Merge branch 'main' into docs/update-net-sdk

.env.example

@@ -107,14 +107,6 @@ INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY=
 INF_APP_CONNECTION_GITHUB_APP_SLUG=
 INF_APP_CONNECTION_GITHUB_APP_ID=
 
-#github radar app connection
-INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_ID=
-INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_SECRET=
-INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY=
-INF_APP_CONNECTION_GITHUB_RADAR_APP_SLUG=
-INF_APP_CONNECTION_GITHUB_RADAR_APP_ID=
-INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET=
-
 #gcp app connection
 INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL=
 

.infisicalignore

@@ -40,4 +40,3 @@ cli/detect/config/gitleaks.toml:gcp-api-key:578
 cli/detect/config/gitleaks.toml:gcp-api-key:579
 cli/detect/config/gitleaks.toml:gcp-api-key:581
 cli/detect/config/gitleaks.toml:gcp-api-key:582
-backend/src/services/smtp/smtp-service.ts:generic-api-key:79

backend/src/@types/fastify.d.ts

@@ -37,7 +37,6 @@ import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-ap
 import { TSecretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
 import { TSecretRotationV2ServiceFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-service";
 import { TSecretScanningServiceFactory } from "@app/ee/services/secret-scanning/secret-scanning-service";
-import { TSecretScanningV2ServiceFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-service";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
 import { TSshCertificateAuthorityServiceFactory } from "@app/ee/services/ssh/ssh-certificate-authority-service";
 import { TSshCertificateTemplateServiceFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-service";
@@ -84,7 +83,6 @@ import { TOrgAdminServiceFactory } from "@app/services/org-admin/org-admin-servi
 import { TPkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
 import { TPkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
 import { TPkiSubscriberServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-service";
-import { TPkiTemplatesServiceFactory } from "@app/services/pki-templates/pki-templates-service";
 import { TProjectServiceFactory } from "@app/services/project/project-service";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env-service";
@@ -119,10 +117,6 @@ declare module "@fastify/request-context" {
       oidc?: {
         claims: Record<string, string>;
       };
-      kubernetes?: {
-        namespace: string;
-        name: string;
-      };
     };
     identityPermissionMetadata?: Record<string, unknown>; // filled by permission service
     assumedPrivilegeDetails?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
@@ -276,9 +270,7 @@ declare module "fastify" {
       microsoftTeams: TMicrosoftTeamsServiceFactory;
       assumePrivileges: TAssumePrivilegeServiceFactory;
       githubOrgSync: TGithubOrgSyncServiceFactory;
-      secretScanningV2: TSecretScanningV2ServiceFactory;
       internalCertificateAuthority: TInternalCertificateAuthorityServiceFactory;
-      pkiTemplate: TPkiTemplatesServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data
     // everywhere else access using service layer

backend/src/@types/knex.d.ts

@@ -6,9 +6,6 @@ import {
   TAccessApprovalPoliciesApprovers,
   TAccessApprovalPoliciesApproversInsert,
   TAccessApprovalPoliciesApproversUpdate,
-  TAccessApprovalPoliciesBypassers,
-  TAccessApprovalPoliciesBypassersInsert,
-  TAccessApprovalPoliciesBypassersUpdate,
   TAccessApprovalPoliciesInsert,
   TAccessApprovalPoliciesUpdate,
   TAccessApprovalRequests,
@@ -279,9 +276,6 @@ import {
   TSecretApprovalPoliciesApprovers,
   TSecretApprovalPoliciesApproversInsert,
   TSecretApprovalPoliciesApproversUpdate,
-  TSecretApprovalPoliciesBypassers,
-  TSecretApprovalPoliciesBypassersInsert,
-  TSecretApprovalPoliciesBypassersUpdate,
   TSecretApprovalPoliciesInsert,
   TSecretApprovalPoliciesUpdate,
   TSecretApprovalRequests,
@@ -336,24 +330,9 @@ import {
   TSecretRotationV2SecretMappingsInsert,
   TSecretRotationV2SecretMappingsUpdate,
   TSecrets,
-  TSecretScanningConfigs,
-  TSecretScanningConfigsInsert,
-  TSecretScanningConfigsUpdate,
-  TSecretScanningDataSources,
-  TSecretScanningDataSourcesInsert,
-  TSecretScanningDataSourcesUpdate,
-  TSecretScanningFindings,
-  TSecretScanningFindingsInsert,
-  TSecretScanningFindingsUpdate,
   TSecretScanningGitRisks,
   TSecretScanningGitRisksInsert,
   TSecretScanningGitRisksUpdate,
-  TSecretScanningResources,
-  TSecretScanningResourcesInsert,
-  TSecretScanningResourcesUpdate,
-  TSecretScanningScans,
-  TSecretScanningScansInsert,
-  TSecretScanningScansUpdate,
   TSecretSharing,
   TSecretSharingInsert,
   TSecretSharingUpdate,
@@ -841,12 +820,6 @@ declare module "knex/types/tables" {
       TAccessApprovalPoliciesApproversUpdate
     >;
 
-    [TableName.AccessApprovalPolicyBypasser]: KnexOriginal.CompositeTableType<
-      TAccessApprovalPoliciesBypassers,
-      TAccessApprovalPoliciesBypassersInsert,
-      TAccessApprovalPoliciesBypassersUpdate
-    >;
-
     [TableName.AccessApprovalRequest]: KnexOriginal.CompositeTableType<
       TAccessApprovalRequests,
       TAccessApprovalRequestsInsert,
@@ -870,11 +843,6 @@ declare module "knex/types/tables" {
       TSecretApprovalPoliciesApproversInsert,
       TSecretApprovalPoliciesApproversUpdate
     >;
-    [TableName.SecretApprovalPolicyBypasser]: KnexOriginal.CompositeTableType<
-      TSecretApprovalPoliciesBypassers,
-      TSecretApprovalPoliciesBypassersInsert,
-      TSecretApprovalPoliciesBypassersUpdate
-    >;
     [TableName.SecretApprovalRequest]: KnexOriginal.CompositeTableType<
       TSecretApprovalRequests,
       TSecretApprovalRequestsInsert,
@@ -1122,30 +1090,5 @@ declare module "knex/types/tables" {
       TGithubOrgSyncConfigsInsert,
       TGithubOrgSyncConfigsUpdate
     >;
-    [TableName.SecretScanningDataSource]: KnexOriginal.CompositeTableType<
-      TSecretScanningDataSources,
-      TSecretScanningDataSourcesInsert,
-      TSecretScanningDataSourcesUpdate
-    >;
-    [TableName.SecretScanningResource]: KnexOriginal.CompositeTableType<
-      TSecretScanningResources,
-      TSecretScanningResourcesInsert,
-      TSecretScanningResourcesUpdate
-    >;
-    [TableName.SecretScanningScan]: KnexOriginal.CompositeTableType<
-      TSecretScanningScans,
-      TSecretScanningScansInsert,
-      TSecretScanningScansUpdate
-    >;
-    [TableName.SecretScanningFinding]: KnexOriginal.CompositeTableType<
-      TSecretScanningFindings,
-      TSecretScanningFindingsInsert,
-      TSecretScanningFindingsUpdate
-    >;
-    [TableName.SecretScanningConfig]: KnexOriginal.CompositeTableType<
-      TSecretScanningConfigs,
-      TSecretScanningConfigsInsert,
-      TSecretScanningConfigsUpdate
-    >;
   }
 }

backend/src/db/migrations/20250517002225_secret-scanning-v2.ts

@@ -1,107 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "@app/db/utils";
-import {
-  SecretScanningFindingStatus,
-  SecretScanningScanStatus
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.SecretScanningDataSource))) {
-    await knex.schema.createTable(TableName.SecretScanningDataSource, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("externalId").index(); // if we need a unique way of identifying this data source from an external resource
-      t.string("name", 48).notNullable();
-      t.string("description");
-      t.string("type").notNullable();
-      t.jsonb("config").notNullable();
-      t.binary("encryptedCredentials"); // webhook credentials, etc.
-      t.uuid("connectionId");
-      t.boolean("isAutoScanEnabled").defaultTo(true);
-      t.foreign("connectionId").references("id").inTable(TableName.AppConnection);
-      t.string("projectId").notNullable();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-      t.boolean("isDisconnected").notNullable().defaultTo(false);
-      t.unique(["projectId", "name"]);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretScanningDataSource);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretScanningResource))) {
-    await knex.schema.createTable(TableName.SecretScanningResource, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("externalId").notNullable();
-      t.string("name").notNullable();
-      t.string("type").notNullable();
-      t.uuid("dataSourceId").notNullable();
-      t.foreign("dataSourceId").references("id").inTable(TableName.SecretScanningDataSource).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-      t.unique(["dataSourceId", "externalId"]);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretScanningResource);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretScanningScan))) {
-    await knex.schema.createTable(TableName.SecretScanningScan, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("status").notNullable().defaultTo(SecretScanningScanStatus.Queued);
-      t.string("statusMessage", 1024);
-      t.string("type").notNullable();
-      t.uuid("resourceId").notNullable();
-      t.foreign("resourceId").references("id").inTable(TableName.SecretScanningResource).onDelete("CASCADE");
-      t.timestamp("createdAt").defaultTo(knex.fn.now());
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretScanningFinding))) {
-    await knex.schema.createTable(TableName.SecretScanningFinding, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("dataSourceName").notNullable();
-      t.string("dataSourceType").notNullable();
-      t.string("resourceName").notNullable();
-      t.string("resourceType").notNullable();
-      t.string("rule").notNullable();
-      t.string("severity").notNullable();
-      t.string("status").notNullable().defaultTo(SecretScanningFindingStatus.Unresolved);
-      t.string("remarks");
-      t.string("fingerprint").notNullable();
-      t.jsonb("details").notNullable();
-      t.string("projectId").notNullable();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.uuid("scanId");
-      t.foreign("scanId").references("id").inTable(TableName.SecretScanningScan).onDelete("SET NULL");
-      t.timestamps(true, true, true);
-      t.unique(["projectId", "fingerprint"]);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretScanningFinding);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretScanningConfig))) {
-    await knex.schema.createTable(TableName.SecretScanningConfig, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("projectId").notNullable().unique();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.string("content", 5000);
-      t.timestamps(true, true, true);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretScanningConfig);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.SecretScanningFinding);
-
-  await dropOnUpdateTrigger(knex, TableName.SecretScanningFinding);
-  await knex.schema.dropTableIfExists(TableName.SecretScanningScan);
-
-  await knex.schema.dropTableIfExists(TableName.SecretScanningResource);
-  await dropOnUpdateTrigger(knex, TableName.SecretScanningResource);
-
-  await knex.schema.dropTableIfExists(TableName.SecretScanningDataSource);
-  await dropOnUpdateTrigger(knex, TableName.SecretScanningDataSource);
-
-  await knex.schema.dropTableIfExists(TableName.SecretScanningConfig);
-  await dropOnUpdateTrigger(knex, TableName.SecretScanningConfig);
-}

backend/src/db/migrations/20250527030702_policy-bypassers.ts

@@ -1,48 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.AccessApprovalPolicyBypasser))) {
-    await knex.schema.createTable(TableName.AccessApprovalPolicyBypasser, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-
-      t.uuid("bypasserGroupId").nullable();
-      t.foreign("bypasserGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
-
-      t.uuid("bypasserUserId").nullable();
-      t.foreign("bypasserUserId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-
-      t.uuid("policyId").notNullable();
-      t.foreign("policyId").references("id").inTable(TableName.AccessApprovalPolicy).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-    await createOnUpdateTrigger(knex, TableName.AccessApprovalPolicyBypasser);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyBypasser))) {
-    await knex.schema.createTable(TableName.SecretApprovalPolicyBypasser, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-
-      t.uuid("bypasserGroupId").nullable();
-      t.foreign("bypasserGroupId").references("id").inTable(TableName.Groups).onDelete("CASCADE");
-
-      t.uuid("bypasserUserId").nullable();
-      t.foreign("bypasserUserId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-
-      t.uuid("policyId").notNullable();
-      t.foreign("policyId").references("id").inTable(TableName.SecretApprovalPolicy).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-    await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyBypasser);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyBypasser);
-  await knex.schema.dropTableIfExists(TableName.AccessApprovalPolicyBypasser);
-
-  await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicyBypasser);
-  await dropOnUpdateTrigger(knex, TableName.AccessApprovalPolicyBypasser);
-}

backend/src/db/migrations/20250527140639_dynamic-secret-username-template.ts

@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "usernameTemplate");
-  if (!hasColumn) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      t.string("usernameTemplate").nullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "usernameTemplate");
-  if (hasColumn) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      t.dropColumn("usernameTemplate");
-    });
-  }
-}

backend/src/db/migrations/20250528145356_add-template-slug.ts

@@ -1,24 +0,0 @@
-import slugify from "@sindresorhus/slugify";
-import { Knex } from "knex";
-
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasNameCol = await knex.schema.hasColumn(TableName.CertificateTemplate, "name");
-  if (hasNameCol) {
-    const templates = await knex(TableName.CertificateTemplate).select("id", "name");
-    await Promise.all(
-      templates.map((el) => {
-        const slugifiedName = el.name
-          ? slugify(`${el.name.slice(0, 16)}-${alphaNumericNanoId(8)}`)
-          : slugify(alphaNumericNanoId(12));
-
-        return knex(TableName.CertificateTemplate).where({ id: el.id }).update({ name: slugifiedName });
-      })
-    );
-  }
-}
-
-export async function down(): Promise<void> {}

backend/src/db/migrations/20250530152721_add-access-approval-request-deleted-at.ts

@@ -1,63 +0,0 @@
-import { Knex } from "knex";
-
-import { ApprovalStatus } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasPrivilegeDeletedAtColumn = await knex.schema.hasColumn(
-    TableName.AccessApprovalRequest,
-    "privilegeDeletedAt"
-  );
-  const hasStatusColumn = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "status");
-
-  if (!hasPrivilegeDeletedAtColumn) {
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
-      t.timestamp("privilegeDeletedAt").nullable();
-    });
-  }
-
-  if (!hasStatusColumn) {
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
-      t.string("status").defaultTo(ApprovalStatus.PENDING).notNullable();
-    });
-
-    // Update existing rows based on business logic
-    // If privilegeId is not null, set status to "approved"
-    await knex(TableName.AccessApprovalRequest).whereNotNull("privilegeId").update({ status: ApprovalStatus.APPROVED });
-
-    // If privilegeId is null and there's a rejected reviewer, set to "rejected"
-    const rejectedRequestIds = await knex(TableName.AccessApprovalRequestReviewer)
-      .select("requestId")
-      .where("status", "rejected")
-      .distinct()
-      .pluck("requestId");
-
-    if (rejectedRequestIds.length > 0) {
-      await knex(TableName.AccessApprovalRequest)
-        .whereNull("privilegeId")
-        .whereIn("id", rejectedRequestIds)
-        .update({ status: ApprovalStatus.REJECTED });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasPrivilegeDeletedAtColumn = await knex.schema.hasColumn(
-    TableName.AccessApprovalRequest,
-    "privilegeDeletedAt"
-  );
-  const hasStatusColumn = await knex.schema.hasColumn(TableName.AccessApprovalRequest, "status");
-
-  if (hasPrivilegeDeletedAtColumn) {
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
-      t.dropColumn("privilegeDeletedAt");
-    });
-  }
-
-  if (hasStatusColumn) {
-    await knex.schema.alterTable(TableName.AccessApprovalRequest, (t) => {
-      t.dropColumn("status");
-    });
-  }
-}

backend/src/db/migrations/20250604174128_identity-kubernetes-auth-gateway-reviewer.ts

@@ -1,23 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasTokenReviewModeColumn = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "tokenReviewMode");
-
-  if (!hasTokenReviewModeColumn) {
-    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (table) => {
-      table.string("tokenReviewMode").notNullable().defaultTo("api");
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasTokenReviewModeColumn = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "tokenReviewMode");
-
-  if (hasTokenReviewModeColumn) {
-    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (table) => {
-      table.dropColumn("tokenReviewMode");
-    });
-  }
-}

backend/src/db/schemas/access-approval-policies-bypassers.ts

@@ -1,26 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const AccessApprovalPoliciesBypassersSchema = z.object({
-  id: z.string().uuid(),
-  bypasserGroupId: z.string().uuid().nullable().optional(),
-  bypasserUserId: z.string().uuid().nullable().optional(),
-  policyId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TAccessApprovalPoliciesBypassers = z.infer<typeof AccessApprovalPoliciesBypassersSchema>;
-export type TAccessApprovalPoliciesBypassersInsert = Omit<
-  z.input<typeof AccessApprovalPoliciesBypassersSchema>,
-  TImmutableDBKeys
->;
-export type TAccessApprovalPoliciesBypassersUpdate = Partial<
-  Omit<z.input<typeof AccessApprovalPoliciesBypassersSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/access-approval-requests.ts

@@ -18,9 +18,7 @@ export const AccessApprovalRequestsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   requestedByUserId: z.string().uuid(),
-  note: z.string().nullable().optional(),
-  privilegeDeletedAt: z.date().nullable().optional(),
-  status: z.string().default("pending")
+  note: z.string().nullable().optional()
 });
 
 export type TAccessApprovalRequests = z.infer<typeof AccessApprovalRequestsSchema>;

backend/src/db/schemas/dynamic-secrets.ts

@@ -28,8 +28,7 @@ export const DynamicSecretsSchema = z.object({
   updatedAt: z.date(),
   encryptedInput: zodBuffer,
   projectGatewayId: z.string().uuid().nullable().optional(),
-  gatewayId: z.string().uuid().nullable().optional(),
-  usernameTemplate: z.string().nullable().optional()
+  gatewayId: z.string().uuid().nullable().optional()
 });
 
 export type TDynamicSecrets = z.infer<typeof DynamicSecretsSchema>;

backend/src/db/schemas/identity-kubernetes-auths.ts

@@ -31,8 +31,7 @@ export const IdentityKubernetesAuthsSchema = z.object({
   encryptedKubernetesTokenReviewerJwt: zodBuffer.nullable().optional(),
   encryptedKubernetesCaCertificate: zodBuffer.nullable().optional(),
   gatewayId: z.string().uuid().nullable().optional(),
-  accessTokenPeriod: z.coerce.number().default(0),
-  tokenReviewMode: z.string().default("api")
+  accessTokenPeriod: z.coerce.number().default(0)
 });
 
 export type TIdentityKubernetesAuths = z.infer<typeof IdentityKubernetesAuthsSchema>;

backend/src/db/schemas/index.ts

@@ -1,6 +1,5 @@
 export * from "./access-approval-policies";
 export * from "./access-approval-policies-approvers";
-export * from "./access-approval-policies-bypassers";
 export * from "./access-approval-requests";
 export * from "./access-approval-requests-reviewers";
 export * from "./api-keys";
@@ -93,7 +92,6 @@ export * from "./saml-configs";
 export * from "./scim-tokens";
 export * from "./secret-approval-policies";
 export * from "./secret-approval-policies-approvers";
-export * from "./secret-approval-policies-bypassers";
 export * from "./secret-approval-request-secret-tags";
 export * from "./secret-approval-request-secret-tags-v2";
 export * from "./secret-approval-requests";
@@ -111,12 +109,7 @@ export * from "./secret-rotation-outputs";
 export * from "./secret-rotation-v2-secret-mappings";
 export * from "./secret-rotations";
 export * from "./secret-rotations-v2";
-export * from "./secret-scanning-configs";
-export * from "./secret-scanning-data-sources";
-export * from "./secret-scanning-findings";
 export * from "./secret-scanning-git-risks";
-export * from "./secret-scanning-resources";
-export * from "./secret-scanning-scans";
 export * from "./secret-sharing";
 export * from "./secret-snapshot-folders";
 export * from "./secret-snapshot-secrets";

backend/src/db/schemas/models.ts

@@ -95,12 +95,10 @@ export enum TableName {
   ScimToken = "scim_tokens",
   AccessApprovalPolicy = "access_approval_policies",
   AccessApprovalPolicyApprover = "access_approval_policies_approvers",
-  AccessApprovalPolicyBypasser = "access_approval_policies_bypassers",
   AccessApprovalRequest = "access_approval_requests",
   AccessApprovalRequestReviewer = "access_approval_requests_reviewers",
   SecretApprovalPolicy = "secret_approval_policies",
   SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
-  SecretApprovalPolicyBypasser = "secret_approval_policies_bypassers",
   SecretApprovalRequest = "secret_approval_requests",
   SecretApprovalRequestReviewer = "secret_approval_requests_reviewers",
   SecretApprovalRequestSecret = "secret_approval_requests_secrets",
@@ -159,12 +157,7 @@ export enum TableName {
   MicrosoftTeamsIntegrations = "microsoft_teams_integrations",
   ProjectMicrosoftTeamsConfigs = "project_microsoft_teams_configs",
   SecretReminderRecipients = "secret_reminder_recipients",
-  GithubOrgSyncConfig = "github_org_sync_configs",
-  SecretScanningDataSource = "secret_scanning_data_sources",
-  SecretScanningResource = "secret_scanning_resources",
-  SecretScanningScan = "secret_scanning_scans",
-  SecretScanningFinding = "secret_scanning_findings",
-  SecretScanningConfig = "secret_scanning_configs"
+  GithubOrgSyncConfig = "github_org_sync_configs"
 }
 
 export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";
@@ -253,8 +246,7 @@ export enum ProjectType {
   SecretManager = "secret-manager",
   CertificateManager = "cert-manager",
   KMS = "kms",
-  SSH = "ssh",
-  SecretScanning = "secret-scanning"
+  SSH = "ssh"
 }
 
 export enum ActionProjectType {
@@ -262,7 +254,6 @@ export enum ActionProjectType {
   CertificateManager = ProjectType.CertificateManager,
   KMS = ProjectType.KMS,
   SSH = ProjectType.SSH,
-  SecretScanning = ProjectType.SecretScanning,
   // project operations that happen on all types
   Any = "any"
 }

backend/src/db/schemas/secret-approval-policies-bypassers.ts

@@ -1,26 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretApprovalPoliciesBypassersSchema = z.object({
-  id: z.string().uuid(),
-  bypasserGroupId: z.string().uuid().nullable().optional(),
-  bypasserUserId: z.string().uuid().nullable().optional(),
-  policyId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretApprovalPoliciesBypassers = z.infer<typeof SecretApprovalPoliciesBypassersSchema>;
-export type TSecretApprovalPoliciesBypassersInsert = Omit<
-  z.input<typeof SecretApprovalPoliciesBypassersSchema>,
-  TImmutableDBKeys
->;
-export type TSecretApprovalPoliciesBypassersUpdate = Partial<
-  Omit<z.input<typeof SecretApprovalPoliciesBypassersSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-scanning-configs.ts

@@ -1,20 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretScanningConfigsSchema = z.object({
-  id: z.string().uuid(),
-  projectId: z.string(),
-  content: z.string().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretScanningConfigs = z.infer<typeof SecretScanningConfigsSchema>;
-export type TSecretScanningConfigsInsert = Omit<z.input<typeof SecretScanningConfigsSchema>, TImmutableDBKeys>;
-export type TSecretScanningConfigsUpdate = Partial<Omit<z.input<typeof SecretScanningConfigsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/secret-scanning-data-sources.ts

@@ -1,32 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretScanningDataSourcesSchema = z.object({
-  id: z.string().uuid(),
-  externalId: z.string().nullable().optional(),
-  name: z.string(),
-  description: z.string().nullable().optional(),
-  type: z.string(),
-  config: z.unknown(),
-  encryptedCredentials: zodBuffer.nullable().optional(),
-  connectionId: z.string().uuid().nullable().optional(),
-  isAutoScanEnabled: z.boolean().default(true).nullable().optional(),
-  projectId: z.string(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  isDisconnected: z.boolean().default(false)
-});
-
-export type TSecretScanningDataSources = z.infer<typeof SecretScanningDataSourcesSchema>;
-export type TSecretScanningDataSourcesInsert = Omit<z.input<typeof SecretScanningDataSourcesSchema>, TImmutableDBKeys>;
-export type TSecretScanningDataSourcesUpdate = Partial<
-  Omit<z.input<typeof SecretScanningDataSourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-scanning-findings.ts

@@ -1,32 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretScanningFindingsSchema = z.object({
-  id: z.string().uuid(),
-  dataSourceName: z.string(),
-  dataSourceType: z.string(),
-  resourceName: z.string(),
-  resourceType: z.string(),
-  rule: z.string(),
-  severity: z.string(),
-  status: z.string().default("unresolved"),
-  remarks: z.string().nullable().optional(),
-  fingerprint: z.string(),
-  details: z.unknown(),
-  projectId: z.string(),
-  scanId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretScanningFindings = z.infer<typeof SecretScanningFindingsSchema>;
-export type TSecretScanningFindingsInsert = Omit<z.input<typeof SecretScanningFindingsSchema>, TImmutableDBKeys>;
-export type TSecretScanningFindingsUpdate = Partial<
-  Omit<z.input<typeof SecretScanningFindingsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-scanning-resources.ts

@@ -1,24 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretScanningResourcesSchema = z.object({
-  id: z.string().uuid(),
-  externalId: z.string(),
-  name: z.string(),
-  type: z.string(),
-  dataSourceId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TSecretScanningResources = z.infer<typeof SecretScanningResourcesSchema>;
-export type TSecretScanningResourcesInsert = Omit<z.input<typeof SecretScanningResourcesSchema>, TImmutableDBKeys>;
-export type TSecretScanningResourcesUpdate = Partial<
-  Omit<z.input<typeof SecretScanningResourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/secret-scanning-scans.ts

@@ -1,21 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretScanningScansSchema = z.object({
-  id: z.string().uuid(),
-  status: z.string().default("queued"),
-  statusMessage: z.string().nullable().optional(),
-  type: z.string(),
-  resourceId: z.string().uuid(),
-  createdAt: z.date().nullable().optional()
-});
-
-export type TSecretScanningScans = z.infer<typeof SecretScanningScansSchema>;
-export type TSecretScanningScansInsert = Omit<z.input<typeof SecretScanningScansSchema>, TImmutableDBKeys>;
-export type TSecretScanningScansUpdate = Partial<Omit<z.input<typeof SecretScanningScansSchema>, TImmutableDBKeys>>;

backend/src/ee/routes/v1/access-approval-policy-router.ts

@@ -1,7 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
-import { ApproverType, BypasserType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
+import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { EnforcementLevel } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -24,19 +24,10 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .max(100, "Cannot have more than 100 approvers")
           .min(1, { message: "At least one approver should be provided" }),
-        bypassers: z
-          .discriminatedUnion("type", [
-            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
-            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
-          ])
-          .array()
-          .max(100, "Cannot have more than 100 bypassers")
-          .optional(),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -81,8 +72,7 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
                 .object({ type: z.nativeEnum(ApproverType), id: z.string().nullable().optional() })
                 .array()
                 .nullable()
-                .optional(),
-              bypassers: z.object({ type: z.nativeEnum(BypasserType), id: z.string().nullable().optional() }).array()
+                .optional()
             })
             .array()
             .nullable()
@@ -153,19 +143,10 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" })
-          .max(100, "Cannot have more than 100 approvers"),
-        bypassers: z
-          .discriminatedUnion("type", [
-            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
-            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
-          ])
-          .array()
-          .max(100, "Cannot have more than 100 bypassers")
-          .optional(),
+          .min(1, { message: "At least one approver should be provided" }),
         approvals: z.number().min(1).optional(),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -239,15 +220,6 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
               })
               .array()
               .nullable()
-              .optional(),
-            bypassers: z
-              .object({
-                type: z.nativeEnum(BypasserType),
-                id: z.string().nullable().optional(),
-                name: z.string().nullable().optional()
-              })
-              .array()
-              .nullable()
               .optional()
           })
         })

backend/src/ee/routes/v1/access-approval-request-router.ts

@@ -113,7 +113,6 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
               name: z.string(),
               approvals: z.number(),
               approvers: z.string().array(),
-              bypassers: z.string().array(),
               secretPath: z.string().nullish(),
               envId: z.string(),
               enforcementLevel: z.string(),

backend/src/ee/routes/v1/dynamic-secret-router.ts

@@ -6,8 +6,6 @@ import { ApiDocsTags, DYNAMIC_SECRETS } from "@app/lib/api-docs";
 import { daysToMillisecond } from "@app/lib/dates";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
-import { isValidHandleBarTemplate } from "@app/lib/template/validate-handlebars";
-import { CharacterType, characterValidator } from "@app/lib/validator/validate-string";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -15,31 +13,6 @@ import { SanitizedDynamicSecretSchema } from "@app/server/routes/sanitizedSchema
 import { AuthMode } from "@app/services/auth/auth-type";
 import { ResourceMetadataSchema } from "@app/services/resource-metadata/resource-metadata-schema";
 
