temp: add log to ensure audit log clean up

.github/workflows/release_helm_gateway.yaml

@@ -1,27 +0,0 @@
-name: Release Gateway Helm Chart
-on:
-    workflow_dispatch:
-
-jobs:
-    release-helm:
-        name: Release Helm Chart
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Install Helm
-              uses: azure/setup-helm@v3
-              with:
-                  version: v3.10.0
-
-            - name: Install python
-              uses: actions/setup-python@v4
-
-            - name: Install Cloudsmith CLI
-              run: pip install --upgrade cloudsmith-cli
-
-            - name: Build and push helm package to CloudSmith
-              run: cd helm-charts && sh upload-gateway-cloudsmith.sh
-              env:
-                  CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}

.infisicalignore

@@ -24,7 +24,3 @@ frontend/src/hooks/api/secretRotationsV2/types/index.ts:generic-api-key:65
 frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretRotationListView/SecretRotationItem.tsx:generic-api-key:26
 docs/documentation/platform/kms/overview.mdx:generic-api-key:281
 docs/documentation/platform/kms/overview.mdx:generic-api-key:344
-frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx:generic-api-key:85
-docs/cli/commands/user.mdx:generic-api-key:51
-frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx:generic-api-key:76
-docs/integrations/app-connections/hashicorp-vault.mdx:generic-api-key:188

backend/.eslintrc.js

@@ -69,15 +69,6 @@ module.exports = {
           ["^\\."]
         ]
       }
-    ],
-    "import/extensions": [
-      "error",
-      "ignorePackages",
-      {
-        "": "never", // this is required to get the .tsx to work...
-        ts: "never",
-        tsx: "never"
-      }
     ]
   }
 };

backend/package.json

@@ -72,8 +72,7 @@
     "seed:new": "tsx ./scripts/create-seed-file.ts",
     "seed": "knex --knexfile ./dist/db/knexfile.ts --client pg seed:run",
     "seed-dev": "knex --knexfile ./src/db/knexfile.ts --client pg seed:run",
-    "db:reset": "npm run migration:rollback -- --all && npm run migration:latest",
-    "email:dev": "email dev --dir src/services/smtp/emails"
+    "db:reset": "npm run migration:rollback -- --all && npm run migration:latest"
   },
   "keywords": [],
   "author": "",
@@ -92,12 +91,12 @@
     "@types/lodash.isequal": "^4.5.8",
     "@types/node": "^20.17.30",
     "@types/nodemailer": "^6.4.14",
+    "@types/passport-github": "^1.1.12",
     "@types/passport-google-oauth20": "^2.0.14",
     "@types/pg": "^8.10.9",
     "@types/picomatch": "^2.3.3",
     "@types/pkcs11js": "^1.0.4",
     "@types/prompt-sync": "^4.2.3",
-    "@types/react": "^19.1.2",
     "@types/resolve": "^1.20.6",
     "@types/safe-regex": "^1.1.6",
     "@types/sjcl": "^1.0.34",
@@ -117,7 +116,6 @@
     "nodemon": "^3.0.2",
     "pino-pretty": "^10.2.3",
     "prompt-sync": "^4.2.0",
-    "react-email": "4.0.7",
     "rimraf": "^5.0.5",
     "ts-node": "^10.9.2",
     "tsc-alias": "^1.8.8",
@@ -152,7 +150,6 @@
     "@infisical/quic": "^1.0.8",
     "@node-saml/passport-saml": "^5.0.1",
     "@octokit/auth-app": "^7.1.1",
-    "@octokit/plugin-paginate-graphql": "^5.2.4",
     "@octokit/plugin-retry": "^5.0.5",
     "@octokit/rest": "^20.0.2",
     "@octokit/webhooks-types": "^7.3.1",
@@ -167,7 +164,6 @@
     "@opentelemetry/semantic-conventions": "^1.27.0",
     "@peculiar/asn1-schema": "^2.3.8",
     "@peculiar/x509": "^1.12.1",
-    "@react-email/components": "0.0.36",
     "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@sindresorhus/slugify": "1.1.0",
     "@slack/oauth": "^3.0.2",
@@ -179,7 +175,6 @@
     "axios": "^1.6.7",
     "axios-retry": "^4.0.0",
     "bcrypt": "^5.1.1",
-    "botbuilder": "^4.23.2",
     "bullmq": "^5.4.2",
     "cassandra-driver": "^4.7.2",
     "connect-redis": "^7.1.1",
@@ -213,10 +208,10 @@
     "ora": "^7.0.1",
     "oracledb": "^6.4.0",
     "otplib": "^12.0.1",
+    "passport-github": "^1.1.0",
     "passport-gitlab2": "^5.0.0",
     "passport-google-oauth20": "^2.0.0",
     "passport-ldapauth": "^3.0.1",
-    "passport-oauth2": "^1.8.0",
     "pg": "^8.11.3",
     "pg-boss": "^10.1.5",
     "pg-query-stream": "^4.5.3",
@@ -227,8 +222,6 @@
     "posthog-node": "^3.6.2",
     "probot": "^13.3.8",
     "re2": "^1.21.4",
-    "react": "19.1.0",
-    "react-dom": "19.1.0",
     "safe-regex": "^2.1.1",
     "scim-patch": "^0.8.3",
     "scim2-parse-filter": "^0.2.10",

