From e521658ab7d1e89e860016e451a1e630800506b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Mon, 23 Feb 2026 11:30:55 +0100
Subject: [PATCH 01/13] fix capitalization

---
 web/messages/en/edge.json              | 19 ++++++++++---------
 web/src/pages/EdgesPage/EdgesTable.tsx |  2 +-
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/web/messages/en/edge.json b/web/messages/en/edge.json
index 9eb606ef6..39d05a93f 100644
--- a/web/messages/en/edge.json
+++ b/web/messages/en/edge.json
@@ -1,15 +1,15 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
-  "edge_title": "Edge components",
-  "edge_edit_title": "Edit edge component",
+  "edge_title": "Edge Components",
+  "edge_edit_title": "Edit Edge Component",
   "edge_edit_general_info": "General information",
   "edge_edit_name": "Name",
   "edge_edit_address": "IP or Domain",
   "edge_edit_port": "gRPC port",
   "edge_edit_public_address": "Public domain",
   "edge_edit_delete": "Delete",
-  "edge_edit_success": "Edge component updated",
-  "edge_edit_failed": "Failed to update edge component",
+  "edge_edit_success": "Edge Component updated",
+  "edge_edit_failed": "Failed to update Edge Component",
   "edges_header_title": "All components",
   "edges_col_name": "Name",
   "edges_col_address": "Address",
@@ -19,11 +19,12 @@
   "edges_col_modified_by": "Modified by",
   "edges_col_status": "Status",
   "edges_row_menu_edit": "Edit",
-  "edges_empty_title": "No edge components added yet.",
-  "edges_empty_subtitle": "Add edge components by clicking the button below.",
+  "edges_empty_title": "No Edge Components added yet.",
+  "edges_empty_subtitle": "Add Edge Components by clicking the button below.",
   "edges_search_placeholder": "Search",
-  "edge_delete_success": "Edge component deleted",
-  "edge_delete_failed": "Failed to delete edge component",
+  "edge_delete_success": "Edge Component deleted",
+  "edge_delete_failed": "Failed to delete Edge Component",
   "edge_connected": "Connected",
-  "edge_disconnected": "Disconnected"
+  "edge_disconnected": "Disconnected",
+  "edge_add": "Add Edge Component"
 }
diff --git a/web/src/pages/EdgesPage/EdgesTable.tsx b/web/src/pages/EdgesPage/EdgesTable.tsx
index 2d9abe550..80b3d67da 100644
--- a/web/src/pages/EdgesPage/EdgesTable.tsx
+++ b/web/src/pages/EdgesPage/EdgesTable.tsx
@@ -62,7 +62,7 @@ export const EdgesTable = () => {
   const addButtonProps = useMemo(
     (): ButtonProps => ({
       variant: 'primary',
-      text: 'Add Edge component',
+      text: m.edge_add(),
       iconLeft: 'globe',
       testId: 'add-edge',
       onClick: () => {

From 5a59e84ff08d035482bc8629b21f13919ee0683d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Mon, 23 Feb 2026 12:21:54 +0100
Subject: [PATCH 02/13] handle proxy URL in general settings page

---
 web/messages/en/settings.json                 |  3 ++-
 .../SettingsInstancePage.tsx                  | 25 ++++++++++++++++---
 web/src/shared/api/types.ts                   |  7 +++++-
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index ff8c4635a..211792b89 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -9,5 +9,6 @@
   "settings_activity_log_streaming_table_title": "All log streams",
   "settings_activity_log_streaming_table_header_name": "Name",
   "settings_activity_log_streaming_table_stream_type_name": "Destination",
-  "settings_msg_saved": "Settings saved"
+  "settings_msg_saved": "Settings saved",
+  "settings_msg_save_failed": "Failed to save settings"
 }
diff --git a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
index e026c78d7..90b03a1a5 100644
--- a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
+++ b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
@@ -12,6 +12,9 @@ import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCa
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { Snackbar } from '../../../shared/defguard-ui/providers/snackbar/snackbar';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../../shared/form';
 import { formChangeLogic } from '../../../shared/formLogic';
@@ -65,6 +68,9 @@ const formSchema = z.object({
       }),
     )
     .max(64, m.form_error_max_len({ length: 64 })),
+  public_proxy_url: z
+    .url(m.initial_setup_general_config_error_public_proxy_url_invalid())
+    .min(1, m.initial_setup_general_config_error_public_proxy_url_required()),
 });
 
