFromStripe(parsedInput.organizationId);
     return { success: true };
   });

apps/web/modules/ee/billing/api/lib/stripe-webhook.ts

@@ -150,7 +150,7 @@ export const webhookHandler = async (requestBody: string, stripeSignature: strin
       await handleSetupCheckoutCompleted(event.data.object, stripe);
     }
 
-    await reconcileCloudStripeSubscriptionsForOrganization(organizationId);
+    await reconcileCloudStripeSubscriptionsForOrganization(organizationId, event.id);
     await syncOrganizationBillingFromStripe(organizationId, {
       id: event.id,
       created: event.created,

apps/web/modules/ee/billing/lib/organization-billing.test.ts

@@ -1905,7 +1905,7 @@ describe("organization-billing", () => {
         items: [{ price: "price_hobby_monthly", quantity: 1 }],
         metadata: { organizationId: "org_1" },
       },
-      { idempotencyKey: "ensure-hobby-subscription-org_1-0" }
+      { idempotencyKey: "ensure-hobby-subscription-org_1-bootstrap" }
     );
     expect(mocks.prismaOrganizationBillingUpdate).toHaveBeenCalledWith({
       where: { organizationId: "org_1" },
@@ -1974,7 +1974,7 @@ describe("organization-billing", () => {
       ],
     });
 
-    await reconcileCloudStripeSubscriptionsForOrganization("org_1");
+    await reconcileCloudStripeSubscriptionsForOrganization("org_1", "evt_123");
 
     expect(mocks.subscriptionsCancel).toHaveBeenCalledWith("sub_hobby", { prorate: false });
     expect(mocks.subscriptionsCreate).not.toHaveBeenCalled();

apps/web/modules/ee/billing/lib/organization-billing.ts

@@ -458,21 +458,18 @@ const resolvePendingChangeEffectiveAt = (
 const ensureHobbySubscription = async (
   organizationId: string,
   customerId: string,
-  subscriptionCount: number
+  idempotencySuffix: string
 ): Promise<void> => {
   if (!stripeClient) return;
   const hobbyItems = await getCatalogItemsForPlan("hobby", "monthly");
 
-  // Include subscriptionCount so the key is stable across concurrent calls (same
-  // count → same key → Stripe deduplicates) but changes after a cancellation
-  // (count increases → new key → allows legitimate re-creation).
   await stripeClient.subscriptions.create(
     {
       customer: customerId,
       items: hobbyItems,
       metadata: { organizationId },
     },
-    { idempotencyKey: `ensure-hobby-subscription-${organizationId}-${subscriptionCount}` }
+    { idempotencyKey: `ensure-hobby-subscription-${organizationId}-${idempotencySuffix}` }
   );
 };
 
@@ -1267,7 +1264,8 @@ export const findOrganizationIdByStripeCustomerId = async (customerId: string):
 };
 
 export const reconcileCloudStripeSubscriptionsForOrganization = async (
-  organizationId: string
+  organizationId: string,
+  idempotencySuffix = "reconcile"
 ): Promise<void> => {
   const client = stripeClient;
   if (!IS_FORMBRICKS_CLOUD || !client) return;
@@ -1344,14 +1342,12 @@ export const reconcileCloudStripeSubscriptionsForOrganization = async (
     // (e.g. webhook + bootstrap) both seeing 0 and creating duplicate hobbies.
     const freshSubscriptions = await client.subscriptions.list({
       customer: customerId,
-      status: "all",
-      limit: 20,
+      status: "active",
+      limit: 1,
     });
 
-    const freshActive = freshSubscriptions.data.filter((sub) => ACTIVE_SUBSCRIPTION_STATUSES.has(sub.status));
-
-    if (freshActive.length === 0) {
-      await ensureHobbySubscription(organizationId, customerId, freshSubscriptions.data.length);
+    if (freshSubscriptions.data.length === 0) {
+      await ensureHobbySubscription(organizationId, customerId, idempotencySuffix);
     }
   }
 };
@@ -1359,6 +1355,6 @@ export const reconcileCloudStripeSubscriptionsForOrganization = async (
 export const ensureCloudStripeSetupForOrganization = async (organizationId: string): Promise<void> => {
   if (!IS_FORMBRICKS_CLOUD || !stripeClient) return;
   await ensureStripeCustomerForOrganization(organizationId);
-  await reconcileCloudStripeSubscriptionsForOrganization(organizationId);
+  await reconcileCloudStripeSubscriptionsForOrganization(organizationId, "bootstrap");
   await syncOrganizationBillingFromStripe(organizationId);
 };

apps/web/modules/ee/sso/lib/sso-handlers.ts

@@ -3,7 +3,7 @@ import type { Account } from "next-auth";
 import { prisma } from "@formbricks/database";
 import { logger } from "@formbricks/logger";
 import type { TUser, TUserNotificationSettings } from "@formbricks/types/user";
-import { upsertAccount } from "@/lib/account/service";
+import { createAccount } from "@/lib/account/service";
 import { DEFAULT_TEAM_ID, SKIP_INVITE_FOR_SSO } from "@/lib/constants";
 import { getIsFreshInstance } from "@/lib/instance/service";
 import { verifyInviteToken } from "@/lib/jwt";
@@ -23,21 +23,6 @@ import {
 import { getFirstOrganization } from "@/modules/ee/sso/lib/organization";
 import { createDefaultTeamMembership, getOrganizationByTeamId } from "@/modules/ee/sso/lib/team";
 
-const syncSsoAccount = async (userId: string, account: Account) => {
-  await upsertAccount({
-    userId,
-    type: account.type,
-    provider: account.provider,
-    providerAccountId: account.providerAccountId,
-    ...(account.access_token !== undefined ? { access_token: account.access_token } : {}),
-    ...(account.refresh_token !== undefined ? { refresh_token: account.refresh_token } : {}),
-    ...(account.expires_at !== undefined ? { expires_at: account.expires_at } : {}),
-    ...(account.scope !== undefined ? { scope: account.scope } : {}),
-    ...(account.token_type !== undefined ? { token_type: account.token_type } : {}),
-    ...(account.id_token !== undefined ? { id_token: account.id_token } : {}),
-  });
-};
-
 export const handleSsoCallback = async ({
   user,
   account,
@@ -123,7 +108,6 @@ export const handleSsoCallback = async ({
       // User with this provider found
       // check if email still the same
       if (existingUserWithAccount.email === user.email) {
-        await syncSsoAccount(existingUserWithAccount.id, account);
         contextLogger.debug(
           { existingUserId: existingUserWithAccount.id },
           "SSO callback successful: existing user, email matches"
@@ -149,7 +133,6 @@ export const handleSsoCallback = async ({
         );
 
         await updateUser(existingUserWithAccount.id, { email: user.email });
-        await syncSsoAccount(existingUserWithAccount.id, account);
         return true;
       }
 
