feat(pam): windows discovery base by x032205 · Pull Request #5517 · Infisical/infisical

x032205 · 2026-02-19T11:33:59Z

Context

Adds Windows Discovery with:

AD scanning for machines (resources) & AD user/service accounts

Not yet supported:

Local machine account scanning & import (WinRM)
Dependency scanning & import (WinRM)

Screenshots

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

maidul98 · 2026-02-19T11:34:43Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

gitguardian · 2026-02-20T05:36:58Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
27411356	Triggered	Generic Database Assignment	`3a65a82`	backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

greptile-apps · 2026-02-22T03:36:20Z

Greptile Summary

This PR implements Windows Discovery for PAM with Active Directory scanning capabilities. The implementation adds comprehensive backend infrastructure including database tables, DALs, services, queue handlers, and API endpoints for discovering AD machines (resources) and AD user/service accounts. The frontend includes new pages and forms for managing discovery sources and viewing discovered resources/accounts.

Key Changes:

Added 6 new database tables for discovery sources, runs, and junction tables linking discovered resources/accounts to sources
Implemented AD LDAP enumeration via gateway proxy for discovering Windows Servers and domain accounts
Service accounts are auto-detected using SPN and naming patterns (svc-, -service, -svc)
Scheduled discovery runs daily at 3:00 AM UTC, with manual trigger support
Comprehensive permission system with Read, Create, Edit, Delete, and RunScan actions
Full audit logging for all discovery operations

Issues Found:

Critical: Migration has conflicting constraint - gatewayId is notNullable() but foreign key uses onDelete("SET NULL") (line 21)
LDAP filter construction uses user-provided domainFQDN - verify validation prevents LDAP injection
No documentation found in /docs folder for this new discovery feature

Not Yet Supported (per PR description):

Local machine account scanning via WinRM
Dependency scanning via WinRM

Confidence Score: 3/5

This PR has one critical database constraint issue that will cause runtime failures, but otherwise implements a well-structured feature with proper security controls
Score reflects the critical migration bug (gatewayId constraint conflict) that must be fixed before merging. The implementation is otherwise solid with proper permissions, audit logging, encryption, and error handling. The LDAP enumeration appears safe but needs validation confirmation. Missing documentation is a concern for feature discoverability.
Pay close attention to backend/src/db/migrations/20260219070359_pam-discovery.ts (line 21) - the gatewayId constraint conflict must be resolved

Important Files Changed

Filename	Overview
backend/src/db/migrations/20260219070359_pam-discovery.ts	Creates 6 new PAM discovery tables with proper foreign keys, indices, and idempotency checks
backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts	Active Directory LDAP discovery implementation with connection validation and auto-import of resources and accounts
backend/src/ee/services/pam-discovery/pam-discovery-source-service.ts	Service layer with proper permission checks for all PAM discovery operations including CRUD and scan triggering
backend/src/ee/services/permission/project-permission.ts	Adds PamDiscovery permission subject with Read, Create, Edit, Delete, and RunScan actions
backend/src/ee/routes/v1/pam-discovery-routers/pam-discovery-endpoints.ts	Generic endpoint factory for PAM discovery sources with comprehensive audit logging
frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/ActiveDirectoryDiscoveryForm.tsx	Frontend form for AD discovery with proper validation and password handling using UNCHANGED_PASSWORD_SENTINEL
backend/src/ee/services/pam-discovery/pam-discovery-queue.ts	Queue handler for PAM discovery scans with manual and scheduled triggers, runs daily at 3 AM UTC

_{Last reviewed commit: 6b712df}

greptile-apps

_{71 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-22T03:36:23Z

backend/src/db/migrations/20260219070359_pam-discovery.ts

+      t.string("discoveryType").notNullable();
+
+      t.uuid("gatewayId").notNullable();
+      t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("SET NULL");


Column gatewayId is marked as notNullable() on line 20 but the foreign key uses onDelete("SET NULL"). This creates a constraint conflict - if the referenced gateway is deleted, the database will try to set this field to NULL but the NOT NULL constraint will prevent it, causing the delete operation to fail.