 type FormFields = z.infer<typeof formSchema>;
@@ -75,13 +81,20 @@ const Content = ({ settings }: { settings: Settings }) => {
     meta: {
       invalidate: ['settings'],
     },
+    onSuccess: () => {
+      Snackbar.success(m.settings_msg_saved());
+    },
+    onError: () => {
+      Snackbar.error(m.settings_msg_save_failed());
+    },
   });
 
   const defaultValues = useMemo(
     (): FormFields => ({
       instance_name: settings.instance_name ?? '',
+      public_proxy_url: settings.public_proxy_url ?? '',
     }),
-    [settings.instance_name],
+    [settings.instance_name, settings.public_proxy_url],
   );
 
   const form = useAppForm({
@@ -93,6 +106,7 @@ const Content = ({ settings }: { settings: Settings }) => {
     },
     onSubmit: async ({ value }) => {
       await mutateAsync(value);
+      form.reset(value);
     },
   });
 
@@ -108,20 +122,25 @@ const Content = ({ settings }: { settings: Settings }) => {
         <form.AppField name="instance_name">
           {(field) => <field.FormInput required label="Instance name" />}
         </form.AppField>
+        <SizedBox height={ThemeSpacing.Xl} />
+        <form.AppField name="public_proxy_url">
+          {(field) => <field.FormInput required label="Public Edge Component URL" />}
+        </form.AppField>
       </form.AppForm>
       <form.Subscribe
         selector={(s) => ({
           isDefault: s.isDefaultValue || s.isPristine,
           isSubmitting: s.isSubmitting,
+          canSubmit: s.canSubmit,
         })}
       >
-        {({ isDefault, isSubmitting }) => (
+        {({ isDefault, isSubmitting, canSubmit }) => (
           <Controls>
             <div className="right">
               <Button
                 variant="primary"
                 text={m.controls_save_changes()}
-                disabled={isDefault}
+                disabled={isDefault || !canSubmit}
                 loading={isSubmitting}
                 type="submit"
                 onClick={() => {
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 1a68b47d6..c0dac8280 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -791,6 +791,10 @@ export interface SettingsGatewayNotifications {
   gateway_disconnect_notifications_reconnect_notification_enabled: boolean;
 }
 
+export interface SettingsGeneral {
+  public_proxy_url: string;
+}
+
 export type Settings = SettingsBranding &
   SettingsGatewayNotifications &
   SettingsEnterprise &
@@ -799,7 +803,8 @@ export type Settings = SettingsBranding &
   SettingsModules &
   SettingsOpenID &
   SettingsEnrollment &
-  SettingsSMTP;
+  SettingsSMTP &
+  SettingsGeneral;
 
 export interface OpenIdProviderSettings {
   create_account: boolean;

From 3e2dec704e4fbfa78f625de12ed08deff050bbeb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 10:21:45 +0100
Subject: [PATCH 03/13] update protos

---
 proto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/proto b/proto
index faebcc544..b76289ef9 160000
--- a/proto
+++ b/proto
@@ -1 +1 @@
-Subproject commit faebcc5449ae803e15cf5faf838c0c508401caf1
+Subproject commit b76289ef976e03cdd6bbf336ebac7cc02c0011cc

From 2e34e776c7ac03275b3c80071da8877253f8d2b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 10:31:20 +0100
Subject: [PATCH 04/13] add method for generating edge callback URL

---
 .../defguard_common/src/db/models/settings.rs | 49 ++++++++++++++++++-
 crates/defguard_common/src/types/mod.rs       |  6 +++
 crates/defguard_core/src/lib.rs               |  1 +
 3 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/crates/defguard_common/src/db/models/settings.rs b/crates/defguard_common/src/db/models/settings.rs
index 8daaf158a..1ebf0037c 100644
--- a/crates/defguard_common/src/db/models/settings.rs
+++ b/crates/defguard_common/src/db/models/settings.rs
@@ -10,7 +10,7 @@ use url::Url;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
-use crate::{db::Id, global_value, secret::SecretStringWrapper};
+use crate::{db::Id, global_value, secret::SecretStringWrapper, types::AuthFlowType};
 
 global_value!(SETTINGS, Option<Settings>, None, set_settings, get_settings);
 
