Merge pull request #3689 from Infisical/add-gloo-docs

Gloo mesh docs

backend/scripts/generate-schema-types.ts

@@ -84,11 +84,6 @@ const getZodDefaultValue = (type: unknown, value: string | number | boolean | Ob
   }
 };
 
-const bigIntegerColumns: Record<string, string[]> = {
-  "folder_commits": ["commitId"]
-};
-
-
 const main = async () => {
   const tables = (
     await db("information_schema.tables")
@@ -113,9 +108,6 @@ const main = async () => {
       const columnName = columnNames[colNum];
       const colInfo = columns[columnName];
       let ztype = getZodPrimitiveType(colInfo.type);
-      if (bigIntegerColumns[tableName]?.includes(columnName)) {
-        ztype = "z.coerce.bigint()";
-      }
       if (["zodBuffer"].includes(ztype)) {
         zodImportSet.add(ztype);
       }

backend/src/@types/fastify.d.ts

@@ -26,7 +26,6 @@ import { TLdapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-con
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { TPitServiceFactory } from "@app/ee/services/pit/pit-service";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service";
 import { TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service";
@@ -59,7 +58,6 @@ import { TCertificateTemplateServiceFactory } from "@app/services/certificate-te
 import { TCmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { TExternalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { TExternalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service";
 import { THsmServiceFactory } from "@app/services/hsm/hsm-service";
 import { TIdentityServiceFactory } from "@app/services/identity/identity-service";
@@ -85,6 +83,7 @@ import { TOrgAdminServiceFactory } from "@app/services/org-admin/org-admin-servi
 import { TPkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
 import { TPkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
 import { TPkiSubscriberServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-service";
+import { TPkiTemplatesServiceFactory } from "@app/services/pki-templates/pki-templates-service";
 import { TProjectServiceFactory } from "@app/services/project/project-service";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env-service";
@@ -272,9 +271,8 @@ declare module "fastify" {
       microsoftTeams: TMicrosoftTeamsServiceFactory;
       assumePrivileges: TAssumePrivilegeServiceFactory;
       githubOrgSync: TGithubOrgSyncServiceFactory;
-      folderCommit: TFolderCommitServiceFactory;
-      pit: TPitServiceFactory;
       internalCertificateAuthority: TInternalCertificateAuthorityServiceFactory;
+      pkiTemplate: TPkiTemplatesServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data
     // everywhere else access using service layer

backend/src/@types/knex.d.ts

@@ -6,6 +6,9 @@ import {
   TAccessApprovalPoliciesApprovers,
   TAccessApprovalPoliciesApproversInsert,
   TAccessApprovalPoliciesApproversUpdate,
+  TAccessApprovalPoliciesBypassers,
+  TAccessApprovalPoliciesBypassersInsert,
+  TAccessApprovalPoliciesBypassersUpdate,
   TAccessApprovalPoliciesInsert,
   TAccessApprovalPoliciesUpdate,
   TAccessApprovalRequests,
@@ -77,24 +80,6 @@ import {
   TExternalKms,
   TExternalKmsInsert,
   TExternalKmsUpdate,
-  TFolderCheckpointResources,
-  TFolderCheckpointResourcesInsert,
-  TFolderCheckpointResourcesUpdate,
-  TFolderCheckpoints,
-  TFolderCheckpointsInsert,
-  TFolderCheckpointsUpdate,
-  TFolderCommitChanges,
-  TFolderCommitChangesInsert,
-  TFolderCommitChangesUpdate,
-  TFolderCommits,
-  TFolderCommitsInsert,
-  TFolderCommitsUpdate,
-  TFolderTreeCheckpointResources,
-  TFolderTreeCheckpointResourcesInsert,
-  TFolderTreeCheckpointResourcesUpdate,
-  TFolderTreeCheckpoints,
-  TFolderTreeCheckpointsInsert,
-  TFolderTreeCheckpointsUpdate,
   TGateways,
   TGatewaysInsert,
   TGatewaysUpdate,
@@ -294,6 +279,9 @@ import {
   TSecretApprovalPoliciesApprovers,
   TSecretApprovalPoliciesApproversInsert,
   TSecretApprovalPoliciesApproversUpdate,
+  TSecretApprovalPoliciesBypassers,
+  TSecretApprovalPoliciesBypassersInsert,
+  TSecretApprovalPoliciesBypassersUpdate,
   TSecretApprovalPoliciesInsert,
   TSecretApprovalPoliciesUpdate,
   TSecretApprovalRequests,
@@ -838,6 +826,12 @@ declare module "knex/types/tables" {
       TAccessApprovalPoliciesApproversUpdate
     >;
 
+    [TableName.AccessApprovalPolicyBypasser]: KnexOriginal.CompositeTableType<
+      TAccessApprovalPoliciesBypassers,
+      TAccessApprovalPoliciesBypassersInsert,
+      TAccessApprovalPoliciesBypassersUpdate
+    >;
+
     [TableName.AccessApprovalRequest]: KnexOriginal.CompositeTableType<
       TAccessApprovalRequests,
       TAccessApprovalRequestsInsert,
@@ -861,6 +855,11 @@ declare module "knex/types/tables" {
       TSecretApprovalPoliciesApproversInsert,
       TSecretApprovalPoliciesApproversUpdate
     >;
+    [TableName.SecretApprovalPolicyBypasser]: KnexOriginal.CompositeTableType<
+      TSecretApprovalPoliciesBypassers,
+      TSecretApprovalPoliciesBypassersInsert,
+      TSecretApprovalPoliciesBypassersUpdate
+    >;
     [TableName.SecretApprovalRequest]: KnexOriginal.CompositeTableType<
       TSecretApprovalRequests,
       TSecretApprovalRequestsInsert,
@@ -1108,35 +1107,5 @@ declare module "knex/types/tables" {
       TGithubOrgSyncConfigsInsert,
       TGithubOrgSyncConfigsUpdate
     >;
-    [TableName.FolderCommit]: KnexOriginal.CompositeTableType<
-      TFolderCommits,
-      TFolderCommitsInsert,
-      TFolderCommitsUpdate
-    >;
-    [TableName.FolderCommitChanges]: KnexOriginal.CompositeTableType<
-      TFolderCommitChanges,
-      TFolderCommitChangesInsert,
-      TFolderCommitChangesUpdate
-    >;
-    [TableName.FolderCheckpoint]: KnexOriginal.CompositeTableType<
-      TFolderCheckpoints,
-      TFolderCheckpointsInsert,
-      TFolderCheckpointsUpdate
-    >;
-    [TableName.FolderCheckpointResources]: KnexOriginal.CompositeTableType<
-      TFolderCheckpointResources,
-      TFolderCheckpointResourcesInsert,
-      TFolderCheckpointResourcesUpdate
-    >;
-    [TableName.FolderTreeCheckpoint]: KnexOriginal.CompositeTableType<
-      TFolderTreeCheckpoints,
-      TFolderTreeCheckpointsInsert,
-      TFolderTreeCheckpointsUpdate
-    >;
-    [TableName.FolderTreeCheckpointResources]: KnexOriginal.CompositeTableType<
-      TFolderTreeCheckpointResources,
-      TFolderTreeCheckpointResourcesInsert,
-      TFolderTreeCheckpointResourcesUpdate
-    >;
   }
 }

backend/src/db/migrations/20250505194916_add-pit-revamp-tables.ts

@@ -1,166 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (!hasFolderCommitTable) {
-    await knex.schema.createTable(TableName.FolderCommit, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.bigIncrements("commitId");
-      t.jsonb("actorMetadata").notNullable();
-      t.string("actorType").notNullable();
-      t.string("message");
-      t.uuid("folderId").notNullable();
-      t.uuid("envId").notNullable();
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderId");
-      t.index("envId");
-    });
-  }
-
-  const hasFolderCommitChangesTable = await knex.schema.hasTable(TableName.FolderCommitChanges);
-  if (!hasFolderCommitChangesTable) {
-    await knex.schema.createTable(TableName.FolderCommitChanges, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.string("changeType").notNullable();
-      t.boolean("isUpdate").notNullable().defaultTo(false);
-      t.uuid("secretVersionId");
-      t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE");
-      t.uuid("folderVersionId");
-      t.foreign("folderVersionId").references("id").inTable(TableName.SecretFolderVersion).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-      t.index("secretVersionId");
-      t.index("folderVersionId");
-    });
-  }
-
-  const hasFolderCheckpointTable = await knex.schema.hasTable(TableName.FolderCheckpoint);
-  if (!hasFolderCheckpointTable) {
-    await knex.schema.createTable(TableName.FolderCheckpoint, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-    });
-  }
-
-  const hasFolderCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderCheckpointResources);
-  if (!hasFolderCheckpointResourcesTable) {
-    await knex.schema.createTable(TableName.FolderCheckpointResources, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCheckpointId").notNullable();
-      t.foreign("folderCheckpointId").references("id").inTable(TableName.FolderCheckpoint).onDelete("CASCADE");
-      t.uuid("secretVersionId");
-      t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE");
-      t.uuid("folderVersionId");
-      t.foreign("folderVersionId").references("id").inTable(TableName.SecretFolderVersion).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCheckpointId");
-      t.index("secretVersionId");
-      t.index("folderVersionId");
-    });
-  }
-
-  const hasFolderTreeCheckpointTable = await knex.schema.hasTable(TableName.FolderTreeCheckpoint);
-  if (!hasFolderTreeCheckpointTable) {
-    await knex.schema.createTable(TableName.FolderTreeCheckpoint, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-    });
-  }
-
-  const hasFolderTreeCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderTreeCheckpointResources);
-  if (!hasFolderTreeCheckpointResourcesTable) {
-    await knex.schema.createTable(TableName.FolderTreeCheckpointResources, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderTreeCheckpointId").notNullable();
-      t.foreign("folderTreeCheckpointId").references("id").inTable(TableName.FolderTreeCheckpoint).onDelete("CASCADE");
-      t.uuid("folderId").notNullable();
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderTreeCheckpointId");
-      t.index("folderId");
-      t.index("folderCommitId");
-    });
-  }
-
-  if (!hasFolderCommitTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCommit);
-  }
-
-  if (!hasFolderCommitChangesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCommitChanges);
-  }
-
-  if (!hasFolderCheckpointTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCheckpoint);
-  }
-
-  if (!hasFolderCheckpointResourcesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
-  }
-
-  if (!hasFolderTreeCheckpointTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
-  }
-
-  if (!hasFolderTreeCheckpointResourcesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasFolderCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderCheckpointResources);
-  const hasFolderTreeCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderTreeCheckpointResources);
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  const hasFolderCommitChangesTable = await knex.schema.hasTable(TableName.FolderCommitChanges);
-  const hasFolderTreeCheckpointTable = await knex.schema.hasTable(TableName.FolderTreeCheckpoint);
-  const hasFolderCheckpointTable = await knex.schema.hasTable(TableName.FolderCheckpoint);
-
-  if (hasFolderTreeCheckpointResourcesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
-    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpointResources);
-  }
-
-  if (hasFolderCheckpointResourcesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
-    await knex.schema.dropTableIfExists(TableName.FolderCheckpointResources);
-  }
-
-  if (hasFolderTreeCheckpointTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
-    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpoint);
-  }
-
-  if (hasFolderCheckpointTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCheckpoint);
-    await knex.schema.dropTableIfExists(TableName.FolderCheckpoint);
-  }
-
-  if (hasFolderCommitChangesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCommitChanges);
-    await knex.schema.dropTableIfExists(TableName.FolderCommitChanges);
-  }
-
-  if (hasFolderCommitTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCommit);
-    await knex.schema.dropTableIfExists(TableName.FolderCommit);
-  }
-}

backend/src/db/migrations/20250507185010_pit-projects-commits-initialization.ts

@@ -1,29 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-
-import { ProjectType, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { getMigrationPITServices } from "./utils/services";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (hasFolderCommitTable) {
-    const keyStore = inMemoryKeyStore();
-    const envConfig = getMigrationEnvConfig();
-    const { folderCommitService } = await getMigrationPITServices({ db: knex, keyStore, envConfig });
-    const projects = await knex(TableName.Project).where({ version: 3, type: ProjectType.SecretManager }).select("id");
-    for (const project of projects) {
-      // eslint-disable-next-line no-await-in-loop
-      await folderCommitService.initializeProject(project.id, knex);
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (hasFolderCommitTable) {
-    // delete all existing entries
-    await knex(TableName.FolderCommit).del();
-  }
-}

backend/src/db/migrations/20250527030702_policy-bypassers.ts

@@ -0,0 +1,48 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.AccessApprovalPolicyBypasser))) {
+    await knex.schema.createTable(TableName.AccessApprovalPolicyBypasser, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("bypasserGroupId").nullable();
+      t.foreign("bypasserGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
+
+      t.uuid("bypasserUserId").nullable();
+      t.foreign("bypasserUserId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+
+      t.uuid("policyId").notNullable();
+      t.foreign("policyId").references("id").inTable(TableName.AccessApprovalPolicy).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+    await createOnUpdateTrigger(knex, TableName.AccessApprovalPolicyBypasser);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyBypasser))) {
+    await knex.schema.createTable(TableName.SecretApprovalPolicyBypasser, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("bypasserGroupId").nullable();
+      t.foreign("bypasserGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
+
+      t.uuid("bypasserUserId").nullable();
+      t.foreign("bypasserUserId").references("id").inTable(TableName.Users).onDelete("CASCADE");
+
+      t.uuid("policyId").notNullable();
+      t.foreign("policyId").references("id").inTable(TableName.SecretApprovalPolicy).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+    await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyBypasser);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyBypasser);
+  await knex.schema.dropTableIfExists(TableName.AccessApprovalPolicyBypasser);
+
+  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicyBypasser);
+  await dropOnUpdateTrigger(knex, TableName.AccessApprovalPolicyBypasser);
+}

backend/src/db/migrations/20250528110936_add-folder-description-to-versioning.ts

@@ -1,19 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasColumn(TableName.SecretFolderVersion, "description"))) {
-    await knex.schema.alterTable(TableName.SecretFolderVersion, (t) => {
-      t.string("description").nullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasColumn(TableName.SecretFolderVersion, "description")) {
-    await knex.schema.alterTable(TableName.SecretFolderVersion, (t) => {
-      t.dropColumn("description");
-    });
-  }
-}

backend/src/db/migrations/20250528145356_add-template-slug.ts

@@ -0,0 +1,24 @@
+import slugify from "@sindresorhus/slugify";
+import { Knex } from "knex";
+
+import { alphaNumericNanoId } from "@app/lib/nanoid";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasNameCol = await knex.schema.hasColumn(TableName.CertificateTemplate, "name");
+  if (hasNameCol) {
+    const templates = await knex(TableName.CertificateTemplate).select("id", "name");
+    await Promise.all(
+      templates.map((el) => {
+        const slugifiedName = el.name
+          ? slugify(`${el.name.slice(0, 16)}-${alphaNumericNanoId(8)}`)
+          : slugify(alphaNumericNanoId(12));
+
+        return knex(TableName.CertificateTemplate).where({ id: el.id }).update({ name: slugifiedName });
+      })
+    );
+  }
+}
+
+export async function down(): Promise<void> {}

backend/src/db/migrations/20250530152721_add-access-approval-request-deleted-at.ts

@@ -0,0 +1,63 @@
+import { Knex } from "knex";
+
+import { ApprovalStatus } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasPrivilegeDeletedAtColumn = await knex.schema.hasColumn(
+    TableName.AccessApprovalRequest,
+    "privilegeDeletedAt"
+  );
+  const hasStatusColumn = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "status");
+
+  if (!hasPrivilegeDeletedAtColumn) {
+    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
+      t.timestamp("privilegeDeletedAt").nullable();
+    });
+  }
+
+  if (!hasStatusColumn) {
+    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
+      t.string("status").defaultTo(ApprovalStatus.PENDING).notNullable();
+    });
+
+    // Update existing rows based on business logic
+    // If privilegeId is not null, set status to "approved"
+    await knex(TableName.AccessApprovalRequest).whereNotNull("privilegeId").update({ status: ApprovalStatus.APPROVED });
+
+    // If privilegeId is null and there's a rejected reviewer, set to "rejected"
+    const rejectedRequestIds = await knex(TableName.AccessApprovalRequestReviewer)
+      .select("requestId")
+      .where("status", "rejected")
+      .distinct()
+      .pluck("requestId");
+
+    if (rejectedRequestIds.length > 0) {
+      await knex(TableName.AccessApprovalRequest)
+        .whereNull("privilegeId")
+        .whereIn("id", rejectedRequestIds)
+        .update({ status: ApprovalStatus.REJECTED });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasPrivilegeDeletedAtColumn = await knex.schema.hasColumn(
+    TableName.AccessApprovalRequest,
+    "privilegeDeletedAt"
+  );
+  const hasStatusColumn = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "status");
+
+  if (hasPrivilegeDeletedAtColumn) {
+    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
+      t.dropColumn("privilegeDeletedAt");
+    });
+  }
+
+  if (hasStatusColumn) {
+    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
+      t.dropColumn("status");
+    });
+  }
+}

backend/src/db/migrations/utils/services.ts

@@ -3,27 +3,12 @@ import { Knex } from "knex";
 import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
-import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
-import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
-import { folderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import { folderCommitChangesDALFactory } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { folderTreeCheckpointDALFactory } from "@app/services/folder-tree-checkpoint/folder-tree-checkpoint-dal";
-import { folderTreeCheckpointResourcesDALFactory } from "@app/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal";
-import { identityDALFactory } from "@app/services/identity/identity-dal";
 import { internalKmsDALFactory } from "@app/services/kms/internal-kms-dal";
 import { kmskeyDALFactory } from "@app/services/kms/kms-key-dal";
 import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 import { kmsServiceFactory } from "@app/services/kms/kms-service";
 import { orgDALFactory } from "@app/services/org/org-dal";
 import { projectDALFactory } from "@app/services/project/project-dal";
-import { resourceMetadataDALFactory } from "@app/services/resource-metadata/resource-metadata-dal";
-import { secretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { secretFolderVersionDALFactory } from "@app/services/secret-folder/secret-folder-version-dal";
-import { secretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";
-import { secretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
-import { secretVersionV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
-import { userDALFactory } from "@app/services/user/user-dal";
 
 import { TMigrationEnvConfig } from "./env-config";
 
@@ -65,77 +50,3 @@ export const getMigrationEncryptionServices = async ({ envConfig, db, keyStore }
 
   return { kmsService };
 };
-
-export const getMigrationPITServices = async ({
-  db,
-  keyStore,
-  envConfig
-}: {
-  db: Knex;
-  keyStore: TKeyStoreFactory;
-  envConfig: TMigrationEnvConfig;
-}) => {
-  const projectDAL = projectDALFactory(db);
-  const folderCommitDAL = folderCommitDALFactory(db);
-  const folderCommitChangesDAL = folderCommitChangesDALFactory(db);
-  const folderCheckpointDAL = folderCheckpointDALFactory(db);
-  const folderTreeCheckpointDAL = folderTreeCheckpointDALFactory(db);
-  const userDAL = userDALFactory(db);
-  const identityDAL = identityDALFactory(db);
-  const folderDAL = secretFolderDALFactory(db);
-  const folderVersionDAL = secretFolderVersionDALFactory(db);
-  const secretVersionV2BridgeDAL = secretVersionV2BridgeDALFactory(db);
-  const folderCheckpointResourcesDAL = folderCheckpointResourcesDALFactory(db);
-  const secretV2BridgeDAL = secretV2BridgeDALFactory({ db, keyStore });
-  const folderTreeCheckpointResourcesDAL = folderTreeCheckpointResourcesDALFactory(db);
-  const secretTagDAL = secretTagDALFactory(db);
-
-  const orgDAL = orgDALFactory(db);
-  const kmsRootConfigDAL = kmsRootConfigDALFactory(db);
-  const kmsDAL = kmskeyDALFactory(db);
-  const internalKmsDAL = internalKmsDALFactory(db);
-  const resourceMetadataDAL = resourceMetadataDALFactory(db);
-
-  const hsmModule = initializeHsmModule(envConfig);
-  hsmModule.initialize();
-
-  const hsmService = hsmServiceFactory({
-    hsmModule: hsmModule.getModule(),
-    envConfig
-  });
-
-  const kmsService = kmsServiceFactory({
-    kmsRootConfigDAL,
-    keyStore,
-    kmsDAL,
-    internalKmsDAL,
-    orgDAL,
-    projectDAL,
-    hsmService,
-    envConfig
-  });
-
-  await hsmService.startService();
-  await kmsService.startService();
-
-  const folderCommitService = folderCommitServiceFactory({
-    folderCommitDAL,
-    folderCommitChangesDAL,
-    folderCheckpointDAL,
-    folderTreeCheckpointDAL,
-    userDAL,
-    identityDAL,
-    folderDAL,
-    folderVersionDAL,
-    secretVersionV2BridgeDAL,
-    projectDAL,
-    folderCheckpointResourcesDAL,
-    secretV2BridgeDAL,
-    folderTreeCheckpointResourcesDAL,
-    kmsService,
-    secretTagDAL,
-    resourceMetadataDAL
-  });
-
-  return { folderCommitService };
-};

backend/src/db/schemas/access-approval-policies-bypassers.ts

@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const AccessApprovalPoliciesBypassersSchema = z.object({
+  id: z.string().uuid(),
+  bypasserGroupId: z.string().uuid().nullable().optional(),
+  bypasserUserId: z.string().uuid().nullable().optional(),
+  policyId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TAccessApprovalPoliciesBypassers = z.infer<typeof AccessApprovalPoliciesBypassersSchema>;
+export type TAccessApprovalPoliciesBypassersInsert = Omit<
+  z.input<typeof AccessApprovalPoliciesBypassersSchema>,
+  TImmutableDBKeys
+>;
+export type TAccessApprovalPoliciesBypassersUpdate = Partial<
+  Omit<z.input<typeof AccessApprovalPoliciesBypassersSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/access-approval-requests.ts

@@ -18,7 +18,9 @@ export const AccessApprovalRequestsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   requestedByUserId: z.string().uuid(),
-  note: z.string().nullable().optional()
+  note: z.string().nullable().optional(),
+  privilegeDeletedAt: z.date().nullable().optional(),
+  status: z.string().default("pending")
 });
 
 export type TAccessApprovalRequests = z.infer<typeof AccessApprovalRequestsSchema>;

backend/src/db/schemas/folder-checkpoint-resources.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCheckpointResourcesSchema = z.object({
-  id: z.string().uuid(),
-  folderCheckpointId: z.string().uuid(),
-  secretVersionId: z.string().uuid().nullable().optional(),
-  folderVersionId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCheckpointResources = z.infer<typeof FolderCheckpointResourcesSchema>;
-export type TFolderCheckpointResourcesInsert = Omit<z.input<typeof FolderCheckpointResourcesSchema>, TImmutableDBKeys>;
-export type TFolderCheckpointResourcesUpdate = Partial<
-  Omit<z.input<typeof FolderCheckpointResourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/folder-checkpoints.ts

@@ -1,19 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCheckpointsSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCheckpoints = z.infer<typeof FolderCheckpointsSchema>;
-export type TFolderCheckpointsInsert = Omit<z.input<typeof FolderCheckpointsSchema>, TImmutableDBKeys>;
-export type TFolderCheckpointsUpdate = Partial<Omit<z.input<typeof FolderCheckpointsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-commit-changes.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCommitChangesSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  changeType: z.string(),
-  isUpdate: z.boolean().default(false),
-  secretVersionId: z.string().uuid().nullable().optional(),
-  folderVersionId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCommitChanges = z.infer<typeof FolderCommitChangesSchema>;
-export type TFolderCommitChangesInsert = Omit<z.input<typeof FolderCommitChangesSchema>, TImmutableDBKeys>;
-export type TFolderCommitChangesUpdate = Partial<Omit<z.input<typeof FolderCommitChangesSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-commits.ts

@@ -1,24 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCommitsSchema = z.object({
-  id: z.string().uuid(),
-  commitId: z.coerce.bigint(),
-  actorMetadata: z.unknown(),
-  actorType: z.string(),
-  message: z.string().nullable().optional(),
-  folderId: z.string().uuid(),
-  envId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCommits = z.infer<typeof FolderCommitsSchema>;
-export type TFolderCommitsInsert = Omit<z.input<typeof FolderCommitsSchema>, TImmutableDBKeys>;
-export type TFolderCommitsUpdate = Partial<Omit<z.input<typeof FolderCommitsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-tree-checkpoint-resources.ts

@@ -1,26 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderTreeCheckpointResourcesSchema = z.object({
-  id: z.string().uuid(),
-  folderTreeCheckpointId: z.string().uuid(),
-  folderId: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderTreeCheckpointResources = z.infer<typeof FolderTreeCheckpointResourcesSchema>;
-export type TFolderTreeCheckpointResourcesInsert = Omit<
-  z.input<typeof FolderTreeCheckpointResourcesSchema>,
-  TImmutableDBKeys
->;
-export type TFolderTreeCheckpointResourcesUpdate = Partial<
-  Omit<z.input<typeof FolderTreeCheckpointResourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/folder-tree-checkpoints.ts

@@ -1,19 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderTreeCheckpointsSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderTreeCheckpoints = z.infer<typeof FolderTreeCheckpointsSchema>;
-export type TFolderTreeCheckpointsInsert = Omit<z.input<typeof FolderTreeCheckpointsSchema>, TImmutableDBKeys>;
-export type TFolderTreeCheckpointsUpdate = Partial<Omit<z.input<typeof FolderTreeCheckpointsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -1,5 +1,6 @@
 export * from "./access-approval-policies";
 export * from "./access-approval-policies-approvers";
+export * from "./access-approval-policies-bypassers";
 export * from "./access-approval-requests";
 export * from "./access-approval-requests-reviewers";
 export * from "./api-keys";
@@ -23,12 +24,6 @@ export * from "./dynamic-secrets";
 export * from "./external-certificate-authorities";
 export * from "./external-group-org-role-mappings";
 export * from "./external-kms";
-export * from "./folder-checkpoint-resources";
-export * from "./folder-checkpoints";
-export * from "./folder-commit-changes";
-export * from "./folder-commits";
-export * from "./folder-tree-checkpoint-resources";
-export * from "./folder-tree-checkpoints";
 export * from "./gateways";
 export * from "./git-app-install-sessions";
 export * from "./git-app-org";
@@ -98,6 +93,7 @@ export * from "./saml-configs";
 export * from "./scim-tokens";
 export * from "./secret-approval-policies";
 export * from "./secret-approval-policies-approvers";
+export * from "./secret-approval-policies-bypassers";
 export * from "./secret-approval-request-secret-tags";
 export * from "./secret-approval-request-secret-tags-v2";
 export * from "./secret-approval-requests";

backend/src/db/schemas/models.ts

@@ -95,10 +95,12 @@ export enum TableName {
   ScimToken = "scim_tokens",
   AccessApprovalPolicy = "access_approval_policies",
   AccessApprovalPolicyApprover = "access_approval_policies_approvers",
+  AccessApprovalPolicyBypasser = "access_approval_policies_bypassers",
   AccessApprovalRequest = "access_approval_requests",
   AccessApprovalRequestReviewer = "access_approval_requests_reviewers",
   SecretApprovalPolicy = "secret_approval_policies",
   SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
+  SecretApprovalPolicyBypasser = "secret_approval_policies_bypassers",
   SecretApprovalRequest = "secret_approval_requests",
   SecretApprovalRequestReviewer = "secret_approval_requests_reviewers",
   SecretApprovalRequestSecret = "secret_approval_requests_secrets",
@@ -157,16 +159,10 @@ export enum TableName {
   MicrosoftTeamsIntegrations = "microsoft_teams_integrations",
   ProjectMicrosoftTeamsConfigs = "project_microsoft_teams_configs",
   SecretReminderRecipients = "secret_reminder_recipients",
-  GithubOrgSyncConfig = "github_org_sync_configs",
-  FolderCommit = "folder_commits",
-  FolderCommitChanges = "folder_commit_changes",
-  FolderCheckpoint = "folder_checkpoints",
-  FolderCheckpointResources = "folder_checkpoint_resources",
-  FolderTreeCheckpoint = "folder_tree_checkpoints",
-  FolderTreeCheckpointResources = "folder_tree_checkpoint_resources"
+  GithubOrgSyncConfig = "github_org_sync_configs"
 }
 
-export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";
+export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";
 
 export const UserDeviceSchema = z
   .object({

backend/src/db/schemas/secret-approval-policies-bypassers.ts

@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SecretApprovalPoliciesBypassersSchema = z.object({
+  id: z.string().uuid(),
+  bypasserGroupId: z.string().uuid().nullable().optional(),
+  bypasserUserId: z.string().uuid().nullable().optional(),
+  policyId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TSecretApprovalPoliciesBypassers = z.infer<typeof SecretApprovalPoliciesBypassersSchema>;
+export type TSecretApprovalPoliciesBypassersInsert = Omit<
+  z.input<typeof SecretApprovalPoliciesBypassersSchema>,
+  TImmutableDBKeys
+>;
+export type TSecretApprovalPoliciesBypassersUpdate = Partial<
+  Omit<z.input<typeof SecretApprovalPoliciesBypassersSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/secret-folder-versions.ts

@@ -14,8 +14,7 @@ export const SecretFolderVersionsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   envId: z.string().uuid(),
-  folderId: z.string().uuid(),
-  description: z.string().nullable().optional()
+  folderId: z.string().uuid()
 });
 
 export type TSecretFolderVersions = z.infer<typeof SecretFolderVersionsSchema>;

backend/src/ee/routes/v1/access-approval-policy-router.ts

@@ -1,7 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
-import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
+import { ApproverType, BypasserType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { EnforcementLevel } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -24,10 +24,19 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 approvers")
           .min(1, { message: "At least one approver should be provided" }),
+        bypassers: z
+          .discriminatedUnion("type", [
+            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
+            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
+          ])
+          .array()
+          .max(100, "Cannot have more than 100 bypassers")
+          .optional(),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -72,7 +81,8 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
                 .object({ type: z.nativeEnum(ApproverType), id: z.string().nullable().optional() })
                 .array()
                 .nullable()
-                .optional()
+                .optional(),
+              bypassers: z.object({ type: z.nativeEnum(BypasserType), id: z.string().nullable().optional() }).array()
             })
             .array()
             .nullable()
@@ -143,10 +153,19 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
+        bypassers: z
+          .discriminatedUnion("type", [
+            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
+            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
+          ])
+          .array()
+          .max(100, "Cannot have more than 100 bypassers")
+          .optional(),
         approvals: z.number().min(1).optional(),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -220,6 +239,15 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
               })
               .array()
               .nullable()
+              .optional(),
+            bypassers: z
+              .object({
+                type: z.nativeEnum(BypasserType),
+                id: z.string().nullable().optional(),
+                name: z.string().nullable().optional()
+              })
+              .array()
+              .nullable()
               .optional()
           })
         })

backend/src/ee/routes/v1/access-approval-request-router.ts

@@ -113,6 +113,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
               name: z.string(),
               approvals: z.number(),
               approvers: z.string().array(),
+              bypassers: z.string().array(),
               secretPath: z.string().nullish(),
               envId: z.string(),
               enforcementLevel: z.string(),

backend/src/ee/routes/v1/index.ts

@@ -18,7 +18,6 @@ import { registerLdapRouter } from "./ldap-router";
 import { registerLicenseRouter } from "./license-router";
 import { registerOidcRouter } from "./oidc-router";
 import { registerOrgRoleRouter } from "./org-role-router";
-import { registerPITRouter } from "./pit-router";
 import { registerProjectRoleRouter } from "./project-role-router";
 import { registerProjectRouter } from "./project-router";
 import { registerRateLimitRouter } from "./rate-limit-router";
@@ -54,7 +53,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
     { prefix: "/workspace" }
   );
   await server.register(registerSnapshotRouter, { prefix: "/secret-snapshot" });
-  await server.register(registerPITRouter, { prefix: "/pit" });
   await server.register(registerSecretApprovalPolicyRouter, { prefix: "/secret-approvals" });
   await server.register(registerSecretApprovalRequestRouter, {
     prefix: "/secret-approval-requests"

backend/src/ee/routes/v1/pit-router.ts

@@ -1,416 +0,0 @@
-/* eslint-disable @typescript-eslint/no-base-to-string */
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { removeTrailingSlash } from "@app/lib/fn";
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { booleanSchema } from "@app/server/routes/sanitizedSchemas";
-import { AuthMode } from "@app/services/auth/auth-type";
-import { commitChangesResponseSchema, resourceChangeSchema } from "@app/services/folder-commit/folder-commit-schemas";
-
-const commitHistoryItemSchema = z.object({
-  id: z.string(),
-  folderId: z.string(),
-  actorType: z.string(),
-  actorMetadata: z.unknown().optional(),
-  message: z.string().optional().nullable(),
-  commitId: z.string(),
-  createdAt: z.string().or(z.date()),
-  envId: z.string()
-});
-
-const folderStateSchema = z.array(
-  z.object({
-    type: z.string(),
-    id: z.string(),
-    versionId: z.string(),
-    secretKey: z.string().optional(),
-    secretVersion: z.number().optional(),
-    folderName: z.string().optional(),
-    folderVersion: z.number().optional()
-  })
-);
-
-export const registerPITRouter = async (server: FastifyZodProvider) => {
-  // Get commits count for a folder
-  server.route({
-    method: "GET",
-    url: "/commits/count",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        environment: z.string().trim(),
-        path: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          count: z.number(),
-          folderId: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitsCount({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        environment: req.query.environment,
-        path: req.query.path
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMIT_COUNT,
-          metadata: {
-            environment: req.query.environment,
-            path: req.query.path,
-            commitCount: result.count.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Get all commits for a folder
-  server.route({
-    method: "GET",
-    url: "/commits",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        environment: z.string().trim(),
-        path: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim(),
-        offset: z.coerce.number().min(0).default(0),
-        limit: z.coerce.number().min(1).max(100).default(20),
-        search: z.string().trim().optional(),
-        sort: z.enum(["asc", "desc"]).default("desc")
-      }),
-      response: {
-        200: z.object({
-          commits: commitHistoryItemSchema.array(),
-          total: z.number(),
-          hasMore: z.boolean()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitsForFolder({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        environment: req.query.environment,
-        path: req.query.path,
-        offset: req.query.offset,
-        limit: req.query.limit,
-        search: req.query.search,
-        sort: req.query.sort
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMITS,
-          metadata: {
-            environment: req.query.environment,
-            path: req.query.path,
-            commitCount: result.commits.length.toString(),
-            offset: req.query.offset.toString(),
-            limit: req.query.limit.toString(),
-            search: req.query.search,
-            sort: req.query.sort
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Get commit changes for a specific commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId/changes",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: commitChangesResponseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitChanges({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMIT_CHANGES,
-          metadata: {
-            commitId: req.params.commitId,
-            changesCount: (result.changes.changes?.length || 0).toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Retrieve rollback changes for a commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId/compare",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        folderId: z.string().trim(),
-        environment: z.string().trim(),
-        deepRollback: booleanSchema.default(false),
-        secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.array(
-          z.object({
-            folderId: z.string(),
-            folderName: z.string(),
-            folderPath: z.string().optional(),
-            changes: z.array(resourceChangeSchema)
-          })
-        )
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.compareCommitChanges({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId,
-        folderId: req.query.folderId,
-        environment: req.query.environment,
-        deepRollback: req.query.deepRollback,
-        secretPath: req.query.secretPath
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.PIT_COMPARE_FOLDER_STATES,
-          metadata: {
-            targetCommitId: req.params.commitId,
-            folderId: req.query.folderId,
-            deepRollback: req.query.deepRollback,
-            diffsCount: result.length.toString(),
-            environment: req.query.environment,
-            folderPath: req.query.secretPath
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Rollback to a previous commit
-  server.route({
-    method: "POST",
-    url: "/commits/:commitId/rollback",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      body: z.object({
-        folderId: z.string().trim(),
-        deepRollback: z.boolean().default(false),
-        message: z.string().max(256).trim().optional(),
-        environment: z.string().trim(),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          success: z.boolean(),
-          secretChangesCount: z.number().optional(),
-          folderChangesCount: z.number().optional(),
-          totalChanges: z.number().optional()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.rollbackToCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.body.projectId,
-        commitId: req.params.commitId,
-        folderId: req.body.folderId,
-        deepRollback: req.body.deepRollback,
-        message: req.body.message,
-        environment: req.body.environment
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.body.projectId,
-        event: {
-          type: EventType.PIT_ROLLBACK_COMMIT,
-          metadata: {
-            targetCommitId: req.params.commitId,
-            environment: req.body.environment,
-            folderId: req.body.folderId,
-            deepRollback: req.body.deepRollback,
-            message: req.body.message || "Rollback to previous commit",
-            totalChanges: result.totalChanges?.toString() || "0"
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Revert commit
-  server.route({
-    method: "POST",
-    url: "/commits/:commitId/revert",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      body: z.object({
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          success: z.boolean(),
-          message: z.string(),
-          originalCommitId: z.string(),
-          revertCommitId: z.string().optional(),
-          changesReverted: z.number().optional()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.revertCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.body.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.body.projectId,
-        event: {
-          type: EventType.PIT_REVERT_COMMIT,
-          metadata: {
-            commitId: req.params.commitId,
-            revertCommitId: result.revertCommitId,
-            changesReverted: result.changesReverted?.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Folder state at commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        folderId: z.string().trim(),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: folderStateSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getFolderStateAtCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.PIT_GET_FOLDER_STATE,
-          metadata: {
-            commitId: req.params.commitId,
-            folderId: req.query.folderId,
-            resourceCount: result.length.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-};

backend/src/ee/routes/v1/secret-approval-policy-router.ts

@@ -1,7 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
-import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
+import { ApproverType, BypasserType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { EnforcementLevel } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -30,10 +30,19 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
+        bypassers: z
+          .discriminatedUnion("type", [
+            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
+            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
+          ])
+          .array()
+          .max(100, "Cannot have more than 100 bypassers")
+          .optional(),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -75,10 +84,19 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
+        bypassers: z
+          .discriminatedUnion("type", [
+            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
+            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
+          ])
+          .array()
+          .max(100, "Cannot have more than 100 bypassers")
+          .optional(),
         approvals: z.number().min(1).default(1),
         secretPath: z
           .string()
@@ -157,6 +175,12 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
                   id: z.string().nullable().optional(),
                   type: z.nativeEnum(ApproverType)
                 })
+                .array(),
+              bypassers: z
+                .object({
+                  id: z.string().nullable().optional(),
+                  type: z.nativeEnum(BypasserType)
+                })
                 .array()
             })
             .array()
@@ -193,7 +217,14 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
               .object({
                 id: z.string().nullable().optional(),
                 type: z.nativeEnum(ApproverType),
-                name: z.string().nullable().optional()
+                username: z.string().nullable().optional()
+              })
+              .array(),
+            bypassers: z
+              .object({
+                id: z.string().nullable().optional(),
+                type: z.nativeEnum(BypasserType),
+                username: z.string().nullable().optional()
               })
               .array()
           })

backend/src/ee/routes/v1/secret-approval-request-router.ts

@@ -47,6 +47,11 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                   userId: z.string().nullable().optional()
                 })
                 .array(),
+              bypassers: z
+                .object({
+                  userId: z.string().nullable().optional()
+                })
+                .array(),
               secretPath: z.string().optional().nullable(),
               enforcementLevel: z.string(),
               deletedAt: z.date().nullish(),
@@ -266,6 +271,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                 name: z.string(),
                 approvals: z.number(),
                 approvers: approvalRequestUser.array(),
+                bypassers: approvalRequestUser.array(),
                 secretPath: z.string().optional().nullable(),
                 enforcementLevel: z.string(),
                 deletedAt: z.date().nullish(),

backend/src/ee/services/access-approval-policy/access-approval-policy-approver-dal.ts