-const validateUsernameTemplateCharacters = characterValidator([
-  CharacterType.AlphaNumeric,
-  CharacterType.Underscore,
-  CharacterType.Hyphen,
-  CharacterType.OpenBrace,
-  CharacterType.CloseBrace,
-  CharacterType.CloseBracket,
-  CharacterType.OpenBracket,
-  CharacterType.Fullstop,
-  CharacterType.SingleQuote,
-  CharacterType.Spaces,
-  CharacterType.Pipe
-]);
-
-const userTemplateSchema = z
-  .string()
-  .trim()
-  .max(255)
-  .refine((el) => validateUsernameTemplateCharacters(el))
-  .refine((el) =>
-    isValidHandleBarTemplate(el, {
-      allowedExpressions: (val) => ["randomUsername", "unixTimestamp", "identity.name"].includes(val)
-    })
-  );
-
 export const registerDynamicSecretRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -79,8 +52,7 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
         path: z.string().describe(DYNAMIC_SECRETS.CREATE.path).trim().default("/").transform(removeTrailingSlash),
         environmentSlug: z.string().describe(DYNAMIC_SECRETS.CREATE.environmentSlug).min(1),
         name: slugSchema({ min: 1, max: 64, field: "Name" }).describe(DYNAMIC_SECRETS.CREATE.name),
-        metadata: ResourceMetadataSchema.optional(),
-        usernameTemplate: userTemplateSchema.optional()
+        metadata: ResourceMetadataSchema.optional()
       }),
       response: {
         200: z.object({
@@ -101,6 +73,39 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/entra-id/users",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      body: z.object({
+        tenantId: z.string().min(1).describe("The tenant ID of the Azure Entra ID"),
+        applicationId: z.string().min(1).describe("The application ID of the Azure Entra ID App Registration"),
+        clientSecret: z.string().min(1).describe("The client secret of the Azure Entra ID App Registration")
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string().min(1).describe("The name of the user"),
+            id: z.string().min(1).describe("The ID of the user"),
+            email: z.string().min(1).describe("The email of the user")
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const data = await server.services.dynamicSecret.fetchAzureEntraIdUsers({
+        tenantId: req.body.tenantId,
+        applicationId: req.body.applicationId,
+        clientSecret: req.body.clientSecret
+      });
+      return data;
+    }
+  });
+
   server.route({
     method: "PATCH",
     url: "/:name",
@@ -145,8 +150,7 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
             })
             .nullable(),
           newName: z.string().describe(DYNAMIC_SECRETS.UPDATE.newName).optional(),
-          metadata: ResourceMetadataSchema.optional(),
-          usernameTemplate: userTemplateSchema.nullable().optional()
+          metadata: ResourceMetadataSchema.optional()
         })
       }),
       response: {
@@ -324,37 +328,4 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
       return { leases };
     }
   });
-
-  server.route({
-    method: "POST",
-    url: "/entra-id/users",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      body: z.object({
-        tenantId: z.string().min(1).describe("The tenant ID of the Azure Entra ID"),
-        applicationId: z.string().min(1).describe("The application ID of the Azure Entra ID App Registration"),
-        clientSecret: z.string().min(1).describe("The client secret of the Azure Entra ID App Registration")
-      }),
-      response: {
-        200: z
-          .object({
-            name: z.string().min(1).describe("The name of the user"),
-            id: z.string().min(1).describe("The ID of the user"),
-            email: z.string().min(1).describe("The email of the user")
-          })
-          .array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const data = await server.services.dynamicSecret.fetchAzureEntraIdUsers({
-        tenantId: req.body.tenantId,
-        applicationId: req.body.applicationId,
-        clientSecret: req.body.clientSecret
-      });
-      return data;
-    }
-  });
 };

backend/src/ee/routes/v1/secret-approval-policy-router.ts

@@ -1,7 +1,7 @@
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
-import { ApproverType, BypasserType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
+import { ApproverType } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { EnforcementLevel } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -30,19 +30,10 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" })
-          .max(100, "Cannot have more than 100 approvers"),
-        bypassers: z
-          .discriminatedUnion("type", [
-            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
-            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
-          ])
-          .array()
-          .max(100, "Cannot have more than 100 bypassers")
-          .optional(),
+          .min(1, { message: "At least one approver should be provided" }),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
         allowedSelfApprovals: z.boolean().default(true)
@@ -84,19 +75,10 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
         approvers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(ApproverType.Group), id: z.string() }),
-            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), username: z.string().optional() })
+            z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" })
-          .max(100, "Cannot have more than 100 approvers"),
-        bypassers: z
-          .discriminatedUnion("type", [
-            z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
-            z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), username: z.string().optional() })
-          ])
-          .array()
-          .max(100, "Cannot have more than 100 bypassers")
-          .optional(),
+          .min(1, { message: "At least one approver should be provided" }),
         approvals: z.number().min(1).default(1),
         secretPath: z
           .string()
@@ -175,12 +157,6 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
                   id: z.string().nullable().optional(),
                   type: z.nativeEnum(ApproverType)
                 })
-                .array(),
-              bypassers: z
-                .object({
-                  id: z.string().nullable().optional(),
-                  type: z.nativeEnum(BypasserType)
-                })
                 .array()
             })
             .array()
@@ -217,14 +193,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
               .object({
                 id: z.string().nullable().optional(),
                 type: z.nativeEnum(ApproverType),
-                username: z.string().nullable().optional()
-              })
-              .array(),
-            bypassers: z
-              .object({
-                id: z.string().nullable().optional(),
-                type: z.nativeEnum(BypasserType),
-                username: z.string().nullable().optional()
+                name: z.string().nullable().optional()
               })
               .array()
           })

backend/src/ee/routes/v1/secret-approval-request-router.ts

@@ -47,11 +47,6 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                   userId: z.string().nullable().optional()
                 })
                 .array(),
-              bypassers: z
-                .object({
-                  userId: z.string().nullable().optional()
-                })
-                .array(),
               secretPath: z.string().optional().nullable(),
               enforcementLevel: z.string(),
               deletedAt: z.date().nullish(),
@@ -271,7 +266,6 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                 name: z.string(),
                 approvals: z.number(),
                 approvers: approvalRequestUser.array(),
-                bypassers: approvalRequestUser.array(),
                 secretPath: z.string().optional().nullable(),
                 enforcementLevel: z.string(),
                 deletedAt: z.date().nullish(),

backend/src/ee/routes/v2/index.ts

@@ -2,10 +2,6 @@ import {
   registerSecretRotationV2Router,
   SECRET_ROTATION_REGISTER_ROUTER_MAP
 } from "@app/ee/routes/v2/secret-rotation-v2-routers";
-import {
-  registerSecretScanningV2Router,
-  SECRET_SCANNING_REGISTER_ROUTER_MAP
-} from "@app/ee/routes/v2/secret-scanning-v2-routers";
 
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
 import { registerProjectRoleRouter } from "./project-role-router";
@@ -35,17 +31,4 @@ export const registerV2EERoutes = async (server: FastifyZodProvider) => {
     },
     { prefix: "/secret-rotations" }
   );
-
-  await server.register(
-    async (secretScanningV2Router) => {
-      // register generic secret scanning endpoints
-      await secretScanningV2Router.register(registerSecretScanningV2Router);
-
-      // register service-specific secret scanning endpoints (gitlab/github, etc.)
-      for await (const [type, router] of Object.entries(SECRET_SCANNING_REGISTER_ROUTER_MAP)) {
-        await secretScanningV2Router.register(router, { prefix: `data-sources/${type}` });
-      }
-    },
-    { prefix: "/secret-scanning" }
-  );
 };

backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts

@@ -5,7 +5,6 @@ import { registerAwsIamUserSecretRotationRouter } from "./aws-iam-user-secret-ro
 import { registerAzureClientSecretRotationRouter } from "./azure-client-secret-rotation-router";
 import { registerLdapPasswordRotationRouter } from "./ldap-password-rotation-router";
 import { registerMsSqlCredentialsRotationRouter } from "./mssql-credentials-rotation-router";
-import { registerMySqlCredentialsRotationRouter } from "./mysql-credentials-rotation-router";
 import { registerPostgresCredentialsRotationRouter } from "./postgres-credentials-rotation-router";
 
 export * from "./secret-rotation-v2-router";
@@ -16,7 +15,6 @@ export const SECRET_ROTATION_REGISTER_ROUTER_MAP: Record<
 > = {
   [SecretRotation.PostgresCredentials]: registerPostgresCredentialsRotationRouter,
   [SecretRotation.MsSqlCredentials]: registerMsSqlCredentialsRotationRouter,
-  [SecretRotation.MySqlCredentials]: registerMySqlCredentialsRotationRouter,
   [SecretRotation.Auth0ClientSecret]: registerAuth0ClientSecretRotationRouter,
   [SecretRotation.AzureClientSecret]: registerAzureClientSecretRotationRouter,
   [SecretRotation.AwsIamUserSecret]: registerAwsIamUserSecretRotationRouter,

backend/src/ee/routes/v2/secret-rotation-v2-routers/mysql-credentials-rotation-router.ts

@@ -1,19 +0,0 @@
-import {
-  CreateMySqlCredentialsRotationSchema,
-  MySqlCredentialsRotationSchema,
-  UpdateMySqlCredentialsRotationSchema
-} from "@app/ee/services/secret-rotation-v2/mysql-credentials";
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import { SqlCredentialsRotationGeneratedCredentialsSchema } from "@app/ee/services/secret-rotation-v2/shared/sql-credentials";
-
-import { registerSecretRotationEndpoints } from "./secret-rotation-v2-endpoints";
-
-export const registerMySqlCredentialsRotationRouter = async (server: FastifyZodProvider) =>
-  registerSecretRotationEndpoints({
-    type: SecretRotation.MySqlCredentials,
-    server,
-    responseSchema: MySqlCredentialsRotationSchema,
-    createSchema: CreateMySqlCredentialsRotationSchema,
-    updateSchema: UpdateMySqlCredentialsRotationSchema,
-    generatedCredentialsSchema: SqlCredentialsRotationGeneratedCredentialsSchema
-  });

backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts

@@ -6,7 +6,6 @@ import { AwsIamUserSecretRotationListItemSchema } from "@app/ee/services/secret-
 import { AzureClientSecretRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/azure-client-secret";
 import { LdapPasswordRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/ldap-password";
 import { MsSqlCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/mssql-credentials";
-import { MySqlCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/mysql-credentials";
 import { PostgresCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 import { SecretRotationV2Schema } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema";
 import { ApiDocsTags, SecretRotations } from "@app/lib/api-docs";
@@ -17,7 +16,6 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SecretRotationV2OptionsSchema = z.discriminatedUnion("type", [
   PostgresCredentialsRotationListItemSchema,
   MsSqlCredentialsRotationListItemSchema,
-  MySqlCredentialsRotationListItemSchema,
   Auth0ClientSecretRotationListItemSchema,
   AzureClientSecretRotationListItemSchema,
   AwsIamUserSecretRotationListItemSchema,

backend/src/ee/routes/v2/secret-scanning-v2-routers/github-secret-scanning-router.ts

@@ -1,16 +0,0 @@
-import { registerSecretScanningEndpoints } from "@app/ee/routes/v2/secret-scanning-v2-routers/secret-scanning-v2-endpoints";
-import {
-  CreateGitHubDataSourceSchema,
-  GitHubDataSourceSchema,
-  UpdateGitHubDataSourceSchema
-} from "@app/ee/services/secret-scanning-v2/github";
-import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-
-export const registerGitHubSecretScanningRouter = async (server: FastifyZodProvider) =>
-  registerSecretScanningEndpoints({
-    type: SecretScanningDataSource.GitHub,
-    server,
-    responseSchema: GitHubDataSourceSchema,
-    createSchema: CreateGitHubDataSourceSchema,
-    updateSchema: UpdateGitHubDataSourceSchema
-  });

backend/src/ee/routes/v2/secret-scanning-v2-routers/index.ts

@@ -1,12 +0,0 @@
-import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-
-import { registerGitHubSecretScanningRouter } from "./github-secret-scanning-router";
-
-export * from "./secret-scanning-v2-router";
-
-export const SECRET_SCANNING_REGISTER_ROUTER_MAP: Record<
-  SecretScanningDataSource,
-  (server: FastifyZodProvider) => Promise<void>
-> = {
-  [SecretScanningDataSource.GitHub]: registerGitHubSecretScanningRouter
-};

backend/src/ee/routes/v2/secret-scanning-v2-routers/secret-scanning-v2-endpoints.ts

@@ -1,593 +0,0 @@
-import { z } from "zod";
-
-import { SecretScanningResourcesSchema, SecretScanningScansSchema } from "@app/db/schemas";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import {
-  SecretScanningDataSource,
-  SecretScanningScanStatus
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import { SECRET_SCANNING_DATA_SOURCE_NAME_MAP } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-maps";
-import {
-  TSecretScanningDataSource,
-  TSecretScanningDataSourceInput
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-types";
-import { ApiDocsTags, SecretScanningDataSources } from "@app/lib/api-docs";
-import { startsWithVowel } from "@app/lib/fn";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerSecretScanningEndpoints = <
-  T extends TSecretScanningDataSource,
-  I extends TSecretScanningDataSourceInput
->({
-  server,
-  type,
-  createSchema,
-  updateSchema,
-  responseSchema
-}: {
-  type: SecretScanningDataSource;
-  server: FastifyZodProvider;
-  createSchema: z.ZodType<{
-    name: string;
-    projectId: string;
-    connectionId?: string;
-    config: Partial<I["config"]>;
-    description?: string | null;
-    isAutoScanEnabled?: boolean;
-  }>;
-  updateSchema: z.ZodType<{
-    name?: string;
-    config?: Partial<I["config"]>;
-    description?: string | null;
-    isAutoScanEnabled?: boolean;
-  }>;
-  responseSchema: z.ZodTypeAny;
-}) => {
-  const sourceType = SECRET_SCANNING_DATA_SOURCE_NAME_MAP[type];
-
-  server.route({
-    method: "GET",
-    url: `/`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `List the ${sourceType} Data Sources for the specified project.`,
-      querystring: z.object({
-        projectId: z
-          .string()
-          .trim()
-          .min(1, "Project ID required")
-          .describe(SecretScanningDataSources.LIST(type).projectId)
-      }),
-      response: {
-        200: z.object({ dataSources: responseSchema.array() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId }
-      } = req;
-
-      const dataSources = (await server.services.secretScanningV2.listSecretScanningDataSourcesByProjectId(
-        { projectId, type },
-        req.permission
-      )) as T[];
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_LIST,
-          metadata: {
-            type,
-            count: dataSources.length,
-            dataSourceIds: dataSources.map((source) => source.id)
-          }
-        }
-      });
-
-      return { dataSources };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:dataSourceId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Get the specified ${sourceType} Data Source by ID.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.GET_BY_ID(type).dataSourceId)
-      }),
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const dataSource = (await server.services.secretScanningV2.findSecretScanningDataSourceById(
-        { dataSourceId, type },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_GET,
-          metadata: {
-            dataSourceId,
-            type
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: `/data-source-name/:dataSourceName`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Get the specified ${sourceType} Data Source by name and project ID.`,
-      params: z.object({
-        sourceName: z
-          .string()
-          .trim()
-          .min(1, "Data Source name required")
-          .describe(SecretScanningDataSources.GET_BY_NAME(type).sourceName)
-      }),
-      querystring: z.object({
-        projectId: z
-          .string()
-          .trim()
-          .min(1, "Project ID required")
-          .describe(SecretScanningDataSources.GET_BY_NAME(type).projectId)
-      }),
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { sourceName } = req.params;
-      const { projectId } = req.query;
-
-      const dataSource = (await server.services.secretScanningV2.findSecretScanningDataSourceByName(
-        { sourceName, projectId, type },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_GET,
-          metadata: {
-            dataSourceId: dataSource.id,
-            type
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Create ${
-        startsWithVowel(sourceType) ? "an" : "a"
-      } ${sourceType} Data Source for the specified project.`,
-      body: createSchema,
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const dataSource = (await server.services.secretScanningV2.createSecretScanningDataSource(
-        { ...req.body, type },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_CREATE,
-          metadata: {
-            dataSourceId: dataSource.id,
-            type,
-            ...req.body
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:dataSourceId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Update the specified ${sourceType} Data Source.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.UPDATE(type).dataSourceId)
-      }),
-      body: updateSchema,
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const dataSource = (await server.services.secretScanningV2.updateSecretScanningDataSource(
-        { ...req.body, dataSourceId, type },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_UPDATE,
-          metadata: {
-            dataSourceId,
-            type,
-            ...req.body
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: `/:dataSourceId`,
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Delete the specified ${sourceType} Data Source.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.DELETE(type).dataSourceId)
-      }),
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const dataSource = (await server.services.secretScanningV2.deleteSecretScanningDataSource(
-        { type, dataSourceId },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_DELETE,
-          metadata: {
-            type,
-            dataSourceId
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: `/:dataSourceId/scan`,
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Trigger a scan for the specified ${sourceType} Data Source.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.SCAN(type).dataSourceId)
-      }),
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const dataSource = (await server.services.secretScanningV2.triggerSecretScanningDataSourceScan(
-        { type, dataSourceId },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_TRIGGER_SCAN,
-          metadata: {
-            type,
-            dataSourceId
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: `/:dataSourceId/resources/:resourceId/scan`,
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Trigger a scan for the specified ${sourceType} Data Source resource.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.SCAN(type).dataSourceId),
-        resourceId: z.string().uuid().describe(SecretScanningDataSources.SCAN(type).resourceId)
-      }),
-      response: {
-        200: z.object({ dataSource: responseSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId, resourceId } = req.params;
-
-      const dataSource = (await server.services.secretScanningV2.triggerSecretScanningDataSourceScan(
-        { type, dataSourceId, resourceId },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: dataSource.projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_TRIGGER_SCAN,
-          metadata: {
-            type,
-            dataSourceId,
-            resourceId
-          }
-        }
-      });
-
-      return { dataSource };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:dataSourceId/resources",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Get the resources associated with the specified ${sourceType} Data Source by ID.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.LIST_RESOURCES(type).dataSourceId)
-      }),
-      response: {
-        200: z.object({ resources: SecretScanningResourcesSchema.array() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const { resources, projectId } = await server.services.secretScanningV2.listSecretScanningResourcesByDataSourceId(
-        { dataSourceId, type },
-        req.permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_RESOURCE_LIST,
-          metadata: {
-            dataSourceId,
-            type,
-            resourceIds: resources.map((resource) => resource.id),
-            count: resources.length
-          }
-        }
-      });
-
-      return { resources };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:dataSourceId/scans",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: `Get the scans associated with the specified ${sourceType} Data Source by ID.`,
-      params: z.object({
-        dataSourceId: z.string().uuid().describe(SecretScanningDataSources.LIST_SCANS(type).dataSourceId)
-      }),
-      response: {
-        200: z.object({ scans: SecretScanningScansSchema.array() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const { scans, projectId } = await server.services.secretScanningV2.listSecretScanningScansByDataSourceId(
-        { dataSourceId, type },
-        req.permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_SCAN_LIST,
-          metadata: {
-            dataSourceId,
-            type,
-            count: scans.length
-          }
-        }
-      });
-
-      return { scans };
-    }
-  });
-
-  // not exposed, for UI only
-  server.route({
-    method: "GET",
-    url: "/:dataSourceId/resources-dashboard",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      tags: [ApiDocsTags.SecretScanning],
-      params: z.object({
-        dataSourceId: z.string().uuid()
-      }),
-      response: {
-        200: z.object({
-          resources: SecretScanningResourcesSchema.extend({
-            lastScannedAt: z.date().nullish(),
-            lastScanStatus: z.nativeEnum(SecretScanningScanStatus).nullish(),
-            lastScanStatusMessage: z.string().nullish(),
-            unresolvedFindings: z.number()
-          }).array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const { resources, projectId } =
-        await server.services.secretScanningV2.listSecretScanningResourcesWithDetailsByDataSourceId(
-          { dataSourceId, type },
-          req.permission
-        );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_RESOURCE_LIST,
-          metadata: {
-            dataSourceId,
-            type,
-            resourceIds: resources.map((resource) => resource.id),
-            count: resources.length
-          }
-        }
-      });
-
-      return { resources };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:dataSourceId/scans-dashboard",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      tags: [ApiDocsTags.SecretScanning],
-      params: z.object({
-        dataSourceId: z.string().uuid()
-      }),
-      response: {
-        200: z.object({
-          scans: SecretScanningScansSchema.extend({
-            unresolvedFindings: z.number(),
-            resolvedFindings: z.number(),
-            resourceName: z.string()
-          }).array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { dataSourceId } = req.params;
-
-      const { scans, projectId } =
-        await server.services.secretScanningV2.listSecretScanningScansWithDetailsByDataSourceId(
-          { dataSourceId, type },
-          req.permission
-        );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_SCAN_LIST,
-          metadata: {
-            dataSourceId,
-            type,
-            count: scans.length
-          }
-        }
-      });
-
-      return { scans };
-    }
-  });
-};

backend/src/ee/routes/v2/secret-scanning-v2-routers/secret-scanning-v2-router.ts

@@ -1,366 +0,0 @@
-import { z } from "zod";
-
-import { SecretScanningConfigsSchema } from "@app/db/schemas";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { GitHubDataSourceListItemSchema } from "@app/ee/services/secret-scanning-v2/github";
-import {
-  SecretScanningFindingStatus,
-  SecretScanningScanStatus
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import {
-  SecretScanningDataSourceSchema,
-  SecretScanningFindingSchema
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-union-schemas";
-import {
-  ApiDocsTags,
-  SecretScanningConfigs,
-  SecretScanningDataSources,
-  SecretScanningFindings
-} from "@app/lib/api-docs";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-const SecretScanningDataSourceOptionsSchema = z.discriminatedUnion("type", [GitHubDataSourceListItemSchema]);
-
-export const registerSecretScanningV2Router = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/data-sources/options",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "List the available Secret Scanning Data Source Options.",
-      response: {
-        200: z.object({
-          dataSourceOptions: SecretScanningDataSourceOptionsSchema.array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: () => {
-      const dataSourceOptions = server.services.secretScanningV2.listSecretScanningDataSourceOptions();
-      return { dataSourceOptions };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/data-sources",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "List all the Secret Scanning Data Sources for the specified project.",
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required").describe(SecretScanningDataSources.LIST().projectId)
-      }),
-      response: {
-        200: z.object({ dataSources: SecretScanningDataSourceSchema.array() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        permission
-      } = req;
-
-      const dataSources = await server.services.secretScanningV2.listSecretScanningDataSourcesByProjectId(
-        { projectId },
-        permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_LIST,
-          metadata: {
-            dataSourceIds: dataSources.map((dataSource) => dataSource.id),
-            count: dataSources.length
-          }
-        }
-      });
-
-      return { dataSources };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/findings",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "List all the Secret Scanning Findings for the specified project.",
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required").describe(SecretScanningFindings.LIST.projectId)
-      }),
-      response: {
-        200: z.object({ findings: SecretScanningFindingSchema.array() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        permission
-      } = req;
-
-      const findings = await server.services.secretScanningV2.listSecretScanningFindingsByProjectId(
-        projectId,
-        permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_FINDING_LIST,
-          metadata: {
-            findingIds: findings.map((finding) => finding.id),
-            count: findings.length
-          }
-        }
-      });
-
-      return { findings };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/findings/:findingId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "Update the specified Secret Scanning Finding.",
-      params: z.object({
-        findingId: z.string().trim().min(1, "Finding ID required").describe(SecretScanningFindings.UPDATE.findingId)
-      }),
-      body: z.object({
-        status: z.nativeEnum(SecretScanningFindingStatus).optional().describe(SecretScanningFindings.UPDATE.status),
-        remarks: z.string().nullish().describe(SecretScanningFindings.UPDATE.remarks)
-      }),
-      response: {
-        200: z.object({ finding: SecretScanningFindingSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        params: { findingId },
-        body,
-        permission
-      } = req;
-
-      const { finding, projectId } = await server.services.secretScanningV2.updateSecretScanningFindingById(
-        { findingId, ...body },
-        permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_FINDING_UPDATE,
-          metadata: {
-            findingId,
-            ...body
-          }
-        }
-      });
-
-      return { finding };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/configs",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "Get the Secret Scanning Config for the specified project.",
-      querystring: z.object({
-        projectId: z
-          .string()
-          .trim()
-          .min(1, "Project ID required")
-          .describe(SecretScanningConfigs.GET_BY_PROJECT_ID.projectId)
-      }),
-      response: {
-        200: z.object({
-          config: z.object({ content: z.string().nullish(), projectId: z.string(), updatedAt: z.date().nullish() })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        permission
-      } = req;
-
-      const config = await server.services.secretScanningV2.findSecretScanningConfigByProjectId(projectId, permission);
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_CONFIG_GET
-        }
-      });
-
-      return { config };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/configs",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SecretScanning],
-      description: "Update the specified Secret Scanning Configuration.",
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required").describe(SecretScanningConfigs.UPDATE.projectId)
-      }),
-      body: z.object({
-        content: z.string().nullable().describe(SecretScanningConfigs.UPDATE.content)
-      }),
-      response: {
-        200: z.object({ config: SecretScanningConfigsSchema })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        body,
-        permission
-      } = req;
-
-      const config = await server.services.secretScanningV2.upsertSecretScanningConfig(
-        { projectId, ...body },
-        permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_CONFIG_UPDATE,
-          metadata: body
-        }
-      });
-
-      return { config };
-    }
-  });
-
-  // not exposed, for UI only
-  server.route({
-    method: "GET",
-    url: "/data-sources-dashboard",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required")
-      }),
-      response: {
-        200: z.object({
-          dataSources: z
-            .intersection(
-              SecretScanningDataSourceSchema,
-              z.object({
-                lastScannedAt: z.date().nullish(),
-                lastScanStatus: z.nativeEnum(SecretScanningScanStatus).nullish(),
-                lastScanStatusMessage: z.string().nullish(),
-                unresolvedFindings: z.number().nullish()
-              })
-            )
-            .array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        permission
-      } = req;
-
-      const dataSources = await server.services.secretScanningV2.listSecretScanningDataSourcesWithDetailsByProjectId(
-        { projectId },
-        permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.SECRET_SCANNING_DATA_SOURCE_LIST,
-          metadata: {
-            dataSourceIds: dataSources.map((dataSource) => dataSource.id),
-            count: dataSources.length
-          }
-        }
-      });
-
-      return { dataSources };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/unresolved-findings-count",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      tags: [ApiDocsTags.SecretScanning],
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required").describe(SecretScanningFindings.LIST.projectId)
-      }),
-      response: {
-        200: z.object({ unresolvedFindings: z.number() })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const {
-        query: { projectId },
-        permission
-      } = req;
-
-      const unresolvedFindings =
-        await server.services.secretScanningV2.getSecretScanningUnresolvedFindingsCountByProjectId(
-          projectId,
-          permission
-        );
-
-      return { unresolvedFindings };
-    }
-  });
-};

backend/src/ee/services/access-approval-policy/access-approval-policy-approver-dal.ts