backend/src/@types/fastify.d.ts

@@ -5,7 +5,6 @@ import { Redis } from "ioredis";
 import { TUsers } from "@app/db/schemas";
 import { TAccessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
 import { TAccessApprovalRequestServiceFactory } from "@app/ee/services/access-approval-request/access-approval-request-service";
-import { TAssumePrivilegeServiceFactory } from "@app/ee/services/assume-privilege/assume-privilege-service";
 import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
 import { TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types";
 import { TAuditLogStreamServiceFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-service";
@@ -15,7 +14,6 @@ import { TDynamicSecretServiceFactory } from "@app/ee/services/dynamic-secret/dy
 import { TDynamicSecretLeaseServiceFactory } from "@app/ee/services/dynamic-secret-lease/dynamic-secret-lease-service";
 import { TExternalKmsServiceFactory } from "@app/ee/services/external-kms/external-kms-service";
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
-import { TGithubOrgSyncServiceFactory } from "@app/ee/services/github-org-sync/github-org-sync-service";
 import { TGroupServiceFactory } from "@app/ee/services/group/group-service";
 import { TIdentityProjectAdditionalPrivilegeServiceFactory } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { TIdentityProjectAdditionalPrivilegeV2ServiceFactory } from "@app/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service";
@@ -41,7 +39,6 @@ import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/
 import { TSshCertificateAuthorityServiceFactory } from "@app/ee/services/ssh/ssh-certificate-authority-service";
 import { TSshCertificateTemplateServiceFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-service";
 import { TSshHostServiceFactory } from "@app/ee/services/ssh-host/ssh-host-service";
-import { TSshHostGroupServiceFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-service";
 import { TTrustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service";
 import { TAuthMode } from "@app/server/plugins/auth/inject-identity";
 import { TApiKeyServiceFactory } from "@app/services/api-key/api-key-service";
@@ -72,7 +69,6 @@ import { TIdentityTokenAuthServiceFactory } from "@app/services/identity-token-a
 import { TIdentityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";
 import { TIntegrationServiceFactory } from "@app/services/integration/integration-service";
 import { TIntegrationAuthServiceFactory } from "@app/services/integration-auth/integration-auth-service";
-import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
 import { TOrgRoleServiceFactory } from "@app/services/org/org-role-service";
 import { TOrgServiceFactory } from "@app/services/org/org-service";
 import { TOrgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
@@ -113,14 +109,12 @@ declare module "@fastify/request-context" {
       };
     };
     identityPermissionMetadata?: Record<string, unknown>; // filled by permission service
-    assumedPrivilegeDetails?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
   }
 }
 
 declare module "fastify" {
   interface Session {
     callbackPort: string;
-    isAdminLogin: boolean;
   }
 
   interface FastifyRequest {
@@ -144,7 +138,6 @@ declare module "fastify" {
     passportUser: {
       isUserCompleted: boolean;
       providerAuthToken: string;
-      externalProviderAccessToken?: string;
     };
     kmipUser: {
       projectId: string;
@@ -215,7 +208,6 @@ declare module "fastify" {
       sshCertificateAuthority: TSshCertificateAuthorityServiceFactory;
       sshCertificateTemplate: TSshCertificateTemplateServiceFactory;
       sshHost: TSshHostServiceFactory;
-      sshHostGroup: TSshHostGroupServiceFactory;
       certificateAuthority: TCertificateAuthorityServiceFactory;
       certificateAuthorityCrl: TCertificateAuthorityCrlServiceFactory;
       certificateEst: TCertificateEstServiceFactory;
@@ -249,9 +241,6 @@ declare module "fastify" {
       kmipOperation: TKmipOperationServiceFactory;
       gateway: TGatewayServiceFactory;
       secretRotationV2: TSecretRotationV2ServiceFactory;
-      microsoftTeams: TMicrosoftTeamsServiceFactory;
-      assumePrivileges: TAssumePrivilegeServiceFactory;
-      githubOrgSync: TGithubOrgSyncServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data
     // everywhere else access using service layer

backend/src/@types/knex.d.ts

@@ -83,9 +83,6 @@ import {
   TGitAppOrg,
   TGitAppOrgInsert,
   TGitAppOrgUpdate,
-  TGithubOrgSyncConfigs,
-  TGithubOrgSyncConfigsInsert,
-  TGithubOrgSyncConfigsUpdate,
   TGroupProjectMembershipRoles,
   TGroupProjectMembershipRolesInsert,
   TGroupProjectMembershipRolesUpdate,
@@ -386,12 +383,6 @@ import {
   TSshCertificateTemplates,
   TSshCertificateTemplatesInsert,
   TSshCertificateTemplatesUpdate,
-  TSshHostGroupMemberships,
-  TSshHostGroupMembershipsInsert,
-  TSshHostGroupMembershipsUpdate,
-  TSshHostGroups,
-  TSshHostGroupsInsert,
-  TSshHostGroupsUpdate,
   TSshHostLoginUserMappings,
   TSshHostLoginUserMappingsInsert,
   TSshHostLoginUserMappingsUpdate,
@@ -432,21 +423,6 @@ import {
   TWorkflowIntegrationsInsert,
   TWorkflowIntegrationsUpdate
 } from "@app/db/schemas";
-import {
-  TMicrosoftTeamsIntegrations,
-  TMicrosoftTeamsIntegrationsInsert,
-  TMicrosoftTeamsIntegrationsUpdate
-} from "@app/db/schemas/microsoft-teams-integrations";
-import {
-  TProjectMicrosoftTeamsConfigs,
-  TProjectMicrosoftTeamsConfigsInsert,
-  TProjectMicrosoftTeamsConfigsUpdate
-} from "@app/db/schemas/project-microsoft-teams-configs";
-import {
-  TSecretReminderRecipients,
-  TSecretReminderRecipientsInsert,
-  TSecretReminderRecipientsUpdate
-} from "@app/db/schemas/secret-reminder-recipients";
 
