Update build-binaries.yml

.github/workflows/build-binaries.yml

@@ -14,16 +14,16 @@ defaults:
 
 jobs:
     build-and-deploy:
+        runs-on: ubuntu-20.04
         strategy:
             matrix:
                 arch: [x64, arm64]
-                os: [linux, win]
+                os: [linux]
                 include:
                     - os: linux
                       target: node20-linux
                     - os: win
                       target: node20-win
-        runs-on: ${{ (matrix.arch == 'arm64' && matrix.os == 'linux') && 'ubuntu24-arm64' || 'ubuntu-latest' }}
 
         steps:
             - name: Checkout code
@@ -34,19 +34,31 @@ jobs:
               with:
                   node-version: 20
 
+            - name: Set up QEMU
+              if: matrix.arch == 'arm64' && matrix.os == 'linux'
+              uses: docker/setup-qemu-action@v2
+
+            - name: Install dependencies and build (x64)
+              if: matrix.arch == 'x64'
+              run: |
+                  npm install
+                  npm install --prefix ../frontend
+                  npm run binary:build
+
+            - name: Install dependencies and build (arm64)
+              if: matrix.arch == 'arm64' && matrix.os == 'linux'
+              run: |
+                  docker run --rm -v ${{ github.workspace }}:/workspace --platform linux/arm64 node:20 bash -c "
+                    cd /workspace/backend && npm install && 
+                    cd /workspace/frontend && npm install && npm run build && 
+                    cd /workspace/backend && npm run binary:build
+                  "
+
             - name: Install pkg
               run: npm install -g @yao-pkg/pkg
 
-            - name: Install dependencies (backend)
-              run: npm install
-
-            - name: Install dependencies (frontend)
-              run: npm install --prefix ../frontend
-
-            - name: Prerequisites for pkg
-              run: npm run binary:build
-
-            - name: Package into node binary
+            - name: Package into node binary (x64)
+              if: matrix.arch == 'x64'
               run: |
                   if [ "${{ matrix.os }}" != "linux" ]; then
                     pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }} .
@@ -54,6 +66,15 @@ jobs:
                     pkg --no-bytecode --public-packages "*" --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core .
                   fi
 
+            - name: Package into node binary (arm64)
+              if: matrix.arch == 'arm64' && matrix.os == 'linux'
+              run: |
+                  docker run --rm -v ${{ github.workspace }}:/workspace --platform linux/arm64 node:20 bash -c "
+                    cd /workspace/backend && 
+                    npm install -g @yao-pkg/pkg && 
+                    pkg --no-bytecode --public-packages '*' --public --target ${{ matrix.target }}-${{ matrix.arch }} --output ./binary/infisical-core .
+                  "
+
             # Set up .deb package structure (Debian/Ubuntu only)
             - name: Set up .deb package structure
               if: matrix.os == 'linux'
@@ -84,21 +105,27 @@ jobs:
                   mv infisical-core.deb ./binary/infisical-core-${{matrix.arch}}.deb
 
             - uses: actions/setup-python@v4
-              with:
-                  python-version: "3.x" # Specify the Python version you need
-            - name: Install Python dependencies
-              run: |
-                  python -m pip install --upgrade pip
-                  pip install --upgrade cloudsmith-cli
+            - run: pip install --upgrade cloudsmith-cli
 
             # Publish .deb file to Cloudsmith (Debian/Ubuntu only)
             - name: Publish to Cloudsmith (Debian/Ubuntu)
-              if: matrix.os == 'linux'
+              if: matrix.os == 'linux' && matrix.arch == 'TEMP_DISABLED'
               working-directory: ./backend
               run: cloudsmith push deb --republish --no-wait-for-sync --api-key=${{ secrets.CLOUDSMITH_API_KEY }} infisical/infisical-core/any-distro/any-version ./binary/infisical-core-${{ matrix.arch }}.deb
 
             # Publish .exe file to Cloudsmith (Windows only)
             - name: Publish to Cloudsmith (Windows)
-              if: matrix.os == 'win'
+              if: matrix.os == 'win' && matrix.arch == 'TEMP_DISABLED'
               working-directory: ./backend
               run: cloudsmith push raw infisical/infisical-core ./binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }}.exe --republish --no-wait-for-sync --version ${{ github.event.inputs.version }} --api-key ${{ secrets.CLOUDSMITH_API_KEY }}
+
+            - name: List files in resources folders
+              run: |
+                  echo "Listing files in backend:"
+                  ls -R ./binary
+
+            - uses: actions/upload-artifact@v4
+              if: matrix.os == 'linux' && matrix.arch == 'arm64'
+              with:
+                  name: test-binary
+                  path: backend/binary/infisical-core-${{ matrix.os }}-${{ matrix.arch }}.deb

.github/workflows/check-api-for-breaking-changes.yml

@@ -22,14 +22,14 @@ jobs:
       # uncomment this when testing locally using nektos/act
       - uses: KengoTODA/actions-setup-docker-compose@v1
         if: ${{ env.ACT }}
-        name: Install `docker compose` for local simulations
+        name: Install `docker-compose` for local simulations
         with:
           version: "2.14.2"
       - name: 📦Build the latest image
         run: docker build --tag infisical-api .
         working-directory: backend
       - name: Start postgres and redis
-        run: touch .env && docker compose -f docker-compose.dev.yml up -d db redis
+        run: touch .env && docker-compose -f docker-compose.dev.yml up -d db redis
       - name: Start the server
         run: |
             echo "SECRET_SCANNING_GIT_APP_ID=793712" >> .env
@@ -72,6 +72,6 @@ jobs:
         run: oasdiff breaking https://app.infisical.com/api/docs/json http://localhost:4000/api/docs/json --fail-on ERR
       - name: cleanup
         run: |
-          docker compose -f "docker-compose.dev.yml" down
+          docker-compose -f "docker-compose.dev.yml" down
           docker stop infisical-api
           docker remove infisical-api

.github/workflows/run-backend-tests.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v3
       - uses: KengoTODA/actions-setup-docker-compose@v1
         if: ${{ env.ACT }}
-        name: Install `docker compose` for local simulations
+        name: Install `docker-compose` for local simulations
         with:
           version: "2.14.2"
       - name: 🔧 Setup Node 20
@@ -33,7 +33,7 @@ jobs:
         run: npm install
         working-directory: backend
       - name: Start postgres and redis
-        run: touch .env && docker compose -f docker-compose.dev.yml up -d db redis
+        run: touch .env && docker-compose -f docker-compose.dev.yml up -d db redis
       - name: Start integration test
         run: npm run test:e2e
         working-directory: backend
@@ -44,4 +44,4 @@ jobs:
           ENCRYPTION_KEY: 4bnfe4e407b8921c104518903515b218
       - name: cleanup
         run: |
-          docker compose -f "docker-compose.dev.yml" down
+          docker-compose -f "docker-compose.dev.yml" down

.github/workflows/run-cli-tests.yml

@@ -50,6 +50,6 @@ jobs:
                   CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }}
                   CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }}
                   CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }}
-                #   INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }}
+                  INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }}
 
               run: go test -v -count=1 ./test

Makefile

@@ -15,16 +15,3 @@ up-prod:
 
 down:
 	docker compose -f docker-compose.dev.yml down
-
-reviewable-ui:
-	cd frontend && \
-	npm run lint:fix && \
-	npm run type:check
-
-reviewable-api:
-	cd backend && \
-	npm run lint:fix && \
-	npm run type:check
-
-reviewable: reviewable-ui reviewable-api
-

backend/e2e-test/routes/v3/secrets-v2.spec.ts

@@ -1,576 +0,0 @@
-import { SecretType } from "@app/db/schemas";
-import { seedData1 } from "@app/db/seed-data";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-type TRawSecret = {
-  secretKey: string;
-  secretValue: string;
-  secretComment?: string;
-  version: number;
-};
-const createSecret = async (dto: { path: string; key: string; value: string; comment: string; type?: SecretType }) => {
-  const createSecretReqBody = {
-    workspaceId: seedData1.projectV3.id,
-    environment: seedData1.environment.slug,
-    type: dto.type || SecretType.Shared,
-    secretPath: dto.path,
-    secretKey: dto.key,
-    secretValue: dto.value,
-    secretComment: dto.comment
-  };
-  const createSecRes = await testServer.inject({
-    method: "POST",
-    url: `/api/v3/secrets/raw/${dto.key}`,
-    headers: {
-      authorization: `Bearer ${jwtAuthToken}`
-    },
-    body: createSecretReqBody
-  });
-  expect(createSecRes.statusCode).toBe(200);
-  const createdSecretPayload = JSON.parse(createSecRes.payload);
-  expect(createdSecretPayload).toHaveProperty("secret");
-  return createdSecretPayload.secret as TRawSecret;
-};
-
-const deleteSecret = async (dto: { path: string; key: string }) => {
-  const deleteSecRes = await testServer.inject({
-    method: "DELETE",
-    url: `/api/v3/secrets/raw/${dto.key}`,
-    headers: {
-      authorization: `Bearer ${jwtAuthToken}`
-    },
-    body: {
-      workspaceId: seedData1.projectV3.id,
-      environment: seedData1.environment.slug,
-      secretPath: dto.path
-    }
-  });
-  expect(deleteSecRes.statusCode).toBe(200);
-  const updatedSecretPayload = JSON.parse(deleteSecRes.payload);
-  expect(updatedSecretPayload).toHaveProperty("secret");
-  return updatedSecretPayload.secret as TRawSecret;
-};
-
-describe.each([{ auth: AuthMode.JWT }, { auth: AuthMode.IDENTITY_ACCESS_TOKEN }])(
-  "Secret V2 Architecture - $auth mode",
-  async ({ auth }) => {
-    let folderId = "";
-    let authToken = "";
-    const secretTestCases = [
-      {
-        path: "/",
-        secret: {
-          key: "SEC1",
-          value: "something-secret",
-          comment: "some comment"
-        }
-      },
-      {
-        path: "/nested1/nested2/folder",
-        secret: {
-          key: "NESTED-SEC1",
-          value: "something-secret",
-          comment: "some comment"
-        }
-      },
-      {
-        path: "/",
-        secret: {
-          key: "secret-key-2",
-          value: `-----BEGIN PRIVATE KEY-----
-        MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCa6eeFk+cMVqFn
-        hoVQDYgn2Ptp5Azysr2UPq6P73pCL9BzUtOXKZROqDyGehzzfg3wE2KdYU1Jk5Uq
-        fP0ZOWDIlM2SaVCSI3FW32o5+ZiggjpqcVdLFc/PS0S/ZdSmpPd8h11iO2brtIAI
-        ugTW8fcKlGSNUwx9aFmE7A6JnTRliTxB1l6QaC+YAwTK39VgeVH2gDSWC407aS15
-        QobAkaBKKmFkzB5D7i2ZJwt+uXJV/rbLmyDmtnw0lubciGn7NX9wbYef180fisqT
-        aPNAz0nPKk0fFH2Wd5MZixNGbrrpDA+FCYvI5doThZyT2hpj08qWP07oXXCAqw46
-        IEupNSILAgMBAAECggEBAIJb5KzeaiZS3B3O8G4OBQ5rJB3WfyLYUHnoSWLsBbie
-        nc392/ovThLmtZAAQE6SO85Tsb93+t64Z2TKqv1H8G658UeMgfWIB78v4CcLJ2mi
-        TN/3opqXrzjkQOTDHzBgT7al/mpETHZ6fOdbCemK0fVALGFUioUZg4M8VXtuI4Jw
-        q28jAyoRKrCrzda4BeQ553NZ4G5RvwhX3O2I8B8upTbt5hLcisBKy8MPLYY5LUFj
-        YKAP+raf6QLliP6KYHuVxUlgzxjLTxVG41etcyqqZF+foyiKBO3PU3n8oh++tgQP
-        ExOxiR0JSkBG5b+oOBD0zxcvo3/SjBHn0dJOZCSU2SkCgYEAyCe676XnNyBZMRD7
-        6trsaoiCWBpA6M8H44+x3w4cQFtqV38RyLy60D+iMKjIaLqeBbnay61VMzo24Bz3
-        EuF2n4+9k/MetLJ0NCw8HmN5k0WSMD2BFsJWG8glVbzaqzehP4tIclwDTYc1jQVt
-        IoV2/iL7HGT+x2daUwbU5kN5hK0CgYEAxiLB+fmjxJW7VY4SHDLqPdpIW0q/kv4K
-        d/yZBrCX799vjmFb9vLh7PkQUfJhMJ/ttJOd7EtT3xh4mfkBeLfHwVU0d/ahbmSH
-        UJu/E9ZGxAW3PP0kxHZtPrLKQwBnfq8AxBauIhR3rPSorQTIOKtwz1jMlHFSUpuL
-        3KeK2YfDYJcCgYEAkQnJOlNcAuRb/WQzSHIvktssqK8NjiZHryy3Vc0hx7j2jES2
-        HGI2dSVHYD9OSiXA0KFm3OTTsnViwm/60iGzFdjRJV6tR39xGUVcoyCuPnvRfUd0
-        PYvBXgxgkYpyYlPDcwp5CvWGJy3tLi1acgOIwIuUr3S38sL//t4adGk8q1kCgYB8
-        Jbs1Tl53BvrimKpwUNbE+sjrquJu0A7vL68SqgQJoQ7dP9PH4Ff/i+/V6PFM7mib
-        BQOm02wyFbs7fvKVGVJoqWK+6CIucX732x7W5yRgHtS5ukQXdbzt1Ek3wkEW98Cb
-        HTruz7RNAt/NyXlLSODeit1lBbx3Vk9EaxZtRsv88QKBgGn7JwXgez9NOyobsNIo
-        QVO80rpUeenSjuFi+R0VmbLKe/wgAQbYJ0xTAsQ0btqViMzB27D6mJyC+KUIwWNX
-        MN8a+m46v4kqvZkKL2c4gmDibyURNe/vCtCHFuanJS/1mo2tr4XDyEeiuK52eTd9
-        omQDpP86RX/hIIQ+JyLSaWYa
-        -----END PRIVATE KEY-----`,
-          comment:
-            "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation"
-        }
-      },
-      {
-        path: "/nested1/nested2/folder",
-        secret: {
-          key: "secret-key-3",
-          value: `-----BEGIN PRIVATE KEY-----
-        MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCa6eeFk+cMVqFn
-        hoVQDYgn2Ptp5Azysr2UPq6P73pCL9BzUtOXKZROqDyGehzzfg3wE2KdYU1Jk5Uq
-        fP0ZOWDIlM2SaVCSI3FW32o5+ZiggjpqcVdLFc/PS0S/ZdSmpPd8h11iO2brtIAI
-        ugTW8fcKlGSNUwx9aFmE7A6JnTRliTxB1l6QaC+YAwTK39VgeVH2gDSWC407aS15
-        QobAkaBKKmFkzB5D7i2ZJwt+uXJV/rbLmyDmtnw0lubciGn7NX9wbYef180fisqT
-        aPNAz0nPKk0fFH2Wd5MZixNGbrrpDA+FCYvI5doThZyT2hpj08qWP07oXXCAqw46
-        IEupNSILAgMBAAECggEBAIJb5KzeaiZS3B3O8G4OBQ5rJB3WfyLYUHnoSWLsBbie
-        nc392/ovThLmtZAAQE6SO85Tsb93+t64Z2TKqv1H8G658UeMgfWIB78v4CcLJ2mi
-        TN/3opqXrzjkQOTDHzBgT7al/mpETHZ6fOdbCemK0fVALGFUioUZg4M8VXtuI4Jw
-        q28jAyoRKrCrzda4BeQ553NZ4G5RvwhX3O2I8B8upTbt5hLcisBKy8MPLYY5LUFj
-        YKAP+raf6QLliP6KYHuVxUlgzxjLTxVG41etcyqqZF+foyiKBO3PU3n8oh++tgQP
-        ExOxiR0JSkBG5b+oOBD0zxcvo3/SjBHn0dJOZCSU2SkCgYEAyCe676XnNyBZMRD7
-        6trsaoiCWBpA6M8H44+x3w4cQFtqV38RyLy60D+iMKjIaLqeBbnay61VMzo24Bz3
-        EuF2n4+9k/MetLJ0NCw8HmN5k0WSMD2BFsJWG8glVbzaqzehP4tIclwDTYc1jQVt
-        IoV2/iL7HGT+x2daUwbU5kN5hK0CgYEAxiLB+fmjxJW7VY4SHDLqPdpIW0q/kv4K
-        d/yZBrCX799vjmFb9vLh7PkQUfJhMJ/ttJOd7EtT3xh4mfkBeLfHwVU0d/ahbmSH
-        UJu/E9ZGxAW3PP0kxHZtPrLKQwBnfq8AxBauIhR3rPSorQTIOKtwz1jMlHFSUpuL
-        3KeK2YfDYJcCgYEAkQnJOlNcAuRb/WQzSHIvktssqK8NjiZHryy3Vc0hx7j2jES2
-        HGI2dSVHYD9OSiXA0KFm3OTTsnViwm/60iGzFdjRJV6tR39xGUVcoyCuPnvRfUd0
-        PYvBXgxgkYpyYlPDcwp5CvWGJy3tLi1acgOIwIuUr3S38sL//t4adGk8q1kCgYB8
-        Jbs1Tl53BvrimKpwUNbE+sjrquJu0A7vL68SqgQJoQ7dP9PH4Ff/i+/V6PFM7mib
-        BQOm02wyFbs7fvKVGVJoqWK+6CIucX732x7W5yRgHtS5ukQXdbzt1Ek3wkEW98Cb
-        HTruz7RNAt/NyXlLSODeit1lBbx3Vk9EaxZtRsv88QKBgGn7JwXgez9NOyobsNIo
-        QVO80rpUeenSjuFi+R0VmbLKe/wgAQbYJ0xTAsQ0btqViMzB27D6mJyC+KUIwWNX
-        MN8a+m46v4kqvZkKL2c4gmDibyURNe/vCtCHFuanJS/1mo2tr4XDyEeiuK52eTd9
-        omQDpP86RX/hIIQ+JyLSaWYa
-        -----END PRIVATE KEY-----`,
-          comment:
-            "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation"
-        }
-      },
-      {
-        path: "/nested1/nested2/folder",
-        secret: {
-          key: "secret-key-3",
-          value:
-            "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxpdC4gU2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0IGRvbG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlzIG5vc3RydWQgZXhlcmNpdGF0aW9uCg==",
-          comment: ""
-        }
-      }
-    ];
-
-    beforeAll(async () => {
-      if (auth === AuthMode.JWT) {
-        authToken = jwtAuthToken;
-      } else if (auth === AuthMode.IDENTITY_ACCESS_TOKEN) {
-        const identityLogin = await testServer.inject({
-          method: "POST",
-          url: "/api/v1/auth/universal-auth/login",
-          body: {
-            clientSecret: seedData1.machineIdentity.clientCredentials.secret,
-            clientId: seedData1.machineIdentity.clientCredentials.id
-          }
-        });
-        expect(identityLogin.statusCode).toBe(200);
-        authToken = identityLogin.json().accessToken;
-      }
-      // create a deep folder
-      const folderCreate = await testServer.inject({
-        method: "POST",
-        url: `/api/v1/folders`,
-        headers: {
-          authorization: `Bearer ${jwtAuthToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          name: "folder",
-          path: "/nested1/nested2"
-        }
-      });
-      expect(folderCreate.statusCode).toBe(200);
-      folderId = folderCreate.json().folder.id;
-    });
-
-    afterAll(async () => {
-      const deleteFolder = await testServer.inject({
-        method: "DELETE",
-        url: `/api/v1/folders/${folderId}`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          path: "/nested1/nested2"
-        }
-      });
-      expect(deleteFolder.statusCode).toBe(200);
-    });
-
-    const getSecrets = async (environment: string, secretPath = "/") => {
-      const res = await testServer.inject({
-        method: "GET",
-        url: `/api/v3/secrets/raw`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        query: {
-          secretPath,
-          environment,
-          workspaceId: seedData1.projectV3.id
-        }
-      });
-      const secrets: TRawSecret[] = JSON.parse(res.payload).secrets || [];
-      return secrets;
-    };
-
-    test.each(secretTestCases)("Create secret in path $path", async ({ secret, path }) => {
-      const createdSecret = await createSecret({ path, ...secret });
-      expect(createdSecret.secretKey).toEqual(secret.key);
-      expect(createdSecret.secretValue).toEqual(secret.value);
-      expect(createdSecret.secretComment || "").toEqual(secret.comment);
-      expect(createdSecret.version).toEqual(1);
-
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({
-            secretKey: secret.key,
-            secretValue: secret.value,
-            type: SecretType.Shared
-          })
-        ])
-      );
-      await deleteSecret({ path, key: secret.key });
-    });
-
-    test.each(secretTestCases)("Get secret by name in path $path", async ({ secret, path }) => {
-      await createSecret({ path, ...secret });
-
-      const getSecByNameRes = await testServer.inject({
-        method: "GET",
-        url: `/api/v3/secrets/raw/${secret.key}`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        query: {
-          secretPath: path,
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug
-        }
-      });
-      expect(getSecByNameRes.statusCode).toBe(200);
-      const getSecretByNamePayload = JSON.parse(getSecByNameRes.payload);
-      expect(getSecretByNamePayload).toHaveProperty("secret");
-      const decryptedSecret = getSecretByNamePayload.secret as TRawSecret;
-      expect(decryptedSecret.secretKey).toEqual(secret.key);
-      expect(decryptedSecret.secretValue).toEqual(secret.value);
-      expect(decryptedSecret.secretComment || "").toEqual(secret.comment);
-
-      await deleteSecret({ path, key: secret.key });
-    });
-
-    if (auth === AuthMode.JWT) {
-      test.each(secretTestCases)(
-        "Creating personal secret without shared throw error in path $path",
-        async ({ secret }) => {
-          const createSecretReqBody = {
-            workspaceId: seedData1.projectV3.id,
-            environment: seedData1.environment.slug,
-            type: SecretType.Personal,
-            secretKey: secret.key,
-            secretValue: secret.value,
-            secretComment: secret.comment
-          };
-          const createSecRes = await testServer.inject({
-            method: "POST",
-            url: `/api/v3/secrets/raw/SEC2`,
-            headers: {
-              authorization: `Bearer ${authToken}`
-            },
-            body: createSecretReqBody
-          });
-          const payload = JSON.parse(createSecRes.payload);
-          expect(createSecRes.statusCode).toBe(400);
-          expect(payload.error).toEqual("BadRequest");
-        }
-      );
-
-      test.each(secretTestCases)("Creating personal secret in path $path", async ({ secret, path }) => {
-        await createSecret({ path, ...secret });
-
-        const createSecretReqBody = {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          type: SecretType.Personal,
-          secretPath: path,
-          secretKey: secret.key,
-          secretValue: "personal-value",
-          secretComment: secret.comment
-        };
-        const createSecRes = await testServer.inject({
-          method: "POST",
-          url: `/api/v3/secrets/raw/${secret.key}`,
-          headers: {
-            authorization: `Bearer ${authToken}`
-          },
-          body: createSecretReqBody
-        });
-        expect(createSecRes.statusCode).toBe(200);
-
-        // list secrets should contain personal one and shared one
-        const secrets = await getSecrets(seedData1.environment.slug, path);
-        expect(secrets).toEqual(
-          expect.arrayContaining([
-            expect.objectContaining({
-              secretKey: secret.key,
-              secretValue: secret.value,
-              type: SecretType.Shared
-            }),
-            expect.objectContaining({
-              secretKey: secret.key,
-              secretValue: "personal-value",
-              type: SecretType.Personal
-            })
-          ])
-        );
-
-        await deleteSecret({ path, key: secret.key });
-      });
-
-      test.each(secretTestCases)(
-        "Deleting personal one should not delete shared secret in path $path",
-        async ({ secret, path }) => {
-          await createSecret({ path, ...secret }); // shared one
-          await createSecret({ path, ...secret, type: SecretType.Personal });
-
-          // shared secret deletion should delete personal ones also
-          const secrets = await getSecrets(seedData1.environment.slug, path);
-          expect(secrets).toEqual(
-            expect.arrayContaining([
-              expect.objectContaining({
-                secretKey: secret.key,
-                type: SecretType.Shared
-              }),
-              expect.not.objectContaining({
-                secretKey: secret.key,
-                type: SecretType.Personal
-              })
-            ])
-          );
-          await deleteSecret({ path, key: secret.key });
-        }
-      );
-    }
-
-    test.each(secretTestCases)("Update secret in path $path", async ({ path, secret }) => {
-      await createSecret({ path, ...secret });
-      const updateSecretReqBody = {
-        workspaceId: seedData1.projectV3.id,
-        environment: seedData1.environment.slug,
-        type: SecretType.Shared,
-        secretPath: path,
-        secretKey: secret.key,
-        secretValue: "new-value",
-        secretComment: secret.comment
-      };
-      const updateSecRes = await testServer.inject({
-        method: "PATCH",
-        url: `/api/v3/secrets/raw/${secret.key}`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: updateSecretReqBody
-      });
-      expect(updateSecRes.statusCode).toBe(200);
-      const updatedSecretPayload = JSON.parse(updateSecRes.payload);
-      expect(updatedSecretPayload).toHaveProperty("secret");
-      const decryptedSecret = updatedSecretPayload.secret;
-      expect(decryptedSecret.secretKey).toEqual(secret.key);
-      expect(decryptedSecret.secretValue).toEqual("new-value");
-      expect(decryptedSecret.secretComment || "").toEqual(secret.comment);
-
-      // list secret should have updated value
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({
-            secretKey: secret.key,
-            secretValue: "new-value",
-            type: SecretType.Shared
-          })
-        ])
-      );
-
-      await deleteSecret({ path, key: secret.key });
-    });
-
-    test.each(secretTestCases)("Delete secret in path $path", async ({ secret, path }) => {
-      await createSecret({ path, ...secret });
-      const deletedSecret = await deleteSecret({ path, key: secret.key });
-      expect(deletedSecret.secretKey).toEqual(secret.key);
-
-      // shared secret deletion should delete personal ones also
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.not.arrayContaining([
-          expect.objectContaining({
-            secretKey: secret.key,
-            type: SecretType.Shared
-          }),
-          expect.objectContaining({
-            secretKey: secret.key,
-            type: SecretType.Personal
-          })
-        ])
-      );
-    });
-
-    test.each(secretTestCases)("Bulk create secrets in path $path", async ({ secret, path }) => {
-      const createSharedSecRes = await testServer.inject({
-        method: "POST",
-        url: `/api/v3/secrets/batch/raw`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          secretPath: path,
-          secrets: Array.from(Array(5)).map((_e, i) => ({
-            secretKey: `BULK-${secret.key}-${i + 1}`,
-            secretValue: secret.value,
-            secretComment: secret.comment
-          }))
-        }
-      });
-      expect(createSharedSecRes.statusCode).toBe(200);
-      const createSharedSecPayload = JSON.parse(createSharedSecRes.payload);
-      expect(createSharedSecPayload).toHaveProperty("secrets");
-
-      // bulk ones should exist
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.arrayContaining(
-          Array.from(Array(5)).map((_e, i) =>
-            expect.objectContaining({
-              secretKey: `BULK-${secret.key}-${i + 1}`,
-              secretValue: secret.value,
-              type: SecretType.Shared
-            })
-          )
-        )
-      );
-
-      await Promise.all(
-        Array.from(Array(5)).map((_e, i) => deleteSecret({ path, key: `BULK-${secret.key}-${i + 1}` }))
-      );
-    });
-
-    test.each(secretTestCases)("Bulk create fail on existing secret in path $path", async ({ secret, path }) => {
-      await createSecret({ ...secret, key: `BULK-${secret.key}-1`, path });
-
-      const createSharedSecRes = await testServer.inject({
-        method: "POST",
-        url: `/api/v3/secrets/batch/raw`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          secretPath: path,
-          secrets: Array.from(Array(5)).map((_e, i) => ({
-            secretKey: `BULK-${secret.key}-${i + 1}`,
-            secretValue: secret.value,
-            secretComment: secret.comment
-          }))
-        }
-      });
-      expect(createSharedSecRes.statusCode).toBe(400);
-
-      await deleteSecret({ path, key: `BULK-${secret.key}-1` });
-    });
-
-    test.each(secretTestCases)("Bulk update secrets in path $path", async ({ secret, path }) => {
-      await Promise.all(
-        Array.from(Array(5)).map((_e, i) => createSecret({ ...secret, key: `BULK-${secret.key}-${i + 1}`, path }))
-      );
-
-      const updateSharedSecRes = await testServer.inject({
-        method: "PATCH",
-        url: `/api/v3/secrets/batch/raw`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          secretPath: path,
-          secrets: Array.from(Array(5)).map((_e, i) => ({
-            secretKey: `BULK-${secret.key}-${i + 1}`,
-            secretValue: "update-value",
-            secretComment: secret.comment
-          }))
-        }
-      });
-      expect(updateSharedSecRes.statusCode).toBe(200);
-      const updateSharedSecPayload = JSON.parse(updateSharedSecRes.payload);
-      expect(updateSharedSecPayload).toHaveProperty("secrets");
-
-      // bulk ones should exist
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.arrayContaining(
-          Array.from(Array(5)).map((_e, i) =>
-            expect.objectContaining({
-              secretKey: `BULK-${secret.key}-${i + 1}`,
-              secretValue: "update-value",
-              type: SecretType.Shared
-            })
-          )
-        )
-      );
-      await Promise.all(
-        Array.from(Array(5)).map((_e, i) => deleteSecret({ path, key: `BULK-${secret.key}-${i + 1}` }))
-      );
-    });
-
-    test.each(secretTestCases)("Bulk delete secrets in path $path", async ({ secret, path }) => {
-      await Promise.all(
-        Array.from(Array(5)).map((_e, i) => createSecret({ ...secret, key: `BULK-${secret.key}-${i + 1}`, path }))
-      );
-
-      const deletedSharedSecRes = await testServer.inject({
-        method: "DELETE",
-        url: `/api/v3/secrets/batch/raw`,
-        headers: {
-          authorization: `Bearer ${authToken}`
-        },
-        body: {
-          workspaceId: seedData1.projectV3.id,
-          environment: seedData1.environment.slug,
-          secretPath: path,
-          secrets: Array.from(Array(5)).map((_e, i) => ({
-            secretKey: `BULK-${secret.key}-${i + 1}`
-          }))
-        }
-      });
-
-      expect(deletedSharedSecRes.statusCode).toBe(200);
-      const deletedSecretPayload = JSON.parse(deletedSharedSecRes.payload);
-      expect(deletedSecretPayload).toHaveProperty("secrets");
-
-      // bulk ones should exist
-      const secrets = await getSecrets(seedData1.environment.slug, path);
-      expect(secrets).toEqual(
-        expect.not.arrayContaining(
-          Array.from(Array(5)).map((_e, i) =>
-            expect.objectContaining({
-              secretKey: `BULK-${secret.value}-${i + 1}`,
-              type: SecretType.Shared
-            })
-          )
-        )
-      );
-    });
-  }
-);