@@ -8,10 +8,3 @@ export const accessApprovalPolicyApproverDALFactory = (db: TDbClient) => {
   const accessApprovalPolicyApproverOrm = ormify(db, TableName.AccessApprovalPolicyApprover);
   return { ...accessApprovalPolicyApproverOrm };
 };
-
-export type TAccessApprovalPolicyBypasserDALFactory = ReturnType<typeof accessApprovalPolicyBypasserDALFactory>;
-
-export const accessApprovalPolicyBypasserDALFactory = (db: TDbClient) => {
-  const accessApprovalPolicyBypasserOrm = ormify(db, TableName.AccessApprovalPolicyBypasser);
-  return { ...accessApprovalPolicyBypasserOrm };
-};

backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts

@@ -1,11 +1,11 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies, TUsers } from "@app/db/schemas";
+import { AccessApprovalPoliciesSchema, TableName, TAccessApprovalPolicies } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
-import { ApproverType, BypasserType } from "./access-approval-policy-types";
+import { ApproverType } from "./access-approval-policy-types";
 
 export type TAccessApprovalPolicyDALFactory = ReturnType<typeof accessApprovalPolicyDALFactory>;
 
@@ -34,22 +34,9 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
       .leftJoin(TableName.Users, `${TableName.AccessApprovalPolicyApprover}.approverUserId`, `${TableName.Users}.id`)
-      .leftJoin(
-        TableName.AccessApprovalPolicyBypasser,
-        `${TableName.AccessApprovalPolicy}.id`,
-        `${TableName.AccessApprovalPolicyBypasser}.policyId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("bypasserUsers"),
-        `${TableName.AccessApprovalPolicyBypasser}.bypasserUserId`,
-        `bypasserUsers.id`
-      )
       .select(tx.ref("username").withSchema(TableName.Users).as("approverUsername"))
-      .select(tx.ref("username").withSchema("bypasserUsers").as("bypasserUsername"))
       .select(tx.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
       .select(tx.ref("approverGroupId").withSchema(TableName.AccessApprovalPolicyApprover))
-      .select(tx.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser))
-      .select(tx.ref("bypasserGroupId").withSchema(TableName.AccessApprovalPolicyBypasser))
       .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
       .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
       .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
@@ -142,23 +129,6 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
               id,
               type: ApproverType.Group
             })
-          },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserUserId: id, bypasserUsername }) => ({
-              id,
-              type: BypasserType.User,
-              name: bypasserUsername
-            })
-          },
-          {
-            key: "bypasserGroupId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserGroupId: id }) => ({
-              id,
-              type: BypasserType.Group
-            })
           }
         ]
       });
@@ -174,28 +144,5 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
     return softDeletedPolicy;
   };
 
-  const findLastValidPolicy = async ({ envId, secretPath }: { envId: string; secretPath: string }, tx?: Knex) => {
-    try {
-      const result = await (tx || db.replicaNode())(TableName.AccessApprovalPolicy)
-        .where(
-          // eslint-disable-next-line @typescript-eslint/no-misused-promises
-          buildFindFilter(
-            {
-              envId,
-              secretPath
-            },
-            TableName.AccessApprovalPolicy
-          )
-        )
-        .orderBy("deletedAt", "desc")
-        .orderByRaw(`"deletedAt" IS NULL`)
-        .first();
-
-      return result;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindLastValidPolicy" });
-    }
-  };
-
-  return { ...accessApprovalPolicyOrm, find, findById, softDeleteById, findLastValidPolicy };
+  return { ...accessApprovalPolicyOrm, find, findById, softDeleteById };
 };

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -2,9 +2,8 @@ import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
@@ -15,14 +14,10 @@ import { TAccessApprovalRequestReviewerDALFactory } from "../access-approval-req
 import { ApprovalStatus } from "../access-approval-request/access-approval-request-types";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
-import {
-  TAccessApprovalPolicyApproverDALFactory,
-  TAccessApprovalPolicyBypasserDALFactory
-} from "./access-approval-policy-approver-dal";
+import { TAccessApprovalPolicyApproverDALFactory } from "./access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "./access-approval-policy-dal";
 import {
   ApproverType,
-  BypasserType,
   TCreateAccessApprovalPolicy,
   TDeleteAccessApprovalPolicy,
   TGetAccessApprovalPolicyByIdDTO,
@@ -37,14 +32,12 @@ type TAccessApprovalPolicyServiceFactoryDep = {
   accessApprovalPolicyDAL: TAccessApprovalPolicyDALFactory;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findOne">;
   accessApprovalPolicyApproverDAL: TAccessApprovalPolicyApproverDALFactory;
-  accessApprovalPolicyBypasserDAL: TAccessApprovalPolicyBypasserDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
   groupDAL: TGroupDALFactory;
   userDAL: Pick<TUserDALFactory, "find">;
   accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update" | "find">;
   additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "delete">;
   accessApprovalRequestReviewerDAL: Pick<TAccessApprovalRequestReviewerDALFactory, "update">;
-  orgMembershipDAL: Pick<TOrgMembershipDALFactory, "find">;
 };
 
 export type TAccessApprovalPolicyServiceFactory = ReturnType<typeof accessApprovalPolicyServiceFactory>;
@@ -52,7 +45,6 @@ export type TAccessApprovalPolicyServiceFactory = ReturnType<typeof accessApprov
 export const accessApprovalPolicyServiceFactory = ({
   accessApprovalPolicyDAL,
   accessApprovalPolicyApproverDAL,
-  accessApprovalPolicyBypasserDAL,
   groupDAL,
   permissionService,
   projectEnvDAL,
@@ -60,8 +52,7 @@ export const accessApprovalPolicyServiceFactory = ({
   userDAL,
   accessApprovalRequestDAL,
   additionalPrivilegeDAL,
-  accessApprovalRequestReviewerDAL,
-  orgMembershipDAL
+  accessApprovalRequestReviewerDAL
 }: TAccessApprovalPolicyServiceFactoryDep) => {
   const createAccessApprovalPolicy = async ({
     name,
@@ -72,7 +63,6 @@ export const accessApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
-    bypassers,
     projectSlug,
     environment,
     enforcementLevel,
@@ -92,7 +82,7 @@ export const accessApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
       .filter(Boolean) as string[];
 
     if (!groupApprovers && approvals > userApprovers.length + userApproverNames.length)
@@ -108,7 +98,7 @@ export const accessApprovalPolicyServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionApprovalActions.Create,
       ProjectPermissionSub.SecretApproval
     );
     const env = await projectEnvDAL.findOne({ slug: environment, projectId: project.id });
@@ -157,44 +147,6 @@ export const accessApprovalPolicyServiceFactory = ({
       .map((user) => user.id);
     verifyAllApprovers.push(...verifyGroupApprovers);
 
-    let groupBypassers: string[] = [];
-    let bypasserUserIds: string[] = [];
-
-    if (bypassers && bypassers.length) {
-      groupBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.Group)
-        .map((bypasser) => bypasser.id) as string[];
-
-      const userBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.User)
-        .map((bypasser) => bypasser.id)
-        .filter(Boolean) as string[];
-
-      const userBypasserNames = bypassers
-        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
-        .filter(Boolean) as string[];
-
-      bypasserUserIds = userBypassers;
-      if (userBypasserNames.length) {
-        const bypasserUsers = await userDAL.find({
-          $in: {
-            username: userBypasserNames
-          }
-        });
-
-        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
-        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
-
-        if (invalidUsernames.length) {
-          throw new BadRequestError({
-            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
-          });
-        }
-
-        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
-      }
-    }
-
     const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await accessApprovalPolicyDAL.create(
         {
@@ -207,7 +159,6 @@ export const accessApprovalPolicyServiceFactory = ({
         },
         tx
       );
-
       if (approverUserIds.length) {
         await accessApprovalPolicyApproverDAL.insertMany(
           approverUserIds.map((userId) => ({
@@ -228,29 +179,8 @@ export const accessApprovalPolicyServiceFactory = ({
         );
       }
 
-      if (bypasserUserIds.length) {
-        await accessApprovalPolicyBypasserDAL.insertMany(
-          bypasserUserIds.map((userId) => ({
-            bypasserUserId: userId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
-      if (groupBypassers.length) {
-        await accessApprovalPolicyBypasserDAL.insertMany(
-          groupBypassers.map((groupId) => ({
-            bypasserGroupId: groupId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
       return doc;
     });
-
     return { ...accessApproval, environment: env, projectId: project.id };
   };
 
@@ -281,7 +211,6 @@ export const accessApprovalPolicyServiceFactory = ({
   const updateAccessApprovalPolicy = async ({
     policyId,
     approvers,
-    bypassers,
     secretPath,
     name,
     actorId,
@@ -302,15 +231,15 @@ export const accessApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
       .filter(Boolean) as string[];
 
     const accessApprovalPolicy = await accessApprovalPolicyDAL.findById(policyId);
-    const currentApprovals = approvals || accessApprovalPolicy.approvals;
+    const currentAppovals = approvals || accessApprovalPolicy.approvals;
     if (
       groupApprovers?.length === 0 &&
       userApprovers &&
-      currentApprovals > userApprovers.length + userApproverNames.length
+      currentAppovals > userApprovers.length + userApproverNames.length
     ) {
       throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
     }
@@ -327,79 +256,10 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
-
-    let groupBypassers: string[] = [];
-    let bypasserUserIds: string[] = [];
-
-    if (bypassers && bypassers.length) {
-      groupBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.Group)
-        .map((bypasser) => bypasser.id) as string[];
-
-      groupBypassers = [...new Set(groupBypassers)];
-
-      const userBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.User)
-        .map((bypasser) => bypasser.id)
-        .filter(Boolean) as string[];
-
-      const userBypasserNames = bypassers
-        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
-        .filter(Boolean) as string[];
-
-      bypasserUserIds = userBypassers;
-      if (userBypasserNames.length) {
-        const bypasserUsers = await userDAL.find({
-          $in: {
-            username: userBypasserNames
-          }
-        });
-
-        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
-        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
-
-        if (invalidUsernames.length) {
-          throw new BadRequestError({
-            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
-          });
-        }
-
-        bypasserUserIds = [...new Set(bypasserUserIds.concat(bypasserUsers.map((user) => user.id)))];
-      }
-
-      // Validate user bypassers
-      if (bypasserUserIds.length > 0) {
-        const orgMemberships = await orgMembershipDAL.find({
-          $in: { userId: bypasserUserIds },
-          orgId: actorOrgId
-        });
-
-        if (orgMemberships.length !== bypasserUserIds.length) {
-          const foundUserIdsInOrg = new Set(orgMemberships.map((mem) => mem.userId));
-          const missingUserIds = bypasserUserIds.filter((id) => !foundUserIdsInOrg.has(id));
-          throw new BadRequestError({
-            message: `One or more specified bypasser users are not part of the organization or do not exist. Invalid or non-member user IDs: ${missingUserIds.join(", ")}`
-          });
-        }
-      }
-
-      // Validate group bypassers
-      if (groupBypassers.length > 0) {
-        const orgGroups = await groupDAL.find({
-          $in: { id: groupBypassers },
-          orgId: actorOrgId
-        });
-
-        if (orgGroups.length !== groupBypassers.length) {
-          const foundGroupIdsInOrg = new Set(orgGroups.map((group) => group.id));
-          const missingGroupIds = groupBypassers.filter((id) => !foundGroupIdsInOrg.has(id));
-          throw new BadRequestError({
-            message: `One or more specified bypasser groups are not part of the organization or do not exist. Invalid or non-member group IDs: ${missingGroupIds.join(", ")}`
-          });
-        }
-      }
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionApprovalActions.Edit,
+      ProjectPermissionSub.SecretApproval
+    );
 
     const updatedPolicy = await accessApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await accessApprovalPolicyDAL.updateById(
@@ -456,28 +316,6 @@ export const accessApprovalPolicyServiceFactory = ({
         );
       }
 
-      await accessApprovalPolicyBypasserDAL.delete({ policyId: doc.id }, tx);
-
-      if (bypasserUserIds.length) {
-        await accessApprovalPolicyBypasserDAL.insertMany(
-          bypasserUserIds.map((userId) => ({
-            bypasserUserId: userId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
-      if (groupBypassers.length) {
-        await accessApprovalPolicyBypasserDAL.insertMany(
-          groupBypassers.map((groupId) => ({
-            bypasserGroupId: groupId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
       return doc;
     });
     return {
@@ -506,7 +344,7 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionApprovalActions.Delete,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -597,7 +435,10 @@ export const accessApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionApprovalActions.Read,
+      ProjectPermissionSub.SecretApproval
+    );
 
     return policy;
   };

backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts

@@ -18,20 +18,11 @@ export enum ApproverType {
   User = "user"
 }
 
-export enum BypasserType {
-  Group = "group",
-  User = "user"
-}
-
 export type TCreateAccessApprovalPolicy = {
   approvals: number;
   secretPath: string;
   environment: string;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
-  bypassers?: (
-    | { type: BypasserType.Group; id: string }
-    | { type: BypasserType.User; id?: string; username?: string }
-  )[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
   projectSlug: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -41,11 +32,7 @@ export type TCreateAccessApprovalPolicy = {
 export type TUpdateAccessApprovalPolicy = {
   policyId: string;
   approvals?: number;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
-  bypassers?: (
-    | { type: BypasserType.Group; id: string }
-    | { type: BypasserType.User; id?: string; username?: string }
-  )[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
   secretPath?: string;
   name?: string;
   enforcementLevel?: EnforcementLevel;

backend/src/ee/services/access-approval-request/access-approval-request-dal.ts

@@ -1,13 +1,7 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import {
-  AccessApprovalRequestsSchema,
-  TableName,
-  TAccessApprovalRequests,
-  TUserGroupMembership,
-  TUsers
-} from "@app/db/schemas";
+import { AccessApprovalRequestsSchema, TableName, TAccessApprovalRequests, TUsers } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
@@ -34,12 +28,12 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.AccessApprovalRequest}.policyId`,
           `${TableName.AccessApprovalPolicy}.id`
         )
+
         .leftJoin(
           TableName.AccessApprovalRequestReviewer,
           `${TableName.AccessApprovalRequest}.id`,
           `${TableName.AccessApprovalRequestReviewer}.requestId`
         )
-
         .leftJoin(
           TableName.AccessApprovalPolicyApprover,
           `${TableName.AccessApprovalPolicy}.id`,
@@ -52,17 +46,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         )
         .leftJoin(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
 
-        .leftJoin(
-          TableName.AccessApprovalPolicyBypasser,
-          `${TableName.AccessApprovalPolicy}.id`,
-          `${TableName.AccessApprovalPolicyBypasser}.policyId`
-        )
-        .leftJoin<TUserGroupMembership>(
-          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-          `${TableName.AccessApprovalPolicyBypasser}.bypasserGroupId`,
-          `bypasserUserGroupMembership.groupId`
-        )
-
         .join<TUsers>(
           db(TableName.Users).as("requestedByUser"),
           `${TableName.AccessApprovalRequest}.requestedByUserId`,
@@ -86,9 +69,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         .select(db.ref("approverUserId").withSchema(TableName.AccessApprovalPolicyApprover))
         .select(db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"))
 
-        .select(db.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser))
-        .select(db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"))
-
         .select(
           db.ref("projectId").withSchema(TableName.Environment),
           db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
@@ -165,7 +145,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
               }
             : null,
 
-          isApproved: !!doc.policyDeletedAt || !!doc.privilegeId || doc.status !== ApprovalStatus.PENDING
+          isApproved: !!doc.policyDeletedAt || !!doc.privilegeId
         }),
         childrenMapper: [
           {
@@ -178,12 +158,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverGroupUserId",
             label: "approvers" as const,
             mapper: ({ approverGroupUserId }) => approverGroupUserId
-          },
-          { key: "bypasserUserId", label: "bypassers" as const, mapper: ({ bypasserUserId }) => bypasserUserId },
-          {
-            key: "bypasserGroupUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserGroupUserId }) => bypasserGroupUserId
           }
         ]
       });
@@ -192,7 +166,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
 
       return formattedDocs.map((doc) => ({
         ...doc,
-        policy: { ...doc.policy, approvers: doc.approvers, bypassers: doc.bypassers }
+        policy: { ...doc.policy, approvers: doc.approvers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindRequestsWithPrivilege" });
@@ -219,6 +193,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicy}.id`,
         `${TableName.AccessApprovalPolicyApprover}.policyId`
       )
+
       .leftJoin<TUsers>(
         db(TableName.Users).as("accessApprovalPolicyApproverUser"),
         `${TableName.AccessApprovalPolicyApprover}.approverUserId`,
@@ -229,33 +204,13 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.AccessApprovalPolicyApprover}.approverGroupId`,
         `${TableName.UserGroupMembership}.groupId`
       )
+
       .leftJoin<TUsers>(
         db(TableName.Users).as("accessApprovalPolicyGroupApproverUser"),
         `${TableName.UserGroupMembership}.userId`,
         "accessApprovalPolicyGroupApproverUser.id"
       )
 
-      .leftJoin(
-        TableName.AccessApprovalPolicyBypasser,
-        `${TableName.AccessApprovalPolicy}.id`,
-        `${TableName.AccessApprovalPolicyBypasser}.policyId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("accessApprovalPolicyBypasserUser"),
-        `${TableName.AccessApprovalPolicyBypasser}.bypasserUserId`,
-        "accessApprovalPolicyBypasserUser.id"
-      )
-      .leftJoin<TUserGroupMembership>(
-        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-        `${TableName.AccessApprovalPolicyBypasser}.bypasserGroupId`,
-        `bypasserUserGroupMembership.groupId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("accessApprovalPolicyGroupBypasserUser"),
-        `bypasserUserGroupMembership.userId`,
-        "accessApprovalPolicyGroupBypasserUser.id"
-      )
-
       .leftJoin(
         TableName.AccessApprovalRequestReviewer,
         `${TableName.AccessApprovalRequest}.id`,
@@ -286,18 +241,6 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema("requestedByUser").as("requestedByUserFirstName"),
         tx.ref("lastName").withSchema("requestedByUser").as("requestedByUserLastName"),
 
-        // Bypassers
-        tx.ref("bypasserUserId").withSchema(TableName.AccessApprovalPolicyBypasser),
-        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
-        tx.ref("email").withSchema("accessApprovalPolicyBypasserUser").as("bypasserEmail"),
-        tx.ref("email").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupEmail"),
-        tx.ref("username").withSchema("accessApprovalPolicyBypasserUser").as("bypasserUsername"),
-        tx.ref("username").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupUsername"),
-        tx.ref("firstName").withSchema("accessApprovalPolicyBypasserUser").as("bypasserFirstName"),
-        tx.ref("firstName").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupFirstName"),
-        tx.ref("lastName").withSchema("accessApprovalPolicyBypasserUser").as("bypasserLastName"),
-        tx.ref("lastName").withSchema("accessApprovalPolicyGroupBypasserUser").as("bypasserGroupLastName"),
-
         tx.ref("reviewerUserId").withSchema(TableName.AccessApprovalRequestReviewer),
 
         tx.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus"),
@@ -322,7 +265,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
     try {
       const sql = findQuery({ [`${TableName.AccessApprovalRequest}.id` as "id"]: id }, tx || db.replicaNode());
       const docs = await sql;
-      const formattedDoc = sqlNestRelationships({
+      const formatedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -392,51 +335,13 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
               lastName,
               username
             })
-          },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({
-              bypasserUserId,
-              bypasserEmail: email,
-              bypasserUsername: username,
-              bypasserLastName: lastName,
-              bypasserFirstName: firstName
-            }) => ({
-              userId: bypasserUserId,
-              email,
-              firstName,
-              lastName,
-              username
-            })
-          },
-          {
-            key: "bypasserGroupUserId",
-            label: "bypassers" as const,
-            mapper: ({
-              userId,
-              bypasserGroupEmail: email,
-              bypasserGroupUsername: username,
-              bypasserGroupLastName: lastName,
-              bypasserFirstName: firstName
-            }) => ({
-              userId,
-              email,
-              firstName,
-              lastName,
-              username
-            })
           }
         ]
       });
-      if (!formattedDoc?.[0]) return;
+      if (!formatedDoc?.[0]) return;
       return {
-        ...formattedDoc[0],
-        policy: {
-          ...formattedDoc[0].policy,
-          approvers: formattedDoc[0].approvers,
-          bypassers: formattedDoc[0].bypassers
-        }
+        ...formatedDoc[0],
+        policy: { ...formatedDoc[0].policy, approvers: formatedDoc[0].approvers }
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "FindByIdAccessApprovalRequest" });
@@ -487,20 +392,14 @@ export const accessApprovalRequestDALFactory = (db: TDbClient) => {
         ]
       });
 
-      // an approval is pending if there is no reviewer rejections, no privilege ID is set and the status is pending
+      // an approval is pending if there is no reviewer rejections and no privilege ID is set
       const pendingApprovals = formattedRequests.filter(
-        (req) =>
-          !req.privilegeId &&
-          !req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED) &&
-          req.status === ApprovalStatus.PENDING
+        (req) => !req.privilegeId && !req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED)
       );
 
-      // an approval is finalized if there are any rejections, a privilege ID is set or the number of approvals is equal to the number of approvals required
+      // an approval is finalized if there are any rejections or a privilege ID is set
       const finalizedApprovals = formattedRequests.filter(
-        (req) =>
-          req.privilegeId ||
-          req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED) ||
-          req.status !== ApprovalStatus.PENDING
+        (req) => req.privilegeId || req.reviewers.some((r) => r.status === ApprovalStatus.REJECTED)
       );
 
       return { pendingCount: pendingApprovals.length, finalizedCount: finalizedApprovals.length };

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -23,6 +23,7 @@ import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-poli
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
+import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "../project-user-additional-privilege/project-user-additional-privilege-types";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
@@ -56,7 +57,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
     | "findOne"
     | "getCount"
   >;
-  accessApprovalPolicyDAL: Pick<TAccessApprovalPolicyDALFactory, "findOne" | "find" | "findLastValidPolicy">;
+  accessApprovalPolicyDAL: Pick<TAccessApprovalPolicyDALFactory, "findOne" | "find">;
   accessApprovalRequestReviewerDAL: Pick<
     TAccessApprovalRequestReviewerDALFactory,
     "create" | "find" | "findOne" | "transaction"
@@ -131,7 +132,7 @@ export const accessApprovalRequestServiceFactory = ({
 
     if (!environment) throw new NotFoundError({ message: `Environment with slug '${envSlug}' not found` });
 
-    const policy = await accessApprovalPolicyDAL.findLastValidPolicy({
+    const policy = await accessApprovalPolicyDAL.findOne({
       envId: environment.id,
       secretPath
     });
@@ -203,7 +204,7 @@ export const accessApprovalRequestServiceFactory = ({
 
           const isRejected = reviewers.some((reviewer) => reviewer.status === ApprovalStatus.REJECTED);
 
-          if (!isRejected && duplicateRequest.status === ApprovalStatus.PENDING) {
+          if (!isRejected) {
             throw new BadRequestError({ message: "You already have a pending access request with the same criteria" });
           }
         }
@@ -339,7 +340,7 @@ export const accessApprovalRequestServiceFactory = ({
       });
     }
 
-    const { membership, hasRole } = await permissionService.getProjectPermission({
+    const { membership, hasRole, permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: accessApprovalRequest.projectId,
@@ -354,13 +355,13 @@ export const accessApprovalRequestServiceFactory = ({
 
     const isSelfApproval = actorId === accessApprovalRequest.requestedByUserId;
     const isSoftEnforcement = policy.enforcementLevel === EnforcementLevel.Soft;
-    const canBypass = !policy.bypassers.length || policy.bypassers.some((bypasser) => bypasser.userId === actorId);
-    const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypass);
+    const canBypassApproval = permission.can(
+      ProjectPermissionApprovalActions.AllowAccessBypass,
+      ProjectPermissionSub.SecretApproval
+    );
+    const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypassApproval);
 
-    const isApprover = policy.approvers.find((approver) => approver.userId === actorId);
-
-    // If user is (not an approver OR cant self approve) AND can't bypass policy
-    if ((!isApprover || (!policy.allowedSelfApprovals && isSelfApproval)) && cannotBypassUnderSoftEnforcement) {
+    if (!policy.allowedSelfApprovals && isSelfApproval && cannotBypassUnderSoftEnforcement) {
       throw new BadRequestError({
         message: "Failed to review access approval request. Users are not authorized to review their own request."
       });
@@ -369,7 +370,7 @@ export const accessApprovalRequestServiceFactory = ({
     if (
       !hasRole(ProjectMembershipRole.Admin) &&
       accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user
-      !isApprover // The request isn't performed by an assigned approver
+      !policy.approvers.find((approver) => approver.userId === actorId) // The request isn't performed by an assigned approver
     ) {
       throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
     }
@@ -477,11 +478,7 @@ export const accessApprovalRequestServiceFactory = ({
             );
             privilegeIdToSet = privilege.id;
           }
-          await accessApprovalRequestDAL.updateById(
-            accessApprovalRequest.id,
-            { privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED },
-            tx
-          );
+          await accessApprovalRequestDAL.updateById(accessApprovalRequest.id, { privilegeId: privilegeIdToSet }, tx);
         }
       }
 

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -10,18 +10,6 @@ import {
   TSecretRotationV2Raw,
   TUpdateSecretRotationV2DTO
 } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import {
-  SecretScanningDataSource,
-  SecretScanningScanStatus,
-  SecretScanningScanType
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import {
-  TCreateSecretScanningDataSourceDTO,
-  TDeleteSecretScanningDataSourceDTO,
-  TTriggerSecretScanningDataSourceDTO,
-  TUpdateSecretScanningDataSourceDTO,
-  TUpdateSecretScanningFindingDTO
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-types";
 import { SshCaStatus, SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types";
 import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types";
 import { SshCertTemplateStatus } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-types";
@@ -393,20 +381,6 @@ export enum EventType {
   PROJECT_ASSUME_PRIVILEGE_SESSION_START = "project-assume-privileges-session-start",
   PROJECT_ASSUME_PRIVILEGE_SESSION_END = "project-assume-privileges-session-end",
 