@@ -171,7 +154,6 @@ export const handleSsoCallback = async ({
     const existingUserWithEmail = await getUserByEmail(user.email);
 
     if (existingUserWithEmail) {
-      await syncSsoAccount(existingUserWithEmail.id, account);
       contextLogger.debug(
         { existingUserId: existingUserWithEmail.id, action: "existing_user_login" },
         "SSO callback successful: existing user found by email"
@@ -360,7 +342,6 @@ export const handleSsoCallback = async ({
 
     // send new user to brevo
     createBrevoCustomer({ id: userProfile.id, email: userProfile.email });
-    await syncSsoAccount(userProfile.id, account);
 
     if (isMultiOrgEnabled) {
       contextLogger.debug(
@@ -377,6 +358,10 @@ export const handleSsoCallback = async ({
         "Assigning user to organization"
       );
       await createMembership(organization.id, userProfile.id, { role: "member", accepted: true });
+      await createAccount({
+        ...account,
+        userId: userProfile.id,
+      });
 
       if (SKIP_INVITE_FOR_SSO && DEFAULT_TEAM_ID) {
         contextLogger.debug(

apps/web/modules/ee/sso/lib/tests/sso-handlers.test.ts

@@ -1,7 +1,6 @@
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import type { TUser } from "@formbricks/types/user";
-import { upsertAccount } from "@/lib/account/service";
 import { createMembership } from "@/lib/membership/service";
 import { createOrganization, getOrganization } from "@/lib/organization/service";
 import { findMatchingLocale } from "@/lib/utils/locale";
@@ -63,7 +62,7 @@ vi.mock("@/modules/ee/sso/lib/team", () => ({
 }));
 
 vi.mock("@/lib/account/service", () => ({
-  upsertAccount: vi.fn(),
+  createAccount: vi.fn(),
 }));
 
 vi.mock("@/lib/membership/service", () => ({
@@ -204,36 +203,6 @@ describe("handleSsoCallback", () => {
       });
     });
 
-    test("should not overwrite stored tokens when the provider omits them", async () => {
-      vi.mocked(prisma.user.findFirst).mockResolvedValue({
-        ...mockUser,
-        email: mockUser.email,
-        accounts: [{ provider: mockAccount.provider }],
-      } as any);
-
-      const result = await handleSsoCallback({
-        user: mockUser,
-        account: {
-          ...mockAccount,
-          access_token: undefined,
-          refresh_token: undefined,
-          expires_at: undefined,
-          scope: undefined,
-          token_type: undefined,
-          id_token: undefined,
-        },
-        callbackUrl: "http://localhost:3000",
-      });
-
-      expect(result).toBe(true);
-      expect(upsertAccount).toHaveBeenCalledWith({
-        userId: mockUser.id,
-        type: mockAccount.type,
-        provider: mockAccount.provider,
-        providerAccountId: mockAccount.providerAccountId,
-      });
-    });
-
     test("should update user email if user with account exists but email changed", async () => {
       const existingUser = {
         ...mockUser,

apps/web/modules/integrations/webhooks/components/add-webhook-button.tsx

@@ -11,10 +11,9 @@ import { AddWebhookModal } from "./add-webhook-modal";
 interface AddWebhookButtonProps {
   environment: TEnvironment;
   surveys: TSurvey[];
-  allowInternalUrls: boolean;
 }
 
-export const AddWebhookButton = ({ environment, surveys, allowInternalUrls }: AddWebhookButtonProps) => {
+export const AddWebhookButton = ({ environment, surveys }: AddWebhookButtonProps) => {
   const { t } = useTranslation();
   const [isAddWebhookModalOpen, setAddWebhookModalOpen] = useState(false);
   return (
@@ -32,7 +31,6 @@ export const AddWebhookButton = ({ environment, surveys, allowInternalUrls }: Ad
         surveys={surveys}
         open={isAddWebhookModalOpen}
         setOpen={setAddWebhookModalOpen}
-        allowInternalUrls={allowInternalUrls}
       />
     </>
   );

apps/web/modules/integrations/webhooks/components/add-webhook-modal.tsx

@@ -34,16 +34,9 @@ interface AddWebhookModalProps {
   open: boolean;
   surveys: TSurvey[];
   setOpen: (v: boolean) => void;
-  allowInternalUrls: boolean;
 }
 
-export const AddWebhookModal = ({
-  environmentId,
-  surveys,
-  open,
-  setOpen,
-  allowInternalUrls,
-}: AddWebhookModalProps) => {
+export const AddWebhookModal = ({ environmentId, surveys, open, setOpen }: AddWebhookModalProps) => {
   const router = useRouter();
   const {
     handleSubmit,
@@ -66,7 +59,7 @@ export const AddWebhookModal = ({
     sendSuccessToast: boolean
   ): Promise<{ success: boolean; secret?: string }> => {
     try {
-      const { valid, error } = validWebHookURL(testEndpointInput, allowInternalUrls);
+      const { valid, error } = validWebHookURL(testEndpointInput);
       if (!valid) {
         toast.error(error ?? t("common.something_went_wrong_please_try_again"));
         return { success: false };

apps/web/modules/integrations/webhooks/components/webhook-detail-modal.tsx

@@ -23,17 +23,9 @@ interface WebhookModalProps {
   webhook: Webhook;
   surveys: TSurvey[];
   isReadOnly: boolean;
-  allowInternalUrls: boolean;
 }
 
-export const WebhookModal = ({
-  open,
-  setOpen,
-  webhook,
-  surveys,
-  isReadOnly,
-  allowInternalUrls,
-}: WebhookModalProps) => {
+export const WebhookModal = ({ open, setOpen, webhook, surveys, isReadOnly }: WebhookModalProps) => {
   const { t, i18n } = useTranslation();
   const locale = (i18n.resolvedLanguage ?? i18n.language ?? "en-US") as TUserLocale;
   const [activeTab, setActiveTab] = useState(0);
@@ -46,13 +38,7 @@ export const WebhookModal = ({
     {
       title: t("common.settings"),
       children: (
-        <WebhookSettingsTab
-          webhook={webhook}
-          surveys={surveys}
-          setOpen={setOpen}
-          isReadOnly={isReadOnly}
-          allowInternalUrls={allowInternalUrls}
-        />
+        <WebhookSettingsTab webhook={webhook} surveys={surveys} setOpen={setOpen} isReadOnly={isReadOnly} />
       ),
     },
   ];

apps/web/modules/integrations/webhooks/components/webhook-settings-tab.tsx

@@ -26,16 +26,9 @@ interface WebhookSettingsTabProps {
   surveys: TSurvey[];
   setOpen: (v: boolean) => void;
   isReadOnly: boolean;
-  allowInternalUrls: boolean;
 }
 