@@ -8,3 +8,10 @@ export const accessApprovalPolicyApproverDALFactory = (db: TDbClient) => {
   const accessApprovalPolicyApproverOrm = ormify(db, TableName.AccessApprovalPolicyApprover);
   return { ...accessApprovalPolicyApproverOrm };
 };
+
+export type TAccessApprovalPolicyBypasserDALFactory = ReturnType<typeof accessApprovalPolicyBypasserDALFactory>;
+
+export const accessApprovalPolicyBypasserDALFactory = (db: TDbClient) => {
+  const accessApprovalPolicyBypasserOrm = ormify(db, TableName.AccessApprovalPolicyBypasser);
+  return { ...accessApprovalPolicyBypasserOrm };
+};

backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts

@@ -1,11 +1,11 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies } from "@app/db/schemas";
+import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies, TUsers } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
-import { ApproverType } from "./access-approval-policy-types";
+import { ApproverType, BypasserType } from "./access-approval-policy-types";
 
 export type TAccessApprovalPolicyDALFactory = ReturnType<typeof accessApprovalPolicyDALFactory>;
 
@@ -34,9 +34,22 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
       .leftJoin(TableName.Users, `${TableName.AccessApprovalPolicyApprover}.approverUserId`, `${TableName.Users}.id`)
+      .leftJoin(
+        TableName.AccessApprovalPolicyBypasser,
+        `${TableName.AccessApprovalPolicy}.id`,
+        `${TableName.AccessApprovalPolicyBypasser}.policyId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("bypasserUsers"),
+        `${TableName.AccessApprovalPolicyBypasser}.bypasserUserId`,
+        `bypasserUsers.id`
+      )
       .select(tx.ref("username").withSchema(TableName.Users).as("approverUsername"))
+      .select(tx.ref("username").withSchema("bypasserUsers").as("bypasserUsername"))
       .select(tx.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
       .select(tx.ref("approverGroupId").withSchema(TableName.AccessApprovalPolicyApprover))
+      .select(tx.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser))
+      .select(tx.ref("bypasserGroupId").withSchema(TableName.AccessApprovalPolicyBypasser))
       .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
       .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
       .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
@@ -129,6 +142,23 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
               id,
               type: ApproverType.Group
             })
+          },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserUserId: id, bypasserUsername }) => ({
+              id,
+              type: BypasserType.User,
+              name: bypasserUsername
+            })
+          },
+          {
+            key: "bypasserGroupId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserGroupId: id }) => ({
+              id,
+              type: BypasserType.Group
+            })
           }
         ]
       });
@@ -144,5 +174,28 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
     return softDeletedPolicy;
   };
 
-  return { ...accessApprovalPolicyOrm, find, findById, softDeleteById };
+  const findLastValidPolicy = async ({ envId, secretPath }: { envId: string; secretPath: string }, tx?: Knex) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.AccessApprovalPolicy)
+        .where(
+          // eslint-disable-next-line @typescript-eslint/no-misused-promises
+          buildFindFilter(
+            {
+              envId,
+              secretPath
+            },
+            TableName.AccessApprovalPolicy
+          )
+        )
+        .orderBy("deletedAt", "desc")
+        .orderByRaw(`"deletedAt" IS NULL`)
+        .first();
+
+      return result;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "FindLastValidPolicy" });
+    }
+  };
+
+  return { ...accessApprovalPolicyOrm, find, findById, softDeleteById, findLastValidPolicy };
 };

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -2,8 +2,9 @@ import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
@@ -14,10 +15,14 @@ import { TAccessApprovalRequestReviewerDALFactory } from "../access-approval-req
 import { ApprovalStatus } from "../access-approval-request/access-approval-request-types";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
-import { TAccessApprovalPolicyApproverDALFactory } from "./access-approval-policy-approver-dal";
+import {
+  TAccessApprovalPolicyApproverDALFactory,
+  TAccessApprovalPolicyBypasserDALFactory
+} from "./access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "./access-approval-policy-dal";
 import {
   ApproverType,
+  BypasserType,
   TCreateAccessApprovalPolicy,
   TDeleteAccessApprovalPolicy,
   TGetAccessApprovalPolicyByIdDTO,
@@ -32,12 +37,14 @@ type TAccessApprovalPolicyServiceFactoryDep = {
   accessApprovalPolicyDAL: TAccessApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findOne">;
   accessApprovalPolicyApproverDAL: TAccessApprovalPolicyApproverDALFactory;
+  accessApprovalPolicyBypasserDAL: TAccessApprovalPolicyBypasserDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
   groupDAL: TGroupDALFactory;
   userDAL: Pick<TUserDALFactory, "find">;
   accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update" | "find">;
   additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "delete">;
   accessApprovalRequestReviewerDAL: Pick<TAccessApprovalRequestReviewerDALFactory, "update">;
+  orgMembershipDAL: Pick<TOrgMembershipDALFactory, "find">;
 };
 
 export type TAccessApprovalPolicyServiceFactory = ReturnType<typeof accessApprovalPolicyServiceFactory>;
@@ -45,6 +52,7 @@ export type TAccessApprovalPolicyServiceFactory = ReturnType<typeof accessApprov
 export const accessApprovalPolicyServiceFactory = ({
   accessApprovalPolicyDAL,
   accessApprovalPolicyApproverDAL,
+  accessApprovalPolicyBypasserDAL,
   groupDAL,
   permissionService,
   projectEnvDAL,
@@ -52,7 +60,8 @@ export const accessApprovalPolicyServiceFactory = ({
   userDAL,
   accessApprovalRequestDAL,
   additionalPrivilegeDAL,
-  accessApprovalRequestReviewerDAL
+  accessApprovalRequestReviewerDAL,
+  orgMembershipDAL
 }: TAccessApprovalPolicyServiceFactoryDep) => {
   const createAccessApprovalPolicy = async ({
     name,
@@ -63,6 +72,7 @@ export const accessApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
+    bypassers,
     projectSlug,
     environment,
     enforcementLevel,
@@ -82,7 +92,7 @@ export const accessApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
       .filter(Boolean) as string[];
 
     if (!groupApprovers && approvals > userApprovers.length + userApproverNames.length)
@@ -98,7 +108,7 @@ export const accessApprovalPolicyServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Create,
+      ProjectPermissionActions.Create,
       ProjectPermissionSub.SecretApproval
     );
     const env = await projectEnvDAL.findOne({ slug: environment, projectId: project.id });
@@ -147,6 +157,44 @@ export const accessApprovalPolicyServiceFactory = ({
       .map((user) => user.id);
     verifyAllApprovers.push(...verifyGroupApprovers);
 
+    let groupBypassers: string[] = [];
+    let bypasserUserIds: string[] = [];
+
+    if (bypassers && bypassers.length) {
+      groupBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.Group)
+        .map((bypasser) => bypasser.id) as string[];
+
+      const userBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.User)
+        .map((bypasser) => bypasser.id)
+        .filter(Boolean) as string[];
+
+      const userBypasserNames = bypassers
+        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
+        .filter(Boolean) as string[];
+
+      bypasserUserIds = userBypassers;
+      if (userBypasserNames.length) {
+        const bypasserUsers = await userDAL.find({
+          $in: {
+            username: userBypasserNames
+          }
+        });
+
+        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
+        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
+
+        if (invalidUsernames.length) {
+          throw new BadRequestError({
+            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
+          });
+        }
+
+        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
+      }
+    }
+
     const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await accessApprovalPolicyDAL.create(
         {
@@ -159,6 +207,7 @@ export const accessApprovalPolicyServiceFactory = ({
         },
         tx
       );
+
       if (approverUserIds.length) {
         await accessApprovalPolicyApproverDAL.insertMany(
           approverUserIds.map((userId) => ({
@@ -179,8 +228,29 @@ export const accessApprovalPolicyServiceFactory = ({
         );
       }
 
+      if (bypasserUserIds.length) {
+        await accessApprovalPolicyBypasserDAL.insertMany(
+          bypasserUserIds.map((userId) => ({
+            bypasserUserId: userId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
+      if (groupBypassers.length) {
+        await accessApprovalPolicyBypasserDAL.insertMany(
+          groupBypassers.map((groupId) => ({
+            bypasserGroupId: groupId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
       return doc;
     });
+
     return { ...accessApproval, environment: env, projectId: project.id };
   };
 
@@ -211,6 +281,7 @@ export const accessApprovalPolicyServiceFactory = ({
   const updateAccessApprovalPolicy = async ({
     policyId,
     approvers,
+    bypassers,
     secretPath,
     name,
     actorId,
@@ -231,15 +302,15 @@ export const accessApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
       .filter(Boolean) as string[];
 
     const accessApprovalPolicy = await accessApprovalPolicyDAL.findById(policyId);
-    const currentAppovals = approvals || accessApprovalPolicy.approvals;
+    const currentApprovals = approvals || accessApprovalPolicy.approvals;
     if (
       groupApprovers?.length === 0 &&
       userApprovers &&
-      currentAppovals > userApprovers.length + userApproverNames.length
+      currentApprovals > userApprovers.length + userApproverNames.length
     ) {
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
     }
@@ -256,10 +327,79 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Edit,
-      ProjectPermissionSub.SecretApproval
-    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
+
+    let groupBypassers: string[] = [];
+    let bypasserUserIds: string[] = [];
+
+    if (bypassers && bypassers.length) {
+      groupBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.Group)
+        .map((bypasser) => bypasser.id) as string[];
+
+      groupBypassers = [...new Set(groupBypassers)];
+
+      const userBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.User)
+        .map((bypasser) => bypasser.id)
+        .filter(Boolean) as string[];
+
+      const userBypasserNames = bypassers
+        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
+        .filter(Boolean) as string[];
+
+      bypasserUserIds = userBypassers;
+      if (userBypasserNames.length) {
+        const bypasserUsers = await userDAL.find({
+          $in: {
+            username: userBypasserNames
+          }
+        });
+
+        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
+        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
+
+        if (invalidUsernames.length) {
+          throw new BadRequestError({
+            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
+          });
+        }
+
+        bypasserUserIds = [...new Set(bypasserUserIds.concat(bypasserUsers.map((user) => user.id)))];
+      }
+
+      // Validate user bypassers
+      if (bypasserUserIds.length > 0) {
+        const orgMemberships = await orgMembershipDAL.find({
+          $in: { userId: bypasserUserIds },
+          orgId: actorOrgId
+        });
+
+        if (orgMemberships.length !== bypasserUserIds.length) {
+          const foundUserIdsInOrg = new Set(orgMemberships.map((mem) => mem.userId));
+          const missingUserIds = bypasserUserIds.filter((id) => !foundUserIdsInOrg.has(id));
+          throw new BadRequestError({
+            message: `One or more specified bypasser users are not part of the organization or do not exist. Invalid or non-member user IDs: ${missingUserIds.join(", ")}`
+          });
+        }
+      }
+
+      // Validate group bypassers
+      if (groupBypassers.length > 0) {
+        const orgGroups = await groupDAL.find({
+          $in: { id: groupBypassers },
+          orgId: actorOrgId
+        });
+
+        if (orgGroups.length !== groupBypassers.length) {
+          const foundGroupIdsInOrg = new Set(orgGroups.map((group) => group.id));
+          const missingGroupIds = groupBypassers.filter((id) => !foundGroupIdsInOrg.has(id));
+          throw new BadRequestError({
+            message: `One or more specified bypasser groups are not part of the organization or do not exist. Invalid or non-member group IDs: ${missingGroupIds.join(", ")}`
+          });
+        }
+      }
+    }
 
     const updatedPolicy = await accessApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await accessApprovalPolicyDAL.updateById(
@@ -316,6 +456,28 @@ export const accessApprovalPolicyServiceFactory = ({
         );
       }
 
+      await accessApprovalPolicyBypasserDAL.delete({ policyId: doc.id }, tx);
+
+      if (bypasserUserIds.length) {
+        await accessApprovalPolicyBypasserDAL.insertMany(
+          bypasserUserIds.map((userId) => ({
+            bypasserUserId: userId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
+      if (groupBypassers.length) {
+        await accessApprovalPolicyBypasserDAL.insertMany(
+          groupBypassers.map((groupId) => ({
+            bypasserGroupId: groupId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
       return doc;
     });
     return {
@@ -344,7 +506,7 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Delete,
+      ProjectPermissionActions.Delete,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -435,10 +597,7 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Read,
-      ProjectPermissionSub.SecretApproval
-    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
 
     return policy;
   };

backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts

@@ -18,11 +18,20 @@ export enum ApproverType {
   User = "user"
 }
 
+export enum BypasserType {
+  Group = "group",
+  User = "user"
+}
+
 export type TCreateAccessApprovalPolicy = {
   approvals: number;
   secretPath: string;
   environment: string;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
+  bypassers?: (
+    | { type: BypasserType.Group; id: string }
+    | { type: BypasserType.User; id?: string; username?: string }
+  )[];
   projectSlug: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -32,7 +41,11 @@ export type TCreateAccessApprovalPolicy = {
 export type TUpdateAccessApprovalPolicy = {
   policyId: string;
   approvals?: number;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
+  bypassers?: (
+    | { type: BypasserType.Group; id: string }
+    | { type: BypasserType.User; id?: string; username?: string }
+  )[];
   secretPath?: string;
   name?: string;
   enforcementLevel?: EnforcementLevel;

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -1,7 +1,13 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessApprovalRequestsSchema, TableName, TAccessApprovalRequests, TUsers } from "@app/db/schemas";
+import {
+  AccessApprovalRequestsSchema,
+  TableName,
+  TAccessApprovalRequests,
+  TUserGroupMembership,
+  TUsers
+} from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
@@ -28,12 +34,12 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.AccessApprovalRequest}.policyId`,
           `${TableName.AccessApprovalPolicy}.id`
         )
-
         .leftJoin(
           TableName.AccessApprovalRequestReviewer,
           `${TableName.AccessApprovalRequest}.id`,
           `${TableName.AccessApprovalRequestReviewer}.requestId`
         )
+
         .leftJoin(
           TableName.AccessApprovalPolicyApprover,
           `${TableName.AccessApprovalPolicy}.id`,
@@ -46,6 +52,17 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         )
         .leftJoin(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
 
+        .leftJoin(
+          TableName.AccessApprovalPolicyBypasser,
+          `${TableName.AccessApprovalPolicy}.id`,
+          `${TableName.AccessApprovalPolicyBypasser}.policyId`
+        )
+        .leftJoin<TUserGroupMembership>(
+          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+          `${TableName.AccessApprovalPolicyBypasser}.bypasserGroupId`,
+          `bypasserUserGroupMembership.groupId`
+        )
+
         .join<TUsers>(
           db(TableName.Users).as("requestedByUser"),
           `${TableName.AccessApprovalRequest}.requestedByUserId`,
@@ -69,6 +86,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         .select(db.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
         .select(db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"))
 
+        .select(db.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser))
+        .select(db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"))
+
         .select(
           db.ref("projectId").withSchema(TableName.Environment),
           db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
@@ -145,7 +165,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
               }
             : null,
 
-          isApproved: !!doc.policyDeletedAt || !!doc.privilegeId
+          isApproved: !!doc.policyDeletedAt || !!doc.privilegeId || doc.status !== ApprovalStatus.PENDING
         }),
         childrenMapper: [
           {
@@ -158,6 +178,12 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverGroupUserId",
             label: "approvers" as const,
             mapper: ({ approverGroupUserId }) => approverGroupUserId
+          },
+          { key: "bypasserUserId", label: "bypassers" as const, mapper: ({ bypasserUserId }) => bypasserUserId },
+          {
+            key: "bypasserGroupUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserGroupUserId }) => bypasserGroupUserId
           }
         ]
       });
@@ -166,7 +192,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
 
       return formattedDocs.map((doc) => ({
         ...doc,
-        policy: { ...doc.policy, approvers: doc.approvers }
+        policy: { ...doc.policy, approvers: doc.approvers, bypassers: doc.bypassers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindRequestsWithPrivilege" });
@@ -193,7 +219,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicy}.id`,
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
-
       .leftJoin<TUsers>(
         db(TableName.Users).as("accessApprovalPolicyApproverUser"),
         `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
@@ -204,13 +229,33 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicyApprover}.approverGroupId`,
         `${TableName.UserGroupMembership}.groupId`
       )
-
       .leftJoin<TUsers>(
         db(TableName.Users).as("accessApprovalPolicyGroupApproverUser"),
         `${TableName.UserGroupMembership}.userId`,
         "accessApprovalPolicyGroupApproverUser.id"
       )
 
+      .leftJoin(
+        TableName.AccessApprovalPolicyBypasser,
+        `${TableName.AccessApprovalPolicy}.id`,
+        `${TableName.AccessApprovalPolicyBypasser}.policyId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("accessApprovalPolicyBypasserUser"),
+        `${TableName.AccessApprovalPolicyBypasser}.bypasserUserId`,
+        "accessApprovalPolicyBypasserUser.id"
+      )
+      .leftJoin<TUserGroupMembership>(
+        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+        `${TableName.AccessApprovalPolicyBypasser}.bypasserGroupId`,
+        `bypasserUserGroupMembership.groupId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("accessApprovalPolicyGroupBypasserUser"),
+        `bypasserUserGroupMembership.userId`,
+        "accessApprovalPolicyGroupBypasserUser.id"
+      )
+
       .leftJoin(
         TableName.AccessApprovalRequestReviewer,
         `${TableName.AccessApprovalRequest}.id`,
@@ -241,6 +286,18 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
         tx.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),
 
+        // Bypassers
+        tx.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser),
+        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
+        tx.ref("email").withSchema("accessApprovalPolicyBypasserUser").as("bypasserEmail"),
+        tx.ref("email").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupEmail"),
+        tx.ref("username").withSchema("accessApprovalPolicyBypasserUser").as("bypasserUsername"),
+        tx.ref("username").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupUsername"),
+        tx.ref("firstName").withSchema("accessApprovalPolicyBypasserUser").as("bypasserFirstName"),
+        tx.ref("firstName").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupFirstName"),
+        tx.ref("lastName").withSchema("accessApprovalPolicyBypasserUser").as("bypasserLastName"),
+        tx.ref("lastName").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupLastName"),
+
         tx.ref("reviewerUserId").withSchema(TableName.AccessApprovalRequestReviewer),
 
         tx.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus"),
@@ -265,7 +322,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
     try {
       const sql = findQuery({ [`${TableName.AccessApprovalRequest}.id` as "id"]: id }, tx || db.replicaNode());
       const docs = await sql;
-      const formatedDoc = sqlNestRelationships({
+      const formattedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -335,13 +392,51 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
               lastName,
               username
             })
+          },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({
+              bypasserUserId,
+              bypasserEmail: email,
+              bypasserUsername: username,
+              bypasserLastName: lastName,
+              bypasserFirstName: firstName
+            }) => ({
+              userId: bypasserUserId,
+              email,
+              firstName,
+              lastName,
+              username
+            })
+          },
+          {
+            key: "bypasserGroupUserId",
+            label: "bypassers" as const,
+            mapper: ({
+              userId,
+              bypasserGroupEmail: email,
+              bypasserGroupUsername: username,
+              bypasserGroupLastName: lastName,
+              bypasserFirstName: firstName
+            }) => ({
+              userId,
+              email,
+              firstName,
+              lastName,
+              username
+            })
           }
         ]
       });
-      if (!formatedDoc?.[0]) return;
+      if (!formattedDoc?.[0]) return;
       return {
-        ...formatedDoc[0],
-        policy: { ...formatedDoc[0].policy, approvers: formatedDoc[0].approvers }
+        ...formattedDoc[0],
+        policy: {
+          ...formattedDoc[0].policy,
+          approvers: formattedDoc[0].approvers,
+          bypassers: formattedDoc[0].bypassers
+        }
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "FindByIdAccessApprovalRequest" });
@@ -392,14 +487,20 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         ]
       });
 
-      // an approval is pending if there is no reviewer rejections and no privilege ID is set
+      // an approval is pending if there is no reviewer rejections, no privilege ID is set and the status is pending
       const pendingApprovals = formattedRequests.filter(
-        (req) => !req.privilegeId && !req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED)
+        (req) =>
+          !req.privilegeId &&
+          !req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED) &&
+          req.status === ApprovalStatus.PENDING
       );
 
-      // an approval is finalized if there are any rejections or a privilege ID is set
+      // an approval is finalized if there are any rejections, a privilege ID is set or the number of approvals is equal to the number of approvals required
       const finalizedApprovals = formattedRequests.filter(
-        (req) => req.privilegeId || req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED)
+        (req) =>
+          req.privilegeId ||
+          req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED) ||
+          req.status !== ApprovalStatus.PENDING
       );
 
       return { pendingCount: pendingApprovals.length, finalizedCount: finalizedApprovals.length };

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -23,7 +23,6 @@ import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-poli
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "../project-user-additional-privilege/project-user-additional-privilege-types";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
@@ -57,7 +56,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
     | "findOne"
     | "getCount"
   >;
-  accessApprovalPolicyDAL: Pick<TAccessApprovalPolicyDALFactory, "findOne" | "find">;
+  accessApprovalPolicyDAL: Pick<TAccessApprovalPolicyDALFactory, "findOne" | "find" | "findLastValidPolicy">;
   accessApprovalRequestReviewerDAL: Pick<
     TAccessApprovalRequestReviewerDALFactory,
     "create" | "find" | "findOne" | "transaction"
@@ -132,7 +131,7 @@ export const accessApprovalRequestServiceFactory = ({
 
     if (!environment) throw new NotFoundError({ message: `Environment with slug '${envSlug}' not found` });
 
-    const policy = await accessApprovalPolicyDAL.findOne({
+    const policy = await accessApprovalPolicyDAL.findLastValidPolicy({
       envId: environment.id,
       secretPath
     });
@@ -204,7 +203,7 @@ export const accessApprovalRequestServiceFactory = ({
 
           const isRejected = reviewers.some((reviewer) => reviewer.status === ApprovalStatus.REJECTED);
 
-          if (!isRejected) {
+          if (!isRejected && duplicateRequest.status === ApprovalStatus.PENDING) {
             throw new BadRequestError({ message: "You already have a pending access request with the same criteria" });
           }
         }
@@ -340,7 +339,7 @@ export const accessApprovalRequestServiceFactory = ({
       });
     }
 
-    const { membership, hasRole, permission } = await permissionService.getProjectPermission({
+    const { membership, hasRole } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: accessApprovalRequest.projectId,
@@ -355,13 +354,13 @@ export const accessApprovalRequestServiceFactory = ({
 
     const isSelfApproval = actorId === accessApprovalRequest.requestedByUserId;
     const isSoftEnforcement = policy.enforcementLevel === EnforcementLevel.Soft;
-    const canBypassApproval = permission.can(
-      ProjectPermissionApprovalActions.AllowAccessBypass,
-      ProjectPermissionSub.SecretApproval
-    );
-    const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypassApproval);
+    const canBypass = !policy.bypassers.length || policy.bypassers.some((bypasser) => bypasser.userId === actorId);
+    const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypass);
 
-    if (!policy.allowedSelfApprovals && isSelfApproval && cannotBypassUnderSoftEnforcement) {
+    const isApprover = policy.approvers.find((approver) => approver.userId === actorId);
+
+    // If user is (not an approver OR cant self approve) AND can't bypass policy
+    if ((!isApprover || (!policy.allowedSelfApprovals && isSelfApproval)) && cannotBypassUnderSoftEnforcement) {
       throw new BadRequestError({
         message: "Failed to review access approval request. Users are not authorized to review their own request."
       });
@@ -370,7 +369,7 @@ export const accessApprovalRequestServiceFactory = ({
     if (
       !hasRole(ProjectMembershipRole.Admin) &&
       accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user
-      !policy.approvers.find((approver) => approver.userId === actorId) // The request isn't performed by an assigned approver
+      !isApprover // The request isn't performed by an assigned approver
     ) {
       throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
     }
@@ -478,7 +477,11 @@ export const accessApprovalRequestServiceFactory = ({
             );
             privilegeIdToSet = privilege.id;
           }
-          await accessApprovalRequestDAL.updateById(accessApprovalRequest.id, { privilegeId: privilegeIdToSet }, tx);
+          await accessApprovalRequestDAL.updateById(
+            accessApprovalRequest.id,
+            { privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED },
+            tx
+          );
         }
       }
 

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -381,14 +381,6 @@ export enum EventType {
   PROJECT_ASSUME_PRIVILEGE_SESSION_START = "project-assume-privileges-session-start",
   PROJECT_ASSUME_PRIVILEGE_SESSION_END = "project-assume-privileges-session-end",
 
-  GET_PROJECT_PIT_COMMITS = "get-project-pit-commits",
-  GET_PROJECT_PIT_COMMIT_CHANGES = "get-project-pit-commit-changes",
-  GET_PROJECT_PIT_COMMIT_COUNT = "get-project-pit-commit-count",
-  PIT_ROLLBACK_COMMIT = "pit-rollback-commit",
-  PIT_REVERT_COMMIT = "pit-revert-commit",
-  PIT_GET_FOLDER_STATE = "pit-get-folder-state",
-  PIT_COMPARE_FOLDER_STATES = "pit-compare-folder-states",
-
   UPDATE_ORG = "update-org",
 
   CREATE_PROJECT = "create-project",
@@ -2961,78 +2953,6 @@ interface MicrosoftTeamsWorkflowIntegrationUpdateEvent {
   };
 }
 
-interface GetProjectPitCommitsEvent {
-  type: EventType.GET_PROJECT_PIT_COMMITS;
-  metadata: {
-    commitCount: string;
-    environment: string;
-    path: string;
-    offset: string;
-    limit: string;
-    search?: string;
-    sort: string;
-  };
-}
-
-interface GetProjectPitCommitChangesEvent {
-  type: EventType.GET_PROJECT_PIT_COMMIT_CHANGES;
-  metadata: {
-    changesCount: string;
-    commitId: string;
-  };
-}
-
-interface GetProjectPitCommitCountEvent {
-  type: EventType.GET_PROJECT_PIT_COMMIT_COUNT;
-  metadata: {
-    environment: string;
-    path: string;
-    commitCount: string;
-  };
-}
-
-interface PitRollbackCommitEvent {
-  type: EventType.PIT_ROLLBACK_COMMIT;
-  metadata: {
-    targetCommitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    message: string;
-    totalChanges: string;
-    environment: string;
-  };
-}
-
-interface PitRevertCommitEvent {
-  type: EventType.PIT_REVERT_COMMIT;
-  metadata: {
-    commitId: string;
-    revertCommitId?: string;
-    changesReverted?: string;
-  };
-}
-
-interface PitGetFolderStateEvent {
-  type: EventType.PIT_GET_FOLDER_STATE;
-  metadata: {
-    commitId: string;
-    folderId: string;
-    resourceCount: string;
-  };
-}
-
-interface PitCompareFolderStatesEvent {
-  type: EventType.PIT_COMPARE_FOLDER_STATES;
-  metadata: {
-    targetCommitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    diffsCount: string;
-    environment: string;
-    folderPath: string;
-  };
-}
-
 interface OrgUpdateEvent {
   type: EventType.UPDATE_ORG;
   metadata: {
@@ -3356,13 +3276,6 @@ export type Event =
   | MicrosoftTeamsWorkflowIntegrationGetEvent
   | MicrosoftTeamsWorkflowIntegrationListEvent
   | MicrosoftTeamsWorkflowIntegrationUpdateEvent
-  | GetProjectPitCommitsEvent
-  | GetProjectPitCommitChangesEvent
-  | PitRollbackCommitEvent
-  | GetProjectPitCommitCountEvent
-  | PitRevertCommitEvent
-  | PitCompareFolderStatesEvent
-  | PitGetFolderStateEvent
   | OrgUpdateEvent
   | ProjectCreateEvent
   | ProjectUpdateEvent

backend/src/ee/services/dynamic-secret/providers/index.ts

@@ -6,6 +6,7 @@ import { AwsIamProvider } from "./aws-iam";
 import { AzureEntraIDProvider } from "./azure-entra-id";
 import { CassandraProvider } from "./cassandra";
 import { ElasticSearchProvider } from "./elastic-search";
+import { KubernetesProvider } from "./kubernetes";
 import { LdapProvider } from "./ldap";
 import { DynamicSecretProviders, TDynamicProviderFns } from "./models";
 import { MongoAtlasProvider } from "./mongo-atlas";
@@ -38,5 +39,6 @@ export const buildDynamicSecretProviders = ({
   [DynamicSecretProviders.SapHana]: SapHanaProvider(),
   [DynamicSecretProviders.Snowflake]: SnowflakeProvider(),
   [DynamicSecretProviders.Totp]: TotpProvider(),
-  [DynamicSecretProviders.SapAse]: SapAseProvider()
+  [DynamicSecretProviders.SapAse]: SapAseProvider(),
+  [DynamicSecretProviders.Kubernetes]: KubernetesProvider({ gatewayService })
 });

backend/src/ee/services/dynamic-secret/providers/kubernetes.ts

@@ -0,0 +1,199 @@
+import axios from "axios";
+import https from "https";
+
+import { InternalServerError } from "@app/lib/errors";
+import { withGatewayProxy } from "@app/lib/gateway";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { TKubernetesTokenRequest } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-types";
+
+import { TGatewayServiceFactory } from "../../gateway/gateway-service";
+import { DynamicSecretKubernetesSchema, TDynamicProviderFns } from "./models";
+
+const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
+
+type TKubernetesProviderDTO = {
+  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
+};
+
+export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO): TDynamicProviderFns => {
+  const validateProviderInputs = async (inputs: unknown) => {
+    const providerInputs = await DynamicSecretKubernetesSchema.parseAsync(inputs);
+    if (!providerInputs.gatewayId) {
+      await blockLocalAndPrivateIpAddresses(providerInputs.url);
+    }
+
+    return providerInputs;
+  };
+
+  const $gatewayProxyWrapper = async <T>(
+    inputs: {
+      gatewayId: string;
+      targetHost: string;
+      targetPort: number;
+    },
+    gatewayCallback: (host: string, port: number) => Promise<T>
+  ): Promise<T> => {
+    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(inputs.gatewayId);
+    const [relayHost, relayPort] = relayDetails.relayAddress.split(":");
+
+    const callbackResult = await withGatewayProxy(
+      async (port) => {
+        // Needs to be https protocol or the kubernetes API server will fail with "Client sent an HTTP request to an HTTPS server"
+        const res = await gatewayCallback("https://localhost", port);
+        return res;
+      },
+      {
+        targetHost: inputs.targetHost,
+        targetPort: inputs.targetPort,
+        relayHost,
+        relayPort: Number(relayPort),
+        identityId: relayDetails.identityId,
+        orgId: relayDetails.orgId,
+        tlsOptions: {
+          ca: relayDetails.certChain,
+          cert: relayDetails.certificate,
+          key: relayDetails.privateKey.toString()
+        }
+      }
+    );
+
+    return callbackResult;
+  };
+
+  const validateConnection = async (inputs: unknown) => {
+    const providerInputs = await validateProviderInputs(inputs);
+
+    const serviceAccountGetCallback = async (host: string, port: number) => {
+      const baseUrl = port ? `${host}:${port}` : host;
+
+      await axios.get(
+        `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}`,
+        {
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${providerInputs.clusterToken}`
+          },
+          signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
+          timeout: EXTERNAL_REQUEST_TIMEOUT,
+          httpsAgent: new https.Agent({
+            ca: providerInputs.ca,
+            rejectUnauthorized: providerInputs.sslEnabled
+          })
+        }
+      );
+    };
+
+    const url = new URL(providerInputs.url);
+    const k8sPort = url.port ? Number(url.port) : 443;
+
+    try {
+      if (providerInputs.gatewayId) {
+        const k8sHost = url.hostname;
+
+        await $gatewayProxyWrapper(
+          {
+            gatewayId: providerInputs.gatewayId,
+            targetHost: k8sHost,
+            targetPort: k8sPort
+          },
+          serviceAccountGetCallback
+        );
+      } else {
+        const k8sHost = `${url.protocol}//${url.hostname}`;
+        await serviceAccountGetCallback(k8sHost, k8sPort);
+      }
+
+      return true;
+    } catch (error) {
+      let errorMessage = error instanceof Error ? error.message : "Unknown error";
+      if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) {
+        errorMessage = (error.response?.data as { message: string }).message;
+      }
+
+      throw new InternalServerError({
+        message: `Failed to validate connection: ${errorMessage}`
+      });
+    }
+  };
+
+  const create = async (inputs: unknown, expireAt: number) => {
+    const providerInputs = await validateProviderInputs(inputs);
+
+    const tokenRequestCallback = async (host: string, port: number) => {
+      const baseUrl = port ? `${host}:${port}` : host;
+
+      const res = await axios.post<TKubernetesTokenRequest>(
+        `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}/token`,
+        {
+          spec: {
+            expirationSeconds: Math.floor((expireAt - Date.now()) / 1000),
+            ...(providerInputs.audiences?.length ? { audiences: providerInputs.audiences } : {})
+          }
+        },
+        {
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${providerInputs.clusterToken}`
+          },
+          signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
+          timeout: EXTERNAL_REQUEST_TIMEOUT,
+          httpsAgent: new https.Agent({
+            ca: providerInputs.ca,
+            rejectUnauthorized: providerInputs.sslEnabled
+          })
+        }
+      );
+
+      return res.data;
+    };
+
+    const url = new URL(providerInputs.url);
+    const k8sHost = `${url.protocol}//${url.hostname}`;
+    const k8sGatewayHost = url.hostname;
+    const k8sPort = url.port ? Number(url.port) : 443;
+
+    try {
+      const tokenData = providerInputs.gatewayId
+        ? await $gatewayProxyWrapper(
+            {
+              gatewayId: providerInputs.gatewayId,
+              targetHost: k8sGatewayHost,
+              targetPort: k8sPort
+            },
+            tokenRequestCallback
+          )
+        : await tokenRequestCallback(k8sHost, k8sPort);
+
+      return {
+        entityId: providerInputs.serviceAccountName,
+        data: { TOKEN: tokenData.status.token }
+      };
+    } catch (error) {
+      let errorMessage = error instanceof Error ? error.message : "Unknown error";
+      if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) {
+        errorMessage = (error.response?.data as { message: string }).message;
+      }
+
+      throw new InternalServerError({
+        message: `Failed to create dynamic secret: ${errorMessage}`
+      });
+    }
+  };
+
+  const revoke = async (_inputs: unknown, entityId: string) => {
+    return { entityId };
+  };
+
+  const renew = async (_inputs: unknown, entityId: string) => {
+    // No renewal necessary
+    return { entityId };
+  };
+
+  return {
+    validateProviderInputs,
+    validateConnection,
+    create,
+    revoke,
+    renew
+  };
+};

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -29,6 +29,10 @@ export enum LdapCredentialType {
   Static = "static"
 }
 
+export enum KubernetesCredentialType {
+  Static = "static"
+}
+
 export enum TotpConfigType {
   URL = "url",
   MANUAL = "manual"
@@ -277,6 +281,18 @@ export const LdapSchema = z.union([
   })
 ]);
 
+export const DynamicSecretKubernetesSchema = z.object({
+  url: z.string().url().trim().min(1),
+  gatewayId: z.string().nullable().optional(),
+  sslEnabled: z.boolean().default(true),
+  clusterToken: z.string().trim().min(1),
+  ca: z.string().optional(),
+  serviceAccountName: z.string().trim().min(1),
+  credentialType: z.literal(KubernetesCredentialType.Static),
+  namespace: z.string().trim().min(1),
+  audiences: z.array(z.string().trim().min(1))
+});
+
 export const DynamicSecretTotpSchema = z.discriminatedUnion("configType", [
   z.object({
     configType: z.literal(TotpConfigType.URL),
@@ -320,7 +336,8 @@ export enum DynamicSecretProviders {
   SapHana = "sap-hana",
   Snowflake = "snowflake",
   Totp = "totp",
-  SapAse = "sap-ase"
+  SapAse = "sap-ase",
+  Kubernetes = "kubernetes"
 }
 
 export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
@@ -338,7 +355,8 @@ export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal(DynamicSecretProviders.AzureEntraID), inputs: AzureEntraIDSchema }),
   z.object({ type: z.literal(DynamicSecretProviders.Ldap), inputs: LdapSchema }),
   z.object({ type: z.literal(DynamicSecretProviders.Snowflake), inputs: DynamicSecretSnowflakeSchema }),
-  z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema })
+  z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema }),
+  z.object({ type: z.literal(DynamicSecretProviders.Kubernetes), inputs: DynamicSecretKubernetesSchema })
 ]);
 
 export type TDynamicProviderFns = {

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -44,7 +44,6 @@ import {
   TOidcLoginDTO,
   TUpdateOidcCfgDTO
 } from "./oidc-config-types";
-import { logger } from "@app/lib/logger";
 
 type TOidcConfigServiceFactoryDep = {
   userDAL: Pick<
@@ -700,7 +699,6 @@ export const oidcConfigServiceFactory = ({
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (_req: any, tokenSet: TokenSet, cb: any) => {
         const claims = tokenSet.claims();
-        logger.info(`User OIDC claims received for [orgId=${org.id}] [claims=${JSON.stringify(claims)}]`);
         if (!claims.email || !claims.given_name) {
           throw new BadRequestError({
             message: "Invalid request. Missing email or first name"

backend/src/ee/services/permission/default-roles.ts

@@ -2,16 +2,15 @@ import { AbilityBuilder, createMongoAbility, MongoAbility } from "@casl/ability"
 
 import {
   ProjectPermissionActions,
-  ProjectPermissionApprovalActions,
   ProjectPermissionCertificateActions,
   ProjectPermissionCmekActions,
-  ProjectPermissionCommitsActions,
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
   ProjectPermissionKmipActions,
   ProjectPermissionMemberActions,
   ProjectPermissionPkiSubscriberActions,
+  ProjectPermissionPkiTemplateActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSecretRotationActions,
   ProjectPermissionSecretSyncActions,
@@ -37,7 +36,6 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.AuditLogs,
     ProjectPermissionSub.IpAllowList,
     ProjectPermissionSub.CertificateAuthorities,
-    ProjectPermissionSub.CertificateTemplates,
     ProjectPermissionSub.PkiAlerts,
     ProjectPermissionSub.PkiCollections,
     ProjectPermissionSub.SshCertificateAuthorities,
@@ -58,12 +56,22 @@ const buildAdminPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionApprovalActions.Read,
-      ProjectPermissionApprovalActions.Edit,
-      ProjectPermissionApprovalActions.Create,
-      ProjectPermissionApprovalActions.Delete,
-      ProjectPermissionApprovalActions.AllowChangeBypass,
-      ProjectPermissionApprovalActions.AllowAccessBypass
+      ProjectPermissionPkiTemplateActions.Read,
+      ProjectPermissionPkiTemplateActions.Edit,
+      ProjectPermissionPkiTemplateActions.Create,
+      ProjectPermissionPkiTemplateActions.Delete,
+      ProjectPermissionPkiTemplateActions.IssueCert,
+      ProjectPermissionPkiTemplateActions.ListCerts
+    ],
+    ProjectPermissionSub.CertificateTemplates
+  );
+
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
     ],
     ProjectPermissionSub.SecretApproval
   );
@@ -79,11 +87,6 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.Certificates
   );
 
-  can(
-    [ProjectPermissionCommitsActions.Read, ProjectPermissionCommitsActions.PerformRollback],
-    ProjectPermissionSub.Commits
-  );
-
   can(
     [
       ProjectPermissionSshHostActions.Edit,
@@ -261,12 +264,7 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.SecretImports
   );
 