 declare module "knex" {
   namespace Knex {
@@ -461,16 +437,6 @@ declare module "knex/types/tables" {
   interface Tables {
     [TableName.Users]: KnexOriginal.CompositeTableType<TUsers, TUsersInsert, TUsersUpdate>;
     [TableName.Groups]: KnexOriginal.CompositeTableType<TGroups, TGroupsInsert, TGroupsUpdate>;
-    [TableName.SshHostGroup]: KnexOriginal.CompositeTableType<
-      TSshHostGroups,
-      TSshHostGroupsInsert,
-      TSshHostGroupsUpdate
-    >;
-    [TableName.SshHostGroupMembership]: KnexOriginal.CompositeTableType<
-      TSshHostGroupMemberships,
-      TSshHostGroupMembershipsInsert,
-      TSshHostGroupMembershipsUpdate
-    >;
     [TableName.SshHost]: KnexOriginal.CompositeTableType<TSshHosts, TSshHostsInsert, TSshHostsUpdate>;
     [TableName.SshCertificateAuthority]: KnexOriginal.CompositeTableType<
       TSshCertificateAuthorities,
@@ -1028,25 +994,5 @@ declare module "knex/types/tables" {
       TSecretRotationV2SecretMappingsInsert,
       TSecretRotationV2SecretMappingsUpdate
     >;
-    [TableName.MicrosoftTeamsIntegrations]: KnexOriginal.CompositeTableType<
-      TMicrosoftTeamsIntegrations,
-      TMicrosoftTeamsIntegrationsInsert,
-      TMicrosoftTeamsIntegrationsUpdate
-    >;
-    [TableName.ProjectMicrosoftTeamsConfigs]: KnexOriginal.CompositeTableType<
-      TProjectMicrosoftTeamsConfigs,
-      TProjectMicrosoftTeamsConfigsInsert,
-      TProjectMicrosoftTeamsConfigsUpdate
-    >;
-    [TableName.SecretReminderRecipients]: KnexOriginal.CompositeTableType<
-      TSecretReminderRecipients,
-      TSecretReminderRecipientsInsert,
-      TSecretReminderRecipientsUpdate
-    >;
-    [TableName.GithubOrgSyncConfig]: KnexOriginal.CompositeTableType<
-      TGithubOrgSyncConfigs,
-      TGithubOrgSyncConfigsInsert,
-      TGithubOrgSyncConfigsUpdate
-    >;
   }
 }

backend/src/db/migrations/20250419004044_secret-reminder-recipients.ts

@@ -1,34 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasSecretReminderRecipientsTable = await knex.schema.hasTable(TableName.SecretReminderRecipients);
-
-  if (!hasSecretReminderRecipientsTable) {
-    await knex.schema.createTable(TableName.SecretReminderRecipients, (table) => {
-      table.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      table.timestamps(true, true, true);
-      table.uuid("secretId").notNullable();
-      table.uuid("userId").notNullable();
-      table.string("projectId").notNullable();
-
-      // Based on userId rather than project membership ID so we can easily extend group support in the future if need be.
-      // This does however mean we need to manually clean up once a user is removed from a project.
-      table.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
-      table.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE");
-      table.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-
-      table.index("secretId");
-      table.unique(["secretId", "userId"]);
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasSecretReminderRecipientsTable = await knex.schema.hasTable(TableName.SecretReminderRecipients);
-
-  if (hasSecretReminderRecipientsTable) {
-    await knex.schema.dropTableIfExists(TableName.SecretReminderRecipients);
-  }
-}

backend/src/db/migrations/20250422125635_microsoft-teams-workflow-integration.ts

@@ -1,130 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const superAdminHasEncryptedMicrosoftTeamsClientIdColumn = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsAppId"
-  );
-  const superAdminHasEncryptedMicrosoftTeamsClientSecret = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsClientSecret"
-  );
-  const superAdminHasEncryptedMicrosoftTeamsBotId = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsBotId"
-  );
-
-  if (
-    !superAdminHasEncryptedMicrosoftTeamsClientIdColumn ||
-    !superAdminHasEncryptedMicrosoftTeamsClientSecret ||
-    !superAdminHasEncryptedMicrosoftTeamsBotId
-  ) {
-    await knex.schema.alterTable(TableName.SuperAdmin, (table) => {
-      if (!superAdminHasEncryptedMicrosoftTeamsClientIdColumn) {
-        table.binary("encryptedMicrosoftTeamsAppId").nullable();
-      }
-      if (!superAdminHasEncryptedMicrosoftTeamsClientSecret) {
-        table.binary("encryptedMicrosoftTeamsClientSecret").nullable();
-      }
-      if (!superAdminHasEncryptedMicrosoftTeamsBotId) {
-        table.binary("encryptedMicrosoftTeamsBotId").nullable();
-      }
-    });
-  }
-
-  if (!(await knex.schema.hasColumn(TableName.WorkflowIntegrations, "status"))) {
-    await knex.schema.alterTable(TableName.WorkflowIntegrations, (table) => {
-      table.enu("status", ["pending", "installed", "failed"]).notNullable().defaultTo("installed"); // defaults to installed so we can have backwards compatibility with existing workflow integrations
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.MicrosoftTeamsIntegrations))) {
-    await knex.schema.createTable(TableName.MicrosoftTeamsIntegrations, (table) => {
-      table.uuid("id", { primaryKey: true }).notNullable();
-      table.foreign("id").references("id").inTable(TableName.WorkflowIntegrations).onDelete("CASCADE"); // the ID itself is the workflow integration ID
-
-      table.string("internalTeamsAppId").nullable();
-      table.string("tenantId").notNullable();
-      table.binary("encryptedAccessToken").nullable();
-      table.binary("encryptedBotAccessToken").nullable();
-
-      table.timestamp("accessTokenExpiresAt").nullable();
-      table.timestamp("botAccessTokenExpiresAt").nullable();
-
-      table.timestamps(true, true, true);
-    });
-
-    await createOnUpdateTrigger(knex, TableName.MicrosoftTeamsIntegrations);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.ProjectMicrosoftTeamsConfigs))) {
-    await knex.schema.createTable(TableName.ProjectMicrosoftTeamsConfigs, (tb) => {
-      tb.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      tb.string("projectId").notNullable().unique();
-      tb.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      tb.uuid("microsoftTeamsIntegrationId").notNullable();
-      tb.foreign("microsoftTeamsIntegrationId")
-        .references("id")
-        .inTable(TableName.MicrosoftTeamsIntegrations)
-        .onDelete("CASCADE");
-      tb.boolean("isAccessRequestNotificationEnabled").notNullable().defaultTo(false);
-      tb.boolean("isSecretRequestNotificationEnabled").notNullable().defaultTo(false);
-
-      tb.jsonb("accessRequestChannels").notNullable(); // {teamId: string, channelIds: string[]}
-      tb.jsonb("secretRequestChannels").notNullable(); // {teamId: string, channelIds: string[]}
-      tb.timestamps(true, true, true);
-    });
-
-    await createOnUpdateTrigger(knex, TableName.ProjectMicrosoftTeamsConfigs);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasEncryptedMicrosoftTeamsClientIdColumn = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsAppId"
-  );
-  const hasEncryptedMicrosoftTeamsClientSecret = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsClientSecret"
-  );
-  const hasEncryptedMicrosoftTeamsBotId = await knex.schema.hasColumn(
-    TableName.SuperAdmin,
-    "encryptedMicrosoftTeamsBotId"
-  );
-
-  if (
-    hasEncryptedMicrosoftTeamsClientIdColumn ||
-    hasEncryptedMicrosoftTeamsClientSecret ||
-    hasEncryptedMicrosoftTeamsBotId
-  ) {
-    await knex.schema.alterTable(TableName.SuperAdmin, (table) => {
-      if (hasEncryptedMicrosoftTeamsClientIdColumn) {
-        table.dropColumn("encryptedMicrosoftTeamsAppId");
-      }
-      if (hasEncryptedMicrosoftTeamsClientSecret) {
-        table.dropColumn("encryptedMicrosoftTeamsClientSecret");
-      }
-      if (hasEncryptedMicrosoftTeamsBotId) {
-        table.dropColumn("encryptedMicrosoftTeamsBotId");
-      }
-    });
-  }
-  if (await knex.schema.hasColumn(TableName.WorkflowIntegrations, "status")) {
-    await knex.schema.alterTable(TableName.WorkflowIntegrations, (table) => {
-      table.dropColumn("status");
-    });
-  }
-
-  if (await knex.schema.hasTable(TableName.ProjectMicrosoftTeamsConfigs)) {
-    await knex.schema.dropTableIfExists(TableName.ProjectMicrosoftTeamsConfigs);
-    await dropOnUpdateTrigger(knex, TableName.ProjectMicrosoftTeamsConfigs);
-  }
-  if (await knex.schema.hasTable(TableName.MicrosoftTeamsIntegrations)) {
-    await knex.schema.dropTableIfExists(TableName.MicrosoftTeamsIntegrations);
-    await dropOnUpdateTrigger(knex, TableName.MicrosoftTeamsIntegrations);
-  }
-}