-export const WebhookSettingsTab = ({
-  webhook,
-  surveys,
-  setOpen,
-  isReadOnly,
-  allowInternalUrls,
-}: WebhookSettingsTabProps) => {
+export const WebhookSettingsTab = ({ webhook, surveys, setOpen, isReadOnly }: WebhookSettingsTabProps) => {
   const { t } = useTranslation();
   const router = useRouter();
   const { register, handleSubmit } = useForm({
@@ -67,7 +60,7 @@ export const WebhookSettingsTab = ({
 
   const handleTestEndpoint = async (sendSuccessToast: boolean): Promise<boolean> => {
     try {
-      const { valid, error } = validWebHookURL(testEndpointInput, allowInternalUrls);
+      const { valid, error } = validWebHookURL(testEndpointInput);
       if (!valid) {
         toast.error(error ?? t("common.something_went_wrong_please_try_again"));
         return false;

apps/web/modules/integrations/webhooks/components/webhook-table.tsx

@@ -14,7 +14,6 @@ interface WebhookTableProps {
   surveys: TSurvey[];
   children: [JSX.Element, JSX.Element[]];
   isReadOnly: boolean;
-  allowInternalUrls: boolean;
 }
 
 export const WebhookTable = ({
@@ -23,7 +22,6 @@ export const WebhookTable = ({
   surveys,
   children: [TableHeading, webhookRows],
   isReadOnly,
-  allowInternalUrls,
 }: WebhookTableProps) => {
   const [isWebhookDetailModalOpen, setWebhookDetailModalOpen] = useState(false);
   const { t } = useTranslation();
@@ -73,7 +71,6 @@ export const WebhookTable = ({
         webhook={activeWebhook}
         surveys={surveys}
         isReadOnly={isReadOnly}
-        allowInternalUrls={allowInternalUrls}
       />
     </>
   );

apps/web/modules/integrations/webhooks/lib/utils.ts

@@ -1,4 +1,4 @@
-export const validWebHookURL = (urlInput: string, allowInternalUrls = false) => {
+export const validWebHookURL = (urlInput: string) => {
   const trimmedInput = urlInput.trim();
   if (!trimmedInput) {
     return { valid: false, error: "Please enter a URL" };
@@ -7,13 +7,6 @@ export const validWebHookURL = (urlInput: string, allowInternalUrls = false) =>
   try {
     const url = new URL(trimmedInput);
 
-    if (allowInternalUrls) {
-      if (url.protocol !== "https:" && url.protocol !== "http:") {
-        return { valid: false, error: "URL must start with https:// or http://" };
-      }
-      return { valid: true };
-    }
-
     if (url.protocol !== "https:") {
       return { valid: false, error: "URL must start with https://" };
     }

apps/web/modules/integrations/webhooks/page.tsx

@@ -1,4 +1,3 @@
-import { DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS } from "@/lib/constants";
 import { getSurveys } from "@/lib/survey/service";
 import { getTranslate } from "@/lingodotdev/server";
 import { getEnvironmentAuth } from "@/modules/environments/lib/utils";
@@ -22,24 +21,13 @@ export const WebhooksPage = async (props: { params: Promise<{ environmentId: str
     getSurveys(params.environmentId, 200), // HOTFIX: not getting all surveys for now since it's maxing out the prisma accelerate limit
   ]);
 
-  const renderAddWebhookButton = () => (
-    <AddWebhookButton
-      environment={environment}
-      surveys={surveys}
-      allowInternalUrls={DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS}
-    />
-  );
+  const renderAddWebhookButton = () => <AddWebhookButton environment={environment} surveys={surveys} />;
 
   return (
     <PageContentWrapper>
       <GoBackButton />
       <PageHeader pageTitle={t("common.webhooks")} cta={!isReadOnly ? renderAddWebhookButton() : <></>} />
-      <WebhookTable
-        environment={environment}
-        webhooks={webhooks}
-        surveys={surveys}
-        isReadOnly={isReadOnly}
-        allowInternalUrls={DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS}>
+      <WebhookTable environment={environment} webhooks={webhooks} surveys={surveys} isReadOnly={isReadOnly}>
         <WebhookTableHeading />
         {webhooks.map((webhook) => (
           <WebhookRowData key={webhook.id} webhook={webhook} surveys={surveys} />

apps/web/package.json

@@ -42,7 +42,6 @@
     "@lexical/react": "0.41.0",
     "@lexical/rich-text": "0.41.0",
     "@lexical/table": "0.41.0",
-    "@next-auth/prisma-adapter": "1.0.7",
     "@opentelemetry/auto-instrumentations-node": "0.71.0",
     "@opentelemetry/exporter-metrics-otlp-http": "0.213.0",
     "@opentelemetry/exporter-prometheus": "0.213.0",
@@ -100,7 +99,7 @@
     "next-auth": "4.24.13",
     "next-safe-action": "8.1.8",
     "node-fetch": "3.3.2",
-    "nodemailer": "8.0.4",
+    "nodemailer": "8.0.2",
     "otplib": "12.0.1",
     "papaparse": "5.5.3",
     "posthog-js": "1.360.0",

apps/web/playwright/api/auth/security.spec.ts

@@ -485,55 +485,5 @@ test.describe("Authentication Security Tests - Vulnerability Prevention", () =>
 