backend/package.json

@@ -20,7 +20,8 @@
       "../frontend/.next/**",
       "!../frontend/node_modules/next/dist/server/**/*.js",
       "../frontend/node_modules/@fortawesome/fontawesome-svg-core/**/*",
-      "../frontend/public/**"
+      "../frontend/public/**",
+      "node_modules/argon2/**/*"
     ],
     "outputPath": "binary"
   },
@@ -34,14 +35,14 @@
     "test": "echo \"Error: no test specified\" && exit 1",
     "dev": "tsx watch --clear-screen=false ./src/main.ts  | pino-pretty --colorize --colorizeObjects --singleLine",
     "dev:docker": "nodemon",
-    "build": "tsup --sourcemap",
+    "build": "tsup",
     "build:frontend": "npm run build --prefix ../frontend",
-    "start": "node --enable-source-maps dist/main.mjs",
+    "start": "node dist/main.mjs",
     "type:check": "tsc --noEmit",
     "lint:fix": "eslint --fix --ext js,ts ./src",
     "lint": "eslint 'src/**/*.ts'",
-    "test:e2e": "vitest run -c vitest.e2e.config.ts --bail=1",
-    "test:e2e-watch": "vitest -c vitest.e2e.config.ts --bail=1",
+    "test:e2e": "vitest run -c vitest.e2e.config.ts",
+    "test:e2e-watch": "vitest -c vitest.e2e.config.ts",
     "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.ts",
     "generate:component": "tsx ./scripts/create-backend-file.ts",
     "generate:schema": "tsx ./scripts/generate-schema-types.ts",
@@ -78,7 +79,6 @@
     "@types/picomatch": "^2.3.3",
     "@types/prompt-sync": "^4.2.3",
     "@types/resolve": "^1.20.6",
-    "@types/safe-regex": "^1.1.6",
     "@types/uuid": "^9.0.7",
     "@typescript-eslint/eslint-plugin": "^6.20.0",
     "@typescript-eslint/parser": "^6.20.0",
@@ -122,11 +122,10 @@
     "@fastify/swagger": "^8.14.0",
     "@fastify/swagger-ui": "^2.1.0",
     "@node-saml/passport-saml": "^4.0.4",
-    "@octokit/plugin-retry": "^5.0.5",
     "@octokit/rest": "^20.0.2",
     "@octokit/webhooks-types": "^7.3.1",
     "@peculiar/asn1-schema": "^2.3.8",
-    "@peculiar/x509": "^1.12.1",
+    "@peculiar/x509": "^1.10.0",
     "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@sindresorhus/slugify": "1.1.0",
     "@team-plain/typescript-sdk": "^4.6.1",
@@ -173,7 +172,6 @@
     "pino": "^8.16.2",
     "posthog-node": "^3.6.2",
     "probot": "^13.0.0",
-    "safe-regex": "^2.1.1",
     "smee-client": "^2.0.0",
     "tedious": "^18.2.1",
     "tweetnacl": "^1.0.3",

backend/scripts/create-backend-file.ts

@@ -7,33 +7,14 @@ const prompt = promptSync({
   sigint: true
 });
 
-type ComponentType = 1 | 2 | 3;
-
 console.log(`
 Component List
 --------------
-0. Exit
 1. Service component
 2. DAL component
 3. Router component
 `);
-
-function getComponentType(): ComponentType {
-  while (true) {
-    const input = prompt("Select a component (0-3): ");
-    const componentType = parseInt(input, 10);
-
-    if (componentType === 0) {
-      console.log("Exiting the program. Goodbye!");
-      process.exit(0);
-    } else if (componentType === 1 || componentType === 2 || componentType === 3) {
-      return componentType;
-    } else {
-      console.log("Invalid input. Please enter 0, 1, 2, or 3.");
-    }
-  }
-}
-const componentType = getComponentType();
+const componentType = parseInt(prompt("Select a component: "), 10);
 
 if (componentType === 1) {
   const componentName = prompt("Enter service name: ");

backend/src/@types/fastify.d.ts

@@ -18,7 +18,6 @@ import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-ser
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service";
 import { TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service";
-import { RateLimitConfiguration } from "@app/ee/services/rate-limit/rate-limit-types";
 import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service";
 import { TScimServiceFactory } from "@app/ee/services/scim/scim-service";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
@@ -36,7 +35,6 @@ import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TCertificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
-import { TCertificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service";
 import { TIdentityServiceFactory } from "@app/services/identity/identity-service";
 import { TIdentityAccessTokenServiceFactory } from "@app/services/identity-access-token/identity-access-token-service";
@@ -52,9 +50,6 @@ import { TIntegrationServiceFactory } from "@app/services/integration/integratio
 import { TIntegrationAuthServiceFactory } from "@app/services/integration-auth/integration-auth-service";
 import { TOrgRoleServiceFactory } from "@app/services/org/org-role-service";
 import { TOrgServiceFactory } from "@app/services/org/org-service";
-import { TOrgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
-import { TPkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
-import { TPkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
 import { TProjectServiceFactory } from "@app/services/project/project-service";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env-service";
@@ -93,7 +88,6 @@ declare module "fastify" {
       id: string;
       orgId: string;
     };
-    rateLimits: RateLimitConfiguration;
     // passport data
     passportUser: {
       isUserCompleted: string;
@@ -119,7 +113,6 @@ declare module "fastify" {
       group: TGroupServiceFactory;
       groupProject: TGroupProjectServiceFactory;
       apiKey: TApiKeyServiceFactory;
-      pkiAlert: TPkiAlertServiceFactory;
       project: TProjectServiceFactory;
       projectMembership: TProjectMembershipServiceFactory;
       projectEnv: TProjectEnvServiceFactory;
@@ -157,10 +150,8 @@ declare module "fastify" {
       auditLog: TAuditLogServiceFactory;
       auditLogStream: TAuditLogStreamServiceFactory;
       certificate: TCertificateServiceFactory;
-      certificateTemplate: TCertificateTemplateServiceFactory;
       certificateAuthority: TCertificateAuthorityServiceFactory;
       certificateAuthorityCrl: TCertificateAuthorityCrlServiceFactory;
-      pkiCollection: TPkiCollectionServiceFactory;
       secretScanning: TSecretScanningServiceFactory;
       license: TLicenseServiceFactory;
       trustedIp: TTrustedIpServiceFactory;
@@ -174,7 +165,6 @@ declare module "fastify" {
       rateLimit: TRateLimitServiceFactory;
       userEngagement: TUserEngagementServiceFactory;
       externalKms: TExternalKmsServiceFactory;
-      orgAdmin: TOrgAdminServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data
     // everywhere else access using service layer

backend/src/@types/knex.d.ts

@@ -53,9 +53,6 @@ import {
   TCertificateSecretsUpdate,
   TCertificatesInsert,
   TCertificatesUpdate,
-  TCertificateTemplates,
-  TCertificateTemplatesInsert,
-  TCertificateTemplatesUpdate,
   TDynamicSecretLeases,
   TDynamicSecretLeasesInsert,
   TDynamicSecretLeasesUpdate,
@@ -164,15 +161,6 @@ import {
   TOrgRoles,
   TOrgRolesInsert,
   TOrgRolesUpdate,
-  TPkiAlerts,
-  TPkiAlertsInsert,
-  TPkiAlertsUpdate,
-  TPkiCollectionItems,
-  TPkiCollectionItemsInsert,
-  TPkiCollectionItemsUpdate,
-  TPkiCollections,
-  TPkiCollectionsInsert,
-  TPkiCollectionsUpdate,
   TProjectBots,
   TProjectBotsInsert,
   TProjectBotsUpdate,
@@ -216,9 +204,6 @@ import {
   TSecretApprovalRequestSecretTags,
   TSecretApprovalRequestSecretTagsInsert,
   TSecretApprovalRequestSecretTagsUpdate,
-  TSecretApprovalRequestSecretTagsV2,
-  TSecretApprovalRequestSecretTagsV2Insert,
-  TSecretApprovalRequestSecretTagsV2Update,
   TSecretApprovalRequestsInsert,
   TSecretApprovalRequestsReviewers,
   TSecretApprovalRequestsReviewersInsert,
@@ -226,9 +211,6 @@ import {
   TSecretApprovalRequestsSecrets,
   TSecretApprovalRequestsSecretsInsert,
   TSecretApprovalRequestsSecretsUpdate,
-  TSecretApprovalRequestsSecretsV2,
-  TSecretApprovalRequestsSecretsV2Insert,
-  TSecretApprovalRequestsSecretsV2Update,
   TSecretApprovalRequestsUpdate,
   TSecretBlindIndexes,
   TSecretBlindIndexesInsert,
@@ -245,15 +227,9 @@ import {
   TSecretReferences,
   TSecretReferencesInsert,
   TSecretReferencesUpdate,
-  TSecretReferencesV2,
-  TSecretReferencesV2Insert,
-  TSecretReferencesV2Update,
   TSecretRotationOutputs,
   TSecretRotationOutputsInsert,
   TSecretRotationOutputsUpdate,
-  TSecretRotationOutputV2,
-  TSecretRotationOutputV2Insert,
-  TSecretRotationOutputV2Update,
   TSecretRotations,
   TSecretRotationsInsert,
   TSecretRotationsUpdate,
@@ -272,9 +248,6 @@ import {
   TSecretSnapshotSecrets,
   TSecretSnapshotSecretsInsert,
   TSecretSnapshotSecretsUpdate,
-  TSecretSnapshotSecretsV2,
-  TSecretSnapshotSecretsV2Insert,
-  TSecretSnapshotSecretsV2Update,
   TSecretSnapshotsInsert,
   TSecretSnapshotsUpdate,
   TSecretsUpdate,
@@ -290,9 +263,6 @@ import {
   TSecretVersionTagJunction,
   TSecretVersionTagJunctionInsert,
   TSecretVersionTagJunctionUpdate,
-  TSecretVersionV2TagJunction,
-  TSecretVersionV2TagJunctionInsert,
-  TSecretVersionV2TagJunctionUpdate,
   TServiceTokens,
   TServiceTokensInsert,
   TServiceTokensUpdate,
@@ -321,17 +291,6 @@ import {
   TWebhooksInsert,
   TWebhooksUpdate
 } from "@app/db/schemas";
-import {
-  TSecretV2TagJunction,
-  TSecretV2TagJunctionInsert,
-  TSecretV2TagJunctionUpdate
-} from "@app/db/schemas/secret-v2-tag-junction";
-import {
-  TSecretVersionsV2,
-  TSecretVersionsV2Insert,
-  TSecretVersionsV2Update
-} from "@app/db/schemas/secret-versions-v2";
-import { TSecretsV2, TSecretsV2Insert, TSecretsV2Update } from "@app/db/schemas/secrets-v2";
 
 declare module "knex" {
   namespace Knex {
@@ -367,11 +326,6 @@ declare module "knex/types/tables" {
       TCertificateAuthorityCrlUpdate
     >;
     [TableName.Certificate]: KnexOriginal.CompositeTableType<TCertificates, TCertificatesInsert, TCertificatesUpdate>;
-    [TableName.CertificateTemplate]: KnexOriginal.CompositeTableType<
-      TCertificateTemplates,
-      TCertificateTemplatesInsert,
-      TCertificateTemplatesUpdate
-    >;
     [TableName.CertificateBody]: KnexOriginal.CompositeTableType<
       TCertificateBodies,
       TCertificateBodiesInsert,
@@ -382,17 +336,6 @@ declare module "knex/types/tables" {
       TCertificateSecretsInsert,
       TCertificateSecretsUpdate
     >;
-    [TableName.PkiAlert]: KnexOriginal.CompositeTableType<TPkiAlerts, TPkiAlertsInsert, TPkiAlertsUpdate>;
-    [TableName.PkiCollection]: KnexOriginal.CompositeTableType<
-      TPkiCollections,
-      TPkiCollectionsInsert,
-      TPkiCollectionsUpdate
-    >;
-    [TableName.PkiCollectionItem]: KnexOriginal.CompositeTableType<
-      TPkiCollectionItems,
-      TPkiCollectionItemsInsert,
-      TPkiCollectionItemsUpdate
-    >;
     [TableName.UserGroupMembership]: KnexOriginal.CompositeTableType<
       TUserGroupMembership,
       TUserGroupMembershipInsert,
@@ -702,23 +645,7 @@ declare module "knex/types/tables" {
       TSecretScanningGitRisksUpdate
     >;
     [TableName.TrustedIps]: KnexOriginal.CompositeTableType<TTrustedIps, TTrustedIpsInsert, TTrustedIpsUpdate>;
-    [TableName.SecretV2]: KnexOriginal.CompositeTableType<TSecretsV2, TSecretsV2Insert, TSecretsV2Update>;
-    [TableName.SecretVersionV2]: KnexOriginal.CompositeTableType<
-      TSecretVersionsV2,
-      TSecretVersionsV2Insert,
-      TSecretVersionsV2Update
-    >;
-    [TableName.SecretReferenceV2]: KnexOriginal.CompositeTableType<
-      TSecretReferencesV2,
-      TSecretReferencesV2Insert,
-      TSecretReferencesV2Update
-    >;
     // Junction tables
-    [TableName.SecretV2JnTag]: KnexOriginal.CompositeTableType<
-      TSecretV2TagJunction,
-      TSecretV2TagJunctionInsert,
-      TSecretV2TagJunctionUpdate
-    >;
     [TableName.JnSecretTag]: KnexOriginal.CompositeTableType<
       TSecretTagJunction,
       TSecretTagJunctionInsert,
@@ -729,31 +656,6 @@ declare module "knex/types/tables" {
       TSecretVersionTagJunctionInsert,
       TSecretVersionTagJunctionUpdate
     >;
-    [TableName.SecretVersionV2Tag]: KnexOriginal.CompositeTableType<
-      TSecretVersionV2TagJunction,
-      TSecretVersionV2TagJunctionInsert,
-      TSecretVersionV2TagJunctionUpdate
-    >;
-    [TableName.SnapshotSecretV2]: KnexOriginal.CompositeTableType<
-      TSecretSnapshotSecretsV2,
-      TSecretSnapshotSecretsV2Insert,
-      TSecretSnapshotSecretsV2Update
-    >;
-    [TableName.SecretApprovalRequestSecretV2]: KnexOriginal.CompositeTableType<
-      TSecretApprovalRequestsSecretsV2,
-      TSecretApprovalRequestsSecretsV2Insert,
-      TSecretApprovalRequestsSecretsV2Update
-    >;
-    [TableName.SecretApprovalRequestSecretTagV2]: KnexOriginal.CompositeTableType<
-      TSecretApprovalRequestSecretTagsV2,
-      TSecretApprovalRequestSecretTagsV2Insert,
-      TSecretApprovalRequestSecretTagsV2Update
-    >;
-    [TableName.SecretRotationOutputV2]: KnexOriginal.CompositeTableType<
-      TSecretRotationOutputV2,
-      TSecretRotationOutputV2Insert,
-      TSecretRotationOutputV2Update
-    >;
     // KMS service
     [TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType<
       TKmsRootConfig,

backend/src/db/migrations/20240724101056_access-request-groups.ts

@@ -1,294 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  // ---------- ACCESS APPROVAL POLICY APPROVER ------------
-  const hasApproverUserId = await knex.schema.hasColumn(TableName.AccessApprovalPolicyApprover, "approverUserId");
-  const hasApproverId = await knex.schema.hasColumn(TableName.AccessApprovalPolicyApprover, "approverId");
-
-  if (!hasApproverUserId) {
-    // add the new fields
-    await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (tb) => {
-      // if (hasApproverId) tb.setNullable("approverId");
-      tb.uuid("approverUserId");
-      tb.foreign("approverUserId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-    });
-
-    // convert project membership id => user id
-    await knex(TableName.AccessApprovalPolicyApprover).update({
-      // eslint-disable-next-line
-      // @ts-ignore because generate schema happens after this
-      approverUserId: knex(TableName.ProjectMembership)
-        .select("userId")
-        .where("id", knex.raw("??", [`${TableName.AccessApprovalPolicyApprover}.approverId`]))
-    });
-    // drop the old field
-    await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (tb) => {
-      if (hasApproverId) tb.dropColumn("approverId");
-      tb.uuid("approverUserId").notNullable().alter();
-    });
-  }
-
-  // ---------- ACCESS APPROVAL REQUEST ------------
-  const hasAccessApprovalRequestTable = await knex.schema.hasTable(TableName.AccessApprovalRequest);
-  const hasRequestedByUserId = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "requestedByUserId");
-  const hasRequestedBy = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "requestedBy");
-
-  if (hasAccessApprovalRequestTable) {
-    // new fields
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (tb) => {
-      if (!hasRequestedByUserId) {
-        tb.uuid("requestedByUserId");
-        tb.foreign("requestedByUserId").references("id").inTable(TableName.Users).onDelete("SET NULL");
-      }
-    });
-
-    // copy the assigned project membership => user id to new fields
-    await knex(TableName.AccessApprovalRequest).update({
-      // eslint-disable-next-line
-      // @ts-ignore because generate schema happens after this
-      requestedByUserId: knex(TableName.ProjectMembership)
-        .select("userId")
-        .where("id", knex.raw("??", [`${TableName.AccessApprovalRequest}.requestedBy`]))
-    });
-    // drop old fields
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (tb) => {
-      if (hasRequestedBy) {
-        // DROP AT A LATER TIME
-        // tb.dropColumn("requestedBy");
-
-        // ADD ALLOW NULLABLE FOR NOW
-        tb.uuid("requestedBy").nullable().alter();
-      }
-      tb.uuid("requestedByUserId").notNullable().alter();
-    });
-  }
-
-  // ---------- ACCESS APPROVAL REQUEST REVIEWER ------------
-  const hasMemberId = await knex.schema.hasColumn(TableName.AccessApprovalRequestReviewer, "member");
-  const hasReviewerUserId = await knex.schema.hasColumn(TableName.AccessApprovalRequestReviewer, "reviewerUserId");
-  if (!hasReviewerUserId) {
-    // new fields
-    await knex.schema.alterTable(TableName.AccessApprovalRequestReviewer, (tb) => {
-      // if (hasMemberId) tb.setNullable("member");
-      tb.uuid("reviewerUserId");
-      tb.foreign("reviewerUserId").references("id").inTable(TableName.Users).onDelete("SET NULL");
-    });
-    // copy project membership => user id to new fields
-    await knex(TableName.AccessApprovalRequestReviewer).update({
-      // eslint-disable-next-line
-      // @ts-ignore because generate schema happens after this
-      reviewerUserId: knex(TableName.ProjectMembership)
-        .select("userId")
-        .where("id", knex.raw("??", [`${TableName.AccessApprovalRequestReviewer}.member`]))
-    });
-    // drop table
-    await knex.schema.alterTable(TableName.AccessApprovalRequestReviewer, (tb) => {
-      if (hasMemberId) {
-        // DROP AT A LATER TIME
-        // tb.dropColumn("member");
-
-        // ADD ALLOW NULLABLE FOR NOW
-        tb.uuid("member").nullable().alter();
-      }
-      tb.uuid("reviewerUserId").notNullable().alter();
-    });
-  }
-
-  // ---------- PROJECT USER ADDITIONAL PRIVILEGE ------------
-  const projectUserAdditionalPrivilegeHasProjectMembershipId = await knex.schema.hasColumn(
-    TableName.ProjectUserAdditionalPrivilege,
-    "projectMembershipId"
-  );
-
-  const projectUserAdditionalPrivilegeHasUserId = await knex.schema.hasColumn(
-    TableName.ProjectUserAdditionalPrivilege,
-    "userId"
-  );
-
-  if (!projectUserAdditionalPrivilegeHasUserId) {
-    await knex.schema.alterTable(TableName.ProjectUserAdditionalPrivilege, (tb) => {
-      tb.uuid("userId");
-      tb.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-
-      tb.string("projectId");
-      tb.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-    });
-
-    await knex(TableName.ProjectUserAdditionalPrivilege)
-      .update({
-        // eslint-disable-next-line
-        // @ts-ignore because generate schema happens after this
-        userId: knex(TableName.ProjectMembership)
-          .select("userId")
-          .where("id", knex.raw("??", [`${TableName.ProjectUserAdditionalPrivilege}.projectMembershipId`])),
-
-        // eslint-disable-next-line
-        // @ts-ignore because generate schema happens after this
-        projectId: knex(TableName.ProjectMembership)
-          .select("projectId")
-          .where("id", knex.raw("??", [`${TableName.ProjectUserAdditionalPrivilege}.projectMembershipId`]))
-      })
-      .whereNotNull("projectMembershipId");
-
-    await knex.schema.alterTable(TableName.ProjectUserAdditionalPrivilege, (tb) => {
-      tb.uuid("userId").notNullable().alter();
-      tb.string("projectId").notNullable().alter();
-    });
-  }
-
-  if (projectUserAdditionalPrivilegeHasProjectMembershipId) {
-    await knex.schema.alterTable(TableName.ProjectUserAdditionalPrivilege, (tb) => {
-      // DROP AT A LATER TIME
-      // tb.dropColumn("projectMembershipId");
-
-      // ADD ALLOW NULLABLE FOR NOW
-      tb.uuid("projectMembershipId").nullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  // We remove project user additional privileges first, because it may delete records in the database where the project membership is not found.
-  // The project membership won't be found on records created by group members. In those cades we just delete the record and continue.
-  // When the additionl privilege record is deleted, it will cascade delete the access request created by the group member.
-
-  // ---------- PROJECT USER ADDITIONAL PRIVILEGE ------------
-  const hasUserId = await knex.schema.hasColumn(TableName.ProjectUserAdditionalPrivilege, "userId");
-  const hasProjectMembershipId = await knex.schema.hasColumn(
-    TableName.ProjectUserAdditionalPrivilege,
-    "projectMembershipId"
-  );
-
-  // If it doesn't have the userId field, then the up migration has not run
-  if (!hasUserId) {
-    return;
-  }
-
-  await knex.schema.alterTable(TableName.ProjectUserAdditionalPrivilege, (tb) => {
-    if (!hasProjectMembershipId) {
-      tb.uuid("projectMembershipId");
-      tb.foreign("projectMembershipId").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
-    }
-  });
-
-  if (!hasProjectMembershipId) {
-    // First, update records where a matching project membership exists
-    await knex(TableName.ProjectUserAdditionalPrivilege).update({
-      // eslint-disable-next-line
-      // @ts-ignore because generate schema happens after this
-      projectMembershipId: knex(TableName.ProjectMembership)
-        .select("id")
-        .where("userId", knex.raw("??", [`${TableName.ProjectUserAdditionalPrivilege}.userId`]))
-    });
-
-    await knex(TableName.AccessApprovalRequest).update({
-      // eslint-disable-next-line
-      // @ts-ignore because generate schema happens after this
-      projectMembershipId: knex(TableName.ProjectMembership)
-        .select("id")
-        .where("userId", knex.raw("??", [`${TableName.SecretApprovalRequest}.userId`]))
-    });
-
-    await knex.schema.alterTable(TableName.ProjectUserAdditionalPrivilege, (tb) => {
-      tb.dropColumn("userId");
-      tb.dropColumn("projectId");
-
-      tb.uuid("projectMembershipId").notNullable().alter();
-    });
-  }
-
-  // Then, delete records where no matching project membership was found
-  await knex(TableName.ProjectUserAdditionalPrivilege).whereNull("projectMembershipId").delete();
-  await knex(TableName.AccessApprovalRequest).whereNull("requestedBy").delete();
-
-  // ---------- ACCESS APPROVAL POLICY APPROVER ------------
-  const hasApproverUserId = await knex.schema.hasColumn(TableName.AccessApprovalPolicyApprover, "approverUserId");
-  const hasApproverId = await knex.schema.hasColumn(TableName.AccessApprovalPolicyApprover, "approverId");
-
-  if (hasApproverUserId) {
-    await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (tb) => {
-      if (!hasApproverId) {
-        tb.uuid("approverId");
-        tb.foreign("approverId").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
-      }
-    });
-
-    if (!hasApproverId) {
-      await knex(TableName.AccessApprovalPolicyApprover).update({
-        // eslint-disable-next-line
-        // @ts-ignore because generate schema happens after this
-        approverId: knex(TableName.ProjectMembership)
-          .select("id")
-          .where("userId", knex.raw("??", [`${TableName.AccessApprovalPolicyApprover}.approverUserId`]))
-      });
-      await knex.schema.alterTable(TableName.AccessApprovalPolicyApprover, (tb) => {
-        tb.dropColumn("approverUserId");
-
-        tb.uuid("approverId").notNullable().alter();
-      });
-    }
-
-    // ---------- ACCESS APPROVAL REQUEST ------------
-    const hasAccessApprovalRequestTable = await knex.schema.hasTable(TableName.AccessApprovalRequest);
-    const hasRequestedByUserId = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "requestedByUserId");
-    const hasRequestedBy = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "requestedBy");
-
-    if (hasAccessApprovalRequestTable) {
-      await knex.schema.alterTable(TableName.AccessApprovalRequest, (tb) => {
-        if (!hasRequestedBy) {
-          tb.uuid("requestedBy");
-          tb.foreign("requestedBy").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
-        }
-      });
-
-      // Try to find a project membership based on the AccessApprovalRequest.requestedByUserId and AccessApprovalRequest.policyId(reference to AccessApprovalRequestPolicy).envId(reference to Environment).projectId(reference to Project)
-      // If a project membership is found, set the AccessApprovalRequest.requestedBy to the project membership id
-      // If a project membership is not found, remove the AccessApprovalRequest record
-
-      await knex(TableName.AccessApprovalRequest).update({
-        // eslint-disable-next-line
-        // @ts-ignore because generate schema happens after this
-        requestedBy: knex(TableName.ProjectMembership)
-          .select("id")
-          .where("userId", knex.raw("??", [`${TableName.AccessApprovalRequest}.requestedByUserId`]))
-      });
-
-      // Then, delete records where no matching project membership was found
-      await knex(TableName.AccessApprovalRequest).whereNull("requestedBy").delete();
-
-      await knex.schema.alterTable(TableName.AccessApprovalRequest, (tb) => {
-        if (hasRequestedByUserId) {
-          tb.dropColumn("requestedByUserId");
-        }
-        if (hasRequestedBy) tb.uuid("requestedBy").notNullable().alter();
-      });
-    }
-
-    // ---------- ACCESS APPROVAL REQUEST REVIEWER ------------
-    const hasMemberId = await knex.schema.hasColumn(TableName.AccessApprovalRequestReviewer, "member");
-    const hasReviewerUserId = await knex.schema.hasColumn(TableName.AccessApprovalRequestReviewer, "reviewerUserId");
-
-    if (hasReviewerUserId) {
-      if (!hasMemberId) {
-        await knex.schema.alterTable(TableName.AccessApprovalRequestReviewer, (tb) => {
-          tb.uuid("member");
-          tb.foreign("member").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
-        });
-      }
-      await knex(TableName.AccessApprovalRequestReviewer).update({
-        // eslint-disable-next-line
-        // @ts-ignore because generate schema happens after this
-        member: knex(TableName.ProjectMembership)
-          .select("id")
-          .where("userId", knex.raw("??", [`${TableName.AccessApprovalRequestReviewer}.reviewerUserId`]))
-      });
-      await knex.schema.alterTable(TableName.AccessApprovalRequestReviewer, (tb) => {
-        tb.dropColumn("reviewerUserId");
-
-        tb.uuid("member").notNullable().alter();
-      });
-    }
-  }
-}