-  SECRET_SCANNING_DATA_SOURCE_LIST = "secret-scanning-data-source-list",
-  SECRET_SCANNING_DATA_SOURCE_CREATE = "secret-scanning-data-source-create",
-  SECRET_SCANNING_DATA_SOURCE_UPDATE = "secret-scanning-data-source-update",
-  SECRET_SCANNING_DATA_SOURCE_DELETE = "secret-scanning-data-source-delete",
-  SECRET_SCANNING_DATA_SOURCE_GET = "secret-scanning-data-source-get",
-  SECRET_SCANNING_DATA_SOURCE_TRIGGER_SCAN = "secret-scanning-data-source-trigger-scan",
-  SECRET_SCANNING_DATA_SOURCE_SCAN = "secret-scanning-data-source-scan",
-  SECRET_SCANNING_RESOURCE_LIST = "secret-scanning-resource-list",
-  SECRET_SCANNING_SCAN_LIST = "secret-scanning-scan-list",
-  SECRET_SCANNING_FINDING_LIST = "secret-scanning-finding-list",
-  SECRET_SCANNING_FINDING_UPDATE = "secret-scanning-finding-update",
-  SECRET_SCANNING_CONFIG_GET = "secret-scanning-config-get",
-  SECRET_SCANNING_CONFIG_UPDATE = "secret-scanning-config-update",
-
   UPDATE_ORG = "update-org",
 
   CREATE_PROJECT = "create-project",
@@ -2979,101 +2953,6 @@ interface MicrosoftTeamsWorkflowIntegrationUpdateEvent {
   };
 }
 
-interface SecretScanningDataSourceListEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_LIST;
-  metadata: {
-    type?: SecretScanningDataSource;
-    count: number;
-    dataSourceIds: string[];
-  };
-}
-
-interface SecretScanningDataSourceGetEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_GET;
-  metadata: {
-    type: SecretScanningDataSource;
-    dataSourceId: string;
-  };
-}
-
-interface SecretScanningDataSourceCreateEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_CREATE;
-  metadata: Omit<TCreateSecretScanningDataSourceDTO, "projectId"> & { dataSourceId: string };
-}
-
-interface SecretScanningDataSourceUpdateEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_UPDATE;
-  metadata: TUpdateSecretScanningDataSourceDTO;
-}
-
-interface SecretScanningDataSourceDeleteEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_DELETE;
-  metadata: TDeleteSecretScanningDataSourceDTO;
-}
-
-interface SecretScanningDataSourceTriggerScanEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_TRIGGER_SCAN;
-  metadata: TTriggerSecretScanningDataSourceDTO;
-}
-
-interface SecretScanningDataSourceScanEvent {
-  type: EventType.SECRET_SCANNING_DATA_SOURCE_SCAN;
-  metadata: {
-    scanId: string;
-    resourceId: string;
-    resourceType: string;
-    dataSourceId: string;
-    dataSourceType: string;
-    scanStatus: SecretScanningScanStatus;
-    scanType: SecretScanningScanType;
-    numberOfSecretsDetected?: number;
-  };
-}
-
-interface SecretScanningResourceListEvent {
-  type: EventType.SECRET_SCANNING_RESOURCE_LIST;
-  metadata: {
-    type: SecretScanningDataSource;
-    dataSourceId: string;
-    resourceIds: string[];
-    count: number;
-  };
-}
-
-interface SecretScanningScanListEvent {
-  type: EventType.SECRET_SCANNING_SCAN_LIST;
-  metadata: {
-    type: SecretScanningDataSource;
-    dataSourceId: string;
-    count: number;
-  };
-}
-
-interface SecretScanningFindingListEvent {
-  type: EventType.SECRET_SCANNING_FINDING_LIST;
-  metadata: {
-    findingIds: string[];
-    count: number;
-  };
-}
-
-interface SecretScanningFindingUpdateEvent {
-  type: EventType.SECRET_SCANNING_FINDING_UPDATE;
-  metadata: TUpdateSecretScanningFindingDTO;
-}
-
-interface SecretScanningConfigUpdateEvent {
-  type: EventType.SECRET_SCANNING_CONFIG_UPDATE;
-  metadata: {
-    content: string | null;
-  };
-}
-
-interface SecretScanningConfigReadEvent {
-  type: EventType.SECRET_SCANNING_CONFIG_GET;
-  metadata?: Record<string, never>; // not needed, based off projectId
-}
-
 interface OrgUpdateEvent {
   type: EventType.UPDATE_ORG;
   metadata: {
@@ -3397,19 +3276,6 @@ export type Event =
   | MicrosoftTeamsWorkflowIntegrationGetEvent
   | MicrosoftTeamsWorkflowIntegrationListEvent
   | MicrosoftTeamsWorkflowIntegrationUpdateEvent
-  | SecretScanningDataSourceListEvent
-  | SecretScanningDataSourceGetEvent
-  | SecretScanningDataSourceCreateEvent
-  | SecretScanningDataSourceUpdateEvent
-  | SecretScanningDataSourceDeleteEvent
-  | SecretScanningDataSourceTriggerScanEvent
-  | SecretScanningDataSourceScanEvent
-  | SecretScanningResourceListEvent
-  | SecretScanningScanListEvent
-  | SecretScanningFindingListEvent
-  | SecretScanningFindingUpdateEvent
-  | SecretScanningConfigUpdateEvent
-  | SecretScanningConfigReadEvent
   | OrgUpdateEvent
   | ProjectCreateEvent
   | ProjectUpdateEvent

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts

@@ -99,9 +99,7 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
           secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
         ) as object;
 
-        await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId, {
-          projectId: folder.projectId
-        });
+        await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId);
         await dynamicSecretLeaseDAL.deleteById(dynamicSecretLease.id);
         return;
       }
@@ -135,9 +133,7 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
           await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id)));
           await Promise.all(
             dynamicSecretLeases.map(({ externalEntityId }) =>
-              selectedProvider.revoke(decryptedStoredInput, externalEntityId, {
-                projectId: folder.projectId
-              })
+              selectedProvider.revoke(decryptedStoredInput, externalEntityId)
             )
           );
         }

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -1,5 +1,4 @@
 import { ForbiddenError, subject } from "@casl/ability";
-import RE2 from "re2";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -12,13 +11,10 @@ import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { ms } from "@app/lib/ms";
-import { ActorType } from "@app/services/auth/auth-type";
-import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TDynamicSecretDALFactory } from "../dynamic-secret/dynamic-secret-dal";
 import { DynamicSecretProviders, TDynamicProviderFns } from "../dynamic-secret/providers/models";
@@ -43,8 +39,6 @@ type TDynamicSecretLeaseServiceFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  userDAL: Pick<TUserDALFactory, "findById">;
-  identityDAL: TIdentityDALFactory;
 };
 
 export type TDynamicSecretLeaseServiceFactory = ReturnType<typeof dynamicSecretLeaseServiceFactory>;
@@ -58,16 +52,8 @@ export const dynamicSecretLeaseServiceFactory = ({
   dynamicSecretQueueService,
   projectDAL,
   licenseService,
-  kmsService,
-  userDAL,
-  identityDAL
+  kmsService
 }: TDynamicSecretLeaseServiceFactoryDep) => {
-  const extractEmailUsername = (email: string) => {
-    const regex = new RE2(/^([^@]+)/);
-    const match = email.match(regex);
-    return match ? match[1] : email;
-  };
-
   const create = async ({
     environmentSlug,
     path,
@@ -146,25 +132,7 @@ export const dynamicSecretLeaseServiceFactory = ({
 
     let result;
     try {
-      const identity: { name: string } = { name: "" };
-      if (actor === ActorType.USER) {
-        const user = await userDAL.findById(actorId);
-        if (user) {
-          identity.name = extractEmailUsername(user.username);
-        }
-      } else if (actor === ActorType.Machine) {
-        const machineIdentity = await identityDAL.findById(actorId);
-        if (machineIdentity) {
-          identity.name = machineIdentity.name;
-        }
-      }
-      result = await selectedProvider.create({
-        inputs: decryptedStoredInput,
-        expireAt: expireAt.getTime(),
-        usernameTemplate: dynamicSecretCfg.usernameTemplate,
-        identity,
-        metadata: { projectId }
-      });
+      result = await selectedProvider.create(decryptedStoredInput, expireAt.getTime());
     } catch (error: unknown) {
       if (error && typeof error === "object" && error !== null && "sqlMessage" in error) {
         throw new BadRequestError({ message: error.sqlMessage as string });
@@ -265,8 +233,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     const { entityId } = await selectedProvider.renew(
       decryptedStoredInput,
       dynamicSecretLease.externalEntityId,
-      expireAt.getTime(),
-      { projectId }
+      expireAt.getTime()
     );
 
     await dynamicSecretQueueService.unsetLeaseRevocation(dynamicSecretLease.id);
@@ -342,7 +309,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     ) as object;
 
     const revokeResponse = await selectedProvider
-      .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId, { projectId })
+      .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId)
       .catch(async (err) => {
         // only propogate this error if forced is false
         if (!isForced) return { error: err as Error };

backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts

@@ -11,8 +11,6 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) =
 
   if (appCfg.isDevelopmentMode) return [host];
 
-  if (isGateway) return [host];
-
   const reservedHosts = [appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI)].concat(
     (appCfg.DB_READ_REPLICAS || []).map((el) => getDbConnectionHost(el.DB_CONNECTION_URI)),
     getDbConnectionHost(appCfg.REDIS_URL),
@@ -60,7 +58,7 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) =
     }
   }
 
-  if (!(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) {
+  if (!isGateway && !(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) {
     const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));
     if (isInternalIp) throw new BadRequestError({ message: "Invalid db host" });
   }

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -78,8 +78,7 @@ export const dynamicSecretServiceFactory = ({
     actorOrgId,
     defaultTTL,
     actorAuthMethod,
-    metadata,
-    usernameTemplate
+    metadata
   }: TCreateDynamicSecretDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
@@ -116,7 +115,7 @@ export const dynamicSecretServiceFactory = ({
       throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" });
 
     const selectedProvider = dynamicSecretProviders[provider.type];
-    const inputs = await selectedProvider.validateProviderInputs(provider.inputs, { projectId });
+    const inputs = await selectedProvider.validateProviderInputs(provider.inputs);
 
     let selectedGatewayId: string | null = null;
     if (inputs && typeof inputs === "object" && "gatewayId" in inputs && inputs.gatewayId) {
@@ -146,7 +145,7 @@ export const dynamicSecretServiceFactory = ({
       selectedGatewayId = gateway.id;
     }
 
-    const isConnected = await selectedProvider.validateConnection(provider.inputs, { projectId });
+    const isConnected = await selectedProvider.validateConnection(provider.inputs);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
 
     const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
@@ -164,8 +163,7 @@ export const dynamicSecretServiceFactory = ({
           defaultTTL,
           folderId: folder.id,
           name,
-          gatewayId: selectedGatewayId,
-          usernameTemplate
+          gatewayId: selectedGatewayId
         },
         tx
       );
@@ -201,8 +199,7 @@ export const dynamicSecretServiceFactory = ({
     newName,
     actorOrgId,
     actorAuthMethod,
-    metadata,
-    usernameTemplate
+    metadata
   }: TUpdateDynamicSecretDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
@@ -272,7 +269,7 @@ export const dynamicSecretServiceFactory = ({
       secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
     ) as object;
     const newInput = { ...decryptedStoredInput, ...(inputs || {}) };
-    const updatedInput = await selectedProvider.validateProviderInputs(newInput, { projectId });
+    const updatedInput = await selectedProvider.validateProviderInputs(newInput);
 
     let selectedGatewayId: string | null = null;
     if (updatedInput && typeof updatedInput === "object" && "gatewayId" in updatedInput && updatedInput?.gatewayId) {
@@ -301,7 +298,7 @@ export const dynamicSecretServiceFactory = ({
       selectedGatewayId = gateway.id;
     }
 
-    const isConnected = await selectedProvider.validateConnection(newInput, { projectId });
+    const isConnected = await selectedProvider.validateConnection(newInput);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
 
     const updatedDynamicCfg = await dynamicSecretDAL.transaction(async (tx) => {
@@ -314,8 +311,7 @@ export const dynamicSecretServiceFactory = ({
           defaultTTL,
           name: newName ?? name,
           status: null,
-          gatewayId: selectedGatewayId,
-          usernameTemplate
+          gatewayId: selectedGatewayId
         },
         tx
       );
@@ -472,9 +468,7 @@ export const dynamicSecretServiceFactory = ({
       secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
     ) as object;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-    const providerInputs = (await selectedProvider.validateProviderInputs(decryptedStoredInput, {
-      projectId
-    })) as object;
+    const providerInputs = (await selectedProvider.validateProviderInputs(decryptedStoredInput)) as object;
 
     return { ...dynamicSecretCfg, inputs: providerInputs };
   };

backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts

@@ -22,7 +22,6 @@ export type TCreateDynamicSecretDTO = {
   name: string;
   projectSlug: string;
   metadata?: ResourceMetadataDTO;
-  usernameTemplate?: string | null;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TUpdateDynamicSecretDTO = {
@@ -35,7 +34,6 @@ export type TUpdateDynamicSecretDTO = {
   inputs?: TProvider["inputs"];
   projectSlug: string;
   metadata?: ResourceMetadataDTO;
-  usernameTemplate?: string | null;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TDeleteDynamicSecretDTO = {

backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts

@@ -16,7 +16,6 @@ import { BadRequestError } from "@app/lib/errors";
 import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
 
 import { DynamicSecretAwsElastiCacheSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const CreateElastiCacheUserSchema = z.object({
   UserId: z.string().trim().min(1),
@@ -133,15 +132,9 @@ const generatePassword = () => {
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
+const generateUsername = () => {
   const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-";
-  const randomUsername = `inf-${customAlphabet(charset, 32)()}`;
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+  return `inf-${customAlphabet(charset, 32)()}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
 };
 
 export const AwsElastiCacheDatabaseProvider = (): TDynamicProviderFns => {
@@ -175,21 +168,13 @@ export const AwsElastiCacheDatabaseProvider = (): TDynamicProviderFns => {
     return true;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: {
-      name: string;
-    };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     if (!(await validateConnection(providerInputs))) {
       throw new BadRequestError({ message: "Failed to establish connection" });
     }
 
-    const leaseUsername = generateUsername(usernameTemplate, identity);
+    const leaseUsername = generateUsername();
     const leasePassword = generatePassword();
     const leaseExpiration = new Date(expireAt).toISOString();
 

backend/src/ee/services/dynamic-secret/providers/aws-iam.ts

@@ -16,26 +16,15 @@ import {
   PutUserPolicyCommand,
   RemoveUserFromGroupCommand
 } from "@aws-sdk/client-iam";
-import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
-import { randomUUID } from "crypto";
 import { z } from "zod";
 
-import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
-import { AwsIamAuthType, DynamicSecretAwsIamSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
+import { DynamicSecretAwsIamSchema, TDynamicProviderFns } from "./models";
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32);
-  if (!usernameTemplate) return randomUsername;
-
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const AwsIamProvider = (): TDynamicProviderFns => {
@@ -44,43 +33,7 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
     return providerInputs;
   };
 
-  const $getClient = async (providerInputs: z.infer<typeof DynamicSecretAwsIamSchema>, projectId: string) => {
-    const appCfg = getConfig();
-    if (providerInputs.method === AwsIamAuthType.AssumeRole) {
-      const stsClient = new STSClient({
-        region: providerInputs.region,
-        credentials:
-          appCfg.DYNAMIC_SECRET_AWS_ACCESS_KEY_ID && appCfg.DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY
-            ? {
-                accessKeyId: appCfg.DYNAMIC_SECRET_AWS_ACCESS_KEY_ID,
-                secretAccessKey: appCfg.DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY
-              }
-            : undefined // if hosting on AWS
-      });
-
-      const command = new AssumeRoleCommand({
-        RoleArn: providerInputs.roleArn,
-        RoleSessionName: `infisical-dynamic-secret-${randomUUID()}`,
-        DurationSeconds: 900, // 15 mins
-        ExternalId: projectId
-      });
-
-      const assumeRes = await stsClient.send(command);
-
-      if (!assumeRes.Credentials?.AccessKeyId || !assumeRes.Credentials?.SecretAccessKey) {
-        throw new BadRequestError({ message: "Failed to assume role - verify credentials and role configuration" });
-      }
-      const client = new IAMClient({
-        region: providerInputs.region,
-        credentials: {
-          accessKeyId: assumeRes.Credentials?.AccessKeyId,
-          secretAccessKey: assumeRes.Credentials?.SecretAccessKey,
-          sessionToken: assumeRes.Credentials?.SessionToken
-        }
-      });
-      return client;
-    }
-
+  const $getClient = async (providerInputs: z.infer<typeof DynamicSecretAwsIamSchema>) => {
     const client = new IAMClient({
       region: providerInputs.region,
       credentials: {
@@ -92,41 +45,19 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
     return client;
   };
 
-  const validateConnection = async (inputs: unknown, { projectId }: { projectId: string }) => {
+  const validateConnection = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
-    const client = await $getClient(providerInputs, projectId);
-    const isConnected = await client
-      .send(new GetUserCommand({}))
-      .then(() => true)
-      .catch((err) => {
-        const message = (err as Error)?.message;
-        if (
-          providerInputs.method === AwsIamAuthType.AssumeRole &&
-          // assume role will throw an error asking to provider username, but if so this has access in aws correctly
-          message.includes("Must specify userName when calling with non-User credentials")
-        ) {
-          return true;
-        }
-        throw err;
-      });
+    const client = await $getClient(providerInputs);
+
+    const isConnected = await client.send(new GetUserCommand({})).then(() => true);
     return isConnected;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: {
-      name: string;
-    };
-    metadata: { projectId: string };
-  }) => {
-    const { inputs, usernameTemplate, metadata, identity } = data;
-
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
-    const client = await $getClient(providerInputs, metadata.projectId);
+    const client = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const { policyArns, userGroups, policyDocument, awsPath, permissionBoundaryPolicyArn } = providerInputs;
     const createUserRes = await client.send(
       new CreateUserCommand({
@@ -136,7 +67,6 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
         UserName: username
       })
     );
-
     if (!createUserRes.User) throw new BadRequestError({ message: "Failed to create AWS IAM User" });
     if (userGroups) {
       await Promise.all(
@@ -186,9 +116,9 @@ export const AwsIamProvider = (): TDynamicProviderFns => {
     };
   };
 
-  const revoke = async (inputs: unknown, entityId: string, metadata: { projectId: string }) => {
+  const revoke = async (inputs: unknown, entityId: string) => {
     const providerInputs = await validateProviderInputs(inputs);
-    const client = await $getClient(providerInputs, metadata.projectId);
+    const client = await $getClient(providerInputs);
 
     const username = entityId;
 

backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts

@@ -55,7 +55,7 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & {
     return data.success;
   };
 
-  const create = async ({ inputs }: { inputs: unknown }) => {
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
     const data = await $getToken(providerInputs.tenantId, providerInputs.applicationId, providerInputs.clientSecret);
     if (!data.success) {
@@ -88,7 +88,7 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & {
 
   const revoke = async (inputs: unknown, entityId: string) => {
     // Creates a new password
-    await create({ inputs });
+    await create(inputs);
     return { entityId };
   };
 

backend/src/ee/services/dynamic-secret/providers/cassandra.ts

@@ -8,21 +8,14 @@ import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretCassandraSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = (size = 48) => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const CassandraProvider = (): TDynamicProviderFns => {
@@ -76,17 +69,11 @@ export const CassandraProvider = (): TDynamicProviderFns => {
     return isConnected;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     const client = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
     const { keyspace } = providerInputs;
     const expiration = new Date(expireAt).toISOString();

backend/src/ee/services/dynamic-secret/providers/elastic-search.ts

@@ -6,21 +6,14 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretElasticSearchSchema, ElasticSearchAuthTypes, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const ElasticSearchProvider = (): TDynamicProviderFns => {
@@ -71,12 +64,11 @@ export const ElasticSearchProvider = (): TDynamicProviderFns => {
     return infoResponse;
   };
 
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null; identity?: { name: string } }) => {
-    const { inputs, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
     const connection = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
 
     await connection.security.putUser({

backend/src/ee/services/dynamic-secret/providers/index.ts

@@ -17,7 +17,6 @@ import { SapAseProvider } from "./sap-ase";
 import { SapHanaProvider } from "./sap-hana";
 import { SqlDatabaseProvider } from "./sql-database";
 import { TotpProvider } from "./totp";
-import { VerticaProvider } from "./vertica";
 
 type TBuildDynamicSecretProviderDTO = {
   gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
@@ -41,6 +40,5 @@ export const buildDynamicSecretProviders = ({
   [DynamicSecretProviders.Snowflake]: SnowflakeProvider(),
   [DynamicSecretProviders.Totp]: TotpProvider(),
   [DynamicSecretProviders.SapAse]: SapAseProvider(),
-  [DynamicSecretProviders.Kubernetes]: KubernetesProvider({ gatewayService }),
-  [DynamicSecretProviders.Vertica]: VerticaProvider({ gatewayService })
+  [DynamicSecretProviders.Kubernetes]: KubernetesProvider({ gatewayService })
 });

backend/src/ee/services/dynamic-secret/providers/kubernetes.ts

@@ -2,7 +2,7 @@ import axios from "axios";
 import https from "https";
 
 import { InternalServerError } from "@app/lib/errors";
-import { GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";
+import { withGatewayProxy } from "@app/lib/gateway";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TKubernetesTokenRequest } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-types";
 
@@ -43,7 +43,6 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
         return res;
       },
       {
-        protocol: GatewayProxyProtocol.Tcp,
         targetHost: inputs.targetHost,
         targetPort: inputs.targetPort,
         relayHost,
@@ -117,7 +116,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
     }
   };
 
-  const create = async ({ inputs, expireAt }: { inputs: unknown; expireAt: number }) => {
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
 
     const tokenRequestCallback = async (host: string, port: number) => {

backend/src/ee/services/dynamic-secret/providers/ldap.ts

@@ -9,7 +9,6 @@ import { BadRequestError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { LdapCredentialType, LdapSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*$#";
@@ -23,14 +22,8 @@ const encodePassword = (password?: string) => {
   return base64Password;
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(20);
 };
 
 const generateLDIF = ({
@@ -197,8 +190,7 @@ export const LdapProvider = (): TDynamicProviderFns => {
     return dnArray;
   };
 
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null; identity?: { name: string } }) => {
-    const { inputs, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
     const client = await $getClient(providerInputs);
 
@@ -225,7 +217,7 @@ export const LdapProvider = (): TDynamicProviderFns => {
         });
       }
     } else {
-      const username = generateUsername(usernameTemplate, identity);
+      const username = generateUsername();
       const password = generatePassword();
       const generatedLdif = generateLDIF({ username, password, ldifTemplate: providerInputs.creationLdif });
 

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -16,13 +16,7 @@ export enum SqlProviders {
   MySQL = "mysql2",
   Oracle = "oracledb",
   MsSQL = "mssql",
-  SapAse = "sap-ase",
-  Vertica = "vertica"
-}
-
-export enum AwsIamAuthType {
-  AssumeRole = "assume-role",
-  AccessKey = "access-key"
+  SapAse = "sap-ase"
 }
 
 export enum ElasticSearchAuthTypes {
@@ -173,38 +167,16 @@ export const DynamicSecretSapAseSchema = z.object({
   revocationStatement: z.string().trim()
 });
 
-export const DynamicSecretAwsIamSchema = z.preprocess(
-  (val) => {
-    if (typeof val === "object" && val !== null && !Object.hasOwn(val, "method")) {
-      // eslint-disable-next-line no-param-reassign
-      (val as { method: string }).method = AwsIamAuthType.AccessKey;
-    }
-    return val;
-  },
-  z.discriminatedUnion("method", [
-    z.object({
-      method: z.literal(AwsIamAuthType.AccessKey),
-      accessKey: z.string().trim().min(1),
-      secretAccessKey: z.string().trim().min(1),
-      region: z.string().trim().min(1),
-      awsPath: z.string().trim().optional(),
-      permissionBoundaryPolicyArn: z.string().trim().optional(),
-      policyDocument: z.string().trim().optional(),
-      userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
-    }),
-    z.object({
-      method: z.literal(AwsIamAuthType.AssumeRole),
-      roleArn: z.string().trim().min(1, "Role ARN required"),
-      region: z.string().trim().min(1),
-      awsPath: z.string().trim().optional(),
-      permissionBoundaryPolicyArn: z.string().trim().optional(),
-      policyDocument: z.string().trim().optional(),
-      userGroups: z.string().trim().optional(),
-      policyArns: z.string().trim().optional()
-    })
-  ])
-);
+export const DynamicSecretAwsIamSchema = z.object({
+  accessKey: z.string().trim().min(1),
+  secretAccessKey: z.string().trim().min(1),
+  region: z.string().trim().min(1),
+  awsPath: z.string().trim().optional(),
+  permissionBoundaryPolicyArn: z.string().trim().optional(),
+  policyDocument: z.string().trim().optional(),
+  userGroups: z.string().trim().optional(),
+  policyArns: z.string().trim().optional()
+});
 
 export const DynamicSecretMongoAtlasSchema = z.object({
   adminPublicKey: z.string().trim().min(1).describe("Admin user public api key"),
@@ -321,39 +293,6 @@ export const DynamicSecretKubernetesSchema = z.object({
   audiences: z.array(z.string().trim().min(1))
 });
 
-export const DynamicSecretVerticaSchema = z.object({
-  host: z.string().trim().toLowerCase(),
-  port: z.number(),
-  username: z.string().trim(),
-  password: z.string().trim(),
-  database: z.string().trim(),
-  gatewayId: z.string().nullable().optional(),
-  creationStatement: z.string().trim(),
-  revocationStatement: z.string().trim(),
-  passwordRequirements: z
-    .object({
-      length: z.number().min(1).max(250),
-      required: z
-        .object({
-          lowercase: z.number().min(0),
-          uppercase: z.number().min(0),
-          digits: z.number().min(0),
-          symbols: z.number().min(0)
-        })
-        .refine((data) => {
-          const total = Object.values(data).reduce((sum, count) => sum + count, 0);
-          return total <= 250;
-        }, "Sum of required characters cannot exceed 250"),
-      allowedSymbols: z.string().optional()
-    })
-    .refine((data) => {
-      const total = Object.values(data.required).reduce((sum, count) => sum + count, 0);
-      return total <= data.length;
-    }, "Sum of required characters cannot exceed the total length")
-    .optional()
-    .describe("Password generation requirements")
-});
-
 export const DynamicSecretTotpSchema = z.discriminatedUnion("configType", [
   z.object({
     configType: z.literal(TotpConfigType.URL),
@@ -398,8 +337,7 @@ export enum DynamicSecretProviders {
   Snowflake = "snowflake",
   Totp = "totp",
   SapAse = "sap-ase",
-  Kubernetes = "kubernetes",
-  Vertica = "vertica"
+  Kubernetes = "kubernetes"
 }
 
 export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
@@ -418,27 +356,13 @@ export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal(DynamicSecretProviders.Ldap), inputs: LdapSchema }),
   z.object({ type: z.literal(DynamicSecretProviders.Snowflake), inputs: DynamicSecretSnowflakeSchema }),
   z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema }),
-  z.object({ type: z.literal(DynamicSecretProviders.Kubernetes), inputs: DynamicSecretKubernetesSchema }),
-  z.object({ type: z.literal(DynamicSecretProviders.Vertica), inputs: DynamicSecretVerticaSchema })
+  z.object({ type: z.literal(DynamicSecretProviders.Kubernetes), inputs: DynamicSecretKubernetesSchema })
 ]);
 
 export type TDynamicProviderFns = {
-  create: (arg: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: {
-      name: string;
-    };
-    metadata: { projectId: string };
-  }) => Promise<{ entityId: string; data: unknown }>;
-  validateConnection: (inputs: unknown, metadata: { projectId: string }) => Promise<boolean>;
-  validateProviderInputs: (inputs: object, metadata: { projectId: string }) => Promise<unknown>;
-  revoke: (inputs: unknown, entityId: string, metadata: { projectId: string }) => Promise<{ entityId: string }>;
-  renew: (
-    inputs: unknown,
-    entityId: string,
-    expireAt: number,
-    metadata: { projectId: string }
-  ) => Promise<{ entityId: string }>;
+  create: (inputs: unknown, expireAt: number) => Promise<{ entityId: string; data: unknown }>;
+  validateConnection: (inputs: unknown) => Promise<boolean>;
+  validateProviderInputs: (inputs: object) => Promise<unknown>;
+  revoke: (inputs: unknown, entityId: string) => Promise<{ entityId: string }>;
+  renew: (inputs: unknown, entityId: string, expireAt: number) => Promise<{ entityId: string }>;
 };

backend/src/ee/services/dynamic-secret/providers/mongo-atlas.ts

@@ -6,21 +6,14 @@ import { createDigestAuthRequestInterceptor } from "@app/lib/axios/digest-auth";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { DynamicSecretMongoAtlasSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = (size = 48) => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32);
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const MongoAtlasProvider = (): TDynamicProviderFns => {
@@ -64,17 +57,11 @@ export const MongoAtlasProvider = (): TDynamicProviderFns => {
     return isConnected;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     const client = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
     const expiration = new Date(expireAt).toISOString();
     await client({

backend/src/ee/services/dynamic-secret/providers/mongo-db.ts

@@ -6,21 +6,14 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretMongoDBSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = (size = 48) => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32);
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const MongoDBProvider = (): TDynamicProviderFns => {
@@ -60,12 +53,11 @@ export const MongoDBProvider = (): TDynamicProviderFns => {
     return isConnected;
   };
 