       logger.info(`✅ Malformed request handled gracefully: status ${response.status()}`);
     });
-
-    test("should invalidate a copied session cookie after logout", async ({ page, browser, users }) => {
-      const user = await users.create();
-      await user.login();
-
-      const sessionCookie = (await page.context().cookies()).find((cookie) =>
-        cookie.name.includes("next-auth.session-token")
-      );
-
-      expect(sessionCookie).toBeDefined();
-
-      const preLogoutContext = await browser.newContext();
-      try {
-        await preLogoutContext.addCookies([sessionCookie!]);
-        const preLogoutPage = await preLogoutContext.newPage();
-        await preLogoutPage.goto("http://localhost:3000/environments");
-        await expect(preLogoutPage).not.toHaveURL(/\/auth\/login/);
-      } finally {
-        await preLogoutContext.close();
-      }
-
-      const signOutCsrfToken = await page
-        .context()
-        .request.get("/api/auth/csrf")
-        .then((response) => response.json())
-        .then((json) => json.csrfToken);
-
-      const signOutResponse = await page.context().request.post("/api/auth/signout", {
-        form: {
-          callbackUrl: "/auth/login",
-          csrfToken: signOutCsrfToken,
-          json: "true",
-        },
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-        },
-      });
-
-      expect(signOutResponse.status()).not.toBe(500);
-
-      const replayContext = await browser.newContext();
-      try {
-        await replayContext.addCookies([sessionCookie!]);
-        const replayPage = await replayContext.newPage();
-        await replayPage.goto("http://localhost:3000/environments");
-        await expect(replayPage).toHaveURL(/\/auth\/login/);
-      } finally {
-        await replayContext.close();
-      }
-    });
   });
 });

apps/web/proxy.test.ts

@@ -1,85 +0,0 @@
-import { NextRequest } from "next/server";
-import { beforeEach, describe, expect, test, vi } from "vitest";
-import { proxy } from "./proxy";
-
-const { mockGetProxySession, mockIsPublicDomainConfigured, mockIsRequestFromPublicDomain } = vi.hoisted(
-  () => ({
-    mockGetProxySession: vi.fn(),
-    mockIsPublicDomainConfigured: vi.fn(),
-    mockIsRequestFromPublicDomain: vi.fn(),
-  })
-);
-
-vi.mock("@/modules/auth/lib/proxy-session", () => ({
-  getProxySession: mockGetProxySession,
-}));
-
-vi.mock("@/app/middleware/domain-utils", () => ({
-  isPublicDomainConfigured: mockIsPublicDomainConfigured,
-  isRequestFromPublicDomain: mockIsRequestFromPublicDomain,
-}));
-
-vi.mock("@/app/middleware/endpoint-validator", () => ({
-  isAuthProtectedRoute: (url: string) => url.startsWith("/environments"),
-  isRouteAllowedForDomain: vi.fn(() => true),
-}));
-
-vi.mock("@/lib/constants", () => ({
-  WEBAPP_URL: "http://localhost:3000",
-}));
-
-vi.mock("@/lib/utils/url", () => ({
-  isValidCallbackUrl: (url: string) => url.startsWith("http://localhost:3000"),
-}));
-
-vi.mock("@formbricks/logger", () => ({
-  logger: {
-    error: vi.fn(),
-  },
-}));
-
-describe("proxy", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockIsPublicDomainConfigured.mockReturnValue(false);
-    mockIsRequestFromPublicDomain.mockReturnValue(false);
-  });
-
-  test("redirects unauthenticated protected routes to login with callbackUrl", async () => {
-    mockGetProxySession.mockResolvedValue(null);
-
-    const response = await proxy(new NextRequest("http://localhost:3000/environments/test"));
-
-    expect(response.status).toBe(307);
-    expect(response.headers.get("location")).toBe(
-      "http://localhost:3000/auth/login?callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fenvironments%2Ftest"
-    );
-  });
-
-  test("rejects invalid callback URLs", async () => {
-    mockGetProxySession.mockResolvedValue(null);
-
-    const response = await proxy(
-      new NextRequest("http://localhost:3000/auth/login?callbackUrl=https%3A%2F%2Fevil.example")
-    );
-
-    expect(response.status).toBe(400);
-    await expect(response.json()).resolves.toEqual({ error: "Invalid callback URL" });
-  });
-
-  test("redirects authenticated callback requests to the callback URL", async () => {
-    mockGetProxySession.mockResolvedValue({
-      userId: "user-1",
-      expires: new Date(Date.now() + 60_000),
-    });
-
-    const response = await proxy(
-      new NextRequest(
-        "http://localhost:3000/auth/login?callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fenvironments%2Ftest"
-      )
-    );
-
-    expect(response.status).toBe(307);
-    expect(response.headers.get("location")).toBe("http://localhost:3000/environments/test");
-  });
-});

apps/web/proxy.ts

@@ -1,3 +1,4 @@
+import { getToken } from "next-auth/jwt";
 import { NextRequest, NextResponse } from "next/server";
 import { v4 as uuidv4 } from "uuid";
 import { logger } from "@formbricks/logger";
@@ -5,12 +6,11 @@ import { isPublicDomainConfigured, isRequestFromPublicDomain } from "@/app/middl
 import { isAuthProtectedRoute, isRouteAllowedForDomain } from "@/app/middleware/endpoint-validator";
 import { WEBAPP_URL } from "@/lib/constants";
 import { isValidCallbackUrl } from "@/lib/utils/url";
-import { getProxySession } from "@/modules/auth/lib/proxy-session";
 
 const handleAuth = async (request: NextRequest): Promise<Response | null> => {
-  const session = await getProxySession(request);
+  const token = await getToken({ req: request as any });
 
-  if (isAuthProtectedRoute(request.nextUrl.pathname) && !session) {
+  if (isAuthProtectedRoute(request.nextUrl.pathname) && !token) {
     const loginUrl = `${WEBAPP_URL}/auth/login?callbackUrl=${encodeURIComponent(WEBAPP_URL + request.nextUrl.pathname + request.nextUrl.search)}`;
     return NextResponse.redirect(loginUrl);
   }
@@ -21,7 +21,7 @@ const handleAuth = async (request: NextRequest): Promise<Response | null> => {
     return NextResponse.json({ error: "Invalid callback URL" }, { status: 400 });
   }
 