@@ -529,6 +529,22 @@ impl Settings {
     pub fn proxy_public_url(&self) -> Result<Url, url::ParseError> {
         Url::parse(&self.public_proxy_url)
     }
+
+    /// Returns configured Edge Component URL with the correct callback path appended depending on auth flow type.
+    pub fn edge_callback_url(
+        &self,
+        auth_flow_type: AuthFlowType,
+    ) -> Result<Url, url::ParseError> {
+        let mut url = self.proxy_public_url()?;
+        // Append callback segments to the URL.
+        if let Ok(mut path_segments) = url.path_segments_mut() {
+            match auth_flow_type {
+                AuthFlowType::Enrollment => path_segments.extend(&["openid", "callback"]),
+                AuthFlowType::Mfa => path_segments.extend(&["openid", "mfa", "callback"]),
+            };
+        }
+        Ok(url)
+    }
 }
 
 #[derive(Serialize)]
@@ -676,4 +692,35 @@ mod test {
             "https://defguard.example.com:8443/path/auth/callback"
         );
     }
+
+    #[test]
+    fn test_edge_callback_url() {
+        let mut s = Settings {
+            public_proxy_url: "https://edge.example.com".into(),
+            ..Default::default()
+        };
+
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Enrollment)
+                .unwrap()
+                .as_str(),
+            "https://edge.example.com/openid/callback"
+        );
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Mfa).unwrap().as_str(),
+            "https://edge.example.com/openid/mfa/callback"
+        );
+
+        s.public_proxy_url = "https://edge.example.com:8443/path".into();
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Enrollment)
+                .unwrap()
+                .as_str(),
+            "https://edge.example.com:8443/path/openid/callback"
+        );
+        assert_eq!(
+            s.edge_callback_url(AuthFlowType::Mfa).unwrap().as_str(),
+            "https://edge.example.com:8443/path/openid/mfa/callback"
+        );
+    }
 }
diff --git a/crates/defguard_common/src/types/mod.rs b/crates/defguard_common/src/types/mod.rs
index 04247cadd..2b5d8ad81 100644
--- a/crates/defguard_common/src/types/mod.rs
+++ b/crates/defguard_common/src/types/mod.rs
@@ -3,3 +3,9 @@ pub mod proxy;
 pub mod user_info;
 
 pub type UrlParseError = url::ParseError;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum AuthFlowType {
+    Enrollment,
+    Mfa,
+}
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index bc6ae24ca..ab7a01128 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -893,6 +893,7 @@ pub fn is_valid_phone_number(number: &str) -> bool {
     PHONE_NUMBER_REGEX.is_match(number)
 }
 
+
 #[cfg(test)]
 mod test {
 

From 80e43b728a362900b7125aed899a2802aeba6309 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 10:50:35 +0100
Subject: [PATCH 05/13] update auth info grpc handler

---
 crates/defguard_proxy_manager/src/handler.rs | 129 +++++++++++--------
 1 file changed, 74 insertions(+), 55 deletions(-)