-  can(
-    [ProjectPermissionCommitsActions.Read, ProjectPermissionCommitsActions.PerformRollback],
-    ProjectPermissionSub.Commits
-  );
-
-  can([ProjectPermissionApprovalActions.Read], ProjectPermissionSub.SecretApproval);
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretApproval);
   can([ProjectPermissionSecretRotationActions.Read], ProjectPermissionSub.SecretRotation);
 
   can([ProjectPermissionActions.Read, ProjectPermissionActions.Create], ProjectPermissionSub.SecretRollback);
@@ -362,7 +360,7 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.Certificates
   );
 
-  can([ProjectPermissionActions.Read], ProjectPermissionSub.CertificateTemplates);
+  can([ProjectPermissionPkiTemplateActions.Read], ProjectPermissionSub.CertificateTemplates);
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiAlerts);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiCollections);
@@ -414,7 +412,7 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
   can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionApprovalActions.Read, ProjectPermissionSub.SecretApproval);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionSecretRotationActions.Read, ProjectPermissionSub.SecretRotation);
   can(ProjectPermissionMemberActions.Read, ProjectPermissionSub.Member);
@@ -431,11 +429,11 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
   can(ProjectPermissionCertificateActions.Read, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionPkiTemplateActions.Read, ProjectPermissionSub.CertificateTemplates);
   can(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateTemplates);
   can(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs);
-  can(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
 
   return rules;
 };

backend/src/ee/services/permission/project-permission.ts

@@ -17,11 +17,6 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
-export enum ProjectPermissionCommitsActions {
-  Read = "read",
-  PerformRollback = "perform-rollback"
-}
-
 export enum ProjectPermissionCertificateActions {
   Read = "read",
   Create = "create",
@@ -39,15 +34,6 @@ export enum ProjectPermissionSecretActions {
   Delete = "delete"
 }
 
-export enum ProjectPermissionApprovalActions {
-  Read = "read",
-  Create = "create",
-  Edit = "edit",
-  Delete = "delete",
-  AllowChangeBypass = "allow-change-bypass",
-  AllowAccessBypass = "allow-access-bypass"
-}
-
 export enum ProjectPermissionCmekActions {
   Read = "read",
   Create = "create",
@@ -101,6 +87,15 @@ export enum ProjectPermissionSshHostActions {
   IssueHostCert = "issue-host-cert"
 }
 
+export enum ProjectPermissionPkiTemplateActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  IssueCert = "issue-cert",
+  ListCerts = "list-certs"
+}
+
 export enum ProjectPermissionPkiSubscriberActions {
   Read = "read",
   Create = "create",
@@ -157,7 +152,6 @@ export enum ProjectPermissionSub {
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
-  Commits = "commits",
   Identity = "identity",
   CertificateAuthorities = "certificate-authorities",
   Certificates = "certificates",
@@ -215,6 +209,11 @@ export type SshHostSubjectFields = {
   hostname: string;
 };
 
+export type PkiTemplateSubjectFields = {
+  name: string;
+  // (dangtony98): consider adding [commonName] as a subject field in the future
+};
+
 export type PkiSubscriberSubjectFields = {
   name: string;
   // (dangtony98): consider adding [commonName] as a subject field in the future
@@ -257,7 +256,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.IpAllowList]
   | [ProjectPermissionActions, ProjectPermissionSub.Settings]
   | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
-  | [ProjectPermissionApprovalActions, ProjectPermissionSub.SecretApproval]
+  | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
   | [
       ProjectPermissionSecretRotationActions,
       (
@@ -271,7 +270,13 @@ export type ProjectPermissionSet =
     ]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
   | [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
-  | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
+  | [
+      ProjectPermissionPkiTemplateActions,
+      (
+        | ProjectPermissionSub.CertificateTemplates
+        | (ForcedSubject<ProjectPermissionSub.CertificateTemplates> & PkiTemplateSubjectFields)
+      )
+    ]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateAuthorities]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificates]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateTemplates]
@@ -296,8 +301,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
   | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms]
-  | [ProjectPermissionCommitsActions, ProjectPermissionSub.Commits];
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms];
 
 const SECRET_PATH_MISSING_SLASH_ERR_MSG = "Invalid Secret Path; it must start with a '/'";
 const SECRET_PATH_PERMISSION_OPERATOR_SCHEMA = z.union([
@@ -452,10 +456,25 @@ const PkiSubscriberConditionSchema = z
   })
   .partial();
 
+const PkiTemplateConditionSchema = z
+  .object({
+    name: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+        })
+        .partial()
+    ])
+  })
+  .partial();
+
 const GeneralPermissionSchema = [
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionApprovalActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
       "Describe what action an entity can take."
     )
   }),
@@ -543,12 +562,6 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
-      "Describe what action an entity can take."
-    )
-  }),
   z.object({
     subject: z
       .literal(ProjectPermissionSub.SshCertificateAuthorities)
@@ -618,12 +631,6 @@ const GeneralPermissionSchema = [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionKmipActions).describe(
       "Describe what action an entity can take."
     )
-  }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.Commits).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCommitsActions).describe(
-      "Describe what action an entity can take."
-    )
   })
 ];
 
@@ -732,6 +739,16 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionPkiTemplateActions).describe(
+      "Describe what action an entity can take."
+    ),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    conditions: PkiTemplateConditionSchema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretRotation).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
@@ -742,6 +759,7 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
+
   ...GeneralPermissionSchema
 ]);
 

backend/src/ee/services/pit/pit-service.ts

@@ -1,485 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import { ForbiddenError } from "@casl/ability";
-
-import { ActionProjectType } from "@app/db/schemas";
-import { ProjectPermissionCommitsActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { NotFoundError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
-import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
-import { ResourceType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import {
-  isFolderCommitChange,
-  isSecretCommitChange
-} from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
-import { TSecretServiceFactory } from "@app/services/secret/secret-service";
-import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service";
-
-import { TPermissionServiceFactory } from "../permission/permission-service";
-
-type TPitServiceFactoryDep = {
-  folderCommitService: TFolderCommitServiceFactory;
-  secretService: Pick<TSecretServiceFactory, "getSecretVersionsV2ByIds" | "getChangeVersions">;
-  folderService: Pick<TSecretFolderServiceFactory, "getFolderById" | "getFolderVersions">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  folderDAL: Pick<TSecretFolderDALFactory, "findSecretPathByFolderIds">;
-  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
-};
-
-export type TPitServiceFactory = ReturnType<typeof pitServiceFactory>;
-
-export const pitServiceFactory = ({
-  folderCommitService,
-  secretService,
-  folderService,
-  permissionService,
-  folderDAL,
-  projectEnvDAL
-}: TPitServiceFactoryDep) => {
-  const getCommitsCount = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    environment,
-    path
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    environment: string;
-    path: string;
-  }) => {
-    const result = await folderCommitService.getCommitsCount({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      environment,
-      path
-    });
-
-    return result;
-  };
-
-  const getCommitsForFolder = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    environment,
-    path,
-    offset,
-    limit,
-    search,
-    sort
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    environment: string;
-    path: string;
-    offset: number;
-    limit: number;
-    search?: string;
-    sort: "asc" | "desc";
-  }) => {
-    const result = await folderCommitService.getCommitsForFolder({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      environment,
-      path,
-      offset,
-      limit,
-      search,
-      sort
-    });
-
-    return {
-      commits: result.commits.map((commit) => ({
-        ...commit,
-        commitId: commit.commitId.toString()
-      })),
-      total: result.total,
-      hasMore: result.hasMore
-    };
-  };
-
-  const getCommitChanges = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const changes = await folderCommitService.getCommitChanges({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      commitId
-    });
-
-    const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(projectId, [changes.folderId]);
-
-    for (const change of changes.changes) {
-      if (isSecretCommitChange(change)) {
-        change.versions = await secretService.getChangeVersions(
-          {
-            secretVersion: change.secretVersion,
-            secretId: change.secretId,
-            id: change.id,
-            isUpdate: change.isUpdate,
-            changeType: change.changeType
-          },
-          (Number.parseInt(change.secretVersion, 10) - 1).toString(),
-          actorId,
-          actor,
-          actorOrgId,
-          actorAuthMethod,
-          changes.envId,
-          projectId,
-          folderWithPath?.path || ""
-        );
-      } else if (isFolderCommitChange(change)) {
-        change.versions = await folderService.getFolderVersions(
-          change,
-          (Number.parseInt(change.folderVersion, 10) - 1).toString(),
-          change.folderChangeId
-        );
-      }
-    }
-
-    return {
-      changes: {
-        ...changes,
-        commitId: changes.commitId.toString()
-      }
-    };
-  };
-
-  const compareCommitChanges = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId,
-    folderId,
-    environment,
-    deepRollback,
-    secretPath
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-    folderId: string;
-    environment: string;
-    deepRollback: boolean;
-    secretPath: string;
-  }) => {
-    const latestCommit = await folderCommitService.getLatestCommit({
-      folderId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    const targetCommit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    const env = await projectEnvDAL.findOne({
-      projectId,
-      slug: environment
-    });
-
-    if (!latestCommit) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    let diffs;
-    if (deepRollback) {
-      diffs = await folderCommitService.deepCompareFolder({
-        targetCommitId: targetCommit.id,
-        envId: env.id,
-        projectId
-      });
-    } else {
-      const folderData = await folderService.getFolderById({
-        actor,
-        actorId,
-        actorOrgId,
-        actorAuthMethod,
-        id: folderId
-      });
-
-      diffs = [
-        {
-          folderId: folderData.id,
-          folderName: folderData.name,
-          folderPath: secretPath,
-          changes: await folderCommitService.compareFolderStates({
-            targetCommitId: commitId,
-            currentCommitId: latestCommit.id
-          })
-        }
-      ];
-    }
-
-    for (const diff of diffs) {
-      for (const change of diff.changes) {
-        // Use discriminated union type checking
-        if (change.type === ResourceType.SECRET) {
-          // TypeScript now knows this is a SecretChange
-          if (change.secretKey && change.secretVersion && change.secretId) {
-            change.versions = await secretService.getChangeVersions(
-              {
-                secretVersion: change.secretVersion,
-                secretId: change.secretId,
-                id: change.id,
-                isUpdate: change.isUpdate,
-                changeType: change.changeType
-              },
-              change.fromVersion || "1",
-              actorId,
-              actor,
-              actorOrgId,
-              actorAuthMethod,
-              env.id,
-              projectId,
-              diff.folderPath || ""
-            );
-          }
-        } else if (change.type === ResourceType.FOLDER) {
-          // TypeScript now knows this is a FolderChange
-          if (change.folderVersion) {
-            change.versions = await folderService.getFolderVersions(change, change.fromVersion || "1", change.id);
-          }
-        }
-      }
-    }
-
-    return diffs;
-  };
-
-  const rollbackToCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId,
-    folderId,
-    deepRollback,
-    message,
-    environment
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    message?: string;
-    environment: string;
-  }) => {
-    const { permission: userPermission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-
-    ForbiddenError.from(userPermission).throwUnlessCan(
-      ProjectPermissionCommitsActions.PerformRollback,
-      ProjectPermissionSub.Commits
-    );
-
-    const latestCommit = await folderCommitService.getLatestCommit({
-      folderId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    if (!latestCommit) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    logger.info(`PIT - Attempting to rollback folder ${folderId} from commit ${latestCommit.id} to commit ${commitId}`);
-
-    const targetCommit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorAuthMethod,
-      actorOrgId,
-      projectId
-    });
-
-    const env = await projectEnvDAL.findOne({
-      projectId,
-      slug: environment
-    });
-
-    if (!targetCommit || targetCommit.folderId !== folderId || targetCommit.envId !== env.id) {
-      throw new NotFoundError({ message: "Target commit not found" });
-    }
-
-    if (!latestCommit || latestCommit.envId !== env.id) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    if (deepRollback) {
-      await folderCommitService.deepRollbackFolder(commitId, env.id, actorId, actor, projectId, message);
-      return { success: true };
-    }
-
-    const diff = await folderCommitService.compareFolderStates({
-      currentCommitId: latestCommit.id,
-      targetCommitId: commitId
-    });
-
-    const response = await folderCommitService.applyFolderStateDifferences({
-      differences: diff,
-      actorInfo: {
-        actorType: actor,
-        actorId,
-        message: message || "Rollback to previous commit"
-      },
-      folderId,
-      projectId,
-      reconstructNewFolders: deepRollback
-    });
-
-    return {
-      success: true,
-      secretChangesCount: response.secretChangesCount,
-      folderChangesCount: response.folderChangesCount,
-      totalChanges: response.totalChanges
-    };
-  };
-
-  const revertCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const response = await folderCommitService.revertCommitChanges({
-      commitId,
-      actor,
-      actorId,
-      actorAuthMethod,
-      actorOrgId,
-      projectId
-    });
-
-    return response;
-  };
-
-  const getFolderStateAtCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const commit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    if (!commit) {
-      throw new NotFoundError({ message: `Commit with ID ${commitId} not found` });
-    }
-
-    const response = await folderCommitService.reconstructFolderState(commitId);
-
-    return response.map((item) => {
-      if (item.type === ResourceType.SECRET) {
-        return {
-          ...item,
-          secretVersion: Number(item.secretVersion)
-        };
-      }
-
-      if (item.type === ResourceType.FOLDER) {
-        return {
-          ...item,
-          folderVersion: Number(item.folderVersion)
-        };
-      }
-
-      return item;
-    });
-  };
-
-  return {
-    getCommitsCount,
-    getCommitsForFolder,
-    getCommitChanges,
-    compareCommitChanges,
-    rollbackToCommit,
-    revertCommit,
-    getFolderStateAtCommit
-  };
-};

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -9,6 +9,7 @@ import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/per
 import { ActorType } from "@app/services/auth/auth-type";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 
+import { TAccessApprovalRequestDALFactory } from "../access-approval-request/access-approval-request-dal";
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import {
@@ -16,6 +17,7 @@ import {
   ProjectPermissionSet,
   ProjectPermissionSub
 } from "../permission/project-permission";
+import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "./project-user-additional-privilege-dal";
 import {
   ProjectUserAdditionalPrivilegeTemporaryMode,
@@ -30,6 +32,7 @@ type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
   projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
 };
 
 export type TProjectUserAdditionalPrivilegeServiceFactory = ReturnType<
@@ -44,7 +47,8 @@ const unpackPermissions = (permissions: unknown) =>
 export const projectUserAdditionalPrivilegeServiceFactory = ({
   projectUserAdditionalPrivilegeDAL,
   projectMembershipDAL,
-  permissionService
+  permissionService,
+  accessApprovalRequestDAL
 }: TProjectUserAdditionalPrivilegeServiceFactoryDep) => {
   const create = async ({
     slug,
@@ -279,6 +283,15 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member);
 
+    await accessApprovalRequestDAL.update(
+      {
+        privilegeId: userPrivilege.id
+      },
+      {
+        privilegeDeletedAt: new Date(),
+        status: ApprovalStatus.REJECTED
+      }
+    );
     const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
     return {
       ...deletedPrivilege,

backend/src/ee/services/secret-approval-policy/secret-approval-policy-approver-dal.ts

@@ -8,3 +8,10 @@ export const secretApprovalPolicyApproverDALFactory = (db: TDbClient) => {
   const sapApproverOrm = ormify(db, TableName.SecretApprovalPolicyApprover);
   return sapApproverOrm;
 };
+
+export type TSecretApprovalPolicyBypasserDALFactory = ReturnType<typeof secretApprovalPolicyBypasserDALFactory>;
+
+export const secretApprovalPolicyBypasserDALFactory = (db: TDbClient) => {
+  const sapBypasserOrm = ormify(db, TableName.SecretApprovalPolicyBypasser);
+  return sapBypasserOrm;
+};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -1,11 +1,17 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { SecretApprovalPoliciesSchema, TableName, TSecretApprovalPolicies, TUsers } from "@app/db/schemas";
+import {
+  SecretApprovalPoliciesSchema,
+  TableName,
+  TSecretApprovalPolicies,
+  TUserGroupMembership,
+  TUsers
+} from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
-import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
 
 export type TSecretApprovalPolicyDALFactory = ReturnType<typeof secretApprovalPolicyDALFactory>;
 
@@ -43,6 +49,22 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
         "secretApprovalPolicyApproverUser.id"
       )
+      // Bypasser
+      .leftJoin(
+        TableName.SecretApprovalPolicyBypasser,
+        `${TableName.SecretApprovalPolicy}.id`,
+        `${TableName.SecretApprovalPolicyBypasser}.policyId`
+      )
+      .leftJoin<TUserGroupMembership>(
+        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+        `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
+        `bypasserUserGroupMembership.groupId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("secretApprovalPolicyBypasserUser"),
+        `${TableName.SecretApprovalPolicyBypasser}.bypasserUserId`,
+        "secretApprovalPolicyBypasserUser.id"
+      )
       .leftJoin<TUsers>(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
       .select(
         tx.ref("id").withSchema("secretApprovalPolicyApproverUser").as("approverUserId"),
@@ -58,6 +80,20 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema(TableName.Users).as("approverGroupFirstName"),
         tx.ref("lastName").withSchema(TableName.Users).as("approverGroupLastName")
       )
+      .select(
+        tx.ref("id").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUserId"),
+        tx.ref("email").withSchema("secretApprovalPolicyBypasserUser").as("bypasserEmail"),
+        tx.ref("firstName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserFirstName"),
+        tx.ref("username").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUsername"),
+        tx.ref("lastName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserLastName")
+      )
+      .select(
+        tx.ref("bypasserGroupId").withSchema(TableName.SecretApprovalPolicyBypasser),
+        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
+        tx.ref("email").withSchema(TableName.Users).as("bypasserGroupEmail"),
+        tx.ref("firstName").withSchema(TableName.Users).as("bypasserGroupFirstName"),
+        tx.ref("lastName").withSchema(TableName.Users).as("bypasserGroupLastName")
+      )
       .select(
         tx.ref("name").withSchema(TableName.Environment).as("envName"),
         tx.ref("slug").withSchema(TableName.Environment).as("envSlug"),
@@ -143,7 +179,7 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
             label: "approvers" as const,
             mapper: ({ approverUserId: id, approverUsername }) => ({
               type: ApproverType.User,
-              name: approverUsername,
+              username: approverUsername,
               id
             })
           },
@@ -155,6 +191,23 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
               id
             })
           },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserUserId: id, bypasserUsername }) => ({
+              type: BypasserType.User,
+              username: bypasserUsername,
+              id
+            })
+          },
+          {
+            key: "bypasserGroupId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserGroupId: id }) => ({
+              type: BypasserType.Group,
+              id
+            })
+          },
           {
             key: "approverUserId",
             label: "userApprovers" as const,

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -3,18 +3,21 @@ import picomatch from "picomatch";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { containsGlobPatterns } from "@app/lib/picomatch";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
-import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TSecretApprovalRequestDALFactory } from "../secret-approval-request/secret-approval-request-dal";
 import { RequestState } from "../secret-approval-request/secret-approval-request-types";
-import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
+import {
+  TSecretApprovalPolicyApproverDALFactory,
+  TSecretApprovalPolicyBypasserDALFactory
+} from "./secret-approval-policy-approver-dal";
 import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
 import {
   TCreateSapDTO,
@@ -36,6 +39,7 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   userDAL: Pick<TUserDALFactory, "find">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
+  secretApprovalPolicyBypasserDAL: TSecretApprovalPolicyBypasserDALFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   secretApprovalRequestDAL: Pick<TSecretApprovalRequestDALFactory, "update">;
 };
@@ -46,6 +50,7 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyDAL,
   permissionService,
   secretApprovalPolicyApproverDAL,
+  secretApprovalPolicyBypasserDAL,
   projectEnvDAL,
   userDAL,
   licenseService,
@@ -59,6 +64,7 @@ export const secretApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
+    bypassers,
     projectId,
     secretPath,
     environment,
@@ -74,7 +80,7 @@ export const secretApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
       .filter(Boolean) as string[];
 
     if (!groupApprovers.length && approvals > approvers.length)
@@ -89,7 +95,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Create,
+      ProjectPermissionActions.Create,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -107,6 +113,44 @@ export const secretApprovalPolicyServiceFactory = ({
         message: `Environment with slug '${environment}' not found in project with ID ${projectId}`
       });
 
+    let groupBypassers: string[] = [];
+    let bypasserUserIds: string[] = [];
+
+    if (bypassers && bypassers.length) {
+      groupBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.Group)
+        .map((bypasser) => bypasser.id) as string[];
+
+      const userBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.User)
+        .map((bypasser) => bypasser.id)
+        .filter(Boolean) as string[];
+
+      const userBypasserNames = bypassers
+        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
+        .filter(Boolean) as string[];
+
+      bypasserUserIds = userBypassers;
+      if (userBypasserNames.length) {
+        const bypasserUsers = await userDAL.find({
+          $in: {
+            username: userBypasserNames
+          }
+        });
+
+        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
+        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
+
+        if (invalidUsernames.length) {
+          throw new BadRequestError({
+            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
+          });
+        }
+
+        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
+      }
+    }
+
     const secretApproval = await secretApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await secretApprovalPolicyDAL.create(
         {
@@ -158,6 +202,27 @@ export const secretApprovalPolicyServiceFactory = ({
         })),
         tx
       );
+
+      if (bypasserUserIds.length) {
+        await secretApprovalPolicyBypasserDAL.insertMany(
+          bypasserUserIds.map((userId) => ({
+            bypasserUserId: userId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
+      if (groupBypassers.length) {
+        await secretApprovalPolicyBypasserDAL.insertMany(
+          groupBypassers.map((groupId) => ({
+            bypasserGroupId: groupId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
       return doc;
     });
 
@@ -166,6 +231,7 @@ export const secretApprovalPolicyServiceFactory = ({
 
   const updateSecretApprovalPolicy = async ({
     approvers,
+    bypassers,
     secretPath,
     name,
     actorId,
@@ -186,7 +252,7 @@ export const secretApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
       .filter(Boolean) as string[];
 
     const secretApprovalPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
@@ -204,10 +270,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Edit,
-      ProjectPermissionSub.SecretApproval
-    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
 
     const plan = await licenseService.getPlan(actorOrgId);
     if (!plan.secretApproval) {
@@ -217,6 +280,44 @@ export const secretApprovalPolicyServiceFactory = ({
       });
     }
 
+    let groupBypassers: string[] = [];
+    let bypasserUserIds: string[] = [];
+
+    if (bypassers && bypassers.length) {
+      groupBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.Group)
+        .map((bypasser) => bypasser.id) as string[];
+
+      const userBypassers = bypassers
+        .filter((bypasser) => bypasser.type === BypasserType.User)
+        .map((bypasser) => bypasser.id)
+        .filter(Boolean) as string[];
+
+      const userBypasserNames = bypassers
+        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
+        .filter(Boolean) as string[];
+
+      bypasserUserIds = userBypassers;
+      if (userBypasserNames.length) {
+        const bypasserUsers = await userDAL.find({
+          $in: {
+            username: userBypasserNames
+          }
+        });
+
+        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
+        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
+
+        if (invalidUsernames.length) {
+          throw new BadRequestError({
+            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
+          });
+        }
+
+        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
+      }
+    }
+
     const updatedSap = await secretApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await secretApprovalPolicyDAL.updateById(
         secretApprovalPolicy.id,
@@ -275,6 +376,28 @@ export const secretApprovalPolicyServiceFactory = ({
         );
       }
 
+      await secretApprovalPolicyBypasserDAL.delete({ policyId: doc.id }, tx);
+
+      if (bypasserUserIds.length) {
+        await secretApprovalPolicyBypasserDAL.insertMany(
+          bypasserUserIds.map((userId) => ({
+            bypasserUserId: userId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
+      if (groupBypassers.length) {
+        await secretApprovalPolicyBypasserDAL.insertMany(
+          groupBypassers.map((groupId) => ({
+            bypasserGroupId: groupId,
+            policyId: doc.id
+          })),
+          tx
+        );
+      }
+
       return doc;
     });
     return {
@@ -304,7 +427,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Delete,
+      ProjectPermissionActions.Delete,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -343,10 +466,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Read,
-      ProjectPermissionSub.SecretApproval
-    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
 
     const sapPolicies = await secretApprovalPolicyDAL.find({ projectId, deletedAt: null });
     return sapPolicies;
@@ -419,10 +539,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionApprovalActions.Read,
-      ProjectPermissionSub.SecretApproval
-    );
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
 
     return sapPolicy;
   };

backend/src/ee/services/secret-approval-policy/secret-approval-policy-types.ts

@@ -1,12 +1,16 @@
 import { EnforcementLevel, TProjectPermission } from "@app/lib/types";
 
-import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
 
 export type TCreateSapDTO = {
   approvals: number;
   secretPath?: string | null;
   environment: string;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
+  bypassers?: (
+    | { type: BypasserType.Group; id: string }
+    | { type: BypasserType.User; id?: string; username?: string }
+  )[];
   projectId: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -17,7 +21,11 @@ export type TUpdateSapDTO = {
   secretPolicyId: string;
   approvals?: number;
   secretPath?: string | null;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
+  bypassers?: (
+    | { type: BypasserType.Group; id: string }
+    | { type: BypasserType.User; id?: string; username?: string }
+  )[];
   name?: string;
   enforcementLevel?: EnforcementLevel;
   allowedSelfApprovals?: boolean;

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -6,6 +6,7 @@ import {
   TableName,
   TSecretApprovalRequests,
   TSecretApprovalRequestsSecrets,
+  TUserGroupMembership,
   TUsers
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
@@ -58,16 +59,36 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
         "secretApprovalPolicyApproverUser.id"
       )
-      .leftJoin(
-        TableName.UserGroupMembership,
+      .leftJoin<TUserGroupMembership>(
+        db(TableName.UserGroupMembership).as("approverUserGroupMembership"),
         `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
-        `${TableName.UserGroupMembership}.groupId`
+        `approverUserGroupMembership.groupId`
       )
       .leftJoin<TUsers>(
         db(TableName.Users).as("secretApprovalPolicyGroupApproverUser"),
-        `${TableName.UserGroupMembership}.userId`,
+        `approverUserGroupMembership.userId`,
         `secretApprovalPolicyGroupApproverUser.id`
       )
+      .leftJoin(
+        TableName.SecretApprovalPolicyBypasser,
+        `${TableName.SecretApprovalPolicy}.id`,
+        `${TableName.SecretApprovalPolicyBypasser}.policyId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("secretApprovalPolicyBypasserUser"),
+        `${TableName.SecretApprovalPolicyBypasser}.bypasserUserId`,
+        "secretApprovalPolicyBypasserUser.id"
+      )
+      .leftJoin<TUserGroupMembership>(
+        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+        `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
+        `bypasserUserGroupMembership.groupId`
+      )
+      .leftJoin<TUsers>(
+        db(TableName.Users).as("secretApprovalPolicyGroupBypasserUser"),
+        `bypasserUserGroupMembership.userId`,
+        `secretApprovalPolicyGroupBypasserUser.id`
+      )
       .leftJoin(
         TableName.SecretApprovalRequestReviewer,
         `${TableName.SecretApprovalRequest}.id`,
@@ -81,7 +102,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
       .select(selectAllTableCols(TableName.SecretApprovalRequest))
       .select(
         tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
-        tx.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
+        tx.ref("userId").withSchema("approverUserGroupMembership").as("approverGroupUserId"),
         tx.ref("email").withSchema("secretApprovalPolicyApproverUser").as("approverEmail"),
         tx.ref("email").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupEmail"),
         tx.ref("username").withSchema("secretApprovalPolicyApproverUser").as("approverUsername"),
@@ -90,6 +111,20 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupFirstName"),
         tx.ref("lastName").withSchema("secretApprovalPolicyApproverUser").as("approverLastName"),
         tx.ref("lastName").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupLastName"),
+
+        // Bypasser fields
+        tx.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
+        tx.ref("bypasserGroupId").withSchema(TableName.SecretApprovalPolicyBypasser),
+        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
+        tx.ref("email").withSchema("secretApprovalPolicyBypasserUser").as("bypasserEmail"),
+        tx.ref("email").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupEmail"),
+        tx.ref("username").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUsername"),
+        tx.ref("username").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupUsername"),
+        tx.ref("firstName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserFirstName"),
+        tx.ref("firstName").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupFirstName"),
+        tx.ref("lastName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserLastName"),
+        tx.ref("lastName").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupLastName"),
+
         tx.ref("email").withSchema("statusChangedByUser").as("statusChangedByUserEmail"),
         tx.ref("username").withSchema("statusChangedByUser").as("statusChangedByUserUsername"),
         tx.ref("firstName").withSchema("statusChangedByUser").as("statusChangedByUserFirstName"),
@@ -121,7 +156,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
     try {
       const sql = findQuery({ [`${TableName.SecretApprovalRequest}.id` as "id"]: id }, tx || db.replicaNode());
       const docs = await sql;
-      const formatedDoc = sqlNestRelationships({
+      const formattedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -203,13 +238,51 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
               lastName,
               username
             })
+          },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({
+              bypasserUserId: userId,
+              bypasserEmail: email,
+              bypasserUsername: username,
+              bypasserLastName: lastName,
+              bypasserFirstName: firstName
+            }) => ({
+              userId,
+              email,
+              firstName,
+              lastName,
+              username
+            })
+          },
+          {
+            key: "bypasserGroupUserId",
+            label: "bypassers" as const,
+            mapper: ({
+              bypasserGroupUserId: userId,
+              bypasserGroupEmail: email,
+              bypasserGroupUsername: username,
+              bypasserGroupLastName: lastName,
+              bypasserGroupFirstName: firstName
+            }) => ({
+              userId,
+              email,
+              firstName,
+              lastName,
+              username
+            })
           }
         ]
       });
-      if (!formatedDoc?.[0]) return;
+      if (!formattedDoc?.[0]) return;
       return {
-        ...formatedDoc[0],
-        policy: { ...formatedDoc[0].policy, approvers: formatedDoc[0].approvers }
+        ...formattedDoc[0],
+        policy: {
+          ...formattedDoc[0].policy,
+          approvers: formattedDoc[0].approvers,
+          bypassers: formattedDoc[0].bypassers
+        }
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "FindByIdSAR" });
@@ -291,6 +364,16 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
+        .leftJoin(
+          TableName.SecretApprovalPolicyBypasser,
+          `${TableName.SecretApprovalPolicy}.id`,
+          `${TableName.SecretApprovalPolicyBypasser}.policyId`
+        )
+        .leftJoin<TUserGroupMembership>(
+          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+          `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
+          `bypasserUserGroupMembership.groupId`
+        )
         .join<TUsers>(
           db(TableName.Users).as("committerUser"),
           `${TableName.SecretApprovalRequest}.committerUserId`,
@@ -342,6 +425,11 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           db.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
           db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
           db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
+
+          // Bypasser fields
+          db.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
+          db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
+
           db.ref("email").withSchema("committerUser").as("committerUserEmail"),
           db.ref("username").withSchema("committerUser").as("committerUserUsername"),
           db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
@@ -355,7 +443,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         .from<Awaited<typeof query>[number]>("w")
         .where("w.rank", ">=", offset)
         .andWhere("w.rank", "<", offset + limit);
-      const formatedDoc = sqlNestRelationships({
+      const formattedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -403,12 +491,22 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverGroupUserId",
             label: "approvers" as const,
             mapper: ({ approverGroupUserId }) => ({ userId: approverGroupUserId })
+          },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserUserId }) => ({ userId: bypasserUserId })
+          },
+          {
+            key: "bypasserGroupUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserGroupUserId }) => ({ userId: bypasserGroupUserId })
           }
         ]
       });
-      return formatedDoc.map((el) => ({
+      return formattedDoc.map((el) => ({
         ...el,
-        policy: { ...el.policy, approvers: el.approvers }
+        policy: { ...el.policy, approvers: el.approvers, bypassers: el.bypassers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindSAR" });
@@ -440,6 +538,16 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
+        .leftJoin(
+          TableName.SecretApprovalPolicyBypasser,
+          `${TableName.SecretApprovalPolicy}.id`,
+          `${TableName.SecretApprovalPolicyBypasser}.policyId`
+        )
+        .leftJoin<TUserGroupMembership>(
+          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
+          `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
+          `bypasserUserGroupMembership.groupId`
+        )
         .join<TUsers>(
           db(TableName.Users).as("committerUser"),
           `${TableName.SecretApprovalRequest}.committerUserId`,
@@ -491,6 +599,11 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           db.ref("enforcementLevel").withSchema(TableName.SecretApprovalPolicy).as("policyEnforcementLevel"),
           db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
           db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
+
+          // Bypasser
+          db.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
+          db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
+
           db.ref("email").withSchema("committerUser").as("committerUserEmail"),
           db.ref("username").withSchema("committerUser").as("committerUserUsername"),
           db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
@@ -504,7 +617,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         .from<Awaited<typeof query>[number]>("w")
         .where("w.rank", ">=", offset)
         .andWhere("w.rank", "<", offset + limit);
-      const formatedDoc = sqlNestRelationships({
+      const formattedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -554,12 +667,24 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             mapper: ({ approverGroupUserId }) => ({
               userId: approverGroupUserId
             })
+          },
+          {
+            key: "bypasserUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserUserId }) => ({ userId: bypasserUserId })
+          },
+          {
+            key: "bypasserGroupUserId",
+            label: "bypassers" as const,
+            mapper: ({ bypasserGroupUserId }) => ({
+              userId: bypasserGroupUserId
+            })
           }
         ]
       });
-      return formatedDoc.map((el) => ({
+      return formattedDoc.map((el) => ({
         ...el,
-        policy: { ...el.policy, approvers: el.approvers }
+        policy: { ...el.policy, approvers: el.approvers, bypassers: el.bypassers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindSAR" });

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -20,7 +20,6 @@ import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
@@ -63,11 +62,7 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { throwIfMissingSecretReadValueOrDescribePermission } from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import {
-  ProjectPermissionApprovalActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "../permission/project-permission";
+import { ProjectPermissionSecretActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TSecretApprovalPolicyDALFactory } from "../secret-approval-policy/secret-approval-policy-dal";
 import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";
 import { TSecretApprovalRequestDALFactory } from "./secret-approval-request-dal";
@@ -135,7 +130,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
   microsoftTeamsService: Pick<TMicrosoftTeamsServiceFactory, "sendNotification">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretApprovalRequestServiceFactory = ReturnType<typeof secretApprovalRequestServiceFactory>;
@@ -167,8 +161,7 @@ export const secretApprovalRequestServiceFactory = ({
   projectSlackConfigDAL,
   resourceMetadataDAL,
   projectMicrosoftTeamsConfigDAL,
-  microsoftTeamsService,
-  folderCommitService
+  microsoftTeamsService
 }: TSecretApprovalRequestServiceFactoryDep) => {
   const requestCount = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TApprovalRequestCountDTO) => {
     if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" });
@@ -504,14 +497,14 @@ export const secretApprovalRequestServiceFactory = ({
       });
     }
 
-    const { policy, folderId, projectId } = secretApprovalRequest;
+    const { policy, folderId, projectId, bypassers } = secretApprovalRequest;
     if (policy.deletedAt) {
       throw new BadRequestError({
         message: "The policy associated with this secret approval request has been deleted."
       });
     }
 
-    const { hasRole, permission } = await permissionService.getProjectPermission({
+    const { hasRole } = await permissionService.getProjectPermission({
       actor: ActorType.USER,
       actorId,
       projectId,
@@ -537,14 +530,9 @@ export const secretApprovalRequestServiceFactory = ({
         approverId ? reviewers[approverId] === ApprovalStatus.APPROVED : false
       ).length;
     const isSoftEnforcement = secretApprovalRequest.policy.enforcementLevel === EnforcementLevel.Soft;
+    const canBypass = !bypassers.length || bypassers.some((bypasser) => bypasser.userId === actorId);
 
-    if (
-      !hasMinApproval &&
-      !(
-        isSoftEnforcement &&
-        permission.can(ProjectPermissionApprovalActions.AllowChangeBypass, ProjectPermissionSub.SecretApproval)
-      )
-    )
+    if (!hasMinApproval && !(isSoftEnforcement && canBypass))
       throw new BadRequestError({ message: "Doesn't have minimum approvals needed" });
 
     const { botKey, shouldUseSecretV2Bridge, project } = await projectBotService.getBotKey(projectId);
@@ -609,10 +597,6 @@ export const secretApprovalRequestServiceFactory = ({
           ? await fnSecretV2BridgeBulkInsert({
               tx,
               folderId,
-              actor: {
-                actorId,
-                type: actor
-              },
               orgId: actorOrgId,
               inputSecrets: secretCreationCommits.map((el) => ({
                 tagIds: el?.tags.map(({ id }) => id),
@@ -635,18 +619,13 @@ export const secretApprovalRequestServiceFactory = ({
               secretDAL: secretV2BridgeDAL,
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretTagDAL,
-              secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              folderCommitService
+              secretVersionTagDAL: secretVersionTagV2BridgeDAL
             })
           : [];
         const updatedSecrets = secretUpdationCommits.length
           ? await fnSecretV2BridgeBulkUpdate({
               folderId,
               orgId: actorOrgId,
-              actor: {
-                actorId,
-                type: actor
-              },
               tx,
               inputSecrets: secretUpdationCommits.map((el) => {
                 const encryptedValue =
@@ -680,8 +659,7 @@ export const secretApprovalRequestServiceFactory = ({
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretTagDAL,
               secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              resourceMetadataDAL,
-              folderCommitService
+              resourceMetadataDAL
             })
           : [];
         const deletedSecret = secretDeletionCommits.length
@@ -689,13 +667,10 @@ export const secretApprovalRequestServiceFactory = ({
               projectId,
               folderId,
               tx,
-              actorId,
-              actorType: actor,
+              actorId: "",
               secretDAL: secretV2BridgeDAL,
               secretQueueService,
-              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared })),
-              folderCommitService,
-              secretVersionDAL: secretVersionV2BridgeDAL
+              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared }))
             })
           : [];
         const updatedSecretApproval = await secretApprovalRequestDAL.updateById(

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -10,7 +10,6 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -88,7 +87,6 @@ type TSecretReplicationServiceFactoryDep = {
 
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretReplicationServiceFactory = ReturnType<typeof secretReplicationServiceFactory>;
@@ -134,7 +132,6 @@ export const secretReplicationServiceFactory = ({
   secretVersionV2BridgeDAL,
   secretV2BridgeDAL,
   kmsService,
-  folderCommitService,
   resourceMetadataDAL
 }: TSecretReplicationServiceFactoryDep) => {
   const $getReplicatedSecrets = (
@@ -422,7 +419,7 @@ export const secretReplicationServiceFactory = ({
                     return {
                       op: operation,
                       requestId: approvalRequestDoc.id,
-                      metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                      metadata: doc.metadata,
                       secretMetadata: JSON.stringify(doc.secretMetadata),
                       key: doc.key,
                       encryptedValue: doc.encryptedValue,
@@ -449,12 +446,11 @@ export const secretReplicationServiceFactory = ({
                     tx,
                     secretTagDAL,
                     resourceMetadataDAL,
-                    folderCommitService,
                     secretVersionTagDAL: secretVersionV2TagBridgeDAL,
                     inputSecrets: locallyCreatedSecrets.map((doc) => {
                       return {
                         type: doc.type,
-                        metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                        metadata: doc.metadata,
                         key: doc.key,
                         encryptedValue: doc.encryptedValue,
                         encryptedComment: doc.encryptedComment,
@@ -470,7 +466,6 @@ export const secretReplicationServiceFactory = ({
                     orgId,
                     folderId: destinationReplicationFolderId,
                     secretVersionDAL: secretVersionV2BridgeDAL,
-                    folderCommitService,
                     secretDAL: secretV2BridgeDAL,
                     tx,
                     resourceMetadataDAL,
@@ -484,7 +479,7 @@ export const secretReplicationServiceFactory = ({
                         },
                         data: {
                           type: doc.type,
-                          metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                          metadata: doc.metadata,
                           key: doc.key,
                           encryptedValue: doc.encryptedValue as Buffer,
                           encryptedComment: doc.encryptedComment,