backend/src/db/migrations/20240728010334_secret-sharing-name.ts

@@ -1,39 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretSharing)) {
-    const doesNameExist = await knex.schema.hasColumn(TableName.SecretSharing, "name");
-    if (!doesNameExist) {
-      await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-        t.string("name").nullable();
-      });
-    }
-
-    const doesLastViewedAtExist = await knex.schema.hasColumn(TableName.SecretSharing, "lastViewedAt");
-    if (!doesLastViewedAtExist) {
-      await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-        t.timestamp("lastViewedAt").nullable();
-      });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretSharing)) {
-    const doesNameExist = await knex.schema.hasColumn(TableName.SecretSharing, "name");
-    if (doesNameExist) {
-      await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-        t.dropColumn("name");
-      });
-    }
-
-    const doesLastViewedAtExist = await knex.schema.hasColumn(TableName.SecretSharing, "lastViewedAt");
-    if (doesLastViewedAtExist) {
-      await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-        t.dropColumn("lastViewedAt");
-      });
-    }
-  }
-}

backend/src/db/migrations/20240730181830_add-org-kms-data-key.ts

@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasKmsDataKeyCol = await knex.schema.hasColumn(TableName.Organization, "kmsEncryptedDataKey");
-  await knex.schema.alterTable(TableName.Organization, (tb) => {
-    if (!hasKmsDataKeyCol) {
-      tb.binary("kmsEncryptedDataKey");
-    }
-  });
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasKmsDataKeyCol = await knex.schema.hasColumn(TableName.Organization, "kmsEncryptedDataKey");
-  await knex.schema.alterTable(TableName.Organization, (t) => {
-    if (hasKmsDataKeyCol) {
-      t.dropColumn("kmsEncryptedDataKey");
-    }
-  });
-}

backend/src/db/migrations/20240730181840_add-project-data-key.ts

@@ -1,29 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasKmsSecretManagerEncryptedDataKey = await knex.schema.hasColumn(
-    TableName.Project,
-    "kmsSecretManagerEncryptedDataKey"
-  );
-
-  await knex.schema.alterTable(TableName.Project, (tb) => {
-    if (!hasKmsSecretManagerEncryptedDataKey) {
-      tb.binary("kmsSecretManagerEncryptedDataKey");
-    }
-  });
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasKmsSecretManagerEncryptedDataKey = await knex.schema.hasColumn(
-    TableName.Project,
-    "kmsSecretManagerEncryptedDataKey"
-  );
-
-  await knex.schema.alterTable(TableName.Project, (t) => {
-    if (hasKmsSecretManagerEncryptedDataKey) {
-      t.dropColumn("kmsSecretManagerEncryptedDataKey");
-    }
-  });
-}

backend/src/db/migrations/20240730181850_secret-v2.ts

@@ -1,181 +0,0 @@
-/* eslint-disable @typescript-eslint/ban-ts-comment */
-import { Knex } from "knex";
-
-import { SecretType, TableName } from "../schemas";
-import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const doesSecretV2TableExist = await knex.schema.hasTable(TableName.SecretV2);
-  if (!doesSecretV2TableExist) {
-    await knex.schema.createTable(TableName.SecretV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.integer("version").defaultTo(1).notNullable();
-      t.string("type").notNullable().defaultTo(SecretType.Shared);
-      t.string("key", 500).notNullable();
-      t.binary("encryptedValue");
-      t.binary("encryptedComment");
-      t.string("reminderNote");
-      t.integer("reminderRepeatDays");
-      t.boolean("skipMultilineEncoding").defaultTo(false);
-      t.jsonb("metadata");
-      t.uuid("userId");
-      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-      t.uuid("folderId").notNullable();
-      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-      t.index(["folderId", "userId"]);
-    });
-  }
-  await createOnUpdateTrigger(knex, TableName.SecretV2);
-
-  // many to many relation between tags
-  await createJunctionTable(knex, TableName.SecretV2JnTag, TableName.SecretV2, TableName.SecretTag);
-
-  const doesSecretV2VersionTableExist = await knex.schema.hasTable(TableName.SecretVersionV2);
-  if (!doesSecretV2VersionTableExist) {
-    await knex.schema.createTable(TableName.SecretVersionV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.integer("version").defaultTo(1).notNullable();
-      t.string("type").notNullable().defaultTo(SecretType.Shared);
-      t.string("key", 500).notNullable();
-      t.binary("encryptedValue");
-      t.binary("encryptedComment");
-      t.string("reminderNote");
-      t.integer("reminderRepeatDays");
-      t.boolean("skipMultilineEncoding").defaultTo(false);
-      t.jsonb("metadata");
-      // to avoid orphan rows
-      t.uuid("envId");
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
-      t.uuid("secretId").notNullable();
-      t.uuid("folderId").notNullable();
-      t.uuid("userId");
-      t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-  }
-  await createOnUpdateTrigger(knex, TableName.SecretVersionV2);
-
-  if (!(await knex.schema.hasTable(TableName.SecretReferenceV2))) {
-    await knex.schema.createTable(TableName.SecretReferenceV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("environment").notNullable();
-      t.string("secretPath").notNullable();
-      t.string("secretKey", 500).notNullable();
-      t.uuid("secretId").notNullable();
-      t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE");
-    });
-  }
-
-  await createJunctionTable(knex, TableName.SecretVersionV2Tag, TableName.SecretVersionV2, TableName.SecretTag);
-
-  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretV2))) {
-    await knex.schema.createTable(TableName.SecretApprovalRequestSecretV2, (t) => {
-      // everything related  to secret
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.integer("version").defaultTo(1);
-      t.string("key", 500).notNullable();
-      t.binary("encryptedValue");
-      t.binary("encryptedComment");
-      t.string("reminderNote");
-      t.integer("reminderRepeatDays");
-      t.boolean("skipMultilineEncoding").defaultTo(false);
-      t.jsonb("metadata");
-      t.timestamps(true, true, true);
-      // commit details
-      t.uuid("requestId").notNullable();
-      t.foreign("requestId").references("id").inTable(TableName.SecretApprovalRequest).onDelete("CASCADE");
-      t.string("op").notNullable();
-      t.uuid("secretId");
-      t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("SET NULL");
-      t.uuid("secretVersion");
-      t.foreign("secretVersion").references("id").inTable(TableName.SecretVersionV2).onDelete("SET NULL");
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretTagV2))) {
-    await knex.schema.createTable(TableName.SecretApprovalRequestSecretTagV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.uuid("secretId").notNullable();
-      t.foreign("secretId").references("id").inTable(TableName.SecretApprovalRequestSecretV2).onDelete("CASCADE");
-      t.uuid("tagId").notNullable();
-      t.foreign("tagId").references("id").inTable(TableName.SecretTag).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SnapshotSecretV2))) {
-    await knex.schema.createTable(TableName.SnapshotSecretV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.uuid("envId").index().notNullable();
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
-      // not a relation kept like that to keep it when rolled back
-      t.uuid("secretVersionId").index().notNullable();
-      t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE");
-      t.uuid("snapshotId").index().notNullable();
-      t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-  }
-
-  if (await knex.schema.hasTable(TableName.IntegrationAuth)) {
-    const hasEncryptedAccess = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccess");
-    const hasEncryptedAccessId = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccessId");
-    const hasEncryptedRefresh = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedRefresh");
-    const hasEncryptedAwsIamAssumRole = await knex.schema.hasColumn(
-      TableName.IntegrationAuth,
-      "encryptedAwsAssumeIamRoleArn"
-    );
-    await knex.schema.alterTable(TableName.IntegrationAuth, (t) => {
-      if (!hasEncryptedAccess) t.binary("encryptedAccess");
-      if (!hasEncryptedAccessId) t.binary("encryptedAccessId");
-      if (!hasEncryptedRefresh) t.binary("encryptedRefresh");
-      if (!hasEncryptedAwsIamAssumRole) t.binary("encryptedAwsAssumeIamRoleArn");
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretRotationOutputV2))) {
-    await knex.schema.createTable(TableName.SecretRotationOutputV2, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("key").notNullable();
-      t.uuid("secretId").notNullable();
-      t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE");
-      t.uuid("rotationId").notNullable();
-      t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.SnapshotSecretV2);
-  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretTagV2);
-  await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretV2);
-
-  await knex.schema.dropTableIfExists(TableName.SecretV2JnTag);
-  await knex.schema.dropTableIfExists(TableName.SecretReferenceV2);
-
-  await knex.schema.dropTableIfExists(TableName.SecretRotationOutputV2);
-
-  await dropOnUpdateTrigger(knex, TableName.SecretVersionV2);
-  await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag);
-  await knex.schema.dropTableIfExists(TableName.SecretVersionV2);
-
-  await dropOnUpdateTrigger(knex, TableName.SecretV2);
-  await knex.schema.dropTableIfExists(TableName.SecretV2);
-
-  if (await knex.schema.hasTable(TableName.IntegrationAuth)) {
-    const hasEncryptedAccess = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccess");
-    const hasEncryptedAccessId = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccessId");
-    const hasEncryptedRefresh = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedRefresh");
-    const hasEncryptedAwsIamAssumRole = await knex.schema.hasColumn(
-      TableName.IntegrationAuth,
-      "encryptedAwsAssumeIamRoleArn"
-    );
-    await knex.schema.alterTable(TableName.IntegrationAuth, (t) => {
-      if (hasEncryptedAccess) t.dropColumn("encryptedAccess");
-      if (hasEncryptedAccessId) t.dropColumn("encryptedAccessId");
-      if (hasEncryptedRefresh) t.dropColumn("encryptedRefresh");
-      if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsAssumeIamRoleArn");
-    });
-  }
-}

backend/src/db/migrations/20240802181855_ca-cert-version.ts

@@ -1,117 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateAuthority)) {
-    const hasActiveCaCertIdColumn = await knex.schema.hasColumn(TableName.CertificateAuthority, "activeCaCertId");
-    if (!hasActiveCaCertIdColumn) {
-      await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-        t.uuid("activeCaCertId").nullable();
-        t.foreign("activeCaCertId").references("id").inTable(TableName.CertificateAuthorityCert);
-      });
-
-      await knex.raw(`
-        UPDATE "${TableName.CertificateAuthority}" ca
-        SET "activeCaCertId" = cac.id
-        FROM "${TableName.CertificateAuthorityCert}" cac
-        WHERE ca.id = cac."caId"
-      `);
-    }
-  }
-
-  if (await knex.schema.hasTable(TableName.CertificateAuthorityCert)) {
-    const hasVersionColumn = await knex.schema.hasColumn(TableName.CertificateAuthorityCert, "version");
-    if (!hasVersionColumn) {
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.integer("version").nullable();
-        t.dropUnique(["caId"]);
-      });
-
-      await knex(TableName.CertificateAuthorityCert).update({ version: 1 }).whereNull("version");
-
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.integer("version").notNullable().alter();
-      });
-    }
-
-    const hasCaSecretIdColumn = await knex.schema.hasColumn(TableName.CertificateAuthorityCert, "caSecretId");
-    if (!hasCaSecretIdColumn) {
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.uuid("caSecretId").nullable();
-        t.foreign("caSecretId").references("id").inTable(TableName.CertificateAuthoritySecret).onDelete("CASCADE");
-      });
-
-      await knex.raw(`
-        UPDATE "${TableName.CertificateAuthorityCert}" cert
-        SET "caSecretId" = (
-          SELECT sec.id
-          FROM "${TableName.CertificateAuthoritySecret}" sec
-          WHERE sec."caId" = cert."caId"
-        )
-      `);
-
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.uuid("caSecretId").notNullable().alter();
-      });
-    }
-  }
-
-  if (await knex.schema.hasTable(TableName.CertificateAuthoritySecret)) {
-    await knex.schema.alterTable(TableName.CertificateAuthoritySecret, (t) => {
-      t.dropUnique(["caId"]);
-    });
-  }
-
-  if (await knex.schema.hasTable(TableName.Certificate)) {
-    await knex.schema.alterTable(TableName.Certificate, (t) => {
-      t.uuid("caCertId").nullable();
-      t.foreign("caCertId").references("id").inTable(TableName.CertificateAuthorityCert);
-    });
-
-    await knex.raw(`
-        UPDATE "${TableName.Certificate}" cert
-        SET "caCertId" = (
-          SELECT caCert.id
-          FROM "${TableName.CertificateAuthorityCert}" caCert
-          WHERE caCert."caId" = cert."caId"
-        )
-      `);
-
-    await knex.schema.alterTable(TableName.Certificate, (t) => {
-      t.uuid("caCertId").notNullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateAuthority)) {
-    if (await knex.schema.hasColumn(TableName.CertificateAuthority, "activeCaCertId")) {
-      await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-        t.dropColumn("activeCaCertId");
-      });
-    }
-  }
-
-  if (await knex.schema.hasTable(TableName.CertificateAuthorityCert)) {
-    if (await knex.schema.hasColumn(TableName.CertificateAuthorityCert, "version")) {
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.dropColumn("version");
-      });
-    }
-
-    if (await knex.schema.hasColumn(TableName.CertificateAuthorityCert, "caSecretId")) {
-      await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
-        t.dropColumn("caSecretId");
-      });
-    }
-  }
-
-  if (await knex.schema.hasTable(TableName.Certificate)) {
-    if (await knex.schema.hasColumn(TableName.Certificate, "caCertId")) {
-      await knex.schema.alterTable(TableName.Certificate, (t) => {
-        t.dropColumn("caCertId");
-      });
-    }
-  }
-}

backend/src/db/migrations/20240806113425_remove-creation-limit-rate-limit.ts

@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasCreationLimitCol = await knex.schema.hasColumn(TableName.RateLimit, "creationLimit");
-  await knex.schema.alterTable(TableName.RateLimit, (t) => {
-    if (hasCreationLimitCol) {
-      t.dropColumn("creationLimit");
-    }
-  });
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasCreationLimitCol = await knex.schema.hasColumn(TableName.RateLimit, "creationLimit");
-  await knex.schema.alterTable(TableName.RateLimit, (t) => {
-    if (!hasCreationLimitCol) {
-      t.integer("creationLimit").defaultTo(30).notNullable();
-    }
-  });
-}

backend/src/db/migrations/20240806185442_drop-tag-name.ts

@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasNameField = await knex.schema.hasColumn(TableName.SecretTag, "name");
-  if (hasNameField) {
-    await knex.schema.alterTable(TableName.SecretTag, (t) => {
-      t.dropColumn("name");
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasNameField = await knex.schema.hasColumn(TableName.SecretTag, "name");
-  if (!hasNameField) {
-    await knex.schema.alterTable(TableName.SecretTag, (t) => {
-      t.string("name");
-    });
-  }
-}

backend/src/db/migrations/20240818024923_cert-alerting.ts

@@ -1,62 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.PkiCollection))) {
-    await knex.schema.createTable(TableName.PkiCollection, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.string("projectId").notNullable();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.string("name").notNullable();
-      t.string("description").notNullable();
-    });
-  }
-
-  await createOnUpdateTrigger(knex, TableName.PkiCollection);
-
-  if (!(await knex.schema.hasTable(TableName.PkiCollectionItem))) {
-    await knex.schema.createTable(TableName.PkiCollectionItem, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.uuid("pkiCollectionId").notNullable();
-      t.foreign("pkiCollectionId").references("id").inTable(TableName.PkiCollection).onDelete("CASCADE");
-      t.uuid("caId").nullable();
-      t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
-      t.uuid("certId").nullable();
-      t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
-    });
-  }
-
-  await createOnUpdateTrigger(knex, TableName.PkiCollectionItem);
-
-  if (!(await knex.schema.hasTable(TableName.PkiAlert))) {
-    await knex.schema.createTable(TableName.PkiAlert, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.string("projectId").notNullable();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.uuid("pkiCollectionId").notNullable();
-      t.foreign("pkiCollectionId").references("id").inTable(TableName.PkiCollection).onDelete("CASCADE");
-      t.string("name").notNullable();
-      t.integer("alertBeforeDays").notNullable();
-      t.string("recipientEmails").notNullable();
-      t.unique(["name", "projectId"]);
-    });
-  }
-
-  await createOnUpdateTrigger(knex, TableName.PkiAlert);
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.PkiAlert);
-  await dropOnUpdateTrigger(knex, TableName.PkiAlert);
-
-  await knex.schema.dropTableIfExists(TableName.PkiCollectionItem);
-  await dropOnUpdateTrigger(knex, TableName.PkiCollectionItem);
-
-  await knex.schema.dropTableIfExists(TableName.PkiCollection);
-  await dropOnUpdateTrigger(knex, TableName.PkiCollection);
-}

backend/src/db/migrations/20240818184238_add-certificate-template.ts

@@ -1,55 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasCertificateTemplateTable = await knex.schema.hasTable(TableName.CertificateTemplate);
-  if (!hasCertificateTemplateTable) {
-    await knex.schema.createTable(TableName.CertificateTemplate, (tb) => {
-      tb.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      tb.uuid("caId").notNullable();
-      tb.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
-      tb.uuid("pkiCollectionId");
-      tb.foreign("pkiCollectionId").references("id").inTable(TableName.PkiCollection).onDelete("SET NULL");
-      tb.string("name").notNullable();
-      tb.string("commonName").notNullable();
-      tb.string("subjectAlternativeName").notNullable();
-      tb.string("ttl").notNullable();
-      tb.timestamps(true, true, true);
-    });
-
-    await createOnUpdateTrigger(knex, TableName.CertificateTemplate);
-  }
-
-  const doesCertificateTableHaveTemplateId = await knex.schema.hasColumn(
-    TableName.Certificate,
-    "certificateTemplateId"
-  );
-
-  if (!doesCertificateTableHaveTemplateId) {
-    await knex.schema.alterTable(TableName.Certificate, (tb) => {
-      tb.uuid("certificateTemplateId");
-      tb.foreign("certificateTemplateId").references("id").inTable(TableName.CertificateTemplate).onDelete("SET NULL");
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const doesCertificateTableHaveTemplateId = await knex.schema.hasColumn(
-    TableName.Certificate,
-    "certificateTemplateId"
-  );
-
-  if (doesCertificateTableHaveTemplateId) {
-    await knex.schema.alterTable(TableName.Certificate, (t) => {
-      t.dropColumn("certificateTemplateId");
-    });
-  }
-
-  const hasCertificateTemplateTable = await knex.schema.hasTable(TableName.CertificateTemplate);
-  if (hasCertificateTemplateTable) {
-    await knex.schema.dropTable(TableName.CertificateTemplate);
-    await dropOnUpdateTrigger(knex, TableName.CertificateTemplate);
-  }
-}

backend/src/db/migrations/20240821212643_crl-ca-secret-binding.ts

@@ -1,36 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateAuthorityCrl)) {
-    const hasCaSecretIdColumn = await knex.schema.hasColumn(TableName.CertificateAuthorityCrl, "caSecretId");
-    if (!hasCaSecretIdColumn) {
-      await knex.schema.alterTable(TableName.CertificateAuthorityCrl, (t) => {
-        t.uuid("caSecretId").nullable();
-        t.foreign("caSecretId").references("id").inTable(TableName.CertificateAuthoritySecret).onDelete("CASCADE");
-      });
-
-      await knex.raw(`
-        UPDATE "${TableName.CertificateAuthorityCrl}" crl
-        SET "caSecretId" = (
-          SELECT sec.id
-          FROM "${TableName.CertificateAuthoritySecret}" sec
-          WHERE sec."caId" = crl."caId"
-        )
-      `);
-
-      await knex.schema.alterTable(TableName.CertificateAuthorityCrl, (t) => {
-        t.uuid("caSecretId").notNullable().alter();
-      });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateAuthorityCrl)) {
-    await knex.schema.alterTable(TableName.CertificateAuthorityCrl, (t) => {
-      t.dropColumn("caSecretId");
-    });
-  }
-}