diff --git a/crates/defguard_proxy_manager/src/handler.rs b/crates/defguard_proxy_manager/src/handler.rs
index 06b24aba0..1943303a8 100644
--- a/crates/defguard_proxy_manager/src/handler.rs
+++ b/crates/defguard_proxy_manager/src/handler.rs
@@ -12,6 +12,7 @@ use defguard_common::{
         Id,
         models::{Settings, proxy::Proxy},
     },
+    types::AuthFlowType,
 };
 use defguard_core::{
     db::models::enrollment::{ENROLLMENT_TOKEN_TYPE, Token},
@@ -34,8 +35,8 @@ use defguard_core::{
 };
 use defguard_grpc_tls::{certs as tls_certs, connector::HttpsSchemeConnector};
 use defguard_proto::proxy::{
-    AuthCallbackResponse, AuthInfoResponse, CoreError, CoreRequest, CoreResponse, InitialInfo,
-    core_request, core_response, proxy_client::ProxyClient,
+    AuthCallbackResponse, AuthFlowType as ProtoAuthFlowType, AuthInfoResponse, CoreError,
+    CoreRequest, CoreResponse, InitialInfo, core_request, core_response, proxy_client::ProxyClient,
 };
 use defguard_version::{
     ComponentInfo, DefguardComponent, client::ClientVersionInterceptor, get_tracing_variables,
@@ -624,66 +625,84 @@ impl ProxyHandler {
                                     status_code: Code::FailedPrecondition as i32,
                                     message: "no valid license".into(),
                                 }))
-                            } else if let Ok(redirect_url) = Url::parse(&request.redirect_url) {
-                                if let Some(provider) = OpenIdProvider::get_current(&pool).await? {
-                                    match make_oidc_client(redirect_url, &provider).await {
-                                        Ok((_client_id, client)) => {
-                                            let mut authorize_url_builder = client
-                                                .authorize_url(
-                                                    CoreAuthenticationFlow::AuthorizationCode,
-                                                    || build_state(request.state),
-                                                    Nonce::new_random,
-                                                )
-                                                .add_scope(Scope::new("email".to_string()))
-                                                .add_scope(Scope::new("profile".to_string()));
-
-                                            if SELECT_ACCOUNT_SUPPORTED_PROVIDERS
-                                                .iter()
-                                                .all(|p| p.eq_ignore_ascii_case(&provider.name))
-                                            {
-                                                authorize_url_builder = authorize_url_builder
-                                                .add_prompt(
-                                                openidconnect::core::CoreAuthPrompt::SelectAccount,
-                                            );
+                            } else {
+                                let redirect_url = match request.auth_flow_type() {
+                                    ProtoAuthFlowType::Enrollment => {
+                                        let settings = Settings::get_current_settings();
+                                        settings.edge_callback_url(AuthFlowType::Enrollment)
+                                    }
+                                    ProtoAuthFlowType::Mfa => {
+                                        let settings = Settings::get_current_settings();
+                                        settings.edge_callback_url(AuthFlowType::Mfa)
+                                    }
+                                    // fall back for legacy pre-2.0 clients
+                                    ProtoAuthFlowType::Unspecified =>
+                                    {
+                                        #[allow(deprecated)]
+                                        Url::parse(&request.redirect_url)
+                                    }
+                                };
+
+                                if let Ok(redirect_url) = redirect_url {
+                                    if let Some(provider) =
+                                        OpenIdProvider::get_current(&pool).await?
+                                    {
+                                        match make_oidc_client(redirect_url, &provider).await {
+                                            Ok((_client_id, client)) => {
+                                                let mut authorize_url_builder = client
+                                                    .authorize_url(
+                                                        CoreAuthenticationFlow::AuthorizationCode,
+                                                        || build_state(request.state),
+                                                        Nonce::new_random,
+                                                    )
+                                                    .add_scope(Scope::new("email".to_string()))
+                                                    .add_scope(Scope::new("profile".to_string()));
+
+                                                if SELECT_ACCOUNT_SUPPORTED_PROVIDERS
+                                                    .iter()
+                                                    .all(|p| p.eq_ignore_ascii_case(&provider.name))
+                                                {
+                                                    authorize_url_builder = authorize_url_builder
+                                                        .add_prompt(
+                                                            openidconnect::core::CoreAuthPrompt::SelectAccount,
+                                                        );
+                                                }
+                                                let (url, csrf_token, nonce) =
+                                                    authorize_url_builder.url();
+
+                                                Some(core_response::Payload::AuthInfo(
+                                                    AuthInfoResponse {
+                                                        url: url.into(),
+                                                        csrf_token: csrf_token.secret().to_owned(),
+                                                        nonce: nonce.secret().to_owned(),
+                                                        button_display_name: provider.display_name,
+                                                    },
+                                                ))
+                                            }
+                                            Err(err) => {
+                                                error!(
+                                                    "Failed to setup external OIDC provider client: {err}"
+                                                );
+                                                Some(core_response::Payload::CoreError(CoreError {
+                                                    status_code: Code::Internal as i32,
+                                                    message: "failed to build OIDC client".into(),
+                                                }))
                                             }
-                                            let (url, csrf_token, nonce) =
-                                                authorize_url_builder.url();
-
-                                            Some(core_response::Payload::AuthInfo(
-                                                AuthInfoResponse {
-                                                    url: url.into(),
-                                                    csrf_token: csrf_token.secret().to_owned(),
-                                                    nonce: nonce.secret().to_owned(),
-                                                    button_display_name: provider.display_name,
-                                                },
-                                            ))
-                                        }
-                                        Err(err) => {
-                                            error!(
-                                                "Failed to setup external OIDC provider client: {err}"
-                                            );
-                                            Some(core_response::Payload::CoreError(CoreError {
-                                                status_code: Code::Internal as i32,
-                                                message: "failed to build OIDC client".into(),
-                                            }))
                                         }
+                                    } else {
+                                        error!("Failed to get current OpenID provider");
+                                        Some(core_response::Payload::CoreError(CoreError {
+                                            status_code: Code::NotFound as i32,
+                                            message: "failed to get current OpenID provider".into(),
+                                        }))
                                     }
                                 } else {
-                                    error!("Failed to get current OpenID provider");
+                                    error!("Invalid redirect URL in authentication info request");
                                     Some(core_response::Payload::CoreError(CoreError {
-                                        status_code: Code::NotFound as i32,
-                                        message: "failed to get current OpenID provider".into(),
+                                        status_code: Code::Internal as i32,
+                                        message: "invalid redirect URL".into(),
                                     }))
                                 }
-                            } else {
-                                error!(
-                                    "Invalid redirect URL in authentication info request: {}",
-                                    request.redirect_url
-                                );
-                                Some(core_response::Payload::CoreError(CoreError {
-                                    status_code: Code::Internal as i32,
-                                    message: "invalid redirect URL".into(),
-                                }))
                             }
                         }
                         Some(core_request::Payload::AuthCallback(request)) => {