backend/src/db/migrations/20250425163216_ssh-nullable-ca-defaults.ts

@@ -1,47 +0,0 @@
-import { Knex } from "knex";
-
-import { ProjectType, TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasDefaultUserCaCol = await knex.schema.hasColumn(TableName.ProjectSshConfig, "defaultUserSshCaId");
-  const hasDefaultHostCaCol = await knex.schema.hasColumn(TableName.ProjectSshConfig, "defaultHostSshCaId");
-
-  if (hasDefaultUserCaCol && hasDefaultHostCaCol) {
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      t.dropForeign(["defaultUserSshCaId"]);
-      t.dropForeign(["defaultHostSshCaId"]);
-    });
-    await knex.schema.alterTable(TableName.ProjectSshConfig, (t) => {
-      // allow nullable (does not wipe existing values)
-      t.uuid("defaultUserSshCaId").nullable().alter();
-      t.uuid("defaultHostSshCaId").nullable().alter();
-      // re-add with SET NULL behavior (previously CASCADE)
-      t.foreign("defaultUserSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
-      t.foreign("defaultHostSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("SET NULL");
-    });
-  }
-
-  // (dangtony98): backfill by adding null defaults CAs for all existing Infisical SSH projects
-  // that do not have an associated ProjectSshConfig record introduced in Infisical SSH V2.
-
-  const allProjects = await knex(TableName.Project).where("type", ProjectType.SSH).select("id");
-
-  const projectsWithConfig = await knex(TableName.ProjectSshConfig).select("projectId");
-  const projectIdsWithConfig = new Set(projectsWithConfig.map((config) => config.projectId));
-
-  const projectsNeedingConfig = allProjects.filter((project) => !projectIdsWithConfig.has(project.id));
-
-  if (projectsNeedingConfig.length > 0) {
-    const configsToInsert = projectsNeedingConfig.map((project) => ({
-      projectId: project.id,
-      defaultUserSshCaId: null,
-      defaultHostSshCaId: null,
-      createdAt: new Date(),
-      updatedAt: new Date()
-    }));
-
-    await knex.batchInsert(TableName.ProjectSshConfig, configsToInsert);
-  }
-}
-
-export async function down(): Promise<void> {}

backend/src/db/migrations/20250426044605_ssh-host-alias.ts

@@ -1,23 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasAliasColumn = await knex.schema.hasColumn(TableName.SshHost, "alias");
-  if (!hasAliasColumn) {
-    await knex.schema.alterTable(TableName.SshHost, (t) => {
-      t.string("alias").nullable();
-      t.unique(["projectId", "alias"]);
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasAliasColumn = await knex.schema.hasColumn(TableName.SshHost, "alias");
-  if (hasAliasColumn) {
-    await knex.schema.alterTable(TableName.SshHost, (t) => {
-      t.dropUnique(["projectId", "alias"]);
-      t.dropColumn("alias");
-    });
-  }
-}

backend/src/db/migrations/20250426075943_github-org-sync-config.ts

@@ -1,26 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasTable = await knex.schema.hasTable(TableName.GithubOrgSyncConfig);
-  if (!hasTable) {
-    await knex.schema.createTable(TableName.GithubOrgSyncConfig, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("githubOrgName").notNullable();
-      t.boolean("isActive").defaultTo(false);
-      t.binary("encryptedGithubOrgAccessToken");
-      t.uuid("orgId").notNullable().unique();
-      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-    });
-  }
-
-  await createOnUpdateTrigger(knex, TableName.GithubOrgSyncConfig);
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.GithubOrgSyncConfig);
-  await dropOnUpdateTrigger(knex, TableName.GithubOrgSyncConfig);
-}

backend/src/db/migrations/20250428134716_add-org-user-token-expiration-setting.ts