Suggested change

t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("SET NULL");

t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("CASCADE");

valid ^^

we should make it so that deleting the gateway throws an error if it's selected in one of the discovery sources

greptile-apps · 2026-02-22T03:36:24Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+const toSlugName = (name: string): string =>
+  name
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "");


The regex patterns in toSlugName use simple character classes without nested quantifiers, so they're safe from ReDoS. However, consider using the re2 package for consistency with the codebase's security policy (Rule 1), even though these specific patterns are not vulnerable.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

valid ^^

Redos!

greptile-apps · 2026-02-22T03:36:25Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+        const computerEntries = await ldapSearch(
+          client,
+          baseDN,
+          "(&(objectClass=computer)(operatingSystem=*Server*))",
+          ["cn", "dNSHostName", "operatingSystem", "operatingSystemVersion", "objectGUID", "whenChanged"]
+        );


LDAP filters are hardcoded here, which is safe. User-controllable input (configuration.domainFQDN, credentials.username) is used in buildDomainDN and bind operations but not in the filter strings themselves. The baseDN is constructed from the domain FQDN, which could theoretically be manipulated. Verify that configuration.domainFQDN is validated on the frontend and backend to prevent LDAP injection (e.g., no special LDAP characters like *, (, ), \, etc.).

sheensantoscapadngan · 2026-02-22T14:09:57Z

backend/src/@types/fastify.d.ts

 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { TPamAccountServiceFactory } from "@app/ee/services/pam-account/pam-account-service";
+import { TPamDiscoverySourceServiceFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-service";


IGNORE PLACEMENT OF COMMENT

we might not need the "New" and "Stale" columns altogether if you just do (+1) or (-1) beside the account/resource count?

sheensantoscapadngan · 2026-02-22T14:10:48Z

backend/src/@types/knex.d.ts

+    [TableName.PamDiscoveryRun]: KnexOriginal.CompositeTableType<
+      TPamDiscoveryRuns,
+      TPamDiscoveryRunsInsert,
+      TPamDiscoveryRunsUpdate


this should be PamDiscoverySourceRun right

sheensantoscapadngan · 2026-02-22T14:14:09Z

backend/src/db/migrations/20260219070359_pam-discovery.ts

+      t.integer("newSinceLastRun").defaultTo(0);
+      t.integer("staleSinceLastRun").defaultTo(0);


we might not need to track this since these are just values you can derive if needed

sheensantoscapadngan · 2026-02-22T14:14:48Z

backend/src/db/migrations/20260219070359_pam-discovery.ts

+      t.integer("resourcesDiscovered").defaultTo(0);
+      t.integer("accountsDiscovered").defaultTo(0);
+      t.integer("dependenciesDiscovered").defaultTo(0);
+      t.integer("newSinceLastRun").defaultTo(0);


for numeric columns, it would make more sense if it had count prefix or something better

sheensantoscapadngan · 2026-02-22T14:17:40Z

backend/src/db/migrations/20260219070359_pam-discovery.ts

+      t.string("state").nullable();
+      t.jsonb("data").notNullable();
+
+      t.string("source").notNullable();


what does this refer to?

sheensantoscapadngan · 2026-02-22T14:18:16Z

backend/src/db/migrations/20260219070359_pam-discovery.ts

+      t.foreign("resourceId").references("id").inTable(TableName.PamResource).onDelete("CASCADE");
+      t.index("resourceId");
+
+      t.string("dependencyType").notNullable();


nit - this can just be type

sheensantoscapadngan · 2026-02-22T14:23:16Z

backend/src/ee/routes/v1/pam-discovery-routers/pam-discovery-endpoints.ts

+  const discoveryTypeId = discoveryType
+    .split("-")
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+    .join("");
+


maybe just use an enum for this

sheensantoscapadngan · 2026-02-22T14:25:50Z

backend/src/ee/routes/v1/pam-discovery-routers/pam-discovery-endpoints.ts

+          metadata: {
+            sourceId: req.params.discoverySourceId,
+            discoveryType
+          }


let's make all audit logs for this have an identifier that's easily recognizable by users.. like discovery source name

sheensantoscapadngan · 2026-02-22T14:31:40Z

backend/src/ee/routes/v1/index.ts

+            )
+          );
+        },
+        { prefix: "/discovery" }


let's do discovery-sources?

sheensantoscapadngan · 2026-02-22T14:32:47Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+
+const LDAP_TIMEOUT = 30 * 1000;
+const LDAP_PAGE_SIZE = 500;
+const SERVICE_ACCOUNT_PATTERNS = [/^svc[_-]/i, /[_-]service$/i, /[_-]svc$/i];