From 7c29375e138624e89ec8782654a873d4c69050fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 10:59:41 +0100
Subject: [PATCH 06/13] update desktop MFA handler

---
 .../src/enterprise/grpc/desktop_client_mfa.rs      | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs b/crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs
index e23c402c2..6b595cde4 100644
--- a/crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs
+++ b/crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs
@@ -1,6 +1,6 @@
+use defguard_common::{db::models::Settings, types::AuthFlowType};
 use defguard_proto::proxy::{ClientMfaOidcAuthenticateRequest, DeviceInfo, MfaMethod};
 use openidconnect::{AuthorizationCode, Nonce};
-use reqwest::Url;
 use tonic::Status;
 
 use crate::{
@@ -84,10 +84,12 @@ impl ClientMfaServer {
         );
 
         let code = AuthorizationCode::new(request.code.clone());
-        let url = match Url::parse(&request.callback_url).map_err(|err| {
-            error!("Invalid redirect URL provided: {err}");
-            Status::invalid_argument("invalid redirect URL")
-        }) {
+        let url = match Settings::get_current_settings()
+            .edge_callback_url(AuthFlowType::Mfa)
+            .map_err(|err| {
+                error!("Invalid callback URL configuration: {err}");
+                Status::invalid_argument("invalid callback URL")
+            }) {
             Ok(url) => url,
             Err(status) => {
                 self.sessions
@@ -101,7 +103,7 @@ impl ClientMfaServer {
                             location: location.clone(),
                             device: device.clone(),
                             method,
-                            message: "provided invalid redirect URL".to_string(),
+                            message: "provided invalid callback URL".to_string(),
                         },
                     )),
                 })?;

From c530fb9a042679b72d0f7555dda9b27675a34c59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 11:03:06 +0100
Subject: [PATCH 07/13] update auth callback handler