@@ -1,27 +0,0 @@
-import { Knex } from "knex";
-
-import { getConfig } from "@app/lib/config/env";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const appCfg = getConfig();
-  const tokenDuration = appCfg?.JWT_REFRESH_LIFETIME;
-
-  if (!(await knex.schema.hasColumn(TableName.Organization, "userTokenExpiration"))) {
-    await knex.schema.alterTable(TableName.Organization, (t) => {
-      t.string("userTokenExpiration");
-    });
-    if (tokenDuration) {
-      await knex(TableName.Organization).update({ userTokenExpiration: tokenDuration });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasColumn(TableName.Organization, "userTokenExpiration")) {
-    await knex.schema.alterTable(TableName.Organization, (t) => {
-      t.dropColumn("userTokenExpiration");
-    });
-  }
-}

backend/src/db/migrations/20250428173025_ssh-host-groups.ts

@@ -1,55 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.SshHostGroup))) {
-    await knex.schema.createTable(TableName.SshHostGroup, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.string("projectId").notNullable();
-      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      t.string("name").notNullable();
-      t.unique(["projectId", "name"]);
-    });
-    await createOnUpdateTrigger(knex, TableName.SshHostGroup);
-  }
-
-  if (!(await knex.schema.hasTable(TableName.SshHostGroupMembership))) {
-    await knex.schema.createTable(TableName.SshHostGroupMembership, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.uuid("sshHostGroupId").notNullable();
-      t.foreign("sshHostGroupId").references("id").inTable(TableName.SshHostGroup).onDelete("CASCADE");
-      t.uuid("sshHostId").notNullable();
-      t.foreign("sshHostId").references("id").inTable(TableName.SshHost).onDelete("CASCADE");
-      t.unique(["sshHostGroupId", "sshHostId"]);
-    });
-    await createOnUpdateTrigger(knex, TableName.SshHostGroupMembership);
-  }
-
-  const hasGroupColumn = await knex.schema.hasColumn(TableName.SshHostLoginUser, "sshHostGroupId");
-  if (!hasGroupColumn) {
-    await knex.schema.alterTable(TableName.SshHostLoginUser, (t) => {
-      t.uuid("sshHostGroupId").nullable();
-      t.foreign("sshHostGroupId").references("id").inTable(TableName.SshHostGroup).onDelete("CASCADE");
-      t.uuid("sshHostId").nullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasGroupColumn = await knex.schema.hasColumn(TableName.SshHostLoginUser, "sshHostGroupId");
-  if (hasGroupColumn) {
-    await knex.schema.alterTable(TableName.SshHostLoginUser, (t) => {
-      t.dropColumn("sshHostGroupId");
-    });
-  }
-
-  await knex.schema.dropTableIfExists(TableName.SshHostGroupMembership);
-  await dropOnUpdateTrigger(knex, TableName.SshHostGroupMembership);
-
-  await knex.schema.dropTableIfExists(TableName.SshHostGroup);
-  await dropOnUpdateTrigger(knex, TableName.SshHostGroup);
-}

backend/src/db/migrations/20250429232917_store-cert-secret-key-and-chain.ts

@@ -1,33 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateBody)) {
-    await knex.schema.alterTable(TableName.CertificateBody, (t) => {
-      t.binary("encryptedCertificateChain").nullable();
-    });
-  }
-
-  if (!(await knex.schema.hasTable(TableName.CertificateSecret))) {
-    await knex.schema.createTable(TableName.CertificateSecret, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.timestamps(true, true, true);
-      t.uuid("certId").notNullable().unique();
-      t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
-      t.binary("encryptedPrivateKey").notNullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.CertificateSecret)) {
-    await knex.schema.dropTable(TableName.CertificateSecret);
-  }
-
-  if (await knex.schema.hasTable(TableName.CertificateBody)) {
-    await knex.schema.alterTable(TableName.CertificateBody, (t) => {
-      t.dropColumn("encryptedCertificateChain");
-    });
-  }
-}

backend/src/db/schemas/certificate-bodies.ts

@@ -14,8 +14,7 @@ export const CertificateBodiesSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   certId: z.string().uuid(),
-  encryptedCertificate: zodBuffer,
-  encryptedCertificateChain: zodBuffer.nullable().optional()
+  encryptedCertificate: zodBuffer
 });
 
 export type TCertificateBodies = z.infer<typeof CertificateBodiesSchema>;

backend/src/db/schemas/certificate-secrets.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const CertificateSecretsSchema = z.object({
@@ -14,7 +12,8 @@ export const CertificateSecretsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   certId: z.string().uuid(),
-  encryptedPrivateKey: zodBuffer
+  pk: z.string(),
+  sk: z.string()
 });
 
 export type TCertificateSecrets = z.infer<typeof CertificateSecretsSchema>;

backend/src/db/schemas/certificates.ts

@@ -20,7 +20,7 @@ export const CertificatesSchema = z.object({
   notAfter: z.date(),
   revokedAt: z.date().nullable().optional(),
   revocationReason: z.number().nullable().optional(),
-  altNames: z.string().nullable().optional(),
+  altNames: z.string().default("").nullable().optional(),
   caCertId: z.string().uuid(),
   certificateTemplateId: z.string().uuid().nullable().optional(),
   keyUsages: z.string().array().nullable().optional(),

