Merge remote-tracking branch 'origin' into stv3-org-roles

2025-03-29 22:02:57 +00:00 · 2023-12-04 16:14:31 +07:00
parent 69dae1f0b2 057fcb164d
commit 60a5092947
40 changed files with 2029 additions and 331 deletions
--- a/backend/src/controllers/v3/secretsController.ts
+++ b/backend/src/controllers/v3/secretsController.ts
@ -6,13 +6,7 @@ import { BotService } from "../../services";
 import { containsGlobPatterns, repackageSecretToRaw } from "../../helpers/secrets";
 import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
-import {
-  Folder,
-  IServiceTokenData,
-  Membership,
-  ServiceTokenData,
-  User
-} from "../../models";
+import { Folder, IServiceTokenData, Membership, ServiceTokenData, User } from "../../models";
 import { getFolderByPath } from "../../services/FolderService";
 import { BadRequestError } from "../../utils/errors";
 import { validateRequest } from "../../helpers/validation";
@ -34,6 +28,7 @@ import {
 } from "../../ee/services/SecretApprovalService";
 import { CommitType } from "../../ee/models/secretApprovalRequest";
 import { logger } from "../../utils/logging";
+import { createReminder, deleteReminder } from "../../helpers/reminder";

 const checkSecretsPermission = async ({
  authData,
@ -197,10 +192,11 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
    query: { include_imports: includeImports }
  } = validatedData;

-  logger.info(`getSecretsRaw: fetch raw secrets [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [includeImports=${includeImports}]`)
+  logger.info(
+    `getSecretsRaw: fetch raw secrets [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [includeImports=${includeImports}]`
+  );

  if (req.authData.authPayload instanceof ServiceTokenData) {
-
    // if the service token has single scope, it will get all secrets for that scope by default
    const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
    if (
@ -356,7 +352,9 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
    params: { secretName }
  } = await validateRequest(reqValidator.GetSecretByNameRawV3, req);

-  logger.info(`getSecretByNameRaw: fetch raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [include_imports=${include_imports}]`)
+  logger.info(
+    `getSecretByNameRaw: fetch raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [include_imports=${include_imports}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -481,7 +479,9 @@ export const createSecretRaw = async (req: Request, res: Response) => {
    }
  } = await validateRequest(reqValidator.CreateSecretRawV3, req);

-  logger.info(`createSecretRaw: create a secret raw by name and value [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`)
+  logger.info(
+    `createSecretRaw: create a secret raw by name and value [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -628,7 +628,9 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
    body: { workspaceId, environment, secretValue, secretPath, type, skipMultilineEncoding }
  } = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);

-  logger.info(`updateSecretByNameRaw: update raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`)
+  logger.info(
+    `updateSecretByNameRaw: update raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -752,7 +754,9 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
    body: { environment, secretPath, type, workspaceId }
  } = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);

-  logger.info(`deleteSecretByNameRaw: delete a secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}]`)
+  logger.info(
+    `deleteSecretByNameRaw: delete a secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -807,7 +811,9 @@ export const getSecrets = async (req: Request, res: Response) => {
    query: { secretPath }
  } = validatedData;

-  logger.info(`getSecrets: fetch encrypted secrets [environment=${environment}] [workspaceId=${workspaceId}] [includeImports=${includeImports}]`)
+  logger.info(
+    `getSecrets: fetch encrypted secrets [environment=${environment}] [workspaceId=${workspaceId}] [includeImports=${includeImports}]`
+  );

  const { authVerifier: permissionCheckFn } = await checkSecretsPermission({
    authData: req.authData,
@ -863,7 +869,9 @@ export const getSecretByName = async (req: Request, res: Response) => {
    params: { secretName }
  } = await validateRequest(reqValidator.GetSecretByNameV3, req);

-  logger.info(`getSecretByName: get a single secret by name [environment=${environment}] [workspaceId=${workspaceId}] [include_imports=${include_imports}] [type=${type}]`)
+  logger.info(
+    `getSecretByName: get a single secret by name [environment=${environment}] [workspaceId=${workspaceId}] [include_imports=${include_imports}] [type=${type}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -915,7 +923,9 @@ export const createSecret = async (req: Request, res: Response) => {
    params: { secretName }
  } = await validateRequest(reqValidator.CreateSecretV3, req);

-  logger.info(`createSecret: create an encrypted secret [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`)
+  logger.info(
+    `createSecret: create an encrypted secret [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -932,7 +942,11 @@ export const createSecret = async (req: Request, res: Response) => {
    });

    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1024,12 +1038,16 @@ export const updateSecretByName = async (req: Request, res: Response) => {
      secretKeyIV,
      secretKeyTag,
      secretKeyCiphertext,
-      skipMultilineEncoding
+      skipMultilineEncoding,
+      secretReminderRepeatDays,
+      secretReminderNote
    },
    params: { secretName }
  } = await validateRequest(reqValidator.UpdateSecretByNameV3, req);

-  logger.info(`updateSecretByName: update a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`)
+  logger.info(
+    `updateSecretByName: update a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
+  );

  if (newSecretName && (!secretKeyIV || !secretKeyTag || !secretKeyCiphertext)) {
    throw BadRequestError({ message: "Missing encrypted key" });
@ -1050,7 +1068,11 @@ export const updateSecretByName = async (req: Request, res: Response) => {
    });

    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1084,6 +1106,41 @@ export const updateSecretByName = async (req: Request, res: Response) => {
    }
  }

+  if (type !== "personal") {
+    const existingSecret = await SecretService.getSecret({
+      secretName,
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      type,
+      secretPath,
+      authData: req.authData
+    });
+
+    if (secretReminderRepeatDays !== undefined) {
+      if (
+        (secretReminderRepeatDays &&
+          existingSecret.secretReminderRepeatDays !== secretReminderRepeatDays) ||
+        (secretReminderNote && existingSecret.secretReminderNote !== secretReminderNote)
+      ) {
+        await createReminder(existingSecret, {
+          _id: existingSecret._id,
+          secretReminderRepeatDays,
+          secretReminderNote,
+          workspace: existingSecret.workspace
+        });
+      } else if (
+        secretReminderRepeatDays === null &&
+        secretReminderNote === null &&
+        existingSecret.secretReminderRepeatDays
+      ) {
+        await deleteReminder({
+          _id: existingSecret._id,
+          secretReminderRepeatDays: existingSecret.secretReminderRepeatDays
+        });
+      }
+    }
+  }
+
  const secret = await SecretService.updateSecret({
    secretName,
    workspaceId: new Types.ObjectId(workspaceId),
@ -1094,6 +1151,8 @@ export const updateSecretByName = async (req: Request, res: Response) => {
    newSecretName,
    secretValueCiphertext,
    secretValueIV,
+    secretReminderRepeatDays,
+    secretReminderNote,
    secretValueTag,
    secretPath,
    tags,
@ -1130,7 +1189,9 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
    params: { secretName }
  } = await validateRequest(reqValidator.DeleteSecretByNameV3, req);

-  logger.info(`deleteSecretByName: delete a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [type=${type}]`)
+  logger.info(
+    `deleteSecretByName: delete a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [type=${type}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -1147,7 +1208,11 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
    });

    if (membership && type !== "personal") {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1197,7 +1262,9 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
    body: { secrets, secretPath, environment, workspaceId }
  } = await validateRequest(reqValidator.CreateSecretByNameBatchV3, req);

-  logger.info(`createSecretByNameBatch: create a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`)
+  logger.info(
+    `createSecretByNameBatch: create a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -1214,7 +1281,11 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
    });

    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1258,7 +1329,9 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
    body: { secrets, secretPath, environment, workspaceId }
  } = await validateRequest(reqValidator.UpdateSecretByNameBatchV3, req);

-  logger.info(`updateSecretByNameBatch: update a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`)
+  logger.info(
+    `updateSecretByNameBatch: update a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -1275,7 +1348,11 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
    });

    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1319,7 +1396,9 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
    body: { secrets, secretPath, environment, workspaceId }
  } = await validateRequest(reqValidator.DeleteSecretByNameBatchV3, req);

-  logger.info(`deleteSecretByNameBatch: delete a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`)
+  logger.info(
+    `deleteSecretByNameBatch: delete a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
+  );

  await checkSecretsPermission({
    authData: req.authData,
@ -1336,7 +1415,11 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
    });

    if (membership) {
-      const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
+      const secretApprovalPolicy = await getSecretPolicyOfBoard(
+        workspaceId,
+        environment,
+        secretPath
+      );
      if (secretApprovalPolicy) {
        const secretApprovalRequest = await generateSecretApprovalRequest({
          workspaceId,
@ -1373,4 +1456,4 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
  return res.status(200).send({
    secrets: deletedSecrets
  });
-};
+};
--- a/backend/src/helpers/reminder.ts
+++ b/backend/src/helpers/reminder.ts
@ -0,0 +1,58 @@
+import { ISecret } from "../models";
+import {
+  createRecurringSecretReminder,
+  deleteRecurringSecretReminder,
+  updateRecurringSecretReminder
+} from "../queues/reminders/sendSecretReminders";
+
+type TPartialSecret = Pick<
+  ISecret,
+  "_id" | "secretReminderRepeatDays" | "secretReminderNote" | "workspace"
+>;
+type TPartialSecretDeleteReminder = Pick<ISecret, "_id" | "secretReminderRepeatDays">;
+
+export const createReminder = async (oldSecret: TPartialSecret, newSecret: TPartialSecret) => {
+  if (oldSecret._id !== newSecret._id) {
+    throw new Error("Secret id's don't match");
+  }
+
+  if (!newSecret.secretReminderRepeatDays) {
+    throw new Error("No repeat days provided");
+  }
+
+  const secretId = oldSecret._id.toString();
+  const workspaceId = oldSecret.workspace.toString();
+
+  if (oldSecret.secretReminderRepeatDays) {
+    // This will first delete the existing recurring job, and then create a new one.
+    await updateRecurringSecretReminder({
+      workspaceId,
+      secretId,
+      repeatDays: newSecret.secretReminderRepeatDays,
+      note: newSecret.secretReminderNote
+    });
+  } else {
+    // This will create a new recurring job.
+    await createRecurringSecretReminder({
+      workspaceId,
+      secretId,
+      repeatDays: newSecret.secretReminderRepeatDays,
+      note: newSecret.secretReminderNote
+    });
+  }
+};
+
+export const deleteReminder = async (secret: TPartialSecretDeleteReminder) => {
+  if (!secret._id) {
+    throw new Error("No secret id provided");
+  }
+
+  if (!secret.secretReminderRepeatDays) {
+    throw new Error("No repeat days provided");
+  }
+
+  await deleteRecurringSecretReminder({
+    secretId: secret._id.toString(),
+    repeatDays: secret.secretReminderRepeatDays
+  });
+};
--- a/backend/src/helpers/secrets.ts
+++ b/backend/src/helpers/secrets.ts
@ -574,18 +574,20 @@ export const getSecretsHelper = async ({
    const approximateForNoneCapturedEvents = secrets.length * 10;

    if (shouldCapture) {
-      postHogClient.capture({
-        event: "secrets pulled",
-        distinctId: await TelemetryService.getDistinctId({ authData }),
-        properties: {
-          numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
-          environment,
-          workspaceId,
-          folderId,
-          channel: authData.userAgentType,
-          userAgent: authData.userAgent
-        }
-      });
+      if (workspaceId.toString() != "650e71fbae3e6c8572f436d4") {
+        postHogClient.capture({
+          event: "secrets pulled",
+          distinctId: await TelemetryService.getDistinctId({ authData }),
+          properties: {
+            numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
+            environment,
+            workspaceId,
+            folderId,
+            channel: authData.userAgentType,
+            userAgent: authData.userAgent
+          }
+        });
+      }
    }
  }