---
 crates/defguard_proxy_manager/src/handler.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/crates/defguard_proxy_manager/src/handler.rs b/crates/defguard_proxy_manager/src/handler.rs
index 1943303a8..f16fb182c 100644
--- a/crates/defguard_proxy_manager/src/handler.rs
+++ b/crates/defguard_proxy_manager/src/handler.rs
@@ -706,7 +706,9 @@ impl ProxyHandler {
                             }
                         }
                         Some(core_request::Payload::AuthCallback(request)) => {
-                            match Url::parse(&request.callback_url) {
+                            match Settings::get_current_settings()
+                                .edge_callback_url(AuthFlowType::Enrollment)
+                            {
                                 Ok(callback_url) => {
                                     let code = AuthorizationCode::new(request.code);
                                     match user_from_claims(
@@ -778,8 +780,7 @@ impl ProxyHandler {
                                 Err(err) => {
                                     error!(
                                         "Proxy requested an OpenID authentication info for a callback \
-                                    URL ({}) that couldn't be parsed. Details: {err}",
-                                        request.callback_url
+                                    URL that couldn't be built. Details: {err}"
                                     );
                                     Some(core_response::Payload::CoreError(CoreError {
                                         status_code: Code::Internal as i32,

From e80b18379823cabc33a99fcad9c7d6fff370b49a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:12:37 +0100
Subject: [PATCH 08/13] use a simpler conversion

---
 crates/defguard_common/src/db/models/settings.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/defguard_common/src/db/models/settings.rs b/crates/defguard_common/src/db/models/settings.rs
index 1ebf0037c..a09331c28 100644
--- a/crates/defguard_common/src/db/models/settings.rs
+++ b/crates/defguard_common/src/db/models/settings.rs
@@ -523,7 +523,7 @@ impl Settings {
 
     #[must_use]
     pub fn authentication_timeout(&self) -> Duration {
-        Duration::from_secs(self.authentication_period_days as u64 * 24 * 3600)
+        Duration::from_hours(self.authentication_period_days as u64 * 24)
     }
 
     pub fn proxy_public_url(&self) -> Result<Url, url::ParseError> {

From 1692a84bc870418ea6218f7e6f17ecf5b8e64c51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:27:38 +0100
Subject: [PATCH 09/13] add session duration to settings page

---
 .../SettingsInstancePage.tsx                  | 28 ++++++++++++++++++-
 web/src/shared/api/types.ts                   |  1 +
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
index 90b03a1a5..c9871f189 100644
--- a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
+++ b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
@@ -71,10 +71,21 @@ const formSchema = z.object({
   public_proxy_url: z
     .url(m.initial_setup_general_config_error_public_proxy_url_invalid())
     .min(1, m.initial_setup_general_config_error_public_proxy_url_required()),
+  authentication_period_days: z.number().min(1, m.form_error_invalid()),
 });
 
 type FormFields = z.infer<typeof formSchema>;
 
+const sessionDurationOptions = [
+  { key: 1, value: 1, label: '1 day' },
+  { key: 2, value: 2, label: '2 days' },
+  { key: 3, value: 3, label: '3 days' },
+  { key: 7, value: 7, label: '7 days' },
+  { key: 10, value: 10, label: '10 days' },
+  { key: 14, value: 14, label: '14 days' },
+  { key: 30, value: 30, label: '30 days' },
+];
+
 const Content = ({ settings }: { settings: Settings }) => {
   const { mutateAsync } = useMutation({
     mutationFn: api.settings.patchSettings,
@@ -93,8 +104,13 @@ const Content = ({ settings }: { settings: Settings }) => {
     (): FormFields => ({
       instance_name: settings.instance_name ?? '',
       public_proxy_url: settings.public_proxy_url ?? '',
+      authentication_period_days: settings.authentication_period_days ?? 7,
     }),
-    [settings.instance_name, settings.public_proxy_url],
+    [
+      settings.instance_name,
+      settings.public_proxy_url,
+      settings.authentication_period_days,
+    ],
   );
 
   const form = useAppForm({
@@ -126,6 +142,16 @@ const Content = ({ settings }: { settings: Settings }) => {
         <form.AppField name="public_proxy_url">
           {(field) => <field.FormInput required label="Public Edge Component URL" />}
         </form.AppField>
+        <SizedBox height={ThemeSpacing.Xl} />
+        <form.AppField name="authentication_period_days">
+          {(field) => (
+            <field.FormSelect
+              required
+              label="Session duration (days)"
+              options={sessionDurationOptions}
+            />
+          )}
+        </form.AppField>
       </form.AppForm>
       <form.Subscribe
         selector={(s) => ({
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index c0dac8280..f5a7cd541 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -793,6 +793,7 @@ export interface SettingsGatewayNotifications {
 
 export interface SettingsGeneral {
   public_proxy_url: string;
+  authentication_period_days: number;
 }
 
 export type Settings = SettingsBranding &

From f11ecce97fc5bc987876ac7faf2c769dec76defa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:29:10 +0100
Subject: [PATCH 10/13] Revert "use a simpler conversion"