backend/src/db/schemas/github-org-sync-configs.ts

@@ -1,24 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const GithubOrgSyncConfigsSchema = z.object({
-  id: z.string().uuid(),
-  githubOrgName: z.string(),
-  isActive: z.boolean().default(false).nullable().optional(),
-  encryptedGithubOrgAccessToken: zodBuffer.nullable().optional(),
-  orgId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TGithubOrgSyncConfigs = z.infer<typeof GithubOrgSyncConfigsSchema>;
-export type TGithubOrgSyncConfigsInsert = Omit<z.input<typeof GithubOrgSyncConfigsSchema>, TImmutableDBKeys>;
-export type TGithubOrgSyncConfigsUpdate = Partial<Omit<z.input<typeof GithubOrgSyncConfigsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -25,7 +25,6 @@ export * from "./external-kms";
 export * from "./gateways";
 export * from "./git-app-install-sessions";
 export * from "./git-app-org";
-export * from "./github-org-sync-configs";
 export * from "./group-project-membership-roles";
 export * from "./group-project-memberships";
 export * from "./groups";
@@ -58,7 +57,6 @@ export * from "./kms-keys";
 export * from "./kms-root-config";
 export * from "./ldap-configs";
 export * from "./ldap-group-maps";
-export * from "./microsoft-teams-integrations";
 export * from "./models";
 export * from "./oidc-configs";
 export * from "./org-bots";
@@ -128,8 +126,6 @@ export * from "./ssh-certificate-authority-secrets";
 export * from "./ssh-certificate-bodies";
 export * from "./ssh-certificate-templates";
 export * from "./ssh-certificates";
-export * from "./ssh-host-group-memberships";
-export * from "./ssh-host-groups";
 export * from "./ssh-host-login-user-mappings";
 export * from "./ssh-host-login-users";
 export * from "./ssh-hosts";

backend/src/db/schemas/kmip-org-server-certificates.ts

@@ -13,7 +13,7 @@ export const KmipOrgServerCertificatesSchema = z.object({
   id: z.string().uuid(),
   orgId: z.string().uuid(),
   commonName: z.string(),
-  altNames: z.string().nullable().optional(),
+  altNames: z.string(),
   serialNumber: z.string(),
   keyAlgorithm: z.string(),
   issuedAt: z.date(),

backend/src/db/schemas/microsoft-teams-integrations.ts

@@ -1,31 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const MicrosoftTeamsIntegrationsSchema = z.object({
-  id: z.string().uuid(),
-  internalTeamsAppId: z.string().nullable().optional(),
-  tenantId: z.string(),
-  encryptedAccessToken: zodBuffer.nullable().optional(),
-  encryptedBotAccessToken: zodBuffer.nullable().optional(),
-  accessTokenExpiresAt: z.date().nullable().optional(),
-  botAccessTokenExpiresAt: z.date().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TMicrosoftTeamsIntegrations = z.infer<typeof MicrosoftTeamsIntegrationsSchema>;
-export type TMicrosoftTeamsIntegrationsInsert = Omit<
-  z.input<typeof MicrosoftTeamsIntegrationsSchema>,
-  TImmutableDBKeys
->;
-export type TMicrosoftTeamsIntegrationsUpdate = Partial<
-  Omit<z.input<typeof MicrosoftTeamsIntegrationsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/models.ts

@@ -2,8 +2,6 @@ import { z } from "zod";
 
 export enum TableName {
   Users = "users",
-  SshHostGroup = "ssh_host_groups",
-  SshHostGroupMembership = "ssh_host_group_memberships",
   SshHost = "ssh_hosts",
   SshHostLoginUser = "ssh_host_login_users",
   SshHostLoginUserMapping = "ssh_host_login_user_mappings",
@@ -148,11 +146,7 @@ export enum TableName {
   KmipOrgServerCertificates = "kmip_org_server_certificates",
   KmipClientCertificates = "kmip_client_certificates",
   SecretRotationV2 = "secret_rotations_v2",
-  SecretRotationV2SecretMapping = "secret_rotation_v2_secret_mappings",
-  MicrosoftTeamsIntegrations = "microsoft_teams_integrations",
-  ProjectMicrosoftTeamsConfigs = "project_microsoft_teams_configs",
-  SecretReminderRecipients = "secret_reminder_recipients",
-  GithubOrgSyncConfig = "github_org_sync_configs"
+  SecretRotationV2SecretMapping = "secret_rotation_v2_secret_mappings"
 }
 
 export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";

backend/src/db/schemas/oidc-configs.ts

@@ -30,9 +30,9 @@ export const OidcConfigsSchema = z.object({
   updatedAt: z.date(),
   orgId: z.string().uuid(),
   lastUsed: z.date().nullable().optional(),
-  manageGroupMemberships: z.boolean().default(false),
   encryptedOidcClientId: zodBuffer,
   encryptedOidcClientSecret: zodBuffer,
+  manageGroupMemberships: z.boolean().default(false),
   jwtSignatureAlgorithm: z.string().default("RS256")
 });
 

backend/src/db/schemas/organizations.ts

@@ -27,8 +27,7 @@ export const OrganizationsSchema = z.object({
   shouldUseNewPrivilegeSystem: z.boolean().default(true),
   privilegeUpgradeInitiatedByUsername: z.string().nullable().optional(),
   privilegeUpgradeInitiatedAt: z.date().nullable().optional(),
-  bypassOrgAuthEnabled: z.boolean().default(false),
-  userTokenExpiration: z.string().nullable().optional()
+  bypassOrgAuthEnabled: z.boolean().default(false)
 });
 
 export type TOrganizations = z.infer<typeof OrganizationsSchema>;

backend/src/db/schemas/project-microsoft-teams-configs.ts

@@ -1,29 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const ProjectMicrosoftTeamsConfigsSchema = z.object({
-  id: z.string().uuid(),
-  projectId: z.string(),
-  microsoftTeamsIntegrationId: z.string().uuid(),
-  isAccessRequestNotificationEnabled: z.boolean().default(false),
-  isSecretRequestNotificationEnabled: z.boolean().default(false),
-  accessRequestChannels: z.unknown(),
-  secretRequestChannels: z.unknown(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TProjectMicrosoftTeamsConfigs = z.infer<typeof ProjectMicrosoftTeamsConfigsSchema>;
-export type TProjectMicrosoftTeamsConfigsInsert = Omit<
-  z.input<typeof ProjectMicrosoftTeamsConfigsSchema>,
-  TImmutableDBKeys
->;
-export type TProjectMicrosoftTeamsConfigsUpdate = Partial<
-  Omit<z.input<typeof ProjectMicrosoftTeamsConfigsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/projects.ts