sheensantoscapadngan · 2026-02-22T14:41:06Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+  const existing = await pamResourceDAL.find({
+    projectId,
+    resourceType: PamResource.Windows,
+    name: resourceName
+  });
+
+  if (existing.length > 0) return { resource: existing[0], isNew: false };
+
+  const [encryptedConnectionDetails, encryptedResourceMetadata] = await Promise.all([
+    encryptResourceConnectionDetails({
+      projectId,
+      connectionDetails: {
+        protocol: WindowsProtocol.RDP,
+        hostname,
+        port: 3389
+      } as TWindowsResourceConnectionDetails,
+      kmsService
+    }),
+    encryptResourceMetadata({
+      projectId,
+      metadata: {
+        osVersion: computer.operatingSystem || undefined,
+        osVersionDetail: computer.operatingSystemVersion || undefined
+      } as TWindowsResourceMetadata,
+      kmsService
+    })
+  ]);
+
+  const resource = await pamResourceDAL.create({
+    projectId,
+    name: resourceName,
+    resourceType: PamResource.Windows,
+    gatewayId,
+    encryptedConnectionDetails,
+    encryptedResourceMetadata,
+    adServerResourceId
+  });


we should be doing this inside a transaction right because otherwise the read request might be served by a replica so it would be invalid

sheensantoscapadngan · 2026-02-22T14:42:47Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+  const existing = await pamResourceDAL.find({
+    projectId,
+    resourceType: PamResource.Windows,
+    name: resourceName
+  });


don't we want to match against something more specific/definite like an active directory ID? Existing resources might clash with resources discovered so we could add a suffix to the name. Imagine if I had two domains each with a windows machine of the same name

sheensantoscapadngan · 2026-02-22T14:46:03Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+  const existing = await pamAccountDAL.find({
+    resourceId: adServerResourceId,
+    name: accountName
+  });
+


same concern here about matching and account name duplicates...

also shouldn't we be checking accountType as well?

sheensantoscapadngan · 2026-02-22T14:46:32Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+  const account = await pamAccountDAL.create({
+    projectId,
+    resourceId: adServerResourceId,
+    name: accountName,
+    encryptedCredentials,
+    metadata
+  });


same concern about using transactions

sheensantoscapadngan · 2026-02-22T14:49:29Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+      triggeredBy,
+      startedAt: new Date(),
+      progress: {
+        adEnumeration: { status: "running" }


let's use enums for the status

sheensantoscapadngan · 2026-02-22T14:52:08Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+      const { resource: adServerResource, isNew: isAdServerNew } = await upsertAdServerResource(
+        projectId,
+        configuration,
+        gatewayId,
+        kmsService,
+        pamResourceDAL
+      );
+
+      await pamDiscoverySourceResourcesDAL.upsertJunction({
+        discoverySourceId,
+        resourceId: adServerResource.id,
+        lastDiscoveredRunId: run.id
+      });


this should be in a txn right?

sheensantoscapadngan · 2026-02-22T14:52:44Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+          const { resource, isNew } = await upsertWindowsServerResource(
+            projectId,
+            computer,
+            adServerResource.id,
+            gatewayId,
+            kmsService,
+            pamResourceDAL
+          );
+
+          await pamDiscoverySourceResourcesDAL.upsertJunction({
+            discoverySourceId,
+            resourceId: resource.id,
+            lastDiscoveredRunId: run.id
+          });


same here.. it should likely be a txn per computer so that we don't hold up a txn for too long

sheensantoscapadngan · 2026-02-22T14:52:59Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+          const { account, isNew } = await upsertDomainAccount(
+            projectId,
+            user,
+            adServerResource.id,
+            kmsService,
+            pamAccountDAL
+          );
+
+          await pamDiscoverySourceAccountsDAL.upsertJunction({
+            discoverySourceId,
+            accountId: account.id,
+            lastDiscoveredRunId: run.id
+          });


same remark here

sheensantoscapadngan · 2026-02-22T14:55:03Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+          logger.warn({ err, computer: computer.dNSHostName }, "Failed to import Windows Server resource");
+        }
+      }
+


shouldn't we be updating the discovered resource count right away in case the account processing part fails?

sheensantoscapadngan · 2026-02-22T14:55:52Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+    }
+  };
+
+  const scan = async (discoverySourceId: string, triggeredBy: PamDiscoveryRunTrigger, deps: TPamDiscoveryScanDeps) => {


would it make sense to add a check to ensure that only one scan can happen at a time?

sheensantoscapadngan · 2026-02-22T14:56:45Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts

+      await pamDiscoverySourceDAL.updateById(discoverySourceId, {
+        lastRunAt: new Date()
+      });


nit - could just be added to the finally block

sheensantoscapadngan · 2026-02-22T14:57:08Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-schemas.ts

+    .optional(),
+  dependencyScan: z
+    .object({
+      status: z.enum(["running", "completed", "failed", "skipped"]),


sheensantoscapadngan · 2026-02-22T14:57:43Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-schemas.ts