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts

@@ -63,7 +63,6 @@ import { TAppConnectionDALFactory } from "@app/services/app-connection/app-conne
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -99,7 +98,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
     TSecretV2BridgeDALFactory,
     "bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "invalidateSecretCacheByProjectId"
   >;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
@@ -107,7 +106,6 @@ export type TSecretRotationV2ServiceFactoryDep = {
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   queueService: Pick<TQueueServiceFactory, "queuePg">;
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretRotationV2ServiceFactory = ReturnType<typeof secretRotationV2ServiceFactory>;
@@ -146,7 +144,6 @@ export const secretRotationV2ServiceFactory = ({
   snapshotService,
   keyStore,
   queueService,
-  folderCommitService,
   appConnectionDAL
 }: TSecretRotationV2ServiceFactoryDep) => {
   const $queueSendSecretRotationStatusNotification = async (secretRotation: TSecretRotationV2Raw) => {
@@ -540,12 +537,7 @@ export const secretRotationV2ServiceFactory = ({
             secretVersionDAL: secretVersionV2BridgeDAL,
             secretVersionTagDAL: secretVersionTagV2BridgeDAL,
             secretTagDAL,
-            folderCommitService,
-            resourceMetadataDAL,
-            actor: {
-              type: actor.type,
-              actorId: actor.id
-            }
+            resourceMetadataDAL
           });
 
           await secretRotationV2DAL.insertSecretMappings(
@@ -681,12 +673,7 @@ export const secretRotationV2ServiceFactory = ({
             secretVersionDAL: secretVersionV2BridgeDAL,
             secretVersionTagDAL: secretVersionTagV2BridgeDAL,
             secretTagDAL,
-            folderCommitService,
-            resourceMetadataDAL,
-            actor: {
-              type: actor.type,
-              actorId: actor.id
-            }
+            resourceMetadataDAL
           });
 
           secretsMappingUpdated = true;
@@ -804,9 +791,6 @@ export const secretRotationV2ServiceFactory = ({
             projectId,
             folderId,
             actorId: actor.id, // not actually used since rotated secrets are shared
-            actorType: actor.type,
-            folderCommitService,
-            secretVersionDAL: secretVersionV2BridgeDAL,
             tx
           });
         }
@@ -950,10 +934,6 @@ export const secretRotationV2ServiceFactory = ({
               secretDAL: secretV2BridgeDAL,
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              folderCommitService,
-              actor: {
-                type: ActorType.PLATFORM
-              },
               secretTagDAL,
               resourceMetadataDAL
             });

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -14,7 +14,6 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
-import { CommitType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -54,7 +53,6 @@ type TSecretRotationQueueFactoryDep = {
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   telemetryService: Pick<TTelemetryServiceFactory, "sendPostHogEvents">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 // These error should stop the repeatable job and ask user to reconfigure rotation
@@ -79,7 +77,6 @@ export const secretRotationQueueFactory = ({
   telemetryService,
   secretV2BridgeDAL,
   secretVersionV2BridgeDAL,
-  folderCommitService,
   kmsService
 }: TSecretRotationQueueFactoryDep) => {
   const addToQueue = async (rotationId: string, interval: number) => {
@@ -333,7 +330,7 @@ export const secretRotationQueueFactory = ({
             })),
             tx
           );
-          const secretVersions = await secretVersionV2BridgeDAL.insertMany(
+          await secretVersionV2BridgeDAL.insertMany(
             updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
               ...el,
               actorType: ActorType.PLATFORM,
@@ -341,22 +338,6 @@ export const secretRotationQueueFactory = ({
             })),
             tx
           );
-
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: ActorType.PLATFORM
-              },
-              message: "Changed by Secret rotation",
-              folderId: secretVersions[0].folderId,
-              changes: secretVersions.map((sv) => ({
-                type: CommitType.ADD,
-                isUpdate: true,
-                secretVersionId: sv.id
-              }))
-            },
-            tx
-          );
         });
 
         await secretV2BridgeDAL.invalidateSecretCacheByProjectId(secretRotation.projectId);

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -8,7 +8,6 @@ import { InternalServerError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { ActorType } from "@app/services/auth/auth-type";
-import { CommitType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -52,8 +51,8 @@ type TSecretSnapshotServiceFactoryDep = {
   snapshotSecretV2BridgeDAL: TSnapshotSecretV2DALFactory;
   snapshotFolderDAL: TSnapshotFolderDALFactory;
   secretVersionDAL: Pick<TSecretVersionDALFactory, "insertMany" | "findLatestVersionByFolderId">;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionByFolderId" | "findOne">;
-  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestVersionByFolderId" | "insertMany" | "findOne">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionByFolderId">;
+  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestVersionByFolderId" | "insertMany">;
   secretDAL: Pick<TSecretDALFactory, "delete" | "insertMany">;
   secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "delete" | "insertMany">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecret" | "saveTagsToSecretV2">;
@@ -64,7 +63,6 @@ type TSecretSnapshotServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "isValidLicense">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretSnapshotServiceFactory = ReturnType<typeof secretSnapshotServiceFactory>;
@@ -86,8 +84,7 @@ export const secretSnapshotServiceFactory = ({
   snapshotSecretV2BridgeDAL,
   secretVersionV2TagBridgeDAL,
   kmsService,
-  projectBotService,
-  folderCommitService
+  projectBotService
 }: TSecretSnapshotServiceFactoryDep) => {
   const projectSecretSnapshotCount = async ({
     environment,
@@ -406,18 +403,6 @@ export const secretSnapshotServiceFactory = ({
           .filter((el) => el.isRotatedSecret)
           .map((el) => el.secretId);
 
-        const deletedSecretsChanges = new Map(); // secretId -> version info
-        const deletedFoldersChanges = new Map(); // folderId -> version info
-        const addedSecretsChanges = new Map(); // secretId -> version info
-        const addedFoldersChanges = new Map(); // folderId -> version info
-        const commitChanges: {
-          type: string;
-          secretVersionId?: string;
-          folderVersionId?: string;
-          isUpdate?: boolean;
-          folderId?: string;
-        }[] = [];
-
         // this will remove all secrets in current folder except rotated secrets which we ignore
         const deletedTopLevelSecs = await secretV2BridgeDAL.delete(
           {
@@ -439,35 +424,7 @@ export const secretSnapshotServiceFactory = ({
           },
           tx
         );
-
-        await Promise.all(
-          deletedTopLevelSecs.map(async (sec) => {
-            const version = await secretVersionV2BridgeDAL.findOne({ secretId: sec.id, version: sec.version }, tx);
-            deletedSecretsChanges.set(sec.id, {
-              id: sec.id,
-              version: sec.version,
-              // Store the version ID if available from the snapshot
-              versionId: version?.id
-            });
-          })
-        );
-
         const deletedTopLevelSecsGroupById = groupBy(deletedTopLevelSecs, (item) => item.id);
-
-        const deletedFoldersData = await folderDAL.delete({ parentId: snapshot.folderId, isReserved: false }, tx);
-
-        await Promise.all(
-          deletedFoldersData.map(async (folder) => {
-            const version = await folderVersionDAL.findOne({ folderId: folder.id, version: folder.version }, tx);
-            deletedFoldersChanges.set(folder.id, {
-              id: folder.id,
-              version: folder.version,
-              // Store the version ID if available
-              versionId: version?.id
-            });
-          })
-        );
-
         // this will remove all secrets and folders on child
         // due to sql foreign key and link list connection removing the folders removes everything below too
         const deletedFolders = await folderDAL.delete({ parentId: snapshot.folderId, isReserved: false }, tx);
@@ -532,21 +489,14 @@ export const secretSnapshotServiceFactory = ({
         });
         await secretTagDAL.saveTagsToSecretV2(secretTagsToBeInsert, tx);
         const folderVersions = await folderVersionDAL.insertMany(
-          folders.map(({ version, name, id, envId, description }) => ({
+          folders.map(({ version, name, id, envId }) => ({
             name,
             version,
             folderId: id,
-            envId,
-            description
+            envId
           })),
           tx
         );
-
-        // Track added folders
-        folderVersions.forEach((fv) => {
-          addedFoldersChanges.set(fv.folderId, fv);
-        });
-
         const userActorId = actor === ActorType.USER ? actorId : undefined;
         const identityActorId = actor !== ActorType.USER ? actorId : undefined;
         const actorType = actor || ActorType.PLATFORM;
@@ -561,11 +511,6 @@ export const secretSnapshotServiceFactory = ({
           })),
           tx
         );
-
-        secretVersions.forEach((sv) => {
-          addedSecretsChanges.set(sv.secretId, sv);
-        });
-
         await secretVersionV2TagBridgeDAL.insertMany(
           secretVersions.flatMap(({ secretId, id }) =>
             secretVerTagToBeInsert?.[secretId]?.length
@@ -577,70 +522,6 @@ export const secretSnapshotServiceFactory = ({
           ),
           tx
         );
-
-        // Compute commit changes
-        // Handle secrets
-        deletedSecretsChanges.forEach((deletedInfo, secretId) => {
-          const addedSecret = addedSecretsChanges.get(secretId);
-          if (addedSecret) {
-            // Secret was deleted and re-added - this is an update only if versions are different
-            if (deletedInfo.versionId !== addedSecret.id) {
-              commitChanges.push({
-                type: CommitType.ADD, // In the commit system, updates are tracked as "add" with isUpdate=true
-                secretVersionId: addedSecret.id,
-                isUpdate: true
-              });
-            }
-            // Remove from addedSecrets since we've handled it
-            addedSecretsChanges.delete(secretId);
-          } else if (deletedInfo.versionId) {
-            // Secret was only deleted
-            commitChanges.push({
-              type: CommitType.DELETE,
-              secretVersionId: deletedInfo.versionId
-            });
-          }
-        });
-        // Add remaining new secrets (not updates)
-        addedSecretsChanges.forEach((addedSecret) => {
-          commitChanges.push({
-            type: CommitType.ADD,
-            secretVersionId: addedSecret.id
-          });
-        });
-
-        // Handle folders
-        deletedFoldersChanges.forEach((deletedInfo, folderId) => {
-          const addedFolder = addedFoldersChanges.get(folderId);
-          if (addedFolder) {
-            // Folder was deleted and re-added - this is an update only if versions are different
-            if (deletedInfo.versionId !== addedFolder.id) {
-              commitChanges.push({
-                type: CommitType.ADD,
-                folderVersionId: addedFolder.id,
-                isUpdate: true
-              });
-            }
-            // Remove from addedFolders since we've handled it
-            addedFoldersChanges.delete(folderId);
-          } else if (deletedInfo.versionId) {
-            // Folder was only deleted
-            commitChanges.push({
-              type: CommitType.DELETE,
-              folderVersionId: deletedInfo.versionId,
-              folderId: deletedInfo.id
-            });
-          }
-        });
-
-        // Add remaining new folders (not updates)
-        addedFoldersChanges.forEach((addedFolder) => {
-          commitChanges.push({
-            type: CommitType.ADD,
-            folderVersionId: addedFolder.id
-          });
-        });
-
         const newSnapshot = await snapshotDAL.create(
           {
             folderId: snapshot.folderId,
@@ -669,22 +550,6 @@ export const secretSnapshotServiceFactory = ({
             })),
           tx
         );
-        if (commitChanges.length > 0) {
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: actorType,
-                metadata: {
-                  id: userActorId || identityActorId
-                }
-              },
-              message: "Rollback to snapshot",
-              folderId: snapshot.folderId,
-              changes: commitChanges
-            },
-            tx
-          );
-        }
 
         return { ...newSnapshot, snapshotSecrets, snapshotFolders };
       });
@@ -744,12 +609,11 @@ export const secretSnapshotServiceFactory = ({
       });
       await secretTagDAL.saveTagsToSecret(secretTagsToBeInsert, tx);
       const folderVersions = await folderVersionDAL.insertMany(
-        folders.map(({ version, name, id, envId, description }) => ({
+        folders.map(({ version, name, id, envId }) => ({
           name,
           version,
           folderId: id,
-          envId,
-          description
+          envId
         })),
         tx
       );

backend/src/keystore/keystore.ts

@@ -26,7 +26,6 @@ export const KeyStorePrefixes = {
   KmsOrgDataKeyCreation: "kms-org-data-key-creation-lock",
   WaitUntilReadyKmsOrgKeyCreation: "wait-until-ready-kms-org-key-creation-",
   WaitUntilReadyKmsOrgDataKeyCreation: "wait-until-ready-kms-org-data-key-creation-",
-  FolderTreeCheckpoint: (envId: string) => `folder-tree-checkpoint-${envId}`,
 
   WaitUntilReadyProjectEnvironmentOperation: (projectId: string) =>
     `wait-until-ready-project-environments-operation-${projectId}`,

backend/src/lib/config/env.ts

@@ -244,10 +244,6 @@ const envSchema = z
     DATADOG_SERVICE: zpStr(z.string().optional().default("infisical-core")),
     DATADOG_HOSTNAME: zpStr(z.string().optional()),
 
-    // PIT
-    PIT_CHECKPOINT_WINDOW: zpStr(z.string().optional().default("2")),
-    PIT_TREE_CHECKPOINT_WINDOW: zpStr(z.string().optional().default("30")),
-
     /* CORS ----------------------------------------------------------------------------- */
     CORS_ALLOWED_ORIGINS: zpStr(
       z

backend/src/lib/gateway/index.ts

@@ -3,6 +3,7 @@ import crypto from "node:crypto";
 import net from "node:net";
 
 import quicDefault, * as quicModule from "@infisical/quic";
+import axios from "axios";
 
 import { BadRequestError } from "../errors";
 import { logger } from "../logger";
@@ -378,7 +379,12 @@ export const withGatewayProxy = async <T>(
       logger.error(new Error(proxyErrorMessage), "Failed to proxy");
     }
     logger.error(err, "Failed to do gateway");
-    throw new BadRequestError({ message: proxyErrorMessage || (err as Error)?.message });
+    let errorMessage = proxyErrorMessage || (err as Error)?.message;
+    if (axios.isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
+      errorMessage = (err.response?.data as { message: string }).message;
+    }
+
+    throw new BadRequestError({ message: errorMessage });
   } finally {
     // Ensure cleanup happens regardless of success or failure
     await cleanup();

backend/src/queue/queue-service.ts

@@ -54,7 +54,6 @@ export enum QueueName {
   ImportSecretsFromExternalSource = "import-secrets-from-external-source",
   AppConnectionSecretSync = "app-connection-secret-sync",
   SecretRotationV2 = "secret-rotation-v2",
-  FolderTreeCheckpoint = "folder-tree-checkpoint",
   InvalidateCache = "invalidate-cache"
 }
 
@@ -88,7 +87,6 @@ export enum QueueJobs {
   SecretRotationV2QueueRotations = "secret-rotation-v2-queue-rotations",
   SecretRotationV2RotateSecrets = "secret-rotation-v2-rotate-secrets",
   SecretRotationV2SendNotification = "secret-rotation-v2-send-notification",
-  CreateFolderTreeCheckpoint = "create-folder-tree-checkpoint",
   InvalidateCache = "invalidate-cache",
   CaOrderCertificateForSubscriber = "ca-order-certificate-for-subscriber",
   PkiSubscriberDailyAutoRenewal = "pki-subscriber-daily-auto-renewal"
@@ -201,12 +199,6 @@ export type TQueueJobTypes = {
     name: QueueJobs.ProjectV3Migration;
     payload: { projectId: string };
   };
-  [QueueName.FolderTreeCheckpoint]: {
-    name: QueueJobs.CreateFolderTreeCheckpoint;
-    payload: {
-      envId: string;
-    };
-  };
   [QueueName.ImportSecretsFromExternalSource]: {
     name: QueueJobs.ImportSecretsFromExternalSource;
     payload: {

backend/src/server/routes/index.ts

@@ -6,7 +6,10 @@ import { z } from "zod";
 import { registerCertificateEstRouter } from "@app/ee/routes/est/certificate-est-router";
 import { registerV1EERoutes } from "@app/ee/routes/v1";
 import { registerV2EERoutes } from "@app/ee/routes/v2";
-import { accessApprovalPolicyApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
+import {
+  accessApprovalPolicyApproverDALFactory,
+  accessApprovalPolicyBypasserDALFactory
+} from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
 import { accessApprovalPolicyDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-dal";
 import { accessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
 import { accessApprovalRequestDALFactory } from "@app/ee/services/access-approval-request/access-approval-request-dal";
@@ -57,7 +60,6 @@ import { oidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import { oidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { permissionDALFactory } from "@app/ee/services/permission/permission-dal";
 import { permissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { pitServiceFactory } from "@app/ee/services/pit/pit-service";
 import { projectTemplateDALFactory } from "@app/ee/services/project-template/project-template-dal";
 import { projectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { projectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -68,7 +70,10 @@ import { samlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-d
 import { samlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service";
 import { scimDALFactory } from "@app/ee/services/scim/scim-dal";
 import { scimServiceFactory } from "@app/ee/services/scim/scim-service";
-import { secretApprovalPolicyApproverDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-approver-dal";
+import {
+  secretApprovalPolicyApproverDALFactory,
+  secretApprovalPolicyBypasserDALFactory
+} from "@app/ee/services/secret-approval-policy/secret-approval-policy-approver-dal";
 import { secretApprovalPolicyDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-dal";
 import { secretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { secretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
@@ -145,14 +150,6 @@ import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-gr
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
-import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
-import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
-import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
-import { folderCommitQueueServiceFactory } from "@app/services/folder-commit/folder-commit-queue";
-import { folderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import { folderCommitChangesDALFactory } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { folderTreeCheckpointDALFactory } from "@app/services/folder-tree-checkpoint/folder-tree-checkpoint-dal";
-import { folderTreeCheckpointResourcesDALFactory } from "@app/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal";
 import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
 import { groupProjectServiceFactory } from "@app/services/group-project/group-project-service";
@@ -214,6 +211,8 @@ import { pkiCollectionServiceFactory } from "@app/services/pki-collection/pki-co
 import { pkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
 import { pkiSubscriberQueueServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-queue";
 import { pkiSubscriberServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-service";
+import { pkiTemplatesDALFactory } from "@app/services/pki-templates/pki-templates-dal";
+import { pkiTemplatesServiceFactory } from "@app/services/pki-templates/pki-templates-service";
 import { projectDALFactory } from "@app/services/project/project-dal";
 import { projectQueueFactory } from "@app/services/project/project-queue";
 import { projectServiceFactory } from "@app/services/project/project-service";
@@ -394,9 +393,11 @@ export const registerRoutes = async (
   const accessApprovalPolicyDAL = accessApprovalPolicyDALFactory(db);
   const accessApprovalRequestDAL = accessApprovalRequestDALFactory(db);
   const accessApprovalPolicyApproverDAL = accessApprovalPolicyApproverDALFactory(db);
+  const accessApprovalPolicyBypasserDAL = accessApprovalPolicyBypasserDALFactory(db);
   const accessApprovalRequestReviewerDAL = accessApprovalRequestReviewerDALFactory(db);
 
   const sapApproverDAL = secretApprovalPolicyApproverDALFactory(db);
+  const sapBypasserDAL = secretApprovalPolicyBypasserDALFactory(db);
   const secretApprovalPolicyDAL = secretApprovalPolicyDALFactory(db);
   const secretApprovalRequestDAL = secretApprovalRequestDALFactory(db);
   const secretApprovalRequestReviewerDAL = secretApprovalRequestReviewerDALFactory(db);
@@ -528,6 +529,7 @@ export const registerRoutes = async (
   const secretApprovalPolicyService = secretApprovalPolicyServiceFactory({
     projectEnvDAL,
     secretApprovalPolicyApproverDAL: sapApproverDAL,
+    secretApprovalPolicyBypasserDAL: sapBypasserDAL,
     permissionService,
     secretApprovalPolicyDAL,
     licenseService,
@@ -573,41 +575,6 @@ export const registerRoutes = async (
     projectRoleDAL,
     permissionService
   });
-
-  const folderCommitChangesDAL = folderCommitChangesDALFactory(db);
-  const folderCheckpointDAL = folderCheckpointDALFactory(db);
-  const folderCheckpointResourcesDAL = folderCheckpointResourcesDALFactory(db);
-  const folderTreeCheckpointDAL = folderTreeCheckpointDALFactory(db);
-  const folderCommitDAL = folderCommitDALFactory(db);
-  const folderTreeCheckpointResourcesDAL = folderTreeCheckpointResourcesDALFactory(db);
-  const folderCommitQueueService = folderCommitQueueServiceFactory({
-    queueService,
-    folderTreeCheckpointDAL,
-    keyStore,
-    folderTreeCheckpointResourcesDAL,
-    folderCommitDAL,
-    folderDAL
-  });
-  const folderCommitService = folderCommitServiceFactory({
-    folderCommitDAL,
-    folderCommitChangesDAL,
-    folderCheckpointDAL,
-    folderTreeCheckpointDAL,
-    userDAL,
-    identityDAL,
-    folderDAL,
-    folderVersionDAL,
-    secretVersionV2BridgeDAL,
-    projectDAL,
-    folderCheckpointResourcesDAL,
-    secretV2BridgeDAL,
-    folderTreeCheckpointResourcesDAL,
-    folderCommitQueueService,
-    permissionService,
-    kmsService,
-    secretTagDAL,
-    resourceMetadataDAL
-  });
   const scimService = scimServiceFactory({
     licenseService,
     scimDAL,
@@ -838,7 +805,8 @@ export const registerRoutes = async (
   const projectUserAdditionalPrivilegeService = projectUserAdditionalPrivilegeServiceFactory({
     permissionService,
     projectMembershipDAL,
-    projectUserAdditionalPrivilegeDAL
+    projectUserAdditionalPrivilegeDAL,
+    accessApprovalRequestDAL
   });
   const projectKeyService = projectKeyServiceFactory({
     permissionService,
@@ -882,6 +850,7 @@ export const registerRoutes = async (
   const pkiCollectionDAL = pkiCollectionDALFactory(db);
   const pkiCollectionItemDAL = pkiCollectionItemDALFactory(db);
   const pkiSubscriberDAL = pkiSubscriberDALFactory(db);
+  const pkiTemplatesDAL = pkiTemplatesDALFactory(db);
 
   const certificateService = certificateServiceFactory({
     certificateDAL,
@@ -1008,7 +977,6 @@ export const registerRoutes = async (
     projectMembershipDAL,
     projectBotDAL,
     secretDAL,
-    folderCommitService,
     secretBlindIndexDAL,
     secretVersionDAL,
     secretTagDAL,
@@ -1056,7 +1024,6 @@ export const registerRoutes = async (
     secretReminderRecipientsDAL,
     orgService,
     resourceMetadataDAL,
-    folderCommitService,
     secretSyncQueue
   });
 
@@ -1133,7 +1100,6 @@ export const registerRoutes = async (
     snapshotDAL,
     snapshotFolderDAL,
     snapshotSecretDAL,
-    folderCommitService,
     secretVersionDAL,
     folderVersionDAL,
     secretTagDAL,
@@ -1160,8 +1126,7 @@ export const registerRoutes = async (
     folderVersionDAL,
     projectEnvDAL,
     snapshotService,
-    projectDAL,
-    folderCommitService
+    projectDAL
   });
 
   const secretImportService = secretImportServiceFactory({
@@ -1186,7 +1151,6 @@ export const registerRoutes = async (
   const secretV2BridgeService = secretV2BridgeServiceFactory({
     folderDAL,
     secretVersionDAL: secretVersionV2BridgeDAL,
-    folderCommitService,
     secretQueueService,
     secretDAL: secretV2BridgeDAL,
     permissionService,
@@ -1230,8 +1194,7 @@ export const registerRoutes = async (
     projectSlackConfigDAL,
     resourceMetadataDAL,
     projectMicrosoftTeamsConfigDAL,
-    microsoftTeamsService,
-    folderCommitService
+    microsoftTeamsService
   });
 
   const secretService = secretServiceFactory({
@@ -1268,6 +1231,7 @@ export const registerRoutes = async (
   const accessApprovalPolicyService = accessApprovalPolicyServiceFactory({
     accessApprovalPolicyDAL,
     accessApprovalPolicyApproverDAL,
+    accessApprovalPolicyBypasserDAL,
     groupDAL,
     permissionService,
     projectEnvDAL,
@@ -1276,7 +1240,8 @@ export const registerRoutes = async (
     userDAL,
     accessApprovalRequestDAL,
     additionalPrivilegeDAL: projectUserAdditionalPrivilegeDAL,
-    accessApprovalRequestReviewerDAL
+    accessApprovalRequestReviewerDAL,
+    orgMembershipDAL
   });
 
   const accessApprovalRequestService = accessApprovalRequestServiceFactory({
@@ -1316,8 +1281,7 @@ export const registerRoutes = async (
     secretV2BridgeDAL,
     secretVersionV2TagBridgeDAL: secretVersionTagV2BridgeDAL,
     secretVersionV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   const secretRotationQueue = secretRotationQueueFactory({
@@ -1329,7 +1293,6 @@ export const registerRoutes = async (
     projectBotService,
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
-    folderCommitService,
     kmsService
   });
 
@@ -1481,15 +1444,6 @@ export const registerRoutes = async (
     permissionService
   });
 
-  const pitService = pitServiceFactory({
-    folderCommitService,
-    secretService,
-    folderService,
-    permissionService,
-    folderDAL,
-    projectEnvDAL
-  });
-
   const identityOidcAuthService = identityOidcAuthServiceFactory({
     identityOidcAuthDAL,
     identityOrgMembershipDAL,
@@ -1631,9 +1585,7 @@ export const registerRoutes = async (
     secretDAL: secretV2BridgeDAL,
     queueService,
     secretV2BridgeService,
-    resourceMetadataDAL,
-    folderCommitService,
-    folderVersionDAL
+    resourceMetadataDAL
   });
 
   const migrationService = externalMigrationServiceFactory({
@@ -1743,7 +1695,6 @@ export const registerRoutes = async (
     auditLogService,
     secretV2BridgeDAL,
     secretTagDAL,
-    folderCommitService,
     secretVersionTagV2BridgeDAL,
     secretVersionV2BridgeDAL,
     keyStore,
@@ -1807,6 +1758,21 @@ export const registerRoutes = async (
     internalCaFns
   });
 
+  const pkiTemplateService = pkiTemplatesServiceFactory({
+    pkiTemplatesDAL,
+    certificateAuthorityDAL,
+    certificateAuthorityCertDAL,
+    certificateAuthoritySecretDAL,
+    certificateAuthorityCrlDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    projectDAL,
+    kmsService,
+    permissionService,
+    internalCaFns
+  });
+
   await secretRotationV2QueueServiceFactory({
     secretRotationV2Service,
     secretRotationV2DAL,
@@ -1897,10 +1863,10 @@ export const registerRoutes = async (
     certificateTemplate: certificateTemplateService,
     certificateAuthorityCrl: certificateAuthorityCrlService,
     certificateEst: certificateEstService,
-    pit: pitService,
     pkiAlert: pkiAlertService,
     pkiCollection: pkiCollectionService,
     pkiSubscriber: pkiSubscriberService,
+    pkiTemplate: pkiTemplateService,
     secretScanning: secretScanningService,
     license: licenseService,
     trustedIp: trustedIpService,
@@ -1930,8 +1896,7 @@ export const registerRoutes = async (
     secretRotationV2: secretRotationV2Service,
     microsoftTeams: microsoftTeamsService,
     assumePrivileges: assumePrivilegeService,
-    githubOrgSync: githubOrgSyncConfigService,
-    folderCommit: folderCommitService
+    githubOrgSync: githubOrgSyncConfigService
   });
 
   const cronJobs: CronJob[] = [];

backend/src/server/routes/v1/certificate-template-router.ts

@@ -5,6 +5,7 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, CERTIFICATE_TEMPLATES } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CertExtendedKeyUsage, CertKeyUsage } from "@app/services/certificate/certificate-types";
@@ -72,7 +73,7 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
       body: z.object({
         caId: z.string().describe(CERTIFICATE_TEMPLATES.CREATE.caId),
         pkiCollectionId: z.string().optional().describe(CERTIFICATE_TEMPLATES.CREATE.pkiCollectionId),
-        name: z.string().min(1).describe(CERTIFICATE_TEMPLATES.CREATE.name),
+        name: slugSchema().describe(CERTIFICATE_TEMPLATES.CREATE.name),
         commonName: validateTemplateRegexField.describe(CERTIFICATE_TEMPLATES.CREATE.commonName),
         subjectAlternativeName: validateTemplateRegexField.describe(
           CERTIFICATE_TEMPLATES.CREATE.subjectAlternativeName
@@ -141,7 +142,7 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
       body: z.object({
         caId: z.string().optional().describe(CERTIFICATE_TEMPLATES.UPDATE.caId),
         pkiCollectionId: z.string().optional().describe(CERTIFICATE_TEMPLATES.UPDATE.pkiCollectionId),
-        name: z.string().min(1).optional().describe(CERTIFICATE_TEMPLATES.UPDATE.name),
+        name: slugSchema().optional().describe(CERTIFICATE_TEMPLATES.UPDATE.name),
         commonName: validateTemplateRegexField.optional().describe(CERTIFICATE_TEMPLATES.UPDATE.commonName),
         subjectAlternativeName: validateTemplateRegexField
           .optional()

backend/src/server/routes/v2/index.ts

@@ -5,6 +5,7 @@ import { registerIdentityProjectRouter } from "./identity-project-router";
 import { registerMfaRouter } from "./mfa-router";
 import { registerOrgRouter } from "./organization-router";
 import { registerPasswordRouter } from "./password-router";
+import { registerPkiTemplatesRouter } from "./pki-templates-router";
 import { registerProjectMembershipRouter } from "./project-membership-router";
 import { registerProjectRouter } from "./project-router";
 import { registerServiceTokenRouter } from "./service-token-router";
@@ -15,7 +16,15 @@ export const registerV2Routes = async (server: FastifyZodProvider) => {
   await server.register(registerUserRouter, { prefix: "/users" });
   await server.register(registerServiceTokenRouter, { prefix: "/service-token" });
   await server.register(registerPasswordRouter, { prefix: "/password" });
-  await server.register(registerCaRouter, { prefix: "/pki/ca" });
+
+  await server.register(
+    async (pkiRouter) => {
+      await pkiRouter.register(registerCaRouter, { prefix: "/ca" });
+      await pkiRouter.register(registerPkiTemplatesRouter, { prefix: "/certificate-templates" });
+    },
+    { prefix: "/pki" }
+  );
+
   await server.register(
     async (orgRouter) => {
       await orgRouter.register(registerOrgRouter);

backend/src/server/routes/v2/pki-templates-router.ts

@@ -0,0 +1,309 @@
+import { z } from "zod";
+
+import { CertificateTemplatesSchema } from "@app/db/schemas";
+import { ApiDocsTags } from "@app/lib/api-docs";
+import { ms } from "@app/lib/ms";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { slugSchema } from "@app/server/lib/schemas";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+import { CertExtendedKeyUsage, CertKeyUsage } from "@app/services/certificate/certificate-types";
+import {
+  validateAltNamesField,
+  validateCaDateField
+} from "@app/services/certificate-authority/certificate-authority-validators";
+import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
+
+export const registerPkiTemplatesRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      body: z.object({
+        name: slugSchema(),
+        caName: slugSchema({ field: "caName" }),
+        projectId: z.string(),
+        commonName: validateTemplateRegexField,
+        subjectAlternativeName: validateTemplateRegexField,
+        ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+        keyUsages: z
+          .nativeEnum(CertKeyUsage)
+          .array()
+          .optional()
+          .default([CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT]),
+        extendedKeyUsages: z.nativeEnum(CertExtendedKeyUsage).array().optional().default([])
+      }),
+      response: {
+        200: z.object({
+          certificateTemplate: CertificateTemplatesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const certificateTemplate = await server.services.pkiTemplate.createTemplate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return { certificateTemplate };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:templateName",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      params: z.object({
+        templateName: slugSchema()
+      }),
+      body: z.object({
+        name: slugSchema().optional(),
+        caName: slugSchema(),
+        projectId: z.string(),
+        commonName: validateTemplateRegexField.optional(),
+        subjectAlternativeName: validateTemplateRegexField.optional(),
+        ttl: z
+          .string()
+          .refine((val) => ms(val) > 0, "TTL must be a positive number")
+          .optional(),
+        keyUsages: z
+          .nativeEnum(CertKeyUsage)
+          .array()
+          .optional()
+          .default([CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT]),
+        extendedKeyUsages: z.nativeEnum(CertExtendedKeyUsage).array().optional().default([])
+      }),
+      response: {
+        200: z.object({
+          certificateTemplate: CertificateTemplatesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const certificateTemplate = await server.services.pkiTemplate.updateTemplate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        templateName: req.params.templateName,
+        ...req.body
+      });
+
+      return { certificateTemplate };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:templateName",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      params: z.object({
+        templateName: z.string().min(1)
+      }),
+      body: z.object({
+        projectId: z.string()
+      }),
+      response: {
+        200: z.object({
+          certificateTemplate: CertificateTemplatesSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const certificateTemplate = await server.services.pkiTemplate.deleteTemplate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        templateName: req.params.templateName,
+        projectId: req.body.projectId
+      });
+
+      return { certificateTemplate };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:templateName",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      params: z.object({
+        templateName: slugSchema()
+      }),
+      querystring: z.object({
+        projectId: z.string()
+      }),
+      response: {
+        200: z.object({
+          certificateTemplate: CertificateTemplatesSchema.extend({
+            ca: z.object({ id: z.string(), name: z.string() })
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const certificateTemplate = await server.services.pkiTemplate.getTemplateByName({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        templateName: req.params.templateName,
+        projectId: req.query.projectId
+      });
+
+      return { certificateTemplate };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      querystring: z.object({
+        projectId: z.string(),
+        limit: z.coerce.number().default(100),
+        offset: z.coerce.number().default(0)
+      }),
+      response: {
+        200: z.object({
+          certificateTemplates: CertificateTemplatesSchema.extend({
+            ca: z.object({ id: z.string(), name: z.string() })
+          }).array(),
+          totalCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { certificateTemplates, totalCount } = await server.services.pkiTemplate.listTemplate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.query
+      });
+
+      return { certificateTemplates, totalCount };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/:templateName/issue-certificate",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      params: z.object({
+        templateName: slugSchema()
+      }),
+      body: z.object({
+        projectId: z.string(),
+        commonName: validateTemplateRegexField,
+        ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+        keyUsages: z.nativeEnum(CertKeyUsage).array().optional(),
+        extendedKeyUsages: z.nativeEnum(CertExtendedKeyUsage).array().optional(),
+        notBefore: validateCaDateField.optional(),
+        notAfter: validateCaDateField.optional(),
+        altNames: validateAltNamesField
+      }),
+      response: {
+        200: z.object({
+          certificate: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          privateKey: z.string().trim(),
+          serialNumber: z.string().trim()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const data = await server.services.pkiTemplate.issueCertificate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        templateName: req.params.templateName,
+        ...req.body
+      });
+
+      return data;
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/:templateName/sign-certificate",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificateTemplates],
+      params: z.object({
+        templateName: slugSchema()
+      }),
+      body: z.object({
+        projectId: z.string(),
+        ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+        csr: z.string().trim().min(1).max(4096)
+      }),
+      response: {
+        200: z.object({
+          certificate: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          serialNumber: z.string().trim()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const data = await server.services.pkiTemplate.signCertificate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        templateName: req.params.templateName,
+        ...req.body
+      });
+
+      return data;
+    }
+  });
+};

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -311,7 +311,6 @@ export const certificateAuthorityServiceFactory = ({
       }
 
       const updatedCa = await internalCertificateAuthorityService.updateCaById({
-        ...configuration,
         isInternal: true,
         enableDirectIssuance,
         caId: certificateAuthority.id,

backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts

@@ -1,8 +1,10 @@
+/* eslint-disable no-bitwise */
 import * as x509 from "@peculiar/x509";
 import { KeyObject } from "crypto";
+import RE2 from "re2";
 import { z } from "zod";
 
-import { TPkiSubscribers } from "@app/db/schemas";
+import { TCertificateTemplates, TPkiSubscribers } from "@app/db/schemas";
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
@@ -31,6 +33,7 @@ import {
   keyAlgorithmToAlgCfg
 } from "../certificate-authority-fns";
 import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority-secret-dal";
+import { TIssueCertWithTemplateDTO } from "./internal-certificate-authority-types";
 
 type TInternalCertificateAuthorityFnsDeps = {
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa" | "findById">;
@@ -257,7 +260,274 @@ export const InternalCertificateAuthorityFns = ({
     };
   };
 