@@ -27,7 +27,7 @@ export const ProjectsSchema = z.object({
   description: z.string().nullable().optional(),
   type: z.string(),
   enforceCapitalization: z.boolean().default(false),
-  hasDeleteProtection: z.boolean().default(false).nullable().optional()
+  hasDeleteProtection: z.boolean().default(true).nullable().optional()
 });
 
 export type TProjects = z.infer<typeof ProjectsSchema>;

backend/src/db/schemas/secret-reminder-recipients.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SecretReminderRecipientsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  secretId: z.string().uuid(),
-  userId: z.string().uuid(),
-  projectId: z.string()
-});
-
-export type TSecretReminderRecipients = z.infer<typeof SecretReminderRecipientsSchema>;
-export type TSecretReminderRecipientsInsert = Omit<z.input<typeof SecretReminderRecipientsSchema>, TImmutableDBKeys>;
-export type TSecretReminderRecipientsUpdate = Partial<
-  Omit<z.input<typeof SecretReminderRecipientsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/ssh-host-group-memberships.ts

@@ -1,22 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SshHostGroupMembershipsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  sshHostGroupId: z.string().uuid(),
-  sshHostId: z.string().uuid()
-});
-
-export type TSshHostGroupMemberships = z.infer<typeof SshHostGroupMembershipsSchema>;
-export type TSshHostGroupMembershipsInsert = Omit<z.input<typeof SshHostGroupMembershipsSchema>, TImmutableDBKeys>;
-export type TSshHostGroupMembershipsUpdate = Partial<
-  Omit<z.input<typeof SshHostGroupMembershipsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/ssh-host-groups.ts

@@ -1,20 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const SshHostGroupsSchema = z.object({
-  id: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  projectId: z.string(),
-  name: z.string()
-});
-
-export type TSshHostGroups = z.infer<typeof SshHostGroupsSchema>;
-export type TSshHostGroupsInsert = Omit<z.input<typeof SshHostGroupsSchema>, TImmutableDBKeys>;
-export type TSshHostGroupsUpdate = Partial<Omit<z.input<typeof SshHostGroupsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/ssh-host-login-users.ts

@@ -11,9 +11,8 @@ export const SshHostLoginUsersSchema = z.object({
   id: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  sshHostId: z.string().uuid().nullable().optional(),
-  loginUser: z.string(),
-  sshHostGroupId: z.string().uuid().nullable().optional()
+  sshHostId: z.string().uuid(),
+  loginUser: z.string()
 });
 
 export type TSshHostLoginUsers = z.infer<typeof SshHostLoginUsersSchema>;

backend/src/db/schemas/ssh-hosts.ts

@@ -16,8 +16,7 @@ export const SshHostsSchema = z.object({
   userCertTtl: z.string(),
   hostCertTtl: z.string(),
   userSshCaId: z.string().uuid(),
-  hostSshCaId: z.string().uuid(),
-  alias: z.string().nullable().optional()
+  hostSshCaId: z.string().uuid()
 });
 
 export type TSshHosts = z.infer<typeof SshHostsSchema>;

backend/src/db/schemas/super-admin.ts

@@ -26,10 +26,7 @@ export const SuperAdminSchema = z.object({
   encryptedSlackClientSecret: zodBuffer.nullable().optional(),
   authConsentContent: z.string().nullable().optional(),
   pageFrameContent: z.string().nullable().optional(),
-  adminIdentityIds: z.string().array().nullable().optional(),
-  encryptedMicrosoftTeamsAppId: zodBuffer.nullable().optional(),
-  encryptedMicrosoftTeamsClientSecret: zodBuffer.nullable().optional(),
-  encryptedMicrosoftTeamsBotId: zodBuffer.nullable().optional()
+  adminIdentityIds: z.string().array().nullable().optional()
 });
 
 export type TSuperAdmin = z.infer<typeof SuperAdminSchema>;

backend/src/db/schemas/workflow-integrations.ts

@@ -14,8 +14,7 @@ export const WorkflowIntegrationsSchema = z.object({
   orgId: z.string().uuid(),
   description: z.string().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  status: z.string().default("installed")
+  updatedAt: z.date()
 });
 
 export type TWorkflowIntegrations = z.infer<typeof WorkflowIntegrationsSchema>;