+      totalMachines: z.number().optional(),
+      scannedMachines: z.number().optional(),
+      failedMachines: z.number().optional(),
+      reason: z.string().optional()


what reason? is this for failure? let's be more specific

sheensantoscapadngan · 2026-02-22T14:59:26Z

backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-types.ts

+export type TActiveDirectoryDiscoveryCredentials = z.infer<typeof ActiveDirectoryDiscoveryCredentialsSchema>;
+export type TActiveDirectoryDiscoveryConfiguration = z.infer<typeof ActiveDirectoryDiscoveryConfigurationSchema>;


nit - DiscoverySourceCredentials and same for configuration

sheensantoscapadngan · 2026-02-22T15:05:30Z

backend/src/ee/services/pam-discovery/pam-discovery-enums.ts

+export enum PamAccountDependencyType {
+  WindowsService = "windows-service",
+  ScheduledTask = "scheduled-task",
+  IisAppPool = "iis-app-pool"
+}


should we prefix these so that it's specific to windows? windows-scheduled-task as an example

sheensantoscapadngan · 2026-02-22T15:18:54Z

backend/src/ee/services/pam-discovery/pam-discovery-queue.ts

+          if (!discoverySource.gatewayId) {
+            logger.error(
+              { discoverySourceId, triggeredBy },
+              "PAM Discovery Source has no gateway configured, skipping scan"
+            );
+            return;
+          }


is this something we should to the user in the UI?

sheensantoscapadngan · 2026-02-22T15:20:09Z

backend/src/ee/services/pam-discovery/pam-discovery-run-dal.ts

+      void query.select(selectAllTableCols(TableName.PamDiscoveryRun));
+
+      void query.orderBy("createdAt", "desc");
+


nit but we can just combine this right?

sheensantoscapadngan · 2026-02-22T15:20:54Z

backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts

+  resourceName: z.string(),
+  resourceId: z.string().uuid(),
+  accountName: z.string(),
+  metadata: z.union([ActiveDirectoryAccountMetadataSchema, WindowsAccountMetadataSchema])


should we be using discriminatedUnion here or is that not a concern for this use-case?

sheensantoscapadngan · 2026-02-22T15:21:01Z

backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts

+export const DiscoveredResourceSchema = PamDiscoverySourceResourcesSchema.extend({
+  resourceName: z.string(),
+  resourceType: z.nativeEnum(PamResource),
+  resourceMetadata: z.union([SSHResourceMetadataSchema, WindowsResourceMetadataSchema]).optional()


same Q here

feat(pam): windows discovery base

ef6efff

x032205 added 2 commits February 19, 2026 20:00

finalize discovery base + other minor tweaks

3a65a82

tweaks

3261f60

x032205 added 2 commits February 21, 2026 01:13

audit logs

de68c5b

indicator for empty auto-import passwords

6b712df

x032205 requested a review from sheensantoscapadngan February 22, 2026 03:28

x032205 marked this pull request as ready for review February 22, 2026 03:30

greptile-apps bot reviewed Feb 22, 2026

View reviewed changes

sheensantoscapadngan reviewed Feb 22, 2026

View reviewed changes

backend/src/ee/routes/v1/index.ts

)

);

},

{ prefix: "/discovery" }

Copy link

Member

sheensantoscapadngan Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's do discovery-sources?

sheensantoscapadngan reviewed Feb 22, 2026

View reviewed changes

	t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("SET NULL");
	t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("CASCADE");

		t.integer("newSinceLastRun").defaultTo(0);
		t.integer("staleSinceLastRun").defaultTo(0);

		export type TActiveDirectoryDiscoveryCredentials = z.infer<typeof ActiveDirectoryDiscoveryCredentialsSchema>;
		export type TActiveDirectoryDiscoveryConfiguration = z.infer<typeof ActiveDirectoryDiscoveryConfigurationSchema>;

		void query.select(selectAllTableCols(TableName.PamDiscoveryRun));

		void query.orderBy("createdAt", "desc");

Comments

Conversation

x032205 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Type

Checklist

Uh oh!

maidul98 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

gitguardian bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

greptile-apps bot commented Feb 22, 2026

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sheensantoscapadngan Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sheensantoscapadngan Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sheensantoscapadngan Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sheensantoscapadngan Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

x032205 commented Feb 19, 2026 •

edited

Loading

maidul98 commented Feb 19, 2026 •

edited

Loading

gitguardian bot commented Feb 20, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading

sheensantoscapadngan Feb 22, 2026 •

edited

Loading