+  const issueCertificateWithTemplate = async (
+    ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>,
+    certificateTemplate: TCertificateTemplates,
+    { altNames, commonName, ttl, extendedKeyUsages, keyUsages, notAfter, notBefore }: TIssueCertWithTemplateDTO
+  ) => {
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
+    if (!ca.internalCa?.activeCaCertId)
+      throw new BadRequestError({ message: "CA does not have a certificate installed" });
+
+    const caCert = await certificateAuthorityCertDAL.findById(ca.internalCa.activeCaCertId);
+
+    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+      projectId: ca.projectId,
+      projectDAL,
+      kmsService
+    });
+
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: certificateManagerKmsId
+    });
+
+    const decryptedCaCert = await kmsDecryptor({
+      cipherTextBlob: caCert.encryptedCertificate
+    });
+
+    const caCertObj = new x509.X509Certificate(decryptedCaCert);
+    const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
+
+    let notAfterDate = new Date(new Date().setFullYear(new Date().getFullYear() + 1));
+    if (notAfter) {
+      notAfterDate = new Date(notAfter);
+    } else if (ttl) {
+      notAfterDate = new Date(new Date().getTime() + ms(ttl));
+    }
+
+    const caCertNotBeforeDate = new Date(caCertObj.notBefore);
+    const caCertNotAfterDate = new Date(caCertObj.notAfter);
+
+    // check not before constraint
+    if (notBeforeDate < caCertNotBeforeDate) {
+      throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" });
+    }
+
+    // check not after constraint
+    if (notAfterDate > caCertNotAfterDate) {
+      throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
+    }
+
+    const commonNameRegex = new RE2(certificateTemplate.commonName);
+    if (!commonNameRegex.test(commonName)) {
+      throw new BadRequestError({
+        message: "Invalid common name based on template policy"
+      });
+    }
+
+    if (notAfterDate.getTime() - notBeforeDate.getTime() > ms(certificateTemplate.ttl)) {
+      throw new BadRequestError({
+        message: "Invalid validity date based on template policy"
+      });
+    }
+
+    const subjectAlternativeNameRegex = new RE2(certificateTemplate.subjectAlternativeName);
+    altNames.split(",").forEach((altName) => {
+      if (!subjectAlternativeNameRegex.test(altName)) {
+        throw new BadRequestError({
+          message: "Invalid subject alternative name based on template policy"
+        });
+      }
+    });
+
+    const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+    const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+
+    const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
+      name: `CN=${commonName}`,
+      keys: leafKeys,
+      signingAlgorithm: alg,
+      extensions: [
+        // eslint-disable-next-line no-bitwise
+        new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment)
+      ],
+      attributes: [new x509.ChallengePasswordAttribute("password")]
+    });
+
+    const { caPrivateKey, caSecret } = await getCaCredentials({
+      caId: ca.id,
+      certificateAuthorityDAL,
+      certificateAuthoritySecretDAL,
+      projectDAL,
+      kmsService
+    });
+
+    const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });
+    const appCfg = getConfig();
+
+    const distributionPointUrl = `${appCfg.SITE_URL}/api/v1/pki/crl/${caCrl.id}/der`;
+    const caIssuerUrl = `${appCfg.SITE_URL}/api/v1/pki/ca/${ca.id}/certificates/${caCert.id}/der`;
+
+    const extensions: x509.Extension[] = [
+      new x509.BasicConstraintsExtension(false),
+      new x509.CRLDistributionPointsExtension([distributionPointUrl]),
+      await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false),
+      await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey),
+      new x509.AuthorityInfoAccessExtension({
+        caIssuers: new x509.GeneralName("url", caIssuerUrl)
+      }),
+      new x509.CertificatePolicyExtension(["2.5.29.32.0"]) // anyPolicy
+    ];
+
+    let selectedKeyUsages: CertKeyUsage[] = keyUsages ?? [];
+    if (keyUsages === undefined && !certificateTemplate) {
+      selectedKeyUsages = [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
+    }
+
+    if (keyUsages === undefined && certificateTemplate) {
+      selectedKeyUsages = (certificateTemplate.keyUsages ?? []) as CertKeyUsage[];
+    }
+
+    if (keyUsages?.length && certificateTemplate) {
+      const validKeyUsages = certificateTemplate.keyUsages || [];
+      if (keyUsages.some((keyUsage) => !validKeyUsages.includes(keyUsage))) {
+        throw new BadRequestError({
+          message: "Invalid key usage value based on template policy"
+        });
+      }
+      selectedKeyUsages = keyUsages;
+    }
+
+    const keyUsagesBitValue = selectedKeyUsages.reduce((accum, keyUsage) => accum | x509.KeyUsageFlags[keyUsage], 0);
+    if (keyUsagesBitValue) {
+      extensions.push(new x509.KeyUsagesExtension(keyUsagesBitValue, true));
+    }
+
+    // handle extended key usages
+    let selectedExtendedKeyUsages: CertExtendedKeyUsage[] = extendedKeyUsages ?? [];
+    if (extendedKeyUsages === undefined && certificateTemplate) {
+      selectedExtendedKeyUsages = (certificateTemplate.extendedKeyUsages ?? []) as CertExtendedKeyUsage[];
+    }
+
+    if (extendedKeyUsages?.length && certificateTemplate) {
+      const validExtendedKeyUsages = certificateTemplate.extendedKeyUsages || [];
+      if (extendedKeyUsages.some((eku) => !validExtendedKeyUsages.includes(eku))) {
+        throw new BadRequestError({
+          message: "Invalid extended key usage value based on template policy"
+        });
+      }
+      selectedExtendedKeyUsages = extendedKeyUsages;
+    }
+
+    if (selectedExtendedKeyUsages.length) {
+      extensions.push(
+        new x509.ExtendedKeyUsageExtension(
+          selectedExtendedKeyUsages.map((eku) => x509.ExtendedKeyUsage[eku]),
+          true
+        )
+      );
+    }
+
+    let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
+
+    if (altNames) {
+      altNamesArray = altNames.split(",").map((altName) => {
+        if (z.string().email().safeParse(altName).success) {
+          return { type: "email", value: altName };
+        }
+
+        if (isFQDN(altName, { allow_wildcard: true })) {
+          return { type: "dns", value: altName };
+        }
+
+        throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
+      });
+
+      const altNamesExtension = new x509.SubjectAlternativeNameExtension(altNamesArray, false);
+      extensions.push(altNamesExtension);
+    }
+
+    const serialNumber = createSerialNumber();
+    const leafCert = await x509.X509CertificateGenerator.create({
+      serialNumber,
+      subject: csrObj.subject,
+      issuer: caCertObj.subject,
+      notBefore: notBeforeDate,
+      notAfter: notAfterDate,
+      signingKey: caPrivateKey,
+      publicKey: csrObj.publicKey,
+      signingAlgorithm: alg,
+      extensions
+    });
+
+    const skLeafObj = KeyObject.from(leafKeys.privateKey);
+    const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({
+      kmsId: certificateManagerKmsId
+    });
+    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+      plainText: Buffer.from(new Uint8Array(leafCert.rawData))
+    });
+    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
+      plainText: Buffer.from(skLeaf)
+    });
+
+    const { caCert: issuingCaCertificate, caCertChain } = await getCaCertChain({
+      caCertId: caCert.id,
+      certificateAuthorityDAL,
+      certificateAuthorityCertDAL,
+      projectDAL,
+      kmsService
+    });
+
+    const certificateChainPem = `${issuingCaCertificate}\n${caCertChain}`.trim();
+
+    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+      plainText: Buffer.from(certificateChainPem)
+    });
+
+    await certificateDAL.transaction(async (tx) => {
+      const cert = await certificateDAL.create(
+        {
+          caId: ca.id,
+          caCertId: caCert.id,
+          status: CertStatus.ACTIVE,
+          friendlyName: commonName,
+          commonName,
+          altNames,
+          serialNumber,
+          notBefore: notBeforeDate,
+          notAfter: notAfterDate,
+          keyUsages: selectedKeyUsages,
+          extendedKeyUsages: selectedExtendedKeyUsages,
+          projectId: ca.projectId,
+          certificateTemplateId: certificateTemplate.id
+        },
+        tx
+      );
+
+      await certificateBodyDAL.create(
+        {
+          certId: cert.id,
+          encryptedCertificate,
+          encryptedCertificateChain
+        },
+        tx
+      );
+
+      await certificateSecretDAL.create(
+        {
+          certId: cert.id,
+          encryptedPrivateKey
+        },
+        tx
+      );
+    });
+
+    return {
+      certificate: leafCert.toString("pem"),
+      certificateChain: certificateChainPem,
+      issuingCaCertificate,
+      privateKey: skLeaf,
+      serialNumber,
+      ca,
+      template: certificateTemplate
+    };
+  };
+
   return {
-    issueCertificate
+    issueCertificate,
+    issueCertificateWithTemplate
   };
 };

backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts

@@ -55,8 +55,4 @@ export const CreateInternalCertificateAuthoritySchema = GenericCreateCertificate
   configuration: InternalCertificateAuthorityConfigurationSchema
 });
 
-export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
-  CaType.INTERNAL
-).extend({
-  configuration: InternalCertificateAuthorityConfigurationSchema.optional()
-});
+export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(CaType.INTERNAL);

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -1,5 +1,5 @@
 /* eslint-disable no-bitwise */
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 import slugify from "@sindresorhus/slugify";
 import crypto, { KeyObject } from "crypto";
@@ -16,6 +16,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import {
   ProjectPermissionActions,
   ProjectPermissionCertificateActions,
+  ProjectPermissionPkiTemplateActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
@@ -1952,15 +1953,15 @@ export const internalCertificateAuthorityServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      ProjectPermissionSub.CertificateTemplates
-    );
-
     const certificateTemplates = await certificateTemplateDAL.find({ caId });
 
     return {
-      certificateTemplates,
+      certificateTemplates: certificateTemplates.filter((el) =>
+        permission.can(
+          ProjectPermissionPkiTemplateActions.Read,
+          subject(ProjectPermissionSub.CertificateTemplates, { name: el.name })
+        )
+      ),
       ca: expandInternalCa(ca)
     };
   };

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -221,3 +221,13 @@ export type TOrderCertificateForSubscriberDTO = {
   subscriberId: string;
   caType: CaType;
 };
+
+export type TIssueCertWithTemplateDTO = {
+  commonName: string;
+  altNames: string;
+  ttl: string;
+  notBefore?: string;
+  notAfter?: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+};

backend/src/services/certificate-template/certificate-template-schema.ts

@@ -18,3 +18,20 @@ export const sanitizedCertificateTemplate = CertificateTemplatesSchema.pick({
     caName: z.string()
   })
 );
+
+export const sanitizedCertificateTemplateV2 = CertificateTemplatesSchema.pick({
+  id: true,
+  caId: true,
+  name: true,
+  commonName: true,
+  subjectAlternativeName: true,
+  pkiCollectionId: true,
+  ttl: true,
+  keyUsages: true,
+  extendedKeyUsages: true
+}).merge(
+  z.object({
+    projectId: z.string(),
+    caName: z.string()
+  })
+);

backend/src/services/certificate-template/certificate-template-service.ts

@@ -1,11 +1,14 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 import bcrypt from "bcrypt";
 
 import { ActionProjectType, TCertificateTemplateEstConfigsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionPkiTemplateActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -78,8 +81,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Create,
+      subject(ProjectPermissionSub.CertificateTemplates, { name })
     );
 
     return certificateTemplateDAL.transaction(async (tx) => {
@@ -140,8 +143,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Edit,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
     );
 
     if (caId) {
@@ -153,6 +156,13 @@ export const certificateTemplateServiceFactory = ({
       }
     }
 
+    if (name) {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionPkiTemplateActions.Create,
+        subject(ProjectPermissionSub.CertificateTemplates, { name })
+      );
+    }
+
     return certificateTemplateDAL.transaction(async (tx) => {
       await certificateTemplateDAL.updateById(
         certTemplate.id,
@@ -198,8 +208,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Delete,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
     );
 
     await certificateTemplateDAL.deleteById(certTemplate.id);
@@ -225,8 +235,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Read,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
     );
 
     return certTemplate;
@@ -267,8 +277,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Edit,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
     );
 
     const appCfg = getConfig();
@@ -350,8 +360,8 @@ export const certificateTemplateServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      ProjectPermissionSub.CertificateTemplates
+      ProjectPermissionPkiTemplateActions.Edit,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
     );
 
     const originalCaEstConfig = await certificateTemplateEstConfigDAL.findOne({
@@ -430,8 +440,8 @@ export const certificateTemplateServiceFactory = ({
       });
 
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        ProjectPermissionSub.CertificateTemplates
+        ProjectPermissionPkiTemplateActions.Edit,
+        subject(ProjectPermissionSub.CertificateTemplates, { name: certTemplate.name })
       );
     }
 

backend/src/services/external-migration/external-migration-fns.ts

@@ -10,7 +10,6 @@ import { chunkArray } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
-import { CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectDALFactory } from "../project/project-dal";
@@ -19,7 +18,6 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
-import { TSecretFolderVersionDALFactory } from "../secret-folder/secret-folder-version-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { fnSecretBulkInsert, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
@@ -44,8 +42,6 @@ export type TImportDataIntoInfisicalDTO = {
   projectService: Pick<TProjectServiceFactory, "createProject">;
   projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
   secretV2BridgeService: Pick<TSecretV2BridgeServiceFactory, "createManySecret">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
-  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "create">;
 
   input: TImportInfisicalDataCreate;
 };
@@ -511,8 +507,6 @@ export const importDataIntoInfisicalFn = async ({
   secretVersionTagDAL,
   folderDAL,
   resourceMetadataDAL,
-  folderVersionDAL,
-  folderCommitService,
   input: { data, actor, actorId, actorOrgId, actorAuthMethod }
 }: TImportDataIntoInfisicalDTO) => {
   // Import data to infisical
@@ -605,36 +599,6 @@ export const importDataIntoInfisicalFn = async ({
           tx
         );
 
-        const newFolderVersion = await folderVersionDAL.create(
-          {
-            name: newFolder.name,
-            envId: newFolder.envId,
-            version: newFolder.version,
-            folderId: newFolder.id
-          },
-          tx
-        );
-
-        await folderCommitService.createCommit(
-          {
-            actor: {
-              type: actor,
-              metadata: {
-                id: actorId
-              }
-            },
-            message: "Changed by external migration",
-            folderId: parentEnv.rootFolderId,
-            changes: [
-              {
-                type: CommitType.ADD,
-                folderVersionId: newFolderVersion.id
-              }
-            ]
-          },
-          tx
-        );
-
         originalToNewFolderId.set(folder.id, {
           folderId: newFolder.id,
           projectId: parentEnv.projectId
@@ -808,7 +772,6 @@ export const importDataIntoInfisicalFn = async ({
             secretVersionDAL,
             secretTagDAL,
             secretVersionTagDAL,
-            folderCommitService,
             actor: {
               type: actor,
               actorId

backend/src/services/external-migration/external-migration-queue.ts

@@ -3,7 +3,6 @@ import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectServiceFactory } from "../project/project-service";
@@ -11,7 +10,6 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
-import { TSecretFolderVersionDALFactory } from "../secret-folder/secret-folder-version-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
@@ -38,8 +36,6 @@ export type TExternalMigrationQueueFactoryDep = {
   projectService: Pick<TProjectServiceFactory, "createProject">;
   projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
   secretV2BridgeService: Pick<TSecretV2BridgeServiceFactory, "createManySecret">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
-  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "create">;
 
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
 };
@@ -60,8 +56,6 @@ export const externalMigrationQueueFactory = ({
   secretTagDAL,
   secretVersionTagDAL,
   folderDAL,
-  folderCommitService,
-  folderVersionDAL,
   resourceMetadataDAL
 }: TExternalMigrationQueueFactoryDep) => {
   const startImport = async (dto: {
@@ -120,8 +114,6 @@ export const externalMigrationQueueFactory = ({
         projectService,
         projectEnvService,
         secretV2BridgeService,
-        folderCommitService,
-        folderVersionDAL,
         resourceMetadataDAL
       });
 

backend/src/services/folder-checkpoint-resources/folder-checkpoint-resources-dal.ts

@@ -1,118 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import {
-  TableName,
-  TFolderCheckpointResources,
-  TFolderCheckpoints,
-  TSecretFolderVersions,
-  TSecretVersionsV2
-} from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderCheckpointResourcesDALFactory = ReturnType<typeof folderCheckpointResourcesDALFactory>;
-
-export type ResourceWithCheckpointInfo = TFolderCheckpointResources & {
-  folderCommitId: string;
-};
-
-export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
-  const folderCheckpointResourcesOrm = ormify(db, TableName.FolderCheckpointResources);
-
-  const findByCheckpointId = async (
-    folderCheckpointId: string,
-    tx?: Knex
-  ): Promise<
-    (TFolderCheckpointResources & {
-      referencedSecretId?: string;
-      referencedFolderId?: string;
-      folderName?: string;
-      folderVersion?: string;
-      secretKey?: string;
-      secretVersion?: string;
-    })[]
-  > => {
-    try {
-      const docs = await (tx || db.replicaNode())<TFolderCheckpointResources>(TableName.FolderCheckpointResources)
-        .where({ folderCheckpointId })
-        .leftJoin<TSecretVersionsV2>(
-          TableName.SecretVersionV2,
-          `${TableName.FolderCheckpointResources}.secretVersionId`,
-          `${TableName.SecretVersionV2}.id`
-        )
-        .leftJoin<TSecretFolderVersions>(
-          TableName.SecretFolderVersion,
-          `${TableName.FolderCheckpointResources}.folderVersionId`,
-          `${TableName.SecretFolderVersion}.id`
-        )
-        .select(selectAllTableCols(TableName.FolderCheckpointResources))
-        .select(
-          db.ref("secretId").withSchema(TableName.SecretVersionV2).as("referencedSecretId"),
-          db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("referencedFolderId"),
-          db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderName"),
-          db.ref("version").withSchema(TableName.SecretFolderVersion).as("folderVersion"),
-          db.ref("key").withSchema(TableName.SecretVersionV2).as("secretKey"),
-          db.ref("version").withSchema(TableName.SecretVersionV2).as("secretVersion")
-        );
-      return docs.map((doc) => ({
-        ...doc,
-        folderVersion: doc.folderVersion?.toString(),
-        secretVersion: doc.secretVersion?.toString()
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByCheckpointId" });
-    }
-  };
-
-  const findBySecretVersionId = async (secretVersionId: string, tx?: Knex): Promise<ResourceWithCheckpointInfo[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<
-        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "createdAt">
-      >(TableName.FolderCheckpointResources)
-        .where({ secretVersionId })
-        .select(selectAllTableCols(TableName.FolderCheckpointResources))
-        .join(
-          TableName.FolderCheckpoint,
-          `${TableName.FolderCheckpointResources}.folderCheckpointId`,
-          `${TableName.FolderCheckpoint}.id`
-        )
-        .select(
-          db.ref("folderCommitId").withSchema(TableName.FolderCheckpoint),
-          db.ref("createdAt").withSchema(TableName.FolderCheckpoint)
-        );
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindBySecretVersionId" });
-    }
-  };
-
-  const findByFolderVersionId = async (folderVersionId: string, tx?: Knex): Promise<ResourceWithCheckpointInfo[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<
-        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "createdAt">
-      >(TableName.FolderCheckpointResources)
-        .where({ folderVersionId })
-        .select(selectAllTableCols(TableName.FolderCheckpointResources))
-        .join(
-          TableName.FolderCheckpoint,
-          `${TableName.FolderCheckpointResources}.folderCheckpointId`,
-          `${TableName.FolderCheckpoint}.id`
-        )
-        .select(
-          db.ref("folderCommitId").withSchema(TableName.FolderCheckpoint),
-          db.ref("createdAt").withSchema(TableName.FolderCheckpoint)
-        );
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByFolderVersionId" });
-    }
-  };
-
-  return {
-    ...folderCheckpointResourcesOrm,
-    findByCheckpointId,
-    findBySecretVersionId,
-    findByFolderVersionId
-  };
-};

backend/src/services/folder-checkpoint/folder-checkpoint-dal.ts

@@ -1,129 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName, TFolderCheckpoints, TFolderCommits } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderCheckpointDALFactory = ReturnType<typeof folderCheckpointDALFactory>;
-
-type CheckpointWithCommitInfo = TFolderCheckpoints & {
-  actorMetadata: unknown;
-  actorType: string;
-  message?: string | null;
-  commitDate: Date;
-  folderId: string;
-};
-
-export const folderCheckpointDALFactory = (db: TDbClient) => {
-  const folderCheckpointOrm = ormify(db, TableName.FolderCheckpoint);
-
-  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderCheckpoints | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())<TFolderCheckpoints>(TableName.FolderCheckpoint)
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderCommitId }, TableName.FolderCheckpoint))
-        .select(selectAllTableCols(TableName.FolderCheckpoint))
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByCommitId" });
-    }
-  };
-
-  const findByFolderId = async (folderId: string, limit?: number, tx?: Knex): Promise<CheckpointWithCommitInfo[]> => {
-    try {
-      let query = (tx || db.replicaNode())(TableName.FolderCheckpoint)
-        .join<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderCheckpoint}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderId }, TableName.FolderCommit))
-        .select(selectAllTableCols(TableName.FolderCheckpoint))
-        .select(
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
-          db.ref("folderId").withSchema(TableName.FolderCommit)
-        )
-        .orderBy(`${TableName.FolderCheckpoint}.createdAt`, "desc");
-
-      if (limit !== undefined) {
-        query = query.limit(limit);
-      }
-
-      return await query;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByFolderId" });
-    }
-  };
-
-  const findLatestByFolderId = async (folderId: string, tx?: Knex): Promise<CheckpointWithCommitInfo | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCheckpoint)
-        .join<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderCheckpoint}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderId }, TableName.FolderCommit))
-        .select(selectAllTableCols(TableName.FolderCheckpoint))
-        .select(
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
-          db.ref("folderId").withSchema(TableName.FolderCommit)
-        )
-        .orderBy(`${TableName.FolderCheckpoint}.createdAt`, "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestByFolderId" });
-    }
-  };
-
-  const findNearestCheckpoint = async (
-    folderCommitId: bigint,
-    folderId: string,
-    tx?: Knex
-  ): Promise<(CheckpointWithCommitInfo & { commitId: bigint }) | undefined> => {
-    try {
-      // Get the checkpoint with the highest commitId that's still less than or equal to our commit
-      const nearestCheckpoint = await (tx || db.replicaNode())(TableName.FolderCheckpoint)
-        .join<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderCheckpoint}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        .where(`${TableName.FolderCommit}.folderId`, "=", folderId)
-        .where(`${TableName.FolderCommit}.commitId`, "<=", folderCommitId.toString())
-        .select(selectAllTableCols(TableName.FolderCheckpoint))
-        .select(
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("commitId").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
-          db.ref("folderId").withSchema(TableName.FolderCommit)
-        )
-        .orderBy(`${TableName.FolderCommit}.commitId`, "desc")
-        .first();
-      return nearestCheckpoint;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindNearestCheckpoint" });
-    }
-  };
-
-  return {
-    ...folderCheckpointOrm,
-    findByCommitId,
-    findByFolderId,
-    findLatestByFolderId,
-    findNearestCheckpoint
-  };
-};

backend/src/services/folder-commit-changes/folder-commit-changes-dal.ts

@@ -1,233 +0,0 @@
-/* eslint-disable @typescript-eslint/no-misused-promises */
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import {
-  TableName,
-  TFolderCommitChanges,
-  TFolderCommits,
-  TProjectEnvironments,
-  TSecretFolderVersions,
-  TSecretVersionsV2
-} from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderCommitChangesDALFactory = ReturnType<typeof folderCommitChangesDALFactory>;
-
-// Base type with common fields
-type BaseCommitChangeInfo = TFolderCommitChanges & {
-  actorMetadata: unknown;
-  actorType: string;
-  message?: string | null;
-  folderId: string;
-  createdAt: Date;
-};
-
-// Secret-specific change
-export type SecretCommitChange = BaseCommitChangeInfo & {
-  resourceType: "secret";
-  secretKey: string;
-  changeType: string;
-  secretVersionId?: string | null;
-  secretVersion: string;
-  secretId: string;
-  versions?: {
-    secretKey: string;
-    secretComment: string;
-    skipMultilineEncoding?: boolean | null;
-    secretReminderRepeatDays?: number | null;
-    secretReminderNote?: string | null;
-    metadata?: unknown;
-    tags?: string[] | null;
-    secretReminderRecipients?: string[] | null;
-    secretValue: string;
-  }[];
-};
-
-// Folder-specific change
-export type FolderCommitChange = BaseCommitChangeInfo & {
-  resourceType: "folder";
-  folderName: string;
-  folderVersion: string;
-  folderChangeId: string;
-  versions?: {
-    version: string;
-    name?: string;
-  }[];
-};
-
-// Discriminated union
-export type CommitChangeWithCommitInfo = SecretCommitChange | FolderCommitChange;
-
-// Type guards
-export const isSecretCommitChange = (change: CommitChangeWithCommitInfo): change is SecretCommitChange =>
-  change.resourceType === "secret";
-
-export const isFolderCommitChange = (change: CommitChangeWithCommitInfo): change is FolderCommitChange =>
-  change.resourceType === "folder";
-
-export const folderCommitChangesDALFactory = (db: TDbClient) => {
-  const folderCommitChangesOrm = ormify(db, TableName.FolderCommitChanges);
-
-  const findByCommitId = async (
-    folderCommitId: string,
-    projectId: string,
-    tx?: Knex
-  ): Promise<CommitChangeWithCommitInfo[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<TFolderCommitChanges>(TableName.FolderCommitChanges)
-        .where(buildFindFilter({ folderCommitId }, TableName.FolderCommitChanges))
-        .leftJoin<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderCommitChanges}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        .leftJoin<TSecretVersionsV2>(
-          TableName.SecretVersionV2,
-          `${TableName.FolderCommitChanges}.secretVersionId`,
-          `${TableName.SecretVersionV2}.id`
-        )
-        .leftJoin<TSecretFolderVersions>(
-          TableName.SecretFolderVersion,
-          `${TableName.FolderCommitChanges}.folderVersionId`,
-          `${TableName.SecretFolderVersion}.id`
-        )
-        .leftJoin<TProjectEnvironments>(
-          TableName.Environment,
-          `${TableName.FolderCommit}.envId`,
-          `${TableName.Environment}.id`
-        )
-        .where((qb) => {
-          if (projectId) {
-            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommitChanges))
-        .select(
-          db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderName"),
-          db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("folderChangeId"),
-          db.ref("version").withSchema(TableName.SecretFolderVersion).as("folderVersion"),
-          db.ref("key").withSchema(TableName.SecretVersionV2).as("secretKey"),
-          db.ref("version").withSchema(TableName.SecretVersionV2).as("secretVersion"),
-          db.ref("secretId").withSchema(TableName.SecretVersionV2),
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit),
-          db.ref("folderId").withSchema(TableName.FolderCommit)
-        );
-
-      return docs.map((doc) => {
-        // Determine if this is a secret or folder change based on populated fields
-        if (doc.secretKey && doc.secretVersion && doc.secretId) {
-          return {
-            ...doc,
-            resourceType: "secret",
-            secretKey: doc.secretKey,
-            secretVersion: doc.secretVersion.toString(),
-            secretId: doc.secretId
-          } as SecretCommitChange;
-        }
-        return {
-          ...doc,
-          resourceType: "folder",
-          folderName: doc.folderName,
-          folderVersion: doc.folderVersion.toString(),
-          folderChangeId: doc.folderChangeId
-        } as FolderCommitChange;
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByCommitId" });
-    }
-  };
-
-  const findBySecretVersionId = async (secretVersionId: string, tx?: Knex): Promise<SecretCommitChange[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<
-        TFolderCommitChanges &
-          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
-      >(TableName.FolderCommitChanges)
-        .where(buildFindFilter({ secretVersionId }, TableName.FolderCommitChanges))
-        .select(selectAllTableCols(TableName.FolderCommitChanges))
-        .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
-        .leftJoin<TSecretVersionsV2>(
-          TableName.SecretVersionV2,
-          `${TableName.FolderCommitChanges}.secretVersionId`,
-          `${TableName.SecretVersionV2}.id`
-        )
-        .select(
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit),
-          db.ref("folderId").withSchema(TableName.FolderCommit),
-          db.ref("key").withSchema(TableName.SecretVersionV2).as("secretKey"),
-          db.ref("version").withSchema(TableName.SecretVersionV2).as("secretVersion"),
-          db.ref("secretId").withSchema(TableName.SecretVersionV2)
-        );
-
-      return docs
-        .filter((doc) => doc.secretKey && doc.secretVersion && doc.secretId)
-        .map(
-          (doc): SecretCommitChange => ({
-            ...doc,
-            resourceType: "secret",
-            secretKey: doc.secretKey,
-            secretVersion: doc.secretVersion.toString(),
-            secretId: doc.secretId
-          })
-        );
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindBySecretVersionId" });
-    }
-  };
-
-  const findByFolderVersionId = async (folderVersionId: string, tx?: Knex): Promise<FolderCommitChange[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<
-        TFolderCommitChanges &
-          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
-      >(TableName.FolderCommitChanges)
-        .where(buildFindFilter({ folderVersionId }, TableName.FolderCommitChanges))
-        .select(selectAllTableCols(TableName.FolderCommitChanges))
-        .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
-        .leftJoin<TSecretFolderVersions>(
-          TableName.SecretFolderVersion,
-          `${TableName.FolderCommitChanges}.folderVersionId`,
-          `${TableName.SecretFolderVersion}.id`
-        )
-        .select(
-          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
-          db.ref("actorType").withSchema(TableName.FolderCommit),
-          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("createdAt").withSchema(TableName.FolderCommit),
-          db.ref("folderId").withSchema(TableName.FolderCommit),
-          db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderName"),
-          db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("folderChangeId"),
-          db.ref("version").withSchema(TableName.SecretFolderVersion).as("folderVersion")
-        );
-
-      return docs
-        .filter((doc) => doc.folderName && doc.folderVersion && doc.folderChangeId)
-        .map(
-          (doc): FolderCommitChange => ({
-            ...doc,
-            resourceType: "folder",
-            folderName: doc.folderName,
-            folderVersion: doc.folderVersion!.toString(),
-            folderChangeId: doc.folderChangeId
-          })
-        );
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByFolderVersionId" });
-    }
-  };
-
-  return {
-    ...folderCommitChangesOrm,
-    findByCommitId,
-    findBySecretVersionId,
-    findByFolderVersionId
-  };
-};

backend/src/services/folder-commit/folder-commit-dal.ts

@@ -1,513 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import {
-  TableName,
-  TFolderCommitChanges,
-  TFolderCommits,
-  TProjectEnvironments,
-  TSecretFolderVersions,
-  TSecretVersionsV2
-} from "@app/db/schemas";
-import { DatabaseError, NotFoundError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderCommitDALFactory = ReturnType<typeof folderCommitDALFactory>;
-
-export const folderCommitDALFactory = (db: TDbClient) => {
-  const folderCommitOrm = ormify(db, TableName.FolderCommit);
-  const { delete: deleteOp, deleteById, ...restOfOrm } = folderCommitOrm;
-
-  const findByFolderId = async (folderId: string, tx?: Knex): Promise<TFolderCommits[]> => {
-    try {
-      const trx = tx || db.replicaNode();
-
-      // First, get all folder commits
-      const folderCommits = await trx(TableName.FolderCommit)
-        .where({ folderId })
-        .select("*")
-        .orderBy("createdAt", "desc");
-
-      if (folderCommits.length === 0) return [];
-
-      // Get all commit IDs
-      const commitIds = folderCommits.map((commit) => commit.id);
-
-      // Then get all related changes
-      const changes = await trx(TableName.FolderCommitChanges).whereIn("folderCommitId", commitIds).select("*");
-
-      const changesMap = changes.reduce(
-        (acc, change) => {
-          const { folderCommitId } = change;
-          if (!acc[folderCommitId]) acc[folderCommitId] = [];
-          acc[folderCommitId].push(change);
-          return acc;
-        },
-        {} as Record<string, TFolderCommitChanges[]>
-      );
-
-      return folderCommits.map((commit) => ({
-        ...commit,
-        changes: changesMap[commit.id] || []
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByFolderId" });
-    }
-  };
-
-  const findLatestCommit = async (
-    folderId: string,
-    projectId?: string,
-    tx?: Knex
-  ): Promise<TFolderCommits | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ folderId })
-        .leftJoin(TableName.Environment, `${TableName.FolderCommit}.envId`, `${TableName.Environment}.id`)
-        .where((qb) => {
-          if (projectId) {
-            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommit" });
-    }
-  };
-
-  const findLatestCommitByFolderIds = async (folderIds: string[], tx?: Knex): Promise<TFolderCommits[] | undefined> => {
-    try {
-      // First get max commitId for each folderId
-      const maxCommitIdSubquery = (tx || db.replicaNode())(TableName.FolderCommit)
-        .select("folderId")
-        .max("commitId as maxCommitId")
-        .whereIn("folderId", folderIds)
-        .groupBy("folderId");
-
-      // Join with main table to get complete records for each max commitId
-      const docs = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .select(selectAllTableCols(TableName.FolderCommit))
-        // eslint-disable-next-line func-names
-        .join<TFolderCommits>(maxCommitIdSubquery.as("latest"), function () {
-          this.on(`${TableName.FolderCommit}.folderId`, "=", "latest.folderId").andOn(
-            `${TableName.FolderCommit}.commitId`,
-            "=",
-            "latest.maxCommitId"
-          );
-        });
-
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommitByFolderIds" });
-    }
-  };
-
-  const findLatestEnvCommit = async (envId: string, tx?: Knex): Promise<TFolderCommits | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where(`${TableName.FolderCommit}.envId`, "=", envId)
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommit" });
-    }
-  };
-
-  const findMultipleLatestCommits = async (folderIds: string[], tx?: Knex): Promise<TFolderCommits[]> => {
-    try {
-      const knexInstance = tx || db.replicaNode();
-
-      // Get the latest commitId for each folderId
-      const subquery = knexInstance(TableName.FolderCommit)
-        .whereIn("folderId", folderIds)
-        .groupBy("folderId")
-        .select("folderId")
-        .max("commitId as maxCommitId");
-
-      // Then fetch the complete rows matching those latest commits
-      const docs = await knexInstance(TableName.FolderCommit)
-        // eslint-disable-next-line func-names
-        .innerJoin<TFolderCommits>(subquery.as("latest"), function () {
-          this.on(`${TableName.FolderCommit}.folderId`, "=", "latest.folderId").andOn(
-            `${TableName.FolderCommit}.commitId`,
-            "=",
-            "latest.maxCommitId"
-          );
-        })
-        .select(selectAllTableCols(TableName.FolderCommit));
-
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindMultipleLatestCommits" });
-    }
-  };
-
-  const getNumberOfCommitsSince = async (folderId: string, folderCommitId: string, tx?: Knex): Promise<number> => {
-    try {
-      const referencedCommit = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ id: folderCommitId })
-        .select("commitId")
-        .first();
-
-      if (referencedCommit?.commitId) {
-        const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-          .where({ folderId })
-          .where("commitId", ">", referencedCommit.commitId)
-          .count();
-        return Number(doc?.[0].count);
-      }
-      return 0;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "getNumberOfCommitsSince" });
-    }
-  };
-
-  const getEnvNumberOfCommitsSince = async (envId: string, folderCommitId: string, tx?: Knex): Promise<number> => {
-    try {
-      const referencedCommit = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ id: folderCommitId })
-        .select("commitId")
-        .first();
-
-      if (referencedCommit?.commitId) {
-        const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-          .where(`${TableName.FolderCommit}.envId`, "=", envId)
-          .where("commitId", ">", referencedCommit.commitId)
-          .count();
-        return Number(doc?.[0].count);
-      }
-      return 0;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "getNumberOfCommitsSince" });
-    }
-  };
-
-  const findCommitsToRecreate = async (
-    folderId: string,
-    targetCommitNumber: bigint,
-    checkpointCommitNumber: bigint,
-    tx?: Knex
-  ): Promise<
-    (TFolderCommits & {
-      changes: (TFolderCommitChanges & {
-        referencedSecretId?: string;
-        referencedFolderId?: string;
-        folderName?: string;
-        folderVersion?: string;
-        secretKey?: string;
-        secretVersion?: string;
-      })[];
-    })[]
-  > => {
-    try {
-      // First get all the commits in the range
-      const commits = await (tx || db.replicaNode())(TableName.FolderCommit)
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderId }, TableName.FolderCommit))
-        .andWhere(`${TableName.FolderCommit}.commitId`, ">", checkpointCommitNumber.toString())
-        .andWhere(`${TableName.FolderCommit}.commitId`, "<=", targetCommitNumber.toString())
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy(`${TableName.FolderCommit}.commitId`, "asc");
-
-      // If no commits found, return empty array
-      if (!commits.length) {
-        return [];
-      }
-
-      // Get all the commit IDs
-      const commitIds = commits.map((commit) => commit.id);
-
-      // Get all changes for these commits in a single query
-      const allChanges = await (tx || db.replicaNode())(TableName.FolderCommitChanges)
-        .whereIn(`${TableName.FolderCommitChanges}.folderCommitId`, commitIds)
-        .leftJoin<TSecretVersionsV2>(
-          TableName.SecretVersionV2,
-          `${TableName.FolderCommitChanges}.secretVersionId`,
-          `${TableName.SecretVersionV2}.id`
-        )
-        .leftJoin<TSecretFolderVersions>(
-          TableName.SecretFolderVersion,
-          `${TableName.FolderCommitChanges}.folderVersionId`,
-          `${TableName.SecretFolderVersion}.id`
-        )
-        .select(selectAllTableCols(TableName.FolderCommitChanges))
-        .select(
-          db.ref("secretId").withSchema(TableName.SecretVersionV2).as("referencedSecretId"),
-          db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("referencedFolderId"),
-          db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderName"),
-          db.ref("version").withSchema(TableName.SecretFolderVersion).as("folderVersion"),
-          db.ref("key").withSchema(TableName.SecretVersionV2).as("secretKey"),
-          db.ref("version").withSchema(TableName.SecretVersionV2).as("secretVersion")
-        );
-
-      // Organize changes by commit ID
-      const changesByCommitId = allChanges.reduce(
-        (acc, change) => {
-          if (!acc[change.folderCommitId]) {
-            acc[change.folderCommitId] = [];
-          }
-          acc[change.folderCommitId].push(change);
-          return acc;
-        },
-        {} as Record<string, TFolderCommitChanges[]>
-      );
-
-      // Attach changes to each commit
-      return commits.map((commit) => ({
-        ...commit,
-        changes: changesByCommitId[commit.id] || []
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindCommitsToRecreate" });
-    }
-  };
-
-  const findLatestCommitBetween = async ({
-    folderId,
-    startCommitId,
-    endCommitId,
-    tx
-  }: {
-    folderId: string;
-    startCommitId?: string;
-    endCommitId: string;
-    tx?: Knex;
-  }): Promise<TFolderCommits | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where("commitId", "<=", endCommitId)
-        .where({ folderId })
-        .where((qb) => {
-          if (startCommitId) {
-            void qb.where("commitId", ">=", startCommitId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommitBetween" });
-    }
-  };
-
-  const findAllCommitsBetween = async ({
-    envId,
-    startCommitId,
-    endCommitId,
-    tx
-  }: {
-    envId?: string;
-    startCommitId?: string;
-    endCommitId?: string;
-    tx?: Knex;
-  }): Promise<TFolderCommits[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where((qb) => {
-          if (envId) {
-            void qb.where(`${TableName.FolderCommit}.envId`, "=", envId);
-          }
-          if (startCommitId) {
-            void qb.where("commitId", ">=", startCommitId);
-          }
-          if (endCommitId) {
-            void qb.where("commitId", "<=", endCommitId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc");
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommitBetween" });
-    }
-  };
-
-  const findAllFolderCommitsAfter = async ({
-    envId,
-    startCommitId,
-    tx
-  }: {
-    envId?: string;
-    startCommitId?: string;
-    tx?: Knex;
-  }): Promise<TFolderCommits[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where((qb) => {
-          if (envId) {
-            void qb.where(`${TableName.FolderCommit}.envId`, "=", envId);
-          }
-          if (startCommitId) {
-            void qb.where("commitId", ">=", startCommitId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc");
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestCommitBetween" });
-    }
-  };
-
-  const findPreviousCommitTo = async (
-    folderId: string,
-    commitId: string,
-    tx?: Knex
-  ): Promise<TFolderCommits | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ folderId })
-        .where("commitId", "<=", commitId)
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindPreviousCommitTo" });
-    }
-  };
-
-  const findById = async (id: string, tx?: Knex, projectId?: string): Promise<TFolderCommits> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ id }, TableName.FolderCommit))
-        .leftJoin<TProjectEnvironments>(
-          TableName.Environment,
-          `${TableName.FolderCommit}.envId`,
-          `${TableName.Environment}.id`
-        )
-        .where((qb) => {
-          if (projectId) {
-            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
-          }
-        })
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      if (!doc) {
-        throw new NotFoundError({
-          message: `Folder commit not found for ID ${id}`
-        });
-      }
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindById" });
-    }
-  };
-
-  const findByFolderIdPaginated = async (
-    folderId: string,
-    options: {
-      offset?: number;
-      limit?: number;
-      search?: string;
-      sort?: "asc" | "desc";
-    } = {},
-    tx?: Knex
-  ): Promise<{
-    commits: TFolderCommits[];
-    total: number;
-    hasMore: boolean;
-  }> => {
-    try {
-      const { offset = 0, limit = 20, search, sort = "desc" } = options;
-      const trx = tx || db.replicaNode();
-
-      // Build base query
-      let baseQuery = trx(TableName.FolderCommit).where({ folderId });
-
-      // Add search functionality
-      if (search) {
-        baseQuery = baseQuery.where((qb) => {
-          void qb.whereILike("message", `%${search}%`);
-        });
-      }
-
-      // Get total count
-      const totalResult = await baseQuery.clone().count("*", { as: "count" }).first();
-      const total = Number(totalResult?.count || 0);
-
-      // Get paginated commits
-      const folderCommits = await baseQuery.select("*").orderBy("createdAt", sort).limit(limit).offset(offset);
-
-      if (folderCommits.length === 0) {
-        return { commits: [], total, hasMore: false };
-      }
-
-      // Get all commit IDs for changes
-      const commitIds = folderCommits.map((commit) => commit.id);
-
-      // Get all related changes
-      const changes = await trx(TableName.FolderCommitChanges).whereIn("folderCommitId", commitIds).select("*");
-
-      const changesMap = changes.reduce(
-        (acc, change) => {
-          const { folderCommitId } = change;
-          if (!acc[folderCommitId]) acc[folderCommitId] = [];
-          acc[folderCommitId].push(change);
-          return acc;
-        },
-        {} as Record<string, TFolderCommitChanges[]>
-      );
-
-      const commitsWithChanges = folderCommits.map((commit) => ({
-        ...commit,
-        changes: changesMap[commit.id] || []
-      }));
-
-      const hasMore = offset + limit < total;
-
-      return {
-        commits: commitsWithChanges,
-        total,
-        hasMore
-      };
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByFolderIdPaginated" });
-    }
-  };
-
-  const findCommitBefore = async (
-    folderId: string,
-    commitId: bigint,
-    tx?: Knex
-  ): Promise<TFolderCommits | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ folderId })
-        .where("commitId", "<", commitId.toString())
-        .select(selectAllTableCols(TableName.FolderCommit))
-        .orderBy("commitId", "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindCommitBefore" });
-    }
-  };
-
-  return {
-    ...restOfOrm,
-    findByFolderId,
-    findLatestCommit,
-    getNumberOfCommitsSince,
-    findCommitsToRecreate,
-    findMultipleLatestCommits,
-    findAllCommitsBetween,
-    findLatestCommitBetween,
-    findLatestEnvCommit,
-    getEnvNumberOfCommitsSince,
-    findLatestCommitByFolderIds,
-    findAllFolderCommitsAfter,
-    findPreviousCommitTo,
-    findById,
-    findByFolderIdPaginated,
-    findCommitBefore
-  };
-};