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null; identity?: { name: string } }) => {
-    const { inputs, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
     const client = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
 
     const db = client.db(providerInputs.database);

backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts

@@ -8,21 +8,14 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretRabbitMqSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 type TCreateRabbitMQUser = {
@@ -117,12 +110,11 @@ export const RabbitMqProvider = (): TDynamicProviderFns => {
     return infoResponse;
   };
 
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null; identity?: { name: string } }) => {
-    const { inputs, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
     const connection = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
 
     await createRabbitMqUser({

backend/src/ee/services/dynamic-secret/providers/redis.ts

@@ -9,21 +9,14 @@ import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretRedisDBSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 const executeTransactions = async (connection: Redis, commands: string[]): Promise<(string | null)[] | null> => {
@@ -122,17 +115,11 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
     return pingResponse;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     const connection = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
     const expiration = new Date(expireAt).toISOString();
 

backend/src/ee/services/dynamic-secret/providers/sap-ase.ts

@@ -9,21 +9,14 @@ import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretSapAseSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = (size = 48) => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = `inf_${alphaNumericNanoId(25)}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(25);
 };
 
 enum SapCommands {
@@ -88,12 +81,11 @@ export const SapAseProvider = (): TDynamicProviderFns => {
     return true;
   };
 
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null; identity?: { name: string } }) => {
-    const { inputs, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown) => {
     const providerInputs = await validateProviderInputs(inputs);
 
-    const username = generateUsername(usernameTemplate, identity);
-    const password = generatePassword();
+    const username = `inf_${generateUsername()}`;
+    const password = `${generatePassword()}`;
 
     const client = await $getClient(providerInputs);
     const masterClient = await $getClient(providerInputs, true);

backend/src/ee/services/dynamic-secret/providers/sap-hana.ts

@@ -15,21 +15,14 @@ import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars
 
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretSapHanaSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const generatePassword = (size = 48) => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = alphaNumericNanoId(32); // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return alphaNumericNanoId(32);
 };
 
 export const SapHanaProvider = (): TDynamicProviderFns => {
@@ -98,16 +91,10 @@ export const SapHanaProvider = (): TDynamicProviderFns => {
     return testResult;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
     const expiration = new Date(expireAt).toISOString();
 

backend/src/ee/services/dynamic-secret/providers/snowflake.ts

@@ -8,7 +8,6 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
 
 import { DynamicSecretSnowflakeSchema, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 // destroy client requires callback...
 const noop = () => {};
@@ -18,14 +17,8 @@ const generatePassword = (size = 48) => {
   return customAlphabet(charset, 48)(size);
 };
 
-const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
-  const randomUsername = `infisical_${alphaNumericNanoId(32)}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity
-  });
+const generateUsername = () => {
+  return `infisical_${alphaNumericNanoId(32)}`; // username must start with alpha character, hence prefix
 };
 
 const getDaysToExpiry = (expiryDate: Date) => {
@@ -89,18 +82,12 @@ export const SnowflakeProvider = (): TDynamicProviderFns => {
     return isValidConnection;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
 
     const client = await $getClient(providerInputs);
 
-    const username = generateUsername(usernameTemplate, identity);
+    const username = generateUsername();
     const password = generatePassword();
 
     try {

backend/src/ee/services/dynamic-secret/providers/sql-database.ts

@@ -3,14 +3,13 @@ import handlebars from "handlebars";
 import knex from "knex";
 import { z } from "zod";
 
-import { GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";
+import { withGatewayProxy } from "@app/lib/gateway";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
 
 import { TGatewayServiceFactory } from "../../gateway/gateway-service";
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretSqlDBSchema, PasswordRequirements, SqlProviders, TDynamicProviderFns } from "./models";
-import { compileUsernameTemplate } from "./templateUtils";
 
 const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
 
@@ -105,23 +104,11 @@ const generatePassword = (provider: SqlProviders, requirements?: PasswordRequire
   }
 };
 
-const generateUsername = (provider: SqlProviders, usernameTemplate?: string | null, identity?: { name: string }) => {
-  let randomUsername = "";
+const generateUsername = (provider: SqlProviders) => {
   // For oracle, the client assumes everything is upper case when not using quotes around the password
-  if (provider === SqlProviders.Oracle) {
-    randomUsername = alphaNumericNanoId(32).toUpperCase();
-  } else {
-    randomUsername = alphaNumericNanoId(32);
-  }
-  if (!usernameTemplate) return randomUsername;
-  return compileUsernameTemplate({
-    usernameTemplate,
-    randomUsername,
-    identity,
-    options: {
-      toUpperCase: provider === SqlProviders.Oracle
-    }
-  });
+  if (provider === SqlProviders.Oracle) return alphaNumericNanoId(32).toUpperCase();
+
+  return alphaNumericNanoId(32);
 };
 
 type TSqlDatabaseProviderDTO = {
@@ -188,7 +175,6 @@ export const SqlDatabaseProvider = ({ gatewayService }: TSqlDatabaseProviderDTO)
         await gatewayCallback("localhost", port);
       },
       {
-        protocol: GatewayProxyProtocol.Tcp,
         targetHost: providerInputs.host,
         targetPort: providerInputs.port,
         relayHost,
@@ -224,17 +210,9 @@ export const SqlDatabaseProvider = ({ gatewayService }: TSqlDatabaseProviderDTO)
     return isConnected;
   };
 
-  const create = async (data: {
-    inputs: unknown;
-    expireAt: number;
-    usernameTemplate?: string | null;
-    identity?: { name: string };
-  }) => {
-    const { inputs, expireAt, usernameTemplate, identity } = data;
-
+  const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
-    const username = generateUsername(providerInputs.client, usernameTemplate, identity);
-
+    const username = generateUsername(providerInputs.client);
     const password = generatePassword(providerInputs.client, providerInputs.passwordRequirements);
     const gatewayCallback = async (host = providerInputs.host, port = providerInputs.port) => {
       const db = await $getClient({ ...providerInputs, port, host });

backend/src/ee/services/dynamic-secret/providers/templateUtils.ts

@@ -1,80 +0,0 @@
-/* eslint-disable func-names */
-import handlebars from "handlebars";
-import RE2 from "re2";
-
-import { logger } from "@app/lib/logger";
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-
-export const compileUsernameTemplate = ({
-  usernameTemplate,
-  randomUsername,
-  identity,
-  unixTimestamp,
-  options
-}: {
-  usernameTemplate: string;
-  randomUsername: string;
-  identity?: { name: string };
-  unixTimestamp?: number;
-  options?: {
-    toUpperCase?: boolean;
-  };
-}): string => {
-  // Create isolated handlebars instance
-  const hbs = handlebars.create();
-
-  // Register random helper on local instance
-  hbs.registerHelper("random", function (length: number) {
-    if (typeof length !== "number" || length <= 0 || length > 100) {
-      return "";
-    }
-    return alphaNumericNanoId(length);
-  });
-
-  // Register replace helper on local instance
-  hbs.registerHelper("replace", function (text: string, searchValue: string, replaceValue: string) {
-    // Convert to string if it's not already
-    const textStr = String(text || "");
-    if (!textStr) {
-      return textStr;
-    }
-
-    try {
-      const re2Pattern = new RE2(searchValue, "g");
-      // Replace all occurrences
-      return re2Pattern.replace(textStr, replaceValue);
-    } catch (error) {
-      logger.error(error, "RE2 pattern failed, using original template");
-      return textStr;
-    }
-  });
-
-  // Register truncate helper on local instance
-  hbs.registerHelper("truncate", function (text: string, length: number) {
-    // Convert to string if it's not already
-    const textStr = String(text || "");
-    if (!textStr) {
-      return textStr;
-    }
-
-    if (typeof length !== "number" || length <= 0) return textStr;
-    return textStr.substring(0, length);
-  });
-
-  // Compile template with context using local instance
-  const context = {
-    randomUsername,
-    unixTimestamp: unixTimestamp || Math.floor(Date.now() / 100),
-    identity: {
-      name: identity?.name
-    }
-  };
-
-  const result = hbs.compile(usernameTemplate)(context);
-
-  if (options?.toUpperCase) {
-    return result.toUpperCase();
-  }
-
-  return result;
-};

backend/src/ee/services/dynamic-secret/providers/vertica.ts

@@ -1,368 +0,0 @@
-import { randomInt } from "crypto";
-import handlebars from "handlebars";
-import knex, { Knex } from "knex";
-import { z } from "zod";
-
-import { BadRequestError } from "@app/lib/errors";
-import { GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";
-import { logger } from "@app/lib/logger";
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { validateHandlebarTemplate } from "@app/lib/template/validate-handlebars";
-
-import { TGatewayServiceFactory } from "../../gateway/gateway-service";
-import { verifyHostInputValidity } from "../dynamic-secret-fns";
-import { DynamicSecretVerticaSchema, PasswordRequirements, TDynamicProviderFns } from "./models";
-
-const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
-
-interface VersionResult {
-  version: string;
-}
-
-interface SessionResult {
-  session_id?: string;
-}
-
-interface DatabaseQueryResult {
-  rows?: Array<Record<string, unknown>>;
-}
-
-// Extended Knex client interface to handle Vertica-specific overrides
-interface VerticaKnexClient extends Knex {
-  client: {
-    parseVersion?: () => string;
-  };
-}
-
-const DEFAULT_PASSWORD_REQUIREMENTS = {
-  length: 48,
-  required: {
-    lowercase: 1,
-    uppercase: 1,
-    digits: 1,
-    symbols: 0
-  },
-  allowedSymbols: "-_.~!*"
-};
-
-const generatePassword = (requirements?: PasswordRequirements) => {
-  const finalReqs = requirements || DEFAULT_PASSWORD_REQUIREMENTS;
-
-  try {
-    const { length, required, allowedSymbols } = finalReqs;
-
-    const chars = {
-      lowercase: "abcdefghijklmnopqrstuvwxyz",
-      uppercase: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
-      digits: "0123456789",
-      symbols: allowedSymbols || "-_.~!*"
-    };
-
-    const parts: string[] = [];
-
-    if (required.lowercase > 0) {
-      parts.push(
-        ...Array(required.lowercase)
-          .fill(0)
-          .map(() => chars.lowercase[randomInt(chars.lowercase.length)])
-      );
-    }
-
-    if (required.uppercase > 0) {
-      parts.push(
-        ...Array(required.uppercase)
-          .fill(0)
-          .map(() => chars.uppercase[randomInt(chars.uppercase.length)])
-      );
-    }
-
-    if (required.digits > 0) {
-      parts.push(
-        ...Array(required.digits)
-          .fill(0)
-          .map(() => chars.digits[randomInt(chars.digits.length)])
-      );
-    }
-
-    if (required.symbols > 0) {
-      parts.push(
-        ...Array(required.symbols)
-          .fill(0)
-          .map(() => chars.symbols[randomInt(chars.symbols.length)])
-      );
-    }
-
-    const requiredTotal = Object.values(required).reduce<number>((a, b) => a + b, 0);
-    const remainingLength = Math.max(length - requiredTotal, 0);
-
-    const allowedChars = Object.entries(chars)
-      .filter(([key]) => required[key as keyof typeof required] > 0)
-      .map(([, value]) => value)
-      .join("");
-
-    parts.push(
-      ...Array(remainingLength)
-        .fill(0)
-        .map(() => allowedChars[randomInt(allowedChars.length)])
-    );
-
-    // shuffle the array to mix up the characters
-    for (let i = parts.length - 1; i > 0; i -= 1) {
-      const j = randomInt(i + 1);
-      [parts[i], parts[j]] = [parts[j], parts[i]];
-    }
-
-    return parts.join("");
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : "Unknown error";
-    throw new Error(`Failed to generate password: ${message}`);
-  }
-};
-
-const generateUsername = (usernameTemplate?: string | null) => {
-  const randomUsername = `inf_${alphaNumericNanoId(25)}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
-  if (!usernameTemplate) return randomUsername;
-
-  return handlebars.compile(usernameTemplate)({
-    randomUsername,
-    unixTimestamp: Math.floor(Date.now() / 100)
-  });
-};
-
-type TVerticaProviderDTO = {
-  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
-};
-
-export const VerticaProvider = ({ gatewayService }: TVerticaProviderDTO): TDynamicProviderFns => {
-  const validateProviderInputs = async (inputs: unknown) => {
-    const providerInputs = await DynamicSecretVerticaSchema.parseAsync(inputs);
-
-    const [hostIp] = await verifyHostInputValidity(providerInputs.host, Boolean(providerInputs.gatewayId));
-    validateHandlebarTemplate("Vertica creation", providerInputs.creationStatement, {
-      allowedExpressions: (val) => ["username", "password"].includes(val)
-    });
-    if (providerInputs.revocationStatement) {
-      validateHandlebarTemplate("Vertica revoke", providerInputs.revocationStatement, {
-        allowedExpressions: (val) => ["username"].includes(val)
-      });
-    }
-    return { ...providerInputs, hostIp };
-  };
-
-  const $getClient = async (providerInputs: z.infer<typeof DynamicSecretVerticaSchema> & { hostIp: string }) => {
-    const config = {
-      client: "pg",
-      connection: {
-        host: providerInputs.hostIp,
-        port: providerInputs.port,
-        database: providerInputs.database,
-        user: providerInputs.username,
-        password: providerInputs.password,
-        ssl: false
-      },
-      acquireConnectionTimeout: EXTERNAL_REQUEST_TIMEOUT,
-      pool: {
-        min: 0,
-        max: 1,
-        acquireTimeoutMillis: 30000,
-        createTimeoutMillis: 30000,
-        destroyTimeoutMillis: 5000,
-        idleTimeoutMillis: 30000,
-        reapIntervalMillis: 1000,
-        createRetryIntervalMillis: 100
-      },
-      // Disable version checking for Vertica compatibility
-      version: "9.6.0" // Fake a compatible PostgreSQL version
-    };
-
-    const client = knex(config) as VerticaKnexClient;
-
-    // Override the version parsing to prevent errors with Vertica
-    if (client.client && typeof client.client.parseVersion !== "undefined") {
-      client.client.parseVersion = () => "9.6.0";
-    }
-
-    return client;
-  };
-
-  const gatewayProxyWrapper = async (
-    providerInputs: z.infer<typeof DynamicSecretVerticaSchema>,
-    gatewayCallback: (host: string, port: number) => Promise<void>
-  ) => {
-    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(providerInputs.gatewayId as string);
-    const [relayHost, relayPort] = relayDetails.relayAddress.split(":");
-    await withGatewayProxy(
-      async (port) => {
-        await gatewayCallback("localhost", port);
-      },
-      {
-        protocol: GatewayProxyProtocol.Tcp,
-        targetHost: providerInputs.host,
-        targetPort: providerInputs.port,
-        relayHost,
-        relayPort: Number(relayPort),
-        identityId: relayDetails.identityId,
-        orgId: relayDetails.orgId,
-        tlsOptions: {
-          ca: relayDetails.certChain,
-          cert: relayDetails.certificate,
-          key: relayDetails.privateKey.toString()
-        }
-      }
-    );
-  };
-
-  const validateConnection = async (inputs: unknown) => {
-    const providerInputs = await validateProviderInputs(inputs);
-    let isConnected = false;
-
-    const gatewayCallback = async (host = providerInputs.hostIp, port = providerInputs.port) => {
-      let client: VerticaKnexClient | null = null;
-
-      try {
-        client = await $getClient({ ...providerInputs, hostIp: host, port });
-
-        const clientResult: DatabaseQueryResult = await client.raw("SELECT version() AS version");
-
-        const resultFromSelectedDatabase = clientResult.rows?.[0] as VersionResult | undefined;
-
-        if (!resultFromSelectedDatabase?.version) {
-          throw new BadRequestError({
-            message: "Failed to validate Vertica connection, version query failed"
-          });
-        }
-
-        isConnected = true;
-      } finally {
-        if (client) await client.destroy();
-      }
-    };
-
-    if (providerInputs.gatewayId) {
-      await gatewayProxyWrapper(providerInputs, gatewayCallback);
-    } else {
-      await gatewayCallback();
-    }
-
-    return isConnected;
-  };
-
-  const create = async (data: { inputs: unknown; usernameTemplate?: string | null }) => {
-    const { inputs, usernameTemplate } = data;
-    const providerInputs = await validateProviderInputs(inputs);
-
-    const username = generateUsername(usernameTemplate);
-    const password = generatePassword(providerInputs.passwordRequirements);
-
-    const gatewayCallback = async (host = providerInputs.host, port = providerInputs.port) => {
-      let client: VerticaKnexClient | null = null;
-
-      try {
-        client = await $getClient({ ...providerInputs, hostIp: host, port });
-
-        const creationStatement = handlebars.compile(providerInputs.creationStatement, { noEscape: true })({
-          username,
-          password
-        });
-
-        const queries = creationStatement.trim().replaceAll("\n", "").split(";").filter(Boolean);
-
-        // Execute queries sequentially to maintain transaction integrity
-        for (const query of queries) {
-          const trimmedQuery = query.trim();
-          if (trimmedQuery) {
-            // eslint-disable-next-line no-await-in-loop
-            await client.raw(trimmedQuery);
-          }
-        }
-      } finally {
-        if (client) await client.destroy();
-      }
-    };
-
-    if (providerInputs.gatewayId) {
-      await gatewayProxyWrapper(providerInputs, gatewayCallback);
-    } else {
-      await gatewayCallback();
-    }
-
-    return { entityId: username, data: { DB_USERNAME: username, DB_PASSWORD: password } };
-  };
-
-  const revoke = async (inputs: unknown, username: string) => {
-    const providerInputs = await validateProviderInputs(inputs);
-
-    const gatewayCallback = async (host = providerInputs.host, port = providerInputs.port) => {
-      let client: VerticaKnexClient | null = null;
-
-      try {
-        client = await $getClient({ ...providerInputs, hostIp: host, port });
-
-        const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({
-          username
-        });
-
-        const queries = revokeStatement.trim().replaceAll("\n", "").split(";").filter(Boolean);
-
-        // Check for active sessions and close them
-        try {
-          const sessionResult: DatabaseQueryResult = await client.raw(
-            "SELECT session_id FROM sessions WHERE user_name = ?",
-            [username]
-          );
-
-          const activeSessions = (sessionResult.rows || []) as SessionResult[];
-
-          // Close all sessions in parallel since they're independent operations
-          if (activeSessions.length > 0) {
-            const sessionClosePromises = activeSessions.map(async (session) => {
-              try {
-                await client!.raw("SELECT close_session(?)", [session.session_id]);
-              } catch (error) {
-                // Continue if session is already closed
-                logger.error(error, `Failed to close session ${session.session_id}`);
-              }
-            });
-
-            await Promise.allSettled(sessionClosePromises);
-          }
-        } catch (error) {
-          // Continue if we can't query sessions (permissions, etc.)
-          logger.error(error, "Could not query/close active sessions");
-        }
-
-        // Execute revocation queries sequentially to maintain transaction integrity
-        for (const query of queries) {
-          const trimmedQuery = query.trim();
-          if (trimmedQuery) {
-            // eslint-disable-next-line no-await-in-loop
-            await client.raw(trimmedQuery);
-          }
-        }
-      } finally {
-        if (client) await client.destroy();
-      }
-    };
-
-    if (providerInputs.gatewayId) {
-      await gatewayProxyWrapper(providerInputs, gatewayCallback);
-    } else {
-      await gatewayCallback();
-    }
-
-    return { entityId: username };
-  };
-
-  const renew = async (_: unknown, username: string) => {
-    // No need for renewal
-    return { entityId: username };
-  };
-
-  return {
-    validateProviderInputs,
-    validateConnection,
-    create,
-    revoke,
-    renew
-  };
-};

backend/src/ee/services/group/group-types.ts

@@ -42,10 +42,6 @@ export type TListGroupUsersDTO = {
   filter?: EFilterReturnedUsers;
 } & TGenericPermission;
 
-export type TListProjectGroupUsersDTO = TListGroupUsersDTO & {
-  projectId: string;
-};
-
 export type TAddUserToGroupDTO = {
   id: string;
   username: string;

backend/src/ee/services/license/license-fns.ts

@@ -56,7 +56,6 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   kmip: false,
   gateway: false,
   sshHostGroups: false,
-  secretScanning: false,
   enterpriseSecretSyncs: false,
   enterpriseAppConnections: false
 });

backend/src/ee/services/license/license-service.ts

@@ -17,7 +17,7 @@ import { TIdentityOrgDALFactory } from "@app/services/identity/identity-org-dal"
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
-import { OrgPermissionBillingActions, OrgPermissionSubjects } from "../permission/org-permission";
+import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { BillingPlanRows, BillingPlanTableHead } from "./licence-enums";
 import { TLicenseDALFactory } from "./license-dal";
@@ -288,7 +288,7 @@ export const licenseServiceFactory = ({
     billingCycle
   }: TOrgPlansTableDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
     const { data } = await licenseServerCloudApi.request.get(
       `/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}`
     );
@@ -310,10 +310,8 @@ export const licenseServiceFactory = ({
     success_url
   }: TStartOrgTrialDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -340,10 +338,8 @@ export const licenseServiceFactory = ({
     actorOrgId
   }: TCreateOrgPortalSession) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -389,7 +385,7 @@ export const licenseServiceFactory = ({
 
   const getOrgBillingInfo = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -417,7 +413,7 @@ export const licenseServiceFactory = ({
   // returns org current plan feature table
   const getOrgPlanTable = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -488,7 +484,7 @@ export const licenseServiceFactory = ({
 
   const getOrgBillingDetails = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -513,10 +509,7 @@ export const licenseServiceFactory = ({
     email
   }: TUpdateOrgBillingDetailsDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -536,7 +529,7 @@ export const licenseServiceFactory = ({
 
   const getOrgPmtMethods = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TOrgPmtMethodsDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -563,10 +556,7 @@ export const licenseServiceFactory = ({
     cancel_url
   }: TAddOrgPmtMethodDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -595,10 +585,7 @@ export const licenseServiceFactory = ({
     pmtMethodId
   }: TDelOrgPmtMethodDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -615,7 +602,7 @@ export const licenseServiceFactory = ({
 
   const getOrgTaxIds = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgTaxIdDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -633,10 +620,7 @@ export const licenseServiceFactory = ({
 
   const addOrgTaxId = async ({ actorId, actor, actorAuthMethod, actorOrgId, orgId, type, value }: TAddOrgTaxIdDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -657,10 +641,7 @@ export const licenseServiceFactory = ({
 
   const delOrgTaxId = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId, taxId }: TDelOrgTaxIdDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionBillingActions.ManageBilling,
-      OrgPermissionSubjects.Billing
-    );
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -677,7 +658,7 @@ export const licenseServiceFactory = ({
 
   const getOrgTaxInvoices = async ({ actorId, actor, actorOrgId, actorAuthMethod, orgId }: TOrgInvoiceDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -694,7 +675,7 @@ export const licenseServiceFactory = ({
 
   const getOrgLicenses = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TOrgLicensesDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
 
     const organization = await orgDAL.findOrgById(orgId);
     if (!organization) {
@@ -709,10 +690,6 @@ export const licenseServiceFactory = ({
     return licenses;
   };
 
-  const invalidateGetPlan = async (orgId: string) => {
-    await keyStore.deleteItem(FEATURE_CACHE_KEY(orgId));
-  };
-
   return {
     generateOrgCustomerId,
     removeOrgCustomer,
@@ -727,7 +704,6 @@ export const licenseServiceFactory = ({
       return onPremFeatures;
     },
     getPlan,
-    invalidateGetPlan,
     updateSubscriptionOrgMemberCount,
     refreshPlan,
     getOrgPlan,

backend/src/ee/services/license/license-types.ts

@@ -72,7 +72,6 @@ export type TFeatureSet = {
   kmip: false;
   gateway: false;
   sshHostGroups: false;
-  secretScanning: false;
   enterpriseSecretSyncs: false;
   enterpriseAppConnections: false;
 };

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -44,6 +44,7 @@ import {
   TOidcLoginDTO,
   TUpdateOidcCfgDTO
 } from "./oidc-config-types";
+import { logger } from "@app/lib/logger";
 
 type TOidcConfigServiceFactoryDep = {
   userDAL: Pick<
@@ -699,6 +700,7 @@ export const oidcConfigServiceFactory = ({
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (_req: any, tokenSet: TokenSet, cb: any) => {
         const claims = tokenSet.claims();
+        logger.info(`User OIDC claims received for [orgId=${org.id}] [claims=${JSON.stringify(claims)}]`);
         if (!claims.email || !claims.given_name) {
           throw new BadRequestError({
             message: "Invalid request. Missing email or first name"

backend/src/ee/services/permission/default-roles.ts

@@ -2,6 +2,7 @@ import { AbilityBuilder, createMongoAbility, MongoAbility } from "@casl/ability"
 
 import {
   ProjectPermissionActions,
+  ProjectPermissionApprovalActions,
   ProjectPermissionCertificateActions,
   ProjectPermissionCmekActions,
   ProjectPermissionDynamicSecretActions,
@@ -10,12 +11,8 @@ import {
   ProjectPermissionKmipActions,
   ProjectPermissionMemberActions,
   ProjectPermissionPkiSubscriberActions,
-  ProjectPermissionPkiTemplateActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSecretRotationActions,
-  ProjectPermissionSecretScanningConfigActions,
-  ProjectPermissionSecretScanningDataSourceActions,
-  ProjectPermissionSecretScanningFindingActions,
   ProjectPermissionSecretSyncActions,
   ProjectPermissionSet,
   ProjectPermissionSshHostActions,
@@ -39,6 +36,7 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.AuditLogs,
     ProjectPermissionSub.IpAllowList,
     ProjectPermissionSub.CertificateAuthorities,
+    ProjectPermissionSub.CertificateTemplates,
     ProjectPermissionSub.PkiAlerts,
     ProjectPermissionSub.PkiCollections,
     ProjectPermissionSub.SshCertificateAuthorities,
@@ -59,22 +57,12 @@ const buildAdminPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionPkiTemplateActions.Read,
-      ProjectPermissionPkiTemplateActions.Edit,
-      ProjectPermissionPkiTemplateActions.Create,
-      ProjectPermissionPkiTemplateActions.Delete,
-      ProjectPermissionPkiTemplateActions.IssueCert,
-      ProjectPermissionPkiTemplateActions.ListCerts
-    ],
-    ProjectPermissionSub.CertificateTemplates
-  );
-
-  can(
-    [
-      ProjectPermissionActions.Read,
-      ProjectPermissionActions.Edit,
-      ProjectPermissionActions.Create,
-      ProjectPermissionActions.Delete
+      ProjectPermissionApprovalActions.Read,
+      ProjectPermissionApprovalActions.Edit,
+      ProjectPermissionApprovalActions.Create,
+      ProjectPermissionApprovalActions.Delete,
+      ProjectPermissionApprovalActions.AllowChangeBypass,
+      ProjectPermissionApprovalActions.AllowAccessBypass
     ],
     ProjectPermissionSub.SecretApproval
   );
@@ -151,7 +139,6 @@ const buildAdminPermissionRules = () => {
   can(
     [
       ProjectPermissionSecretActions.DescribeSecret,
-      ProjectPermissionSecretActions.DescribeAndReadValue,
       ProjectPermissionSecretActions.ReadValue,
       ProjectPermissionSecretActions.Create,
       ProjectPermissionSecretActions.Edit,
@@ -223,29 +210,6 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.SecretRotation
   );
 