This reverts commit e80b18379823cabc33a99fcad9c7d6fff370b49a.
---
 crates/defguard_common/src/db/models/settings.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/defguard_common/src/db/models/settings.rs b/crates/defguard_common/src/db/models/settings.rs
index a09331c28..1ebf0037c 100644
--- a/crates/defguard_common/src/db/models/settings.rs
+++ b/crates/defguard_common/src/db/models/settings.rs
@@ -523,7 +523,7 @@ impl Settings {
 
     #[must_use]
     pub fn authentication_timeout(&self) -> Duration {
-        Duration::from_hours(self.authentication_period_days as u64 * 24)
+        Duration::from_secs(self.authentication_period_days as u64 * 24 * 3600)
     }
 
     pub fn proxy_public_url(&self) -> Result<Url, url::ParseError> {

From 4f4292d3a9a71d7b62722dca90ddc54d2d833751 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:30:39 +0100
Subject: [PATCH 11/13] remove redundant label

---
 .../settings/SettingsInstancePage/SettingsInstancePage.tsx      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
index c9871f189..c9039e94e 100644
--- a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
+++ b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
@@ -147,7 +147,7 @@ const Content = ({ settings }: { settings: Settings }) => {
           {(field) => (
             <field.FormSelect
               required
-              label="Session duration (days)"
+              label="Session duration"
               options={sessionDurationOptions}
             />
           )}

From 01f9185c02e0ed8509489c009c018c2f8e236bb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:47:55 +0100
Subject: [PATCH 12/13] add translation

---
 web/messages/en/settings.json                 | 15 ++++++
 .../SettingsInstancePage.tsx                  | 49 +++++++++++++------
 2 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 211792b89..d7f3e95e7 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -1,5 +1,20 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
+  "settings_page_title": "Settings",
+  "settings_breadcrumb_general": "General",
+  "settings_breadcrumb_instance": "Instance settings",
+  "settings_instance_title": "Instance settings",
+  "settings_instance_subtitle": "Here you can configure general instance parameters.",
+  "settings_instance_label_name": "Instance name",
+  "settings_instance_label_public_proxy_url": "Public Edge Component URL",
+  "settings_instance_label_session_duration": "Session duration",
+  "settings_instance_session_duration_1": "1 day",
+  "settings_instance_session_duration_2": "2 days",
+  "settings_instance_session_duration_3": "3 days",
+  "settings_instance_session_duration_7": "7 days",
+  "settings_instance_session_duration_10": "10 days",
+  "settings_instance_session_duration_14": "14 days",
+  "settings_instance_session_duration_30": "30 days",
   "settings_activity_log_streaming_title": "Activity log streaming",
   "settings_activity_log_streaming_description": "Monitor and export real-time activity logs from your Defguard instance. Stream events to external systems for auditing, analytics, or security monitoring.",
   "settings_activity_log_streaming_no_upstreams": "You don't have any activity log upstreams.",
diff --git a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
index c9039e94e..be047c14b 100644
--- a/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
+++ b/web/src/pages/settings/SettingsInstancePage/SettingsInstancePage.tsx
@@ -28,23 +28,23 @@ const breadcrumbs = [
     }}
     key={0}
   >
-    General
+    {m.settings_breadcrumb_general()}
   </Link>,
   <Link to="/settings/instance" key={1}>
-    Instance settings
+    {m.settings_breadcrumb_instance()}
   </Link>,
 ];
 