backend/src/services/folder-commit/folder-commit-queue.ts

@@ -1,282 +0,0 @@
-import { Knex } from "knex";
-
-import { TSecretFolders } from "@app/db/schemas";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
-import { getConfig } from "@app/lib/config/env";
-import { logger } from "@app/lib/logger";
-import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
-
-import { TFolderTreeCheckpointDALFactory } from "../folder-tree-checkpoint/folder-tree-checkpoint-dal";
-import { TFolderTreeCheckpointResourcesDALFactory } from "../folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal";
-import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
-import { TFolderCommitDALFactory } from "./folder-commit-dal";
-
-// Define types for job data
-type TCreateFolderTreeCheckpointDTO = {
-  envId: string;
-  failedToAcquireLockCount?: number;
-  folderCommitId?: string;
-};
-
-type TFolderCommitQueueServiceFactoryDep = {
-  queueService: TQueueServiceFactory;
-  keyStore: Pick<TKeyStoreFactory, "acquireLock" | "getItem" | "deleteItem">;
-  folderTreeCheckpointDAL: Pick<
-    TFolderTreeCheckpointDALFactory,
-    "create" | "findLatestByEnvId" | "findNearestCheckpoint"
-  >;
-  folderTreeCheckpointResourcesDAL: Pick<
-    TFolderTreeCheckpointResourcesDALFactory,
-    "insertMany" | "findByTreeCheckpointId"
-  >;
-  folderCommitDAL: Pick<
-    TFolderCommitDALFactory,
-    "findLatestEnvCommit" | "getEnvNumberOfCommitsSince" | "findMultipleLatestCommits" | "findById"
-  >;
-  folderDAL: Pick<TSecretFolderDALFactory, "findByEnvId">;
-};
-
-export type TFolderCommitQueueServiceFactory = ReturnType<typeof folderCommitQueueServiceFactory>;
-
-export const folderCommitQueueServiceFactory = ({
-  queueService,
-  keyStore,
-  folderTreeCheckpointDAL,
-  folderTreeCheckpointResourcesDAL,
-  folderCommitDAL,
-  folderDAL
-}: TFolderCommitQueueServiceFactoryDep) => {
-  const appCfg = getConfig();
-
-  // Helper function to calculate delay for requeuing
-  const getRequeueDelay = (failureCount?: number) => {
-    if (!failureCount) return 0;
-
-    const baseDelay = 5000;
-    const maxDelay = 30000;
-
-    const delay = Math.min(baseDelay * 2 ** failureCount, maxDelay);
-    const jitter = delay * (0.5 + Math.random() * 0.5);
-
-    return jitter;
-  };
-
-  const scheduleTreeCheckpoint = async (payload: TCreateFolderTreeCheckpointDTO) => {
-    const { envId, failedToAcquireLockCount = 0 } = payload;
-
-    // Create a unique jobId for each retry to prevent conflicts
-    const jobId =
-      failedToAcquireLockCount > 0 ? `${envId}-retry-${failedToAcquireLockCount}-${Date.now()}` : `${envId}`;
-
-    await queueService.queue(QueueName.FolderTreeCheckpoint, QueueJobs.CreateFolderTreeCheckpoint, payload, {
-      jobId,
-      delay: getRequeueDelay(failedToAcquireLockCount),
-      backoff: {
-        type: "exponential",
-        delay: 3000
-      },
-      removeOnFail: {
-        count: 3
-      },
-      removeOnComplete: true
-    });
-  };
-
-  // Sort folders by hierarchy (copied from the source code)
-  const sortFoldersByHierarchy = (folders: TSecretFolders[]) => {
-    const childrenMap = new Map<string, TSecretFolders[]>();
-    const allFolderIds = new Set<string>();
-
-    folders.forEach((folder) => {
-      if (folder.id) allFolderIds.add(folder.id);
-    });
-
-    folders.forEach((folder) => {
-      if (folder.parentId) {
-        const children = childrenMap.get(folder.parentId) || [];
-        children.push(folder);
-        childrenMap.set(folder.parentId, children);
-      }
-    });
-
-    const rootFolders = folders.filter((folder) => !folder.parentId || !allFolderIds.has(folder.parentId));
-
-    const result = [];
-    let currentLevel = rootFolders;
-
-    while (currentLevel.length > 0) {
-      result.push(...currentLevel);
-
-      const nextLevel = [];
-      for (const folder of currentLevel) {
-        if (folder.id) {
-          const children = childrenMap.get(folder.id) || [];
-          nextLevel.push(...children);
-        }
-      }
-
-      currentLevel = nextLevel;
-    }
-
-    return result;
-  };
-
-  const createFolderTreeCheckpoint = async (jobData: TCreateFolderTreeCheckpointDTO, tx?: Knex) => {
-    const { envId, folderCommitId, failedToAcquireLockCount = 0 } = jobData;
-
-    logger.info(`Folder tree checkpoint creation started [envId=${envId}] [attempt=${failedToAcquireLockCount + 1}]`);
-
-    // First, try to clear any stale locks before attempting to acquire
-    if (failedToAcquireLockCount > 1) {
-      try {
-        await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
-        logger.info(`Cleared potential stale lock for envId ${envId} before attempt ${failedToAcquireLockCount + 1}`);
-      } catch (error) {
-        // This is fine if it fails, we'll still try to acquire the lock
-        logger.info(`No stale lock found for envId ${envId}`);
-      }
-    }
-
-    let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
-
-    try {
-      // Attempt to acquire the lock with a shorter timeout for first attempts
-      const timeout = failedToAcquireLockCount > 3 ? 60 * 1000 : 15 * 1000;
-
-      logger.info(`Attempting to acquire lock for envId=${envId} with timeout ${timeout}ms`);
-
-      lock = await keyStore.acquireLock([KeyStorePrefixes.FolderTreeCheckpoint(envId)], timeout);
-
-      logger.info(`Successfully acquired lock for envId=${envId}`);
-    } catch (e) {
-      logger.info(
-        `Failed to acquire lock for folder tree checkpoint [envId=${envId}] [attempt=${failedToAcquireLockCount + 1}]`
-      );
-
-      // Requeue with incremented failure count if under max attempts
-      if (failedToAcquireLockCount < 10) {
-        // Force a delay between retries
-        const nextRetryCount = failedToAcquireLockCount + 1;
-
-        logger.info(`Scheduling retry #${nextRetryCount} for folder tree checkpoint [envId=${envId}]`);
-
-        // Create a new job with incremented counter
-        await scheduleTreeCheckpoint({
-          envId,
-          folderCommitId,
-          failedToAcquireLockCount: nextRetryCount
-        });
-      } else {
-        // Max retries reached
-        logger.error(`Maximum lock acquisition attempts (10) reached for envId ${envId}. Giving up.`);
-        // Try to force-clear the lock for next time
-        try {
-          await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
-        } catch (clearError) {
-          logger.error(clearError, `Failed to clear lock after maximum retries for envId=${envId}`);
-        }
-      }
-      return;
-    }
-
-    if (!lock) {
-      logger.error(`Lock is undefined after acquisition for envId=${envId}. This should never happen.`);
-      return;
-    }
-
-    try {
-      logger.info(`Processing tree checkpoint data for envId=${envId}`);
-
-      const latestTreeCheckpoint = await folderTreeCheckpointDAL.findLatestByEnvId(envId, tx);
-
-      let latestCommit;
-      if (folderCommitId) {
-        latestCommit = await folderCommitDAL.findById(folderCommitId, tx);
-      } else {
-        latestCommit = await folderCommitDAL.findLatestEnvCommit(envId, tx);
-      }
-      if (!latestCommit) {
-        logger.info(`Latest commit ID not found for envId ${envId}`);
-        return;
-      }
-      const latestCommitId = latestCommit.id;
-
-      if (latestTreeCheckpoint) {
-        const commitsSinceLastCheckpoint = await folderCommitDAL.getEnvNumberOfCommitsSince(
-          envId,
-          latestTreeCheckpoint.folderCommitId,
-          tx
-        );
-        if (commitsSinceLastCheckpoint < Number(appCfg.PIT_TREE_CHECKPOINT_WINDOW)) {
-          logger.info(
-            `Commits since last checkpoint ${commitsSinceLastCheckpoint} is less than ${appCfg.PIT_TREE_CHECKPOINT_WINDOW}`
-          );
-          return;
-        }
-      }
-
-      const folders = await folderDAL.findByEnvId(envId, tx);
-      const sortedFolders = sortFoldersByHierarchy(folders);
-      const filteredFoldersIds = sortedFolders.filter((folder) => !folder.isReserved).map((folder) => folder.id);
-
-      const folderCommits = await folderCommitDAL.findMultipleLatestCommits(filteredFoldersIds, tx);
-      const folderTreeCheckpoint = await folderTreeCheckpointDAL.create(
-        {
-          folderCommitId: latestCommitId
-        },
-        tx
-      );
-
-      await folderTreeCheckpointResourcesDAL.insertMany(
-        folderCommits.map((folderCommit) => ({
-          folderTreeCheckpointId: folderTreeCheckpoint.id,
-          folderId: folderCommit.folderId,
-          folderCommitId: folderCommit.id
-        })),
-        tx
-      );
-
-      logger.info(`Folder tree checkpoint created successfully: ${folderTreeCheckpoint.id}`);
-    } catch (error) {
-      logger.error(error, `Error processing folder tree checkpoint [envId=${envId}]`);
-      throw error;
-    } finally {
-      // Always release the lock
-      try {
-        if (lock) {
-          await lock.release();
-          logger.info(`Released lock for folder tree checkpoint [envId=${envId}]`);
-        } else {
-          logger.error(`No lock to release for envId=${envId}. This should never happen.`);
-        }
-      } catch (releaseError) {
-        logger.error(releaseError, `Error releasing lock for folder tree checkpoint [envId=${envId}]`);
-        // Try to force delete the lock if release fails
-        try {
-          await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
-          logger.info(`Force deleted lock after release failure for envId=${envId}`);
-        } catch (deleteError) {
-          logger.error(deleteError, `Failed to force delete lock after release failure for envId=${envId}`);
-        }
-      }
-    }
-  };
-
-  queueService.start(QueueName.FolderTreeCheckpoint, async (job) => {
-    try {
-      if (job.name === QueueJobs.CreateFolderTreeCheckpoint) {
-        const jobData = job.data as TCreateFolderTreeCheckpointDTO;
-        await createFolderTreeCheckpoint(jobData);
-      }
-    } catch (error) {
-      logger.error(error, "Error creating folder tree checkpoint:");
-      throw error;
-    }
-  });
-
-  return {
-    scheduleTreeCheckpoint: (envId: string) => scheduleTreeCheckpoint({ envId }),
-    createFolderTreeCheckpoint: (envId: string, folderCommitId?: string, tx?: Knex) =>
-      createFolderTreeCheckpoint({ envId, folderCommitId }, tx)
-  };
-};

backend/src/services/folder-commit/folder-commit-schemas.ts

@@ -1,143 +0,0 @@
-import { z } from "zod";
-
-// Base schema shared by both secret and folder changes
-const baseChangeSchema = z.object({
-  id: z.string(),
-  folderCommitId: z.string(),
-  changeType: z.string(),
-  isUpdate: z.boolean().optional(),
-  createdAt: z.union([z.string(), z.date()]),
-  updatedAt: z.union([z.string(), z.date()]),
-  actorMetadata: z
-    .union([
-      z.object({
-        id: z.string().optional(),
-        name: z.string().optional()
-      }),
-      z.unknown()
-    ])
-    .optional(),
-  actorType: z.string(),
-  message: z.string().nullable().optional(),
-  folderId: z.string()
-});
-
-// Secret-specific versions schema
-const secretVersionSchema = z.object({
-  secretKey: z.string(),
-  secretComment: z.string(),
-  skipMultilineEncoding: z.boolean().nullable().optional(),
-  tags: z.array(z.string()).nullable().optional(),
-  metadata: z.unknown().nullable().optional(),
-  secretValue: z.string()
-});
-
-// Folder-specific versions schema
-const folderVersionSchema = z.object({
-  version: z.string().optional(),
-  name: z.string().optional(),
-  description: z.string().optional().nullable()
-});
-
-// Secret commit change schema
-const secretCommitChangeSchema = baseChangeSchema.extend({
-  resourceType: z.literal("secret"),
-  secretVersionId: z.string().optional().nullable(),
-  secretKey: z.string(),
-  secretVersion: z.union([z.string(), z.number()]),
-  secretId: z.string(),
-  versions: z.array(secretVersionSchema).optional()
-});
-
-// Folder commit change schema
-const folderCommitChangeSchema = baseChangeSchema.extend({
-  resourceType: z.literal("folder"),
-  folderVersionId: z.string().optional().nullable(),
-  folderName: z.string(),
-  folderChangeId: z.string(),
-  folderVersion: z.union([z.string(), z.number()]),
-  versions: z.array(folderVersionSchema).optional()
-});
-
-// Discriminated union for commit changes
-export const commitChangeSchema = z.discriminatedUnion("resourceType", [
-  secretCommitChangeSchema,
-  folderCommitChangeSchema
-]);
-
-// Commit schema
-const commitSchema = z.object({
-  id: z.string(),
-  commitId: z.string(),
-  actorMetadata: z
-    .union([
-      z.object({
-        id: z.string().optional(),
-        name: z.string().optional()
-      }),
-      z.unknown()
-    ])
-    .optional(),
-  actorType: z.string(),
-  message: z.string().nullable().optional(),
-  folderId: z.string(),
-  envId: z.string(),
-  createdAt: z.union([z.string(), z.date()]),
-  updatedAt: z.union([z.string(), z.date()]),
-  isLatest: z.boolean().default(false),
-  changes: z.array(commitChangeSchema).optional()
-});
-
-// Response schema
-export const commitChangesResponseSchema = z.object({
-  changes: commitSchema
-});
-
-// Base resource change schema for comparison results
-const baseResourceChangeSchema = z.object({
-  id: z.string(),
-  versionId: z.string(),
-  oldVersionId: z.string().optional(),
-  changeType: z.enum(["add", "delete", "update", "create"]),
-  commitId: z.union([z.string(), z.bigint()]),
-  createdAt: z.union([z.string(), z.date()]).optional(),
-  parentId: z.string().optional(),
-  isUpdate: z.boolean().optional(),
-  fromVersion: z.union([z.string(), z.number()]).optional()
-});
-
-// Secret resource change schema
-const secretResourceChangeSchema = baseResourceChangeSchema.extend({
-  type: z.literal("secret"),
-  secretKey: z.string(),
-  secretVersion: z.union([z.string(), z.number()]),
-  secretId: z.string(),
-  versions: z
-    .array(
-      z.object({
-        secretKey: z.string().optional(),
-        secretComment: z.string().optional(),
-        skipMultilineEncoding: z.boolean().nullable().optional(),
-        secretReminderRepeatDays: z.number().nullable().optional(),
-        tags: z.array(z.string()).nullable().optional(),
-        metadata: z.unknown().nullable().optional(),
-        secretReminderNote: z.string().nullable().optional(),
-        secretValue: z.string().optional()
-      })
-    )
-    .optional()
-});
-
-// Folder resource change schema
-const folderResourceChangeSchema = baseResourceChangeSchema.extend({
-  type: z.literal("folder"),
-  folderName: z.string(),
-  folderVersion: z.union([z.string(), z.number()]),
-  versions: z.array(folderVersionSchema).optional()
-});
-
-// Discriminated union for resource changes
-export const resourceChangeSchema = z.discriminatedUnion("type", [
-  secretResourceChangeSchema,
-  folderResourceChangeSchema
-]);

backend/src/services/folder-commit/folder-commit-service.test.ts

@@ -1,671 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unsafe-call */
-/* eslint-disable @typescript-eslint/return-await */
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-import { Knex } from "knex";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-import { ProjectType, TSecretFolderVersions, TSecretVersionsV2 } from "@app/db/schemas";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
-
-import { ActorType } from "../auth/auth-type";
-import {
-  ChangeType,
-  CommitType,
-  folderCommitServiceFactory,
-  ResourceChange,
-  TFolderCommitServiceFactory
-} from "./folder-commit-service";
-
-// Mock config
-vi.mock("@app/lib/config/env", () => ({
-  getConfig: () => ({
-    PIT_CHECKPOINT_WINDOW: 5,
-    PIT_TREE_CHECKPOINT_WINDOW: 10
-  })
-}));
-
-// Mock logger
-vi.mock("@app/lib/logger", () => ({
-  logger: {
-    info: vi.fn(),
-    error: vi.fn()
-  }
-}));
-
-describe("folderCommitServiceFactory", () => {
-  // Properly type the mock functions
-  type TransactionCallback<T> = (trx: Knex) => Promise<T>;
-
-  // Mock dependencies
-  const mockFolderCommitDAL = {
-    create: vi.fn().mockResolvedValue({}),
-    findById: vi.fn().mockResolvedValue({}),
-    findByFolderId: vi.fn().mockResolvedValue([]),
-    findLatestCommit: vi.fn().mockResolvedValue({}),
-    transaction: vi.fn().mockImplementation(<T>(callback: TransactionCallback<T>) => callback({} as Knex)),
-    getNumberOfCommitsSince: vi.fn().mockResolvedValue(0),
-    getEnvNumberOfCommitsSince: vi.fn().mockResolvedValue(0),
-    findCommitsToRecreate: vi.fn().mockResolvedValue([]),
-    findMultipleLatestCommits: vi.fn().mockResolvedValue([]),
-    findLatestCommitBetween: vi.fn().mockResolvedValue({}),
-    findAllCommitsBetween: vi.fn().mockResolvedValue([]),
-    findLatestEnvCommit: vi.fn().mockResolvedValue({}),
-    findLatestCommitByFolderIds: vi.fn().mockResolvedValue({})
-  };
-
-  const mockKmsService = {
-    createCipherPairWithDataKey: vi.fn().mockResolvedValue({})
-  };
-
-  const mockFolderCommitChangesDAL = {
-    create: vi.fn().mockResolvedValue({}),
-    findByCommitId: vi.fn().mockResolvedValue([]),
-    insertMany: vi.fn().mockResolvedValue([])
-  };
-
-  const mockFolderCheckpointDAL = {
-    create: vi.fn().mockResolvedValue({}),
-    findByFolderId: vi.fn().mockResolvedValue([]),
-    findLatestByFolderId: vi.fn().mockResolvedValue(null),
-    findNearestCheckpoint: vi.fn().mockResolvedValue({})
-  };
-
-  const mockFolderCheckpointResourcesDAL = {
-    insertMany: vi.fn().mockResolvedValue([]),
-    findByCheckpointId: vi.fn().mockResolvedValue([])
-  };
-
-  const mockFolderTreeCheckpointDAL = {
-    create: vi.fn().mockResolvedValue({}),
-    findByProjectId: vi.fn().mockResolvedValue([]),
-    findLatestByProjectId: vi.fn().mockResolvedValue({}),
-    findNearestCheckpoint: vi.fn().mockResolvedValue({}),
-    findLatestByEnvId: vi.fn().mockResolvedValue({})
-  };
-
-  const mockFolderTreeCheckpointResourcesDAL = {
-    insertMany: vi.fn().mockResolvedValue([]),
-    findByTreeCheckpointId: vi.fn().mockResolvedValue([])
-  };
-
-  const mockUserDAL = {
-    findById: vi.fn().mockResolvedValue({})
-  };
-
-  const mockIdentityDAL = {
-    findById: vi.fn().mockResolvedValue({})
-  };
-
-  const mockFolderDAL = {
-    findByParentId: vi.fn().mockResolvedValue([]),
-    findByProjectId: vi.fn().mockResolvedValue([]),
-    deleteById: vi.fn().mockResolvedValue({}),
-    create: vi.fn().mockResolvedValue({}),
-    updateById: vi.fn().mockResolvedValue({}),
-    update: vi.fn().mockResolvedValue({}),
-    find: vi.fn().mockResolvedValue([]),
-    findById: vi.fn().mockResolvedValue({}),
-    findByEnvId: vi.fn().mockResolvedValue([]),
-    findFoldersByRootAndIds: vi.fn().mockResolvedValue([])
-  };
-
-  const mockFolderVersionDAL = {
-    findLatestFolderVersions: vi.fn().mockResolvedValue({}),
-    findById: vi.fn().mockResolvedValue({}),
-    deleteById: vi.fn().mockResolvedValue({}),
-    create: vi.fn().mockResolvedValue({}),
-    updateById: vi.fn().mockResolvedValue({}),
-    find: vi.fn().mockResolvedValue({}), // Changed from [] to {} to match Object.values() expectation
-    findByIdsWithLatestVersion: vi.fn().mockResolvedValue({})
-  };
-
-  const mockSecretVersionV2BridgeDAL = {
-    findLatestVersionByFolderId: vi.fn().mockResolvedValue([]),
-    findById: vi.fn().mockResolvedValue({}),
-    deleteById: vi.fn().mockResolvedValue({}),
-    create: vi.fn().mockResolvedValue({}),
-    updateById: vi.fn().mockResolvedValue({}),
-    find: vi.fn().mockResolvedValue([]),
-    findByIdsWithLatestVersion: vi.fn().mockResolvedValue({}),
-    findLatestVersionMany: vi.fn().mockResolvedValue({})
-  };
-
-  const mockSecretV2BridgeDAL = {
-    deleteById: vi.fn().mockResolvedValue({}),
-    create: vi.fn().mockResolvedValue({}),
-    updateById: vi.fn().mockResolvedValue({}),
-    update: vi.fn().mockResolvedValue({}),
-    insertMany: vi.fn().mockResolvedValue([]),
-    invalidateSecretCacheByProjectId: vi.fn().mockResolvedValue({})
-  };
-
-  const mockProjectDAL = {
-    findById: vi.fn().mockResolvedValue({}),
-    findProjectByEnvId: vi.fn().mockResolvedValue({})
-  };
-
-  const mockFolderCommitQueueService = {
-    scheduleTreeCheckpoint: vi.fn().mockResolvedValue({}),
-    createFolderTreeCheckpoint: vi.fn().mockResolvedValue({})
-  };
-
-  const mockPermissionService = {
-    getProjectPermission: vi.fn().mockResolvedValue({})
-  };
-
-  const mockSecretTagDAL = {
-    findSecretTagsByVersionId: vi.fn().mockResolvedValue([]),
-    saveTagsToSecretV2: vi.fn().mockResolvedValue([]),
-    findSecretTagsBySecretId: vi.fn().mockResolvedValue([]),
-    deleteTagsToSecretV2: vi.fn().mockResolvedValue([]),
-    saveTagsToSecretVersionV2: vi.fn().mockResolvedValue([])
-  };
-
-  const mockResourceMetadataDAL = {
-    find: vi.fn().mockResolvedValue([]),
-    insertMany: vi.fn().mockResolvedValue([]),
-    delete: vi.fn().mockResolvedValue([])
-  };
-
-  let folderCommitService: TFolderCommitServiceFactory;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-
-    folderCommitService = folderCommitServiceFactory({
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderCommitDAL: mockFolderCommitDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderCommitChangesDAL: mockFolderCommitChangesDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderCheckpointDAL: mockFolderCheckpointDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderCheckpointResourcesDAL: mockFolderCheckpointResourcesDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderTreeCheckpointDAL: mockFolderTreeCheckpointDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderTreeCheckpointResourcesDAL: mockFolderTreeCheckpointResourcesDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      userDAL: mockUserDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      identityDAL: mockIdentityDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderDAL: mockFolderDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      folderVersionDAL: mockFolderVersionDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      secretVersionV2BridgeDAL: mockSecretVersionV2BridgeDAL,
-      projectDAL: mockProjectDAL,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      secretV2BridgeDAL: mockSecretV2BridgeDAL,
-      folderCommitQueueService: mockFolderCommitQueueService,
-      // @ts-expect-error - Mock implementation doesn't need all interface methods for testing
-      permissionService: mockPermissionService,
-      kmsService: mockKmsService,
-      secretTagDAL: mockSecretTagDAL,
-      resourceMetadataDAL: mockResourceMetadataDAL
-    });
-  });
-
-  afterEach(() => {
-    vi.resetAllMocks();
-  });
-
-  describe("createCommit", () => {
-    it("should successfully create a commit with user actor", async () => {
-      // Arrange
-      const userData = { id: "user-id", username: "testuser" };
-      const folderData = { id: "folder-id", envId: "env-id" };
-      const commitData = { id: "commit-id", folderId: "folder-id" };
-
-      mockUserDAL.findById.mockResolvedValue(userData);
-      mockFolderDAL.findById.mockResolvedValue(folderData);
-      mockFolderCommitDAL.create.mockResolvedValue(commitData);
-      mockFolderCheckpointDAL.findLatestByFolderId.mockResolvedValue(null);
-      mockFolderCommitDAL.findLatestCommit.mockResolvedValue({ id: "latest-commit-id" });
-      mockFolderDAL.findByParentId.mockResolvedValue([]);
-      mockSecretVersionV2BridgeDAL.findLatestVersionByFolderId.mockResolvedValue([]);
-
-      const data = {
-        actor: {
-          type: ActorType.USER,
-          metadata: { id: userData.id }
-        },
-        message: "Test commit",
-        folderId: folderData.id,
-        changes: [
-          {
-            type: CommitType.ADD,
-            secretVersionId: "secret-version-1"
-          }
-        ]
-      };
-
-      // Act
-      const result = await folderCommitService.createCommit(data);
-
-      // Assert
-      expect(mockUserDAL.findById).toHaveBeenCalledWith(userData.id, undefined);
-      expect(mockFolderDAL.findById).toHaveBeenCalledWith(folderData.id, undefined);
-      expect(mockFolderCommitDAL.create).toHaveBeenCalledWith(
-        expect.objectContaining({
-          actorType: ActorType.USER,
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-          actorMetadata: expect.objectContaining({ name: userData.username }),
-          message: data.message,
-          folderId: data.folderId,
-          envId: folderData.envId
-        }),
-        undefined
-      );
-      expect(mockFolderCommitChangesDAL.insertMany).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
-            folderCommitId: commitData.id,
-            changeType: data.changes[0].type,
-            secretVersionId: data.changes[0].secretVersionId
-          })
-        ]),
-        undefined
-      );
-      expect(mockFolderCommitQueueService.scheduleTreeCheckpoint).toHaveBeenCalledWith(folderData.envId);
-      expect(result).toEqual(commitData);
-    });
-
-    it("should successfully create a commit with identity actor", async () => {
-      // Arrange
-      const identityData = { id: "identity-id", name: "testidentity" };
-      const folderData = { id: "folder-id", envId: "env-id" };
-      const commitData = { id: "commit-id", folderId: "folder-id" };
-
-      mockIdentityDAL.findById.mockResolvedValue(identityData);
-      mockFolderDAL.findById.mockResolvedValue(folderData);
-      mockFolderCommitDAL.create.mockResolvedValue(commitData);
-      mockFolderCheckpointDAL.findLatestByFolderId.mockResolvedValue(null);
-      mockFolderCommitDAL.findLatestCommit.mockResolvedValue({ id: "latest-commit-id" });
-      mockFolderDAL.findByParentId.mockResolvedValue([]);
-      mockSecretVersionV2BridgeDAL.findLatestVersionByFolderId.mockResolvedValue([]);
-
-      // Mock folderVersionDAL.find to return an object with folder version data
-      mockFolderVersionDAL.find.mockResolvedValue({
-        "folder-version-1": {
-          id: "folder-version-1",
-          folderId: "sub-folder-id",
-          envId: "env-id",
-          name: "Test Folder",
-          version: 1
-        }
-      });
-
-      const data = {
-        actor: {
-          type: ActorType.IDENTITY,
-          metadata: { id: identityData.id }
-        },
-        message: "Test commit",
-        folderId: folderData.id,
-        changes: [
-          {
-            type: CommitType.ADD,
-            folderVersionId: "folder-version-1"
-          }
-        ],
-        omitIgnoreFilter: true
-      };
-
-      // Act
-      const result = await folderCommitService.createCommit(data);
-
-      // Assert
-      expect(mockIdentityDAL.findById).toHaveBeenCalledWith(identityData.id, undefined);
-      expect(mockFolderDAL.findById).toHaveBeenCalledWith(folderData.id, undefined);
-      expect(mockFolderCommitDAL.create).toHaveBeenCalledWith(
-        expect.objectContaining({
-          actorType: ActorType.IDENTITY,
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-          actorMetadata: expect.objectContaining({ name: identityData.name }),
-          message: data.message,
-          folderId: data.folderId,
-          envId: folderData.envId
-        }),
-        undefined
-      );
-      expect(mockFolderCommitChangesDAL.insertMany).toHaveBeenCalledWith(
-        expect.arrayContaining([
-          expect.objectContaining({
-            folderCommitId: commitData.id,
-            changeType: data.changes[0].type,
-            folderVersionId: data.changes[0].folderVersionId
-          })
-        ]),
-        undefined
-      );
-      expect(mockFolderCommitQueueService.scheduleTreeCheckpoint).toHaveBeenCalledWith(folderData.envId);
-      expect(result).toEqual(commitData);
-    });
-
-    it("should throw NotFoundError when folder does not exist", async () => {
-      // Arrange
-      mockFolderDAL.findById.mockResolvedValue(null);
-
-      const data = {
-        actor: {
-          type: ActorType.PLATFORM
-        },
-        message: "Test commit",
-        folderId: "non-existent-folder",
-        changes: []
-      };
-
-      // Act & Assert
-      await expect(folderCommitService.createCommit(data)).rejects.toThrow(NotFoundError);
-      expect(mockFolderDAL.findById).toHaveBeenCalledWith("non-existent-folder", undefined);
-    });
-  });
-
-  describe("addCommitChange", () => {
-    it("should successfully add a change to an existing commit", async () => {
-      // Arrange
-      const commitData = { id: "commit-id", folderId: "folder-id" };
-      const changeData = { id: "change-id", folderCommitId: "commit-id" };
-
-      mockFolderCommitDAL.findById.mockResolvedValue(commitData);
-      mockFolderCommitChangesDAL.create.mockResolvedValue(changeData);
-
-      const data = {
-        folderCommitId: commitData.id,
-        changeType: CommitType.ADD,
-        secretVersionId: "secret-version-1"
-      };
-
-      // Act
-      const result = await folderCommitService.addCommitChange(data);
-
-      // Assert
-      expect(mockFolderCommitDAL.findById).toHaveBeenCalledWith(commitData.id, undefined);
-      expect(mockFolderCommitChangesDAL.create).toHaveBeenCalledWith(data, undefined);
-      expect(result).toEqual(changeData);
-    });
-
-    it("should throw BadRequestError when neither secretVersionId nor folderVersionId is provided", async () => {
-      // Arrange
-      const data = {
-        folderCommitId: "commit-id",
-        changeType: CommitType.ADD
-      };
-
-      // Act & Assert
-      await expect(folderCommitService.addCommitChange(data)).rejects.toThrow(BadRequestError);
-    });
-
-    it("should throw NotFoundError when commit does not exist", async () => {
-      // Arrange
-      mockFolderCommitDAL.findById.mockResolvedValue(null);
-
-      const data = {
-        folderCommitId: "non-existent-commit",
-        changeType: CommitType.ADD,
-        secretVersionId: "secret-version-1"
-      };
-
-      // Act & Assert
-      await expect(folderCommitService.addCommitChange(data)).rejects.toThrow(NotFoundError);
-      expect(mockFolderCommitDAL.findById).toHaveBeenCalledWith("non-existent-commit", undefined);
-    });
-  });
-
-  // Note: reconstructFolderState is an internal function not exposed in the public API
-  // We'll test it indirectly through compareFolderStates
-
-  describe("compareFolderStates", () => {
-    it("should mark all resources as creates when currentCommitId is not provided", async () => {
-      // Arrange
-      const targetCommitId = "target-commit-id";
-      const targetCommit = { id: targetCommitId, commitId: 1, folderId: "folder-id" };
-
-      mockFolderCommitDAL.findById.mockResolvedValue(targetCommit);
-      // Mock how compareFolderStates would process the results internally
-      mockFolderCheckpointDAL.findNearestCheckpoint.mockResolvedValue({ id: "checkpoint-id", commitId: "hash-0" });
-      mockFolderCheckpointResourcesDAL.findByCheckpointId.mockResolvedValue([
-        { secretVersionId: "secret-version-1", referencedSecretId: "secret-1" },
-        { folderVersionId: "folder-version-1", referencedFolderId: "folder-1" }
-      ]);
-      mockFolderCommitDAL.findCommitsToRecreate.mockResolvedValue([]);
-      mockProjectDAL.findProjectByEnvId.mockResolvedValue({
-        id: "project-id",
-        name: "test-project",
-        type: ProjectType.SecretManager
-      });
-
-      // Act
-      const result = await folderCommitService.compareFolderStates({
-        targetCommitId
-      });
-
-      // Assert
-      expect(mockFolderCommitDAL.findById).toHaveBeenCalledWith(targetCommitId, undefined);
-
-      // Verify we get resources marked as create
-      expect(result).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({
-            changeType: "create",
-            commitId: targetCommit.commitId
-          })
-        ])
-      );
-    });
-  });
-
-  describe("createFolderCheckpoint", () => {
-    it("should successfully create a checkpoint when force is true", async () => {
-      // Arrange
-      const folderCommitId = "commit-id";
-      const folderId = "folder-id";
-      const checkpointData = { id: "checkpoint-id", folderCommitId };
-
-      mockFolderDAL.findByParentId.mockResolvedValue([{ id: "subfolder-id" }]);
-      mockFolderVersionDAL.findLatestFolderVersions.mockResolvedValue({ "subfolder-id": { id: "folder-version-1" } });
-      mockSecretVersionV2BridgeDAL.findLatestVersionByFolderId.mockResolvedValue([{ id: "secret-version-1" }]);
-      mockFolderCheckpointDAL.create.mockResolvedValue(checkpointData);
-
-      // Act
-      const result = await folderCommitService.createFolderCheckpoint({
-        folderId,
-        folderCommitId,
-        force: true
-      });
-
-      // Assert
-      expect(mockFolderCheckpointDAL.create).toHaveBeenCalledWith({ folderCommitId }, undefined);
-      expect(mockFolderCheckpointResourcesDAL.insertMany).toHaveBeenCalled();
-      expect(result).toBe(folderCommitId);
-    });
-  });
-
-  describe("deepRollbackFolder", () => {
-    it("should throw NotFoundError when commit doesn't exist", async () => {
-      // Arrange
-      const targetCommitId = "non-existent-commit";
-      const envId = "env-id";
-      const actorId = "user-id";
-      const actorType = ActorType.USER;
-      const projectId = "project-id";
-
-      // Mock the transaction to properly handle the error
-      mockFolderCommitDAL.transaction.mockImplementation(async (callback) => {
-        return await callback({} as Knex);
-      });
-
-      // Mock findById to return null inside the transaction
-      mockFolderCommitDAL.findById.mockResolvedValue(null);
-
-      // Act & Assert
-      await expect(
-        folderCommitService.deepRollbackFolder(targetCommitId, envId, actorId, actorType, projectId)
-      ).rejects.toThrow(NotFoundError);
-    });
-  });
-
-  describe("createFolderTreeCheckpoint", () => {
-    it("should create a tree checkpoint when checkpoint window is exceeded", async () => {
-      // Arrange
-      const envId = "env-id";
-      const folderCommitId = "commit-id";
-      const latestCommit = { id: folderCommitId };
-      const latestTreeCheckpoint = { id: "tree-checkpoint-id", folderCommitId: "old-commit-id" };
-      const folders = [
-        { id: "folder-1", isReserved: false },
-        { id: "folder-2", isReserved: false },
-        { id: "folder-3", isReserved: true } // Reserved folders should be filtered out
-      ];
-      const folderCommits = [
-        { folderId: "folder-1", id: "commit-1" },
-        { folderId: "folder-2", id: "commit-2" }
-      ];
-      const treeCheckpoint = { id: "new-tree-checkpoint-id" };
-
-      mockFolderCommitDAL.findLatestEnvCommit.mockResolvedValue(latestCommit);
-      mockFolderTreeCheckpointDAL.findLatestByEnvId.mockResolvedValue(latestTreeCheckpoint);
-      mockFolderCommitDAL.getEnvNumberOfCommitsSince.mockResolvedValue(15); // More than PIT_TREE_CHECKPOINT_WINDOW (10)
-      mockFolderDAL.findByEnvId.mockResolvedValue(folders);
-      mockFolderCommitDAL.findMultipleLatestCommits.mockResolvedValue(folderCommits);
-      mockFolderTreeCheckpointDAL.create.mockResolvedValue(treeCheckpoint);
-
-      // Act
-      await folderCommitService.createFolderTreeCheckpoint(envId);
-
-      // Assert
-      expect(mockFolderCommitDAL.findLatestEnvCommit).toHaveBeenCalledWith(envId, undefined);
-      expect(mockFolderTreeCheckpointDAL.create).toHaveBeenCalledWith({ folderCommitId }, undefined);
-    });
-  });
-
-  describe("applyFolderStateDifferences", () => {
-    it("should process changes correctly", async () => {
-      // Arrange
-      const folderId = "folder-id";
-      const projectId = "project-id";
-      const actorId = "user-id";
-      const actorType = ActorType.USER;
-
-      const differences = [
-        {
-          id: "secret-1",
-          versionId: "v1",
-          changeType: ChangeType.CREATE,
-          commitId: BigInt(1)
-        } as ResourceChange,
-        {
-          id: "folder-1",
-          versionId: "v2",
-          changeType: ChangeType.UPDATE,
-          commitId: BigInt(1),
-          folderName: "Test Folder",
-          folderVersion: "v2"
-        } as ResourceChange
-      ];
-
-      const secretVersions = {
-        "secret-1": {
-          id: "secret-version-1",
-          createdAt: new Date(),
-          updatedAt: new Date(),
-          type: "shared",
-          folderId: "folder-1",
-          secretId: "secret-1",
-          version: 1,
-          key: "SECRET_KEY",
-          encryptedValue: Buffer.from("encrypted"),
-          encryptedComment: Buffer.from("comment"),
-          skipMultilineEncoding: false,
-          userId: "user-1",
-          envId: "env-1",
-          metadata: {}
-        } as TSecretVersionsV2
-      };
-
-      const folderVersions = {
-        "folder-1": {
-          folderId: "folder-1",
-          version: 1,
-          name: "Test Folder",
-          envId: "env-1"
-        } as TSecretFolderVersions
-      };
-
-      // Mock folder lookup for the folder being processed
-      mockFolderDAL.findById.mockImplementation((id) => {
-        if (id === folderId) {
-          return Promise.resolve({ id: folderId, envId: "env-1" });
-        }
-        return Promise.resolve(null);
-      });
-
-      // Mock latest commit lookup
-      mockFolderCommitDAL.findLatestCommit.mockImplementation((id) => {
-        if (id === folderId) {
-          return Promise.resolve({ id: "latest-commit-id", folderId });
-        }
-        return Promise.resolve(null);
-      });
-
-      // Make sure findByParentId returns an array, not undefined
-      mockFolderDAL.findByParentId.mockResolvedValue([]);
-
-      // Make sure other required functions return appropriate values
-      mockFolderCheckpointDAL.findLatestByFolderId.mockResolvedValue(null);
-      mockSecretVersionV2BridgeDAL.findLatestVersionByFolderId.mockResolvedValue([]);
-
-      // These mocks need to return objects with an id field
-      mockSecretVersionV2BridgeDAL.findByIdsWithLatestVersion.mockResolvedValue(Object.values(secretVersions));
-      mockFolderVersionDAL.findByIdsWithLatestVersion.mockResolvedValue(Object.values(folderVersions));
-      mockSecretV2BridgeDAL.insertMany.mockResolvedValue([{ id: "new-secret-1" }]);
-      mockSecretVersionV2BridgeDAL.create.mockResolvedValue({ id: "new-secret-version-1" });
-      mockFolderDAL.updateById.mockResolvedValue({ id: "updated-folder-1" });
-      mockFolderVersionDAL.create.mockResolvedValue({ id: "new-folder-version-1" });
-      mockFolderCommitDAL.create.mockResolvedValue({ id: "new-commit-id" });
-      mockSecretVersionV2BridgeDAL.findLatestVersionMany.mockResolvedValue([
-        {
-          id: "secret-version-1",
-          createdAt: new Date(),
-          updatedAt: new Date(),
-          type: "shared",
-          folderId: "folder-1",
-          secretId: "secret-1",
-          version: 1,
-          key: "SECRET_KEY",
-          encryptedValue: Buffer.from("encrypted"),
-          encryptedComment: Buffer.from("comment"),
-          skipMultilineEncoding: false,
-          userId: "user-1",
-          envId: "env-1",
-          metadata: {}
-        }
-      ]);
-
-      // Mock transaction
-      mockFolderCommitDAL.transaction.mockImplementation(<T>(callback: TransactionCallback<T>) => callback({} as Knex));
-
-      // Act
-      const result = await folderCommitService.applyFolderStateDifferences({
-        differences,
-        actorInfo: {
-          actorType,
-          actorId,
-          message: "Applying changes"
-        },
-        folderId,
-        projectId,
-        reconstructNewFolders: false
-      });
-
-      // Assert
-      expect(mockFolderCommitDAL.create).toHaveBeenCalled();
-      expect(mockSecretV2BridgeDAL.invalidateSecretCacheByProjectId).toHaveBeenCalledWith(projectId);
-
-      // Check that we got the right counts
-      expect(result.totalChanges).toEqual(2);
-    });
-  });
-});