-  if (session && callbackUrl) {
+  if (token && callbackUrl) {
     return NextResponse.redirect(callbackUrl);
   }
 

apps/web/vite.config.mts

@@ -15,7 +15,7 @@ export default defineConfig({
       provider: "v8", // Use V8 as the coverage provider
       reporter: ["text", "html", "lcov"], // Generate text summary and HTML reports
       reportsDirectory: "./coverage", // Output coverage reports to the coverage/ directory
-      include: ["app/**/*.ts", "modules/**/*.ts", "lib/**/*.ts", "lingodotdev/**/*.ts", "proxy.ts"],
+      include: ["app/**/*.ts", "modules/**/*.ts", "lib/**/*.ts", "lingodotdev/**/*.ts"],
       exclude: [
         // Build and configuration files
         "**/.next/**", // Next.js build output

docs/self-hosting/configuration/environment-variables.mdx

@@ -32,7 +32,6 @@ These variables are present inside your machine's docker-compose file. Restart t
 | PASSWORD_RESET_DISABLED      | Disables password reset functionality if set to 1.                                                                   | optional                                                |                                                                           |
 | EMAIL_VERIFICATION_DISABLED  | Disables email verification if set to 1.                                                                             | optional                                                |                                                                           |
 | RATE_LIMITING_DISABLED       | Disables rate limiting if set to 1.                                                                                  | optional                                                |                                                                           |
-| DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS | Allows webhook URLs to point to internal/private network addresses (e.g. localhost, 192.168.x.x) if set to 1. Useful for self-hosted instances that need to send webhooks to internal services. | optional                                                |                                                                           |
 | INVITE_DISABLED              | Disables the ability for invited users to create an account if set to 1.                                             | optional                                                |                                                                           |
 | MAIL_FROM                    | Email address to send emails from.                                                                                   | optional (required if email services are to be enabled) |                                                                           |
 | MAIL_FROM_NAME               | Email name/title to send emails from.                                                                                | optional (required if email services are to be enabled) |                                                                           |

docs/xm-and-surveys/core-features/integrations/webhooks.mdx

@@ -70,18 +70,6 @@ endpoint with [ngrok](https://ngrok.com/docs/universal-gateway/http).
   workflow while validating the webhook setup.
 </Note>
 
-### Allowing Internal URLs (Self-Hosted Only)
-
-By default, Formbricks blocks webhook URLs that point to private or internal IP addresses (e.g. `localhost`, `192.168.x.x`, `10.x.x.x`) to prevent [SSRF attacks](https://owasp.org/www-community/attacks/Server-Side_Request_Forgery). If you are self-hosting Formbricks and need to send webhooks to internal services, you can set the following environment variable:
-
-```sh
-DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS=1
-```
-
-<Warning>
-  Only enable this on trusted, self-hosted environments. Enabling this on a publicly accessible instance exposes your server to SSRF risks.
-</Warning>
-
 If you encounter any issues or need help setting up webhooks, feel free to reach out to us on [GitHub Discussions](https://github.com/formbricks/formbricks/discussions). 😃
 
 ---

package.json

@@ -91,26 +91,18 @@
       "flatted": "3.4.2",
       "hono": "4.12.7",
       "@microsoft/api-extractor>minimatch": "10.2.4",
-      "minimatch@3.1.5": "file:vendor/minimatch-3.1.5",
-      "node-forge": "1.4.0",
-      "brace-expansion@5.0.4": "5.0.5",
-      "minimatch@3.1.5>brace-expansion": "5.0.5",
-      "minimatch@9.0.9": "10.2.4",
-      "lodash": "4.17.23",
-      "picomatch@2.3.1": "2.3.2",
-      "picomatch@4.0.3": "4.0.4",
+      "node-forge": ">=1.3.2",
       "qs": "6.14.2",
       "rollup": "4.59.0",
       "socket.io-parser": "4.2.6",
       "tar": ">=7.5.11",
       "typeorm": ">=0.3.26",
       "undici": "7.24.0",
-      "yaml": "2.8.3",
       "fast-xml-parser": "5.5.7",
       "diff": ">=8.0.3"
     },
     "comments": {
-      "overrides": "Security fixes for transitive dependencies. Remove when upstream packages update: @hono/node-server/hono (Dependabot #313/#316/#317) - awaiting Prisma update | @tootallnate/once (Dependabot #305) - awaiting sqlite3/node-gyp chain update | schema-utils@3>ajv (Dependabot #287) - awaiting eslint/file-loader schema-utils update | axios (CVE-2025-58754, CVE-2026-25639) - awaiting @boxyhq/saml-jackson update | effect (Dependabot #339) - awaiting Prisma update | flatted (Dependabot #324/#338) - awaiting eslint/flat-cache update | minimatch (Dependabot #288/#294/#297) - awaiting react-email/glob update | node-forge (Dependabot #347/#348/#349/#350) - awaiting @boxyhq/saml-jackson update | brace-expansion (Dependabot #346 / npm audit) - awaiting upstream adoption of safe minimatch/brace-expansion combos in transitive tooling and @boxyhq/saml-jackson | lodash (npm audit) - awaiting @boxyhq/saml-jackson update | picomatch (Dependabot #342/#343) - awaiting Vite/Vitest/lint-staged patch adoption | qs (Dependabot #277) - awaiting googleapis/googleapis-common update | rollup (Dependabot #291) - awaiting Vite patch adoption | socket.io-parser (Dependabot #334) - awaiting react-email/socket.io update | tar (CVE-2026-23745/23950/24842/26960) - awaiting @boxyhq/saml-jackson/sqlite3 dependency updates | typeorm (Dependabot #223) - awaiting @boxyhq/saml-jackson update | undici (Dependabot #319/#322/#323) - awaiting jsdom/vitest/isomorphic-dompurify updates | yaml (Dependabot #344) - awaiting Vite/lint-staged patch adoption | fast-xml-parser (CVE-2026-25896/26278/33036/33349) - awaiting exact upstream pin updates | diff (Dependabot #269) - awaiting upstream patch range adoption"
+      "overrides": "Security fixes for transitive dependencies. Remove when upstream packages update: @hono/node-server/hono (Dependabot #313/#316/#317) - awaiting Prisma update | @tootallnate/once (Dependabot #305) - awaiting sqlite3/node-gyp chain update | schema-utils@3>ajv (Dependabot #287) - awaiting eslint/file-loader schema-utils update | axios (CVE-2025-58754, CVE-2026-25639) - awaiting @boxyhq/saml-jackson update | effect (Dependabot #339) - awaiting Prisma update | flatted (Dependabot #324/#338) - awaiting eslint/flat-cache update | minimatch (Dependabot #288/#294/#297) - awaiting react-email/glob update | node-forge (Dependabot #230) - awaiting @boxyhq/saml-jackson update | qs (Dependabot #277) - awaiting googleapis/googleapis-common update | rollup (Dependabot #291) - awaiting Vite patch adoption | socket.io-parser (Dependabot #334) - awaiting react-email/socket.io update | tar (CVE-2026-23745/23950/24842/26960) - awaiting @boxyhq/saml-jackson/sqlite3 dependency updates | typeorm (Dependabot #223) - awaiting @boxyhq/saml-jackson update | undici (Dependabot #319/#322/#323) - awaiting jsdom/vitest/isomorphic-dompurify updates | fast-xml-parser (CVE-2026-25896/26278/33036/33349) - awaiting exact upstream pin updates | diff (Dependabot #269) - awaiting upstream patch range adoption"
     },
     "patchedDependencies": {
       "next-auth@4.24.13": "patches/next-auth@4.24.13.patch"