 export const SettingsInstancePage = () => {
   const { data: settings } = useQuery(getSettingsQueryOptions);
   return (
-    <Page title="Settings">
+    <Page title={m.settings_page_title()}>
       <Breadcrumbs links={breadcrumbs} />
       <SettingsLayout>
         <SettingsHeader
           icon="customize"
-          title="Instance settings"
-          subtitle="Here you can configure general instance parameters."
+          title={m.settings_instance_title()}
+          subtitle={m.settings_instance_subtitle()}
         />
         {isPresent(settings) && (
           <SettingsCard>
@@ -77,13 +77,25 @@ const formSchema = z.object({
 type FormFields = z.infer<typeof formSchema>;
 
 const sessionDurationOptions = [
-  { key: 1, value: 1, label: '1 day' },
-  { key: 2, value: 2, label: '2 days' },
-  { key: 3, value: 3, label: '3 days' },
-  { key: 7, value: 7, label: '7 days' },
-  { key: 10, value: 10, label: '10 days' },
-  { key: 14, value: 14, label: '14 days' },
-  { key: 30, value: 30, label: '30 days' },
+  { key: 1, value: 1, label: m.settings_instance_session_duration_1() },
+  { key: 2, value: 2, label: m.settings_instance_session_duration_2() },
+  { key: 3, value: 3, label: m.settings_instance_session_duration_3() },
+  { key: 7, value: 7, label: m.settings_instance_session_duration_7() },
+  {
+    key: 10,
+    value: 10,
+    label: m.settings_instance_session_duration_10(),
+  },
+  {
+    key: 14,
+    value: 14,
+    label: m.settings_instance_session_duration_14(),
+  },
+  {
+    key: 30,
+    value: 30,
+    label: m.settings_instance_session_duration_30(),
+  },
 ];
 
 const Content = ({ settings }: { settings: Settings }) => {
@@ -136,18 +148,25 @@ const Content = ({ settings }: { settings: Settings }) => {
     >
       <form.AppForm>
         <form.AppField name="instance_name">
-          {(field) => <field.FormInput required label="Instance name" />}
+          {(field) => (
+            <field.FormInput required label={m.settings_instance_label_name()} />
+          )}
         </form.AppField>
         <SizedBox height={ThemeSpacing.Xl} />
         <form.AppField name="public_proxy_url">
-          {(field) => <field.FormInput required label="Public Edge Component URL" />}
+          {(field) => (
+            <field.FormInput
+              required
+              label={m.settings_instance_label_public_proxy_url()}
+            />
+          )}
         </form.AppField>
         <SizedBox height={ThemeSpacing.Xl} />
         <form.AppField name="authentication_period_days">
           {(field) => (
             <field.FormSelect
               required
-              label="Session duration"
+              label={m.settings_instance_label_session_duration()}
               options={sessionDurationOptions}
             />
           )}

From 909dcfe3442be61a28b47b915129d80546b0a7b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 24 Feb 2026 18:54:08 +0100
Subject: [PATCH 13/13] formatting

---
 crates/defguard_common/src/db/models/settings.rs | 5 +----
 crates/defguard_core/src/lib.rs                  | 1 -
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/crates/defguard_common/src/db/models/settings.rs b/crates/defguard_common/src/db/models/settings.rs
index 1ebf0037c..ad132f544 100644
--- a/crates/defguard_common/src/db/models/settings.rs
+++ b/crates/defguard_common/src/db/models/settings.rs
@@ -531,10 +531,7 @@ impl Settings {
     }
 
     /// Returns configured Edge Component URL with the correct callback path appended depending on auth flow type.
-    pub fn edge_callback_url(
-        &self,
-        auth_flow_type: AuthFlowType,
-    ) -> Result<Url, url::ParseError> {
+    pub fn edge_callback_url(&self, auth_flow_type: AuthFlowType) -> Result<Url, url::ParseError> {
         let mut url = self.proxy_public_url()?;
         // Append callback segments to the URL.
         if let Ok(mut path_segments) = url.path_segments_mut() {
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index ab7a01128..bc6ae24ca 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -893,7 +893,6 @@ pub fn is_valid_phone_number(number: &str) -> bool {
     PHONE_NUMBER_REGEX.is_match(number)
 }
 
-
 #[cfg(test)]
 mod test {