-  can(
-    [
-      ProjectPermissionSecretScanningDataSourceActions.Create,
-      ProjectPermissionSecretScanningDataSourceActions.Edit,
-      ProjectPermissionSecretScanningDataSourceActions.Delete,
-      ProjectPermissionSecretScanningDataSourceActions.Read,
-      ProjectPermissionSecretScanningDataSourceActions.TriggerScans,
-      ProjectPermissionSecretScanningDataSourceActions.ReadScans,
-      ProjectPermissionSecretScanningDataSourceActions.ReadResources
-    ],
-    ProjectPermissionSub.SecretScanningDataSources
-  );
-
-  can(
-    [ProjectPermissionSecretScanningFindingActions.Read, ProjectPermissionSecretScanningFindingActions.Update],
-    ProjectPermissionSub.SecretScanningFindings
-  );
-
-  can(
-    [ProjectPermissionSecretScanningConfigActions.Read, ProjectPermissionSecretScanningConfigActions.Update],
-    ProjectPermissionSub.SecretScanningConfigs
-  );
-
   return rules;
 };
 
@@ -255,7 +219,6 @@ const buildMemberPermissionRules = () => {
   can(
     [
       ProjectPermissionSecretActions.DescribeSecret,
-      ProjectPermissionSecretActions.DescribeAndReadValue,
       ProjectPermissionSecretActions.ReadValue,
       ProjectPermissionSecretActions.Edit,
       ProjectPermissionSecretActions.Create,
@@ -292,7 +255,7 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.SecretImports
   );
 
-  can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretApproval);
+  can([ProjectPermissionApprovalActions.Read], ProjectPermissionSub.SecretApproval);
   can([ProjectPermissionSecretRotationActions.Read], ProjectPermissionSub.SecretRotation);
 
   can([ProjectPermissionActions.Read, ProjectPermissionActions.Create], ProjectPermissionSub.SecretRollback);
@@ -388,7 +351,7 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.Certificates
   );
 
-  can([ProjectPermissionPkiTemplateActions.Read], ProjectPermissionSub.CertificateTemplates);
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.CertificateTemplates);
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiAlerts);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiCollections);
@@ -427,23 +390,6 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.SecretSyncs
   );
 
-  can(
-    [
-      ProjectPermissionSecretScanningDataSourceActions.Read,
-      ProjectPermissionSecretScanningDataSourceActions.TriggerScans,
-      ProjectPermissionSecretScanningDataSourceActions.ReadScans,
-      ProjectPermissionSecretScanningDataSourceActions.ReadResources
-    ],
-    ProjectPermissionSub.SecretScanningDataSources
-  );
-
-  can(
-    [ProjectPermissionSecretScanningFindingActions.Read, ProjectPermissionSecretScanningFindingActions.Update],
-    ProjectPermissionSub.SecretScanningFindings
-  );
-
-  can([ProjectPermissionSecretScanningConfigActions.Read], ProjectPermissionSub.SecretScanningConfigs);
-
   return rules;
 };
 
@@ -457,7 +403,7 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
   can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
+  can(ProjectPermissionApprovalActions.Read, ProjectPermissionSub.SecretApproval);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionSecretRotationActions.Read, ProjectPermissionSub.SecretRotation);
   can(ProjectPermissionMemberActions.Read, ProjectPermissionSub.Member);
@@ -474,25 +420,11 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
   can(ProjectPermissionCertificateActions.Read, ProjectPermissionSub.Certificates);
-  can(ProjectPermissionPkiTemplateActions.Read, ProjectPermissionSub.CertificateTemplates);
   can(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateTemplates);
   can(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs);
 
-  can(
-    [
-      ProjectPermissionSecretScanningDataSourceActions.Read,
-      ProjectPermissionSecretScanningDataSourceActions.ReadScans,
-      ProjectPermissionSecretScanningDataSourceActions.ReadResources
-    ],
-    ProjectPermissionSub.SecretScanningDataSources
-  );
-
-  can([ProjectPermissionSecretScanningFindingActions.Read], ProjectPermissionSub.SecretScanningFindings);
-
-  can([ProjectPermissionSecretScanningConfigActions.Read], ProjectPermissionSub.SecretScanningConfigs);
-
   return rules;
 };
 

backend/src/ee/services/permission/org-permission.ts

@@ -67,11 +67,6 @@ export enum OrgPermissionGroupActions {
   RemoveMembers = "remove-members"
 }
 
-export enum OrgPermissionBillingActions {
-  Read = "read",
-  ManageBilling = "manage-billing"
-}
-
 export enum OrgPermissionSubjects {
   Workspace = "workspace",
   Role = "role",
@@ -112,7 +107,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.Ldap]
   | [OrgPermissionGroupActions, OrgPermissionSubjects.Groups]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
-  | [OrgPermissionBillingActions, OrgPermissionSubjects.Billing]
+  | [OrgPermissionActions, OrgPermissionSubjects.Billing]
   | [OrgPermissionIdentityActions, OrgPermissionSubjects.Identity]
   | [OrgPermissionActions, OrgPermissionSubjects.Kms]
   | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs]
@@ -303,8 +298,10 @@ const buildAdminPermission = () => {
   can(OrgPermissionGroupActions.AddMembers, OrgPermissionSubjects.Groups);
   can(OrgPermissionGroupActions.RemoveMembers, OrgPermissionSubjects.Groups);
 
-  can(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
-  can(OrgPermissionBillingActions.ManageBilling, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing);
 
   can(OrgPermissionIdentityActions.Read, OrgPermissionSubjects.Identity);
   can(OrgPermissionIdentityActions.Create, OrgPermissionSubjects.Identity);
@@ -365,7 +362,7 @@ const buildMemberPermission = () => {
   can(OrgPermissionGroupActions.Read, OrgPermissionSubjects.Groups);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Role);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings);
-  can(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
+  can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing);
   can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount);
 
   can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning);

backend/src/ee/services/permission/project-permission.ts

@@ -34,6 +34,15 @@ export enum ProjectPermissionSecretActions {
   Delete = "delete"
 }
 
+export enum ProjectPermissionApprovalActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  AllowChangeBypass = "allow-change-bypass",
+  AllowAccessBypass = "allow-access-bypass"
+}
+
 export enum ProjectPermissionCmekActions {
   Read = "read",
   Create = "create",
@@ -87,15 +96,6 @@ export enum ProjectPermissionSshHostActions {
   IssueHostCert = "issue-host-cert"
 }
 
-export enum ProjectPermissionPkiTemplateActions {
-  Read = "read",
-  Create = "create",
-  Edit = "edit",
-  Delete = "delete",
-  IssueCert = "issue-cert",
-  ListCerts = "list-certs"
-}
-
 export enum ProjectPermissionPkiSubscriberActions {
   Read = "read",
   Create = "create",
@@ -132,26 +132,6 @@ export enum ProjectPermissionKmipActions {
   GenerateClientCertificates = "generate-client-certificates"
 }
 
-export enum ProjectPermissionSecretScanningDataSourceActions {
-  Read = "read-data-sources",
-  Create = "create-data-sources",
-  Edit = "edit-data-sources",
-  Delete = "delete-data-sources",
-  TriggerScans = "trigger-data-source-scans",
-  ReadScans = "read-data-source-scans",
-  ReadResources = "read-data-source-resources"
-}
-
-export enum ProjectPermissionSecretScanningFindingActions {
-  Read = "read-findings",
-  Update = "update-findings"
-}
-
-export enum ProjectPermissionSecretScanningConfigActions {
-  Read = "read-configs",
-  Update = "update-configs"
-}
-
 export enum ProjectPermissionSub {
   Role = "role",
   Member = "member",
@@ -187,10 +167,7 @@ export enum ProjectPermissionSub {
   Kms = "kms",
   Cmek = "cmek",
   SecretSyncs = "secret-syncs",
-  Kmip = "kmip",
-  SecretScanningDataSources = "secret-scanning-data-sources",
-  SecretScanningFindings = "secret-scanning-findings",
-  SecretScanningConfigs = "secret-scanning-configs"
+  Kmip = "kmip"
 }
 
 export type SecretSubjectFields = {
@@ -232,11 +209,6 @@ export type SshHostSubjectFields = {
   hostname: string;
 };
 
-export type PkiTemplateSubjectFields = {
-  name: string;
-  // (dangtony98): consider adding [commonName] as a subject field in the future
-};
-
 export type PkiSubscriberSubjectFields = {
   name: string;
   // (dangtony98): consider adding [commonName] as a subject field in the future
@@ -279,7 +251,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.IpAllowList]
   | [ProjectPermissionActions, ProjectPermissionSub.Settings]
   | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
-  | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
+  | [ProjectPermissionApprovalActions, ProjectPermissionSub.SecretApproval]
   | [
       ProjectPermissionSecretRotationActions,
       (
@@ -293,13 +265,7 @@ export type ProjectPermissionSet =
     ]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
   | [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
-  | [
-      ProjectPermissionPkiTemplateActions,
-      (
-        | ProjectPermissionSub.CertificateTemplates
-        | (ForcedSubject<ProjectPermissionSub.CertificateTemplates> & PkiTemplateSubjectFields)
-      )
-    ]
+  | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateAuthorities]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificates]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateTemplates]
@@ -324,10 +290,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
   | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms]
-  | [ProjectPermissionSecretScanningDataSourceActions, ProjectPermissionSub.SecretScanningDataSources]
-  | [ProjectPermissionSecretScanningFindingActions, ProjectPermissionSub.SecretScanningFindings]
-  | [ProjectPermissionSecretScanningConfigActions, ProjectPermissionSub.SecretScanningConfigs];
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms];
 
 const SECRET_PATH_MISSING_SLASH_ERR_MSG = "Invalid Secret Path; it must start with a '/'";
 const SECRET_PATH_PERMISSION_OPERATOR_SCHEMA = z.union([
@@ -376,8 +339,7 @@ const DynamicSecretConditionV2Schema = z
         .object({
           [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
           [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
-          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
-          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
         })
         .partial()
     ]),
@@ -405,23 +367,6 @@ const DynamicSecretConditionV2Schema = z
   })
   .partial();
 
-const SecretImportConditionSchema = z
-  .object({
-    environment: z.union([
-      z.string(),
-      z
-        .object({
-          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
-          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
-          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
-          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
-        })
-        .partial()
-    ]),
-    secretPath: SECRET_PATH_PERMISSION_OPERATOR_SCHEMA
-  })
-  .partial();
-
 const SecretConditionV2Schema = z
   .object({
     environment: z.union([
@@ -500,25 +445,10 @@ const PkiSubscriberConditionSchema = z
   })
   .partial();
 
-const PkiTemplateConditionSchema = z
-  .object({
-    name: z.union([
-      z.string(),
-      z
-        .object({
-          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
-          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB],
-          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
-        })
-        .partial()
-    ])
-  })
-  .partial();
-
 const GeneralPermissionSchema = [
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionApprovalActions).describe(
       "Describe what action an entity can take."
     )
   }),
@@ -606,6 +536,12 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    )
+  }),
   z.object({
     subject: z
       .literal(ProjectPermissionSub.SshCertificateAuthorities)
@@ -675,26 +611,6 @@ const GeneralPermissionSchema = [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionKmipActions).describe(
       "Describe what action an entity can take."
     )
-  }),
-  z.object({
-    subject: z
-      .literal(ProjectPermissionSub.SecretScanningDataSources)
-      .describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretScanningDataSourceActions).describe(
-      "Describe what action an entity can take."
-    )
-  }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SecretScanningFindings).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretScanningFindingActions).describe(
-      "Describe what action an entity can take."
-    )
-  }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SecretScanningConfigs).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretScanningConfigActions).describe(
-      "Describe what action an entity can take."
-    )
   })
 ];
 
@@ -759,7 +675,7 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
       "Describe what action an entity can take."
     ),
-    conditions: SecretImportConditionSchema.describe(
+    conditions: SecretConditionV1Schema.describe(
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
@@ -803,16 +719,6 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionPkiTemplateActions).describe(
-      "Describe what action an entity can take."
-    ),
-    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
-    conditions: PkiTemplateConditionSchema.describe(
-      "When specified, only matching conditions will be allowed to access given resource."
-    ).optional()
-  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretRotation).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
@@ -823,7 +729,6 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
-
   ...GeneralPermissionSchema
 ]);
 

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -9,7 +9,6 @@ import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/per
 import { ActorType } from "@app/services/auth/auth-type";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 
-import { TAccessApprovalRequestDALFactory } from "../access-approval-request/access-approval-request-dal";
 import { constructPermissionErrorMessage, validatePrivilegeChangeOperation } from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import {
@@ -17,7 +16,6 @@ import {
   ProjectPermissionSet,
   ProjectPermissionSub
 } from "../permission/project-permission";
-import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "./project-user-additional-privilege-dal";
 import {
   ProjectUserAdditionalPrivilegeTemporaryMode,
@@ -32,7 +30,6 @@ type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
   projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
 };
 
 export type TProjectUserAdditionalPrivilegeServiceFactory = ReturnType<
@@ -47,8 +44,7 @@ const unpackPermissions = (permissions: unknown) =>
 export const projectUserAdditionalPrivilegeServiceFactory = ({
   projectUserAdditionalPrivilegeDAL,
   projectMembershipDAL,
-  permissionService,
-  accessApprovalRequestDAL
+  permissionService
 }: TProjectUserAdditionalPrivilegeServiceFactoryDep) => {
   const create = async ({
     slug,
@@ -283,15 +279,6 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Edit, ProjectPermissionSub.Member);
 
-    await accessApprovalRequestDAL.update(
-      {
-        privilegeId: userPrivilege.id
-      },
-      {
-        privilegeDeletedAt: new Date(),
-        status: ApprovalStatus.REJECTED
-      }
-    );
     const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
     return {
       ...deletedPrivilege,

backend/src/ee/services/secret-approval-policy/secret-approval-policy-approver-dal.ts

@@ -8,10 +8,3 @@ export const secretApprovalPolicyApproverDALFactory = (db: TDbClient) => {
   const sapApproverOrm = ormify(db, TableName.SecretApprovalPolicyApprover);
   return sapApproverOrm;
 };
-
-export type TSecretApprovalPolicyBypasserDALFactory = ReturnType<typeof secretApprovalPolicyBypasserDALFactory>;
-
-export const secretApprovalPolicyBypasserDALFactory = (db: TDbClient) => {
-  const sapBypasserOrm = ormify(db, TableName.SecretApprovalPolicyBypasser);
-  return sapBypasserOrm;
-};

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -1,17 +1,11 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import {
-  SecretApprovalPoliciesSchema,
-  TableName,
-  TSecretApprovalPolicies,
-  TUserGroupMembership,
-  TUsers
-} from "@app/db/schemas";
+import { SecretApprovalPoliciesSchema, TableName, TSecretApprovalPolicies, TUsers } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
 
-import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
 
 export type TSecretApprovalPolicyDALFactory = ReturnType<typeof secretApprovalPolicyDALFactory>;
 
@@ -49,22 +43,6 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
         "secretApprovalPolicyApproverUser.id"
       )
-      // Bypasser
-      .leftJoin(
-        TableName.SecretApprovalPolicyBypasser,
-        `${TableName.SecretApprovalPolicy}.id`,
-        `${TableName.SecretApprovalPolicyBypasser}.policyId`
-      )
-      .leftJoin<TUserGroupMembership>(
-        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-        `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
-        `bypasserUserGroupMembership.groupId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("secretApprovalPolicyBypasserUser"),
-        `${TableName.SecretApprovalPolicyBypasser}.bypasserUserId`,
-        "secretApprovalPolicyBypasserUser.id"
-      )
       .leftJoin<TUsers>(TableName.Users, `${TableName.UserGroupMembership}.userId`, `${TableName.Users}.id`)
       .select(
         tx.ref("id").withSchema("secretApprovalPolicyApproverUser").as("approverUserId"),
@@ -80,20 +58,6 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema(TableName.Users).as("approverGroupFirstName"),
         tx.ref("lastName").withSchema(TableName.Users).as("approverGroupLastName")
       )
-      .select(
-        tx.ref("id").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUserId"),
-        tx.ref("email").withSchema("secretApprovalPolicyBypasserUser").as("bypasserEmail"),
-        tx.ref("firstName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserFirstName"),
-        tx.ref("username").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUsername"),
-        tx.ref("lastName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserLastName")
-      )
-      .select(
-        tx.ref("bypasserGroupId").withSchema(TableName.SecretApprovalPolicyBypasser),
-        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
-        tx.ref("email").withSchema(TableName.Users).as("bypasserGroupEmail"),
-        tx.ref("firstName").withSchema(TableName.Users).as("bypasserGroupFirstName"),
-        tx.ref("lastName").withSchema(TableName.Users).as("bypasserGroupLastName")
-      )
       .select(
         tx.ref("name").withSchema(TableName.Environment).as("envName"),
         tx.ref("slug").withSchema(TableName.Environment).as("envSlug"),
@@ -179,7 +143,7 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
             label: "approvers" as const,
             mapper: ({ approverUserId: id, approverUsername }) => ({
               type: ApproverType.User,
-              username: approverUsername,
+              name: approverUsername,
               id
             })
           },
@@ -191,23 +155,6 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
               id
             })
           },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserUserId: id, bypasserUsername }) => ({
-              type: BypasserType.User,
-              username: bypasserUsername,
-              id
-            })
-          },
-          {
-            key: "bypasserGroupId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserGroupId: id }) => ({
-              type: BypasserType.Group,
-              id
-            })
-          },
           {
             key: "approverUserId",
             label: "userApprovers" as const,

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -3,21 +3,18 @@ import picomatch from "picomatch";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { containsGlobPatterns } from "@app/lib/picomatch";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
-import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TSecretApprovalRequestDALFactory } from "../secret-approval-request/secret-approval-request-dal";
 import { RequestState } from "../secret-approval-request/secret-approval-request-types";
-import {
-  TSecretApprovalPolicyApproverDALFactory,
-  TSecretApprovalPolicyBypasserDALFactory
-} from "./secret-approval-policy-approver-dal";
+import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
 import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
 import {
   TCreateSapDTO,
@@ -39,7 +36,6 @@ type TSecretApprovalPolicyServiceFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   userDAL: Pick<TUserDALFactory, "find">;
   secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
-  secretApprovalPolicyBypasserDAL: TSecretApprovalPolicyBypasserDALFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   secretApprovalRequestDAL: Pick<TSecretApprovalRequestDALFactory, "update">;
 };
@@ -50,7 +46,6 @@ export const secretApprovalPolicyServiceFactory = ({
   secretApprovalPolicyDAL,
   permissionService,
   secretApprovalPolicyApproverDAL,
-  secretApprovalPolicyBypasserDAL,
   projectEnvDAL,
   userDAL,
   licenseService,
@@ -64,7 +59,6 @@ export const secretApprovalPolicyServiceFactory = ({
     actorAuthMethod,
     approvals,
     approvers,
-    bypassers,
     projectId,
     secretPath,
     environment,
@@ -80,7 +74,7 @@ export const secretApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
       .filter(Boolean) as string[];
 
     if (!groupApprovers.length && approvals > approvers.length)
@@ -95,7 +89,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionApprovalActions.Create,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -113,44 +107,6 @@ export const secretApprovalPolicyServiceFactory = ({
         message: `Environment with slug '${environment}' not found in project with ID ${projectId}`
       });
 
-    let groupBypassers: string[] = [];
-    let bypasserUserIds: string[] = [];
-
-    if (bypassers && bypassers.length) {
-      groupBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.Group)
-        .map((bypasser) => bypasser.id) as string[];
-
-      const userBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.User)
-        .map((bypasser) => bypasser.id)
-        .filter(Boolean) as string[];
-
-      const userBypasserNames = bypassers
-        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
-        .filter(Boolean) as string[];
-
-      bypasserUserIds = userBypassers;
-      if (userBypasserNames.length) {
-        const bypasserUsers = await userDAL.find({
-          $in: {
-            username: userBypasserNames
-          }
-        });
-
-        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
-        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
-
-        if (invalidUsernames.length) {
-          throw new BadRequestError({
-            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
-          });
-        }
-
-        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
-      }
-    }
-
     const secretApproval = await secretApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await secretApprovalPolicyDAL.create(
         {
@@ -202,27 +158,6 @@ export const secretApprovalPolicyServiceFactory = ({
         })),
         tx
       );
-
-      if (bypasserUserIds.length) {
-        await secretApprovalPolicyBypasserDAL.insertMany(
-          bypasserUserIds.map((userId) => ({
-            bypasserUserId: userId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
-      if (groupBypassers.length) {
-        await secretApprovalPolicyBypasserDAL.insertMany(
-          groupBypassers.map((groupId) => ({
-            bypasserGroupId: groupId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
       return doc;
     });
 
@@ -231,7 +166,6 @@ export const secretApprovalPolicyServiceFactory = ({
 
   const updateSecretApprovalPolicy = async ({
     approvers,
-    bypassers,
     secretPath,
     name,
     actorId,
@@ -252,7 +186,7 @@ export const secretApprovalPolicyServiceFactory = ({
       .filter(Boolean) as string[];
 
     const userApproverNames = approvers
-      .map((approver) => (approver.type === ApproverType.User ? approver.username : undefined))
+      .map((approver) => (approver.type === ApproverType.User ? approver.name : undefined))
       .filter(Boolean) as string[];
 
     const secretApprovalPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
@@ -270,7 +204,10 @@ export const secretApprovalPolicyServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionApprovalActions.Edit,
+      ProjectPermissionSub.SecretApproval
+    );
 
     const plan = await licenseService.getPlan(actorOrgId);
     if (!plan.secretApproval) {
@@ -280,44 +217,6 @@ export const secretApprovalPolicyServiceFactory = ({
       });
     }
 
-    let groupBypassers: string[] = [];
-    let bypasserUserIds: string[] = [];
-
-    if (bypassers && bypassers.length) {
-      groupBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.Group)
-        .map((bypasser) => bypasser.id) as string[];
-
-      const userBypassers = bypassers
-        .filter((bypasser) => bypasser.type === BypasserType.User)
-        .map((bypasser) => bypasser.id)
-        .filter(Boolean) as string[];
-
-      const userBypasserNames = bypassers
-        .map((bypasser) => (bypasser.type === BypasserType.User ? bypasser.username : undefined))
-        .filter(Boolean) as string[];
-
-      bypasserUserIds = userBypassers;
-      if (userBypasserNames.length) {
-        const bypasserUsers = await userDAL.find({
-          $in: {
-            username: userBypasserNames
-          }
-        });
-
-        const bypasserNamesFromDb = bypasserUsers.map((user) => user.username);
-        const invalidUsernames = userBypasserNames.filter((username) => !bypasserNamesFromDb.includes(username));
-
-        if (invalidUsernames.length) {
-          throw new BadRequestError({
-            message: `Invalid bypasser user: ${invalidUsernames.join(", ")}`
-          });
-        }
-
-        bypasserUserIds = bypasserUserIds.concat(bypasserUsers.map((user) => user.id));
-      }
-    }
-
     const updatedSap = await secretApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await secretApprovalPolicyDAL.updateById(
         secretApprovalPolicy.id,
@@ -376,28 +275,6 @@ export const secretApprovalPolicyServiceFactory = ({
         );
       }
 
-      await secretApprovalPolicyBypasserDAL.delete({ policyId: doc.id }, tx);
-
-      if (bypasserUserIds.length) {
-        await secretApprovalPolicyBypasserDAL.insertMany(
-          bypasserUserIds.map((userId) => ({
-            bypasserUserId: userId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
-      if (groupBypassers.length) {
-        await secretApprovalPolicyBypasserDAL.insertMany(
-          groupBypassers.map((groupId) => ({
-            bypasserGroupId: groupId,
-            policyId: doc.id
-          })),
-          tx
-        );
-      }
-
       return doc;
     });
     return {
@@ -427,7 +304,7 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionApprovalActions.Delete,
       ProjectPermissionSub.SecretApproval
     );
 
@@ -466,7 +343,10 @@ export const secretApprovalPolicyServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionApprovalActions.Read,
+      ProjectPermissionSub.SecretApproval
+    );
 
     const sapPolicies = await secretApprovalPolicyDAL.find({ projectId, deletedAt: null });
     return sapPolicies;
@@ -539,7 +419,10 @@ export const secretApprovalPolicyServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionApprovalActions.Read,
+      ProjectPermissionSub.SecretApproval
+    );
 
     return sapPolicy;
   };

backend/src/ee/services/secret-approval-policy/secret-approval-policy-types.ts

@@ -1,16 +1,12 @@
 import { EnforcementLevel, TProjectPermission } from "@app/lib/types";
 
-import { ApproverType, BypasserType } from "../access-approval-policy/access-approval-policy-types";
+import { ApproverType } from "../access-approval-policy/access-approval-policy-types";
 
 export type TCreateSapDTO = {
   approvals: number;
   secretPath?: string | null;
   environment: string;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
-  bypassers?: (
-    | { type: BypasserType.Group; id: string }
-    | { type: BypasserType.User; id?: string; username?: string }
-  )[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
   projectId: string;
   name: string;
   enforcementLevel: EnforcementLevel;
@@ -21,11 +17,7 @@ export type TUpdateSapDTO = {
   secretPolicyId: string;
   approvals?: number;
   secretPath?: string | null;
-  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; username?: string })[];
-  bypassers?: (
-    | { type: BypasserType.Group; id: string }
-    | { type: BypasserType.User; id?: string; username?: string }
-  )[];
+  approvers: ({ type: ApproverType.Group; id: string } | { type: ApproverType.User; id?: string; name?: string })[];
   name?: string;
   enforcementLevel?: EnforcementLevel;
   allowedSelfApprovals?: boolean;