backend/src/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal.ts

@@ -1,44 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName, TFolderTreeCheckpointResources } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderTreeCheckpointResourcesDALFactory = ReturnType<typeof folderTreeCheckpointResourcesDALFactory>;
-
-type TFolderTreeCheckpointResourcesWithCommitId = TFolderTreeCheckpointResources & {
-  commitId: bigint;
-};
-
-export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
-  const folderTreeCheckpointResourcesOrm = ormify(db, TableName.FolderTreeCheckpointResources);
-
-  const findByTreeCheckpointId = async (
-    folderTreeCheckpointId: string,
-    tx?: Knex
-  ): Promise<TFolderTreeCheckpointResourcesWithCommitId[]> => {
-    try {
-      const docs = await (tx || db.replicaNode())<TFolderTreeCheckpointResources>(
-        TableName.FolderTreeCheckpointResources
-      )
-        .join(
-          TableName.FolderCommit,
-          `${TableName.FolderTreeCheckpointResources}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderTreeCheckpointId }, TableName.FolderTreeCheckpointResources))
-        .select(selectAllTableCols(TableName.FolderTreeCheckpointResources))
-        .select(db.ref("commitId").withSchema(TableName.FolderCommit).as("commitId"));
-      return docs;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByTreeCheckpointId" });
-    }
-  };
-
-  return {
-    ...folderTreeCheckpointResourcesOrm,
-    findByTreeCheckpointId
-  };
-};

backend/src/services/folder-tree-checkpoint/folder-tree-checkpoint-dal.ts

@@ -1,79 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName, TFolderCommits, TFolderTreeCheckpoints } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
-
-export type TFolderTreeCheckpointDALFactory = ReturnType<typeof folderTreeCheckpointDALFactory>;
-
-type TreeCheckpointWithCommitInfo = TFolderTreeCheckpoints & {
-  commitId: bigint;
-};
-
-export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
-  const folderTreeCheckpointOrm = ormify(db, TableName.FolderTreeCheckpoint);
-
-  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderTreeCheckpoints | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())<TFolderTreeCheckpoints>(TableName.FolderTreeCheckpoint)
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ folderCommitId }, TableName.FolderTreeCheckpoint))
-        .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByCommitId" });
-    }
-  };
-
-  const findNearestCheckpoint = async (
-    folderCommitId: bigint,
-    envId: string,
-    tx?: Knex
-  ): Promise<TreeCheckpointWithCommitInfo | undefined> => {
-    try {
-      const nearestCheckpoint = await (tx || db.replicaNode())(TableName.FolderTreeCheckpoint)
-        .join<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderTreeCheckpoint}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(`${TableName.FolderCommit}.envId`, "=", envId)
-        .andWhere(`${TableName.FolderCommit}.commitId`, "<=", folderCommitId.toString())
-        .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
-        .select(db.ref("commitId").withSchema(TableName.FolderCommit))
-        .orderBy(`${TableName.FolderCommit}.commitId`, "desc")
-        .first();
-
-      return nearestCheckpoint;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindNearestCheckpoint" });
-    }
-  };
-
-  const findLatestByEnvId = async (envId: string, tx?: Knex): Promise<TFolderTreeCheckpoints | undefined> => {
-    try {
-      const doc = await (tx || db.replicaNode())<TFolderTreeCheckpoints>(TableName.FolderTreeCheckpoint)
-        .join<TFolderCommits>(
-          TableName.FolderCommit,
-          `${TableName.FolderTreeCheckpoint}.folderCommitId`,
-          `${TableName.FolderCommit}.id`
-        )
-        .where(`${TableName.FolderCommit}.envId`, "=", envId)
-        .orderBy(`${TableName.FolderTreeCheckpoint}.createdAt`, "desc")
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestByEnvId" });
-    }
-  };
-
-  return {
-    ...folderTreeCheckpointOrm,
-    findByCommitId,
-    findNearestCheckpoint,
-    findLatestByEnvId
-  };
-};

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -2,6 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 import axios, { AxiosError } from "axios";
 import https from "https";
 import jwt from "jsonwebtoken";
+import RE2 from "re2";
 
 import { IdentityAuthMethod, TIdentityKubernetesAuthsUpdate } from "@app/db/schemas";
 import { TGatewayDALFactory } from "@app/ee/services/gateway/gateway-dal";
@@ -185,7 +186,13 @@ export const identityKubernetesAuthServiceFactory = ({
       return res.data;
     };
 
-    const [k8sHost, k8sPort] = identityKubernetesAuth.kubernetesHost.split(":");
+    let { kubernetesHost } = identityKubernetesAuth;
+
+    if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) {
+      kubernetesHost = new RE2("^https?:\\/\\/").replace(kubernetesHost, "");
+    }
+
+    const [k8sHost, k8sPort] = kubernetesHost.split(":");
 
     const data = identityKubernetesAuth.gatewayId
       ? await $gatewayProxyWrapper(

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts

@@ -63,6 +63,18 @@ export type TCreateTokenReviewResponse = {
   status: TCreateTokenReviewSuccessResponse | TCreateTokenReviewErrorResponse;
 };
 
+export type TKubernetesTokenRequest = {
+  apiVersion: "authentication.k8s.io/v1";
+  kind: "TokenRequest";
+  spec: {
+    audiences: string[];
+    expirationSeconds: number;
+  };
+  status: {
+    token: string;
+  };
+};
+
 export type TRevokeKubernetesAuthDTO = {
   identityId: string;
 } & Omit<TProjectPermission, "projectId">;

backend/src/services/pki-subscriber/pki-subscriber-service.ts

@@ -137,6 +137,15 @@ export const pkiSubscriberServiceFactory = ({
       }
     }
 
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) {
+      throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
+    }
+
+    if (ca.projectId !== projectId) {
+      throw new BadRequestError({ message: "CA does not belong to the project" });
+    }
+
     const newSubscriber = await pkiSubscriberDAL.create({
       caId,
       projectId,
@@ -245,6 +254,17 @@ export const pkiSubscriberServiceFactory = ({
       }
     }
 
+    if (caId) {
+      const ca = await certificateAuthorityDAL.findById(caId);
+      if (!ca) {
+        throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
+      }
+
+      if (ca.projectId !== projectId) {
+        throw new BadRequestError({ message: "CA does not belong to the project" });
+      }
+    }
+
     const updatedSubscriber = await pkiSubscriberDAL.updateById(subscriber.id, {
       caId,
       name,

backend/src/services/pki-templates/pki-templates-dal.ts

@@ -0,0 +1,102 @@
+import { Knex } from "knex";
+import { Tables } from "knex/types/tables";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { buildFindFilter, ormify, selectAllTableCols, TFindFilter, TFindOpt, TFindReturn } from "@app/lib/knex";
+
+export type TPkiTemplatesDALFactory = ReturnType<typeof pkiTemplatesDALFactory>;
+
+export const pkiTemplatesDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.CertificateTemplate);
+
+  const findOne = async (
+    filter: Partial<Tables[TableName.CertificateTemplate]["base"] & { projectId: string }>,
+    tx?: Knex
+  ) => {
+    try {
+      const { projectId, ...templateFilters } = filter;
+      const res = await (tx || db.replicaNode())(TableName.CertificateTemplate)
+        .join(
+          TableName.CertificateAuthority,
+          `${TableName.CertificateAuthority}.id`,
+          `${TableName.CertificateTemplate}.caId`
+        )
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter(templateFilters, TableName.CertificateTemplate))
+        .where((qb) => {
+          if (projectId) {
+            // eslint-disable-next-line @typescript-eslint/no-misused-promises
+            void qb.where(buildFindFilter({ projectId }, TableName.CertificateAuthority));
+          }
+        })
+        .select(selectAllTableCols(TableName.CertificateTemplate))
+        .select(db.ref("name").withSchema(TableName.CertificateAuthority).as("caName"))
+        .select(db.ref("projectId").withSchema(TableName.CertificateAuthority))
+        .first();
+
+      if (!res) return undefined;
+
+      return { ...res, ca: { id: res.caId, name: res.caName } };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find one" });
+    }
+  };
+
+  const find = async <
+    TCount extends boolean = false,
+    TCountDistinct extends keyof Tables[TableName.CertificateTemplate]["base"] | undefined = undefined
+  >(
+    filter: TFindFilter<Tables[TableName.CertificateTemplate]["base"]> & { projectId: string },
+    {
+      offset,
+      limit,
+      sort,
+      count,
+      tx,
+      countDistinct
+    }: TFindOpt<Tables[TableName.CertificateTemplate]["base"], TCount, TCountDistinct> = {}
+  ) => {
+    try {
+      const { projectId, ...templateFilters } = filter;
+
+      const query = (tx || db.replicaNode())(TableName.CertificateTemplate)
+        .join(
+          TableName.CertificateAuthority,
+          `${TableName.CertificateAuthority}.id`,
+          `${TableName.CertificateTemplate}.caId`
+        )
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter(templateFilters, TableName.CertificateTemplate))
+        .where((qb) => {
+          if (projectId) {
+            // eslint-disable-next-line @typescript-eslint/no-misused-promises
+            void qb.where(buildFindFilter({ projectId }, TableName.CertificateAuthority));
+          }
+        })
+        .select(selectAllTableCols(TableName.CertificateTemplate))
+        .select(db.ref("projectId").withSchema(TableName.CertificateAuthority))
+        .select(db.ref("name").withSchema(TableName.CertificateAuthority).as("caName"));
+
+      if (countDistinct) {
+        void query.countDistinct(countDistinct);
+      } else if (count) {
+        void query.select(db.raw("COUNT(*) OVER() AS count"));
+      }
+
+      if (limit) void query.limit(limit);
+      if (offset) void query.offset(offset);
+      if (sort) {
+        void query.orderBy(sort.map(([column, order, nulls]) => ({ column: column as string, order, nulls })));
+      }
+
+      const res = (await query) as TFindReturn<typeof query, TCountDistinct extends undefined ? TCount : true>;
+      return res.map((el) => ({ ...el, ca: { id: el.caId, name: el.caName } }));
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find one" });
+    }
+  };
+
+  return { ...orm, find, findOne };
+};

backend/src/services/pki-templates/pki-templates-service.ts

@@ -0,0 +1,644 @@
+/* eslint-disable no-bitwise */
+import { ForbiddenError, subject } from "@casl/ability";
+import * as x509 from "@peculiar/x509";
+import RE2 from "re2";
+
+import { ActionProjectType } from "@app/db/schemas";
+import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import {
+  ProjectPermissionPkiTemplateActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
+import { getConfig } from "@app/lib/config/env";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { ms } from "@app/lib/ms";
+
+import { TCertificateBodyDALFactory } from "../certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "../certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-dal";
+import {
+  CertExtendedKeyUsage,
+  CertExtendedKeyUsageOIDToName,
+  CertKeyAlgorithm,
+  CertKeyUsage,
+  CertStatus
+} from "../certificate/certificate-types";
+import { TCertificateAuthorityCertDALFactory } from "../certificate-authority/certificate-authority-cert-dal";
+import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
+import { CaStatus } from "../certificate-authority/certificate-authority-enums";
+import {
+  createSerialNumber,
+  expandInternalCa,
+  getCaCertChain,
+  getCaCredentials,
+  keyAlgorithmToAlgCfg,
+  parseDistinguishedName
+} from "../certificate-authority/certificate-authority-fns";
+import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority/certificate-authority-secret-dal";
+import { InternalCertificateAuthorityFns } from "../certificate-authority/internal/internal-certificate-authority-fns";
+import { TKmsServiceFactory } from "../kms/kms-service";
+import { TProjectDALFactory } from "../project/project-dal";
+import { getProjectKmsCertificateKeyId } from "../project/project-fns";
+import { TPkiTemplatesDALFactory } from "./pki-templates-dal";
+import {
+  TCreatePkiTemplateDTO,
+  TDeletePkiTemplateDTO,
+  TGetPkiTemplateDTO,
+  TIssueCertPkiTemplateDTO,
+  TListPkiTemplateDTO,
+  TSignCertPkiTemplateDTO,
+  TUpdatePkiTemplateDTO
+} from "./pki-templates-types";
+
+type TPkiTemplatesServiceFactoryDep = {
+  pkiTemplatesDAL: TPkiTemplatesDALFactory;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  certificateAuthorityDAL: Pick<
+    TCertificateAuthorityDALFactory,
+    | "findByIdWithAssociatedCa"
+    | "findById"
+    | "transaction"
+    | "create"
+    | "updateById"
+    | "findWithAssociatedCa"
+    | "findOne"
+  >;
+  internalCaFns: ReturnType<typeof InternalCertificateAuthorityFns>;
+  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "decryptWithKmsKey" | "encryptWithKmsKey">;
+  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
+  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
+  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "findOne">;
+  certificateDAL: Pick<
+    TCertificateDALFactory,
+    "create" | "transaction" | "countCertificatesForPkiSubscriber" | "findLatestActiveCertForSubscriber" | "find"
+  >;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create" | "findOne">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create" | "findOne">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction" | "findById" | "find">;
+};
+
+export type TPkiTemplatesServiceFactory = ReturnType<typeof pkiTemplatesServiceFactory>;
+
+export const pkiTemplatesServiceFactory = ({
+  pkiTemplatesDAL,
+  permissionService,
+  internalCaFns,
+  certificateAuthorityDAL,
+  certificateAuthorityCertDAL,
+  certificateAuthoritySecretDAL,
+  certificateAuthorityCrlDAL,
+  certificateDAL,
+  certificateBodyDAL,
+  kmsService,
+  projectDAL
+}: TPkiTemplatesServiceFactoryDep) => {
+  const createTemplate = async ({
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    caName,
+    commonName,
+    extendedKeyUsages,
+    keyUsages,
+    name,
+    subjectAlternativeName,
+    ttl,
+    projectId
+  }: TCreatePkiTemplateDTO) => {
+    const ca = await certificateAuthorityDAL.findOne({ name: caName, projectId });
+    if (!ca) {
+      throw new NotFoundError({
+        message: `CA with name ${caName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: ca.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.Create,
+      subject(ProjectPermissionSub.CertificateTemplates, { name })
+    );
+
+    const existingTemplate = await pkiTemplatesDAL.findOne({ name, projectId: ca.projectId });
+    if (existingTemplate) {
+      throw new BadRequestError({ message: `Template with name ${name} already exists.` });
+    }
+
+    const newTemplate = await pkiTemplatesDAL.create({
+      caId: ca.id,
+      name,
+      commonName,
+      subjectAlternativeName,
+      ttl,
+      keyUsages,
+      extendedKeyUsages
+    });
+    return newTemplate;
+  };
+
+  const updateTemplate = async ({
+    templateName,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    caName,
+    commonName,
+    extendedKeyUsages,
+    keyUsages,
+    name,
+    subjectAlternativeName,
+    ttl,
+    projectId
+  }: TUpdatePkiTemplateDTO) => {
+    const certTemplate = await pkiTemplatesDAL.findOne({ name: templateName, projectId });
+    if (!certTemplate) {
+      throw new NotFoundError({
+        message: `Certificate template with name ${templateName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certTemplate.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.Edit,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: templateName })
+    );
+
+    let caId;
+    if (caName) {
+      const ca = await certificateAuthorityDAL.findOne({ name: caName, projectId });
+      if (!ca || ca.projectId !== certTemplate.projectId) {
+        throw new NotFoundError({
+          message: `CA with name ${caName} not found`
+        });
+      }
+      caId = ca.id;
+    }
+
+    if (name) {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionPkiTemplateActions.Edit,
+        subject(ProjectPermissionSub.CertificateTemplates, { name })
+      );
+
+      const existingTemplate = await pkiTemplatesDAL.findOne({ name, projectId });
+      if (existingTemplate && existingTemplate.id !== certTemplate.id) {
+        throw new BadRequestError({ message: `Template with name ${name} already exists.` });
+      }
+    }
+
+    const updatedTemplate = await pkiTemplatesDAL.updateById(certTemplate.id, {
+      caId,
+      name,
+      commonName,
+      subjectAlternativeName,
+      ttl,
+      keyUsages,
+      extendedKeyUsages
+    });
+    return updatedTemplate;
+  };
+
+  const deleteTemplate = async ({
+    templateName,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    projectId
+  }: TDeletePkiTemplateDTO) => {
+    const certTemplate = await pkiTemplatesDAL.findOne({ name: templateName, projectId });
+    if (!certTemplate) {
+      throw new NotFoundError({
+        message: `Certificate template with name ${templateName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certTemplate.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.Delete,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: templateName })
+    );
+
+    const deletedTemplate = await pkiTemplatesDAL.deleteById(certTemplate.id);
+    return deletedTemplate;
+  };
+
+  const getTemplateByName = async ({
+    templateName,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    projectId
+  }: TGetPkiTemplateDTO) => {
+    const certTemplate = await pkiTemplatesDAL.findOne({ name: templateName, projectId });
+    if (!certTemplate) {
+      throw new NotFoundError({
+        message: `Certificate template with name ${templateName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certTemplate.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.Read,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: templateName })
+    );
+
+    return certTemplate;
+  };
+
+  const listTemplate = async ({
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    projectId,
+    limit,
+    offset
+  }: TListPkiTemplateDTO) => {
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    const certTemplate = await pkiTemplatesDAL.find({ projectId }, { limit, offset, count: true });
+    return {
+      certificateTemplates: certTemplate.filter((el) =>
+        permission.can(
+          ProjectPermissionPkiTemplateActions.Read,
+          subject(ProjectPermissionSub.CertificateTemplates, { name: el.name })
+        )
+      ),
+      totalCount: Number(certTemplate?.[0]?.count ?? 0)
+    };
+  };
+
+  const issueCertificate = async ({
+    templateName,
+    projectId,
+    commonName,
+    altNames,
+    ttl,
+    notBefore,
+    notAfter,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId,
+    keyUsages,
+    extendedKeyUsages
+  }: TIssueCertPkiTemplateDTO) => {
+    const certTemplate = await pkiTemplatesDAL.findOne({ name: templateName, projectId });
+    if (!certTemplate) {
+      throw new NotFoundError({
+        message: `Certificate template with name ${templateName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certTemplate.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.IssueCert,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: templateName })
+    );
+
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
+    if (ca.internalCa?.id) {
+      return internalCaFns.issueCertificateWithTemplate(ca, certTemplate, {
+        altNames,
+        commonName,
+        ttl,
+        extendedKeyUsages,
+        keyUsages,
+        notAfter,
+        notBefore
+      });
+    }
+
+    throw new BadRequestError({ message: "CA does not support immediate issuance of certificates" });
+  };
+
+  const signCertificate = async ({
+    templateName,
+    csr,
+    projectId,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId,
+    ttl
+  }: TSignCertPkiTemplateDTO) => {
+    const certTemplate = await pkiTemplatesDAL.findOne({ name: templateName, projectId });
+    if (!certTemplate) {
+      throw new NotFoundError({
+        message: `Certificate template with name ${templateName} not found`
+      });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certTemplate.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiTemplateActions.IssueCert,
+      subject(ProjectPermissionSub.CertificateTemplates, { name: templateName })
+    );
+
+    const appCfg = getConfig();
+
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
+    if (!ca?.internalCa) throw new NotFoundError({ message: `CA with ID '${certTemplate.caId}' not found` });
+
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
+    if (!ca.internalCa?.activeCaCertId)
+      throw new BadRequestError({ message: "CA does not have a certificate installed" });
+
+    const caCert = await certificateAuthorityCertDAL.findById(ca.internalCa.activeCaCertId);
+
+    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+      projectId: ca.projectId,
+      projectDAL,
+      kmsService
+    });
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: certificateManagerKmsId
+    });
+
+    const decryptedCaCert = await kmsDecryptor({
+      cipherTextBlob: caCert.encryptedCertificate
+    });
+
+    const caCertObj = new x509.X509Certificate(decryptedCaCert);
+    const notBeforeDate = new Date();
+    const notAfterDate = new Date(new Date().getTime() + ms(ttl ?? "0"));
+    const caCertNotBeforeDate = new Date(caCertObj.notBefore);
+    const caCertNotAfterDate = new Date(caCertObj.notAfter);
+
+    // check not before constraint
+    if (notBeforeDate < caCertNotBeforeDate) {
+      throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" });
+    }
+
+    // check not after constraint
+    if (notAfterDate > caCertNotAfterDate) {
+      throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
+    }
+
+    const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+
+    const csrObj = new x509.Pkcs10CertificateRequest(csr);
+    const dn = parseDistinguishedName(csrObj.subject);
+    const cn = dn.commonName;
+    if (!cn)
+      throw new BadRequestError({
+        message: "Missing common name on CSR"
+      });
+
+    const commonNameRegex = new RE2(certTemplate.commonName);
+    if (!commonNameRegex.test(cn)) {
+      throw new BadRequestError({
+        message: "Invalid common name based on template policy"
+      });
+    }
+
+    if (ms(ttl) > ms(certTemplate.ttl)) {
+      throw new BadRequestError({
+        message: "Invalid validity date based on template policy"
+      });
+    }
+
+    const { caPrivateKey, caSecret } = await getCaCredentials({
+      caId: ca.id,
+      certificateAuthorityDAL,
+      certificateAuthoritySecretDAL,
+      projectDAL,
+      kmsService
+    });
+
+    const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });
+    const distributionPointUrl = `${appCfg.SITE_URL}/api/v1/pki/crl/${caCrl.id}/der`;
+    const caIssuerUrl = `${appCfg.SITE_URL}/api/v1/pki/ca/${ca.id}/certificates/${caCert.id}/der`;
+
+    const extensions: x509.Extension[] = [
+      new x509.BasicConstraintsExtension(false),
+      await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false),
+      await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey),
+      new x509.CRLDistributionPointsExtension([distributionPointUrl]),
+      new x509.AuthorityInfoAccessExtension({
+        caIssuers: new x509.GeneralName("url", caIssuerUrl)
+      }),
+      new x509.CertificatePolicyExtension(["2.5.29.32.0"]) // anyPolicy
+    ];
+
+    // handle key usages
+    const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension | undefined; // Better to type as optional
+    let selectedKeyUsages: CertKeyUsage[] = [];
+    if (csrKeyUsageExtension && csrKeyUsageExtension.usages) {
+      selectedKeyUsages = Object.values(CertKeyUsage).filter(
+        (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
+      );
+      const validKeyUsages = certTemplate.keyUsages || [];
+      if (selectedKeyUsages.some((keyUsage) => !validKeyUsages.includes(keyUsage))) {
+        throw new BadRequestError({
+          message: "Invalid key usage value based on template policy"
+        });
+      }
+
+      const keyUsagesBitValue = selectedKeyUsages.reduce((accum, keyUsage) => accum | x509.KeyUsageFlags[keyUsage], 0);
+      if (keyUsagesBitValue) {
+        extensions.push(new x509.KeyUsagesExtension(keyUsagesBitValue, true));
+      }
+    }
+
+    // handle extended key usage
+    const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension | undefined;
+    let selectedExtendedKeyUsages: CertExtendedKeyUsage[] = [];
+    if (csrExtendedKeyUsageExtension && csrExtendedKeyUsageExtension.usages.length > 0) {
+      selectedExtendedKeyUsages = csrExtendedKeyUsageExtension.usages.map(
+        (ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string]
+      );
+
+      if (selectedExtendedKeyUsages.some((eku) => !certTemplate?.extendedKeyUsages?.includes(eku))) {
+        throw new BadRequestError({
+          message: "Invalid extended key usage value based on subscriber's specified extended key usages"
+        });
+      }
+
+      if (selectedExtendedKeyUsages.length) {
+        extensions.push(
+          new x509.ExtendedKeyUsageExtension(
+            selectedExtendedKeyUsages.map((eku) => x509.ExtendedKeyUsage[eku]),
+            true
+          )
+        );
+      }
+    }
+
+    // attempt to read from CSR if altNames is not explicitly provided
+    let altNamesArray: {
+      type: "email" | "dns";
+      value: string;
+    }[] = [];
+
+    const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
+    if (sanExtension) {
+      const sanNames = new x509.GeneralNames(sanExtension.value);
+
+      altNamesArray = sanNames.items
+        .filter((value) => value.type === "email" || value.type === "dns")
+        .map((name) => ({
+          type: name.type as "email" | "dns",
+          value: name.value
+        }));
+    }
+
+    if (altNamesArray.length) {
+      const altNamesExtension = new x509.SubjectAlternativeNameExtension(altNamesArray, false);
+      extensions.push(altNamesExtension);
+    }
+
+    const subjectAlternativeNameRegex = new RE2(certTemplate.subjectAlternativeName);
+    altNamesArray.forEach((altName) => {
+      if (!subjectAlternativeNameRegex.test(altName.value)) {
+        throw new BadRequestError({
+          message: "Invalid subject alternative name based on template policy"
+        });
+      }
+    });
+
+    const serialNumber = createSerialNumber();
+    const leafCert = await x509.X509CertificateGenerator.create({
+      serialNumber,
+      subject: csrObj.subject,
+      issuer: caCertObj.subject,
+      notBefore: notBeforeDate,
+      notAfter: notAfterDate,
+      signingKey: caPrivateKey,
+      publicKey: csrObj.publicKey,
+      signingAlgorithm: alg,
+      extensions
+    });
+
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({
+      kmsId: certificateManagerKmsId
+    });
+    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+      plainText: Buffer.from(new Uint8Array(leafCert.rawData))
+    });
+
+    const { caCert: issuingCaCertificate, caCertChain } = await getCaCertChain({
+      caCertId: ca.internalCa.activeCaCertId,
+      certificateAuthorityDAL,
+      certificateAuthorityCertDAL,
+      projectDAL,
+      kmsService
+    });
+
+    const certificateChainPem = `${issuingCaCertificate}\n${caCertChain}`.trim();
+
+    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+      plainText: Buffer.from(certificateChainPem)
+    });
+
+    await certificateDAL.transaction(async (tx) => {
+      const cert = await certificateDAL.create(
+        {
+          caId: ca.id,
+          caCertId: caCert.id,
+          status: CertStatus.ACTIVE,
+          friendlyName: cn,
+          commonName: cn,
+          altNames: altNamesArray.map((el) => el.value).join(","),
+          serialNumber,
+          notBefore: notBeforeDate,
+          notAfter: notAfterDate,
+          keyUsages: selectedKeyUsages,
+          extendedKeyUsages: selectedExtendedKeyUsages,
+          projectId
+        },
+        tx
+      );
+
+      await certificateBodyDAL.create(
+        {
+          certId: cert.id,
+          encryptedCertificate,
+          encryptedCertificateChain
+        },
+        tx
+      );
+
+      return cert;
+    });
+
+    return {
+      certificate: leafCert.toString("pem"),
+      certificateChain: `${issuingCaCertificate}\n${caCertChain}`.trim(),
+      issuingCaCertificate,
+      serialNumber,
+      ca: expandInternalCa(ca),
+      commonName: cn,
+      template: certTemplate
+    };
+  };
+
+  return {
+    createTemplate,
+    updateTemplate,
+    getTemplateByName,
+    listTemplate,
+    deleteTemplate,
+    signCertificate,
+    issueCertificate
+  };
+};

backend/src/services/pki-templates/pki-templates-types.ts

@@ -0,0 +1,53 @@
+import { TProjectPermission } from "@app/lib/types";
+import { CertExtendedKeyUsage, CertKeyUsage } from "@app/services/certificate/certificate-types";
+
+export type TCreatePkiTemplateDTO = {
+  caName: string;
+  name: string;
+  commonName: string;
+  subjectAlternativeName: string;
+  ttl: string;
+  keyUsages: CertKeyUsage[];
+  extendedKeyUsages: CertExtendedKeyUsage[];
+} & TProjectPermission;
+
+export type TUpdatePkiTemplateDTO = {
+  templateName: string;
+  caName?: string;
+  name?: string;
+  commonName?: string;
+  subjectAlternativeName?: string;
+  ttl?: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+} & TProjectPermission;
+
+export type TListPkiTemplateDTO = {
+  limit?: number;
+  offset?: number;
+} & TProjectPermission;
+
+export type TGetPkiTemplateDTO = {
+  templateName: string;
+} & TProjectPermission;
+
+export type TDeletePkiTemplateDTO = {
+  templateName: string;
+} & TProjectPermission;
+
+export type TIssueCertPkiTemplateDTO = {
+  templateName: string;
+  commonName: string;
+  altNames: string;
+  ttl: string;
+  notBefore?: string;
+  notAfter?: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+} & TProjectPermission;
+
+export type TSignCertPkiTemplateDTO = {
+  templateName: string;
+  csr: string;
+  ttl: string;
+} & TProjectPermission;

backend/src/services/project/project-dal.ts

@@ -12,7 +12,7 @@ import {
   TProjectsUpdate
 } from "@app/db/schemas";
 import { BadRequestError, DatabaseError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
+import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 import { ActorType } from "../auth/auth-type";
 import { Filter, ProjectFilterType, SearchProjectSortBy } from "./project-types";
@@ -425,16 +425,6 @@ export const projectDALFactory = (db: TDbClient) => {
     return { docs, totalCount: Number(docs?.[0]?.count ?? 0) };
   };
 
-  const findProjectByEnvId = async (envId: string, tx?: Knex) => {
-    const project = await (tx || db.replicaNode())(TableName.Project)
-      .leftJoin(TableName.Environment, `${TableName.Environment}.projectId`, `${TableName.Project}.id`)
-      // eslint-disable-next-line @typescript-eslint/no-misused-promises
-      .where(buildFindFilter({ id: envId }, TableName.Environment))
-      .select(selectAllTableCols(TableName.Project))
-      .first();
-    return project;
-  };
-
   const countOfOrgProjects = async (orgId: string | null, tx?: Knex) => {
     try {
       const doc = await (tx || db.replicaNode())(TableName.Project)
@@ -463,7 +453,6 @@ export const projectDALFactory = (db: TDbClient) => {
     checkProjectUpgradeStatus,
     getProjectFromSplitId,
     searchProjects,
-    findProjectByEnvId,
     countOfOrgProjects
   };
 };

backend/src/services/project/project-service.ts

@@ -17,6 +17,7 @@ import {
   ProjectPermissionActions,
   ProjectPermissionCertificateActions,
   ProjectPermissionPkiSubscriberActions,
+  ProjectPermissionPkiTemplateActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSshHostActions,
   ProjectPermissionSub
@@ -1131,15 +1132,15 @@ export const projectServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      ProjectPermissionSub.CertificateTemplates
-    );
-
     const certificateTemplates = await certificateTemplateDAL.getCertTemplatesByProjectId(projectId);
 
     return {
-      certificateTemplates
+      certificateTemplates: certificateTemplates.filter((el) =>
+        permission.can(
+          ProjectPermissionPkiTemplateActions.Read,
+          subject(ProjectPermissionSub.CertificateTemplates, { name: el.name })
+        )
+      )
     };
   };
 

backend/src/services/secret-folder/secret-folder-dal.ts

@@ -488,75 +488,6 @@ export const secretFolderDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findFoldersByRootAndIds = async ({ rootId, folderIds }: { rootId: string; folderIds: string[] }, tx?: Knex) => {
-    try {
-      // First, get all descendant folders of rootId
-      const descendants = await (tx || db.replicaNode())
-        .withRecursive("descendants", (qb) =>
-          qb
-            .select(
-              selectAllTableCols(TableName.SecretFolder),
-              db.raw("0 as depth"),
-              db.raw(`'/' as path`),
-              db.ref(`${TableName.Environment}.slug`).as("environment")
-            )
-            .from(TableName.SecretFolder)
-            .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
-            .where(`${TableName.SecretFolder}.id`, rootId)
-            .union((un) => {
-              void un
-                .select(
-                  selectAllTableCols(TableName.SecretFolder),
-                  db.raw("descendants.depth + 1 as depth"),
-                  db.raw(
-                    `CONCAT(
-                      CASE WHEN descendants.path = '/' THEN '' ELSE descendants.path END,
-                      CASE WHEN ${TableName.SecretFolder}."parentId" is NULL THEN '' ELSE CONCAT('/', secret_folders.name) END
-                    )`
-                  ),
-                  db.ref("descendants.environment")
-                )
-                .from(TableName.SecretFolder)
-                .where(`${TableName.SecretFolder}.isReserved`, false)
-                .join("descendants", `${TableName.SecretFolder}.parentId`, "descendants.id");
-            })
-        )
-        .select<(TSecretFolders & { path: string; depth: number; environment: string })[]>("*")
-        .from("descendants")
-        .whereIn(`id`, folderIds)
-        .orderBy("depth")
-        .orderBy(`name`);
-
-      return descendants;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindFoldersByRootAndIds" });
-    }
-  };
-
-  const findByParentId = async (parentId: string, tx?: Knex) => {
-    try {
-      const folders = await (tx || db.replicaNode())(TableName.SecretFolder)
-        .where({ parentId })
-        .andWhere({ isReserved: false })
-        .select(selectAllTableCols(TableName.SecretFolder));
-      return folders;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "findByParentId" });
-    }
-  };
-
-  const findByEnvId = async (envId: string, tx?: Knex) => {
-    try {
-      const folders = await (tx || db.replicaNode())(TableName.SecretFolder)
-        .where({ envId })
-        .andWhere({ isReserved: false })
-        .select(selectAllTableCols(TableName.SecretFolder));
-      return folders;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "findByEnvId" });
-    }
-  };
-
   return {
     ...secretFolderOrm,
     update,
@@ -568,9 +499,6 @@ export const secretFolderDALFactory = (db: TDbClient) => {
     findClosestFolder,
     findByProjectId,
     findByMultiEnv,
-    findByEnvsDeep,
-    findByParentId,
-    findByEnvId,
-    findFoldersByRootAndIds
+    findByEnvsDeep
   };
 };

backend/src/services/secret-folder/secret-folder-service.ts

@@ -10,7 +10,6 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
 import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 
-import { ChangeType, CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
@@ -30,8 +29,7 @@ type TSecretFolderServiceFactoryDep = {
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   folderDAL: TSecretFolderDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs" | "find">;
-  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestFolderVersions" | "create" | "insertMany" | "find">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
+  folderVersionDAL: TSecretFolderVersionDALFactory;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
 };
 
@@ -43,7 +41,6 @@ export const secretFolderServiceFactory = ({
   permissionService,
   projectEnvDAL,
   folderVersionDAL,
-  folderCommitService,
   projectDAL
 }: TSecretFolderServiceFactoryDep) => {
   const createFolder = async ({
@@ -114,33 +111,15 @@ export const secretFolderServiceFactory = ({
           });
           parentFolderId = newFolders.at(-1)?.id as string;
           const docs = await folderDAL.insertMany(newFolders, tx);
-          const folderVersions = await folderVersionDAL.insertMany(
+          await folderVersionDAL.insertMany(
             docs.map((doc) => ({
               name: doc.name,
               envId: doc.envId,
               version: doc.version,
-              folderId: doc.id,
-              description: doc.description
+              folderId: doc.id
             })),
             tx
           );
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: actor,
-                metadata: {
-                  id: actorId
-                }
-              },
-              message: "Folder created",
-              folderId: parentFolderId,
-              changes: folderVersions.map((fv) => ({
-                type: CommitType.ADD,
-                folderVersionId: fv.id
-              }))
-            },
-            tx
-          );
         }
       }
 