@ -717,6 +719,8 @@ export const updateSecretHelper = async ({
  secretValueIV,
  secretValueTag,
  secretPath,
+  secretReminderRepeatDays,
+  secretReminderNote,
  tags,
  secretCommentCiphertext,
  secretCommentIV,
@ -781,6 +785,10 @@ export const updateSecretHelper = async ({
        secretCommentIV,
        secretCommentTag,
        secretCommentCiphertext,
+
+        secretReminderRepeatDays,
+        secretReminderNote,
+
        skipMultilineEncoding,
        secretBlindIndex: newSecretNameBlindIndex,
        secretKeyIV,
--- a/backend/src/interfaces/services/SecretService/index.ts
+++ b/backend/src/interfaces/services/SecretService/index.ts
@ -58,6 +58,10 @@ export interface UpdateSecretParams {
  secretCommentCiphertext?: string;
  secretCommentIV?: string;
  secretCommentTag?: string;
+
+  secretReminderRepeatDays?: number | null;
+  secretReminderNote?: string | null;
+
  skipMultilineEncoding?: boolean;
  tags?: string[];
 }
--- a/backend/src/models/secret.ts
+++ b/backend/src/models/secret.ts
@ -27,6 +27,12 @@ export interface ISecret {
  secretCommentIV?: string;
  secretCommentTag?: string;
  secretCommentHash?: string;
+
+  // ? NOTE: This works great for workspace-level reminders.
+  // ? If we want to do it on a user-basis, we should ideally have a seperate model for reminders.
+  secretReminderRepeatDays?: number | null;
+  secretReminderNote?: string | null;
+
  skipMultilineEncoding?: boolean;
  algorithm: "aes-256-gcm";
  keyEncoding: "utf8" | "base64";
@ -118,10 +124,23 @@ const secretSchema = new Schema<ISecret>(
      type: String,
      required: false
    },
+
+    secretReminderRepeatDays: {
+      type: Number,
+      required: false,
+      default: null
+    },
+    secretReminderNote: {
+      type: String,
+      required: false,
+      default: null
+    },
+
    skipMultilineEncoding: {
      type: Boolean,
      required: false
    },
+
    algorithm: {
      // the encryption algorithm used
      type: String,
--- a/backend/src/queues/reminders/sendSecretReminders.ts
+++ b/backend/src/queues/reminders/sendSecretReminders.ts
@ -0,0 +1,83 @@
+import Queue, { Job } from "bull";
+import { IUser, Membership, Organization, Workspace } from "../../models";
+import { Types } from "mongoose";
+import { sendMail } from "../../helpers";
+
+type TSendSecretReminders = {
+  workspaceId: string;
+  secretId: string;
+  repeatDays: number;
+  note: string | undefined | null;
+};
+
+type TDeleteSecretReminder = {
+  secretId: string;
+  repeatDays: number;
+};
+
+const DAY_IN_MS = 86400000;
+
+export const sendSecretReminders = new Queue(
+  "send-secret-reminders",
+  process.env.REDIS_URL as string
+);
+
+sendSecretReminders.process(async (job: Job<TSendSecretReminders>) => {
+  const { workspaceId }: TSendSecretReminders = job.data;
+
+  const workspace = await Workspace.findById(new Types.ObjectId(workspaceId));
+  const organization = await Organization.findById(new Types.ObjectId(workspace?.organization));
+
+  if (!workspace) {
+    throw new Error("Workspace for reminder not found");
+  }
+  if (!organization) {
+    throw new Error("Organization for reminder not found");
+  }
+
+  const memberships = await Membership.find({
+    workspace: workspaceId
+  }).populate<{ user: IUser }>("user");
+
+  await sendMail({
+    template: "secretReminder.handlebars",
+    subjectLine: "Infisical secret reminder",
+    recipients: [...memberships.map((membership) => membership.user.email)],
+    substitutions: {
+      reminderNote: job.data.note, // May not be present.
+      workspaceName: workspace.name,
+      organizationName: organization.name
+    }
+  });
+});
+
+export const createRecurringSecretReminder = (jobDetails: TSendSecretReminders) => {
+  const repeat = jobDetails.repeatDays * DAY_IN_MS;
+
+  return sendSecretReminders.add(jobDetails, {
+    delay: repeat,
+    repeat: {
+      every: repeat
+    },
+    jobId: `reminder-${jobDetails.secretId}`,
+    removeOnComplete: true,
+    removeOnFail: {
+      count: 20
+    }
+  });
+};
+
+export const deleteRecurringSecretReminder = (jobDetails: TDeleteSecretReminder) => {
+  const repeat = jobDetails.repeatDays * DAY_IN_MS;
+
+  return sendSecretReminders.removeRepeatable({
+    every: repeat,
+    jobId: `reminder-${jobDetails.secretId}`
+  });
+};
+
+export const updateRecurringSecretReminder = async (jobDetails: TSendSecretReminders) => {
+  // We need to delete the potentially existing reminder job first, or the new one won't be created.
+  await deleteRecurringSecretReminder(jobDetails);
+  await createRecurringSecretReminder(jobDetails);
+};
--- a/backend/src/templates/secretReminder.handlebars
+++ b/backend/src/templates/secretReminder.handlebars
@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+    <meta charset="utf-8">
+    <meta http-equiv="x-ua-compatible" content="ie=edge">
+    <title>Secret Reminder</title>
+</head>
+
+<body>
+    <h2>Infisical</h2>
+    <h2>You have a new secret reminder!</h2>
+    <p>You have a new secret reminder from workspace "{{workspaceName}}", in {{organizationName}}</p>
+    {{#if reminderNote}}
+      <p>Here's the note included with the reminder: {{reminderNote}}</p>
+    {{/if}}
+</body>
+
+</html>
--- a/backend/src/validation/secrets.ts
+++ b/backend/src/validation/secrets.ts
@ -10,7 +10,6 @@ import { AuthData } from "../interfaces/middleware";
 import { ActorType } from "../ee/models";
 import { z } from "zod";
 import { SECRET_PERSONAL, SECRET_SHARED } from "../variables";
-
 /**
 * Validate authenticated clients for secrets with id [secretId] based
 * on any known permissions.
@ -260,6 +259,7 @@ export const CreateSecretRawV3 = z.object({
      .string()
      .transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())),
    secretComment: z.string().trim().optional().default(""),
+
    skipMultilineEncoding: z.boolean().optional(),
    type: z.enum([SECRET_SHARED, SECRET_PERSONAL])
  }),
@ -275,6 +275,7 @@ export const UpdateSecretByNameRawV3 = z.object({
  body: z.object({
    workspaceId: z.string().trim(),
    environment: z.string().trim(),
+
    secretValue: z
      .string()
      .transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())),
@ -360,6 +361,10 @@ export const UpdateSecretByNameV3 = z.object({
    secretCommentCiphertext: z.string().trim().optional(),
    secretCommentIV: z.string().trim().optional(),
    secretCommentTag: z.string().trim().optional(),
+
+    secretReminderRepeatDays: z.number().min(1).max(365).optional().nullable(),
+    secretReminderNote: z.string().trim().nullable().optional(),
+
    tags: z.string().array().optional(),
    skipMultilineEncoding: z.boolean().optional(),
    // to update secret name
--- a/cli/example-agent-config.yaml
+++ b/cli/example-agent-config.yaml
@ -0,0 +1,17 @@
+infisical:
+  address: "http://localhost:8080"
+auth:
+  type: "token"
+  config:
+    token-path: "./role-id"
+sinks:
+  - type: "file"
+    config:
+      path: "/Users/maidulislam/Desktop/test/infisical-token"
+  - type: "file"
+    config:
+      path: "access-token"
+  - type: "file"
+    config:
+      path: "maiduls-access-token"
+templates:
--- a/cli/packages/api/api.go
+++ b/cli/packages/api/api.go
@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"net/http"
+	"strings"

 	"github.com/Infisical/infisical-merge/packages/config"
 	"github.com/go-resty/resty/v2"
@ -260,6 +261,70 @@ func CallGetSecretsV3(httpClient *resty.Client, request GetEncryptedSecretsV3Req
 	return secretsResponse, nil
 }

+func CallGetFoldersV1(httpClient *resty.Client, request GetFoldersV1Request) (GetFoldersV1Response, error) {
+	var foldersResponse GetFoldersV1Response
+	httpRequest := httpClient.
+		R().
+		SetResult(&foldersResponse).
+		SetHeader("User-Agent", USER_AGENT).
+		SetQueryParam("environment", request.Environment).
+		SetQueryParam("workspaceId", request.WorkspaceId).
+		SetQueryParam("directory", request.FoldersPath)
+
+	response, err := httpRequest.Get(fmt.Sprintf("%v/v1/folders", config.INFISICAL_URL))
+
+	if err != nil {
+		return GetFoldersV1Response{}, fmt.Errorf("CallGetFoldersV1: Unable to complete api request [err=%v]", err)
+	}
+
+	if response.IsError() {
+		return GetFoldersV1Response{}, fmt.Errorf("CallGetFoldersV1: Unsuccessful [response=%s]", response)
+	}
+
+	return foldersResponse, nil
+}
+
+func CallCreateFolderV1(httpClient *resty.Client, request CreateFolderV1Request) (CreateFolderV1Response, error) {
+	var folderResponse CreateFolderV1Response
+	httpRequest := httpClient.
+		R().
+		SetResult(&folderResponse).
+		SetHeader("User-Agent", USER_AGENT).
+		SetBody(request)
+
+	response, err := httpRequest.Post(fmt.Sprintf("%v/v1/folders", config.INFISICAL_URL))
+	if err != nil {
+		return CreateFolderV1Response{}, fmt.Errorf("CallCreateFolderV1: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return CreateFolderV1Response{}, fmt.Errorf("CallCreateFolderV1: Unsuccessful [response=%s]", response.String())
+	}
+
+	return folderResponse, nil
+}
+
+func CallDeleteFolderV1(httpClient *resty.Client, request DeleteFolderV1Request) (DeleteFolderV1Response, error) {
+	var folderResponse DeleteFolderV1Response
+
+	httpRequest := httpClient.
+		R().
+		SetResult(&folderResponse).
+		SetHeader("User-Agent", USER_AGENT).
+		SetBody(request)
+
+	response, err := httpRequest.Delete(fmt.Sprintf("%v/v1/folders/%v", config.INFISICAL_URL, request.FolderName))
+	if err != nil {
+		return DeleteFolderV1Response{}, fmt.Errorf("CallDeleteFolderV1: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return DeleteFolderV1Response{}, fmt.Errorf("CallDeleteFolderV1: Unsuccessful [response=%s]", response.String())
+	}
+
+	return folderResponse, nil
+}
+
 func CallCreateSecretsV3(httpClient *resty.Client, request CreateSecretV3Request) error {
 	var secretsResponse GetEncryptedSecretsV3Response
 	response, err := httpClient.
@ -359,3 +424,50 @@ func CallCreateServiceToken(httpClient *resty.Client, request CreateServiceToken

 	return createServiceTokenResponse, nil
 }
+
+func CallServiceTokenV3Refresh(httpClient *resty.Client, request ServiceTokenV3RefreshTokenRequest) (ServiceTokenV3RefreshTokenResponse, error) {
+	var serviceTokenV3RefreshTokenResponse ServiceTokenV3RefreshTokenResponse
+	response, err := httpClient.
+		R().
+		SetResult(&serviceTokenV3RefreshTokenResponse).
+		SetHeader("User-Agent", USER_AGENT).
+		SetBody(request).
+		Post(fmt.Sprintf("%v/v3/service-token/me/token", config.INFISICAL_URL))
+
+	if err != nil {
+		return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
+	}
+
+	return serviceTokenV3RefreshTokenResponse, nil
+}
+
+func CallGetRawSecretsV3(httpClient *resty.Client, request GetRawSecretsV3Request) (GetRawSecretsV3Response, error) {
+	var getRawSecretsV3Response GetRawSecretsV3Response
+	response, err := httpClient.
+		R().
+		SetResult(&getRawSecretsV3Response).
+		SetHeader("User-Agent", USER_AGENT).
+		SetBody(request).
+		SetQueryParam("workspaceId", request.WorkspaceId).
+		SetQueryParam("environment", request.Environment).
+		SetQueryParam("include_imports", "false").
+		Get(fmt.Sprintf("%v/v3/secrets/raw", config.INFISICAL_URL))
+
+	if err != nil {
+		return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unable to complete api request [err=%w]", err)
+	}
+
+	if response.IsError() && strings.Contains(response.String(), "Failed to find bot key") {
+		return GetRawSecretsV3Response{}, fmt.Errorf("project with id %s is a legacy project type, please navigate to project settings and disable end to end encryption then try again", request.WorkspaceId)
+	}
+
+	if response.IsError() {
+		return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unsuccessful response [%v %v] [status-code=%v]", response.Request.Method, response.Request.URL, response.StatusCode())
+	}
+
+	return getRawSecretsV3Response, nil
+}
--- a/cli/packages/api/model.go
+++ b/cli/packages/api/model.go
@ -278,6 +278,47 @@ type GetEncryptedSecretsV3Request struct {
 	IncludeImport bool   `json:"include_imports"`
 }