packages/database/migration/20260325090000_add_auth_sessions/migration.sql

@@ -1,30 +0,0 @@
--- CreateTable
-CREATE TABLE "Session" (
-    "id" TEXT NOT NULL,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-    "sessionToken" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
-    "expires" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "Session_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "VerificationToken" (
-    "identifier" TEXT NOT NULL,
-    "token" TEXT NOT NULL,
-    "expires" TIMESTAMP(3) NOT NULL
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "Session_sessionToken_key" ON "Session"("sessionToken");
-
--- CreateIndex
-CREATE INDEX "Session_userId_idx" ON "Session"("userId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "VerificationToken_identifier_token_key" ON "VerificationToken"("identifier", "token");
-
--- AddForeignKey
-ALTER TABLE "Session" ADD CONSTRAINT "Session_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

packages/database/schema.prisma

@@ -853,32 +853,6 @@ model Account {
   @@index([userId])
 }
 
-/// Stores active authentication sessions for revocable server-side login state.
-///
-/// @property sessionToken - Opaque token stored in the browser cookie
-/// @property user - The Formbricks user who owns this session
-/// @property expires - Hard expiry for the session
-model Session {
-  id           String   @id @default(cuid())
-  createdAt    DateTime @default(now()) @map(name: "created_at")
-  updatedAt    DateTime @updatedAt @map(name: "updated_at")
-  sessionToken String   @unique
-  user         User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-  userId       String
-  expires      DateTime
-
-  @@index([userId])
-}
-
-/// Stores one-time verification tokens used by Auth.js adapter flows.
-model VerificationToken {
-  identifier String
-  token      String
-  expires    DateTime
-
-  @@unique([identifier, token])
-}
-
 /// Represents a user in the Formbricks system.
 /// Central model for user authentication and profile management.
 ///
@@ -904,7 +878,6 @@ model User {
   identityProviderAccountId String?
   memberships               Membership[]
   accounts                  Account[]
-  sessions                  Session[]
   groupId                   String?
   invitesCreated            Invite[]         @relation("inviteCreatedBy")
   invitesAccepted           Invite[]         @relation("inviteAcceptedBy")

packages/surveys/locales/et.json

@@ -1,85 +0,0 @@
-{
-  "common": {
-    "and": "ja",
-    "apply": "rakenda",
-    "auto_close_wrapper": "Automaatse sulgemise ümbris",
-    "back": "Tagasi",
-    "close_survey": "Sulge küsitlus",
-    "company_logo": "Ettevõtte logo",
-    "finish": "Lõpeta",
-    "language_switch": "Keele vahetamine",
-    "next": "Edasi",
-    "no_results_found": "Tulemusi ei leitud",
-    "open_in_new_tab": "Ava uuel vahelehel",
-    "people_responded": "{count, plural, one {1 inimene vastas} other {{count} inimest vastas}}",
-    "please_retry_now_or_try_again_later": "Palun proovi uuesti kohe või hiljem.",
-    "powered_by": "Teenust pakub",
-    "privacy_policy": "Privaatsuspoliitika",
-    "protected_by_reCAPTCHA_and_the_Google": "Kaitstud reCAPTCHA ja Google'i poolt",
-    "question": "Küsimus",
-    "question_video": "Küsimuse video",
-    "required": "Kohustuslik",
-    "respondents_will_not_see_this_card": "Vastajad ei näe seda kaarti",
-    "retry": "Proovi uuesti",
-    "retrying": "Proovin uuesti…",
-    "search": "Otsi...",
-    "select_option": "Vali variant",
-    "select_options": "Vali variandid",
-    "sending_responses": "Vastuste saatmine…",
-    "takes_less_than_x_minutes": "{count, plural, one {Võtab vähem kui 1 minuti} other {Võtab vähem kui {count} minutit}}",
-    "takes_x_minutes": "{count, plural, one {Võtab 1 minuti} other {Võtab {count} minutit}}",
-    "takes_x_plus_minutes": "Võtab {count}+ minutit",
-    "terms_of_service": "Teenusetingimused",
-    "the_servers_cannot_be_reached_at_the_moment": "Serveritega ei saa hetkel ühendust.",
-    "they_will_be_redirected_immediately": "Nad suunatakse kohe ümber",
-    "your_feedback_is_stuck": "Sinu tagasiside on kinni jäänud :("
-  },
-  "errors": {
-    "all_options_must_be_ranked": "Palun järjesta kõik variandid",
-    "all_rows_must_be_answered": "Palun vasta kõikidele ridadele",
-    "file_extension_must_be": "Faililaiend peab olema {extension}",
-    "file_extension_must_not_be": "Faililaiend ei tohi olla {extension}",
-    "file_input": {
-      "duplicate_files": "Järgmised failid on juba üles laaditud: {duplicateNames}. Duplikaatfailid ei ole lubatud.",
-      "file_size_exceeded": "Järgmised failid ületavad maksimaalse suuruse {maxSizeInMB} MB ja eemaldati: {fileNames}",
-      "file_size_exceeded_alert": "Fail peab olema väiksem kui {maxSizeInMB} MB",
-      "no_valid_file_types_selected": "Ühtegi kehtivat failitüüpi pole valitud. Palun vali kehtiv failitüüp.",
-      "only_one_file_can_be_uploaded_at_a_time": "Korraga saab üles laadida ainult ühe faili.",
-      "placeholder_text": "Klõpsa või lohista failide üleslaadimiseks",
-      "upload_failed": "Üleslaadimine ebaõnnestus! Palun proovi uuesti.",
-      "uploading": "Üleslaadimine...",
-      "you_can_only_upload_a_maximum_of_files": "Saad üles laadida maksimaalselt {FILE_LIMIT} faili."
-    },
-    "invalid_device_error": {
-      "message": "Palun keela küsitluse seadetes rämpsposti kaitse, et jätkata selle seadmega.",
-      "title": "See seade ei toeta rämpsposti kaitset."
-    },
-    "invalid_format": "Palun sisesta kehtiv vorming",
-    "is_between": "Palun vali kuupäev vahemikus {startDate} kuni {endDate}",
-    "is_earlier_than": "Palun vali kuupäev enne {date}",
-    "is_greater_than": "Palun sisesta väärtus, mis on suurem kui {min}",
-    "is_later_than": "Palun vali kuupäev pärast {date}",
-    "is_less_than": "Palun sisesta väärtus, mis on väiksem kui {max}",
-    "is_not_between": "Palun vali kuupäev, mis ei jää vahemikku {startDate} kuni {endDate}",
-    "max_length": "Palun sisesta mitte rohkem kui {max} tähemärki",
-    "max_selections": "Palun vali mitte rohkem kui {max} varianti",
-    "max_value": "Palun sisesta väärtus, mis ei ole suurem kui {max}",
-    "min_length": "Palun sisesta vähemalt {min} tähemärki",
-    "min_selections": "Palun vali vähemalt {min} varianti",
-    "min_value": "Palun sisesta väärtus vähemalt {min}",
-    "minimum_options_ranked": "Palun järjesta vähemalt {min} varianti",
-    "minimum_rows_answered": "Palun vasta vähemalt {min} reale",
-    "please_enter_a_valid_email_address": "Palun sisesta kehtiv e-posti aadress",
-    "please_enter_a_valid_phone_number": "Palun sisesta kehtiv telefoninumber",
-    "please_enter_a_valid_url": "Palun sisesta kehtiv URL",
-    "please_fill_out_this_field": "Palun täida see väli",
-    "recaptcha_error": {
-      "message": "Sinu vastust ei saanud esitada, kuna see märgiti automatiseeritud tegevuseks. Kui sa hingad, palun proovi uuesti.",
-      "title": "Me ei suutnud kinnitada, et sa oled inimene."
-    },
-    "value_must_contain": "Väärtus peab sisaldama {value}",
-    "value_must_equal": "Väärtus peab võrduma {value}",
-    "value_must_not_contain": "Väärtus ei tohi sisaldada {value}",
-    "value_must_not_equal": "Väärtus ei tohi võrduda {value}"
-  }
-}