backend/src/db/migrations/utils/kms.ts

@@ -1,105 +0,0 @@
-import slugify from "@sindresorhus/slugify";
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-import { randomSecureBytes } from "@app/lib/crypto";
-import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher";
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-
-const getInstanceRootKey = async (knex: Knex) => {
-  const encryptionKey = process.env.ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY;
-  // if root key its base64 encoded
-  const isBase64 = !process.env.ENCRYPTION_KEY;
-  if (!encryptionKey) throw new Error("ENCRYPTION_KEY variable needed for migration");
-  const encryptionKeyBuffer = Buffer.from(encryptionKey, isBase64 ? "base64" : "utf8");
-
-  const KMS_ROOT_CONFIG_UUID = "00000000-0000-0000-0000-000000000000";
-  const kmsRootConfig = await knex(TableName.KmsServerRootConfig).where({ id: KMS_ROOT_CONFIG_UUID }).first();
-  const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-  if (kmsRootConfig) {
-    const decryptedRootKey = cipher.decrypt(kmsRootConfig.encryptedRootKey, encryptionKeyBuffer);
-    // set the flag so that other instancen nodes can start
-    return decryptedRootKey;
-  }
-
-  const newRootKey = randomSecureBytes(32);
-  const encryptedRootKey = cipher.encrypt(newRootKey, encryptionKeyBuffer);
-  await knex(TableName.KmsServerRootConfig).insert({
-    encryptedRootKey,
-    // eslint-disable-next-line
-    // @ts-ignore id is kept as fixed for idempotence and to avoid race condition
-    id: KMS_ROOT_CONFIG_UUID
-  });
-  return encryptedRootKey;
-};
-
-export const getSecretManagerDataKey = async (knex: Knex, projectId: string) => {
-  const KMS_VERSION = "v01";
-  const KMS_VERSION_BLOB_LENGTH = 3;
-  const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-  const project = await knex(TableName.Project).where({ id: projectId }).first();
-  if (!project) throw new Error("Missing project id");
-
-  const ROOT_ENCRYPTION_KEY = await getInstanceRootKey(knex);
-
-  let secretManagerKmsKey;
-  const projectSecretManagerKmsId = project?.kmsSecretManagerKeyId;
-  if (projectSecretManagerKmsId) {
-    const kmsDoc = await knex(TableName.KmsKey)
-      .leftJoin(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`)
-      .where({ [`${TableName.KmsKey}.id` as "id"]: projectSecretManagerKmsId })
-      .first();
-    if (!kmsDoc) throw new Error("missing kms");
-    secretManagerKmsKey = cipher.decrypt(kmsDoc.encryptedKey, ROOT_ENCRYPTION_KEY);
-  } else {
-    const [kmsDoc] = await knex(TableName.KmsKey)
-      .insert({
-        slug: slugify(alphaNumericNanoId(8).toLowerCase()),
-        orgId: project.orgId,
-        isReserved: false
-      })
-      .returning("*");
-
-    secretManagerKmsKey = randomSecureBytes(32);
-    const encryptedKeyMaterial = cipher.encrypt(secretManagerKmsKey, ROOT_ENCRYPTION_KEY);
-    await knex(TableName.InternalKms).insert({
-      version: 1,
-      encryptedKey: encryptedKeyMaterial,
-      encryptionAlgorithm: SymmetricEncryption.AES_GCM_256,
-      kmsKeyId: kmsDoc.id
-    });
-  }
-
-  const encryptedSecretManagerDataKey = project?.kmsSecretManagerEncryptedDataKey;
-  let dataKey: Buffer;
-  if (!encryptedSecretManagerDataKey) {
-    dataKey = randomSecureBytes();
-    // the below versioning we do it automatically in kms service
-    const unversionedDataKey = cipher.encrypt(dataKey, secretManagerKmsKey);
-    const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3
-    await knex(TableName.Project)
-      .where({ id: projectId })
-      .update({
-        kmsSecretManagerEncryptedDataKey: Buffer.concat([unversionedDataKey, versionBlob])
-      });
-  } else {
-    const cipherTextBlob = encryptedSecretManagerDataKey.subarray(0, -KMS_VERSION_BLOB_LENGTH);
-    dataKey = cipher.decrypt(cipherTextBlob, secretManagerKmsKey);
-  }
-
-  return {
-    encryptor: ({ plainText }: { plainText: Buffer }) => {
-      const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey);
-
-      // Buffer#1 encrypted text + Buffer#2 version number
-      const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3
-      const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]);
-      return { cipherTextBlob };
-    },
-    decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: { cipherTextBlob: Buffer }) => {
-      const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH);
-      const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey);
-      return decryptedBlob;
-    }
-  };
-};

backend/src/db/schemas/access-approval-policies-approvers.ts

@@ -9,10 +9,10 @@ import { TImmutableDBKeys } from "./models";
 
 export const AccessApprovalPoliciesApproversSchema = z.object({
   id: z.string().uuid(),
+  approverId: z.string().uuid(),
   policyId: z.string().uuid(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  approverUserId: z.string().uuid()
+  updatedAt: z.date()
 });
 
 export type TAccessApprovalPoliciesApprovers = z.infer<typeof AccessApprovalPoliciesApproversSchema>;

backend/src/db/schemas/access-approval-policies.ts

@@ -5,6 +5,8 @@
 
 import { z } from "zod";
 
+import { EnforcementLevel } from "@app/lib/types";
+
 import { TImmutableDBKeys } from "./models";
 
 export const AccessApprovalPoliciesSchema = z.object({
@@ -15,7 +17,7 @@ export const AccessApprovalPoliciesSchema = z.object({
   envId: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  enforcementLevel: z.string().default("hard")
+  enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
 });
 
 export type TAccessApprovalPolicies = z.infer<typeof AccessApprovalPoliciesSchema>;

backend/src/db/schemas/access-approval-requests-reviewers.ts

@@ -9,12 +9,11 @@ import { TImmutableDBKeys } from "./models";
 
 export const AccessApprovalRequestsReviewersSchema = z.object({
   id: z.string().uuid(),
-  member: z.string().uuid().nullable().optional(),
+  member: z.string().uuid(),
   status: z.string(),
   requestId: z.string().uuid(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  reviewerUserId: z.string().uuid()
+  updatedAt: z.date()
 });
 
 export type TAccessApprovalRequestsReviewers = z.infer<typeof AccessApprovalRequestsReviewersSchema>;

backend/src/db/schemas/access-approval-requests.ts

@@ -11,13 +11,12 @@ export const AccessApprovalRequestsSchema = z.object({
   id: z.string().uuid(),
   policyId: z.string().uuid(),
   privilegeId: z.string().uuid().nullable().optional(),
-  requestedBy: z.string().uuid().nullable().optional(),
+  requestedBy: z.string().uuid(),
   isTemporary: z.boolean(),
   temporaryRange: z.string().nullable().optional(),
   permissions: z.unknown(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  requestedByUserId: z.string().uuid()
+  updatedAt: z.date()
 });
 
 export type TAccessApprovalRequests = z.infer<typeof AccessApprovalRequestsSchema>;

backend/src/db/schemas/certificate-authorities.ts

@@ -27,8 +27,7 @@ export const CertificateAuthoritiesSchema = z.object({
   maxPathLength: z.number().nullable().optional(),
   keyAlgorithm: z.string(),
   notBefore: z.date().nullable().optional(),
-  notAfter: z.date().nullable().optional(),
-  activeCaCertId: z.string().uuid().nullable().optional()
+  notAfter: z.date().nullable().optional()
 });
 
 export type TCertificateAuthorities = z.infer<typeof CertificateAuthoritiesSchema>;

backend/src/db/schemas/certificate-authority-certs.ts

@@ -15,9 +15,7 @@ export const CertificateAuthorityCertsSchema = z.object({
   updatedAt: z.date(),
   caId: z.string().uuid(),
   encryptedCertificate: zodBuffer,
-  encryptedCertificateChain: zodBuffer,
-  version: z.number(),
-  caSecretId: z.string().uuid()
+  encryptedCertificateChain: zodBuffer
 });
 
 export type TCertificateAuthorityCerts = z.infer<typeof CertificateAuthorityCertsSchema>;

backend/src/db/schemas/certificate-authority-crl.ts

@@ -14,8 +14,7 @@ export const CertificateAuthorityCrlSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   caId: z.string().uuid(),
-  encryptedCrl: zodBuffer,
-  caSecretId: z.string().uuid()
+  encryptedCrl: zodBuffer
 });
 
 export type TCertificateAuthorityCrl = z.infer<typeof CertificateAuthorityCrlSchema>;

backend/src/db/schemas/certificate-templates.ts

@@ -1,24 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const CertificateTemplatesSchema = z.object({
-  id: z.string().uuid(),
-  caId: z.string().uuid(),
-  pkiCollectionId: z.string().uuid().nullable().optional(),
-  name: z.string(),
-  commonName: z.string(),
-  subjectAlternativeName: z.string(),
-  ttl: z.string(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TCertificateTemplates = z.infer<typeof CertificateTemplatesSchema>;
-export type TCertificateTemplatesInsert = Omit<z.input<typeof CertificateTemplatesSchema>, TImmutableDBKeys>;
-export type TCertificateTemplatesUpdate = Partial<Omit<z.input<typeof CertificateTemplatesSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/certificates.ts

@@ -20,9 +20,7 @@ export const CertificatesSchema = z.object({
   notAfter: z.date(),
   revokedAt: z.date().nullable().optional(),
   revocationReason: z.number().nullable().optional(),
-  altNames: z.string().default("").nullable().optional(),
-  caCertId: z.string().uuid(),
-  certificateTemplateId: z.string().uuid().nullable().optional()
+  altNames: z.string().default("").nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;

backend/src/db/schemas/index.ts

@@ -14,7 +14,6 @@ export * from "./certificate-authority-crl";
 export * from "./certificate-authority-secret";
 export * from "./certificate-bodies";
 export * from "./certificate-secrets";
-export * from "./certificate-templates";
 export * from "./certificates";
 export * from "./dynamic-secret-leases";
 export * from "./dynamic-secrets";
@@ -53,9 +52,6 @@ export * from "./org-bots";
 export * from "./org-memberships";
 export * from "./org-roles";
 export * from "./organizations";
-export * from "./pki-alerts";
-export * from "./pki-collection-items";
-export * from "./pki-collections";
 export * from "./project-bots";
 export * from "./project-environments";
 export * from "./project-keys";
@@ -70,35 +66,26 @@ export * from "./scim-tokens";
 export * from "./secret-approval-policies";
 export * from "./secret-approval-policies-approvers";
 export * from "./secret-approval-request-secret-tags";
-export * from "./secret-approval-request-secret-tags-v2";
 export * from "./secret-approval-requests";
 export * from "./secret-approval-requests-reviewers";
 export * from "./secret-approval-requests-secrets";
-export * from "./secret-approval-requests-secrets-v2";
 export * from "./secret-blind-indexes";
 export * from "./secret-folder-versions";
 export * from "./secret-folders";
 export * from "./secret-imports";
 export * from "./secret-references";
-export * from "./secret-references-v2";
-export * from "./secret-rotation-output-v2";
 export * from "./secret-rotation-outputs";
 export * from "./secret-rotations";
 export * from "./secret-scanning-git-risks";
 export * from "./secret-sharing";
 export * from "./secret-snapshot-folders";
 export * from "./secret-snapshot-secrets";
-export * from "./secret-snapshot-secrets-v2";
 export * from "./secret-snapshots";
 export * from "./secret-tag-junction";
 export * from "./secret-tags";
-export * from "./secret-v2-tag-junction";
 export * from "./secret-version-tag-junction";
-export * from "./secret-version-v2-tag-junction";
 export * from "./secret-versions";
-export * from "./secret-versions-v2";
 export * from "./secrets";
-export * from "./secrets-v2";
 export * from "./service-tokens";
 export * from "./super-admin";
 export * from "./trusted-ips";

backend/src/db/schemas/integration-auths.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const IntegrationAuthsSchema = z.object({
@@ -34,11 +32,7 @@ export const IntegrationAuthsSchema = z.object({
   updatedAt: z.date(),
   awsAssumeIamRoleArnCipherText: z.string().nullable().optional(),
   awsAssumeIamRoleArnIV: z.string().nullable().optional(),
-  awsAssumeIamRoleArnTag: z.string().nullable().optional(),
-  encryptedAccess: zodBuffer.nullable().optional(),
-  encryptedAccessId: zodBuffer.nullable().optional(),
-  encryptedRefresh: zodBuffer.nullable().optional(),
-  encryptedAwsAssumeIamRoleArn: zodBuffer.nullable().optional()
+  awsAssumeIamRoleArnTag: z.string().nullable().optional()
 });
 
 export type TIntegrationAuths = z.infer<typeof IntegrationAuthsSchema>;

backend/src/db/schemas/kms-keys.ts

@@ -13,9 +13,9 @@ export const KmsKeysSchema = z.object({
   isDisabled: z.boolean().default(false).nullable().optional(),
   isReserved: z.boolean().default(true).nullable().optional(),
   orgId: z.string().uuid(),
-  slug: z.string(),
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  slug: z.string()
 });
 
 export type TKmsKeys = z.infer<typeof KmsKeysSchema>;

backend/src/db/schemas/models.ts

@@ -9,10 +9,6 @@ export enum TableName {
   Certificate = "certificates",
   CertificateBody = "certificate_bodies",
   CertificateSecret = "certificate_secrets",
-  CertificateTemplate = "certificate_templates",
-  PkiAlert = "pki_alerts",
-  PkiCollection = "pki_collections",
-  PkiCollectionItem = "pki_collection_items",
   Groups = "groups",
   GroupProjectMembership = "group_project_memberships",
   GroupProjectMembershipRole = "group_project_membership_roles",
@@ -94,18 +90,9 @@ export enum TableName {
   TrustedIps = "trusted_ips",
   DynamicSecret = "dynamic_secrets",
   DynamicSecretLease = "dynamic_secret_leases",
-  SecretV2 = "secrets_v2",
-  SecretReferenceV2 = "secret_references_v2",
-  SecretVersionV2 = "secret_versions_v2",
-  SecretApprovalRequestSecretV2 = "secret_approval_requests_secrets_v2",
-  SecretApprovalRequestSecretTagV2 = "secret_approval_request_secret_tags_v2",
-  SnapshotSecretV2 = "secret_snapshot_secrets_v2",
   // junction tables with tags
-  SecretV2JnTag = "secret_v2_tag_junction",
   JnSecretTag = "secret_tag_junction",
   SecretVersionTag = "secret_version_tag_junction",
-  SecretVersionV2Tag = "secret_version_v2_tag_junction",
-  SecretRotationOutputV2 = "secret_rotation_output_v2",
   // KMS Service
   KmsServerRootConfig = "kms_root_config",
   KmsKey = "kms_keys",
@@ -170,8 +157,7 @@ export enum SecretType {
 
 export enum ProjectVersion {
   V1 = 1,
-  V2 = 2,
-  V3 = 3
+  V2 = 2
 }
 
 export enum ProjectUpgradeStatus {

backend/src/db/schemas/org-memberships.ts

@@ -18,7 +18,7 @@ export const OrgMembershipsSchema = z.object({
   orgId: z.string().uuid(),
   roleId: z.string().uuid().nullable().optional(),
   projectFavorites: z.string().array().nullable().optional(),
-  isActive: z.boolean().default(true)
+  isActive: z.boolean()
 });
 
 export type TOrgMemberships = z.infer<typeof OrgMembershipsSchema>;

backend/src/db/schemas/organizations.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const OrganizationsSchema = z.object({
@@ -18,8 +16,7 @@ export const OrganizationsSchema = z.object({
   updatedAt: z.date(),
   authEnforced: z.boolean().default(false).nullable().optional(),
   scimEnabled: z.boolean().default(false).nullable().optional(),
-  kmsDefaultKeyId: z.string().uuid().nullable().optional(),
-  kmsEncryptedDataKey: zodBuffer.nullable().optional()
+  kmsDefaultKeyId: z.string().uuid().nullable().optional()
 });
 
 export type TOrganizations = z.infer<typeof OrganizationsSchema>;

backend/src/db/schemas/pki-alerts.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const PkiAlertsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  projectId: z.string(),
-  pkiCollectionId: z.string().uuid(),
-  name: z.string(),
-  alertBeforeDays: z.number(),
-  recipientEmails: z.string()
-});
-
-export type TPkiAlerts = z.infer<typeof PkiAlertsSchema>;
-export type TPkiAlertsInsert = Omit<z.input<typeof PkiAlertsSchema>, TImmutableDBKeys>;
-export type TPkiAlertsUpdate = Partial<Omit<z.input<typeof PkiAlertsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/pki-collection-items.ts

@@ -1,21 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const PkiCollectionItemsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  pkiCollectionId: z.string().uuid(),
-  caId: z.string().uuid().nullable().optional(),
-  certId: z.string().uuid().nullable().optional()
-});
-
-export type TPkiCollectionItems = z.infer<typeof PkiCollectionItemsSchema>;
-export type TPkiCollectionItemsInsert = Omit<z.input<typeof PkiCollectionItemsSchema>, TImmutableDBKeys>;
-export type TPkiCollectionItemsUpdate = Partial<Omit<z.input<typeof PkiCollectionItemsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/pki-collections.ts

@@ -1,21 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const PkiCollectionsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  projectId: z.string(),
-  name: z.string(),
-  description: z.string()
-});
-
-export type TPkiCollections = z.infer<typeof PkiCollectionsSchema>;
-export type TPkiCollectionsInsert = Omit<z.input<typeof PkiCollectionsSchema>, TImmutableDBKeys>;
-export type TPkiCollectionsUpdate = Partial<Omit<z.input<typeof PkiCollectionsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/project-user-additional-privilege.ts

@@ -10,7 +10,7 @@ import { TImmutableDBKeys } from "./models";
 export const ProjectUserAdditionalPrivilegeSchema = z.object({
   id: z.string().uuid(),
   slug: z.string(),
-  projectMembershipId: z.string().uuid().nullable().optional(),
+  projectMembershipId: z.string().uuid(),
   isTemporary: z.boolean().default(false),
   temporaryMode: z.string().nullable().optional(),
   temporaryRange: z.string().nullable().optional(),
@@ -18,9 +18,7 @@ export const ProjectUserAdditionalPrivilegeSchema = z.object({
   temporaryAccessEndTime: z.date().nullable().optional(),
   permissions: z.unknown(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  userId: z.string().uuid(),
-  projectId: z.string()
+  updatedAt: z.date()
 });
 
 export type TProjectUserAdditionalPrivilege = z.infer<typeof ProjectUserAdditionalPrivilegeSchema>;

backend/src/db/schemas/projects.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const ProjectsSchema = z.object({
@@ -22,8 +20,7 @@ export const ProjectsSchema = z.object({
   pitVersionLimit: z.number().default(10),
   kmsCertificateKeyId: z.string().uuid().nullable().optional(),
   auditLogsRetentionDays: z.number().nullable().optional(),
-  kmsSecretManagerKeyId: z.string().uuid().nullable().optional(),
-  kmsSecretManagerEncryptedDataKey: zodBuffer.nullable().optional()
+  kmsSecretManagerKeyId: z.string().uuid().nullable().optional()
 });
 
 export type TProjects = z.infer<typeof ProjectsSchema>;

backend/src/db/schemas/rate-limit.ts

@@ -15,6 +15,7 @@ export const RateLimitSchema = z.object({
   authRateLimit: z.number().default(60),
   inviteUserRateLimit: z.number().default(30),
   mfaRateLimit: z.number().default(20),
+  creationLimit: z.number().default(30),
   publicEndpointLimit: z.number().default(30),
   createdAt: z.date(),
   updatedAt: z.date()

backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts

@@ -1,25 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretApprovalRequestSecretTagsV2Schema = z.object({
-  id: z.string().uuid(),
-  secretId: z.string().uuid(),
-  tagId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretApprovalRequestSecretTagsV2 = z.infer<typeof SecretApprovalRequestSecretTagsV2Schema>;
-export type TSecretApprovalRequestSecretTagsV2Insert = Omit<
-  z.input<typeof SecretApprovalRequestSecretTagsV2Schema>,
-  TImmutableDBKeys
->;
-export type TSecretApprovalRequestSecretTagsV2Update = Partial<
-  Omit<z.input<typeof SecretApprovalRequestSecretTagsV2Schema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-approval-requests-secrets-v2.ts

@@ -1,37 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretApprovalRequestsSecretsV2Schema = z.object({
-  id: z.string().uuid(),
-  version: z.number().default(1).nullable().optional(),
-  key: z.string(),
-  encryptedValue: zodBuffer.nullable().optional(),
-  encryptedComment: zodBuffer.nullable().optional(),
-  reminderNote: z.string().nullable().optional(),
-  reminderRepeatDays: z.number().nullable().optional(),
-  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
-  metadata: z.unknown().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  requestId: z.string().uuid(),
-  op: z.string(),
-  secretId: z.string().uuid().nullable().optional(),
-  secretVersion: z.string().uuid().nullable().optional()
-});
-
-export type TSecretApprovalRequestsSecretsV2 = z.infer<typeof SecretApprovalRequestsSecretsV2Schema>;
-export type TSecretApprovalRequestsSecretsV2Insert = Omit<
-  z.input<typeof SecretApprovalRequestsSecretsV2Schema>,
-  TImmutableDBKeys
->;
-export type TSecretApprovalRequestsSecretsV2Update = Partial<
-  Omit<z.input<typeof SecretApprovalRequestsSecretsV2Schema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-approval-requests.ts

@@ -15,12 +15,12 @@ export const SecretApprovalRequestsSchema = z.object({
   conflicts: z.unknown().nullable().optional(),
   slug: z.string(),
   folderId: z.string().uuid(),
+  bypassReason: z.string().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date(),
   isReplicated: z.boolean().nullable().optional(),
   committerUserId: z.string().uuid(),
-  statusChangedByUserId: z.string().uuid().nullable().optional(),
-  bypassReason: z.string().nullable().optional()
+  statusChangedByUserId: z.string().uuid().nullable().optional()
 });
 
 export type TSecretApprovalRequests = z.infer<typeof SecretApprovalRequestsSchema>;

backend/src/db/schemas/secret-references-v2.ts

@@ -1,20 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretReferencesV2Schema = z.object({
-  id: z.string().uuid(),
-  environment: z.string(),
-  secretPath: z.string(),
-  secretKey: z.string(),
-  secretId: z.string().uuid()
-});
-
-export type TSecretReferencesV2 = z.infer<typeof SecretReferencesV2Schema>;
-export type TSecretReferencesV2Insert = Omit<z.input<typeof SecretReferencesV2Schema>, TImmutableDBKeys>;
-export type TSecretReferencesV2Update = Partial<Omit<z.input<typeof SecretReferencesV2Schema>, TImmutableDBKeys>>;

backend/src/db/schemas/secret-rotation-output-v2.ts

@@ -1,21 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretRotationOutputV2Schema = z.object({
-  id: z.string().uuid(),
-  key: z.string(),
-  secretId: z.string().uuid(),
-  rotationId: z.string().uuid()
-});
-
-export type TSecretRotationOutputV2 = z.infer<typeof SecretRotationOutputV2Schema>;
-export type TSecretRotationOutputV2Insert = Omit<z.input<typeof SecretRotationOutputV2Schema>, TImmutableDBKeys>;
-export type TSecretRotationOutputV2Update = Partial<
-  Omit<z.input<typeof SecretRotationOutputV2Schema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-sharing.ts

@@ -5,6 +5,8 @@
 
 import { z } from "zod";
 
+import { SecretSharingAccessType } from "@app/lib/types";
+
 import { TImmutableDBKeys } from "./models";
 
 export const SecretSharingSchema = z.object({
@@ -16,12 +18,10 @@ export const SecretSharingSchema = z.object({
   expiresAt: z.date(),
   userId: z.string().uuid().nullable().optional(),
   orgId: z.string().uuid().nullable().optional(),
+  accessType: z.nativeEnum(SecretSharingAccessType).default(SecretSharingAccessType.Organization),
   createdAt: z.date(),
   updatedAt: z.date(),
-  expiresAfterViews: z.number().nullable().optional(),
-  accessType: z.string().default("anyone"),
-  name: z.string().nullable().optional(),
-  lastViewedAt: z.date().nullable().optional()
+  expiresAfterViews: z.number().nullable().optional()
 });
 
 export type TSecretSharing = z.infer<typeof SecretSharingSchema>;

backend/src/db/schemas/secret-snapshot-secrets-v2.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretSnapshotSecretsV2Schema = z.object({
-  id: z.string().uuid(),
-  envId: z.string().uuid(),
-  secretVersionId: z.string().uuid(),
-  snapshotId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretSnapshotSecretsV2 = z.infer<typeof SecretSnapshotSecretsV2Schema>;
-export type TSecretSnapshotSecretsV2Insert = Omit<z.input<typeof SecretSnapshotSecretsV2Schema>, TImmutableDBKeys>;
-export type TSecretSnapshotSecretsV2Update = Partial<
-  Omit<z.input<typeof SecretSnapshotSecretsV2Schema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-tags.ts

@@ -9,6 +9,7 @@ import { TImmutableDBKeys } from "./models";
 
 export const SecretTagsSchema = z.object({
   id: z.string().uuid(),
+  name: z.string(),
   slug: z.string(),
   color: z.string().nullable().optional(),
   createdAt: z.date(),

backend/src/db/schemas/secret-v2-tag-junction.ts

@@ -1,18 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretV2TagJunctionSchema = z.object({
-  id: z.string().uuid(),
-  secrets_v2Id: z.string().uuid(),
-  secret_tagsId: z.string().uuid()
-});
-
-export type TSecretV2TagJunction = z.infer<typeof SecretV2TagJunctionSchema>;
-export type TSecretV2TagJunctionInsert = Omit<z.input<typeof SecretV2TagJunctionSchema>, TImmutableDBKeys>;
-export type TSecretV2TagJunctionUpdate = Partial<Omit<z.input<typeof SecretV2TagJunctionSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/secret-version-v2-tag-junction.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretVersionV2TagJunctionSchema = z.object({
-  id: z.string().uuid(),
-  secret_versions_v2Id: z.string().uuid(),
-  secret_tagsId: z.string().uuid()
-});
-
-export type TSecretVersionV2TagJunction = z.infer<typeof SecretVersionV2TagJunctionSchema>;
-export type TSecretVersionV2TagJunctionInsert = Omit<
-  z.input<typeof SecretVersionV2TagJunctionSchema>,
-  TImmutableDBKeys
->;
-export type TSecretVersionV2TagJunctionUpdate = Partial<
-  Omit<z.input<typeof SecretVersionV2TagJunctionSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-versions-v2.ts