+type GetFoldersV1Request struct {
+	Environment string `json:"environment"`
+	WorkspaceId string `json:"workspaceId"`
+	FoldersPath string `json:"foldersPath"`
+}
+
+type GetFoldersV1Response struct {
+	Folders []struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"folders"`
+}
+
+type CreateFolderV1Request struct {
+	FolderName  string `json:"folderName"`
+	WorkspaceId string `json:"workspaceId"`
+	Environment string `json:"environment"`
+	Directory   string `json:"directory"`
+}
+
+type CreateFolderV1Response struct {
+	Folder struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"folder"`
+}
+
+type DeleteFolderV1Request struct {
+	FolderName  string `json:"folderName"`
+	WorkspaceId string `json:"workspaceId"`
+	Environment string `json:"environment"`
+	Directory   string `json:"directory"`
+}
+
+type DeleteFolderV1Response struct {
+	Folders []struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"folders"`
+}
+
 type EncryptedSecretV3 struct {
 	ID        string `json:"_id"`
 	Version   int    `json:"version"`
@ -421,3 +462,34 @@ type CreateServiceTokenResponse struct {
 	ServiceToken     string           `json:"serviceToken"`
 	ServiceTokenData ServiceTokenData `json:"serviceTokenData"`
 }
+
+type ServiceTokenV3RefreshTokenRequest struct {
+	RefreshToken string `json:"refresh_token"`
+}
+type ServiceTokenV3RefreshTokenResponse struct {
+	RefreshToken string `json:"refresh_token"`
+	AccessToken  string `json:"access_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	TokenType    string `json:"token_type"`
+}
+
+type GetRawSecretsV3Request struct {
+	Environment   string `json:"environment"`
+	WorkspaceId   string `json:"workspaceId"`
+	SecretPath    string `json:"secretPath"`
+	IncludeImport bool   `json:"include_imports"`
+}
+
+type GetRawSecretsV3Response struct {
+	Secrets []struct {
+		ID            string `json:"_id"`
+		Version       int    `json:"version"`
+		Workspace     string `json:"workspace"`
+		Type          string `json:"type"`
+		Environment   string `json:"environment"`
+		SecretKey     string `json:"secretKey"`
+		SecretValue   string `json:"secretValue"`
+		SecretComment string `json:"secretComment"`
+	} `json:"secrets"`
+	Imports []any `json:"imports"`
+}
--- a/cli/packages/cmd/agent.go
+++ b/cli/packages/cmd/agent.go
@ -0,0 +1,327 @@
+/*
+Copyright (c) 2023 Infisical Inc.
+*/
+package cmd
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"text/template"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"gopkg.in/yaml.v2"
+
+	"github.com/Infisical/infisical-merge/packages/api"
+	"github.com/Infisical/infisical-merge/packages/config"
+	"github.com/Infisical/infisical-merge/packages/models"
+	"github.com/Infisical/infisical-merge/packages/util"
+	"github.com/go-resty/resty/v2"
+	"github.com/spf13/cobra"
+)
+
+const DEFAULT_INFISICAL_CLOUD_URL = "https://app.infisical.com"
+
+type Config struct {
+	Infisical InfisicalConfig `yaml:"infisical"`
+	Auth      AuthConfig      `yaml:"auth"`
+	Sinks     []Sink          `yaml:"sinks"`
+	Templates []Template      `yaml:"templates"`
+}
+
+type InfisicalConfig struct {
+	Address string `yaml:"address"`
+}
+
+type AuthConfig struct {
+	Type   string      `yaml:"type"`
+	Config interface{} `yaml:"config"`
+}
+
+type TokenAuthConfig struct {
+	TokenPath string `yaml:"token-path"`
+}
+
+type OAuthConfig struct {
+	ClientID     string `yaml:"client-id"`
+	ClientSecret string `yaml:"client-secret"`
+}
+
+type Sink struct {
+	Type   string      `yaml:"type"`
+	Config SinkDetails `yaml:"config"`
+}
+
+type SinkDetails struct {
+	Path string `yaml:"path"`
+}
+
+type Template struct {
+	SourcePath      string `yaml:"source-path"`
+	DestinationPath string `yaml:"destination-path"`
+}
+
+func ReadFile(filePath string) ([]byte, error) {
+	return ioutil.ReadFile(filePath)
+}
+
+func FileExists(filepath string) bool {
+	info, err := os.Stat(filepath)
+	if os.IsNotExist(err) {
+		return false
+	}
+	return !info.IsDir()
+}
+
+// WriteToFile writes data to the specified file path.
+func WriteBytesToFile(data *bytes.Buffer, outputPath string) error {
+	outputFile, err := os.Create(outputPath)
+	if err != nil {
+		return err
+	}
+	defer outputFile.Close()
+
+	_, err = outputFile.Write(data.Bytes())
+	return err
+}
+
+func appendAPIEndpoint(address string) string {
+	// Ensure the address does not already end with "/api"
+	if strings.HasSuffix(address, "/api") {
+		return address
+	}
+
+	// Check if the address ends with a slash and append accordingly
+	if address[len(address)-1] == '/' {
+		return address + "api"
+	}
+	return address + "/api"
+}
+
+func ParseAgentConfig(filePath string) (*Config, error) {
+	data, err := ioutil.ReadFile(filePath)
+	if err != nil {
+		return nil, err
+	}
+
+	var rawConfig struct {
+		Infisical InfisicalConfig `yaml:"infisical"`
+		Auth      struct {
+			Type   string                 `yaml:"type"`
+			Config map[string]interface{} `yaml:"config"`
+		} `yaml:"auth"`
+		Sinks     []Sink     `yaml:"sinks"`
+		Templates []Template `yaml:"templates"`
+	}
+
+	if err := yaml.Unmarshal(data, &rawConfig); err != nil {
+		return nil, err
+	}
+
+	// Set defaults
+	if rawConfig.Infisical.Address == "" {
+		rawConfig.Infisical.Address = DEFAULT_INFISICAL_CLOUD_URL
+	}
+
+	config.INFISICAL_URL = appendAPIEndpoint(rawConfig.Infisical.Address)
+
+	log.Info().Msgf("Infisical instance address set to %s", rawConfig.Infisical.Address)
+
+	config := &Config{
+		Infisical: rawConfig.Infisical,
+		Auth: AuthConfig{
+			Type: rawConfig.Auth.Type,
+		},
+		Sinks:     rawConfig.Sinks,
+		Templates: rawConfig.Templates,
+	}
+
+	// Marshal and then unmarshal the config based on the type
+	configBytes, err := yaml.Marshal(rawConfig.Auth.Config)
+	if err != nil {
+		return nil, err
+	}
+
+	switch rawConfig.Auth.Type {
+	case "token":
+		var tokenConfig TokenAuthConfig
+		if err := yaml.Unmarshal(configBytes, &tokenConfig); err != nil {
+			return nil, err
+		}
+		config.Auth.Config = tokenConfig
+	case "oauth": // aws, gcp, k8s service account, etc
+		var oauthConfig OAuthConfig
+		if err := yaml.Unmarshal(configBytes, &oauthConfig); err != nil {
+			return nil, err
+		}
+		config.Auth.Config = oauthConfig
+	default:
+		return nil, fmt.Errorf("unknown auth type: %s", rawConfig.Auth.Type)
+	}
+
+	return config, nil
+}
+
+func secretTemplateFunction(accessToken string) func(string, string, string) ([]models.SingleEnvironmentVariable, error) {
+	return func(projectID, envSlug, secretPath string) ([]models.SingleEnvironmentVariable, error) {
+		secrets, err := util.GetPlainTextSecretsViaMachineIdentity(accessToken, projectID, envSlug, secretPath, false)
+		if err != nil {
+			return nil, err
+		}
+
+		return secrets, nil
+	}
+}
+
+func ProcessTemplate(templatePath string, data interface{}, accessToken string) (*bytes.Buffer, error) {
+	// custom template function to fetch secrets from Infisical
+	secretFunction := secretTemplateFunction(accessToken)
+	funcs := template.FuncMap{
+		"secret": secretFunction,
+	}
+
+	tmpl, err := template.New(templatePath).Funcs(funcs).ParseFiles(templatePath)
+	if err != nil {
+		return nil, err
+	}
+
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, data); err != nil {
+		return nil, err
+	}
+
+	return &buf, nil
+}
+
+func refreshTokenAndProcessTemplate(refreshToken string, config *Config, errChan chan error) {
+	for {
+		httpClient := resty.New()
+		httpClient.SetRetryCount(10000).
+			SetRetryMaxWaitTime(20 * time.Second).
+			SetRetryWaitTime(5 * time.Second)
+
+		tokenResponse, err := api.CallServiceTokenV3Refresh(httpClient, api.ServiceTokenV3RefreshTokenRequest{RefreshToken: refreshToken})
+		if err != nil {
+			errChan <- fmt.Errorf("unable to complete renewal because [%s]", err)
+		}
+
+		for _, sinkFile := range config.Sinks {
+			if sinkFile.Type == "file" {
+				err = ioutil.WriteFile(sinkFile.Config.Path, []byte(tokenResponse.AccessToken), 0644)
+				if err != nil {
+					errChan <- err
+					return
+				}
+			} else {
+				errChan <- errors.New("unsupported sink type. Only 'file' type is supported")
+				return
+			}
+		}
+
+		refreshToken = tokenResponse.RefreshToken
+		nextRefreshCycle := time.Duration(tokenResponse.ExpiresIn-5) * time.Second // when the next access refresh will happen
+
+		d, err := time.ParseDuration(nextRefreshCycle.String())
+		if err != nil {
+			errChan <- fmt.Errorf("unable to parse refresh time because %s", err)
+			return
+		}
+
+		log.Info().Msgf("token refreshed and saved to selected path; next cycle will occur in %s", d.String())
+
+		for _, secretTemplate := range config.Templates {
+			processedTemplate, err := ProcessTemplate(secretTemplate.SourcePath, nil, tokenResponse.AccessToken)
+			if err != nil {
+				errChan <- err
+				return
+			}
+
+			if err := WriteBytesToFile(processedTemplate, secretTemplate.DestinationPath); err != nil {
+				errChan <- err
+				return
+			}
+
+			log.Info().Msgf("secret template at path %s has been rendered and saved to path %s", secretTemplate.SourcePath, secretTemplate.DestinationPath)
+		}
+
+		time.Sleep(nextRefreshCycle)
+	}
+}
+
+// runCmd represents the run command
+var agentCmd = &cobra.Command{
+	Example: `
+	infisical agent
+	`,
+	Use:                   "agent",
+	Short:                 "agent",
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+
+		log.Info().Msg("starting Infisical agent...")
+
+		configPath, err := cmd.Flags().GetString("config")
+		if err != nil {
+			util.HandleError(err, "Unable to parse flag config")
+		}
+
+		if !FileExists(configPath) {
+			log.Error().Msgf("Unable to locate %s. The provided agent config file path is either missing or incorrect", configPath)
+			return
+		}
+
+		agentConfig, err := ParseAgentConfig(configPath)
+		if err != nil {
+			log.Error().Msgf("Unable to prase %s because %v. Please ensure that is follows the Infisical Agent config structure", configPath, err)
+			return
+		}
+
+		errChan := make(chan error)
+		sigChan := make(chan os.Signal, 1)
+
+		signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+
+		switch configAuthType := agentConfig.Auth.Config.(type) {
+		case TokenAuthConfig:
+			content, err := ReadFile(configAuthType.TokenPath)
+			if err != nil {
+				log.Error().Msgf("unable to read initial token from file path %s because %v", configAuthType.TokenPath, err)
+				return
+			}
+
+			refreshToken := string(content)
+			go refreshTokenAndProcessTemplate(refreshToken, agentConfig, errChan)
+
+		case OAuthConfig:
+			// future auth types
+		default:
+			log.Error().Msgf("unknown auth config type. Only 'file' type is supported")
+			return
+		}
+
+		select {
+		case err := <-errChan:
+			log.Fatal().Msgf("agent stopped due to error: %v", err)
+			os.Exit(1)
+		case <-sigChan:
+			log.Info().Msg("agent is gracefully shutting...")
+			os.Exit(1)
+		}
+
+	},
+}
+
+func init() {
+	agentCmd.SetHelpFunc(func(command *cobra.Command, strings []string) {
+		command.Flags().MarkHidden("domain")
+		command.Parent().HelpFunc()(command, strings)
+	})
+	agentCmd.Flags().String("config", "agent-config.yaml", "The path to agent config yaml file")
+	rootCmd.AddCommand(agentCmd)
+}
--- a/cli/packages/cmd/folder.go
+++ b/cli/packages/cmd/folder.go
@ -0,0 +1,164 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/Infisical/infisical-merge/packages/models"
+	"github.com/Infisical/infisical-merge/packages/util"
+	"github.com/Infisical/infisical-merge/packages/visualize"
+	"github.com/posthog/posthog-go"
+	"github.com/spf13/cobra"
+)
+
+var folderCmd = &cobra.Command{
+	Use:                   "folders",
+	Short:                 "Create, delete, and list folders",
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+	},
+}
+
+var getCmd = &cobra.Command{
+	Use:   "get",
+	Short: "Get folders in a directory",
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		util.RequireLocalWorkspaceFile()
+		util.RequireLogin()
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+
+		environmentName, _ := cmd.Flags().GetString("env")
+		if !cmd.Flags().Changed("env") {
+			environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
+			if environmentFromWorkspace != "" {
+				environmentName = environmentFromWorkspace
+			}
+		}
+
+		infisicalToken, err := cmd.Flags().GetString("token")
+		if err != nil {
+			util.HandleError(err, "Unable to parse flag")
+		}
+
+		foldersPath, err := cmd.Flags().GetString("path")
+		if err != nil {
+			util.HandleError(err, "Unable to parse flag")
+		}
+
+		folders, err := util.GetAllFolders(models.GetAllFoldersParameters{Environment: environmentName, InfisicalToken: infisicalToken, FoldersPath: foldersPath})
+		if err != nil {
+			util.HandleError(err, "Unable to get folders")
+		}
+
+		visualize.PrintAllFoldersDetails(folders, foldersPath)
+		Telemetry.CaptureEvent("cli-command:folders get", posthog.NewProperties().Set("folderCount", len(folders)).Set("version", util.CLI_VERSION))
+	},
+}
+
+var createCmd = &cobra.Command{
+	Use:   "create",
+	Short: "Create a folder",
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		util.RequireLogin()
+		util.RequireLocalWorkspaceFile()
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		environmentName, _ := cmd.Flags().GetString("env")
+		if !cmd.Flags().Changed("env") {
+			environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
+			if environmentFromWorkspace != "" {
+				environmentName = environmentFromWorkspace
+			}
+		}
+
+		folderPath, err := cmd.Flags().GetString("path")
+		if err != nil {
+			util.HandleError(err, "Unable to parse flag")
+		}
+
+		folderName, err := cmd.Flags().GetString("name")
+		if err != nil {
+			util.HandleError(err, "Unable to parse name flag")
+		}
+
+		if folderName == "" {
+			util.HandleError(fmt.Errorf("Invalid folder name"), "Folder name cannot be empty")
+		}
+
+		workspaceFile, err := util.GetWorkSpaceFromFile()
+		if err != nil {
+			util.HandleError(err, "Unable to get workspace file")
+		}
+
+		params := models.CreateFolderParameters{
+			FolderName:  folderName,
+			WorkspaceId: workspaceFile.WorkspaceId,
+			Environment: environmentName,
+			FolderPath:  folderPath,
+		}
+
+		_, err = util.CreateFolder(params)
+		if err != nil {
+			util.HandleError(err, "Unable to create folder")
+		}
+
+		util.PrintSuccessMessage(fmt.Sprintf("folder named `%s` created in path %s", folderName, folderPath))
+
+		Telemetry.CaptureEvent("cli-command:folders create", posthog.NewProperties().Set("version", util.CLI_VERSION))
+	},
+}
+
+var deleteCmd = &cobra.Command{
+	Use:   "delete",
+	Short: "Delete a folder",
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		util.RequireLogin()
+		util.RequireLocalWorkspaceFile()
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+
+		environmentName, _ := cmd.Flags().GetString("env")
+		if !cmd.Flags().Changed("env") {
+			environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
+			if environmentFromWorkspace != "" {
+				environmentName = environmentFromWorkspace
+			}
+		}
+
+		folderPath, err := cmd.Flags().GetString("path")
+		if err != nil {
+			util.HandleError(err, "Unable to parse flag")
+		}
+
+		folderName, err := cmd.Flags().GetString("name")
+		if err != nil {
+			util.HandleError(err, "Unable to parse name flag")
+		}
+
+		if folderName == "" {
+			util.HandleError(fmt.Errorf("Invalid folder name"), "Folder name cannot be empty")
+		}
+
+		workspaceFile, err := util.GetWorkSpaceFromFile()
+		if err != nil {
+			util.HandleError(err, "Unable to get workspace file")
+		}
+
+		params := models.DeleteFolderParameters{
+			FolderName:  folderName,
+			WorkspaceId: workspaceFile.WorkspaceId,
+			Environment: environmentName,
+			FolderPath:  folderPath,
+		}
+
+		_, err = util.DeleteFolder(params)
+		if err != nil {
+			util.HandleError(err, "Unable to delete folder")
+		}
+
+		util.PrintSuccessMessage(fmt.Sprintf("folder named `%s` deleted in path %s", folderName, folderPath))
+
+		Telemetry.CaptureEvent("cli-command:folders delete", posthog.NewProperties().Set("version", util.CLI_VERSION))
+	},
+}
--- a/cli/packages/cmd/secrets.go
+++ b/cli/packages/cmd/secrets.go
@ -679,6 +679,28 @@ func init() {
 		util.RequireLocalWorkspaceFile()
 	}