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

@@ -6,7 +6,6 @@ import {
   TableName,
   TSecretApprovalRequests,
   TSecretApprovalRequestsSecrets,
-  TUserGroupMembership,
   TUsers
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
@@ -59,36 +58,16 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         `${TableName.SecretApprovalPolicyApprover}.approverUserId`,
         "secretApprovalPolicyApproverUser.id"
       )
-      .leftJoin<TUserGroupMembership>(
-        db(TableName.UserGroupMembership).as("approverUserGroupMembership"),
+      .leftJoin(
+        TableName.UserGroupMembership,
         `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
-        `approverUserGroupMembership.groupId`
+        `${TableName.UserGroupMembership}.groupId`
       )
       .leftJoin<TUsers>(
         db(TableName.Users).as("secretApprovalPolicyGroupApproverUser"),
-        `approverUserGroupMembership.userId`,
+        `${TableName.UserGroupMembership}.userId`,
         `secretApprovalPolicyGroupApproverUser.id`
       )
-      .leftJoin(
-        TableName.SecretApprovalPolicyBypasser,
-        `${TableName.SecretApprovalPolicy}.id`,
-        `${TableName.SecretApprovalPolicyBypasser}.policyId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("secretApprovalPolicyBypasserUser"),
-        `${TableName.SecretApprovalPolicyBypasser}.bypasserUserId`,
-        "secretApprovalPolicyBypasserUser.id"
-      )
-      .leftJoin<TUserGroupMembership>(
-        db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-        `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
-        `bypasserUserGroupMembership.groupId`
-      )
-      .leftJoin<TUsers>(
-        db(TableName.Users).as("secretApprovalPolicyGroupBypasserUser"),
-        `bypasserUserGroupMembership.userId`,
-        `secretApprovalPolicyGroupBypasserUser.id`
-      )
       .leftJoin(
         TableName.SecretApprovalRequestReviewer,
         `${TableName.SecretApprovalRequest}.id`,
@@ -102,7 +81,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
       .select(selectAllTableCols(TableName.SecretApprovalRequest))
       .select(
         tx.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
-        tx.ref("userId").withSchema("approverUserGroupMembership").as("approverGroupUserId"),
+        tx.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
         tx.ref("email").withSchema("secretApprovalPolicyApproverUser").as("approverEmail"),
         tx.ref("email").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupEmail"),
         tx.ref("username").withSchema("secretApprovalPolicyApproverUser").as("approverUsername"),
@@ -111,20 +90,6 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         tx.ref("firstName").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupFirstName"),
         tx.ref("lastName").withSchema("secretApprovalPolicyApproverUser").as("approverLastName"),
         tx.ref("lastName").withSchema("secretApprovalPolicyGroupApproverUser").as("approverGroupLastName"),
-
-        // Bypasser fields
-        tx.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
-        tx.ref("bypasserGroupId").withSchema(TableName.SecretApprovalPolicyBypasser),
-        tx.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
-        tx.ref("email").withSchema("secretApprovalPolicyBypasserUser").as("bypasserEmail"),
-        tx.ref("email").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupEmail"),
-        tx.ref("username").withSchema("secretApprovalPolicyBypasserUser").as("bypasserUsername"),
-        tx.ref("username").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupUsername"),
-        tx.ref("firstName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserFirstName"),
-        tx.ref("firstName").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupFirstName"),
-        tx.ref("lastName").withSchema("secretApprovalPolicyBypasserUser").as("bypasserLastName"),
-        tx.ref("lastName").withSchema("secretApprovalPolicyGroupBypasserUser").as("bypasserGroupLastName"),
-
         tx.ref("email").withSchema("statusChangedByUser").as("statusChangedByUserEmail"),
         tx.ref("username").withSchema("statusChangedByUser").as("statusChangedByUserUsername"),
         tx.ref("firstName").withSchema("statusChangedByUser").as("statusChangedByUserFirstName"),
@@ -156,7 +121,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
     try {
       const sql = findQuery({ [`${TableName.SecretApprovalRequest}.id` as "id"]: id }, tx || db.replicaNode());
       const docs = await sql;
-      const formattedDoc = sqlNestRelationships({
+      const formatedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -238,51 +203,13 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
               lastName,
               username
             })
-          },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({
-              bypasserUserId: userId,
-              bypasserEmail: email,
-              bypasserUsername: username,
-              bypasserLastName: lastName,
-              bypasserFirstName: firstName
-            }) => ({
-              userId,
-              email,
-              firstName,
-              lastName,
-              username
-            })
-          },
-          {
-            key: "bypasserGroupUserId",
-            label: "bypassers" as const,
-            mapper: ({
-              bypasserGroupUserId: userId,
-              bypasserGroupEmail: email,
-              bypasserGroupUsername: username,
-              bypasserGroupLastName: lastName,
-              bypasserGroupFirstName: firstName
-            }) => ({
-              userId,
-              email,
-              firstName,
-              lastName,
-              username
-            })
           }
         ]
       });
-      if (!formattedDoc?.[0]) return;
+      if (!formatedDoc?.[0]) return;
       return {
-        ...formattedDoc[0],
-        policy: {
-          ...formattedDoc[0].policy,
-          approvers: formattedDoc[0].approvers,
-          bypassers: formattedDoc[0].bypassers
-        }
+        ...formatedDoc[0],
+        policy: { ...formatedDoc[0].policy, approvers: formatedDoc[0].approvers }
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "FindByIdSAR" });
@@ -364,16 +291,6 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
-        .leftJoin(
-          TableName.SecretApprovalPolicyBypasser,
-          `${TableName.SecretApprovalPolicy}.id`,
-          `${TableName.SecretApprovalPolicyBypasser}.policyId`
-        )
-        .leftJoin<TUserGroupMembership>(
-          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-          `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
-          `bypasserUserGroupMembership.groupId`
-        )
         .join<TUsers>(
           db(TableName.Users).as("committerUser"),
           `${TableName.SecretApprovalRequest}.committerUserId`,
@@ -425,11 +342,6 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           db.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
           db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
           db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
-
-          // Bypasser fields
-          db.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
-          db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
-
           db.ref("email").withSchema("committerUser").as("committerUserEmail"),
           db.ref("username").withSchema("committerUser").as("committerUserUsername"),
           db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
@@ -443,7 +355,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         .from<Awaited<typeof query>[number]>("w")
         .where("w.rank", ">=", offset)
         .andWhere("w.rank", "<", offset + limit);
-      const formattedDoc = sqlNestRelationships({
+      const formatedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -491,22 +403,12 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             key: "approverGroupUserId",
             label: "approvers" as const,
             mapper: ({ approverGroupUserId }) => ({ userId: approverGroupUserId })
-          },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserUserId }) => ({ userId: bypasserUserId })
-          },
-          {
-            key: "bypasserGroupUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserGroupUserId }) => ({ userId: bypasserGroupUserId })
           }
         ]
       });
-      return formattedDoc.map((el) => ({
+      return formatedDoc.map((el) => ({
         ...el,
-        policy: { ...el.policy, approvers: el.approvers, bypassers: el.bypassers }
+        policy: { ...el.policy, approvers: el.approvers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindSAR" });
@@ -538,16 +440,6 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           `${TableName.SecretApprovalPolicyApprover}.approverGroupId`,
           `${TableName.UserGroupMembership}.groupId`
         )
-        .leftJoin(
-          TableName.SecretApprovalPolicyBypasser,
-          `${TableName.SecretApprovalPolicy}.id`,
-          `${TableName.SecretApprovalPolicyBypasser}.policyId`
-        )
-        .leftJoin<TUserGroupMembership>(
-          db(TableName.UserGroupMembership).as("bypasserUserGroupMembership"),
-          `${TableName.SecretApprovalPolicyBypasser}.bypasserGroupId`,
-          `bypasserUserGroupMembership.groupId`
-        )
         .join<TUsers>(
           db(TableName.Users).as("committerUser"),
           `${TableName.SecretApprovalRequest}.committerUserId`,
@@ -599,11 +491,6 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
           db.ref("enforcementLevel").withSchema(TableName.SecretApprovalPolicy).as("policyEnforcementLevel"),
           db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover),
           db.ref("userId").withSchema(TableName.UserGroupMembership).as("approverGroupUserId"),
-
-          // Bypasser
-          db.ref("bypasserUserId").withSchema(TableName.SecretApprovalPolicyBypasser),
-          db.ref("userId").withSchema("bypasserUserGroupMembership").as("bypasserGroupUserId"),
-
           db.ref("email").withSchema("committerUser").as("committerUserEmail"),
           db.ref("username").withSchema("committerUser").as("committerUserUsername"),
           db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
@@ -617,7 +504,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
         .from<Awaited<typeof query>[number]>("w")
         .where("w.rank", ">=", offset)
         .andWhere("w.rank", "<", offset + limit);
-      const formattedDoc = sqlNestRelationships({
+      const formatedDoc = sqlNestRelationships({
         data: docs,
         key: "id",
         parentMapper: (el) => ({
@@ -667,24 +554,12 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             mapper: ({ approverGroupUserId }) => ({
               userId: approverGroupUserId
             })
-          },
-          {
-            key: "bypasserUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserUserId }) => ({ userId: bypasserUserId })
-          },
-          {
-            key: "bypasserGroupUserId",
-            label: "bypassers" as const,
-            mapper: ({ bypasserGroupUserId }) => ({
-              userId: bypasserGroupUserId
-            })
           }
         ]
       });
-      return formattedDoc.map((el) => ({
+      return formatedDoc.map((el) => ({
         ...el,
-        policy: { ...el.policy, approvers: el.approvers, bypassers: el.bypassers }
+        policy: { ...el.policy, approvers: el.approvers }
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: "FindSAR" });

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -62,7 +62,11 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TLicenseServiceFactory } from "../license/license-service";
 import { throwIfMissingSecretReadValueOrDescribePermission } from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionSecretActions, ProjectPermissionSub } from "../permission/project-permission";
+import {
+  ProjectPermissionApprovalActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "../permission/project-permission";
 import { TSecretApprovalPolicyDALFactory } from "../secret-approval-policy/secret-approval-policy-dal";
 import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";
 import { TSecretApprovalRequestDALFactory } from "./secret-approval-request-dal";
@@ -497,14 +501,14 @@ export const secretApprovalRequestServiceFactory = ({
       });
     }
 
-    const { policy, folderId, projectId, bypassers } = secretApprovalRequest;
+    const { policy, folderId, projectId } = secretApprovalRequest;
     if (policy.deletedAt) {
       throw new BadRequestError({
         message: "The policy associated with this secret approval request has been deleted."
       });
     }
 
-    const { hasRole } = await permissionService.getProjectPermission({
+    const { hasRole, permission } = await permissionService.getProjectPermission({
       actor: ActorType.USER,
       actorId,
       projectId,
@@ -530,9 +534,14 @@ export const secretApprovalRequestServiceFactory = ({
         approverId ? reviewers[approverId] === ApprovalStatus.APPROVED : false
       ).length;
     const isSoftEnforcement = secretApprovalRequest.policy.enforcementLevel === EnforcementLevel.Soft;
-    const canBypass = !bypassers.length || bypassers.some((bypasser) => bypasser.userId === actorId);
 
-    if (!hasMinApproval && !(isSoftEnforcement && canBypass))
+    if (
+      !hasMinApproval &&
+      !(
+        isSoftEnforcement &&
+        permission.can(ProjectPermissionApprovalActions.AllowChangeBypass, ProjectPermissionSub.SecretApproval)
+      )
+    )
       throw new BadRequestError({ message: "Doesn't have minimum approvals needed" });
 
     const { botKey, shouldUseSecretV2Bridge, project } = await projectBotService.getBotKey(projectId);

backend/src/ee/services/secret-rotation-v2/mysql-credentials/index.ts

@@ -1,3 +0,0 @@
-export * from "./mysql-credentials-rotation-constants";
-export * from "./mysql-credentials-rotation-schemas";
-export * from "./mysql-credentials-rotation-types";

backend/src/ee/services/secret-rotation-v2/mysql-credentials/mysql-credentials-rotation-constants.ts

@@ -1,23 +0,0 @@
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import { TSecretRotationV2ListItem } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const MYSQL_CREDENTIALS_ROTATION_LIST_OPTION: TSecretRotationV2ListItem = {
-  name: "MySQL Credentials",
-  type: SecretRotation.MySqlCredentials,
-  connection: AppConnection.MySql,
-  template: {
-    createUserStatement: `-- create user
-CREATE USER 'infisical_user'@'%' IDENTIFIED BY 'temporary_password';
-
--- grant all privileges
-GRANT ALL PRIVILEGES ON my_database.* TO 'infisical_user'@'%';
-
--- apply the privilege changes
-FLUSH PRIVILEGES;`,
-    secretsMapping: {
-      username: "MYSQL_USERNAME",
-      password: "MYSQL_PASSWORD"
-    }
-  }
-};

backend/src/ee/services/secret-rotation-v2/mysql-credentials/mysql-credentials-rotation-schemas.ts

@@ -1,41 +0,0 @@
-import { z } from "zod";
-
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import {
-  BaseCreateSecretRotationSchema,
-  BaseSecretRotationSchema,
-  BaseUpdateSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-schemas";
-import {
-  SqlCredentialsRotationParametersSchema,
-  SqlCredentialsRotationSecretsMappingSchema,
-  SqlCredentialsRotationTemplateSchema
-} from "@app/ee/services/secret-rotation-v2/shared/sql-credentials";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const MySqlCredentialsRotationSchema = BaseSecretRotationSchema(SecretRotation.MySqlCredentials).extend({
-  type: z.literal(SecretRotation.MySqlCredentials),
-  parameters: SqlCredentialsRotationParametersSchema,
-  secretsMapping: SqlCredentialsRotationSecretsMappingSchema
-});
-
-export const CreateMySqlCredentialsRotationSchema = BaseCreateSecretRotationSchema(
-  SecretRotation.MySqlCredentials
-).extend({
-  parameters: SqlCredentialsRotationParametersSchema,
-  secretsMapping: SqlCredentialsRotationSecretsMappingSchema
-});
-
-export const UpdateMySqlCredentialsRotationSchema = BaseUpdateSecretRotationSchema(
-  SecretRotation.MySqlCredentials
-).extend({
-  parameters: SqlCredentialsRotationParametersSchema.optional(),
-  secretsMapping: SqlCredentialsRotationSecretsMappingSchema.optional()
-});
-
-export const MySqlCredentialsRotationListItemSchema = z.object({
-  name: z.literal("MySQL Credentials"),
-  connection: z.literal(AppConnection.MySql),
-  type: z.literal(SecretRotation.MySqlCredentials),
-  template: SqlCredentialsRotationTemplateSchema
-});

backend/src/ee/services/secret-rotation-v2/mysql-credentials/mysql-credentials-rotation-types.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-
-import { TMySqlConnection } from "@app/services/app-connection/mysql";
-
-import {
-  CreateMySqlCredentialsRotationSchema,
-  MySqlCredentialsRotationListItemSchema,
-  MySqlCredentialsRotationSchema
-} from "./mysql-credentials-rotation-schemas";
-
-export type TMySqlCredentialsRotation = z.infer<typeof MySqlCredentialsRotationSchema>;
-
-export type TMySqlCredentialsRotationInput = z.infer<typeof CreateMySqlCredentialsRotationSchema>;
-
-export type TMySqlCredentialsRotationListItem = z.infer<typeof MySqlCredentialsRotationListItemSchema>;
-
-export type TMySqlCredentialsRotationWithConnection = TMySqlCredentialsRotation & {
-  connection: TMySqlConnection;
-};

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts

@@ -1,7 +1,6 @@
 export enum SecretRotation {
   PostgresCredentials = "postgres-credentials",
   MsSqlCredentials = "mssql-credentials",
-  MySqlCredentials = "mysql-credentials",
   Auth0ClientSecret = "auth0-client-secret",
   AzureClientSecret = "azure-client-secret",
   AwsIamUserSecret = "aws-iam-user-secret",

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts

@@ -9,7 +9,6 @@ import { AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION } from "./aws-iam-user-secret"
 import { AZURE_CLIENT_SECRET_ROTATION_LIST_OPTION } from "./azure-client-secret";
 import { LDAP_PASSWORD_ROTATION_LIST_OPTION, TLdapPasswordRotation } from "./ldap-password";
 import { MSSQL_CREDENTIALS_ROTATION_LIST_OPTION } from "./mssql-credentials";
-import { MYSQL_CREDENTIALS_ROTATION_LIST_OPTION } from "./mysql-credentials";
 import { POSTGRES_CREDENTIALS_ROTATION_LIST_OPTION } from "./postgres-credentials";
 import { SecretRotation, SecretRotationStatus } from "./secret-rotation-v2-enums";
 import { TSecretRotationV2ServiceFactoryDep } from "./secret-rotation-v2-service";
@@ -24,7 +23,6 @@ import {
 const SECRET_ROTATION_LIST_OPTIONS: Record<SecretRotation, TSecretRotationV2ListItem> = {
   [SecretRotation.PostgresCredentials]: POSTGRES_CREDENTIALS_ROTATION_LIST_OPTION,
   [SecretRotation.MsSqlCredentials]: MSSQL_CREDENTIALS_ROTATION_LIST_OPTION,
-  [SecretRotation.MySqlCredentials]: MYSQL_CREDENTIALS_ROTATION_LIST_OPTION,
   [SecretRotation.Auth0ClientSecret]: AUTH0_CLIENT_SECRET_ROTATION_LIST_OPTION,
   [SecretRotation.AzureClientSecret]: AZURE_CLIENT_SECRET_ROTATION_LIST_OPTION,
   [SecretRotation.AwsIamUserSecret]: AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION,

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts

@@ -4,7 +4,6 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
   [SecretRotation.PostgresCredentials]: "PostgreSQL Credentials",
   [SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials",
-  [SecretRotation.MySqlCredentials]: "MySQL Credentials",
   [SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret",
   [SecretRotation.AzureClientSecret]: "Azure Client Secret",
   [SecretRotation.AwsIamUserSecret]: "AWS IAM User Secret",
@@ -14,7 +13,6 @@ export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
   [SecretRotation.PostgresCredentials]: AppConnection.Postgres,
   [SecretRotation.MsSqlCredentials]: AppConnection.MsSql,
-  [SecretRotation.MySqlCredentials]: AppConnection.MySql,
   [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0,
   [SecretRotation.AzureClientSecret]: AppConnection.AzureClientSecrets,
   [SecretRotation.AwsIamUserSecret]: AppConnection.AWS,

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts

@@ -120,7 +120,6 @@ type TRotationFactoryImplementation = TRotationFactory<
 const SECRET_ROTATION_FACTORY_MAP: Record<SecretRotation, TRotationFactoryImplementation> = {
   [SecretRotation.PostgresCredentials]: sqlCredentialsRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.MsSqlCredentials]: sqlCredentialsRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.MySqlCredentials]: sqlCredentialsRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.Auth0ClientSecret]: auth0ClientSecretRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.AzureClientSecret]: azureClientSecretRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.AwsIamUserSecret]: awsIamUserSecretRotationFactory as TRotationFactoryImplementation,

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts

@@ -39,12 +39,6 @@ import {
   TMsSqlCredentialsRotationListItem,
   TMsSqlCredentialsRotationWithConnection
 } from "./mssql-credentials";
-import {
-  TMySqlCredentialsRotation,
-  TMySqlCredentialsRotationInput,
-  TMySqlCredentialsRotationListItem,
-  TMySqlCredentialsRotationWithConnection
-} from "./mysql-credentials";
 import {
   TPostgresCredentialsRotation,
   TPostgresCredentialsRotationInput,
@@ -57,7 +51,6 @@ import { SecretRotation } from "./secret-rotation-v2-enums";
 export type TSecretRotationV2 =
   | TPostgresCredentialsRotation
   | TMsSqlCredentialsRotation
-  | TMySqlCredentialsRotation
   | TAuth0ClientSecretRotation
   | TAzureClientSecretRotation
   | TLdapPasswordRotation
@@ -66,7 +59,6 @@ export type TSecretRotationV2 =
 export type TSecretRotationV2WithConnection =
   | TPostgresCredentialsRotationWithConnection
   | TMsSqlCredentialsRotationWithConnection
-  | TMySqlCredentialsRotationWithConnection
   | TAuth0ClientSecretRotationWithConnection
   | TAzureClientSecretRotationWithConnection
   | TLdapPasswordRotationWithConnection
@@ -82,7 +74,6 @@ export type TSecretRotationV2GeneratedCredentials =
 export type TSecretRotationV2Input =
   | TPostgresCredentialsRotationInput
   | TMsSqlCredentialsRotationInput
-  | TMySqlCredentialsRotationInput
   | TAuth0ClientSecretRotationInput
   | TAzureClientSecretRotationInput
   | TLdapPasswordRotationInput
@@ -91,7 +82,6 @@ export type TSecretRotationV2Input =
 export type TSecretRotationV2ListItem =
   | TPostgresCredentialsRotationListItem
   | TMsSqlCredentialsRotationListItem
-  | TMySqlCredentialsRotationListItem
   | TAuth0ClientSecretRotationListItem
   | TAzureClientSecretRotationListItem
   | TLdapPasswordRotationListItem

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts

@@ -4,7 +4,6 @@ import { Auth0ClientSecretRotationSchema } from "@app/ee/services/secret-rotatio
 import { AzureClientSecretRotationSchema } from "@app/ee/services/secret-rotation-v2/azure-client-secret";
 import { LdapPasswordRotationSchema } from "@app/ee/services/secret-rotation-v2/ldap-password";
 import { MsSqlCredentialsRotationSchema } from "@app/ee/services/secret-rotation-v2/mssql-credentials";
-import { MySqlCredentialsRotationSchema } from "@app/ee/services/secret-rotation-v2/mysql-credentials";
 import { PostgresCredentialsRotationSchema } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 
 import { AwsIamUserSecretRotationSchema } from "./aws-iam-user-secret";
@@ -12,7 +11,6 @@ import { AwsIamUserSecretRotationSchema } from "./aws-iam-user-secret";
 export const SecretRotationV2Schema = z.discriminatedUnion("type", [
   PostgresCredentialsRotationSchema,
   MsSqlCredentialsRotationSchema,
-  MySqlCredentialsRotationSchema,
   Auth0ClientSecretRotationSchema,
   AzureClientSecretRotationSchema,
   LdapPasswordRotationSchema,

backend/src/ee/services/secret-rotation-v2/shared/sql-credentials/sql-credentials-rotation-types.ts

@@ -1,15 +1,13 @@
 import { z } from "zod";
 
 import { TMsSqlCredentialsRotationWithConnection } from "@app/ee/services/secret-rotation-v2/mssql-credentials";
-import { TMySqlCredentialsRotationWithConnection } from "@app/ee/services/secret-rotation-v2/mysql-credentials";
 import { TPostgresCredentialsRotationWithConnection } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 
 import { SqlCredentialsRotationGeneratedCredentialsSchema } from "./sql-credentials-rotation-schemas";
 
 export type TSqlCredentialsRotationWithConnection =
   | TPostgresCredentialsRotationWithConnection
-  | TMsSqlCredentialsRotationWithConnection
-  | TMySqlCredentialsRotationWithConnection;
+  | TMsSqlCredentialsRotationWithConnection;
 
 export type TSqlCredentialsRotationGeneratedCredentials = z.infer<
   typeof SqlCredentialsRotationGeneratedCredentialsSchema

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-fn.ts

@@ -171,13 +171,6 @@ export const getDbSetQuery = (db: TDbProviderClients, variables: { username: str
     };
   }
 
-  if (db === TDbProviderClients.MySql) {
-    return {
-      query: `ALTER USER ??@'%' IDENTIFIED BY '${variables.password}'`,
-      variables: [variables.username]
-    };
-  }
-
   // add more based on client
   return {
     query: `ALTER USER ?? IDENTIFIED BY '${variables.password}'`,

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-constants.ts

@@ -1,9 +0,0 @@
-import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import { TSecretScanningDataSourceListItem } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const GITHUB_SECRET_SCANNING_DATA_SOURCE_LIST_OPTION: TSecretScanningDataSourceListItem = {
-  name: "GitHub",
-  type: SecretScanningDataSource.GitHub,
-  connection: AppConnection.GitHubRadar
-};