@@ -148,32 +127,12 @@ export const secretFolderServiceFactory = ({
         { name, envId: env.id, version: 1, parentId: parentFolderId, description },
         tx
       );
-      const folderVersion = await folderVersionDAL.create(
+      await folderVersionDAL.create(
         {
           name: doc.name,
           envId: doc.envId,
           version: doc.version,
-          folderId: doc.id,
-          description: doc.description
-        },
-        tx
-      );
-      await folderCommitService.createCommit(
-        {
-          actor: {
-            type: actor,
-            metadata: {
-              id: actorId
-            }
-          },
-          message: "Folder created",
-          folderId: parentFolderId,
-          changes: [
-            {
-              type: CommitType.ADD,
-              folderVersionId: folderVersion.id
-            }
-          ]
+          folderId: doc.id
         },
         tx
       );
@@ -266,33 +225,12 @@ export const secretFolderServiceFactory = ({
             { name, description },
             tx
           );
-          const folderVersion = await folderVersionDAL.create(
+          await folderVersionDAL.create(
             {
               name: doc.name,
               envId: doc.envId,
               version: doc.version,
-              folderId: doc.id,
-              description: doc.description
-            },
-            tx
-          );
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: actor,
-                metadata: {
-                  id: actorId
-                }
-              },
-              message: "Folder updated",
-              folderId: parentFolder.id,
-              changes: [
-                {
-                  type: CommitType.ADD,
-                  isUpdate: true,
-                  folderVersionId: folderVersion.id
-                }
-              ]
+              folderId: doc.id
             },
             tx
           );
@@ -383,33 +321,12 @@ export const secretFolderServiceFactory = ({
         { name, description },
         tx
       );
-      const folderVersion = await folderVersionDAL.create(
+      await folderVersionDAL.create(
         {
           name: doc.name,
           envId: doc.envId,
           version: doc.version,
-          folderId: doc.id,
-          description: doc.description
-        },
-        tx
-      );
-      await folderCommitService.createCommit(
-        {
-          actor: {
-            type: actor,
-            metadata: {
-              id: actorId
-            }
-          },
-          message: "Folder updated",
-          folderId: parentFolder.id,
-          changes: [
-            {
-              type: CommitType.ADD,
-              isUpdate: true,
-              folderVersionId: folderVersion.id
-            }
-          ]
+          folderId: doc.id
         },
         tx
       );
@@ -464,31 +381,7 @@ export const secretFolderServiceFactory = ({
         },
         tx
       );
-
       if (!doc) throw new NotFoundError({ message: `Failed to delete folder with ID '${idOrName}', not found` });
-
-      const folderVersions = await folderVersionDAL.findLatestFolderVersions([doc.id], tx);
-
-      await folderCommitService.createCommit(
-        {
-          actor: {
-            type: actor,
-            metadata: {
-              id: actorId
-            }
-          },
-          message: "Folder deleted",
-          folderId: parentFolder.id,
-          changes: [
-            {
-              type: CommitType.DELETE,
-              folderVersionId: folderVersions[doc.id].id,
-              folderId: doc.id
-            }
-          ]
-        },
-        tx
-      );
       return doc;
     });
 
@@ -772,45 +665,6 @@ export const secretFolderServiceFactory = ({
     return environmentFolders;
   };
 
-  const getFolderVersionsByIds = async ({
-    folderId,
-    folderVersions
-  }: {
-    folderId: string;
-    folderVersions: string[];
-  }) => {
-    const versions = await folderVersionDAL.find({
-      folderId,
-      $in: {
-        version: folderVersions.map((v) => Number.parseInt(v, 10))
-      }
-    });
-    return versions;
-  };
-
-  const getFolderVersions = async (
-    change: {
-      folderVersion?: string;
-      isUpdate?: boolean;
-      changeType?: string;
-    },
-    fromVersion: string,
-    folderId: string
-  ) => {
-    const currentVersion = change.folderVersion || "1";
-    // eslint-disable-next-line no-await-in-loop
-    const versions = await getFolderVersionsByIds({
-      folderId,
-      folderVersions:
-        change.isUpdate || change.changeType === ChangeType.UPDATE ? [currentVersion, fromVersion] : [currentVersion]
-    });
-    return versions.map((v) => ({
-      version: v.version?.toString() || "1",
-      name: v.name,
-      description: v.description
-    }));
-  };
-
   return {
     createFolder,
     updateFolder,
@@ -821,8 +675,6 @@ export const secretFolderServiceFactory = ({
     getProjectFolderCount,
     getFoldersMultiEnv,
     getFoldersDeepByEnvs,
-    getProjectEnvironmentsFolders,
-    getFolderVersionsByIds,
-    getFolderVersions
+    getProjectEnvironmentsFolders
   };
 };

backend/src/services/secret-folder/secret-folder-version-dal.ts

@@ -43,7 +43,7 @@ export const secretFolderVersionDALFactory = (db: TDbClient) => {
       const docs: Array<TSecretFolderVersions & { max: number }> = await (tx || db.replicaNode())(
         TableName.SecretFolderVersion
       )
-        .whereIn(`${TableName.SecretFolderVersion}.folderId`, folderIds)
+        .whereIn("folderId", folderIds)
         .join(
           (tx || db)(TableName.SecretFolderVersion)
             .groupBy("folderId")
@@ -85,8 +85,6 @@ export const secretFolderVersionDALFactory = (db: TDbClient) => {
         .join(TableName.Project, `${TableName.Project}.id`, `${TableName.Environment}.projectId`)
         .join("folder_cte", "folder_cte.id", `${TableName.SecretFolderVersion}.id`)
         .whereRaw(`folder_cte.row_num > ${TableName.Project}."pitVersionLimit"`)
-        // Projects with version >= 3 will require to have all folder versions for PIT
-        .andWhere(`${TableName.Project}.version`, "<", 3)
         .delete();
     } catch (error) {
       throw new DatabaseError({
@@ -97,107 +95,5 @@ export const secretFolderVersionDALFactory = (db: TDbClient) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning secret folder versions completed`);
   };
 
-  // Get latest versions by folderIds
-  const getLatestFolderVersions = async (folderIds: string[], tx?: Knex): Promise<Array<TSecretFolderVersions>> => {
-    if (!folderIds.length) return [];
-
-    const knexInstance = tx || db.replicaNode();
-    return knexInstance(TableName.SecretFolderVersion)
-      .whereIn(`${TableName.SecretFolderVersion}.folderId`, folderIds)
-      .join(
-        knexInstance(TableName.SecretFolderVersion)
-          .groupBy("folderId")
-          .max("version")
-          .select("folderId")
-          .as("latestVersion"),
-        (bd) => {
-          bd.on(`${TableName.SecretFolderVersion}.folderId`, "latestVersion.folderId").andOn(
-            `${TableName.SecretFolderVersion}.version`,
-            "latestVersion.max"
-          );
-        }
-      );
-  };
-
-  // Get specific versions and update with max version
-  const getSpecificFolderVersionsWithLatest = async (
-    versionIds: string[],
-    tx?: Knex
-  ): Promise<Array<TSecretFolderVersions>> => {
-    if (!versionIds.length) return [];
-
-    const knexInstance = tx || db.replicaNode();
-
-    // Get specific versions
-    const specificVersions = await knexInstance(TableName.SecretFolderVersion).whereIn("id", versionIds);
-
-    // Get folderIds from these versions
-    const specificFolderIds = [...new Set(specificVersions.map((v) => v.folderId).filter(Boolean))];
-
-    if (!specificFolderIds.length) return specificVersions;
-
-    // Get max versions for these folderIds
-    const maxVersionsQuery = await knexInstance(TableName.SecretFolderVersion)
-      .whereIn("folderId", specificFolderIds)
-      .groupBy("folderId")
-      .select("folderId")
-      .max("version", { as: "maxVersion" });
-
-    // Create lookup map for max versions
-    const maxVersionMap = maxVersionsQuery.reduce<Record<string, number>>((acc, item) => {
-      if (item.maxVersion) {
-        acc[item.folderId] = item.maxVersion;
-      }
-      return acc;
-    }, {});
-
-    // Replace version with max version
-    return specificVersions.map((version) => ({
-      ...version,
-      version: maxVersionMap[version.folderId] || version.version
-    }));
-  };
-
-  const findByIdsWithLatestVersion = async (folderIds: string[], versionIds?: string[], tx?: Knex) => {
-    try {
-      if (!folderIds.length && (!versionIds || !versionIds.length)) return {};
-
-      // Run both queries in parallel
-      const [latestVersions, specificVersionsWithLatest] = await Promise.all([
-        folderIds.length ? getLatestFolderVersions(folderIds, tx) : [],
-        versionIds?.length ? getSpecificFolderVersionsWithLatest(versionIds, tx) : []
-      ]);
-
-      const allDocs = [...latestVersions, ...specificVersionsWithLatest];
-
-      // Convert array to record with folderId as key
-      return allDocs.reduce<Record<string, TSecretFolderVersions>>(
-        (prev, curr) => ({ ...prev, [curr.folderId || ""]: curr }),
-        {}
-      );
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByIdsWithLatestVersion" });
-    }
-  };
-
-  const findLatestVersion = async (folderId: string, tx?: Knex) => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.SecretFolderVersion)
-        .where(`${TableName.SecretFolderVersion}.folderId`, folderId)
-        .select(selectAllTableCols(TableName.SecretFolderVersion))
-        .first();
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "findLatestVersion" });
-    }
-  };
-
-  return {
-    ...secretFolderVerOrm,
-    findLatestFolderVersions,
-    findLatestVersionByFolderId,
-    pruneExcessVersions,
-    findByIdsWithLatestVersion,
-    findLatestVersion
-  };
+  return { ...secretFolderVerOrm, findLatestFolderVersions, findLatestVersionByFolderId, pruneExcessVersions };
 };

backend/src/services/secret-sync/secret-sync-queue.ts

@@ -59,7 +59,6 @@ import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/se
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 
 import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 
 export type TSecretSyncQueueFactory = ReturnType<typeof secretSyncQueueFactory>;
 
@@ -95,7 +94,6 @@ type TSecretSyncQueueFactoryDep = {
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
@@ -138,7 +136,6 @@ export const secretSyncQueueFactory = ({
   secretVersionV2BridgeDAL,
   secretVersionTagV2BridgeDAL,
   resourceMetadataDAL,
-  folderCommitService,
   licenseService
 }: TSecretSyncQueueFactoryDep) => {
   const appCfg = getConfig();
@@ -170,8 +167,7 @@ export const secretSyncQueueFactory = ({
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   const $updateManySecretsRawFn = updateManySecretsRawFnFactory({
@@ -187,8 +183,7 @@ export const secretSyncQueueFactory = ({
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   const $getInfisicalSecrets = async (
@@ -378,7 +373,7 @@ export const secretSyncQueueFactory = ({
 
       if (Object.hasOwn(secretMap, key)) {
         // Only update secrets if the source value is not empty
-        if (value && value !== secretMap[key].value) {
+        if (value) {
           secretsToUpdate.push(secret);
           if (importBehavior === SecretSyncImportBehavior.PrioritizeDestination) importedSecretMap[key] = secretData;
         }

backend/src/services/secret-tag/secret-tag-dal.ts

@@ -11,7 +11,6 @@ export const secretTagDALFactory = (db: TDbClient) => {
   const secretTagOrm = ormify(db, TableName.SecretTag);
   const secretJnTagOrm = ormify(db, TableName.JnSecretTag);
   const secretV2JnTagOrm = ormify(db, TableName.SecretV2JnTag);
-  const secretVersionV2TagOrm = ormify(db, TableName.SecretVersionV2Tag);
 
   const findManyTagsById = async (projectId: string, ids: string[], tx?: Knex) => {
     try {
@@ -49,39 +48,14 @@ export const secretTagDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findSecretTagsByVersionId = async (versionId: string, tx?: Knex) => {
-    try {
-      const tags = await (tx || db.replicaNode())(TableName.SecretVersionV2Tag)
-        .where(`${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`, versionId)
-        .select(selectAllTableCols(TableName.SecretVersionV2Tag));
-      return tags;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find all by version id" });
-    }
-  };
-
-  const findSecretTagsBySecretId = async (secretId: string, tx?: Knex) => {
-    try {
-      const tags = await (tx || db.replicaNode())(TableName.SecretV2JnTag)
-        .where(`${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`, secretId)
-        .select(selectAllTableCols(TableName.SecretV2JnTag));
-      return tags;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find all by secret id" });
-    }
-  };
-
   return {
     ...secretTagOrm,
     saveTagsToSecret: secretJnTagOrm.insertMany,
     deleteTagsToSecret: secretJnTagOrm.delete,
     saveTagsToSecretV2: secretV2JnTagOrm.batchInsert,
     deleteTagsToSecretV2: secretV2JnTagOrm.delete,
-    saveTagsToSecretVersionV2: secretVersionV2TagOrm.insertMany,
     findSecretTagsByProjectId,
     deleteTagsManySecret,
-    findManyTagsById,
-    findSecretTagsByVersionId,
-    findSecretTagsBySecretId
+    findManyTagsById
   };
 };

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -8,7 +8,6 @@ import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 
 import { ActorType } from "../auth/auth-type";
-import { CommitType } from "../folder-commit/folder-commit-service";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
@@ -74,7 +73,6 @@ export const fnSecretBulkInsert = async ({
   resourceMetadataDAL,
   secretTagDAL,
   secretVersionTagDAL,
-  folderCommitService,
   actor,
   tx
 }: TFnSecretBulkInsert) => {
@@ -128,36 +126,11 @@ export const fnSecretBulkInsert = async ({
       userActorId,
       identityActorId,
       actorType,
-      metadata: el.metadata ? JSON.stringify(el.metadata) : [],
       secretId: newSecretGroupedByKeyName[el.key][0].id
     })),
     tx
   );
 
-  const commitChanges = secretVersions
-    .filter(({ type }) => type === SecretType.Shared)
-    .map((sv) => ({
-      type: CommitType.ADD,
-      secretVersionId: sv.id
-    }));
-
-  if (commitChanges.length > 0) {
-    await folderCommitService.createCommit(
-      {
-        actor: {
-          type: actorType || ActorType.PLATFORM,
-          metadata: {
-            id: actor?.actorId
-          }
-        },
-        message: "Secret Created",
-        folderId,
-        changes: commitChanges
-      },
-      tx
-    );
-  }
-
   await secretDAL.upsertSecretReferences(
     inputSecrets.map(({ references = [], key }) => ({
       secretId: newSecretGroupedByKeyName[key][0].id,
@@ -212,7 +185,6 @@ export const fnSecretBulkUpdate = async ({
   orgId,
   secretDAL,
   secretVersionDAL,
-  folderCommitService,
   secretTagDAL,
   secretVersionTagDAL,
   resourceMetadataDAL,
@@ -274,7 +246,7 @@ export const fnSecretBulkUpdate = async ({
         userId,
         encryptedComment,
         version,
-        metadata: metadata ? JSON.stringify(metadata) : [],
+        metadata,
         reminderNote,
         encryptedValue,
         reminderRepeatDays,
@@ -287,7 +259,6 @@ export const fnSecretBulkUpdate = async ({
     ),
     tx
   );
-
   await secretDAL.upsertSecretReferences(
     inputSecrets
       .filter(({ data: { references } }) => Boolean(references))
@@ -358,31 +329,6 @@ export const fnSecretBulkUpdate = async ({
     },
     { tx }
   );
-
-  const commitChanges = secretVersions
-    .filter(({ type }) => type === SecretType.Shared)
-    .map((sv) => ({
-      type: CommitType.ADD,
-      isUpdate: true,
-      secretVersionId: sv.id
-    }));
-  if (commitChanges.length > 0) {
-    await folderCommitService.createCommit(
-      {
-        actor: {
-          type: actorType || ActorType.PLATFORM,
-          metadata: {
-            id: actor?.actorId
-          }
-        },
-        message: "Secret Updated",
-        folderId,
-        changes: commitChanges
-      },
-      tx
-    );
-  }
-
   return secretsWithTags.map((secret) => ({ ...secret, _id: secret.id }));
 };
 
@@ -391,11 +337,8 @@ export const fnSecretBulkDelete = async ({
   inputSecrets,
   tx,
   actorId,
-  actorType,
   secretDAL,
-  secretQueueService,
-  folderCommitService,
-  secretVersionDAL
+  secretQueueService
 }: TFnSecretBulkDelete) => {
   const deletedSecrets = await secretDAL.deleteMany(
     inputSecrets.map(({ type, secretKey }) => ({
@@ -415,35 +358,6 @@ export const fnSecretBulkDelete = async ({
       )
   );
 
-  const secretVersions = await secretVersionDAL.findLatestVersionMany(
-    folderId,
-    deletedSecrets.map(({ id }) => id),
-    tx
-  );
-
-  const commitChanges = deletedSecrets
-    .filter(({ type }) => type === SecretType.Shared)
-    .map(({ id }) => ({
-      type: CommitType.DELETE,
-      secretVersionId: secretVersions[id].id
-    }));
-  if (commitChanges.length > 0) {
-    await folderCommitService.createCommit(
-      {
-        actor: {
-          type: actorType || ActorType.PLATFORM,
-          metadata: {
-            id: actorId
-          }
-        },
-        message: "Secret Deleted",
-        folderId,
-        changes: commitChanges
-      },
-      tx
-    );
-  }
-
   return deletedSecrets;
 };
 

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -17,7 +17,6 @@ import {
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
   ProjectPermissionActions,
-  ProjectPermissionCommitsActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSet,
   ProjectPermissionSub
@@ -35,7 +34,6 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { ActorType } from "../auth/auth-type";
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
@@ -92,7 +90,6 @@ type TSecretV2BridgeServiceFactoryDep = {
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   secretTagDAL: TSecretTagDALFactory;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs">;
   folderDAL: Pick<
     TSecretFolderDALFactory,
@@ -127,7 +124,6 @@ export const secretV2BridgeServiceFactory = ({
   projectEnvDAL,
   secretTagDAL,
   secretVersionDAL,
-  folderCommitService,
   folderDAL,
   permissionService,
   snapshotService,
@@ -325,14 +321,12 @@ export const secretV2BridgeServiceFactory = ({
             userId: inputSecret.type === SecretType.Personal ? actorId : null,
             tagIds: inputSecret.tagIds,
             references: nestedReferences,
-            metadata: secretMetadata ? JSON.stringify(secretMetadata) : [],
             secretMetadata
           }
         ],
         resourceMetadataDAL,
         secretDAL,
         secretVersionDAL,
-        folderCommitService,
         secretTagDAL,
         secretVersionTagDAL,
         actor: {
@@ -516,7 +510,6 @@ export const secretV2BridgeServiceFactory = ({
         folderId,
         orgId: actorOrgId,
         resourceMetadataDAL,
-        folderCommitService,
         inputSecrets: [
           {
             filter: { id: secretId },
@@ -530,7 +523,6 @@ export const secretV2BridgeServiceFactory = ({
               skipMultilineEncoding: inputSecret.skipMultilineEncoding,
               key: inputSecret.newSecretName || secretName,
               tags: inputSecret.tagIds,
-              metadata: secretMetadata ? JSON.stringify(secretMetadata) : [],
               secretMetadata,
               ...encryptedValue
             }
@@ -658,9 +650,6 @@ export const secretV2BridgeServiceFactory = ({
           projectId,
           folderId,
           actorId,
-          actorType: actor,
-          folderCommitService,
-          secretVersionDAL,
           secretDAL,
           secretQueueService,
           inputSecrets: [
@@ -1601,7 +1590,6 @@ export const secretV2BridgeServiceFactory = ({
         orgId: actorOrgId,
         secretDAL,
         resourceMetadataDAL,
-        folderCommitService,
         secretVersionDAL,
         secretTagDAL,
         secretVersionTagDAL,
@@ -1871,7 +1859,6 @@ export const secretV2BridgeServiceFactory = ({
         const bulkUpdatedSecrets = await fnSecretBulkUpdate({
           folderId,
           orgId: actorOrgId,
-          folderCommitService,
           tx,
           inputSecrets: secretsToUpdate.map((el) => {
             const originalSecret = secretsToUpdateInDBGroupedByKey[el.secretKey][0];
@@ -1941,7 +1928,6 @@ export const secretV2BridgeServiceFactory = ({
             secretVersionDAL,
             secretTagDAL,
             secretVersionTagDAL,
-            folderCommitService,
             actor: {
               type: actor,
               actorId
@@ -2075,8 +2061,6 @@ export const secretV2BridgeServiceFactory = ({
         fnSecretBulkDelete({
           secretDAL,
           secretQueueService,
-          folderCommitService,
-          secretVersionDAL,
           inputSecrets: inputSecrets.map(({ type, secretKey }) => ({
             secretKey,
             type: type || SecretType.Shared
@@ -2084,7 +2068,6 @@ export const secretV2BridgeServiceFactory = ({
           projectId,
           folderId,
           actorId,
-          actorType: actor,
           tx
         })
       );
@@ -2176,25 +2159,15 @@ export const secretV2BridgeServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-
-    const canRead =
-      permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback) ||
-      permission.can(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
-
-    if (!canRead) throw new ForbiddenRequestError({ message: "You do not have permission to read secret versions" });
-
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,
       projectId: folder.projectId
     });
-    const secretVersions = await secretVersionDAL.findVersionsBySecretIdWithActors({
-      secretId,
-      projectId: folder.projectId,
-      findOpt: {
-        offset,
-        limit,
-        sort: [["createdAt", "desc"]]
-      }
+    const secretVersions = await secretVersionDAL.findVersionsBySecretIdWithActors(secretId, folder.projectId, {
+      offset,
+      limit,
+      sort: [["createdAt", "desc"]]
     });
     return secretVersions.map((el) => {
       const secretValueHidden = !hasSecretReadValueOrDescribePermission(
@@ -2496,7 +2469,6 @@ export const secretV2BridgeServiceFactory = ({
             tx,
             secretTagDAL,
             resourceMetadataDAL,
-            folderCommitService,
             secretVersionTagDAL,
             actor: {
               type: actor,
@@ -2523,7 +2495,6 @@ export const secretV2BridgeServiceFactory = ({
             folderId: destinationFolder.id,
             orgId: actorOrgId,
             resourceMetadataDAL,
-            folderCommitService,
             secretVersionDAL,
             secretDAL,
             tx,
@@ -2869,76 +2840,6 @@ export const secretV2BridgeServiceFactory = ({
     };
   };
 
-  const getSecretVersionsByIds = async ({
-    actorId,
-    actor,
-    actorOrgId,
-    actorAuthMethod,
-    secretId,
-    secretVersionNumbers,
-    secretPath,
-    envId,
-    projectId
-  }: TGetSecretVersionsDTO & {
-    secretVersionNumbers: string[];
-    secretPath: string;
-    envId: string;
-    projectId: string;
-  }) => {
-    const environment = await projectEnvDAL.findOne({ id: envId, projectId });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-
-    const canRead =
-      permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback) ||
-      permission.can(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
-
-    if (!canRead) throw new ForbiddenRequestError({ message: "You do not have permission to read secret versions" });
-
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-    const secretVersions = await secretVersionDAL.findVersionsBySecretIdWithActors({
-      secretId,
-      projectId,
-      secretVersions: secretVersionNumbers
-    });
-    return secretVersions.map((el) => {
-      const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-        permission,
-        ProjectPermissionSecretActions.ReadValue,
-        {
-          environment: environment.slug,
-          secretPath,
-          secretName: el.key,
-          ...(el.tags?.length && {
-            secretTags: el.tags.map((tag) => tag.slug)
-          })
-        }
-      );
-
-      return reshapeBridgeSecret(
-        projectId,
-        environment.slug,
-        secretPath,
-        {
-          ...el,
-          value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
-          comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
-        },
-        secretValueHidden
-      );
-    });
-  };
-
   return {
     createSecret,
     deleteSecret,
@@ -2957,7 +2858,6 @@ export const secretV2BridgeServiceFactory = ({
     getSecretReferenceTree,
     getSecretsByFolderMappings,
     getSecretById,
-    getAccessibleSecrets,
-    getSecretVersionsByIds
+    getAccessibleSecrets
   };
 };

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -8,7 +8,6 @@ import { SecretsOrderBy } from "@app/services/secret/secret-types";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";
 
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
@@ -179,10 +178,9 @@ export type TFnSecretBulkInsert = {
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   actor?: {
     type: string;
-    actorId?: string;
+    actorId: string;
   };
 };
 
@@ -208,10 +206,9 @@ export type TFnSecretBulkUpdate = {
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   actor?: {
     type: string;
-    actorId?: string;
+    actorId: string;
   };
   tx?: Knex;
 };
@@ -221,14 +218,11 @@ export type TFnSecretBulkDelete = {
   projectId: string;
   inputSecrets: Array<{ type: SecretType; secretKey: string }>;
   actorId: string;
-  actorType?: string;
   tx?: Knex;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "deleteMany">;
   secretQueueService: {
     removeSecretReminder: (data: TRemoveSecretReminderDTO, tx?: Knex) => Promise<void>;
   };
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
-  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "findLatestVersionMany">;
 };
 
 export type THandleReminderDTO = {

backend/src/services/secret-v2-bridge/secret-version-dal.ts

@@ -4,7 +4,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { SecretVersionsV2Schema, TableName, TSecretVersionsV2, TSecretVersionsV2Update } from "@app/db/schemas";
 import { BadRequestError, DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindOpt } from "@app/lib/knex";
+import { ormify, selectAllTableCols, sqlNestRelationships, TFindOpt } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
 
@@ -138,7 +138,7 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
         {}
       );
     } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestVersionMany" });
+      throw new DatabaseError({ error, name: "FindLatestVersinMany" });
     }
   };
 
@@ -162,8 +162,6 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
         .join(TableName.Project, `${TableName.Project}.id`, `${TableName.Environment}.projectId`)
         .join("version_cte", "version_cte.id", `${TableName.SecretVersionV2}.id`)
         .whereRaw(`version_cte.row_num > ${TableName.Project}."pitVersionLimit"`)
-        // Projects with version >= 3 will require to have all secret versions for PIT
-        .andWhere(`${TableName.Project}.version`, "<", 3)
         .delete();
     } catch (error) {
       throw new DatabaseError({
@@ -174,21 +172,13 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning secret version v2 completed`);
   };
 
-  const findVersionsBySecretIdWithActors = async ({
-    secretId,
-    projectId,
-    secretVersions,
-    findOpt = {},
-    tx
-  }: {
-    secretId: string;
-    projectId: string;
-    secretVersions?: string[];
-    findOpt?: TFindOpt<TSecretVersionsV2>;
-    tx?: Knex;
-  }) => {
+  const findVersionsBySecretIdWithActors = async (
+    secretId: string,
+    projectId: string,
+    { offset, limit, sort = [["createdAt", "desc"]] }: TFindOpt<TSecretVersionsV2> = {},
+    tx?: Knex
+  ) => {
     try {
-      const { offset, limit, sort = [["createdAt", "desc"]] } = findOpt;
       const query = (tx || db)(TableName.SecretVersionV2)
         .leftJoin(TableName.Users, `${TableName.Users}.id`, `${TableName.SecretVersionV2}.userActorId`)
         .leftJoin(
@@ -199,24 +189,22 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
         .leftJoin(TableName.Identity, `${TableName.Identity}.id`, `${TableName.SecretVersionV2}.identityActorId`)
         .leftJoin(TableName.SecretV2, `${TableName.SecretVersionV2}.secretId`, `${TableName.SecretV2}.id`)
         .leftJoin(
-          TableName.SecretVersionV2Tag,
-          `${TableName.SecretVersionV2}.id`,
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`
+          TableName.SecretV2JnTag,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
         )
         .leftJoin(
           TableName.SecretTag,
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
           `${TableName.SecretTag}.id`
         )
         .where((qb) => {
           void qb.where(`${TableName.SecretVersionV2}.secretId`, secretId);
           void qb.where(`${TableName.ProjectMembership}.projectId`, projectId);
-          if (secretVersions?.length) void qb.whereIn(`${TableName.SecretVersionV2}.version`, secretVersions);
         })
         .orWhere((qb) => {
           void qb.where(`${TableName.SecretVersionV2}.secretId`, secretId);
           void qb.whereNull(`${TableName.ProjectMembership}.projectId`);
-          if (secretVersions?.length) void qb.whereIn(`${TableName.SecretVersionV2}.version`, secretVersions);
         })
         .select(
           selectAllTableCols(TableName.SecretVersionV2),
@@ -272,178 +260,6 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     }
   };
 
-  // Function to fetch latest versions by secretIds
-  const getLatestVersionsBySecretIds = async (
-    folderId: string,
-    secretIds: string[],
-    tx?: Knex
-  ): Promise<Array<TSecretVersionsV2>> => {
-    if (!secretIds.length) return [];
-
-    const knexInstance = tx || db.replicaNode();
-    return knexInstance(TableName.SecretVersionV2)
-      .where("folderId", folderId)
-      .whereIn(`${TableName.SecretVersionV2}.secretId`, secretIds)
-      .join(
-        knexInstance(TableName.SecretVersionV2)
-          .groupBy("secretId")
-          .max("version")
-          .select("secretId")
-          .as("latestVersion"),
-        (bd) => {
-          bd.on(`${TableName.SecretVersionV2}.secretId`, "latestVersion.secretId").andOn(
-            `${TableName.SecretVersionV2}.version`,
-            "latestVersion.max"
-          );
-        }
-      );
-  };
-
-  // Function to fetch specific versions by versionIds
-  const getSpecificVersionsWithLatestInfo = async (
-    folderId: string,
-    versionIds: string[],
-    tx?: Knex
-  ): Promise<Array<TSecretVersionsV2>> => {
-    if (!versionIds.length) return [];
-
-    const knexInstance = tx || db.replicaNode();
-
-    // Get the specific versions
-    const specificVersions = await knexInstance(TableName.SecretVersionV2)
-      .where("folderId", folderId)
-      .whereIn("id", versionIds);
-
-    // Get the secretIds from these versions
-    const specificSecretIds = [...new Set(specificVersions.map((v) => v.secretId).filter(Boolean))];
-
-    if (!specificSecretIds.length) return specificVersions;
-
-    // Get max versions for these secretIds
-    const maxVersionsQuery = await knexInstance(TableName.SecretVersionV2)
-      .whereIn("secretId", specificSecretIds)
-      .groupBy("secretId")
-      .select("secretId")
-      .max("version", { as: "maxVersion" });
-
-    // Create a lookup map for max versions
-    const maxVersionMap = maxVersionsQuery.reduce(
-      (acc, item) => {
-        acc[item.secretId] = item.maxVersion;
-        return acc;
-      },
-      {} as Record<string, number>
-    );
-
-    // Update the version field with maxVersion when needed
-    return specificVersions.map((version) => {
-      // Replace version with maxVersion
-      return {
-        ...version,
-        version: maxVersionMap[version.secretId] || version.version
-      };
-    });
-  };
-
-  const findByIdsWithLatestVersion = async (
-    folderId: string,
-    secretIds: string[],
-    versionIds?: string[],
-    tx?: Knex
-  ) => {
-    try {
-      if (!secretIds.length && (!versionIds || !versionIds.length)) return {};
-
-      const [latestVersions, specificVersionsWithLatest] = await Promise.all([
-        secretIds.length ? getLatestVersionsBySecretIds(folderId, secretIds, tx) : [],
-        versionIds?.length ? getSpecificVersionsWithLatestInfo(folderId, versionIds, tx) : []
-      ]);
-
-      const allDocs = [...latestVersions, ...specificVersionsWithLatest];
-
-      // Convert array to record with secretId as key
-      return allDocs.reduce<Record<string, TSecretVersionsV2>>(
-        (prev, curr) => ({ ...prev, [curr.secretId || ""]: curr }),
-        {}
-      );
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByIdsWithLatestVersion" });
-    }
-  };
-
-  const findByIdAndPreviousVersion = async (secretVersionId: string, tx?: Knex) => {
-    try {
-      const targetSecretVersion = await (tx || db.replicaNode())(TableName.SecretVersionV2)
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter({ id: secretVersionId }, TableName.SecretVersionV2))
-        .leftJoin(
-          TableName.SecretVersionV2Tag,
-          `${TableName.SecretVersionV2}.id`,
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`
-        )
-        .leftJoin(
-          TableName.SecretTag,
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`,
-          `${TableName.SecretTag}.id`
-        )
-        .select(selectAllTableCols(TableName.SecretVersionV2))
-        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
-        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"))
-        .first();
-      if (targetSecretVersion) {
-        const previousSecretVersion = await (tx || db.replicaNode())(TableName.SecretVersionV2)
-          .where(
-            // eslint-disable-next-line @typescript-eslint/no-misused-promises
-            buildFindFilter(
-              { version: targetSecretVersion.version - 1, secretId: targetSecretVersion.secretId },
-              TableName.SecretVersionV2
-            )
-          )
-          .leftJoin(
-            TableName.SecretVersionV2Tag,
-            `${TableName.SecretVersionV2}.id`,
-            `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`
-          )
-          .leftJoin(
-            TableName.SecretTag,
-            `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`,
-            `${TableName.SecretTag}.id`
-          )
-          .select(selectAllTableCols(TableName.SecretVersionV2))
-          .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
-          .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-          .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"))
-          .first();
-        if (!previousSecretVersion) return [];
-        const docs = [previousSecretVersion, targetSecretVersion];
-
-        const data = sqlNestRelationships({
-          data: docs,
-          key: "id",
-          parentMapper: (el) => ({ _id: el.id, ...SecretVersionsV2Schema.parse(el) }),
-          childrenMapper: [
-            {
-              key: "tagId",
-              label: "tags" as const,
-              mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
-                id,
-                color,
-                slug,
-                name: slug
-              })
-            }
-          ]
-        });
-
-        return data;
-      }
-      return [];
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByIdAndPreviousVersion" });
-    }
-  };
-
   return {
     ...secretVersionV2Orm,
     pruneExcessVersions,
@@ -451,8 +267,6 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     bulkUpdate,
     findLatestVersionByFolderId,
     findVersionsBySecretIdWithActors,
-    findBySecretId,
-    findByIdsWithLatestVersion,
-    findByIdAndPreviousVersion
+    findBySecretId
   };
 };

backend/src/services/secret/secret-fns.ts

@@ -778,7 +778,6 @@ export const createManySecretsRawFnFactory = ({
   secretVersionV2BridgeDAL,
   secretV2BridgeDAL,
   secretVersionTagV2BridgeDAL,
-  folderCommitService,
   kmsService,
   resourceMetadataDAL
 }: TCreateManySecretsRawFnFactory) => {
@@ -851,7 +850,6 @@ export const createManySecretsRawFnFactory = ({
           secretVersionDAL: secretVersionV2BridgeDAL,
           secretTagDAL,
           secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-          folderCommitService,
           tx
         })
       );
@@ -944,7 +942,6 @@ export const updateManySecretsRawFnFactory = ({
   secretVersionV2BridgeDAL,
   secretV2BridgeDAL,
   resourceMetadataDAL,
-  folderCommitService,
   kmsService
 }: TUpdateManySecretsRawFnFactory) => {
   const getBotKeyFn = getBotKeyFnFactory(projectBotDAL, projectDAL);
@@ -1035,8 +1032,7 @@ export const updateManySecretsRawFnFactory = ({
           secretDAL: secretV2BridgeDAL,
           secretVersionDAL: secretVersionV2BridgeDAL,
           secretTagDAL,
-          secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-          folderCommitService
+          secretVersionTagDAL: secretVersionTagV2BridgeDAL
         })
       );
 

backend/src/services/secret/secret-queue.ts

@@ -35,7 +35,6 @@ import { TSecretSyncQueueFactory } from "@app/services/secret-sync/secret-sync-q
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";
 
 import { ActorType } from "../auth/auth-type";
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TIntegrationDALFactory } from "../integration/integration-dal";
 import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal";
 import { TIntegrationAuthServiceFactory } from "../integration-auth/integration-auth-service";
@@ -113,7 +112,6 @@ type TSecretQueueFactoryDep = {
   orgService: Pick<TOrgServiceFactory, "addGhostUser">;
   projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "create">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   secretReminderRecipientsDAL: Pick<
     TSecretReminderRecipientsDALFactory,
     "delete" | "findUsersBySecretId" | "insertMany" | "transaction"
@@ -180,8 +178,7 @@ export const secretQueueFactory = ({
   projectKeyDAL,
   resourceMetadataDAL,
   secretReminderRecipientsDAL,
-  secretSyncQueue,
-  folderCommitService
+  secretSyncQueue
 }: TSecretQueueFactoryDep) => {
   const integrationMeter = opentelemetry.metrics.getMeter("Integrations");
   const errorHistogram = integrationMeter.createHistogram("integration_secret_sync_errors", {
@@ -369,8 +366,7 @@ export const secretQueueFactory = ({
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   const updateManySecretsRawFn = updateManySecretsRawFnFactory({
@@ -386,8 +382,7 @@ export const secretQueueFactory = ({
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   /**

backend/src/services/secret/secret-service.ts

@@ -44,8 +44,7 @@ import {
   TGetSecretsRawByFolderMappingsDTO
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-types";
 
-import { ActorAuthMethod, ActorType } from "../auth/auth-type";
-import { ChangeType } from "../folder-commit/folder-commit-service";
+import { ActorType } from "../auth/auth-type";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectBotServiceFactory } from "../project-bot/project-bot-service";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
@@ -2522,36 +2521,6 @@ export const secretServiceFactory = ({
     });
   };
 
-  const getSecretVersionsV2ByIds = async ({
-    actorId,
-    actor,
-    actorOrgId,
-    actorAuthMethod,
-    secretId,
-    secretVersions,
-    secretPath,
-    envId,
-    projectId
-  }: TGetSecretVersionsDTO & {
-    secretVersions: string[];
-    secretPath: string;
-    envId: string;
-    projectId: string;
-  }) => {
-    const secretVersionV2 = await secretV2BridgeService.getSecretVersionsByIds({
-      actorId,
-      actor,
-      actorOrgId,
-      actorAuthMethod,
-      secretId,
-      secretVersionNumbers: secretVersions,
-      secretPath,
-      envId,
-      projectId
-    });
-    return secretVersionV2;
-  };
-
   const attachTags = async ({
     secretName,
     tagSlugs,
@@ -3310,53 +3279,6 @@ export const secretServiceFactory = ({
     return secrets;
   };
 
-  const getChangeVersions = async (
-    change: {
-      secretVersion: string;
-      secretId?: string;
-      id?: string;
-      isUpdate?: boolean;
-      changeType?: string;
-    },
-    previousVersion: string,
-    actorId: string,
-    actor: ActorType,
-    actorOrgId: string,
-    actorAuthMethod: ActorAuthMethod,
-    envId: string,
-    projectId: string,
-    secretPath: string
-  ) => {
-    const currentVersion = change.secretVersion;
-    const secretId = change.secretId ? change.secretId : change.id;
-    if (!secretId) {
-      return;
-    }
-    const versions = await getSecretVersionsV2ByIds({
-      actorId,
-      actor,
-      actorOrgId,
-      actorAuthMethod,
-      secretId,
-      // if it's update add also the previous secretversionid
-      secretVersions:
-        change.isUpdate || change.changeType === ChangeType.UPDATE
-          ? [currentVersion, previousVersion]
-          : [currentVersion],
-      secretPath,
-      envId,
-      projectId
-    });
-    return versions?.map((v) => ({
-      secretKey: v.secretKey,
-      secretComment: v.secretComment,
-      skipMultilineEncoding: v.skipMultilineEncoding,
-      tags: v.tags?.map((tag) => tag.slug),
-      metadata: v.metadata,
-      secretValue: v.secretValue
-    }));
-  };
-
   return {
     attachTags,
     detachTags,
@@ -3387,8 +3309,6 @@ export const secretServiceFactory = ({
     getSecretsRawByFolderMappings,
     getSecretAccessList,
     getSecretByIdRaw,
-    getAccessibleSecrets,
-    getSecretVersionsV2ByIds,
-    getChangeVersions
+    getAccessibleSecrets
   };
 };