+	// *** Folders sub command ***
+	folderCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
+
+	// Add getCmd, createCmd and deleteCmd flags here
+	getCmd.Flags().StringP("path", "p", "/", "The path from where folders should be fetched from")
+	getCmd.Flags().String("token", "", "Fetch folders using the infisical token")
+	folderCmd.AddCommand(getCmd)
+
+	// Add createCmd flags here
+	createCmd.Flags().StringP("path", "p", "/", "Path to where the folder should be created")
+	createCmd.Flags().StringP("name", "n", "", "Name of the folder to be created")
+	folderCmd.AddCommand(createCmd)
+
+	// Add deleteCmd flags here
+	deleteCmd.Flags().StringP("path", "p", "/", "Path to the folder to be deleted")
+	deleteCmd.Flags().StringP("name", "n", "", "Name of the folder to be deleted")
+	folderCmd.AddCommand(deleteCmd)
+
+	secretsCmd.AddCommand(folderCmd)
+
+	// ** End of folders sub command
+
 	secretsCmd.Flags().String("token", "", "Fetch secrets using the Infisical Token")
 	secretsCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
 	secretsCmd.Flags().Bool("expand", true, "Parse shell parameter expansions in your secrets")
--- a/cli/packages/models/cli.go
+++ b/cli/packages/models/cli.go
@ -34,6 +34,11 @@ type SingleEnvironmentVariable struct {
 	Comment string `json:"comment"`
 }

+type SingleFolder struct {
+	ID   string `json:"_id"`
+	Name string `json:"name"`
+}
+
 type Workspace struct {
 	ID           string `json:"_id"`
 	Name         string `json:"name"`
@ -63,3 +68,26 @@ type GetAllSecretsParameters struct {
 	SecretsPath              string
 	IncludeImport            bool
 }
+
+type GetAllFoldersParameters struct {
+	WorkspaceId    string
+	Environment    string
+	FoldersPath    string
+	InfisicalToken string
+}
+
+type CreateFolderParameters struct {
+	FolderName     string
+	WorkspaceId    string
+	Environment    string
+	FolderPath     string
+	InfisicalToken string
+}
+
+type DeleteFolderParameters struct {
+	FolderName     string
+	WorkspaceId    string
+	Environment    string
+	FolderPath     string
+	InfisicalToken string
+}
--- a/cli/packages/util/folders.go
+++ b/cli/packages/util/folders.go
@ -0,0 +1,212 @@
+package util
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/Infisical/infisical-merge/packages/api"
+	"github.com/Infisical/infisical-merge/packages/models"
+	"github.com/go-resty/resty/v2"
+	"github.com/rs/zerolog/log"
+)
+
+func GetAllFolders(params models.GetAllFoldersParameters) ([]models.SingleFolder, error) {
+
+	if params.InfisicalToken == "" {
+		params.InfisicalToken = os.Getenv(INFISICAL_TOKEN_NAME)
+	}
+
+	var foldersToReturn []models.SingleFolder
+	var folderErr error
+	if params.InfisicalToken == "" {
+
+		log.Debug().Msg("GetAllFolders: Trying to fetch folders using logged in details")
+
+		loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
+		if err != nil {
+			return nil, err
+		}
+
+		if loggedInUserDetails.LoginExpired {
+			PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
+		}
+
+		workspaceFile, err := GetWorkSpaceFromFile()
+		if err != nil {
+			return nil, err
+		}
+
+		if params.WorkspaceId != "" {
+			workspaceFile.WorkspaceId = params.WorkspaceId
+		}
+
+		folders, err := GetFoldersViaJTW(loggedInUserDetails.UserCredentials.JTWToken, workspaceFile.WorkspaceId, params.Environment, params.FoldersPath)
+		folderErr = err
+		foldersToReturn = folders
+	} else {
+		// get folders via service token
+		folders, err := GetFoldersViaServiceToken(params.InfisicalToken, params.WorkspaceId, params.Environment, params.FoldersPath)
+		folderErr = err
+		foldersToReturn = folders
+	}
+	return foldersToReturn, folderErr
+}
+
+func GetFoldersViaJTW(JTWToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
+	// set up resty client
+	httpClient := resty.New()
+	httpClient.SetAuthToken(JTWToken).
+		SetHeader("Accept", "application/json")
+
+	getFoldersRequest := api.GetFoldersV1Request{
+		WorkspaceId: workspaceId,
+		Environment: environmentName,
+		FoldersPath: foldersPath,
+	}
+
+	apiResponse, err := api.CallGetFoldersV1(httpClient, getFoldersRequest)
+	if err != nil {
+		return nil, err
+	}
+
+	var folders []models.SingleFolder
+
+	for _, folder := range apiResponse.Folders {
+		folders = append(folders, models.SingleFolder{
+			Name: folder.Name,
+			ID:   folder.ID,
+		})
+	}
+
+	return folders, nil
+}
+
+func GetFoldersViaServiceToken(fullServiceToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
+	serviceTokenParts := strings.SplitN(fullServiceToken, ".", 4)
+	if len(serviceTokenParts) < 4 {
+		return nil, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
+	}
+
+	serviceToken := fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
+
+	httpClient := resty.New()
+
+	httpClient.SetAuthToken(serviceToken).
+		SetHeader("Accept", "application/json")
+
+	serviceTokenDetails, err := api.CallGetServiceTokenDetailsV2(httpClient)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get service token details. [err=%v]", err)
+	}
+
+	// if multiple scopes are there then user needs to specify which environment and folder path
+	if environmentName == "" {
+		if len(serviceTokenDetails.Scopes) != 1 {
+			return nil, fmt.Errorf("you need to provide the --env for multiple environment scoped token")
+		} else {
+			environmentName = serviceTokenDetails.Scopes[0].Environment
+		}
+	}
+
+	getFoldersRequest := api.GetFoldersV1Request{
+		WorkspaceId: serviceTokenDetails.Workspace,
+		Environment: environmentName,
+		FoldersPath: foldersPath,
+	}
+
+	apiResponse, err := api.CallGetFoldersV1(httpClient, getFoldersRequest)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get folders. [err=%v]", err)
+	}
+
+	var folders []models.SingleFolder
+
+	for _, folder := range apiResponse.Folders {
+		folders = append(folders, models.SingleFolder{
+			Name: folder.Name,
+			ID:   folder.ID,
+		})
+	}
+
+	return folders, nil
+}
+
+// CreateFolder creates a folder in Infisical
+func CreateFolder(params models.CreateFolderParameters) (models.SingleFolder, error) {
+	loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
+	if err != nil {
+		return models.SingleFolder{}, err
+	}
+
+	if loggedInUserDetails.LoginExpired {
+		PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
+	}
+
+	// set up resty client
+	httpClient := resty.New()
+	httpClient.
+		SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken).
+		SetHeader("Accept", "application/json").
+		SetHeader("Content-Type", "application/json")
+
+	createFolderRequest := api.CreateFolderV1Request{
+		WorkspaceId: params.WorkspaceId,
+		Environment: params.Environment,
+		FolderName:  params.FolderName,
+		Directory:   params.FolderPath,
+	}
+
+	apiResponse, err := api.CallCreateFolderV1(httpClient, createFolderRequest)
+	if err != nil {
+		return models.SingleFolder{}, err
+	}
+
+	folder := apiResponse.Folder
+
+	return models.SingleFolder{
+		Name: folder.Name,
+		ID:   folder.ID,
+	}, nil
+}
+
+func DeleteFolder(params models.DeleteFolderParameters) ([]models.SingleFolder, error) {
+	loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
+	if err != nil {
+		return nil, err
+	}
+
+	if loggedInUserDetails.LoginExpired {
+		PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
+	}
+
+	// set up resty client
+	httpClient := resty.New()
+	httpClient.
+		SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken).
+		SetHeader("Accept", "application/json").
+		SetHeader("Content-Type", "application/json")
+
+	deleteFolderRequest := api.DeleteFolderV1Request{
+		WorkspaceId: params.WorkspaceId,
+		Environment: params.Environment,
+		FolderName:  params.FolderName,
+		Directory:   params.FolderPath,
+	}
+
+	apiResponse, err := api.CallDeleteFolderV1(httpClient, deleteFolderRequest)
+	if err != nil {
+		return nil, err
+	}
+
+	var folders []models.SingleFolder
+
+	for _, folder := range apiResponse.Folders {
+		folders = append(folders, models.SingleFolder{
+			Name: folder.Name,
+			ID:   folder.ID,
+		})
+	}
+
+	return folders, nil
+}
--- a/cli/packages/util/secrets.go
+++ b/cli/packages/util/secrets.go
@ -152,6 +152,46 @@ func GetPlainTextSecretsViaJTW(JTWToken string, receiversPrivateKey string, work
 	return plainTextSecrets, nil
 }