@@ -1,33 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretVersionsV2Schema = z.object({
-  id: z.string().uuid(),
-  version: z.number().default(1),
-  type: z.string().default("shared"),
-  key: z.string(),
-  encryptedValue: zodBuffer.nullable().optional(),
-  encryptedComment: zodBuffer.nullable().optional(),
-  reminderNote: z.string().nullable().optional(),
-  reminderRepeatDays: z.number().nullable().optional(),
-  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
-  metadata: z.unknown().nullable().optional(),
-  envId: z.string().uuid().nullable().optional(),
-  secretId: z.string().uuid(),
-  folderId: z.string().uuid(),
-  userId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretVersionsV2 = z.infer<typeof SecretVersionsV2Schema>;
-export type TSecretVersionsV2Insert = Omit<z.input<typeof SecretVersionsV2Schema>, TImmutableDBKeys>;
-export type TSecretVersionsV2Update = Partial<Omit<z.input<typeof SecretVersionsV2Schema>, TImmutableDBKeys>>;

backend/src/db/schemas/secrets-v2.ts

@@ -1,31 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretsV2Schema = z.object({
-  id: z.string().uuid(),
-  version: z.number().default(1),
-  type: z.string().default("shared"),
-  key: z.string(),
-  encryptedValue: zodBuffer.nullable().optional(),
-  encryptedComment: zodBuffer.nullable().optional(),
-  reminderNote: z.string().nullable().optional(),
-  reminderRepeatDays: z.number().nullable().optional(),
-  skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
-  metadata: z.unknown().nullable().optional(),
-  userId: z.string().uuid().nullable().optional(),
-  folderId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretsV2 = z.infer<typeof SecretsV2Schema>;
-export type TSecretsV2Insert = Omit<z.input<typeof SecretsV2Schema>, TImmutableDBKeys>;
-export type TSecretsV2Update = Partial<Omit<z.input<typeof SecretsV2Schema>, TImmutableDBKeys>>;

backend/src/db/seed-data.ts

@@ -33,11 +33,6 @@ export const seedData1 = {
     name: "first project",
     slug: "first-project"
   },
-  projectV3: {
-    id: "77fa7aed-9288-401e-a4c9-3a9430be62a4",
-    name: "first project v2",
-    slug: "first-project-v2"
-  },
   environment: {
     name: "Development",
     slug: "dev"

backend/src/db/seeds/4-machine-identity.ts

@@ -86,15 +86,4 @@ export async function seed(knex: Knex): Promise<void> {
     role: ProjectMembershipRole.Admin,
     projectMembershipId: identityProjectMembership[0].id
   });
-  const identityProjectMembershipV3 = await knex(TableName.IdentityProjectMembership)
-    .insert({
-      identityId: seedData1.machineIdentity.id,
-      projectId: seedData1.projectV3.id
-    })
-    .returning("*");
-
-  await knex(TableName.IdentityProjectMembershipRole).insert({
-    role: ProjectMembershipRole.Admin,
-    projectMembershipId: identityProjectMembershipV3[0].id
-  });
 }

backend/src/db/seeds/4-project-v3.ts

@@ -1,50 +0,0 @@
-import { Knex } from "knex";
-
-import { ProjectMembershipRole, ProjectVersion, TableName } from "../schemas";
-import { seedData1 } from "../seed-data";
-
-export const DEFAULT_PROJECT_ENVS = [
-  { name: "Development", slug: "dev" },
-  { name: "Staging", slug: "staging" },
-  { name: "Production", slug: "prod" }
-];
-
-export async function seed(knex: Knex): Promise<void> {
-  const [projectV2] = await knex(TableName.Project)
-    .insert({
-      name: seedData1.projectV3.name,
-      orgId: seedData1.organization.id,
-      slug: seedData1.projectV3.slug,
-      version: ProjectVersion.V3,
-      // eslint-disable-next-line
-      // @ts-ignore
-      id: seedData1.projectV3.id
-    })
-    .returning("*");
-
-  const projectMembershipV3 = await knex(TableName.ProjectMembership)
-    .insert({
-      projectId: projectV2.id,
-      userId: seedData1.id
-    })
-    .returning("*");
-  await knex(TableName.ProjectUserMembershipRole).insert({
-    role: ProjectMembershipRole.Admin,
-    projectMembershipId: projectMembershipV3[0].id
-  });
-
-  // create default environments and default folders
-  const projectV3Envs = await knex(TableName.Environment)
-    .insert(
-      DEFAULT_PROJECT_ENVS.map(({ name, slug }, index) => ({
-        name,
-        slug,
-        projectId: seedData1.projectV3.id,
-        position: index + 1
-      }))
-    )
-    .returning("*");
-  await knex(TableName.SecretFolder).insert(
-    projectV3Envs.map(({ id }) => ({ name: "root", envId: id, parentId: null }))
-  );
-}

backend/src/ee/routes/v1/access-approval-policy-router.ts

@@ -17,11 +17,11 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
           name: z.string().optional(),
           secretPath: z.string().trim().default("/"),
           environment: z.string(),
-          approverUserIds: z.string().array().min(1),
+          approvers: z.string().array().min(1),
           approvals: z.number().min(1).default(1),
           enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
         })
-        .refine((data) => data.approvals <= data.approverUserIds.length, {
+        .refine((data) => data.approvals <= data.approvers.length, {
           path: ["approvals"],
           message: "The number of approvals should be lower than the number of approvers."
         }),
@@ -56,16 +56,7 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
       }),
       response: {
         200: z.object({
-          approvals: sapPubSchema
-            .extend({
-              userApprovers: z
-                .object({
-                  userId: z.string()
-                })
-                .array(),
-              secretPath: z.string().optional().nullable()
-            })
-            .array()
+          approvals: sapPubSchema.extend({ approvers: z.string().array(), secretPath: z.string().optional() }).array()
         })
       }
     },
@@ -78,7 +69,6 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         actorOrgId: req.permission.orgId,
         projectSlug: req.query.projectSlug
       });
-
       return { approvals };
     }
   });
@@ -127,11 +117,11 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
             .trim()
             .optional()
             .transform((val) => (val === "" ? "/" : val)),
-          approverUserIds: z.string().array().min(1),
+          approvers: z.string().array().min(1),
           approvals: z.number().min(1).default(1),
           enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard)
         })
-        .refine((data) => data.approvals <= data.approverUserIds.length, {
+        .refine((data) => data.approvals <= data.approvers.length, {
           path: ["approvals"],
           message: "The number of approvals should be lower than the number of approvers."
         }),

backend/src/ee/routes/v1/access-approval-request-router.ts

@@ -1,19 +1,10 @@
 import { z } from "zod";
 
-import { AccessApprovalRequestsReviewersSchema, AccessApprovalRequestsSchema, UsersSchema } from "@app/db/schemas";
+import { AccessApprovalRequestsReviewersSchema, AccessApprovalRequestsSchema } from "@app/db/schemas";
 import { ApprovalStatus } from "@app/ee/services/access-approval-request/access-approval-request-types";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 
-const approvalRequestUser = z.object({ userId: z.string() }).merge(
-  UsersSchema.pick({
-    email: true,
-    firstName: true,
-    lastName: true,
-    username: true
-  })
-);
-
 export const registerAccessApprovalRequestRouter = async (server: FastifyZodProvider) => {
   server.route({
     url: "/",
@@ -113,11 +104,10 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
             }),
             reviewers: z
               .object({
-                userId: z.string(),
+                member: z.string(),
                 status: z.string()
               })
-              .array(),
-            requestedByUser: approvalRequestUser
+              .array()
           }).array()
         })
       }

backend/src/ee/routes/v1/certificate-authority-crl-router.ts

@@ -1,31 +1,86 @@
-/* eslint-disable @typescript-eslint/no-floating-promises */
 import { z } from "zod";
 
-import { CA_CRLS } from "@app/lib/api-docs";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
 import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerCaCrlRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
-    url: "/:crlId",
+    url: "/:caId/crl",
     config: {
       rateLimit: readLimit
     },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Get CRL in DER format",
+      description: "Get CRL of the CA",
       params: z.object({
-        crlId: z.string().trim().describe(CA_CRLS.GET.crlId)
+        caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CRL.caId)
       }),
       response: {
-        200: z.instanceof(Buffer)
+        200: z.object({
+          crl: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CRL.crl)
+        })
       }
     },
-    handler: async (req, res) => {
-      const { crl } = await server.services.certificateAuthorityCrl.getCrlById(req.params.crlId);
+    handler: async (req) => {
+      const { crl, ca } = await server.services.certificateAuthorityCrl.getCaCrl({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
 
-      res.header("Content-Type", "application/pkix-crl");
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: ca.projectId,
+        event: {
+          type: EventType.GET_CA_CRL,
+          metadata: {
+            caId: ca.id,
+            dn: ca.dn
+          }
+        }
+      });
 
-      return Buffer.from(crl);
+      return {
+        crl
+      };
     }
   });
+
+  // server.route({
+  //   method: "GET",
+  //   url: "/:caId/crl/rotate",
+  //   config: {
+  //     rateLimit: writeLimit
+  //   },
+  //   onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+  //   schema: {
+  //     description: "Rotate CRL of the CA",
+  //     params: z.object({
+  //       caId: z.string().trim()
+  //     }),
+  //     response: {
+  //       200: z.object({
+  //         message: z.string()
+  //       })
+  //     }
+  //   },
+  //   handler: async (req) => {
+  //     await server.services.certificateAuthority.rotateCaCrl({
+  //       caId: req.params.caId,
+  //       actor: req.permission.type,
+  //       actorId: req.permission.id,
+  //       actorAuthMethod: req.permission.authMethod,
+  //       actorOrgId: req.permission.orgId
+  //     });
+  //     return {
+  //       message: "Successfully rotated CA CRL"
+  //     };
+  //   }
+  // });
 };

backend/src/ee/routes/v1/dynamic-secret-lease-router.ts

@@ -131,7 +131,7 @@ export const registerDynamicSecretLeaseRouter = async (server: FastifyZodProvide
           .default("/")
           .transform(removeTrailingSlash)
           .describe(DYNAMIC_SECRET_LEASES.RENEW.path),
-        environmentSlug: z.string().min(1).describe(DYNAMIC_SECRET_LEASES.RENEW.environmentSlug)
+        environmentSlug: z.string().min(1).describe(DYNAMIC_SECRET_LEASES.RENEW.ttl)
       }),
       response: {
         200: z.object({

backend/src/ee/routes/v1/external-kms-router.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
 
 import { ExternalKmsSchema, KmsKeysSchema } from "@app/db/schemas";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import {
   ExternalKmsAwsSchema,
   ExternalKmsInputSchema,
@@ -20,23 +19,6 @@ const sanitizedExternalSchema = KmsKeysSchema.extend({
   })
 });
 
-const sanitizedExternalSchemaForGetAll = KmsKeysSchema.pick({
-  id: true,
-  description: true,
-  isDisabled: true,
-  createdAt: true,
-  updatedAt: true,
-  slug: true
-})
-  .extend({
-    externalKms: ExternalKmsSchema.pick({
-      provider: true,
-      status: true,
-      statusDetails: true
-    })
-  })
-  .array();
-
 const sanitizedExternalSchemaForGetById = KmsKeysSchema.extend({
   external: ExternalKmsSchema.pick({
     id: true,
@@ -57,8 +39,8 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        slug: z.string().min(1).trim().toLowerCase(),
-        description: z.string().trim().optional(),
+        slug: z.string().min(1).trim().toLowerCase().optional(),
+        description: z.string().min(1).trim().optional(),
         provider: ExternalKmsInputSchema
       }),
       response: {
@@ -78,21 +60,6 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
         provider: req.body.provider,
         description: req.body.description
       });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: req.permission.orgId,
-        event: {
-          type: EventType.CREATE_KMS,
-          metadata: {
-            kmsId: externalKms.id,
-            provider: req.body.provider.type,
-            slug: req.body.slug,
-            description: req.body.description
-          }
-        }
-      });
-
       return { externalKms };
     }
   });
@@ -109,7 +76,7 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
       }),
       body: z.object({
         slug: z.string().min(1).trim().toLowerCase().optional(),
-        description: z.string().trim().optional(),
+        description: z.string().min(1).trim().optional(),
         provider: ExternalKmsInputUpdateSchema
       }),
       response: {
@@ -130,21 +97,6 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
         description: req.body.description,
         id: req.params.id
       });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: req.permission.orgId,
-        event: {
-          type: EventType.UPDATE_KMS,
-          metadata: {
-            kmsId: externalKms.id,
-            provider: req.body.provider.type,
-            slug: req.body.slug,
-            description: req.body.description
-          }
-        }
-      });
-
       return { externalKms };
     }
   });
@@ -174,19 +126,6 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
         actorOrgId: req.permission.orgId,
         id: req.params.id
       });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: req.permission.orgId,
-        event: {
-          type: EventType.DELETE_KMS,
-          metadata: {
-            kmsId: externalKms.id,
-            slug: externalKms.slug
-          }
-        }
-      });
-
       return { externalKms };
     }
   });
@@ -216,48 +155,10 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => {
         actorOrgId: req.permission.orgId,
         id: req.params.id
       });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: req.permission.orgId,
-        event: {
-          type: EventType.GET_KMS,
-          metadata: {
-            kmsId: externalKms.id,
-            slug: externalKms.slug
-          }
-        }
-      });
-
       return { externalKms };
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      response: {
-        200: z.object({
-          externalKmsList: sanitizedExternalSchemaForGetAll
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const externalKmsList = await server.services.externalKms.list({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-      return { externalKmsList };
-    }
-  });
-
   server.route({
     method: "GET",
     url: "/slug/:slug",

backend/src/ee/routes/v1/index.ts

@@ -4,7 +4,6 @@ import { registerAuditLogStreamRouter } from "./audit-log-stream-router";
 import { registerCaCrlRouter } from "./certificate-authority-crl-router";
 import { registerDynamicSecretLeaseRouter } from "./dynamic-secret-lease-router";
 import { registerDynamicSecretRouter } from "./dynamic-secret-router";
-import { registerExternalKmsRouter } from "./external-kms-router";
 import { registerGroupRouter } from "./group-router";
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
 import { registerLdapRouter } from "./ldap-router";
@@ -61,7 +60,7 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
 
   await server.register(
     async (pkiRouter) => {
-      await pkiRouter.register(registerCaCrlRouter, { prefix: "/crl" });
+      await pkiRouter.register(registerCaCrlRouter, { prefix: "/ca" });
     },
     { prefix: "/pki" }
   );
@@ -88,8 +87,4 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
     },
     { prefix: "/additional-privilege" }
   );
-
-  await server.register(registerExternalKmsRouter, {
-    prefix: "/external-kms"
-  });
 };

backend/src/ee/routes/v1/org-role-router.ts

@@ -107,7 +107,7 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
           }),
         name: z.string().trim().optional(),
         description: z.string().trim().optional(),
-        permissions: z.any().array().optional()
+        permissions: z.any().array()
       }),
       response: {
         200: z.object({

backend/src/ee/routes/v1/project-role-router.ts

@@ -101,7 +101,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
             message: "Slug must be a valid"
           }),
         name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
-        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
+        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.UPDATE.permissions)
       }),
       response: {
         200: z.object({
@@ -120,7 +120,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
         roleId: req.params.roleId,
         data: {
           ...req.body,
-          permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
+          permissions: JSON.stringify(packRules(req.body.permissions))
         }
       });
       return { role };

backend/src/ee/routes/v1/project-router.ts

@@ -4,10 +4,9 @@ import { AuditLogsSchema, SecretSnapshotsSchema } from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
 import { AUDIT_LOGS, PROJECTS } from "@app/lib/api-docs";
 import { getLastMidnightDateISO, removeTrailingSlash } from "@app/lib/fn";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { KmsType } from "@app/services/kms/kms-types";
 
 export const registerProjectRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -172,212 +171,4 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async () => ({ actors: [] })
   });
-
-  server.route({
-    method: "GET",
-    url: "/:workspaceId/kms",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          secretManagerKmsKey: z.object({
-            id: z.string(),
-            slug: z.string(),
-            isExternal: z.boolean()
-          })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const kmsKey = await server.services.project.getProjectKmsKeys({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId
-      });
-
-      return kmsKey;
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:workspaceId/kms",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      body: z.object({
-        kms: z.discriminatedUnion("type", [
-          z.object({ type: z.literal(KmsType.Internal) }),
-          z.object({ type: z.literal(KmsType.External), kmsId: z.string() })
-        ])
-      }),
-      response: {
-        200: z.object({
-          secretManagerKmsKey: z.object({
-            id: z.string(),
-            slug: z.string(),
-            isExternal: z.boolean()
-          })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { secretManagerKmsKey } = await server.services.project.updateProjectKmsKey({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId,
-        ...req.body
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.params.workspaceId,
-        event: {
-          type: EventType.UPDATE_PROJECT_KMS,
-          metadata: {
-            secretManagerKmsKey: {
-              id: secretManagerKmsKey.id,
-              slug: secretManagerKmsKey.slug
-            }
-          }
-        }
-      });
-
-      return {
-        secretManagerKmsKey
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:workspaceId/kms/backup",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          secretManager: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const backup = await server.services.project.getProjectKmsBackup({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.params.workspaceId,
-        event: {
-          type: EventType.GET_PROJECT_KMS_BACKUP,
-          metadata: {}
-        }
-      });
-
-      return backup;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/:workspaceId/kms/backup",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      body: z.object({
-        backup: z.string().min(1)
-      }),
-      response: {
-        200: z.object({
-          secretManagerKmsKey: z.object({
-            id: z.string(),
-            slug: z.string(),
-            isExternal: z.boolean()
-          })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const backup = await server.services.project.loadProjectKmsBackup({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId,
-        backup: req.body.backup
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.params.workspaceId,
-        event: {
-          type: EventType.LOAD_PROJECT_KMS_BACKUP,
-          metadata: {}
-        }
-      });
-
-      return backup;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/:workspaceId/migrate-v3",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-
-      response: {
-        200: z.object({
-          message: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const migration = await server.services.secret.startSecretV2Migration({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId
-      });
-
-      return migration;
-    }
-  });
 };

backend/src/ee/routes/v1/rate-limit-router.ts

@@ -58,6 +58,7 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => {
         authRateLimit: z.number(),
         inviteUserRateLimit: z.number(),
         mfaRateLimit: z.number(),
+        creationLimit: z.number(),
         publicEndpointLimit: z.number()
       }),
       response: {

backend/src/ee/routes/v1/secret-approval-request-router.ts

@@ -3,14 +3,16 @@ import { z } from "zod";
 import {
   SecretApprovalRequestsReviewersSchema,
   SecretApprovalRequestsSchema,
+  SecretApprovalRequestsSecretsSchema,
+  SecretsSchema,
   SecretTagsSchema,
+  SecretVersionsSchema,
   UsersSchema
 } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApprovalStatus, RequestState } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 const approvalRequestUser = z.object({ userId: z.string() }).merge(
@@ -259,32 +261,46 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
               committerUser: approvalRequestUser,
               reviewers: approvalRequestUser.extend({ status: z.string() }).array(),
               secretPath: z.string(),
-              commits: secretRawSchema
-                .omit({ _id: true, environment: true, workspace: true, type: true, version: true })
-                .extend({
-                  op: z.string(),
-                  tags: tagSchema,
-                  secret: z
-                    .object({
-                      id: z.string(),
-                      version: z.number(),
-                      secretKey: z.string(),
-                      secretValue: z.string().optional(),
-                      secretComment: z.string().optional()
+              commits: SecretApprovalRequestsSecretsSchema.omit({ secretBlindIndex: true })
+                .merge(
+                  z.object({
+                    tags: tagSchema,
+                    secret: SecretsSchema.pick({
+                      id: true,
+                      version: true,
+                      secretKeyIV: true,
+                      secretKeyTag: true,
+                      secretKeyCiphertext: true,
+                      secretValueIV: true,
+                      secretValueTag: true,
+                      secretValueCiphertext: true,
+                      secretCommentIV: true,
+                      secretCommentTag: true,
+                      secretCommentCiphertext: true
                     })
-                    .optional()
-                    .nullable(),
-                  secretVersion: z
-                    .object({
-                      id: z.string(),
-                      version: z.number(),
-                      secretKey: z.string(),
-                      secretValue: z.string().optional(),
-                      secretComment: z.string().optional(),
-                      tags: tagSchema
+                      .optional()
+                      .nullable(),
+                    secretVersion: SecretVersionsSchema.pick({
+                      id: true,
+                      version: true,
+                      secretKeyIV: true,
+                      secretKeyTag: true,
+                      secretKeyCiphertext: true,
+                      secretValueIV: true,
+                      secretValueTag: true,
+                      secretValueCiphertext: true,
+                      secretCommentIV: true,
+                      secretCommentTag: true,
+                      secretCommentCiphertext: true
                     })
-                    .optional()
-                })
+                      .merge(
+                        z.object({
+                          tags: tagSchema
+                        })
+                      )
+                      .optional()
+                  })
+                )
                 .array()
             })
           )

backend/src/ee/routes/v1/secret-rotation-router.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { SecretRotationOutputsSchema, SecretRotationsSchema } from "@app/db/schemas";
+import { SecretRotationOutputsSchema, SecretRotationsSchema, SecretsSchema } from "@app/db/schemas";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -112,10 +112,18 @@ export const registerSecretRotationRouter = async (server: FastifyZodProvider) =
               outputs: z
                 .object({
                   key: z.string(),
-                  secret: z.object({
-                    secretKey: z.string(),
-                    id: z.string(),
-                    version: z.number()
+                  secret: SecretsSchema.pick({
+                    id: true,
+                    version: true,
+                    secretKeyIV: true,
+                    secretKeyTag: true,
+                    secretKeyCiphertext: true,
+                    secretValueIV: true,
+                    secretValueTag: true,
+                    secretValueCiphertext: true,
+                    secretCommentIV: true,
+                    secretCommentTag: true,
+                    secretCommentCiphertext: true
                   })
                 })
                 .array()

backend/src/ee/routes/v1/secret-version-router.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 
+import { SecretVersionsSchema } from "@app/db/schemas";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerSecretVersionRouter = async (server: FastifyZodProvider) => {
@@ -22,7 +22,7 @@ export const registerSecretVersionRouter = async (server: FastifyZodProvider) =>
       }),
       response: {
         200: z.object({
-          secretVersions: secretRawSchema.array()
+          secretVersions: SecretVersionsSchema.omit({ secretBlindIndex: true }).array()
         })
       }
     },

backend/src/ee/routes/v1/snapshot-router.ts

@@ -1,10 +1,9 @@
 import { z } from "zod";
 
-import { SecretSnapshotsSchema, SecretTagsSchema } from "@app/db/schemas";
+import { SecretSnapshotsSchema, SecretTagsSchema, SecretVersionsSchema } from "@app/db/schemas";
 import { PROJECTS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerSnapshotRouter = async (server: FastifyZodProvider) => {
@@ -28,17 +27,17 @@ export const registerSnapshotRouter = async (server: FastifyZodProvider) => {
               slug: z.string(),
               name: z.string()
             }),
-            secretVersions: secretRawSchema
-              .omit({ _id: true, environment: true, workspace: true, type: true })
-              .extend({
-                secretId: z.string(),
-                tags: SecretTagsSchema.pick({
-                  id: true,
-                  slug: true,
-                  name: true,
-                  color: true
-                }).array()
-              })
+            secretVersions: SecretVersionsSchema.omit({ secretBlindIndex: true })
+              .merge(
+                z.object({
+                  tags: SecretTagsSchema.pick({
+                    id: true,
+                    slug: true,
+                    name: true,
+                    color: true
+                  }).array()
+                })
+              )
               .array(),
             folderVersion: z.object({ id: z.string(), name: z.string() }).array(),
             createdAt: z.date(),

backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts

@@ -1,9 +1,9 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies } from "@app/db/schemas";
+import { TableName, TAccessApprovalPolicies } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
+import { buildFindFilter, mergeOneToManyRelation, ormify, selectAllTableCols, TFindFilter } from "@app/lib/knex";
 
 export type TAccessApprovalPolicyDALFactory = ReturnType<typeof accessApprovalPolicyDALFactory>;
 
@@ -15,12 +15,12 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
       // eslint-disable-next-line
       .where(buildFindFilter(filter))
       .join(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
-      .leftJoin(
+      .join(
         TableName.AccessApprovalPolicyApprover,
         `${TableName.AccessApprovalPolicy}.id`,
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
-      .select(tx.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
+      .select(tx.ref("approverId").withSchema(TableName.AccessApprovalPolicyApprover))
       .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
       .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
       .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
@@ -35,30 +35,18 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
       const doc = await accessApprovalPolicyFindQuery(tx || db.replicaNode(), {
         [`${TableName.AccessApprovalPolicy}.id` as "id"]: id
       });
-      const formattedDoc = sqlNestRelationships({
-        data: doc,
-        key: "id",
-        parentMapper: (data) => ({
-          environment: {
-            id: data.envId,
-            name: data.envName,
-            slug: data.envSlug
-          },
-          projectId: data.projectId,
-          ...AccessApprovalPoliciesSchema.parse(data)
+      const formatedDoc = mergeOneToManyRelation(
+        doc,
+        "id",
+        ({ approverId, envId, envName: name, envSlug: slug, ...el }) => ({
+          ...el,
+          envId,
+          environment: { id: envId, name, slug }
         }),
-        childrenMapper: [
-          {
-            key: "approverUserId",
-            label: "userApprovers" as const,
-            mapper: ({ approverUserId }) => ({
-              userId: approverUserId
-            })
-          }
-        ]
-      });
-
-      return formattedDoc?.[0];
+        ({ approverId }) => approverId,
+        "approvers"
+      );
+      return formatedDoc?.[0];
     } catch (error) {
       throw new DatabaseError({ error, name: "FindById" });
     }
@@ -67,32 +55,18 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
   const find = async (filter: TFindFilter<TAccessApprovalPolicies & { projectId: string }>, tx?: Knex) => {
     try {
       const docs = await accessApprovalPolicyFindQuery(tx || db.replicaNode(), filter);
-
-      const formattedDocs = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (data) => ({
-          environment: {
-            id: data.envId,
-            name: data.envName,
-            slug: data.envSlug
-          },
-          projectId: data.projectId,
-          ...AccessApprovalPoliciesSchema.parse(data)
-          // secretPath: data.secretPath || undefined,
+      const formatedDoc = mergeOneToManyRelation(
+        docs,
+        "id",
+        ({ approverId, envId, envName: name, envSlug: slug, ...el }) => ({
+          ...el,
+          envId,
+          environment: { id: envId, name, slug }
         }),
-        childrenMapper: [
-          {
-            key: "approverUserId",
-            label: "userApprovers" as const,
-            mapper: ({ approverUserId }) => ({
-              userId: approverUserId
-            })
-          }
-        ]
-      });
-
-      return formattedDocs;
+        ({ approverId }) => approverId,
+        "approvers"
+      );
+      return formatedDoc.map((policy) => ({ ...policy, secretPath: policy.secretPath || undefined }));
     } catch (error) {
       throw new DatabaseError({ error, name: "Find" });
     }