packages/surveys/src/lib/i18n.config.ts

@@ -6,7 +6,6 @@ import daTranslations from "../../locales/da.json";
 import deTranslations from "../../locales/de.json";
 import enTranslations from "../../locales/en.json";
 import esTranslations from "../../locales/es.json";
-import etTranslations from "../../locales/et.json";
 import frTranslations from "../../locales/fr.json";
 import hiTranslations from "../../locales/hi.json";
 import huTranslations from "../../locales/hu.json";
@@ -31,7 +30,6 @@ i18n
       "de",
       "en",
       "es",
-      "et",
       "fr",
       "hi",
       "hu",
@@ -52,7 +50,6 @@ i18n
       de: { translation: deTranslations },
       en: { translation: enTranslations },
       es: { translation: esTranslations },
-      et: { translation: etTranslations },
       fr: { translation: frTranslations },
       hi: { translation: hiTranslations },
       hu: { translation: huTranslations },

packages/types/next-auth.d.ts

@@ -1,13 +1,11 @@
-import NextAuth, { type DefaultSession } from "next-auth";
+import NextAuth from "next-auth";
+import { type TUser } from "./user";
 
 declare module "next-auth" {
   /**
    * Returned by `useSession`, `getSession` and received as a prop on the `SessionProvider` React Context
    */
   interface Session {
-    user: DefaultSession["user"] & {
-      id: string;
-      isActive?: boolean;
-    };
+    user: { id: string };
   }
 }