+func GetPlainTextSecretsViaMachineIdentity(accessToken string, workspaceId string, environmentName string, secretsPath string, includeImports bool) ([]models.SingleEnvironmentVariable, error) {
+	httpClient := resty.New()
+	httpClient.SetAuthToken(accessToken).
+		SetHeader("Accept", "application/json")
+
+	getSecretsRequest := api.GetEncryptedSecretsV3Request{
+		WorkspaceId:   workspaceId,
+		Environment:   environmentName,
+		IncludeImport: includeImports,
+		// TagSlugs:    tagSlugs,
+	}
+
+	if secretsPath != "" {
+		getSecretsRequest.SecretPath = secretsPath
+	}
+
+	rawSecrets, err := api.CallGetRawSecretsV3(httpClient, api.GetRawSecretsV3Request{WorkspaceId: workspaceId, SecretPath: environmentName, Environment: environmentName})
+	if err != nil {
+		return nil, err
+	}
+
+	plainTextSecrets := []models.SingleEnvironmentVariable{}
+	if err != nil {
+		return nil, fmt.Errorf("unable to decrypt your secrets [err=%v]", err)
+	}
+
+	for _, secret := range rawSecrets.Secrets {
+		plainTextSecrets = append(plainTextSecrets, models.SingleEnvironmentVariable{Key: secret.SecretKey, Value: secret.SecretValue})
+	}
+
+	// if includeImports {
+	// 	plainTextSecrets, err = InjectImportedSecret(plainTextWorkspaceKey, plainTextSecrets, encryptedSecrets.ImportedSecrets)
+	// 	if err != nil {
+	// 		return nil, err
+	// 	}
+	// }
+
+	return plainTextSecrets, nil
+}
+
 func InjectImportedSecret(plainTextWorkspaceKey []byte, secrets []models.SingleEnvironmentVariable, importedSecrets []api.ImportedSecretV3) ([]models.SingleEnvironmentVariable, error) {
 	if importedSecrets == nil {
 		return secrets, nil
--- a/cli/packages/visualize/folders.go
+++ b/cli/packages/visualize/folders.go
@ -0,0 +1,14 @@
+package visualize
+
+import "github.com/Infisical/infisical-merge/packages/models"
+
+func PrintAllFoldersDetails(folders []models.SingleFolder, path string) {
+	rows := [][3]string{}
+	for _, folder := range folders {
+		rows = append(rows, [...]string{folder.Name, path, folder.ID})
+	}
+
+	headers := [...]string{"FOLDER NAME", "PATH", "FOLDER ID"}
+
+	Table(headers, rows)
+}
--- a/cli/secret-render-template
+++ b/cli/secret-render-template
@ -0,0 +1,5 @@
+{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }}
+{{- range . }}
+{{ .Key }}={{ .Value }}
+{{- end }}
+{{- end }}
--- a/docs/changelog/overview.mdx
+++ b/docs/changelog/overview.mdx
@ -4,16 +4,34 @@ title: "Changelog"

 The changelog below reflects new product developments and updates on a monthly basis.

-## September
+## November 2023

+- Replaced internal [Winston](https://github.com/winstonjs/winston) with [Pino](https://github.com/pinojs/pino) logging library with external logging to AWS CloudWatch
+- Added admin panel to self-hosting experience.
+- Released [secret rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview) feature with preliminary support for rotating [SendGrid](https://infisical.com/docs/documentation/platform/secret-rotation/sendgrid), [PostgreSQL/CockroachDB](https://infisical.com/docs/documentation/platform/secret-rotation/postgres), and [MySQL/MariaDB](https://infisical.com/docs/documentation/platform/secret-rotation/mysql) credentials.
+- Released secret reminders feature.
+
+## October 2023
+
+- Added support for [GitLab SSO](https://infisical.com/docs/documentation/platform/sso/gitlab).
+- Became SOC 2 (Type II) certified.
+- Reduced required JWT configuration from 5-6 secrets to 1 secret for self-hosting Infisical.
+- Compacted Infisical into 1 Docker image.
+- Added native [Hasura Cloud integration](https://infisical.com/docs/integrations/cloud/hasura-cloud).
+- Updated resource deletion logic for user, organization, and project deletion.
+
+## September 2023
+
+- Released [secret approvals](https://infisical.com/docs/documentation/platform/pr-workflows) feature.
 - Released an update to access controls; every user role now clearly defines and enforces a certain set of conditions across Infisical.
 - Updated UI/UX for integrations. 
 - Added a native integration with [Qovery](https://infisical.com/docs/integrations/cloud/qovery).
+- Added service token generation capability for the CLI.

 ## August 2023

 - Release Audit Logs V2.
- Add support for GitHub SSO.
+- Add support for [GitHub SSO](https://infisical.com/docs/documentation/platform/sso/github).
 - Enable users to opt in for multiple authentication methods.
 - Improved password requirements including check against [Have I Been Pwnd Password API](https://haveibeenpwned.com/Passwords).
 - Added native [GCP Secret Manager integration](https://infisical.com/docs/integrations/cloud/gcp-secret-manager)
@ -31,8 +49,8 @@ The changelog below reflects new product developments and updates on a monthly b
 - Added native [Terraform Cloud integration](https://infisical.com/docs/integrations/cloud/terraform-cloud).
 - Added native [Northflank integration](https://infisical.com/docs/integrations/cloud/northflank).
 - Added native [Windmill integration](https://infisical.com/docs/integrations/cloud/windmill).
- Added support for Google SSO.
- Added support for [Okta](https://infisical.com/docs/documentation/platform/sso/okta), [Azure AD](https://infisical.com/docs/documentation/platform/sso/azure), and JumpCloud [SAML](https://infisical.com/docs/documentation/platform/saml) authentication.
+- Added support for [Google SSO](https://infisical.com/docs/documentation/platform/sso/google)
+- Added support for [Okta](https://infisical.com/docs/documentation/platform/sso/okta), [Azure AD](https://infisical.com/docs/documentation/platform/sso/azure), and [JumpCloud](https://infisical.com/docs/documentation/platform/sso/jumpcloud) [SAML](https://infisical.com/docs/documentation/platform/saml) authentication.
 - Released [folders / path-based secret storage](https://infisical.com/docs/documentation/platform/folder).
 - Released [webhooks](https://infisical.com/docs/documentation/platform/webhooks).

--- a/docs/contributing/code-of-conduct.mdx
+++ b/docs/contributing/code-of-conduct.mdx
@ -63,7 +63,7 @@ representative at an online or offline event.

 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-[INSERT CONTACT METHOD].
+team@infisical.com.
 All complaints will be reviewed and investigated promptly and fairly.

 All community leaders are obligated to respect the privacy and security of the
--- a/docs/documentation/platform/pr-workflows.mdx
+++ b/docs/documentation/platform/pr-workflows.mdx
@ -0,0 +1,33 @@
+---
+title: "PR Workflows"
+description: "Infisical PR Workflows allows you to create a set of policies to control secret operations."
+---
+
+## Problem at hand
+
+Updating secrets in high-stakes environments (e.g., production) can have a number of problematic issues: 
+- Most developers should not have access to secrets in production environments. Yet, they are the ones who often need to add new secrets or change the existing ones. Many organizations have in-house policies with regards to what person should be contacted in the case of needing to make changes to secrets. This slows down software development lifecycle and distracts engineers from working on things that matter the most.   
+- As a general rule, before making changes in production environments, those changes have to be looked over by at least another person. An extra pair of eyes can help reduce the risk of human error and make sure that the change will not affect the application in an unintended way. 
+- After making updates to secrets, the corresponding applications need to be redeployed with the right set of secrets and configurations. This process is often not automated and hence prone to human error. 
+
+## Solution
+
+As a wide-spread software engineering practice, developers have to submit their code as a PR that needs to be approved before the code is merged into the main branch. 
+
+In a similar way, to solve the above-mentioned issues, Infisical provides a feature called `PR Workflows` for secret management. This is a set of policies and workflows that help advance access controls, compliance procedures, and stability of a particular environment. In other words, **PR Workflows** help you secure, stabilize, and streamline the change of secrets in high-stakes environments. 
+
+### Setting a policy
+
+First, you would need to create a set of policies for a certain environment. In the example below you can see a generic policy for a production environment. In this case, any user who submits a change to `prod` would first have to get an approval by a predefined user (or multiple users).
+
+![create secret update policy](../../images/platform/pr-workflows/secret-update-policy.png)
+
+### Example of updating secrets with PR workflows
+
+When a user submits a change to an enviropnment that is under a particular policy, a corresponsing change request will go to a predefined approver (or multiple approvers). 
+
+![secret update change requests](../../images/platform/pr-workflows/secret-update-request.png)
+
+An approver is notified by email and/or Slack as soon as the request is initiated. In the Infisical Dashboard, they will be able to `approve` and `merge` (or `deny`) a request for a change in a particular environment. After that, depending on the workflows setup, the change will be automatically propagated to the right applications (e.g., using [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes)).
+
+![secrets update pull request](../../images/platform/pr-workflows/secret-update-pr.png)
--- a/docs/documentation/platform/role-based-access-controls.mdx
+++ b/docs/documentation/platform/role-based-access-controls.mdx
@ -0,0 +1,31 @@
+---
+title: "Role-based Access Controls"
+description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict access to resources and the range of actions that can performed."
+---
+
+### General access controls
+
+Access Control Policies provide a highly granular declarative way to grant or forbid access to certain resources and operations in Infisical. In general, access controls can be split up across projects and organizations.
+
+### Organization-level access controls
+
+By default, every user in a organization is either an **admin** or a **member**. 
+
+Admins are able to perform every action with the organization, including adding and removing organization members, managing access controls, setting up security settings, and creating new projects. Members, on the other hand, are restricted from removing organization members, modifying billing information, updating access controls, and performing a number of other actions. 
+
+Overall, organization-level access controls are significantly of administrative nature. Access to projects, secrets and other sensitive data is specified on the project level. 
+
+![Org member role](../../images/platform/rbac/org-member-role.png)
+
+### Project-level access controls
+
+By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode. 
+
+### Creating custom roles
+
+By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for: 
+- Creating superadmin roles, roles specific to SRE engineers, etc. 
+- Restricting access of users to specific secrets, folders, and environments. 
+- Embedding these specific roles into [PR Workflow policies](https://infisical.com/docs/documentation/platform/pr-workflows)
+
+![project member custom role](../../images/platform/rbac/project-member-custom-role.png)
--- a/docs/images/agent/infisical-agent-diagram.png
+++ b/docs/images/agent/infisical-agent-diagram.png
--- a/docs/images/platform/pr-workflows/secret-update-policy.png
+++ b/docs/images/platform/pr-workflows/secret-update-policy.png
--- a/docs/images/platform/pr-workflows/secret-update-pr.png
+++ b/docs/images/platform/pr-workflows/secret-update-pr.png
--- a/docs/images/platform/pr-workflows/secret-update-request.png
+++ b/docs/images/platform/pr-workflows/secret-update-request.png
--- a/docs/images/platform/rbac/org-member-role.png
+++ b/docs/images/platform/rbac/org-member-role.png
--- a/docs/images/platform/rbac/project-member-custom-role.png
+++ b/docs/images/platform/rbac/project-member-custom-role.png
--- a/docs/infisical-agent/overview.mdx
+++ b/docs/infisical-agent/overview.mdx
@ -0,0 +1,93 @@
+---
+title: "Infisical Agent"
+---
+
+Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
+It eliminates the need to modify application logic by enabling clients to decide how they want their secrets rendered through the use of templates.
+
+<img height="200" src="../images/agent/infisical-agent-diagram.png" />
+
+### Key features:
+- Token renewal: Automatically authenticates with Infisical and deposits renewed access tokens at specified path for applications to consume
+- Templating: Renders secrets via user provided templates to desired formats for applications to consume
+
+### Token renewal
+The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a Method, which is the authentication process suitable for your current setup, and Sinks, which are the places where the agent deposits the new access token whenever it receives updates.
+
+When the Infisical Agent is started, it will attempt to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt. 
+
+Once a access token is successfully fetched, the agent will make sure the access token stays valid, continuing to renew it before it expires.
+
+Every time the agent successfully retrieves a new access token, it writes the new token to the Sinks you've configured.
+
+<Info>
+  Access tokens can be utilized with Infisical SDKs or directly in API requests to retrieve secrets from Infisical
+</Info>
+
+### Templating
+The Infisical agent can help deliver formatted secrets to your application in a variety of environments. To achieve this, the agent will retrieve secrets from Infisical, format them using a specified template, and then save these formatted secrets to a designated file path. 
+
+Templating process is done through the use of Go language's [text/template feature](https://pkg.go.dev/text/template). Multiple template definitions can be set in the agent configuration file to generate a variety of formatted secret files.
+
+When the agent is started and templates are defined in the agent configuration file, the agent will attempt to acquire a valid access token using the set authentication method outlined in the agent's configuration. 
+If this initial attempt is unsuccessful, the agent will momentarily pauses before continuing to make more attempts.
+
+Once the agent successfully obtains a valid access token, the agent proceeds to fetch the secrets from Infisical using it. 
+It then formats these secrets using the user provided templates and writes the formatted data to configured file paths.
+
+## Agent configuration file 
+
+To set up the authentication method for token renewal and to define secret templates, the Infisical agent requires a YAML configuration file containing properties defined below. 
+While specifying an authentication method is mandatory to start the agent, configuring sinks and secret templates are optional.
+
+| Field                        | Description |
+| ---------------------------- | ----------- |
+| `infisical.address`          | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
+| `auth.type`                  | The type of authentication method used. Only `"token"` type is currently available |
+| `auth.config.token-path`     | The file path where the initial token for authentication is stored.  |
+| `sinks[].type`               | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
+| `sinks[].config.path`        | The file path where the access token should be stored for each sink in the list. |
+| `templates[].source-path`    | The path to the template file that should be used to render secrets. |
+| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
+
+
+## Quick start Infisical Agent
+To install the Infisical agent, you must first install the [Infisical CLI](../cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI.
+
+Once you have the CLI installed, you will need to create a agent configuration file in yaml. 
+
+```yaml example-agent-config-file.yaml
+infisical:
+  address: "https://app.infisical.com"
+auth:
+  type: "token"
+  config:
+    token-path: "/path/to/initial/token"
+sinks:
+  - type: "file"
+    config:
+      path: "/some/path/to/store/access-token/file-name"
+templates:
+  - source-path: my-dot-ev-secret-template
+    destination-path: /some/path/.env
+```
+
+Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template. 
+
+
+```text my-dot-ev-secret-template
+{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }}
+{{- range . }}
+{{ .Key }}={{ .Value }}
+{{- end }}
+{{- end }}
+```
+
+The secret template above will be used to render the secrets where the key and the value are separated by `=` sign. You'll notice that a custom function named `secret` is used to fetch the secrets. 
+This function takes the following arguments: `secret "<project-id>" "<environment-slug>" "<secret-path>"`. 
+
+```bash 
+infisical agent --config example-agent-config-file.yaml
+```
+
+After defining the agent configuration file, run the command above pointing to the path where the agent configuration is located. 
--- a/docs/internals/security.mdx
+++ b/docs/internals/security.mdx
@ -135,7 +135,7 @@ Lastly, Infisical enforces strong password requirements according to the guidanc