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -34,7 +34,8 @@ export const accessApprovalPolicyServiceFactory = ({
   accessApprovalPolicyApproverDAL,
   permissionService,
   projectEnvDAL,
-  projectDAL
+  projectDAL,
+  projectMembershipDAL
 }: TSecretApprovalPolicyServiceFactoryDep) => {
   const createAccessApprovalPolicy = async ({
     name,
@@ -44,7 +45,7 @@ export const accessApprovalPolicyServiceFactory = ({
     secretPath,
     actorAuthMethod,
     approvals,
-    approverUserIds,
+    approvers,
     projectSlug,
     environment,
     enforcementLevel
@@ -52,7 +53,7 @@ export const accessApprovalPolicyServiceFactory = ({
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
 
-    if (approvals > approverUserIds.length)
+    if (approvals > approvers.length)
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -69,6 +70,15 @@ export const accessApprovalPolicyServiceFactory = ({
     const env = await projectEnvDAL.findOne({ slug: environment, projectId: project.id });
     if (!env) throw new BadRequestError({ message: "Environment not found" });
 
+    const secretApprovers = await projectMembershipDAL.find({
+      projectId: project.id,
+      $in: { id: approvers }
+    });
+
+    if (secretApprovers.length !== approvers.length) {
+      throw new BadRequestError({ message: "Approver not found in project" });
+    }
+
     await verifyApprovers({
       projectId: project.id,
       orgId: actorOrgId,
@@ -76,7 +86,7 @@ export const accessApprovalPolicyServiceFactory = ({
       secretPath,
       actorAuthMethod,
       permissionService,
-      userIds: approverUserIds
+      userIds: secretApprovers.map((approver) => approver.userId)
     });
 
     const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => {
@@ -91,8 +101,8 @@ export const accessApprovalPolicyServiceFactory = ({
         tx
       );
       await accessApprovalPolicyApproverDAL.insertMany(
-        approverUserIds.map((userId) => ({
-          approverUserId: userId,
+        secretApprovers.map(({ id }) => ({
+          approverId: id,
           policyId: doc.id
         })),
         tx
@@ -128,7 +138,7 @@ export const accessApprovalPolicyServiceFactory = ({
 
   const updateAccessApprovalPolicy = async ({
     policyId,
-    approverUserIds,
+    approvers,
     secretPath,
     name,
     actorId,
@@ -161,7 +171,16 @@ export const accessApprovalPolicyServiceFactory = ({
         },
         tx
       );
-      if (approverUserIds) {
+      if (approvers) {
+        // Find the workspace project memberships of the users passed in the approvers array
+        const secretApprovers = await projectMembershipDAL.find(
+          {
+            projectId: accessApprovalPolicy.projectId,
+            $in: { id: approvers }
+          },
+          { tx }
+        );
+
         await verifyApprovers({
           projectId: accessApprovalPolicy.projectId,
           orgId: actorOrgId,
@@ -169,13 +188,15 @@ export const accessApprovalPolicyServiceFactory = ({
           secretPath: doc.secretPath!,
           actorAuthMethod,
           permissionService,
-          userIds: approverUserIds
+          userIds: secretApprovers.map((approver) => approver.userId)
         });
 
+        if (secretApprovers.length !== approvers.length)
+          throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
         await accessApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
         await accessApprovalPolicyApproverDAL.insertMany(
-          approverUserIds.map((userId) => ({
-            approverUserId: userId,
+          secretApprovers.map(({ id }) => ({
+            approverId: id,
             policyId: doc.id
           })),
           tx

backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts

@@ -17,7 +17,7 @@ export type TCreateAccessApprovalPolicy = {
   approvals: number;
   secretPath: string;
   environment: string;
-  approverUserIds: string[];
+  approvers: string[];
   projectSlug: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -26,7 +26,7 @@ export type TCreateAccessApprovalPolicy = {
 export type TUpdateAccessApprovalPolicy = {
   policyId: string;
   approvals?: number;
-  approverUserIds?: string[];
+  approvers?: string[];
   secretPath?: string;
   name?: string;
   enforcementLevel?: EnforcementLevel;

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -1,7 +1,7 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessApprovalRequestsSchema, TableName, TAccessApprovalRequests, TUsers } from "@app/db/schemas";
+import { AccessApprovalRequestsSchema, TableName, TAccessApprovalRequests } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
@@ -40,12 +40,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.AccessApprovalPolicyApprover}.policyId`
         )
 
-        .join<TUsers>(
-          db(TableName.Users).as("requestedByUser"),
-          `${TableName.AccessApprovalRequest}.requestedByUserId`,
-          `requestedByUser.id`
-        )
-
         .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
 
         .select(selectAllTableCols(TableName.AccessApprovalRequest))
@@ -58,7 +52,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
           db.ref("envId").withSchema(TableName.AccessApprovalPolicy).as("policyEnvId")
         )
 
-        .select(db.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
+        .select(db.ref("approverId").withSchema(TableName.AccessApprovalPolicyApprover))
 
         .select(
           db.ref("projectId").withSchema(TableName.Environment),
@@ -67,20 +61,15 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         )
 
         .select(
-          db.ref("reviewerUserId").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerUserId"),
+          db.ref("member").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerMemberId"),
           db.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus")
         )
 
-        // TODO: ADD SUPPORT FOR GROUPS!!!!
         .select(
-          db.ref("email").withSchema("requestedByUser").as("requestedByUserEmail"),
-          db.ref("username").withSchema("requestedByUser").as("requestedByUserUsername"),
-          db.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
-          db.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),
-
-          db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeUserId"),
-          db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeMembershipId"),
-
+          db
+            .ref("projectMembershipId")
+            .withSchema(TableName.ProjectUserAdditionalPrivilege)
+            .as("privilegeMembershipId"),
           db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeIsTemporary"),
           db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryMode"),
           db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("privilegeTemporaryRange"),
@@ -113,18 +102,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
             enforcementLevel: doc.policyEnforcementLevel,
             envId: doc.policyEnvId
           },
-          requestedByUser: {
-            userId: doc.requestedByUserId,
-            email: doc.requestedByUserEmail,
-            firstName: doc.requestedByUserFirstName,
-            lastName: doc.requestedByUserLastName,
-            username: doc.requestedByUserUsername
-          },
           privilege: doc.privilegeId
             ? {
                 membershipId: doc.privilegeMembershipId,
-                userId: doc.privilegeUserId,
-                projectId: doc.projectId,
                 isTemporary: doc.privilegeIsTemporary,
                 temporaryMode: doc.privilegeTemporaryMode,
                 temporaryRange: doc.privilegeTemporaryRange,
@@ -138,11 +118,11 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         }),
         childrenMapper: [
           {
-            key: "reviewerUserId",
+            key: "reviewerMemberId",
             label: "reviewers" as const,
-            mapper: ({ reviewerUserId: userId, reviewerStatus: status }) => (userId ? { userId, status } : undefined)
+            mapper: ({ reviewerMemberId: member, reviewerStatus: status }) => (member ? { member, status } : undefined)
           },
-          { key: "approverUserId", label: "approvers" as const, mapper: ({ approverUserId }) => approverUserId }
+          { key: "approverId", label: "approvers" as const, mapper: ({ approverId }) => approverId }
         ]
       });
 
@@ -166,65 +146,30 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicy}.id`
       )
 
-      .join<TUsers>(
-        db(TableName.Users).as("requestedByUser"),
-        `${TableName.AccessApprovalRequest}.requestedByUserId`,
-        `requestedByUser.id`
-      )
-
       .join(
         TableName.AccessApprovalPolicyApprover,
         `${TableName.AccessApprovalPolicy}.id`,
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
-
-      .join<TUsers>(
-        db(TableName.Users).as("accessApprovalPolicyApproverUser"),
-        `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
-        "accessApprovalPolicyApproverUser.id"
-      )
-
       .leftJoin(
         TableName.AccessApprovalRequestReviewer,
         `${TableName.AccessApprovalRequest}.id`,
         `${TableName.AccessApprovalRequestReviewer}.requestId`
       )
 
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("accessApprovalReviewerUser"),
-        `${TableName.AccessApprovalRequestReviewer}.reviewerUserId`,
-        `accessApprovalReviewerUser.id`
-      )
-
       .leftJoin(TableName.Environment, `${TableName.AccessApprovalPolicy}.envId`, `${TableName.Environment}.id`)
       .select(selectAllTableCols(TableName.AccessApprovalRequest))
       .select(
-        tx.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover),
-        tx.ref("email").withSchema("accessApprovalPolicyApproverUser").as("approverEmail"),
-        tx.ref("username").withSchema("accessApprovalPolicyApproverUser").as("approverUsername"),
-        tx.ref("firstName").withSchema("accessApprovalPolicyApproverUser").as("approverFirstName"),
-        tx.ref("lastName").withSchema("accessApprovalPolicyApproverUser").as("approverLastName"),
-        tx.ref("email").withSchema("requestedByUser").as("requestedByUserEmail"),
-        tx.ref("username").withSchema("requestedByUser").as("requestedByUserUsername"),
-        tx.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
-        tx.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),
-
-        tx.ref("reviewerUserId").withSchema(TableName.AccessApprovalRequestReviewer),
-
+        tx.ref("member").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerMemberId"),
         tx.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus"),
-
-        tx.ref("email").withSchema("accessApprovalReviewerUser").as("reviewerEmail"),
-        tx.ref("username").withSchema("accessApprovalReviewerUser").as("reviewerUsername"),
-        tx.ref("firstName").withSchema("accessApprovalReviewerUser").as("reviewerFirstName"),
-        tx.ref("lastName").withSchema("accessApprovalReviewerUser").as("reviewerLastName"),
-
         tx.ref("id").withSchema(TableName.AccessApprovalPolicy).as("policyId"),
         tx.ref("name").withSchema(TableName.AccessApprovalPolicy).as("policyName"),
         tx.ref("projectId").withSchema(TableName.Environment),
         tx.ref("slug").withSchema(TableName.Environment).as("environment"),
         tx.ref("secretPath").withSchema(TableName.AccessApprovalPolicy).as("policySecretPath"),
         tx.ref("enforcementLevel").withSchema(TableName.AccessApprovalPolicy).as("policyEnforcementLevel"),
-        tx.ref("approvals").withSchema(TableName.AccessApprovalPolicy).as("policyApprovals")
+        tx.ref("approvals").withSchema(TableName.AccessApprovalPolicy).as("policyApprovals"),
+        tx.ref("approverId").withSchema(TableName.AccessApprovalPolicyApprover)
       );
 
   const findById = async (id: string, tx?: Knex) => {
@@ -244,45 +189,15 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
             approvals: el.policyApprovals,
             secretPath: el.policySecretPath,
             enforcementLevel: el.policyEnforcementLevel
-          },
-          requestedByUser: {
-            userId: el.requestedByUserId,
-            email: el.requestedByUserEmail,
-            firstName: el.requestedByUserFirstName,
-            lastName: el.requestedByUserLastName,
-            username: el.requestedByUserUsername
           }
         }),
         childrenMapper: [
           {
-            key: "reviewerUserId",
+            key: "reviewerMemberId",
             label: "reviewers" as const,
-            mapper: ({
-              reviewerUserId: userId,
-              reviewerStatus: status,
-              reviewerEmail: email,
-              reviewerLastName: lastName,
-              reviewerUsername: username,
-              reviewerFirstName: firstName
-            }) => (userId ? { userId, status, email, firstName, lastName, username } : undefined)
+            mapper: ({ reviewerMemberId: member, reviewerStatus: status }) => (member ? { member, status } : undefined)
           },
-          {
-            key: "approverUserId",
-            label: "approvers" as const,
-            mapper: ({
-              approverUserId,
-              approverEmail: email,
-              approverUsername: username,
-              approverLastName: lastName,
-              approverFirstName: firstName
-            }) => ({
-              userId: approverUserId,
-              email,
-              firstName,
-              lastName,
-              username
-            })
-          }
+          { key: "approverId", label: "approvers" as const, mapper: ({ approverId }) => approverId }
         ]
       });
       if (!formatedDoc?.[0]) return;
@@ -320,7 +235,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         .where(`${TableName.Environment}.projectId`, projectId)
         .select(selectAllTableCols(TableName.AccessApprovalRequest))
         .select(db.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus"))
-        .select(db.ref("reviewerUserId").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerUserId"));
+        .select(db.ref("member").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerMemberId"));
 
       const formattedRequests = sqlNestRelationships({
         data: accessRequests,
@@ -330,10 +245,9 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         }),
         childrenMapper: [
           {
-            key: "reviewerUserId",
+            key: "reviewerMemberId",
             label: "reviewers" as const,
-            mapper: ({ reviewerUserId: reviewer, reviewerStatus: status }) =>
-              reviewer ? { reviewer, status } : undefined
+            mapper: ({ reviewerMemberId: member, reviewerStatus: status }) => (member ? { member, status } : undefined)
           }
         ]
       });

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -52,10 +52,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
   >;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById">;
   smtpService: Pick<TSmtpService, "sendMail">;
-  userDAL: Pick<
-    TUserDALFactory,
-    "findUserByProjectMembershipId" | "findUsersByProjectMembershipIds" | "find" | "findById"
-  >;
+  userDAL: Pick<TUserDALFactory, "findUserByProjectMembershipId" | "findUsersByProjectMembershipIds">;
 };
 
 export type TAccessApprovalRequestServiceFactory = ReturnType<typeof accessApprovalRequestServiceFactory>;
@@ -97,7 +94,7 @@ export const accessApprovalRequestServiceFactory = ({
     );
     if (!membership) throw new UnauthorizedError({ message: "You are not a member of this project" });
 
-    const requestedByUser = await userDAL.findById(actorId);
+    const requestedByUser = await userDAL.findUserByProjectMembershipId(membership.id);
     if (!requestedByUser) throw new UnauthorizedError({ message: "User not found" });
 
     await projectDAL.checkProjectUpgradeStatus(project.id);
@@ -117,15 +114,13 @@ export const accessApprovalRequestServiceFactory = ({
       policyId: policy.id
     });
 
-    const approverUsers = await userDAL.find({
-      $in: {
-        id: approvers.map((approver) => approver.approverUserId)
-      }
-    });
+    const approverUsers = await userDAL.findUsersByProjectMembershipIds(
+      approvers.map((approver) => approver.approverId)
+    );
 
     const duplicateRequests = await accessApprovalRequestDAL.find({
       policyId: policy.id,
-      requestedByUserId: actorId,
+      requestedBy: membership.id,
       permissions: JSON.stringify(requestedPermissions),
       isTemporary
     });
@@ -158,7 +153,7 @@ export const accessApprovalRequestServiceFactory = ({
       const approvalRequest = await accessApprovalRequestDAL.create(
         {
           policyId: policy.id,
-          requestedByUserId: actorId,
+          requestedBy: membership.id,
           temporaryRange: temporaryRange || null,
           permissions: JSON.stringify(requestedPermissions),
           isTemporary
@@ -217,7 +212,7 @@ export const accessApprovalRequestServiceFactory = ({
     let requests = await accessApprovalRequestDAL.findRequestsWithPrivilegeByPolicyIds(policies.map((p) => p.id));
 
     if (authorProjectMembershipId) {
-      requests = requests.filter((request) => request.requestedByUserId === actorId);
+      requests = requests.filter((request) => request.requestedBy === authorProjectMembershipId);
     }
 
     if (envSlug) {
@@ -251,8 +246,8 @@ export const accessApprovalRequestServiceFactory = ({
 
     if (
       !hasRole(ProjectMembershipRole.Admin) &&
-      accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user
-      !policy.approvers.find((approver) => approver.userId === actorId) // The request isn't performed by an assigned approver
+      accessApprovalRequest.requestedBy !== membership.id && // The request wasn't made by the current user
+      !policy.approvers.find((approverId) => approverId === membership.id) // The request isn't performed by an assigned approver
     ) {
       throw new UnauthorizedError({ message: "You are not authorized to approve this request" });
     }
@@ -278,7 +273,7 @@ export const accessApprovalRequestServiceFactory = ({
       const review = await accessApprovalRequestReviewerDAL.findOne(
         {
           requestId: accessApprovalRequest.id,
-          reviewerUserId: actorId
+          member: membership.id
         },
         tx
       );
@@ -287,7 +282,7 @@ export const accessApprovalRequestServiceFactory = ({
           {
             status,
             requestId: accessApprovalRequest.id,
-            reviewerUserId: actorId
+            member: membership.id
           },
           tx
         );
@@ -308,8 +303,7 @@ export const accessApprovalRequestServiceFactory = ({
             // Permanent access
             const privilege = await additionalPrivilegeDAL.create(
               {
-                userId: accessApprovalRequest.requestedByUserId,
-                projectId: accessApprovalRequest.projectId,
+                projectMembershipId: accessApprovalRequest.requestedBy,
                 slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                 permissions: JSON.stringify(accessApprovalRequest.permissions)
               },
@@ -323,8 +317,7 @@ export const accessApprovalRequestServiceFactory = ({
 
             const privilege = await additionalPrivilegeDAL.create(
               {
-                userId: accessApprovalRequest.requestedByUserId,
-                projectId: accessApprovalRequest.projectId,
+                projectMembershipId: accessApprovalRequest.requestedBy,
                 slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                 permissions: JSON.stringify(accessApprovalRequest.permissions),
                 isTemporary: true,

backend/src/ee/services/audit-log/audit-log-dal.ts

@@ -75,16 +75,15 @@ export const auditLogDALFactory = (db: TDbClient) => {
           .del()
           .returning("id");
         numberOfRetryOnFailure = 0; // reset
+        // eslint-disable-next-line no-await-in-loop
+        await new Promise((resolve) => {
+          setTimeout(resolve, 100); // time to breathe for db
+        });
       } catch (error) {
         numberOfRetryOnFailure += 1;
         logger.error(error, "Failed to delete audit log on pruning");
-      } finally {
-        // eslint-disable-next-line no-await-in-loop
-        await new Promise((resolve) => {
-          setTimeout(resolve, 10); // time to breathe for db
-        });
       }
-    } while (deletedAuditLogIds.length > 0 || numberOfRetryOnFailure < MAX_RETRY_ON_FAILURE);
+    } while (deletedAuditLogIds.length > 0 && numberOfRetryOnFailure < MAX_RETRY_ON_FAILURE);
   };
 
   return { ...auditLogOrm, pruneAuditLog, find };

backend/src/ee/services/audit-log/audit-log-service.ts

@@ -1,6 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
 
-import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 
 import { TPermissionServiceFactory } from "../permission/permission-service";
@@ -62,10 +61,6 @@ export const auditLogServiceFactory = ({
   };
 
   const createAuditLog = async (data: TCreateAuditLogDTO) => {
-    const appCfg = getConfig();
-    if (appCfg.DISABLE_AUDIT_LOG_GENERATION) {
-      return;
-    }
     // add all cases in which project id or org id cannot be added
     if (data.event.type !== EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH) {
       if (!data.projectId && !data.orgId) throw new BadRequestError({ message: "Must either project id or org id" });

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -2,7 +2,6 @@ import { TProjectPermission } from "@app/lib/types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
-import { PkiItemType } from "@app/services/pki-collection/pki-collection-types";
 
 export type TListProjectAuditLogDTO = {
   auditLogActor?: string;
@@ -131,42 +130,16 @@ export enum EventType {
   GET_CA = "get-certificate-authority",
   UPDATE_CA = "update-certificate-authority",
   DELETE_CA = "delete-certificate-authority",
-  RENEW_CA = "renew-certificate-authority",
   GET_CA_CSR = "get-certificate-authority-csr",
-  GET_CA_CERTS = "get-certificate-authority-certs",
   GET_CA_CERT = "get-certificate-authority-cert",
   SIGN_INTERMEDIATE = "sign-intermediate",
   IMPORT_CA_CERT = "import-certificate-authority-cert",
-  GET_CA_CRLS = "get-certificate-authority-crls",
+  GET_CA_CRL = "get-certificate-authority-crl",
   ISSUE_CERT = "issue-cert",
-  SIGN_CERT = "sign-cert",
   GET_CERT = "get-cert",
   DELETE_CERT = "delete-cert",
   REVOKE_CERT = "revoke-cert",
-  GET_CERT_BODY = "get-cert-body",
-  CREATE_PKI_ALERT = "create-pki-alert",
-  GET_PKI_ALERT = "get-pki-alert",
-  UPDATE_PKI_ALERT = "update-pki-alert",
-  DELETE_PKI_ALERT = "delete-pki-alert",
-  CREATE_PKI_COLLECTION = "create-pki-collection",
-  GET_PKI_COLLECTION = "get-pki-collection",
-  UPDATE_PKI_COLLECTION = "update-pki-collection",
-  DELETE_PKI_COLLECTION = "delete-pki-collection",
-  GET_PKI_COLLECTION_ITEMS = "get-pki-collection-items",
-  ADD_PKI_COLLECTION_ITEM = "add-pki-collection-item",
-  DELETE_PKI_COLLECTION_ITEM = "delete-pki-collection-item",
-  CREATE_KMS = "create-kms",
-  UPDATE_KMS = "update-kms",
-  DELETE_KMS = "delete-kms",
-  GET_KMS = "get-kms",
-  UPDATE_PROJECT_KMS = "update-project-kms",
-  GET_PROJECT_KMS_BACKUP = "get-project-kms-backup",
-  LOAD_PROJECT_KMS_BACKUP = "load-project-kms-backup",
-  ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project",
-  CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template",
-  UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template",
-  DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template",
-  GET_CERTIFICATE_TEMPLATE = "get-certificate-template"
+  GET_CERT_BODY = "get-cert-body"
 }
 
 interface UserActorMetadata {
@@ -356,7 +329,6 @@ interface DeleteIntegrationEvent {
     targetServiceId?: string;
     path?: string;
     region?: string;
-    shouldDeleteIntegrationSecrets?: boolean;
   };
 }
 
@@ -1114,14 +1086,6 @@ interface DeleteCa {
   };
 }
 
-interface RenewCa {
-  type: EventType.RENEW_CA;
-  metadata: {
-    caId: string;
-    dn: string;
-  };
-}
-
 interface GetCaCsr {
   type: EventType.GET_CA_CSR;
   metadata: {
@@ -1130,14 +1094,6 @@ interface GetCaCsr {
   };
 }
 
-interface GetCaCerts {
-  type: EventType.GET_CA_CERTS;
-  metadata: {
-    caId: string;
-    dn: string;
-  };
-}
-
 interface GetCaCert {
   type: EventType.GET_CA_CERT;
   metadata: {
@@ -1163,8 +1119,8 @@ interface ImportCaCert {
   };
 }
 
-interface GetCaCrls {
-  type: EventType.GET_CA_CRLS;
+interface GetCaCrl {
+  type: EventType.GET_CA_CRL;
   metadata: {
     caId: string;
     dn: string;
@@ -1180,15 +1136,6 @@ interface IssueCert {
   };
 }
 
-interface SignCert {
-  type: EventType.SIGN_CERT;
-  metadata: {
-    caId: string;
-    dn: string;
-    serialNumber: string;
-  };
-}
-
 interface GetCert {
   type: EventType.GET_CERT;
   metadata: {
@@ -1225,201 +1172,6 @@ interface GetCertBody {
   };
 }
 