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-factory.ts

@@ -1,230 +0,0 @@
-import { join } from "path";
-import { ProbotOctokit } from "probot";
-
-import { scanContentAndGetFindings } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns";
-import { SecretMatch } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-queue-types";
-import {
-  SecretScanningDataSource,
-  SecretScanningFindingSeverity,
-  SecretScanningResource
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import {
-  cloneRepository,
-  convertPatchLineToFileLineNumber,
-  replaceNonChangesWithNewlines
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-fns";
-import {
-  TSecretScanningFactoryGetDiffScanFindingsPayload,
-  TSecretScanningFactoryGetDiffScanResourcePayload,
-  TSecretScanningFactoryGetFullScanPath,
-  TSecretScanningFactoryInitialize,
-  TSecretScanningFactoryListRawResources,
-  TSecretScanningFactoryPostInitialization
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-types";
-import { getConfig } from "@app/lib/config/env";
-import { BadRequestError } from "@app/lib/errors";
-import { titleCaseToCamelCase } from "@app/lib/fn";
-import { GitHubRepositoryRegex } from "@app/lib/regex";
-import { listGitHubRadarRepositories, TGitHubRadarConnection } from "@app/services/app-connection/github-radar";
-
-import { TGitHubDataSourceWithConnection, TQueueGitHubResourceDiffScan } from "./github-secret-scanning-types";
-
-export const GitHubSecretScanningFactory = () => {
-  const initialize: TSecretScanningFactoryInitialize<TGitHubRadarConnection> = async (
-    { connection, secretScanningV2DAL },
-    callback
-  ) => {
-    const externalId = connection.credentials.installationId;
-
-    const existingDataSource = await secretScanningV2DAL.dataSources.findOne({
-      externalId,
-      type: SecretScanningDataSource.GitHub
-    });
-
-    if (existingDataSource)
-      throw new BadRequestError({
-        message: `A Data Source already exists for this GitHub Radar Connection in the Project with ID "${existingDataSource.projectId}"`
-      });
-
-    return callback({
-      externalId
-    });
-  };
-
-  const postInitialization: TSecretScanningFactoryPostInitialization<TGitHubRadarConnection> = async () => {
-    // no post-initialization required
-  };
-
-  const listRawResources: TSecretScanningFactoryListRawResources<TGitHubDataSourceWithConnection> = async (
-    dataSource
-  ) => {
-    const {
-      connection,
-      config: { includeRepos }
-    } = dataSource;
-
-    const repos = await listGitHubRadarRepositories(connection);
-
-    const filteredRepos: typeof repos = [];
-    if (includeRepos.includes("*")) {
-      filteredRepos.push(...repos);
-    } else {
-      filteredRepos.push(...repos.filter((repo) => includeRepos.includes(repo.full_name)));
-    }
-
-    return filteredRepos.map(({ id, full_name }) => ({
-      name: full_name,
-      externalId: id.toString(),
-      type: SecretScanningResource.Repository
-    }));
-  };
-
-  const getFullScanPath: TSecretScanningFactoryGetFullScanPath<TGitHubDataSourceWithConnection> = async ({
-    dataSource,
-    resourceName,
-    tempFolder
-  }) => {
-    const appCfg = getConfig();
-    const {
-      connection: {
-        credentials: { installationId }
-      }
-    } = dataSource;
-
-    const octokit = new ProbotOctokit({
-      auth: {
-        appId: appCfg.INF_APP_CONNECTION_GITHUB_RADAR_APP_ID,
-        privateKey: appCfg.INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY,
-        installationId
-      }
-    });
-
-    const {
-      data: { token }
-    } = await octokit.apps.createInstallationAccessToken({
-      installation_id: Number(installationId)
-    });
-
-    const repoPath = join(tempFolder, "repo.git");
-
-    if (!GitHubRepositoryRegex.test(resourceName)) {
-      throw new Error("Invalid GitHub repository name");
-    }
-
-    await cloneRepository({
-      cloneUrl: `https://x-access-token:${token}@github.com/${resourceName}.git`,
-      repoPath
-    });
-
-    return repoPath;
-  };
-
-  const getDiffScanResourcePayload: TSecretScanningFactoryGetDiffScanResourcePayload<
-    TQueueGitHubResourceDiffScan["payload"]
-  > = ({ repository }) => {
-    return {
-      name: repository.full_name,
-      externalId: repository.id.toString(),
-      type: SecretScanningResource.Repository
-    };
-  };
-
-  const getDiffScanFindingsPayload: TSecretScanningFactoryGetDiffScanFindingsPayload<
-    TGitHubDataSourceWithConnection,
-    TQueueGitHubResourceDiffScan["payload"]
-  > = async ({ dataSource, payload, resourceName, configPath }) => {
-    const appCfg = getConfig();
-    const {
-      connection: {
-        credentials: { installationId }
-      }
-    } = dataSource;
-
-    const octokit = new ProbotOctokit({
-      auth: {
-        appId: appCfg.INF_APP_CONNECTION_GITHUB_RADAR_APP_ID,
-        privateKey: appCfg.INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY,
-        installationId
-      }
-    });
-
-    const { commits, repository } = payload;
-
-    const [owner, repo] = repository.full_name.split("/");
-
-    const allFindings: SecretMatch[] = [];
-
-    for (const commit of commits) {
-      // eslint-disable-next-line no-await-in-loop
-      const commitData = await octokit.repos.getCommit({
-        owner,
-        repo,
-        ref: commit.id
-      });
-
-      // eslint-disable-next-line no-continue
-      if (!commitData.data.files) continue;
-
-      for (const file of commitData.data.files) {
-        if ((file.status === "added" || file.status === "modified") && file.patch) {
-          // eslint-disable-next-line
-          const findings = await scanContentAndGetFindings(
-            replaceNonChangesWithNewlines(`\n${file.patch}`),
-            configPath
-          );
-
-          const adjustedFindings = findings.map((finding) => {
-            const startLine = convertPatchLineToFileLineNumber(file.patch!, finding.StartLine);
-            const endLine =
-              finding.StartLine === finding.EndLine
-                ? startLine
-                : convertPatchLineToFileLineNumber(file.patch!, finding.EndLine);
-            const startColumn = finding.StartColumn - 1; // subtract 1 for +
-            const endColumn = finding.EndColumn - 1; // subtract 1 for +
-
-            return {
-              ...finding,
-              StartLine: startLine,
-              EndLine: endLine,
-              StartColumn: startColumn,
-              EndColumn: endColumn,
-              File: file.filename,
-              Commit: commit.id,
-              Author: commit.author.name,
-              Email: commit.author.email ?? "",
-              Message: commit.message,
-              Fingerprint: `${commit.id}:${file.filename}:${finding.RuleID}:${startLine}:${startColumn}`,
-              Date: commit.timestamp,
-              Link: `https://github.com/${resourceName}/blob/${commit.id}/${file.filename}#L${startLine}`
-            };
-          });
-
-          allFindings.push(...adjustedFindings);
-        }
-      }
-    }
-
-    return allFindings.map(
-      ({
-        // discard match and secret as we don't want to store
-        Match,
-        Secret,
-        ...finding
-      }) => ({
-        details: titleCaseToCamelCase(finding),
-        fingerprint: finding.Fingerprint,
-        severity: SecretScanningFindingSeverity.High,
-        rule: finding.RuleID
-      })
-    );
-  };
-
-  return {
-    initialize,
-    postInitialization,
-    listRawResources,
-    getFullScanPath,
-    getDiffScanResourcePayload,
-    getDiffScanFindingsPayload
-  };
-};

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-schemas.ts

@@ -1,85 +0,0 @@
-import { z } from "zod";
-
-import {
-  SecretScanningDataSource,
-  SecretScanningResource
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import {
-  BaseCreateSecretScanningDataSourceSchema,
-  BaseSecretScanningDataSourceSchema,
-  BaseSecretScanningFindingSchema,
-  BaseUpdateSecretScanningDataSourceSchema,
-  GitRepositoryScanFindingDetailsSchema
-} from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-schemas";
-import { SecretScanningDataSources } from "@app/lib/api-docs";
-import { GitHubRepositoryRegex } from "@app/lib/regex";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const GitHubDataSourceConfigSchema = z.object({
-  includeRepos: z
-    .array(
-      z
-        .string()
-        .min(1)
-        .max(256)
-        .refine((value) => value === "*" || GitHubRepositoryRegex.test(value), "Invalid repository name format")
-    )
-    .nonempty("One or more repositories required")
-    .max(100, "Cannot configure more than 100 repositories")
-    .default(["*"])
-    .describe(SecretScanningDataSources.CONFIG.GITHUB.includeRepos)
-});
-
-export const GitHubDataSourceSchema = BaseSecretScanningDataSourceSchema({
-  type: SecretScanningDataSource.GitHub,
-  isConnectionRequired: true
-})
-  .extend({
-    config: GitHubDataSourceConfigSchema
-  })
-  .describe(
-    JSON.stringify({
-      title: "GitHub"
-    })
-  );
-
-export const CreateGitHubDataSourceSchema = BaseCreateSecretScanningDataSourceSchema({
-  type: SecretScanningDataSource.GitHub,
-  isConnectionRequired: true
-})
-  .extend({
-    config: GitHubDataSourceConfigSchema
-  })
-  .describe(
-    JSON.stringify({
-      title: "GitHub"
-    })
-  );
-
-export const UpdateGitHubDataSourceSchema = BaseUpdateSecretScanningDataSourceSchema(SecretScanningDataSource.GitHub)
-  .extend({
-    config: GitHubDataSourceConfigSchema.optional()
-  })
-  .describe(
-    JSON.stringify({
-      title: "GitHub"
-    })
-  );
-
-export const GitHubDataSourceListItemSchema = z
-  .object({
-    name: z.literal("GitHub"),
-    connection: z.literal(AppConnection.GitHubRadar),
-    type: z.literal(SecretScanningDataSource.GitHub)
-  })
-  .describe(
-    JSON.stringify({
-      title: "GitHub"
-    })
-  );
-
-export const GitHubFindingSchema = BaseSecretScanningFindingSchema.extend({
-  resourceType: z.literal(SecretScanningResource.Repository),
-  dataSourceType: z.literal(SecretScanningDataSource.GitHub),
-  details: GitRepositoryScanFindingDetailsSchema
-});

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-service.ts

@@ -1,87 +0,0 @@
-import { PushEvent } from "@octokit/webhooks-types";
-
-import { TSecretScanningV2DALFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-dal";
-import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import { TSecretScanningV2QueueServiceFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-queue";
-import { logger } from "@app/lib/logger";
-
-import { TGitHubDataSource } from "./github-secret-scanning-types";
-
-export const githubSecretScanningService = (
-  secretScanningV2DAL: TSecretScanningV2DALFactory,
-  secretScanningV2Queue: Pick<TSecretScanningV2QueueServiceFactory, "queueResourceDiffScan">
-) => {
-  const handleInstallationDeletedEvent = async (installationId: number) => {
-    const dataSource = await secretScanningV2DAL.dataSources.findOne({
-      externalId: String(installationId),
-      type: SecretScanningDataSource.GitHub
-    });
-
-    if (!dataSource) {
-      logger.error(
-        `secretScanningV2RemoveEvent: GitHub - Could not find data source [installationId=${installationId}]`
-      );
-      return;
-    }
-
-    logger.info(
-      `secretScanningV2RemoveEvent: GitHub - installation deleted [installationId=${installationId}] [dataSourceId=${dataSource.id}]`
-    );
-
-    await secretScanningV2DAL.dataSources.updateById(dataSource.id, {
-      isDisconnected: true
-    });
-  };
-
-  const handlePushEvent = async (payload: PushEvent) => {
-    const { commits, repository, installation } = payload;
-
-    if (!commits || !repository || !installation) {
-      logger.warn(
-        `secretScanningV2PushEvent: GitHub - Insufficient data [commits=${commits?.length ?? 0}] [repository=${repository.name}] [installationId=${installation?.id}]`
-      );
-      return;
-    }
-
-    const dataSource = (await secretScanningV2DAL.dataSources.findOne({
-      externalId: String(installation.id),
-      type: SecretScanningDataSource.GitHub
-    })) as TGitHubDataSource | undefined;
-
-    if (!dataSource) {
-      logger.error(
-        `secretScanningV2PushEvent: GitHub - Could not find data source [installationId=${installation.id}]`
-      );
-      return;
-    }
-
-    const {
-      isAutoScanEnabled,
-      config: { includeRepos }
-    } = dataSource;
-
-    if (!isAutoScanEnabled) {
-      logger.info(
-        `secretScanningV2PushEvent: GitHub - ignoring due to auto scan disabled [dataSourceId=${dataSource.id}] [installationId=${installation.id}]`
-      );
-      return;
-    }
-
-    if (includeRepos.includes("*") || includeRepos.includes(repository.full_name)) {
-      await secretScanningV2Queue.queueResourceDiffScan({
-        dataSourceType: SecretScanningDataSource.GitHub,
-        payload,
-        dataSourceId: dataSource.id
-      });
-    } else {
-      logger.info(
-        `secretScanningV2PushEvent: GitHub - ignoring due to repository not being present in config [installationId=${installation.id}] [dataSourceId=${dataSource.id}]`
-      );
-    }
-  };
-
-  return {
-    handlePushEvent,
-    handleInstallationDeletedEvent
-  };
-};

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-types.ts

@@ -1,32 +0,0 @@
-import { PushEvent } from "@octokit/webhooks-types";
-import { z } from "zod";
-
-import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import { TGitHubRadarConnection } from "@app/services/app-connection/github-radar";
-
-import {
-  CreateGitHubDataSourceSchema,
-  GitHubDataSourceListItemSchema,
-  GitHubDataSourceSchema,
-  GitHubFindingSchema
-} from "./github-secret-scanning-schemas";
-
-export type TGitHubDataSource = z.infer<typeof GitHubDataSourceSchema>;
-
-export type TGitHubDataSourceInput = z.infer<typeof CreateGitHubDataSourceSchema>;
-
-export type TGitHubDataSourceListItem = z.infer<typeof GitHubDataSourceListItemSchema>;
-
-export type TGitHubFinding = z.infer<typeof GitHubFindingSchema>;
-
-export type TGitHubDataSourceWithConnection = TGitHubDataSource & {
-  connection: TGitHubRadarConnection;
-};
-
-export type TQueueGitHubResourceDiffScan = {
-  dataSourceType: SecretScanningDataSource.GitHub;
-  payload: PushEvent;
-  dataSourceId: string;
-  resourceId: string;
-  scanId: string;
-};

backend/src/ee/services/secret-scanning-v2/github/index.ts

@@ -1,3 +0,0 @@
-export * from "./github-secret-scanning-constants";
-export * from "./github-secret-scanning-schemas";
-export * from "./github-secret-scanning-types";

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-dal.ts

@@ -1,460 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import {
-  SecretScanningResourcesSchema,
-  SecretScanningScansSchema,
-  TableName,
-  TSecretScanningDataSources
-} from "@app/db/schemas";
-import { SecretScanningFindingStatus } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
-import { DatabaseError } from "@app/lib/errors";
-import {
-  buildFindFilter,
-  ormify,
-  prependTableNameToFindFilter,
-  selectAllTableCols,
-  sqlNestRelationships,
-  TFindOpt
-} from "@app/lib/knex";
-
-export type TSecretScanningV2DALFactory = ReturnType<typeof secretScanningV2DALFactory>;
-
-type TSecretScanningDataSourceFindFilter = Parameters<typeof buildFindFilter<TSecretScanningDataSources>>[0];
-type TSecretScanningDataSourceFindOptions = TFindOpt<TSecretScanningDataSources, true, "name">;
-
-const baseSecretScanningDataSourceQuery = ({
-  filter = {},
-  db,
-  tx
-}: {
-  db: TDbClient;
-  filter?: TSecretScanningDataSourceFindFilter;
-  options?: TSecretScanningDataSourceFindOptions;
-  tx?: Knex;
-}) => {
-  const query = (tx || db.replicaNode())(TableName.SecretScanningDataSource)
-    .join(
-      TableName.AppConnection,
-      `${TableName.SecretScanningDataSource}.connectionId`,
-      `${TableName.AppConnection}.id`
-    )
-    .select(selectAllTableCols(TableName.SecretScanningDataSource))
-    .select(
-      // entire connection
-      db.ref("name").withSchema(TableName.AppConnection).as("connectionName"),
-      db.ref("method").withSchema(TableName.AppConnection).as("connectionMethod"),
-      db.ref("app").withSchema(TableName.AppConnection).as("connectionApp"),
-      db.ref("orgId").withSchema(TableName.AppConnection).as("connectionOrgId"),
-      db.ref("encryptedCredentials").withSchema(TableName.AppConnection).as("connectionEncryptedCredentials"),
-      db.ref("description").withSchema(TableName.AppConnection).as("connectionDescription"),
-      db.ref("version").withSchema(TableName.AppConnection).as("connectionVersion"),
-      db.ref("createdAt").withSchema(TableName.AppConnection).as("connectionCreatedAt"),
-      db.ref("updatedAt").withSchema(TableName.AppConnection).as("connectionUpdatedAt"),
-      db
-        .ref("isPlatformManagedCredentials")
-        .withSchema(TableName.AppConnection)
-        .as("connectionIsPlatformManagedCredentials")
-    );
-
-  if (filter) {
-    /* eslint-disable @typescript-eslint/no-misused-promises */
-    void query.where(buildFindFilter(prependTableNameToFindFilter(TableName.SecretScanningDataSource, filter)));
-  }
-
-  return query;
-};
-
-const expandSecretScanningDataSource = <
-  T extends Awaited<ReturnType<typeof baseSecretScanningDataSourceQuery>>[number]
->(
-  dataSource: T
-) => {
-  const {
-    connectionApp,
-    connectionName,
-    connectionId,
-    connectionOrgId,
-    connectionEncryptedCredentials,
-    connectionMethod,
-    connectionDescription,
-    connectionCreatedAt,
-    connectionUpdatedAt,
-    connectionVersion,
-    connectionIsPlatformManagedCredentials,
-    ...el
-  } = dataSource;
-
-  return {
-    ...el,
-    connectionId,
-    connection: connectionId
-      ? {
-          app: connectionApp,
-          id: connectionId,
-          name: connectionName,
-          orgId: connectionOrgId,
-          encryptedCredentials: connectionEncryptedCredentials,
-          method: connectionMethod,
-          description: connectionDescription,
-          createdAt: connectionCreatedAt,
-          updatedAt: connectionUpdatedAt,
-          version: connectionVersion,
-          isPlatformManagedCredentials: connectionIsPlatformManagedCredentials
-        }
-      : undefined
-  };
-};
-
-export const secretScanningV2DALFactory = (db: TDbClient) => {
-  const dataSourceOrm = ormify(db, TableName.SecretScanningDataSource);
-  const resourceOrm = ormify(db, TableName.SecretScanningResource);
-  const scanOrm = ormify(db, TableName.SecretScanningScan);
-  const findingOrm = ormify(db, TableName.SecretScanningFinding);
-  const configOrm = ormify(db, TableName.SecretScanningConfig);
-
-  const findDataSource = async (filter: Parameters<(typeof dataSourceOrm)["find"]>[0], tx?: Knex) => {
-    try {
-      const dataSources = await baseSecretScanningDataSourceQuery({ filter, db, tx });
-
-      if (!dataSources.length) return [];
-
-      return dataSources.map(expandSecretScanningDataSource);
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find - Secret Scanning Data Source" });
-    }
-  };
-
-  const findDataSourceById = async (id: string, tx?: Knex) => {
-    try {
-      const dataSource = await baseSecretScanningDataSourceQuery({ filter: { id }, db, tx }).first();
-
-      if (dataSource) return expandSecretScanningDataSource(dataSource);
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find By ID - Secret Scanning Data Source" });
-    }
-  };
-
-  const createDataSource = async (data: Parameters<(typeof dataSourceOrm)["create"]>[0], tx?: Knex) => {
-    const source = await dataSourceOrm.create(data, tx);
-
-    const dataSource = (await baseSecretScanningDataSourceQuery({
-      filter: { id: source.id },
-      db,
-      tx
-    }).first())!;
-
-    return expandSecretScanningDataSource(dataSource);
-  };
-
-  const updateDataSourceById = async (
-    dataSourceId: string,
-    data: Parameters<(typeof dataSourceOrm)["updateById"]>[1],
-    tx?: Knex
-  ) => {
-    const source = await dataSourceOrm.updateById(dataSourceId, data, tx);
-
-    const dataSource = (await baseSecretScanningDataSourceQuery({
-      filter: { id: source.id },
-      db,
-      tx
-    }).first())!;
-
-    return expandSecretScanningDataSource(dataSource);
-  };
-
-  const deleteDataSourceById = async (dataSourceId: string, tx?: Knex) => {
-    const dataSource = (await baseSecretScanningDataSourceQuery({
-      filter: { id: dataSourceId },
-      db,
-      tx
-    }).first())!;
-
-    await dataSourceOrm.deleteById(dataSourceId, tx);
-
-    return expandSecretScanningDataSource(dataSource);
-  };
-
-  const findOneDataSource = async (filter: Parameters<(typeof dataSourceOrm)["findOne"]>[0], tx?: Knex) => {
-    try {
-      const dataSource = await baseSecretScanningDataSourceQuery({ filter, db, tx }).first();
-
-      if (dataSource) {
-        return expandSecretScanningDataSource(dataSource);
-      }
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find One - Secret Scanning Data Source" });
-    }
-  };
-
-  const findDataSourceWithDetails = async (filter: Parameters<(typeof dataSourceOrm)["find"]>[0], tx?: Knex) => {
-    try {
-      // TODO (scott): this query will probably need to be optimized
-
-      const dataSources = await baseSecretScanningDataSourceQuery({ filter, db, tx })
-        .leftJoin(
-          TableName.SecretScanningResource,
-          `${TableName.SecretScanningResource}.dataSourceId`,
-          `${TableName.SecretScanningDataSource}.id`
-        )
-        .leftJoin(
-          TableName.SecretScanningScan,
-          `${TableName.SecretScanningScan}.resourceId`,
-          `${TableName.SecretScanningResource}.id`
-        )
-        .leftJoin(
-          TableName.SecretScanningFinding,
-          `${TableName.SecretScanningFinding}.scanId`,
-          `${TableName.SecretScanningScan}.id`
-        )
-        .where((qb) => {
-          void qb
-            .where(`${TableName.SecretScanningFinding}.status`, SecretScanningFindingStatus.Unresolved)
-            .orWhereNull(`${TableName.SecretScanningFinding}.status`);
-        })
-        .select(
-          db.ref("id").withSchema(TableName.SecretScanningScan).as("scanId"),
-          db.ref("status").withSchema(TableName.SecretScanningScan).as("scanStatus"),
-          db.ref("statusMessage").withSchema(TableName.SecretScanningScan).as("scanStatusMessage"),
-          db.ref("createdAt").withSchema(TableName.SecretScanningScan).as("scanCreatedAt"),
-          db.ref("status").withSchema(TableName.SecretScanningFinding).as("findingStatus"),
-          db.ref("id").withSchema(TableName.SecretScanningFinding).as("findingId")
-        );
-
-      if (!dataSources.length) return [];
-
-      const results = sqlNestRelationships({
-        data: dataSources,
-        key: "id",
-        parentMapper: (dataSource) => expandSecretScanningDataSource(dataSource),
-        childrenMapper: [
-          {
-            key: "scanId",
-            label: "scans" as const,
-            mapper: ({ scanId, scanCreatedAt, scanStatus, scanStatusMessage }) => ({
-              id: scanId,
-              createdAt: scanCreatedAt,
-              status: scanStatus,
-              statusMessage: scanStatusMessage
-            })
-          },
-          {
-            key: "findingId",
-            label: "findings" as const,
-            mapper: ({ findingId }) => ({
-              id: findingId
-            })
-          }
-        ]
-      });
-
-      return results.map(({ scans, findings, ...dataSource }) => {
-        const lastScan =
-          scans && scans.length
-            ? scans.reduce((latest, current) => {
-                return new Date(current.createdAt) > new Date(latest.createdAt) ? current : latest;
-              })
-            : null;
-
-        return {
-          ...dataSource,
-          lastScanStatus: lastScan?.status ?? null,
-          lastScanStatusMessage: lastScan?.statusMessage ?? null,
-          lastScannedAt: lastScan?.createdAt ?? null,
-          unresolvedFindings: scans.length ? findings.length : null
-        };
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find with Details - Secret Scanning Data Source" });
-    }
-  };
-
-  const findResourcesWithDetails = async (filter: Parameters<(typeof resourceOrm)["find"]>[0], tx?: Knex) => {
-    try {
-      // TODO (scott): this query will probably need to be optimized
-
-      const resources = await (tx || db.replicaNode())(TableName.SecretScanningResource)
-        .where((qb) => {
-          if (filter)
-            void qb.where(buildFindFilter(prependTableNameToFindFilter(TableName.SecretScanningResource, filter)));
-        })
-        .leftJoin(
-          TableName.SecretScanningScan,
-          `${TableName.SecretScanningScan}.resourceId`,
-          `${TableName.SecretScanningResource}.id`
-        )
-        .leftJoin(
-          TableName.SecretScanningFinding,
-          `${TableName.SecretScanningFinding}.scanId`,
-          `${TableName.SecretScanningScan}.id`
-        )
-        .where((qb) => {
-          void qb
-            .where(`${TableName.SecretScanningFinding}.status`, SecretScanningFindingStatus.Unresolved)
-            .orWhereNull(`${TableName.SecretScanningFinding}.status`);
-        })
-        .select(selectAllTableCols(TableName.SecretScanningResource))
-        .select(
-          db.ref("id").withSchema(TableName.SecretScanningScan).as("scanId"),
-          db.ref("status").withSchema(TableName.SecretScanningScan).as("scanStatus"),
-          db.ref("type").withSchema(TableName.SecretScanningScan).as("scanType"),
-          db.ref("statusMessage").withSchema(TableName.SecretScanningScan).as("scanStatusMessage"),
-          db.ref("createdAt").withSchema(TableName.SecretScanningScan).as("scanCreatedAt"),
-          db.ref("status").withSchema(TableName.SecretScanningFinding).as("findingStatus"),
-          db.ref("id").withSchema(TableName.SecretScanningFinding).as("findingId")
-        );
-
-      if (!resources.length) return [];
-
-      const results = sqlNestRelationships({
-        data: resources,
-        key: "id",
-        parentMapper: (resource) => SecretScanningResourcesSchema.parse(resource),
-        childrenMapper: [
-          {
-            key: "scanId",
-            label: "scans" as const,
-            mapper: ({ scanId, scanCreatedAt, scanStatus, scanStatusMessage, scanType }) => ({
-              id: scanId,
-              type: scanType,
-              createdAt: scanCreatedAt,
-              status: scanStatus,
-              statusMessage: scanStatusMessage
-            })
-          },
-          {
-            key: "findingId",
-            label: "findings" as const,
-            mapper: ({ findingId }) => ({
-              id: findingId
-            })
-          }
-        ]
-      });
-
-      return results.map(({ scans, findings, ...resource }) => {
-        const lastScan =
-          scans && scans.length
-            ? scans.reduce((latest, current) => {
-                return new Date(current.createdAt) > new Date(latest.createdAt) ? current : latest;
-              })
-            : null;
-
-        return {
-          ...resource,
-          lastScanStatus: lastScan?.status ?? null,
-          lastScanStatusMessage: lastScan?.statusMessage ?? null,
-          lastScannedAt: lastScan?.createdAt ?? null,
-          unresolvedFindings: findings?.length ?? 0
-        };
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find with Details - Secret Scanning Resource" });
-    }
-  };
-
-  const findScansWithDetailsByDataSourceId = async (dataSourceId: string, tx?: Knex) => {
-    try {
-      // TODO (scott): this query will probably need to be optimized
-
-      const scans = await (tx || db.replicaNode())(TableName.SecretScanningScan)
-        .leftJoin(
-          TableName.SecretScanningResource,
-          `${TableName.SecretScanningResource}.id`,
-          `${TableName.SecretScanningScan}.resourceId`
-        )
-        .where(`${TableName.SecretScanningResource}.dataSourceId`, dataSourceId)
-        .leftJoin(
-          TableName.SecretScanningFinding,
-          `${TableName.SecretScanningFinding}.scanId`,
-          `${TableName.SecretScanningScan}.id`
-        )
-        .select(selectAllTableCols(TableName.SecretScanningScan))
-        .select(
-          db.ref("status").withSchema(TableName.SecretScanningFinding).as("findingStatus"),
-          db.ref("id").withSchema(TableName.SecretScanningFinding).as("findingId"),
-          db.ref("name").withSchema(TableName.SecretScanningResource).as("resourceName")
-        );
-
-      if (!scans.length) return [];
-
-      const results = sqlNestRelationships({
-        data: scans,
-        key: "id",
-        parentMapper: (scan) => SecretScanningScansSchema.parse(scan),
-        childrenMapper: [
-          {
-            key: "findingId",
-            label: "findings" as const,
-            mapper: ({ findingId, findingStatus }) => ({
-              id: findingId,
-              status: findingStatus
-            })
-          },
-          {
-            key: "resourceId",
-            label: "resources" as const,
-            mapper: ({ resourceName }) => ({
-              name: resourceName
-            })
-          }
-        ]
-      });
-
-      return results.map(({ findings, resources, ...scan }) => {
-        return {
-          ...scan,
-          unresolvedFindings:
-            findings?.filter((finding) => finding.status === SecretScanningFindingStatus.Unresolved).length ?? 0,
-          resolvedFindings:
-            findings?.filter((finding) => finding.status !== SecretScanningFindingStatus.Unresolved).length ?? 0,
-          resourceName: resources[0].name
-        };
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find with Details By Data Source ID - Secret Scanning Scan" });
-    }
-  };
-
-  const findScansByDataSourceId = async (dataSourceId: string, tx?: Knex) => {
-    try {
-      const scans = await (tx || db.replicaNode())(TableName.SecretScanningScan)
-        .leftJoin(
-          TableName.SecretScanningResource,
-          `${TableName.SecretScanningResource}.id`,
-          `${TableName.SecretScanningScan}.resourceId`
-        )
-        .where(`${TableName.SecretScanningResource}.dataSourceId`, dataSourceId)
-
-        .select(selectAllTableCols(TableName.SecretScanningScan));
-
-      return scans;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find By Data Source ID - Secret Scanning Scan" });
-    }
-  };
-
-  return {
-    dataSources: {
-      ...dataSourceOrm,
-      find: findDataSource,
-      findById: findDataSourceById,
-      findOne: findOneDataSource,
-      create: createDataSource,
-      updateById: updateDataSourceById,
-      deleteById: deleteDataSourceById,
-      findWithDetails: findDataSourceWithDetails
-    },
-    resources: {
-      ...resourceOrm,
-      findWithDetails: findResourcesWithDetails
-    },
-    scans: {
-      ...scanOrm,
-      findWithDetailsByDataSourceId: findScansWithDetailsByDataSourceId,
-      findByDataSourceId: findScansByDataSourceId
-    },
-    findings: findingOrm,
-    configs: configOrm
-  };
-};