 ## Role-based access control (RBAC)

-Infisical's RBAC feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members.
+[Infisical's RBAC](https://infisical.com/docs/documentation/platform/role-based-access-controls) feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members.

 For example, you can define a role provisioning access to secrets in a specific project and environment in it with read-only permissions; the role can be assigned to members of an organization in Infisical.

--- a/docs/mint.json
+++ b/docs/mint.json
@ -120,6 +120,8 @@
        "documentation/platform/token",
        "documentation/platform/machine-identity",
        "documentation/platform/mfa",
+        "documentation/platform/pr-workflows",
+        "documentation/platform/role-based-access-controls",
        {
          "group": "Secret Rotation",
          "pages": [
@ -196,6 +198,12 @@
        "cli/faq"
      ]
    },
+    {
+      "group": "Agent",
+      "pages": [
+        "infisical-agent/overview"
+      ]
+    },
    {
      "group": "Integrations",
      "pages": ["integrations/overview"]
--- a/docs/self-hosting/deployment-options/standalone-infisical.mdx
+++ b/docs/self-hosting/deployment-options/standalone-infisical.mdx
@ -39,7 +39,7 @@ Other configs can be found [here](../configuration/envars)
 </ParamField>

 <ParamField query="REDIS_URL" type="string" default="none">
-  Redis connection string. Only required if you plan to use web integrations.
+  Redis connection string. Only required if you plan to use web integrations or secret reminders.
 </ParamField>


--- a/frontend/src/hooks/api/secrets/mutations.tsx
+++ b/frontend/src/hooks/api/secrets/mutations.tsx
@ -139,6 +139,8 @@ export const useUpdateSecretV3 = ({
      latestFileKey,
      tags,
      secretComment,
+      secretReminderRepeatDays,
+      secretReminderNote,
      newSecretName,
      skipMultilineEncoding
    }) => {
@ -157,6 +159,8 @@ export const useUpdateSecretV3 = ({
        workspaceId,
        environment,
        type,
+        secretReminderNote,
+        secretReminderRepeatDays,
        secretPath,
        secretId,
        ...encryptSecret(randomBytes, newSecretName ?? secretName, secretValue, secretComment),
--- a/frontend/src/hooks/api/secrets/queries.tsx
+++ b/frontend/src/hooks/api/secrets/queries.tsx
@ -69,6 +69,8 @@ export const decryptSecrets = (
      value: secretValue,
      tags: encSecret.tags,
      comment: secretComment,
+      reminderRepeatDays: encSecret.secretReminderRepeatDays,
+      reminderNote: encSecret.secretReminderNote,
      createdAt: encSecret.createdAt,
      updatedAt: encSecret.updatedAt,
      version: encSecret.version,
--- a/frontend/src/hooks/api/secrets/types.ts
+++ b/frontend/src/hooks/api/secrets/types.ts
@ -20,6 +20,8 @@ export type EncryptedSecret = {
  secretCommentCiphertext: string;
  secretCommentIV: string;
  secretCommentTag: string;
+  secretReminderRepeatDays?: number | null;
+  secretReminderNote?: string | null;
  tags: WsTag[];
 };

@ -29,6 +31,8 @@ export type DecryptedSecret = {
  key: string;
  value: string;
  comment: string;
+  reminderRepeatDays?: number | null;
+  reminderNote?: string | null;
  tags: WsTag[];
  createdAt: string;
  updatedAt: string;
@ -112,6 +116,8 @@ export type TUpdateSecretsV3DTO = {
  secretId?: string;
  secretValue: string;
  secretComment?: string;
+  secretReminderRepeatDays?: number | null;
+  secretReminderNote?: string | null;
  tags?: string[];
 };

--- a/frontend/src/views/SecretMainPage/components/SecretListView/CreateReminderForm.tsx
+++ b/frontend/src/views/SecretMainPage/components/SecretListView/CreateReminderForm.tsx
@ -0,0 +1,129 @@
+import { useEffect } from "react";
+import { Controller, useForm } from "react-hook-form";
+import { faClock } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { twMerge } from "tailwind-merge";
+import { z } from "zod";
+
+import { Button, FormControl, Input, Modal, ModalContent, TextArea } from "@app/components/v2";
+
+const ReminderFormSchema = z.object({
+  note: z.string().optional(),
+  days: z
+    .number()
+    .min(1, { message: "Must be at least 1 day" })
+    .max(365, { message: "Must be less than 365 days" })
+});
+export type TReminderFormSchema = z.infer<typeof ReminderFormSchema>;
+
+interface ReminderFormProps {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean, data?: TReminderFormSchema) => void;
+}
+
+export const CreateReminderForm = ({ isOpen, onOpenChange }: ReminderFormProps) => {
+  const {
+    register,
+    control,
+    reset,
+    setValue,
+    handleSubmit,
+    formState: { isSubmitting }
+  } = useForm<TReminderFormSchema>({
+    resolver: zodResolver(ReminderFormSchema)
+  });
+
+  const handleFormSubmit = async (data: TReminderFormSchema) => {
+    console.log(data);
+    onOpenChange(false, data);
+  };
+
+  useEffect(() => {
+    if (isOpen) {
+      reset();
+    }
+  }, [isOpen]);
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
+      <ModalContent
+        title="Create secret reminder"
+        // ? QUESTION: Should this specifically say its for secret rotation?
+        // ? Or should we be call it something more generic?
+        subTitle={
+          <div>
+            Set up a reminder for when this secret should be rotated. Everyone with access to this
+            project will be notified when the reminder is triggered.
+          </div>
+        }
+      >
+        <form onSubmit={handleSubmit(handleFormSubmit)}>
+          <div className="space-y-2">
+            <div>
+              <Controller
+                control={control}
+                name="days"
+                render={({ field, fieldState }) => (
+                  <>
+                    <FormControl
+                      className="mb-0"
+                      label="How many days between"
+                      isError={Boolean(fieldState.error)}
+                      errorText={fieldState.error?.message || ""}
+                    >
+                      <Input
+                        onChange={(el) => setValue("days", parseInt(el.target.value, 10))}
+                        type="number"
+                        placeholder="31"
+                      />
+                    </FormControl>
+                    <div
+                      className={twMerge(
+                        "mt-2 ml-1 text-xs",
+                        field.value ? "opacity-60" : "opacity-0"
+                      )}
+                    >
+                      Every {field.value > 1 ? `${field.value} days` : "day"}
+                    </div>
+                  </>
+                )}
+              />
+            </div>
+
+            <FormControl label="Note" className="mb-0">
+              <TextArea
+                placeholder="Remember to rotate the AWS secret every month."
+                className="border border-mineshaft-600 text-sm"
+                rows={8}
+                reSize="none"
+                cols={30}
+                {...register("note")}
+              />
+            </FormControl>
+          </div>
+          <div className="mt-7 flex items-center">
+            <Button
+              isDisabled={isSubmitting}
+              isLoading={isSubmitting}
+              key="layout-create-project-submit"
+              className="mr-4"
+              leftIcon={<FontAwesomeIcon icon={faClock} />}
+              type="submit"
+            >
+              Create reminder
+            </Button>
+            <Button
+              key="layout-cancel-create-project"
+              onClick={() => onOpenChange(false)}
+              variant="plain"
+              colorSchema="secondary"
+            >
+              Cancel
+            </Button>
+          </div>
+        </form>
+      </ModalContent>
+    </Modal>
+  );
+};
--- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx
+++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx
@ -1,9 +1,11 @@
+/* eslint-disable simple-import-sort/imports */
 import { memo, useEffect } from "react";
 import { Controller, useFieldArray, useForm } from "react-hook-form";
 import { subject } from "@casl/ability";
 import { faCheckCircle } from "@fortawesome/free-regular-svg-icons";
 import {
  faCheck,
+  faClock,
  faClose,
  faCodeBranch,
  faComment,
@ -17,7 +19,6 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { AnimatePresence, motion } from "framer-motion";
 import { twMerge } from "tailwind-merge";
-
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
  Button,
@ -49,6 +50,7 @@ import { DecryptedSecret } from "@app/hooks/api/secrets/types";
 import { WsTag } from "@app/hooks/api/types";

 import { formSchema, SecretActionType, TFormSchema } from "./SecretListView.utils";
+import { CreateReminderForm } from "./CreateReminderForm";

 type Props = {
  secret: DecryptedSecret;
@ -111,6 +113,7 @@ export const SecretItem = memo(

    const overrideAction = watch("overrideAction");
    const hasComment = Boolean(watch("comment"));
+    const hasReminder = Boolean(watch("reminderRepeatDays"));

    const selectedTags = watch("tags", []);
    const selectedTagsGroupById = selectedTags.reduce<Record<string, boolean>>(
@ -123,6 +126,7 @@ export const SecretItem = memo(
    });