patches/next-auth@4.24.13.patch

@@ -1,30 +1,8 @@
-diff --git a/core/lib/assert.js b/core/lib/assert.js
---- a/core/lib/assert.js
-+++ b/core/lib/assert.js
-@@ -52,12 +52,6 @@
-     if (provider.type === "credentials") hasCredentials = true;else if (provider.type === "email") hasEmail = true;else if (provider.id === "twitter" && provider.version === "2.0") hasTwitterOAuth2 = true;
-   }
-   if (hasCredentials) {
--    var _options$session;
--    const dbStrategy = ((_options$session = options.session) === null || _options$session === void 0 ? void 0 : _options$session.strategy) === "database";
--    const onlyCredentials = !options.providers.some(p => p.type !== "credentials");
--    if (dbStrategy && onlyCredentials) {
--      return new _errors.UnsupportedStrategy("Signin in with credentials only supported if JWT strategy is enabled");
--    }
-     const credentialsNoAuthorize = options.providers.some(p => p.type === "credentials" && !p.authorize);
-     if (credentialsNoAuthorize) {
-       return new _errors.MissingAuthorize("Must define an authorize() handler to use credentials authentication provider");
-@@ -80,4 +74,4 @@
-     warned = true;
-   }
-   return warnings;
--}
-\ No newline at end of file
-+}
 diff --git a/core/lib/oauth/client.js b/core/lib/oauth/client.js
+index 52c51eb6ff422dc0899ccec31baf3fa39e42eeae..472772cfefc2c2947536d6a22b022c2f9c27c61f 100644
 --- a/core/lib/oauth/client.js
 +++ b/core/lib/oauth/client.js
-@@ -5,9 +5,73 @@
+@@ -5,9 +5,73 @@ Object.defineProperty(exports, "__esModule", {
  });
  exports.openidClient = openidClient;
  var _openidClient = require("openid-client");
@@ -99,199 +77,3 @@ diff --git a/core/lib/oauth/client.js b/core/lib/oauth/client.js
    let issuer;
    if (provider.wellKnown) {
      issuer = await _openidClient.Issuer.discover(provider.wellKnown);
-diff --git a/core/routes/callback.js b/core/routes/callback.js
---- a/core/routes/callback.js
-+++ b/core/routes/callback.js
-@@ -377,29 +377,48 @@
-         cookies
-       };
-     }
--    const defaultToken = {
--      name: user.name,
--      email: user.email,
--      picture: user.image,
--      sub: (_user$id3 = user.id) === null || _user$id3 === void 0 ? void 0 : _user$id3.toString()
--    };
--    const token = await callbacks.jwt({
--      token: defaultToken,
--      user,
--      account,
--      isNewUser: false,
--      trigger: "signIn"
--    });
--    const newToken = await jwt.encode({
--      ...jwt,
--      token
--    });
--    const cookieExpires = new Date();
--    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
--    const sessionCookies = sessionStore.chunk(newToken, {
--      expires: cookieExpires
--    });
--    cookies.push(...sessionCookies);
-+    if (useJwtSession) {
-+      const defaultToken = {
-+        name: user.name,
-+        email: user.email,
-+        picture: user.image,
-+        sub: (_user$id3 = user.id) === null || _user$id3 === void 0 ? void 0 : _user$id3.toString()
-+      };
-+      const token = await callbacks.jwt({
-+        token: defaultToken,
-+        user,
-+        account,
-+        isNewUser: false,
-+        trigger: "signIn"
-+      });
-+      const newToken = await jwt.encode({
-+        ...jwt,
-+        token
-+      });
-+      const cookieExpires = new Date();
-+      cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000);
-+      const sessionCookies = sessionStore.chunk(newToken, {
-+        expires: cookieExpires
-+      });
-+      cookies.push(...sessionCookies);
-+    } else {
-+      if (!adapter) {
-+        throw new Error("Missing adapter");
-+      }
-+      const session = await adapter.createSession({
-+        sessionToken: await options.session.generateSessionToken(),
-+        userId: user.id,
-+        expires: (0, _utils.fromDate)(options.session.maxAge)
-+      });
-+      cookies.push({
-+        name: options.cookies.sessionToken.name,
-+        value: session.sessionToken,
-+        options: {
-+          ...options.cookies.sessionToken.options,
-+          expires: session.expires
-+        }
-+      });
-+    }
-     await ((_events$signIn3 = events.signIn) === null || _events$signIn3 === void 0 ? void 0 : _events$signIn3.call(events, {
-       user,
-       account
-@@ -414,4 +433,4 @@
-     body: `Error: Callback for provider type ${provider.type} not supported`,
-     cookies
-   };
--}
-\ No newline at end of file
-+}
-diff --git a/src/core/lib/assert.ts b/src/core/lib/assert.ts
---- a/src/core/lib/assert.ts
-+++ b/src/core/lib/assert.ts
-@@ -101,16 +101,6 @@
-   }
- 
-   if (hasCredentials) {
--    const dbStrategy = options.session?.strategy === "database"
--    const onlyCredentials = !options.providers.some(
--      (p) => p.type !== "credentials"
--    )
--    if (dbStrategy && onlyCredentials) {
--      return new UnsupportedStrategy(
--        "Signin in with credentials only supported if JWT strategy is enabled"
--      )
--    }
--
-     const credentialsNoAuthorize = options.providers.some(
-       (p) => p.type === "credentials" && !p.authorize
-     )
-diff --git a/src/core/routes/callback.ts b/src/core/routes/callback.ts
---- a/src/core/routes/callback.ts
-+++ b/src/core/routes/callback.ts
-@@ -1,6 +1,6 @@
- import oAuthCallback from "../lib/oauth/callback"
- import callbackHandler from "../lib/callback-handler"
--import { hashToken } from "../lib/utils"
-+import { fromDate, hashToken } from "../lib/utils"
- import getAdapterUserFromEmail from "../lib/email/getUserFromEmail"
- 
- import type { InternalOptions } from "../types"
-@@ -385,37 +385,58 @@
-         )}`,
-         cookies,
-       }
--    }
--
--    const defaultToken = {
--      name: user.name,
--      email: user.email,
--      picture: user.image,
--      sub: user.id?.toString(),
-     }
- 
--    const token = await callbacks.jwt({
--      token: defaultToken,
--      user,
--      // @ts-expect-error
--      account,
--      isNewUser: false,
--      trigger: "signIn",
--    })
-+    if (useJwtSession) {
-+      const defaultToken = {
-+        name: user.name,
-+        email: user.email,
-+        picture: user.image,
-+        sub: user.id?.toString(),
-+      }
- 
--    // Encode token
--    const newToken = await jwt.encode({ ...jwt, token })
-+      const token = await callbacks.jwt({
-+        token: defaultToken,
-+        user,
-+        // @ts-expect-error
-+        account,
-+        isNewUser: false,
-+        trigger: "signIn",
-+      })
- 
--    // Set cookie expiry date
--    const cookieExpires = new Date()
--    cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)
-+      // Encode token
-+      const newToken = await jwt.encode({ ...jwt, token })
- 
--    const sessionCookies = sessionStore.chunk(newToken, {
--      expires: cookieExpires,
--    })
-+      // Set cookie expiry date
-+      const cookieExpires = new Date()
-+      cookieExpires.setTime(cookieExpires.getTime() + sessionMaxAge * 1000)
- 
--    cookies.push(...sessionCookies)
-+      const sessionCookies = sessionStore.chunk(newToken, {
-+        expires: cookieExpires,
-+      })
- 
-+      cookies.push(...sessionCookies)
-+    } else {
-+      if (!adapter) {
-+        throw new Error("Missing adapter")
-+      }
-+
-+      const session = await adapter.createSession({
-+        sessionToken: await options.session.generateSessionToken(),
-+        userId: user.id,
-+        expires: fromDate(options.session.maxAge),
-+      })
-+
-+      cookies.push({
-+        name: options.cookies.sessionToken.name,
-+        value: (session as AdapterSession).sessionToken,
-+        options: {
-+          ...options.cookies.sessionToken.options,
-+          expires: (session as AdapterSession).expires,
-+        },
-+      })
-+    }
-+
-     // @ts-expect-error
-     await events.signIn?.({ user, account })
- 

turbo.json

@@ -141,7 +141,6 @@
         "BREVO_API_KEY",
         "BREVO_LIST_ID",
         "CRON_SECRET",
-        "DANGEROUSLY_ALLOW_WEBHOOK_INTERNAL_URLS",
         "DATABASE_URL",
         "DEBUG",
         "E2E_TESTING",

vendor/minimatch-3.1.5/LICENSE

@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

vendor/minimatch-3.1.5/package.json

@@ -1,33 +0,0 @@
-{
-  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
-  "name": "minimatch",
-  "description": "a glob matcher in javascript",
-  "version": "3.1.5",
-  "publishConfig": {
-    "tag": "legacy-v3"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git://github.com/isaacs/minimatch.git"
-  },
-  "main": "minimatch.js",
-  "scripts": {
-    "test": "tap",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "postpublish": "git push origin --all; git push origin --tags"
-  },
-  "engines": {
-    "node": "*"
-  },
-  "dependencies": {
-    "brace-expansion": "^1.1.7"
-  },
-  "devDependencies": {
-    "tap": "^15.1.6"
-  },
-  "license": "ISC",
-  "files": [
-    "minimatch.js"
-  ]
-}