-interface CreatePkiAlert {
-  type: EventType.CREATE_PKI_ALERT;
-  metadata: {
-    pkiAlertId: string;
-    pkiCollectionId: string;
-    name: string;
-    alertBeforeDays: number;
-    recipientEmails: string;
-  };
-}
-interface GetPkiAlert {
-  type: EventType.GET_PKI_ALERT;
-  metadata: {
-    pkiAlertId: string;
-  };
-}
-
-interface UpdatePkiAlert {
-  type: EventType.UPDATE_PKI_ALERT;
-  metadata: {
-    pkiAlertId: string;
-    pkiCollectionId?: string;
-    name?: string;
-    alertBeforeDays?: number;
-    recipientEmails?: string;
-  };
-}
-interface DeletePkiAlert {
-  type: EventType.DELETE_PKI_ALERT;
-  metadata: {
-    pkiAlertId: string;
-  };
-}
-
-interface CreatePkiCollection {
-  type: EventType.CREATE_PKI_COLLECTION;
-  metadata: {
-    pkiCollectionId: string;
-    name: string;
-  };
-}
-
-interface GetPkiCollection {
-  type: EventType.GET_PKI_COLLECTION;
-  metadata: {
-    pkiCollectionId: string;
-  };
-}
-
-interface UpdatePkiCollection {
-  type: EventType.UPDATE_PKI_COLLECTION;
-  metadata: {
-    pkiCollectionId: string;
-    name?: string;
-  };
-}
-
-interface DeletePkiCollection {
-  type: EventType.DELETE_PKI_COLLECTION;
-  metadata: {
-    pkiCollectionId: string;
-  };
-}
-
-interface GetPkiCollectionItems {
-  type: EventType.GET_PKI_COLLECTION_ITEMS;
-  metadata: {
-    pkiCollectionId: string;
-  };
-}
-
-interface AddPkiCollectionItem {
-  type: EventType.ADD_PKI_COLLECTION_ITEM;
-  metadata: {
-    pkiCollectionItemId: string;
-    pkiCollectionId: string;
-    type: PkiItemType;
-    itemId: string;
-  };
-}
-
-interface DeletePkiCollectionItem {
-  type: EventType.DELETE_PKI_COLLECTION_ITEM;
-  metadata: {
-    pkiCollectionItemId: string;
-    pkiCollectionId: string;
-  };
-}
-
-interface CreateKmsEvent {
-  type: EventType.CREATE_KMS;
-  metadata: {
-    kmsId: string;
-    provider: string;
-    slug: string;
-    description?: string;
-  };
-}
-
-interface DeleteKmsEvent {
-  type: EventType.DELETE_KMS;
-  metadata: {
-    kmsId: string;
-    slug: string;
-  };
-}
-
-interface UpdateKmsEvent {
-  type: EventType.UPDATE_KMS;
-  metadata: {
-    kmsId: string;
-    provider: string;
-    slug?: string;
-    description?: string;
-  };
-}
-
-interface GetKmsEvent {
-  type: EventType.GET_KMS;
-  metadata: {
-    kmsId: string;
-    slug: string;
-  };
-}
-
-interface UpdateProjectKmsEvent {
-  type: EventType.UPDATE_PROJECT_KMS;
-  metadata: {
-    secretManagerKmsKey: {
-      id: string;
-      slug: string;
-    };
-  };
-}
-
-interface GetProjectKmsBackupEvent {
-  type: EventType.GET_PROJECT_KMS_BACKUP;
-  metadata: Record<string, string>; // no metadata yet
-}
-
-interface LoadProjectKmsBackupEvent {
-  type: EventType.LOAD_PROJECT_KMS_BACKUP;
-  metadata: Record<string, string>; // no metadata yet
-}
-
-interface CreateCertificateTemplate {
-  type: EventType.CREATE_CERTIFICATE_TEMPLATE;
-  metadata: {
-    certificateTemplateId: string;
-    caId: string;
-    pkiCollectionId?: string;
-    name: string;
-    commonName: string;
-    subjectAlternativeName: string;
-    ttl: string;
-  };
-}
-
-interface GetCertificateTemplate {
-  type: EventType.GET_CERTIFICATE_TEMPLATE;
-  metadata: {
-    certificateTemplateId: string;
-  };
-}
-
-interface UpdateCertificateTemplate {
-  type: EventType.UPDATE_CERTIFICATE_TEMPLATE;
-  metadata: {
-    certificateTemplateId: string;
-    caId: string;
-    pkiCollectionId?: string;
-    name: string;
-    commonName: string;
-    subjectAlternativeName: string;
-    ttl: string;
-  };
-}
-
-interface DeleteCertificateTemplate {
-  type: EventType.DELETE_CERTIFICATE_TEMPLATE;
-  metadata: {
-    certificateTemplateId: string;
-  };
-}
-
-interface OrgAdminAccessProjectEvent {
-  type: EventType.ORG_ADMIN_ACCESS_PROJECT;
-  metadata: {
-    userId: string;
-    username: string;
-    email: string;
-    projectId: string;
-  }; // no metadata yet
-}
-
 export type Event =
   | GetSecretsEvent
   | GetSecretEvent
@@ -1512,39 +1264,13 @@ export type Event =
   | GetCa
   | UpdateCa
   | DeleteCa
-  | RenewCa
   | GetCaCsr
-  | GetCaCerts
   | GetCaCert
   | SignIntermediate
   | ImportCaCert
-  | GetCaCrls
+  | GetCaCrl
   | IssueCert
-  | SignCert
   | GetCert
   | DeleteCert
   | RevokeCert
-  | GetCertBody
-  | CreatePkiAlert
-  | GetPkiAlert
-  | UpdatePkiAlert
-  | DeletePkiAlert
-  | CreatePkiCollection
-  | GetPkiCollection
-  | UpdatePkiCollection
-  | DeletePkiCollection
-  | GetPkiCollectionItems
-  | AddPkiCollectionItem
-  | DeletePkiCollectionItem
-  | CreateKmsEvent
-  | UpdateKmsEvent
-  | DeleteKmsEvent
-  | GetKmsEvent
-  | UpdateProjectKmsEvent
-  | GetProjectKmsBackupEvent
-  | LoadProjectKmsBackupEvent
-  | OrgAdminAccessProjectEvent
-  | CreateCertificateTemplate
-  | UpdateCertificateTemplate
-  | GetCertificateTemplate
-  | DeleteCertificateTemplate;
+  | GetCertBody;

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts

@@ -2,24 +2,24 @@ import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-// import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError } from "@app/lib/errors";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
-import { TGetCaCrlsDTO, TGetCrlById } from "./certificate-authority-crl-types";
+import { TGetCrl } from "./certificate-authority-crl-types";
 
 type TCertificateAuthorityCrlServiceFactoryDep = {
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
-  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "find" | "findById">;
+  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "findOne">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  // licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TCertificateAuthorityCrlServiceFactory = ReturnType<typeof certificateAuthorityCrlServiceFactory>;
@@ -29,42 +29,13 @@ export const certificateAuthorityCrlServiceFactory = ({
   certificateAuthorityCrlDAL,
   projectDAL,
   kmsService,
-  permissionService // licenseService
+  permissionService,
+  licenseService
 }: TCertificateAuthorityCrlServiceFactoryDep) => {
   /**
-   * Return CRL with id [crlId]
+   * Return the Certificate Revocation List (CRL) for CA with id [caId]
    */
-  const getCrlById = async (crlId: TGetCrlById) => {
-    const caCrl = await certificateAuthorityCrlDAL.findById(crlId);
-    if (!caCrl) throw new NotFoundError({ message: "CRL not found" });
-
-    const ca = await certificateAuthorityDAL.findById(caCrl.caId);
-
-    const keyId = await getProjectKmsCertificateKeyId({
-      projectId: ca.projectId,
-      projectDAL,
-      kmsService
-    });
-
-    const kmsDecryptor = await kmsService.decryptWithKmsKey({
-      kmsId: keyId
-    });
-
-    const decryptedCrl = await kmsDecryptor({ cipherTextBlob: caCrl.encryptedCrl });
-
-    const crl = new x509.X509Crl(decryptedCrl);
-
-    return {
-      ca,
-      caCrl,
-      crl: crl.rawData
-    };
-  };
-
-  /**
-   * Returns a list of CRL ids for CA with id [caId]
-   */
-  const getCaCrls = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCrlsDTO) => {
+  const getCaCrl = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCrl) => {
     const ca = await certificateAuthorityDAL.findById(caId);
     if (!ca) throw new BadRequestError({ message: "CA not found" });
 
@@ -81,14 +52,15 @@ export const certificateAuthorityCrlServiceFactory = ({
       ProjectPermissionSub.CertificateAuthorities
     );
 
-    // const plan = await licenseService.getPlan(actorOrgId);
-    // if (!plan.caCrl)
-    //   throw new BadRequestError({
-    //     message:
-    //       "Failed to get CA certificate revocation lists (CRLs) due to plan restriction. Upgrade plan to get the CA CRL."
-    //   });
+    const plan = await licenseService.getPlan(actorOrgId);
+    if (!plan.caCrl)
+      throw new BadRequestError({
+        message:
+          "Failed to get CA certificate revocation list (CRL) due to plan restriction. Upgrade plan to get the CA CRL."
+      });
 
-    const caCrls = await certificateAuthorityCrlDAL.find({ caId: ca.id }, { sort: [["createdAt", "desc"]] });
+    const caCrl = await certificateAuthorityCrlDAL.findOne({ caId: ca.id });
+    if (!caCrl) throw new BadRequestError({ message: "CRL not found" });
 
     const keyId = await getProjectKmsCertificateKeyId({
       projectId: ca.projectId,
@@ -100,23 +72,15 @@ export const certificateAuthorityCrlServiceFactory = ({
       kmsId: keyId
     });
 
-    const decryptedCrls = await Promise.all(
-      caCrls.map(async (caCrl) => {
-        const decryptedCrl = await kmsDecryptor({ cipherTextBlob: caCrl.encryptedCrl });
-        const crl = new x509.X509Crl(decryptedCrl);
+    const decryptedCrl = kmsDecryptor({ cipherTextBlob: caCrl.encryptedCrl });
+    const crl = new x509.X509Crl(decryptedCrl);
 
-        const base64crl = crl.toString("base64");
-        const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`;
-        return {
-          id: caCrl.id,
-          crl: crlPem
-        };
-      })
-    );
+    const base64crl = crl.toString("base64");
+    const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`;
 
     return {
-      ca,
-      crls: decryptedCrls
+      crl: crlPem,
+      ca
     };
   };
 
@@ -202,8 +166,7 @@ export const certificateAuthorityCrlServiceFactory = ({
   // };
 
   return {
-    getCrlById,
-    getCaCrls
+    getCaCrl
     // rotateCaCrl
   };
 };

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts

@@ -1,7 +1,5 @@
 import { TProjectPermission } from "@app/lib/types";
 
-export type TGetCrlById = string;
-
-export type TGetCaCrlsDTO = {
+export type TGetCrl = {
   caId: string;
 } & Omit<TProjectPermission, "projectId">;

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts

@@ -12,7 +12,10 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
 
   const countLeasesForDynamicSecret = async (dynamicSecretId: string, tx?: Knex) => {
     try {
-      const doc = await (tx || db)(TableName.DynamicSecretLease).count("*").where({ dynamicSecretId }).first();
+      const doc = await (tx || db.replicaNode())(TableName.DynamicSecretLease)
+        .count("*")
+        .where({ dynamicSecretId })
+        .first();
       return parseInt(doc || "0", 10);
     } catch (error) {
       throw new DatabaseError({ error, name: "DynamicSecretCountLeases" });
@@ -21,7 +24,7 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
 
   const findById = async (id: string, tx?: Knex) => {
     try {
-      const doc = await (tx || db)(TableName.DynamicSecretLease)
+      const doc = await (tx || db.replicaNode())(TableName.DynamicSecretLease)
         .where({ [`${TableName.DynamicSecretLease}.id` as "id"]: id })
         .first()
         .join(

backend/src/ee/services/external-kms/external-kms-dal.ts

@@ -31,8 +31,6 @@ export const externalKmsDALFactory = (db: TDbClient) => {
         isReserved: el.isReserved,
         orgId: el.orgId,
         slug: el.slug,
-        createdAt: el.createdAt,
-        updatedAt: el.updatedAt,
         externalKms: {
           id: el.externalKmsId,
           provider: el.externalKmsProvider,

backend/src/ee/services/external-kms/external-kms-service.ts

@@ -5,9 +5,7 @@ import { BadRequestError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
 
-import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { TExternalKmsDALFactory } from "./external-kms-dal";
@@ -24,10 +22,9 @@ import { ExternalKmsAwsSchema, KmsProviders } from "./providers/model";
 
 type TExternalKmsServiceFactoryDep = {
   externalKmsDAL: TExternalKmsDALFactory;
-  kmsService: Pick<TKmsServiceFactory, "getOrgKmsKeyId" | "createCipherPairWithDataKey">;
+  kmsService: Pick<TKmsServiceFactory, "getOrgKmsKeyId" | "encryptWithKmsKey" | "decryptWithKmsKey">;
   kmsDAL: Pick<TKmsKeyDALFactory, "create" | "updateById" | "findById" | "deleteById" | "findOne">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
-  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TExternalKmsServiceFactory = ReturnType<typeof externalKmsServiceFactory>;
@@ -35,7 +32,6 @@ export type TExternalKmsServiceFactory = ReturnType<typeof externalKmsServiceFac
 export const externalKmsServiceFactory = ({
   externalKmsDAL,
   permissionService,
-  licenseService,
   kmsService,
   kmsDAL
 }: TExternalKmsServiceFactoryDep) => {
@@ -55,15 +51,7 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Kms);
-    const plan = await licenseService.getPlan(actorOrgId);
-    if (!plan.externalKms) {
-      throw new BadRequestError({
-        message: "Failed to create external KMS due to plan restriction. Upgrade to the Enterprise plan."
-      });
-    }
-
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
     const kmsSlug = slug ? slugify(slug) : slugify(alphaNumericNanoId(8).toLowerCase());
 
     let sanitizedProviderInput = "";
@@ -71,23 +59,21 @@ export const externalKmsServiceFactory = ({
       case KmsProviders.Aws:
         {
           const externalKms = await AwsKmsProviderFactory({ inputs: provider.inputs });
+          await externalKms.validateConnection();
           // if missing kms key this generate a new kms key id and returns new provider input
           const newProviderInput = await externalKms.generateInputKmsKey();
           sanitizedProviderInput = JSON.stringify(newProviderInput);
-
-          await externalKms.validateConnection();
         }
         break;
       default:
         throw new BadRequestError({ message: "external kms provided is invalid" });
     }
 
-    const { encryptor: orgDataKeyEncryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: actorOrgId
+    const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId);
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({
+      kmsId: orgKmsKeyId
     });
-
-    const { cipherTextBlob: encryptedProviderInputs } = orgDataKeyEncryptor({
+    const { cipherTextBlob: encryptedProviderInputs } = kmsEncryptor({
       plainText: Buffer.from(sanitizedProviderInput, "utf8")
     });
 
@@ -133,28 +119,19 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms);
-
-    const plan = await licenseService.getPlan(kmsDoc.orgId);
-    if (!plan.externalKms) {
-      throw new BadRequestError({
-        message: "Failed to update external KMS due to plan restriction. Upgrade to the Enterprise plan."
-      });
-    }
-
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
     const kmsSlug = slug ? slugify(slug) : undefined;
 
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
+    const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId);
     let sanitizedProviderInput = "";
-    const { encryptor: orgDataKeyEncryptor, decryptor: orgDataKeyDecryptor } =
-      await kmsService.createCipherPairWithDataKey({
-        type: KmsDataKey.Organization,
-        orgId: actorOrgId
-      });
     if (provider) {
-      const decryptedProviderInputBlob = orgDataKeyDecryptor({
+      const kmsDecryptor = await kmsService.decryptWithKmsKey({
+        kmsId: orgDefaultKmsId
+      });
+      const decryptedProviderInputBlob = kmsDecryptor({
         cipherTextBlob: externalKmsDoc.encryptedProviderInputs
       });
 
@@ -177,7 +154,10 @@ export const externalKmsServiceFactory = ({
 
     let encryptedProviderInputs: Buffer | undefined;
     if (sanitizedProviderInput) {
-      const { cipherTextBlob } = orgDataKeyEncryptor({
+      const kmsEncryptor = await kmsService.encryptWithKmsKey({
+        kmsId: orgDefaultKmsId
+      });
+      const { cipherTextBlob } = kmsEncryptor({
         plainText: Buffer.from(sanitizedProviderInput, "utf8")
       });
       encryptedProviderInputs = cipherTextBlob;
@@ -217,7 +197,7 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
 
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
@@ -238,7 +218,7 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
 
     const externalKmsDocs = await externalKmsDAL.find({ orgId: actorOrgId });
 
@@ -254,18 +234,16 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
 
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
-    const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: actorOrgId
+    const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId);
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: orgDefaultKmsId
     });
-
-    const decryptedProviderInputBlob = orgDataKeyDecryptor({
+    const decryptedProviderInputBlob = kmsDecryptor({
       cipherTextBlob: externalKmsDoc.encryptedProviderInputs
     });
     switch (externalKmsDoc.provider) {
@@ -295,17 +273,16 @@ export const externalKmsServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings);
 
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
-    const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: actorOrgId
+    const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId);
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({
+      kmsId: orgDefaultKmsId
     });
-
-    const decryptedProviderInputBlob = orgDataKeyDecryptor({
+    const decryptedProviderInputBlob = kmsDecryptor({
       cipherTextBlob: externalKmsDoc.encryptedProviderInputs
     });
 

backend/src/ee/services/external-kms/providers/aws-kms.ts

@@ -50,26 +50,17 @@ type TAwsKmsProviderFactoryReturn = TExternalKmsProviderFns & {
 };
 
 export const AwsKmsProviderFactory = async ({ inputs }: AwsKmsProviderArgs): Promise<TAwsKmsProviderFactoryReturn> => {
-  let providerInputs = await ExternalKmsAwsSchema.parseAsync(inputs);
-  let awsClient = await getAwsKmsClient(providerInputs);
+  const providerInputs = await ExternalKmsAwsSchema.parseAsync(inputs);
+  const awsClient = await getAwsKmsClient(providerInputs);
 
   const generateInputKmsKey = async () => {
     if (providerInputs.kmsKeyId) return providerInputs;
 
     const command = new CreateKeyCommand({ Tags: [{ TagKey: "author", TagValue: "infisical" }] });
     const kmsKey = await awsClient.send(command);
-
     if (!kmsKey.KeyMetadata?.KeyId) throw new Error("Failed to generate kms key");
 
-    const updatedProviderInputs = await ExternalKmsAwsSchema.parseAsync({
-      ...providerInputs,
-      kmsKeyId: kmsKey.KeyMetadata?.KeyId
-    });
-
-    providerInputs = updatedProviderInputs;
-    awsClient = await getAwsKmsClient(providerInputs);
-
-    return updatedProviderInputs;
+    return { ...providerInputs, kmsKeyId: kmsKey.KeyMetadata?.KeyId };
   };
 
   const validateConnection = async () => {

backend/src/ee/services/group/group-fns.ts

@@ -336,36 +336,31 @@ export const removeUsersFromGroupByUserIds = async ({
         )
       );
 
-      const promises: Array<Promise<void>> = [];
-      for (const userId of userIds) {
-        promises.push(
-          (async () => {
-            const t = await userGroupMembershipDAL.filterProjectsByUserMembership(userId, group.id, projectIds, tx);
-            const projectsToDeleteKeyFor = projectIds.filter((p) => !t.has(p));
+      // TODO: this part can be optimized
+      for await (const userId of userIds) {
+        const t = await userGroupMembershipDAL.filterProjectsByUserMembership(userId, group.id, projectIds, tx);
+        const projectsToDeleteKeyFor = projectIds.filter((p) => !t.has(p));
 
-            if (projectsToDeleteKeyFor.length) {
-              await projectKeyDAL.delete(
-                {
-                  receiverId: userId,
-                  $in: {
-                    projectId: projectsToDeleteKeyFor
-                  }
-                },
-                tx
-              );
-            }
+        if (projectsToDeleteKeyFor.length) {
+          await projectKeyDAL.delete(
+            {
+              receiverId: userId,
+              $in: {
+                projectId: projectsToDeleteKeyFor
+              }
+            },
+            tx
+          );
+        }
 
-            await userGroupMembershipDAL.delete(
-              {
-                groupId: group.id,
-                userId
-              },
-              tx
-            );
-          })()
+        await userGroupMembershipDAL.delete(
+          {
+            groupId: group.id,
+            userId
+          },
+          tx
         );
       }
-      await Promise.all(promises);
     }
 
     if (membersToRemoveFromGroupPending.length) {

backend/src/ee/services/license/licence-fns.ts

@@ -39,13 +39,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   secretApproval: false,
   secretRotation: true,
   caCrl: false,
-  instanceUserManagement: false,
-  externalKms: false,
-  rateLimits: {
-    readLimit: 60,
-    writeLimit: 200,
-    secretsLimit: 40
-  }
+  instanceUserManagement: false
 });
 
 export const setupLicenceRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => {

backend/src/ee/services/license/license-types.ts

@@ -57,12 +57,6 @@ export type TFeatureSet = {
   secretRotation: true;
   caCrl: false;
   instanceUserManagement: false;
-  externalKms: false;
-  rateLimits: {
-    readLimit: number;
-    writeLimit: number;
-    secretsLimit: number;
-  };
 };
 
 export type TOrgPlansTableDTO = {

backend/src/ee/services/permission/org-permission.ts

@@ -9,10 +9,6 @@ export enum OrgPermissionActions {
   Delete = "delete"
 }
 
-export enum OrgPermissionAdminConsoleAction {
-  AccessAllProjects = "access-all-projects"
-}
-
 export enum OrgPermissionSubjects {
   Workspace = "workspace",
   Role = "role",
@@ -25,9 +21,7 @@ export enum OrgPermissionSubjects {
   Groups = "groups",
   Billing = "billing",
   SecretScanning = "secret-scanning",
-  Identity = "identity",
-  Kms = "kms",
-  AdminConsole = "organization-admin-console"
+  Identity = "identity"
 }
 
 export type OrgPermissionSet =
@@ -43,9 +37,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.Groups]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
   | [OrgPermissionActions, OrgPermissionSubjects.Billing]
-  | [OrgPermissionActions, OrgPermissionSubjects.Identity]
-  | [OrgPermissionActions, OrgPermissionSubjects.Kms]
-  | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole];
+  | [OrgPermissionActions, OrgPermissionSubjects.Identity];
 
 const buildAdminPermission = () => {
   const { can, build } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -108,13 +100,6 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Identity);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.Kms);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.Kms);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms);
-
-  can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole);
-
   return build({ conditionsMatcher });
 };
 
@@ -126,6 +111,7 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Workspace);
   can(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Groups);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);

backend/src/ee/services/permission/permission-dal.ts

@@ -66,7 +66,6 @@ export const permissionDALFactory = (db: TDbClient) => {
           `${TableName.GroupProjectMembershipRole}.projectMembershipId`,
           `${TableName.GroupProjectMembership}.id`
         )
-
         .leftJoin(
           TableName.ProjectRoles,
           `${TableName.GroupProjectMembershipRole}.customRoleId`,
@@ -74,12 +73,6 @@ export const permissionDALFactory = (db: TDbClient) => {
         )
         .join(TableName.Project, `${TableName.GroupProjectMembership}.projectId`, `${TableName.Project}.id`)
         .join(TableName.Organization, `${TableName.Project}.orgId`, `${TableName.Organization}.id`)
-
-        .leftJoin(
-          TableName.ProjectUserAdditionalPrivilege,
-          `${TableName.GroupProjectMembership}.projectId`,
-          `${TableName.Project}.id`
-        )
         .select(selectAllTableCols(TableName.GroupProjectMembershipRole))
         .select(
           db.ref("id").withSchema(TableName.GroupProjectMembership).as("membershipId"),
@@ -88,30 +81,9 @@ export const permissionDALFactory = (db: TDbClient) => {
           db.ref("projectId").withSchema(TableName.GroupProjectMembership),
           db.ref("authEnforced").withSchema(TableName.Organization).as("orgAuthEnforced"),
           db.ref("orgId").withSchema(TableName.Project),
-          db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug"),
-
-          db.ref("permissions").withSchema(TableName.ProjectRoles).as("permissions"),
-          // db.ref("permissions").withSchema(TableName.ProjectUserAdditionalPrivilege).as("apPermissions")
-          // Additional Privileges
-          db.ref("id").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApId"),
-          db.ref("permissions").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApPermissions"),
-          db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApTemporaryMode"),
-          db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApIsTemporary"),
-          db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApTemporaryRange"),
-
-          db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApProjectId"),
-          db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApUserId"),
-
-          db
-            .ref("temporaryAccessStartTime")
-            .withSchema(TableName.ProjectUserAdditionalPrivilege)
-            .as("userApTemporaryAccessStartTime"),
-          db
-            .ref("temporaryAccessEndTime")
-            .withSchema(TableName.ProjectUserAdditionalPrivilege)
-            .as("userApTemporaryAccessEndTime")
-        );
-      // .select(`${TableName.ProjectRoles}.permissions`);
+          db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug")
+        )
+        .select("permissions");
 
       const docs = await db(TableName.ProjectMembership)
         .join(
@@ -126,13 +98,12 @@ export const permissionDALFactory = (db: TDbClient) => {
         )
         .leftJoin(
           TableName.ProjectUserAdditionalPrivilege,
-          `${TableName.ProjectUserAdditionalPrivilege}.projectId`,
-          `${TableName.ProjectMembership}.projectId`
+          `${TableName.ProjectUserAdditionalPrivilege}.projectMembershipId`,
+          `${TableName.ProjectMembership}.id`
         )
-
         .join(TableName.Project, `${TableName.ProjectMembership}.projectId`, `${TableName.Project}.id`)
         .join(TableName.Organization, `${TableName.Project}.orgId`, `${TableName.Organization}.id`)
-        .where(`${TableName.ProjectMembership}.userId`, userId)
+        .where("userId", userId)
         .where(`${TableName.ProjectMembership}.projectId`, projectId)
         .select(selectAllTableCols(TableName.ProjectUserMembershipRole))
         .select(
@@ -149,10 +120,6 @@ export const permissionDALFactory = (db: TDbClient) => {
           db.ref("temporaryMode").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApTemporaryMode"),
           db.ref("isTemporary").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApIsTemporary"),
           db.ref("temporaryRange").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApTemporaryRange"),
-
-          db.ref("projectId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApProjectId"),
-          db.ref("userId").withSchema(TableName.ProjectUserAdditionalPrivilege).as("userApUserId"),
-
           db
             .ref("temporaryAccessStartTime")
             .withSchema(TableName.ProjectUserAdditionalPrivilege)
@@ -231,31 +198,6 @@ export const permissionDALFactory = (db: TDbClient) => {
                     permissions: z.unknown(),
                     customRoleSlug: z.string().optional().nullable()
                   }).parse(data)
-              },
-              {
-                key: "userApId",
-                label: "additionalPrivileges" as const,
-                mapper: ({
-                  userApId,
-                  userApProjectId,
-                  userApUserId,
-                  userApPermissions,
-                  userApIsTemporary,
-                  userApTemporaryMode,
-                  userApTemporaryRange,
-                  userApTemporaryAccessEndTime,
-                  userApTemporaryAccessStartTime
-                }) => ({
-                  id: userApId,
-                  userId: userApUserId,
-                  projectId: userApProjectId,
-                  permissions: userApPermissions,
-                  temporaryRange: userApTemporaryRange,
-                  temporaryMode: userApTemporaryMode,
-                  temporaryAccessEndTime: userApTemporaryAccessEndTime,
-                  temporaryAccessStartTime: userApTemporaryAccessStartTime,
-                  isTemporary: userApIsTemporary
-                })
               }
             ]
           })
@@ -276,24 +218,15 @@ export const permissionDALFactory = (db: TDbClient) => {
             !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
         ) ?? [];
 