    const [isSecValueCopied, setIsSecValueCopied] = useToggle(false);
+    const [createReminderFormOpen, setCreateReminderFormOpen] = useToggle(false);
    useEffect(() => {
      let timer: NodeJS.Timeout;
      if (isSecValueCopied) {
@ -148,6 +152,10 @@ export const SecretItem = memo(
          }
        );
        setValue("valueOverride", secret?.valueOverride, { shouldDirty: !isUnsavedOverride });
+        setValue("reminderRepeatDays", secret?.reminderRepeatDays, {
+          shouldDirty: !isUnsavedOverride
+        });
+        setValue("reminderNote", secret?.reminderNote, { shouldDirty: !isUnsavedOverride });
      } else {
        reset();
        setValue("overrideAction", SecretActionType.Modified, { shouldDirty: true });
@ -181,308 +189,349 @@ export const SecretItem = memo(
    };

    return (
-      <form onSubmit={handleSubmit(handleFormSubmit)}>
-        <div
-          className={twMerge(
-            "shadow-none border-b border-mineshaft-600 bg-mineshaft-800 hover:bg-mineshaft-700",
-            isDirty && "border-primary-400/50"
-          )}
-        >
-          <div className="flex group">
-            <div
-              className={twMerge(
-                "flex items-center justify-center w-11 px-4 py-3 h-11",
-                isDirty && "text-primary"
-              )}
-            >
-              <Checkbox
-                id={`checkbox-${secret._id}`}
-                isChecked={isSelected}
-                onCheckedChange={() => onToggleSecretSelect(secret._id)}
-                className={twMerge("group-hover:flex hidden ml-3", isSelected && "flex")}
-              />
-              <FontAwesomeIcon
-                icon={faKey}
-                className={twMerge("group-hover:hidden block ml-3", isSelected && "hidden")}
-              />
-            </div>
-            <div className="w-80 h-11 flex items-center px-4 py-2 flex-shrink-0">
-              <Controller
-                name="key"
-                control={control}
-                render={({ field }) => (
-                  <Input
-                    autoComplete="off"
-                    isReadOnly={isReadOnly}
-                    autoCapitalization={currentWorkspace?.autoCapitalization}
-                    variant="plain"
-                    isDisabled={isOverriden}
-                    {...field}
-                    className="w-full focus:text-bunker-100 focus:ring-transparent px-0"
+      <>
+        <CreateReminderForm
+          isOpen={createReminderFormOpen}
+          onOpenChange={(_, data) => {
+            setCreateReminderFormOpen.toggle();
+
+            if (data) {
+              setValue("reminderRepeatDays", data.days, { shouldDirty: true });
+              setValue("reminderNote", data.note, { shouldDirty: true });
+            }
+          }}
+        />
+
+        <form onSubmit={handleSubmit(handleFormSubmit)}>
+          <div
+            className={twMerge(
+              "border-b border-mineshaft-600 bg-mineshaft-800 shadow-none hover:bg-mineshaft-700",
+              isDirty && "border-primary-400/50"
+            )}
+          >
+            <div className="group flex">
+              <div
+                className={twMerge(
+                  "flex h-11 w-11 items-center justify-center px-4 py-3",
+                  isDirty && "text-primary"
+                )}
+              >
+                <Checkbox
+                  id={`checkbox-${secret._id}`}
+                  isChecked={isSelected}
+                  onCheckedChange={() => onToggleSecretSelect(secret._id)}
+                  className={twMerge("ml-3 hidden group-hover:flex", isSelected && "flex")}
+                />
+                <FontAwesomeIcon
+                  icon={faKey}
+                  className={twMerge("ml-3 block group-hover:hidden", isSelected && "hidden")}
+                />
+              </div>
+              <div className="flex h-11 w-80 flex-shrink-0 items-center px-4 py-2">
+                <Controller
+                  name="key"
+                  control={control}
+                  render={({ field }) => (
+                    <Input
+                      autoComplete="off"
+                      isReadOnly={isReadOnly}
+                      autoCapitalization={currentWorkspace?.autoCapitalization}
+                      variant="plain"
+                      isDisabled={isOverriden}
+                      {...field}
+                      className="w-full px-0 focus:text-bunker-100 focus:ring-transparent"
+                    />
+                  )}
+                />
+              </div>
+              <div
+                className="flex flex-grow items-center border-x border-mineshaft-600 py-1 pl-4 pr-2"
+                tabIndex={0}
+                role="button"
+              >
+                {isOverriden ? (
+                  <Controller
+                    name="valueOverride"
+                    key="value-overriden"
+                    control={control}
+                    render={({ field }) => (
+                      <SecretInput
+                        key="value-overriden"
+                        isVisible={isVisible}
+                        isReadOnly={isReadOnly}
+                        {...field}
+                        containerClassName="py-1.5 rounded-md transition-all group-hover:mr-2"
+                      />
+                    )}
+                  />
+                ) : (
+                  <Controller
+                    name="value"
+                    key="secret-value"
+                    control={control}
+                    render={({ field }) => (
+                      <SecretInput
+                        isReadOnly={isReadOnly}
+                        key="secret-value"
+                        isVisible={isVisible}
+                        {...field}
+                        containerClassName="py-1.5 rounded-md transition-all group-hover:mr-2"
+                      />
+                    )}
                  />
                )}
-              />
-            </div>
-            <div
-              className="flex-grow flex items-center border-x border-mineshaft-600 pl-4 pr-2 py-1"
-              tabIndex={0}
-              role="button"
-            >
-              {isOverriden ? (
-                <Controller
-                  name="valueOverride"
-                  key="value-overriden"
-                  control={control}
-                  render={({ field }) => (
-                    <SecretInput
-                      key="value-overriden"
-                      isVisible={isVisible}
-                      isReadOnly={isReadOnly}
-                      {...field}
-                      containerClassName="py-1.5 rounded-md transition-all group-hover:mr-2"
-                    />
-                  )}
-                />
-              ) : (
-                <Controller
-                  name="value"
-                  key="secret-value"
-                  control={control}
-                  render={({ field }) => (
-                    <SecretInput
-                      isReadOnly={isReadOnly}
-                      key="secret-value"
-                      isVisible={isVisible}
-                      {...field}
-                      containerClassName="py-1.5 rounded-md transition-all group-hover:mr-2"
-                    />
-                  )}
-                />
-              )}
-              <div key="actions" className="h-8 flex self-start flex-shrink-0 transition-all">
-                <Tooltip content="Copy secret">
-                  <IconButton
-                    ariaLabel="copy-value"
-                    variant="plain"
-                    size="sm"
-                    className="w-0 group-hover:w-5 group-hover:mr-2 overflow-hidden p-0"
-                    onClick={copyTokenToClipboard}
-                  >
-                    <FontAwesomeIcon icon={isSecValueCopied ? faCheck : faCopy} />
-                  </IconButton>
-                </Tooltip>
-                <DropdownMenu>
-                  <ProjectPermissionCan
-                    I={ProjectPermissionActions.Edit}
-                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
-                  >
-                    {(isAllowed) => (
-                      <DropdownMenuTrigger asChild disabled={!isAllowed}>
-                        <IconButton
-                          ariaLabel="tags"
-                          variant="plain"
-                          size="sm"
-                          className={twMerge(
-                            "w-0 group-hover:w-5 group-hover:mr-2 overflow-hidden p-0 data-[state=open]:w-5",
-                            hasTagsApplied && "w-5 text-primary"
-                          )}
-                          isDisabled={!isAllowed}
-                        >
-                          <Tooltip content="Tags">
-                            <FontAwesomeIcon icon={faTags} />
-                          </Tooltip>
-                        </IconButton>
-                      </DropdownMenuTrigger>
-                    )}
-                  </ProjectPermissionCan>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuLabel>Apply tags to this secrets</DropdownMenuLabel>
-                    {tags.map((tag) => {
-                      const { _id: tagId, name, tagColor } = tag;
-
-                      const isTagSelected = selectedTagsGroupById?.[tagId];
-                      return (
-                        <DropdownMenuItem
-                          onClick={() => handleTagSelect(tag)}
-                          key={tagId}
-                          icon={isTagSelected && <FontAwesomeIcon icon={faCheckCircle} />}
-                          iconPos="right"
-                        >
-                          <div className="flex items-center">
-                            <div
-                              className="w-2 h-2 rounded-full mr-2"
-                              style={{ background: tagColor || "#bec2c8" }}
-                            />
-                            {name}
-                          </div>
-                        </DropdownMenuItem>
-                      );
-                    })}
-                    <DropdownMenuItem className="px-1.5">
-                      <Button
-                        size="xs"
-                        className="w-full"
-                        colorSchema="primary"
-                        variant="outline_bg"
-                        leftIcon={<FontAwesomeIcon icon={faTag} />}
-                        onClick={onCreateTag}
-                      >
-                        Create a tag
-                      </Button>
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-                <ProjectPermissionCan
-                  I={ProjectPermissionActions.Edit}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
-                  renderTooltip
-                  allowedLabel="Override"
-                >
-                  {(isAllowed) => (
+                <div key="actions" className="flex h-8 flex-shrink-0 self-start transition-all">
+                  <Tooltip content="Copy secret">
                    <IconButton
-                      ariaLabel="override-value"
-                      isDisabled={!isAllowed}
+                      ariaLabel="copy-value"
                      variant="plain"
                      size="sm"
-                      onClick={handleOverrideClick}
-                      className={twMerge(
-                        "w-0 group-hover:w-5 group-hover:mr-2 overflow-hidden p-0",
-                        isOverriden && "w-5 text-primary"
-                      )}
+                      className="w-0 overflow-hidden p-0 group-hover:mr-2 group-hover:w-5"
+                      onClick={copyTokenToClipboard}
                    >
-                      <FontAwesomeIcon icon={faCodeBranch} />
+                      <FontAwesomeIcon icon={isSecValueCopied ? faCheck : faCopy} />
                    </IconButton>
-                  )}
-                </ProjectPermissionCan>
-                <Popover>
+                  </Tooltip>
+                  <DropdownMenu>
+                    <ProjectPermissionCan
+                      I={ProjectPermissionActions.Edit}
+                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                    >
+                      {(isAllowed) => (
+                        <DropdownMenuTrigger asChild disabled={!isAllowed}>
+                          <IconButton
+                            ariaLabel="tags"
+                            variant="plain"
+                            size="sm"
+                            className={twMerge(
+                              "w-0 overflow-hidden p-0 group-hover:mr-2 group-hover:w-5 data-[state=open]:w-5",
+                              hasTagsApplied && "w-5 text-primary"
+                            )}
+                            isDisabled={!isAllowed}
+                          >
+                            <Tooltip content="Tags">
+                              <FontAwesomeIcon icon={faTags} />
+                            </Tooltip>
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                      )}
+                    </ProjectPermissionCan>
+                    <DropdownMenuContent align="end">
+                      <DropdownMenuLabel>Apply tags to this secrets</DropdownMenuLabel>
+                      {tags.map((tag) => {
+                        const { _id: tagId, name, tagColor } = tag;
+
+                        const isTagSelected = selectedTagsGroupById?.[tagId];
+                        return (
+                          <DropdownMenuItem
+                            onClick={() => handleTagSelect(tag)}
+                            key={tagId}
+                            icon={isTagSelected && <FontAwesomeIcon icon={faCheckCircle} />}
+                            iconPos="right"
+                          >
+                            <div className="flex items-center">
+                              <div
+                                className="mr-2 h-2 w-2 rounded-full"
+                                style={{ background: tagColor || "#bec2c8" }}
+                              />
+                              {name}
+                            </div>
+                          </DropdownMenuItem>
+                        );
+                      })}
+                      <DropdownMenuItem className="px-1.5">
+                        <Button
+                          size="xs"
+                          className="w-full"
+                          colorSchema="primary"
+                          variant="outline_bg"
+                          leftIcon={<FontAwesomeIcon icon={faTag} />}
+                          onClick={onCreateTag}
+                        >
+                          Create a tag
+                        </Button>
+                      </DropdownMenuItem>
+                    </DropdownMenuContent>
+                  </DropdownMenu>
                  <ProjectPermissionCan
                    I={ProjectPermissionActions.Edit}
                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
-                  >
-                    {(isAllowed) => (
-                      <PopoverTrigger asChild disabled={!isAllowed}>
-                        <IconButton
-                          className={twMerge(
-                            "overflow-hidden w-0 p-0 group-hover:w-5 group-hover:mr-2 data-[state=open]:w-6",
-                            hasComment && "w-5 text-primary"
-                          )}
-                          variant="plain"
-                          size="md"
-                          ariaLabel="add-comment"
-                          isDisabled={!isAllowed}
-                        >
-                          <Tooltip content="Comment">
-                            <FontAwesomeIcon icon={faComment} />
-                          </Tooltip>
-                        </IconButton>
-                      </PopoverTrigger>
-                    )}
-                  </ProjectPermissionCan>
-                  <PopoverContent
-                    className="w-auto border border-mineshaft-600 bg-mineshaft-800 p-2 drop-shadow-2xl"
-                    sticky="always"
-                  >
-                    <FormControl label="Comment" className="mb-0">
-                      <TextArea
-                        className="border border-mineshaft-600 text-sm"
-                        rows={8}
-                        cols={30}
-                        {...register("comment")}
-                      />
-                    </FormControl>
-                  </PopoverContent>
-                </Popover>
-              </div>
-            </div>
-            <AnimatePresence exitBeforeEnter>
-              {!isDirty ? (
-                <motion.div
-                  key="options"
-                  className="h-10 flex items-center space-x-4 flex-shrink-0 px-3"
-                  initial={{ x: 0, opacity: 0 }}
-                  animate={{ x: 0, opacity: 1 }}
-                  exit={{ x: 10, opacity: 0 }}
-                >
-                  <Tooltip content="More">
-                    <IconButton
-                      ariaLabel="more"
-                      variant="plain"
-                      size="md"
-                      className="group-hover:opacity-100 opacity-0 p-0"
-                      onClick={() => onDetailViewSecret(secret)}
-                    >
-                      <FontAwesomeIcon icon={faEllipsis} size="lg" />
-                    </IconButton>
-                  </Tooltip>
-                  <ProjectPermissionCan
-                    I={ProjectPermissionActions.Delete}
-                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
                    renderTooltip
-                    allowedLabel="Delete"
+                    allowedLabel="Override"
                  >
                    {(isAllowed) => (
                      <IconButton
-                        ariaLabel="delete-value"
-                        variant="plain"
-                        colorSchema="danger"
-                        size="md"
-                        className="group-hover:opacity-100 opacity-0 p-0"
-                        onClick={() => onDeleteSecret(secret)}
+                        ariaLabel="override-value"
                        isDisabled={!isAllowed}
+                        variant="plain"
+                        size="sm"
+                        onClick={handleOverrideClick}
+                        className={twMerge(
+                          "w-0 overflow-hidden p-0 group-hover:mr-2 group-hover:w-5",
+                          isOverriden && "w-5 text-primary"
+                        )}
                      >
-                        <FontAwesomeIcon icon={faClose} size="lg" />
+                        <FontAwesomeIcon icon={faCodeBranch} />
                      </IconButton>
                    )}
                  </ProjectPermissionCan>
-                </motion.div>
-              ) : (
-                <motion.div
-                  key="options-save"
-                  className="h-10 flex items-center space-x-4 flex-shrink-0 px-3"
-                  initial={{ x: -10, opacity: 0 }}
-                  animate={{ x: 0, opacity: 1 }}
-                  exit={{ x: -10, opacity: 0 }}
-                >
-                  <Tooltip content="Save">
+
+                  {!isOverriden && (
                    <IconButton
-                      ariaLabel="more"
-                      variant="plain"
-                      type="submit"
-                      size="md"
                      className={twMerge(
-                        "group-hover:opacity-100 opacity-0 p-0 text-primary",
-                        isDirty && "opacity-100"
+                        "w-0 overflow-hidden p-0 group-hover:mr-2 group-hover:w-5 data-[state=open]:w-6",
+                        hasReminder && "w-5 text-primary"
                      )}
-                      isDisabled={isSubmitting}
-                    >
-                      {isSubmitting ? (
-                        <Spinner className="w-4 h-4 p-0 m-0" />
-                      ) : (
-                        <FontAwesomeIcon icon={faCheck} size="lg" className="text-primary" />
-                      )}
-                    </IconButton>
-                  </Tooltip>
-                  <Tooltip content="Cancel">
-                    <IconButton
-                      ariaLabel="more"
                      variant="plain"
                      size="md"
-                      className={twMerge(
-                        "group-hover:opacity-100 opacity-0 p-0",
-                        isDirty && "opacity-100"
-                      )}
-                      onClick={() => reset()}
-                      isDisabled={isSubmitting}
+                      ariaLabel="add-reminder"
                    >
-                      <FontAwesomeIcon icon={faClose} size="lg" />
+                      <Tooltip content="Reminder">
+                        <FontAwesomeIcon
+                          onClick={() => {
+                            if (!hasReminder) {
+                              setCreateReminderFormOpen.on();
+                            } else {
+                              setValue("reminderRepeatDays", null, { shouldDirty: true });
+                              setValue("reminderNote", null, { shouldDirty: true });
+                            }
+                          }}
+                          icon={faClock}
+                        />
+                      </Tooltip>
                    </IconButton>
-                  </Tooltip>
-                </motion.div>
-              )}
-            </AnimatePresence>
+                  )}
+
+                  <Popover>
+                    <ProjectPermissionCan
+                      I={ProjectPermissionActions.Edit}
+                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                    >
+                      {(isAllowed) => (
+                        <PopoverTrigger asChild disabled={!isAllowed}>
+                          <IconButton
+                            className={twMerge(
+                              "w-0 overflow-hidden p-0 group-hover:mr-2 group-hover:w-5 data-[state=open]:w-6",
+                              hasComment && "w-5 text-primary"
+                            )}
+                            variant="plain"
+                            size="md"
+                            ariaLabel="add-comment"
+                            isDisabled={!isAllowed}
+                          >
+                            <Tooltip content="Comment">
+                              <FontAwesomeIcon icon={faComment} />
+                            </Tooltip>
+                          </IconButton>
+                        </PopoverTrigger>
+                      )}
+                    </ProjectPermissionCan>
+                    <PopoverContent
+                      className="w-auto border border-mineshaft-600 bg-mineshaft-800 p-2 drop-shadow-2xl"
+                      sticky="always"
+                    >
+                      <FormControl label="Comment" className="mb-0">
+                        <TextArea
+                          className="border border-mineshaft-600 text-sm"
+                          rows={8}
+                          cols={30}
+                          {...register("comment")}
+                        />
+                      </FormControl>
+                    </PopoverContent>
+                  </Popover>
+                </div>
+              </div>
+              <AnimatePresence exitBeforeEnter>
+                {!isDirty ? (
+                  <motion.div
+                    key="options"
+                    className="flex h-10 flex-shrink-0 items-center space-x-4 px-3"
+                    initial={{ x: 0, opacity: 0 }}
+                    animate={{ x: 0, opacity: 1 }}
+                    exit={{ x: 10, opacity: 0 }}
+                  >
+                    <Tooltip content="More">
+                      <IconButton
+                        ariaLabel="more"
+                        variant="plain"
+                        size="md"
+                        className="p-0 opacity-0 group-hover:opacity-100"
+                        onClick={() => onDetailViewSecret(secret)}
+                      >
+                        <FontAwesomeIcon icon={faEllipsis} size="lg" />
+                      </IconButton>
+                    </Tooltip>
+                    <ProjectPermissionCan
+                      I={ProjectPermissionActions.Delete}
+                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      renderTooltip
+                      allowedLabel="Delete"
+                    >
+                      {(isAllowed) => (
+                        <IconButton
+                          ariaLabel="delete-value"
+                          variant="plain"
+                          colorSchema="danger"
+                          size="md"
+                          className="p-0 opacity-0 group-hover:opacity-100"
+                          onClick={() => onDeleteSecret(secret)}
+                          isDisabled={!isAllowed}
+                        >
+                          <FontAwesomeIcon icon={faClose} size="lg" />
+                        </IconButton>
+                      )}
+                    </ProjectPermissionCan>
+                  </motion.div>
+                ) : (
+                  <motion.div
+                    key="options-save"
+                    className="flex h-10 flex-shrink-0 items-center space-x-4 px-3"
+                    initial={{ x: -10, opacity: 0 }}
+                    animate={{ x: 0, opacity: 1 }}
+                    exit={{ x: -10, opacity: 0 }}
+                  >
+                    <Tooltip content="Save">
+                      <IconButton
+                        ariaLabel="more"
+                        variant="plain"
+                        type="submit"
+                        size="md"
+                        className={twMerge(
+                          "p-0 text-primary opacity-0 group-hover:opacity-100",
+                          isDirty && "opacity-100"
+                        )}
+                        isDisabled={isSubmitting}
+                      >
+                        {isSubmitting ? (
+                          <Spinner className="m-0 h-4 w-4 p-0" />
+                        ) : (
+                          <FontAwesomeIcon icon={faCheck} size="lg" className="text-primary" />
+                        )}
+                      </IconButton>
+                    </Tooltip>
+                    <Tooltip content="Cancel">
+                      <IconButton
+                        ariaLabel="more"
+                        variant="plain"
+                        size="md"
+                        className={twMerge(
+                          "p-0 opacity-0 group-hover:opacity-100",
+                          isDirty && "opacity-100"
+                        )}
+                        onClick={() => reset()}
+                        isDisabled={isSubmitting}
+                      >
+                        <FontAwesomeIcon icon={faClose} size="lg" />
+                      </IconButton>
+                    </Tooltip>
+                  </motion.div>
+                )}
+              </AnimatePresence>
+            </div>
          </div>
-        </div>
-      </form>
+        </form>
+      </>
    );
  }
 );
--- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx
+++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx
@ -122,6 +122,8 @@ export const SecretListView = ({
    {
      value,
      comment,
+      reminderRepeatDays,
+      reminderNote,
      tags,
      skipMultilineEncoding,
      newKey,
@ -129,6 +131,8 @@ export const SecretListView = ({
    }: Partial<{
      value: string;
      comment: string;
+      reminderRepeatDays: number | null;
+      reminderNote: string | null;
      tags: string[];
      skipMultilineEncoding: boolean;
      newKey: string;
@ -159,6 +163,8 @@ export const SecretListView = ({
        latestFileKey: decryptFileKey,
        tags,
        secretComment: comment,
+        secretReminderRepeatDays: reminderRepeatDays,
+        secretReminderNote: reminderNote,
        skipMultilineEncoding,
        newSecretName: newKey
      });
@ -188,16 +194,33 @@ export const SecretListView = ({
      cb?: () => void
    ) => {
      const { key: oldKey } = orgSecret;
-      const { key, value, overrideAction, idOverride, valueOverride, tags, comment } = modSecret;
+      const {
+        key,
+        value,
+        overrideAction,
+        idOverride,
+        valueOverride,
+        tags,
+        comment,
+        reminderRepeatDays,
+        reminderNote
+      } = modSecret;
      const hasKeyChanged = oldKey !== key;