-      const activeAdditionalPrivileges =
-        permission?.[0]?.additionalPrivileges?.filter(
-          ({ isTemporary, temporaryAccessEndTime }) =>
-            !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
-        ) ?? [];
-
-      const activeGroupAdditionalPrivileges =
-        groupPermission?.[0]?.additionalPrivileges?.filter(
-          ({ isTemporary, temporaryAccessEndTime, userId: apUserId, projectId: apProjectId }) =>
-            apProjectId === projectId &&
-            apUserId === userId &&
-            (!isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime))
-        ) ?? [];
+      const activeAdditionalPrivileges = permission?.[0]?.additionalPrivileges?.filter(
+        ({ isTemporary, temporaryAccessEndTime }) =>
+          !isTemporary || (isTemporary && temporaryAccessEndTime && new Date() < temporaryAccessEndTime)
+      );
 
       return {
         ...(permission[0] || groupPermission[0]),
         roles: [...activeRoles, ...activeGroupRoles],
-        additionalPrivileges: [...activeAdditionalPrivileges, ...activeGroupAdditionalPrivileges]
+        additionalPrivileges: activeAdditionalPrivileges
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "GetProjectPermission" });

backend/src/ee/services/permission/project-permission.ts

@@ -23,17 +23,12 @@ export enum ProjectPermissionSub {
   IpAllowList = "ip-allowlist",
   Project = "workspace",
   Secrets = "secrets",
-  SecretFolders = "secret-folders",
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
   Identity = "identity",
   CertificateAuthorities = "certificate-authorities",
-  Certificates = "certificates",
-  CertificateTemplates = "certificate-templates",
-  PkiAlerts = "pki-alerts",
-  PkiCollections = "pki-collections",
-  Kms = "kms"
+  Certificates = "certificates"
 }
 
 type SubjectFields = {
@@ -46,10 +41,6 @@ export type ProjectPermissionSet =
       ProjectPermissionActions,
       ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SubjectFields)
     ]
-  | [
-      ProjectPermissionActions,
-      ProjectPermissionSub.SecretFolders | (ForcedSubject<ProjectPermissionSub.SecretFolders> & SubjectFields)
-    ]
   | [ProjectPermissionActions, ProjectPermissionSub.Role]
   | [ProjectPermissionActions, ProjectPermissionSub.Tags]
   | [ProjectPermissionActions, ProjectPermissionSub.Member]
@@ -66,14 +57,10 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.Identity]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
   | [ProjectPermissionActions, ProjectPermissionSub.Certificates]
-  | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
-  | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
-  | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms];
+  | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback];
 
 const buildAdminPermissionRules = () => {
   const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
@@ -167,26 +154,9 @@ const buildAdminPermissionRules = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateTemplates);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.CertificateTemplates);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.CertificateTemplates);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.CertificateTemplates);
-
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.PkiAlerts);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiAlerts);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiAlerts);
-
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.PkiCollections);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiCollections);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiCollections);
-
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Project);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
 
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms);
-
   return rules;
 };
 
@@ -258,11 +228,6 @@ const buildMemberPermissionRules = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateTemplates);
-
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
-
   return rules;
 };
 

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -18,7 +18,7 @@ import {
 
 type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
   projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
-  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
+  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
@@ -53,17 +53,12 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
 
-    const existingSlug = await projectUserAdditionalPrivilegeDAL.findOne({
-      slug,
-      projectId: projectMembership.projectId,
-      userId: projectMembership.userId
-    });
+    const existingSlug = await projectUserAdditionalPrivilegeDAL.findOne({ slug, projectMembershipId });
     if (existingSlug) throw new BadRequestError({ message: "Additional privilege of provided slug exist" });
 
     if (!dto.isTemporary) {
       const additionalPrivilege = await projectUserAdditionalPrivilegeDAL.create({
-        userId: projectMembership.userId,
-        projectId: projectMembership.projectId,
+        projectMembershipId,
         slug,
         permissions: customPermission
       });
@@ -72,8 +67,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
 
     const relativeTempAllocatedTimeInMs = ms(dto.temporaryRange);
     const additionalPrivilege = await projectUserAdditionalPrivilegeDAL.create({
-      projectId: projectMembership.projectId,
-      userId: projectMembership.userId,
+      projectMembershipId,
       slug,
       permissions: customPermission,
       isTemporary: true,
@@ -96,11 +90,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
-    const projectMembership = await projectMembershipDAL.findOne({
-      userId: userPrivilege.userId,
-      projectId: userPrivilege.projectId
-    });
-
+    const projectMembership = await projectMembershipDAL.findById(userPrivilege.projectMembershipId);
     if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -115,8 +105,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     if (dto?.slug) {
       const existingSlug = await projectUserAdditionalPrivilegeDAL.findOne({
         slug: dto.slug,
-        userId: projectMembership.id,
-        projectId: projectMembership.projectId
+        projectMembershipId: projectMembership.id
       });
       if (existingSlug && existingSlug.id !== userPrivilege.id)
         throw new BadRequestError({ message: "Additional privilege of provided slug exist" });
@@ -149,10 +138,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
-    const projectMembership = await projectMembershipDAL.findOne({
-      userId: userPrivilege.userId,
-      projectId: userPrivilege.projectId
-    });
+    const projectMembership = await projectMembershipDAL.findById(userPrivilege.projectMembershipId);
     if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -178,10 +164,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId);
     if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" });
 
-    const projectMembership = await projectMembershipDAL.findOne({
-      userId: userPrivilege.userId,
-      projectId: userPrivilege.projectId
-    });
+    const projectMembership = await projectMembershipDAL.findById(userPrivilege.projectMembershipId);
     if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -215,10 +198,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
 
-    const userPrivileges = await projectUserAdditionalPrivilegeDAL.find({
-      userId: projectMembership.userId,
-      projectId: projectMembership.projectId
-    });
+    const userPrivileges = await projectUserAdditionalPrivilegeDAL.find({ projectMembershipId });
     return userPrivileges;
   };
 

backend/src/ee/services/rate-limit/rate-limit-service.ts

@@ -4,16 +4,17 @@ import { logger } from "@app/lib/logger";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TRateLimitDALFactory } from "./rate-limit-dal";
-import { RateLimitConfiguration, TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types";
+import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types";
 
-let rateLimitMaxConfiguration: RateLimitConfiguration = {
+let rateLimitMaxConfiguration = {
   readLimit: 60,
   publicEndpointLimit: 30,
   writeLimit: 200,
   secretsLimit: 60,
   authRateLimit: 60,
   inviteUserRateLimit: 30,
-  mfaRateLimit: 20
+  mfaRateLimit: 20,
+  creationLimit: 30
 };
 
 Object.freeze(rateLimitMaxConfiguration);
@@ -66,7 +67,8 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL
           secretsLimit: rateLimit.secretsRateLimit,
           authRateLimit: rateLimit.authRateLimit,
           inviteUserRateLimit: rateLimit.inviteUserRateLimit,
-          mfaRateLimit: rateLimit.mfaRateLimit
+          mfaRateLimit: rateLimit.mfaRateLimit,
+          creationLimit: rateLimit.creationLimit
         };
 
         logger.info(`syncRateLimitConfiguration: rate limit configuration: %o`, newRateLimitMaxConfiguration);

backend/src/ee/services/rate-limit/rate-limit-types.ts

@@ -5,6 +5,7 @@ export type TRateLimitUpdateDTO = {
   authRateLimit: number;
   inviteUserRateLimit: number;
   mfaRateLimit: number;
+  creationLimit: number;
   publicEndpointLimit: number;
 };
 
@@ -13,13 +14,3 @@ export type TRateLimit = {
   createdAt: Date;
   updatedAt: Date;
 } & TRateLimitUpdateDTO;
-
-export type RateLimitConfiguration = {
-  readLimit: number;
-  publicEndpointLimit: number;
-  writeLimit: number;
-  secretsLimit: number;
-  authRateLimit: number;
-  inviteUserRateLimit: number;
-  mfaRateLimit: number;
-};

backend/src/ee/services/scim/scim-service.ts

@@ -31,7 +31,6 @@ import { UserAliasType } from "@app/services/user-alias/user-alias-types";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import {
   buildScimGroup,
   buildScimGroupList,
@@ -94,7 +93,6 @@ type TScimServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   smtpService: Pick<TSmtpService, "sendMail">;
-  projectUserAdditionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "delete">;
 };
 
 export type TScimServiceFactory = ReturnType<typeof scimServiceFactory>;
@@ -114,7 +112,6 @@ export const scimServiceFactory = ({
   projectKeyDAL,
   projectBotDAL,
   permissionService,
-  projectUserAdditionalPrivilegeDAL,
   smtpService
 }: TScimServiceFactoryDep) => {
   const createScimToken = async ({
@@ -561,7 +558,6 @@ export const scimServiceFactory = ({
       orgId: membership.orgId,
       orgDAL,
       projectMembershipDAL,
-      projectUserAdditionalPrivilegeDAL,
       projectKeyDAL,
       userAliasDAL,
       licenseService

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -8,7 +8,6 @@ import { removeTrailingSlash } from "@app/lib/fn";
 import { containsGlobPatterns } from "@app/lib/picomatch";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 
-import { TLicenseServiceFactory } from "../license/license-service";
 import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
 import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
 import {
@@ -29,7 +28,6 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
-  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TSecretApprovalPolicyServiceFactory = ReturnType<typeof secretApprovalPolicyServiceFactory>;
@@ -38,8 +36,7 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyDAL,
   permissionService,
   secretApprovalPolicyApproverDAL,
-  projectEnvDAL,
-  licenseService
+  projectEnvDAL
 }: TSecretApprovalPolicyServiceFactoryDep) => {
   const createSecretApprovalPolicy = async ({
     name,
@@ -68,15 +65,6 @@ export const secretApprovalPolicyServiceFactory = ({
       ProjectPermissionActions.Create,
       ProjectPermissionSub.SecretApproval
     );
-
-    const plan = await licenseService.getPlan(actorOrgId);
-    if (!plan.secretApproval) {
-      throw new BadRequestError({
-        message:
-          "Failed to create secret approval policy due to plan restriction. Upgrade plan to create secret approval policy."
-      });
-    }
-
     const env = await projectEnvDAL.findOne({ slug: environment, projectId });
     if (!env) throw new BadRequestError({ message: "Environment not found" });
 
@@ -127,14 +115,6 @@ export const secretApprovalPolicyServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
 
-    const plan = await licenseService.getPlan(actorOrgId);
-    if (!plan.secretApproval) {
-      throw new BadRequestError({
-        message:
-          "Failed to update secret approval policy due to plan restriction. Upgrade plan to update secret approval policy."
-      });
-    }
-
     const updatedSap = await secretApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await secretApprovalPolicyDAL.updateById(
         secretApprovalPolicy.id,
@@ -187,14 +167,6 @@ export const secretApprovalPolicyServiceFactory = ({
       ProjectPermissionSub.SecretApproval
     );
 
-    const plan = await licenseService.getPlan(actorOrgId);
-    if (!plan.secretApproval) {
-      throw new BadRequestError({
-        message:
-          "Failed to update secret approval policy due to plan restriction. Upgrade plan to update secret approval policy."
-      });
-    }
-
     await secretApprovalPolicyDAL.deleteById(secretPolicyId);
     return sapPolicy;
   };

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -356,161 +356,5 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findByProjectIdBridgeSecretV2 = async (
-    { status, limit = 20, offset = 0, projectId, committer, environment, userId }: TFindQueryFilter,
-    tx?: Knex
-  ) => {
-    try {
-      // akhilmhdh: If ever u wanted a 1 to so many relationship connected with pagination
-      // this is the place u wanna look at.
-      const query = (tx || db.replicaNode())(TableName.SecretApprovalRequest)
-        .join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`)
-        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
-        .join(
-          TableName.SecretApprovalPolicy,
-          `${TableName.SecretApprovalRequest}.policyId`,
-          `${TableName.SecretApprovalPolicy}.id`
-        )
-        .join(
-          TableName.SecretApprovalPolicyApprover,
-          `${TableName.SecretApprovalPolicy}.id`,
-          `${TableName.SecretApprovalPolicyApprover}.policyId`
-        )
-        .join<TUsers>(
-          db(TableName.Users).as("committerUser"),
-          `${TableName.SecretApprovalRequest}.committerUserId`,
-          `committerUser.id`
-        )
-        .leftJoin(
-          TableName.SecretApprovalRequestReviewer,
-          `${TableName.SecretApprovalRequest}.id`,
-          `${TableName.SecretApprovalRequestReviewer}.requestId`
-        )
-        .leftJoin<TSecretApprovalRequestsSecrets>(
-          TableName.SecretApprovalRequestSecretV2,
-          `${TableName.SecretApprovalRequestSecretV2}.requestId`,
-          `${TableName.SecretApprovalRequest}.id`
-        )
-        .where(
-          stripUndefinedInWhere({
-            projectId,
-            [`${TableName.Environment}.slug` as "slug"]: environment,
-            [`${TableName.SecretApprovalRequest}.status`]: status,
-            committerUserId: committer
-          })
-        )
-        .andWhere(
-          (bd) =>
-            void bd
-              .where(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, userId)
-              .orWhere(`${TableName.SecretApprovalRequest}.committerUserId`, userId)
-        )
-        .select(selectAllTableCols(TableName.SecretApprovalRequest))
-        .select(
-          db.ref("projectId").withSchema(TableName.Environment),
-          db.ref("slug").withSchema(TableName.Environment).as("environment"),
-          db.ref("id").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerId"),
-          db.ref("reviewerUserId").withSchema(TableName.SecretApprovalRequestReviewer),
-          db.ref("status").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerStatus"),
-          db.ref("id").withSchema(TableName.SecretApprovalPolicy).as("policyId"),
-          db.ref("name").withSchema(TableName.SecretApprovalPolicy).as("policyName"),
-          db.ref("op").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitOp"),
-          db.ref("secretId").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitSecretId"),
-          db.ref("id").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitId"),
-          db.raw(
-            `DENSE_RANK() OVER (partition by ${TableName.Environment}."projectId" ORDER BY ${TableName.SecretApprovalRequest}."id" DESC) as rank`
-          ),
-          db.ref("secretPath").withSchema(TableName.SecretApprovalPolicy).as("policySecretPath"),
-          db.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
-          db.ref("enforcementLevel").withSchema(TableName.SecretApprovalPolicy).as("policyEnforcementLevel"),
-          db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
-          db.ref("email").withSchema("committerUser").as("committerUserEmail"),
-          db.ref("username").withSchema("committerUser").as("committerUserUsername"),
-          db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
-          db.ref("lastName").withSchema("committerUser").as("committerUserLastName")
-        )
-        .orderBy("createdAt", "desc");
-
-      const docs = await (tx || db)
-        .with("w", query)
-        .select("*")
-        .from<Awaited<typeof query>[number]>("w")
-        .where("w.rank", ">=", offset)
-        .andWhere("w.rank", "<", offset + limit);
-      const formatedDoc = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (el) => ({
-          ...SecretApprovalRequestsSchema.parse(el),
-          environment: el.environment,
-          projectId: el.projectId,
-          policy: {
-            id: el.policyId,
-            name: el.policyName,
-            approvals: el.policyApprovals,
-            secretPath: el.policySecretPath,
-            enforcementLevel: el.policyEnforcementLevel
-          },
-          committerUser: {
-            userId: el.committerUserId,
-            email: el.committerUserEmail,
-            firstName: el.committerUserFirstName,
-            lastName: el.committerUserLastName,
-            username: el.committerUserUsername
-          }
-        }),
-        childrenMapper: [
-          {
-            key: "reviewerId",
-            label: "reviewers" as const,
-            mapper: ({ reviewerUserId, reviewerStatus: s }) =>
-              reviewerUserId ? { userId: reviewerUserId, status: s } : undefined
-          },
-          {
-            key: "approverUserId",
-            label: "approvers" as const,
-            mapper: ({ approverUserId }) => approverUserId
-          },
-          {
-            key: "commitId",
-            label: "commits" as const,
-            mapper: ({ commitSecretId: secretId, commitId: id, commitOp: op }) => ({
-              op,
-              id,
-              secretId
-            })
-          }
-        ]
-      });
-      return formatedDoc.map((el) => ({
-        ...el,
-        policy: { ...el.policy, approvers: el.approvers }
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindSAR" });
-    }
-  };
-
-  const deleteByProjectId = async (projectId: string, tx?: Knex) => {
-    try {
-      const query = await (tx || db)(TableName.SecretApprovalRequest)
-        .join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`)
-        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
-        .where({ projectId })
-        .delete();
-
-      return query;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "DeleteByProjectId" });
-    }
-  };
-
-  return {
-    ...secretApprovalRequestOrm,
-    findById,
-    findProjectRequestCount,
-    findByProjectId,
-    findByProjectIdBridgeSecretV2,
-    deleteByProjectId
-  };
+  return { ...secretApprovalRequestOrm, findById, findProjectRequestCount, findByProjectId };
 };

backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts

@@ -3,7 +3,6 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import {
   SecretApprovalRequestsSecretsSchema,
-  SecretApprovalRequestsSecretsV2Schema,
   TableName,
   TSecretApprovalRequestsSecrets,
   TSecretTags
@@ -16,8 +15,6 @@ export type TSecretApprovalRequestSecretDALFactory = ReturnType<typeof secretApp
 export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
   const secretApprovalRequestSecretOrm = ormify(db, TableName.SecretApprovalRequestSecret);
   const secretApprovalRequestSecretTagOrm = ormify(db, TableName.SecretApprovalRequestSecretTag);
-  const secretApprovalRequestSecretV2TagOrm = ormify(db, TableName.SecretApprovalRequestSecretTagV2);
-  const secretApprovalRequestSecretV2Orm = ormify(db, TableName.SecretApprovalRequestSecretV2);
 
   const bulkUpdateNoVersionIncrement = async (data: TSecretApprovalRequestsSecrets[], tx?: Knex) => {
     try {
@@ -81,13 +78,15 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
         .select({
           secVerTagId: "secVerTag.id",
           secVerTagColor: "secVerTag.color",
-          secVerTagSlug: "secVerTag.slug"
+          secVerTagSlug: "secVerTag.slug",
+          secVerTagName: "secVerTag.name"
         })
         .select(
           db.ref("id").withSchema(TableName.SecretTag).as("tagId"),
           db.ref("id").withSchema(TableName.SecretApprovalRequestSecretTag).as("tagJnId"),
           db.ref("color").withSchema(TableName.SecretTag).as("tagColor"),
-          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")
+          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"),
+          db.ref("name").withSchema(TableName.SecretTag).as("tagName")
         )
         .select(
           db.ref("secretBlindIndex").withSchema(TableName.Secret).as("orgSecBlindIndex"),
@@ -122,9 +121,9 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
           {
             key: "tagJnId",
             label: "tags" as const,
-            mapper: ({ tagId: id, tagSlug: slug, tagColor: color }) => ({
+            mapper: ({ tagId: id, tagName: name, tagSlug: slug, tagColor: color }) => ({
               id,
-              name: slug,
+              name,
               slug,
               color
             })
@@ -198,11 +197,11 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
               {
                 key: "secVerTagId",
                 label: "tags" as const,
-                mapper: ({ secVerTagId: id, secVerTagSlug: slug, secVerTagColor: color }) => ({
+                mapper: ({ secVerTagId: id, secVerTagName: name, secVerTagSlug: slug, secVerTagColor: color }) => ({
                   // eslint-disable-next-line
                   id,
                   // eslint-disable-next-line
-                  name: slug,
+                  name,
                   // eslint-disable-next-line
                   slug,
                   // eslint-disable-next-line
@@ -222,195 +221,10 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
       throw new DatabaseError({ error, name: "FindByRequestId" });
     }
   };
-
-  const findByRequestIdBridgeSecretV2 = async (requestId: string, tx?: Knex) => {
-    try {
-      const doc = await (tx || db.replicaNode())({
-        secVerTag: TableName.SecretTag
-      })
-        .from(TableName.SecretApprovalRequestSecretV2)
-        .where({ requestId })
-        .leftJoin(
-          TableName.SecretApprovalRequestSecretTagV2,
-          `${TableName.SecretApprovalRequestSecretV2}.id`,
-          `${TableName.SecretApprovalRequestSecretTagV2}.secretId`
-        )
-        .leftJoin(
-          TableName.SecretTag,
-          `${TableName.SecretApprovalRequestSecretTagV2}.tagId`,
-          `${TableName.SecretTag}.id`
-        )
-        .leftJoin(TableName.SecretV2, `${TableName.SecretApprovalRequestSecretV2}.secretId`, `${TableName.SecretV2}.id`)
-        .leftJoin(
-          TableName.SecretVersionV2,
-          `${TableName.SecretVersionV2}.id`,
-          `${TableName.SecretApprovalRequestSecretV2}.secretVersion`
-        )
-        .leftJoin(
-          TableName.SecretVersionV2Tag,
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`,
-          `${TableName.SecretVersionV2}.id`
-        )
-        .leftJoin<TSecretTags>(
-          db.ref(TableName.SecretTag).as("secVerTag"),
-          `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`,
-          db.ref("id").withSchema("secVerTag")
-        )
-        .select(selectAllTableCols(TableName.SecretApprovalRequestSecretV2))
-        .select({
-          secVerTagId: "secVerTag.id",
-          secVerTagColor: "secVerTag.color",
-          secVerTagSlug: "secVerTag.slug"
-        })
-        .select(
-          db.ref("id").withSchema(TableName.SecretTag).as("tagId"),
-          db.ref("id").withSchema(TableName.SecretApprovalRequestSecretTagV2).as("tagJnId"),
-          db.ref("color").withSchema(TableName.SecretTag).as("tagColor"),
-          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")
-        )
-        .select(
-          db.ref("version").withSchema(TableName.SecretV2).as("orgSecVersion"),
-          db.ref("key").withSchema(TableName.SecretV2).as("orgSecKey"),
-          db.ref("encryptedValue").withSchema(TableName.SecretV2).as("orgSecValue"),
-          db.ref("encryptedComment").withSchema(TableName.SecretV2).as("orgSecComment")
-        )
-        .select(
-          db.ref("version").withSchema(TableName.SecretVersionV2).as("secVerVersion"),
-          db.ref("key").withSchema(TableName.SecretVersionV2).as("secVerKey"),
-          db.ref("encryptedValue").withSchema(TableName.SecretVersionV2).as("secVerValue"),
-          db.ref("encryptedComment").withSchema(TableName.SecretVersionV2).as("secVerComment")
-        );
-      const formatedDoc = sqlNestRelationships({
-        data: doc,
-        key: "id",
-        parentMapper: (data) => SecretApprovalRequestsSecretsV2Schema.omit({ secretVersion: true }).parse(data),
-        childrenMapper: [
-          {
-            key: "tagJnId",
-            label: "tags" as const,
-            mapper: ({ tagId: id, tagSlug: slug, tagColor: color }) => ({
-              id,
-              name: slug,
-              slug,
-              color
-            })
-          },
-          {
-            key: "secretId",
-            label: "secret" as const,
-            mapper: ({ orgSecVersion, orgSecKey, orgSecValue, orgSecComment, secretId }) =>
-              secretId
-                ? {
-                    id: secretId,
-                    version: orgSecVersion,
-                    key: orgSecKey,
-                    encryptedValue: orgSecValue,
-                    encryptedComment: orgSecComment
-                  }
-                : undefined
-          },
-          {
-            key: "secretVersion",
-            label: "secretVersion" as const,
-            mapper: ({ secretVersion, secVerVersion, secVerKey, secVerValue, secVerComment }) =>
-              secretVersion
-                ? {
-                    version: secVerVersion,
-                    id: secretVersion,
-                    key: secVerKey,
-                    encryptedValue: secVerValue,
-                    encryptedComment: secVerComment
-                  }
-                : undefined,
-            childrenMapper: [
-              {
-                key: "secVerTagId",
-                label: "tags" as const,
-                mapper: ({ secVerTagId: id, secVerTagSlug: slug, secVerTagColor: color }) => ({
-                  // eslint-disable-next-line
-                  id,
-                  // eslint-disable-next-line
-                  name: slug,
-                  // eslint-disable-next-line
-                  slug,
-                  // eslint-disable-next-line
-                  color
-                })
-              }
-            ]
-          }
-        ]
-      });
-      return formatedDoc?.map(({ secret, secretVersion, ...el }) => ({
-        ...el,
-        secret: secret?.[0],
-        secretVersion: secretVersion?.[0]
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByRequestId" });
-    }
-  };
-  // special query for migration to v2 secret
-  const findByProjectId = async (projectId: string, tx?: Knex) => {
-    try {
-      const docs = await (tx || db)(TableName.SecretApprovalRequestSecret)
-        .join(
-          TableName.SecretApprovalRequest,
-          `${TableName.SecretApprovalRequest}.id`,
-          `${TableName.SecretApprovalRequestSecret}.requestId`
-        )
-        .join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`)
-        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
-        .leftJoin(
-          TableName.SecretApprovalRequestSecretTag,
-          `${TableName.SecretApprovalRequestSecret}.id`,
-          `${TableName.SecretApprovalRequestSecretTag}.secretId`
-        )
-        .where({ projectId })
-        .select(selectAllTableCols(TableName.SecretApprovalRequestSecret))
-        .select(
-          db.ref("id").withSchema(TableName.SecretApprovalRequestSecretTag).as("secretApprovalTagId"),
-          db.ref("secretId").withSchema(TableName.SecretApprovalRequestSecretTag).as("secretApprovalTagSecretId"),
-          db.ref("tagId").withSchema(TableName.SecretApprovalRequestSecretTag).as("secretApprovalTagSecretTagId"),
-          db.ref("createdAt").withSchema(TableName.SecretApprovalRequestSecretTag).as("secretApprovalTagCreatedAt"),
-          db.ref("updatedAt").withSchema(TableName.SecretApprovalRequestSecretTag).as("secretApprovalTagUpdatedAt")
-        );
-      const formatedDoc = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (data) => SecretApprovalRequestsSecretsSchema.parse(data),
-        childrenMapper: [
-          {
-            key: "secretApprovalTagId",
-            label: "tags" as const,
-            mapper: ({
-              secretApprovalTagSecretId,
-              secretApprovalTagId,
-              secretApprovalTagUpdatedAt,
-              secretApprovalTagCreatedAt
-            }) => ({
-              secretApprovalTagSecretId,
-              secretApprovalTagId,
-              secretApprovalTagUpdatedAt,
-              secretApprovalTagCreatedAt
-            })
-          }
-        ]
-      });
-      return formatedDoc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByRequestId" });
-    }
-  };
-
   return {
     ...secretApprovalRequestSecretOrm,
-    insertV2Bridge: secretApprovalRequestSecretV2Orm.insertMany,
     findByRequestId,
-    findByRequestIdBridgeSecretV2,
     bulkUpdateNoVersionIncrement,
-    findByProjectId,
-    insertApprovalSecretTags: secretApprovalRequestSecretTagOrm.insertMany,
-    insertApprovalSecretV2Tags: secretApprovalRequestSecretV2TagOrm.insertMany
+    insertApprovalSecretTags: secretApprovalRequestSecretTagOrm.insertMany
   };
 };