      const tagIds = tags.map(({ _id }) => _id);
      const oldTagIds = orgSecret.tags.map(({ _id }) => _id);
      const isSameTags = JSON.stringify(tagIds) === JSON.stringify(oldTagIds);
      const isSharedSecUnchanged =
-        (["key", "value", "comment", "skipMultilineEncoding"] as const).every(
-          (el) => orgSecret[el] === modSecret[el]
-        ) && isSameTags;
+        (
+          [
+            "key",
+            "value",
+            "comment",
+            "skipMultilineEncoding",
+            "reminderRepeatDays",
+            "reminderNote"
+          ] as const
+        ).every((el) => orgSecret[el] === modSecret[el]) && isSameTags;

      try {
        // personal secret change
@ -222,13 +245,14 @@ export const SecretListView = ({
            value,
            tags: tagIds,
            comment,
+            reminderRepeatDays,
+            reminderNote,
            secretId: orgSecret._id,
            newKey: hasKeyChanged ? key : undefined,
            skipMultilineEncoding: modSecret.skipMultilineEncoding
          });
          if (cb) cb();
        }
-
        queryClient.invalidateQueries(
          secretKeys.getProjectSecret({ workspaceId, environment, secretPath })
        );
@ -306,7 +330,7 @@ export const SecretListView = ({
            <div className="flex flex-col" key={`${namespace}-${groupedSecrets.length}`}>
              <div
                className={twMerge(
-                  "bg-bunker-600 capitalize text-md h-0 transition-all",
+                  "text-md h-0 bg-bunker-600 capitalize transition-all",
                  Boolean(namespace) && Boolean(filteredSecrets.length) && "h-11 py-3 pl-4 "
                )}
                key={namespace}
--- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts
+++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts
@ -20,6 +20,15 @@ export const formSchema = z.object({
  overrideAction: z.string().trim().optional(),
  comment: z.string().trim().optional(),
  skipMultilineEncoding: z.boolean().optional(),
+
+  reminderRepeatDays: z
+    .number()
+    .min(1, { message: "Days must be between 1 and 365" })
+    .max(365, { message: "Days must be between 1 and 365" })
+    .nullable()
+    .optional(),
+  reminderNote: z.string().trim().nullable().optional(),
+
  tags: z
    .object({
      _id: z.string(),