backend/src/ee/routes/v1/assume-privilege-router.ts

@@ -1,124 +0,0 @@
-import { requestContext } from "@fastify/request-context";
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { getConfig } from "@app/lib/config/env";
-import { BadRequestError } from "@app/lib/errors";
-import { writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { ActorType, AuthMode } from "@app/services/auth/auth-type";
-
-export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "POST",
-    url: "/:projectId/assume-privileges",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        projectId: z.string()
-      }),
-      body: z.object({
-        actorType: z.enum([ActorType.USER, ActorType.IDENTITY]),
-        actorId: z.string()
-      }),
-      response: {
-        200: z.object({
-          message: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req, res) => {
-      if (req.auth.authMode === AuthMode.JWT) {
-        const payload = await server.services.assumePrivileges.assumeProjectPrivileges({
-          targetActorType: req.body.actorType,
-          targetActorId: req.body.actorId,
-          projectId: req.params.projectId,
-          actorPermissionDetails: req.permission,
-          tokenVersionId: req.auth.tokenVersionId
-        });
-
-        const appCfg = getConfig();
-        void res.setCookie("infisical-project-assume-privileges", payload.assumePrivilegesToken, {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: appCfg.HTTPS_ENABLED,
-          maxAge: 3600 // 1 hour in seconds
-        });
-
-        await server.services.auditLog.createAuditLog({
-          ...req.auditLogInfo,
-          orgId: req.permission.orgId,
-          event: {
-            type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_START,
-            metadata: {
-              projectId: req.params.projectId,
-              requesterEmail: req.auth.user.username,
-              requesterId: req.auth.user.id,
-              targetActorType: req.body.actorType,
-              targetActorId: req.body.actorId,
-              duration: "1hr"
-            }
-          }
-        });
-
-        return { message: "Successfully assumed role" };
-      }
-
-      throw new BadRequestError({ message: "Invalid auth mode" });
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:projectId/assume-privileges",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        projectId: z.string()
-      }),
-      response: {
-        200: z.object({
-          message: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req, res) => {
-      const assumedPrivilegeDetails = requestContext.get("assumedPrivilegeDetails");
-      if (req.auth.authMode === AuthMode.JWT && assumedPrivilegeDetails) {
-        const appCfg = getConfig();
-        void res.setCookie("infisical-project-assume-privileges", "", {
-          httpOnly: true,
-          path: "/",
-          sameSite: "strict",
-          secure: appCfg.HTTPS_ENABLED,
-          expires: new Date(0)
-        });
-
-        await server.services.auditLog.createAuditLog({
-          ...req.auditLogInfo,
-          orgId: req.permission.orgId,
-          event: {
-            type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_END,
-            metadata: {
-              projectId: req.params.projectId,
-              requesterEmail: req.auth.user.username,
-              requesterId: req.auth.user.id,
-              targetActorId: assumedPrivilegeDetails.actorId,
-              targetActorType: assumedPrivilegeDetails.actorType
-            }
-          }
-        });
-        return { message: "Successfully exited assumed role" };
-      }
-
-      throw new BadRequestError({ message: "Invalid auth mode" });
-    }
-  });
-};

backend/src/ee/routes/v1/github-org-sync-router.ts

@@ -1,129 +0,0 @@
-import { z } from "zod";
-
-import { GithubOrgSyncConfigsSchema } from "@app/db/schemas";
-import { CharacterType, zodValidateCharacters } from "@app/lib/validator/validate-string";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-const SanitizedGithubOrgSyncSchema = GithubOrgSyncConfigsSchema.pick({
-  isActive: true,
-  id: true,
-  createdAt: true,
-  updatedAt: true,
-  orgId: true,
-  githubOrgName: true
-});
-
-const githubOrgNameValidator = zodValidateCharacters([CharacterType.AlphaNumeric, CharacterType.Hyphen]);
-export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    url: "/",
-    method: "POST",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      body: z.object({
-        githubOrgName: githubOrgNameValidator(z.string().trim(), "GitHub Org Name"),
-        githubOrgAccessToken: z.string().trim().max(1000).optional(),
-        isActive: z.boolean().default(false)
-      }),
-      response: {
-        200: z.object({
-          githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const githubOrgSyncConfig = await server.services.githubOrgSync.createGithubOrgSync({
-        orgPermission: req.permission,
-        githubOrgName: req.body.githubOrgName,
-        githubOrgAccessToken: req.body.githubOrgAccessToken,
-        isActive: req.body.isActive
-      });
-
-      return { githubOrgSyncConfig };
-    }
-  });
-
-  server.route({
-    url: "/",
-    method: "PATCH",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      body: z
-        .object({
-          githubOrgName: githubOrgNameValidator(z.string().trim(), "GitHub Org Name"),
-          githubOrgAccessToken: z.string().trim().max(1000),
-          isActive: z.boolean()
-        })
-        .partial(),
-      response: {
-        200: z.object({
-          githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const githubOrgSyncConfig = await server.services.githubOrgSync.updateGithubOrgSync({
-        orgPermission: req.permission,
-        githubOrgName: req.body.githubOrgName,
-        githubOrgAccessToken: req.body.githubOrgAccessToken,
-        isActive: req.body.isActive
-      });
-
-      return { githubOrgSyncConfig };
-    }
-  });
-
-  server.route({
-    url: "/",
-    method: "DELETE",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      response: {
-        200: z.object({
-          githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const githubOrgSyncConfig = await server.services.githubOrgSync.deleteGithubOrgSync({
-        orgPermission: req.permission
-      });
-
-      return { githubOrgSyncConfig };
-    }
-  });
-
-  server.route({
-    url: "/",
-    method: "GET",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      response: {
-        200: z.object({
-          githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const githubOrgSyncConfig = await server.services.githubOrgSync.getGithubOrgSync({
-        orgPermission: req.permission
-      });
-
-      return { githubOrgSyncConfig };
-    }
-  });
-};

backend/src/ee/routes/v1/index.ts

@@ -2,14 +2,12 @@ import { registerProjectTemplateRouter } from "@app/ee/routes/v1/project-templat
 
 import { registerAccessApprovalPolicyRouter } from "./access-approval-policy-router";
 import { registerAccessApprovalRequestRouter } from "./access-approval-request-router";
-import { registerAssumePrivilegeRouter } from "./assume-privilege-router";
 import { registerAuditLogStreamRouter } from "./audit-log-stream-router";
 import { registerCaCrlRouter } from "./certificate-authority-crl-router";
 import { registerDynamicSecretLeaseRouter } from "./dynamic-secret-lease-router";
 import { registerDynamicSecretRouter } from "./dynamic-secret-router";
 import { registerExternalKmsRouter } from "./external-kms-router";
 import { registerGatewayRouter } from "./gateway-router";
-import { registerGithubOrgSyncRouter } from "./github-org-sync-router";
 import { registerGroupRouter } from "./group-router";
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
 import { registerKmipRouter } from "./kmip-router";
@@ -34,7 +32,6 @@ import { registerSnapshotRouter } from "./snapshot-router";
 import { registerSshCaRouter } from "./ssh-certificate-authority-router";
 import { registerSshCertRouter } from "./ssh-certificate-router";
 import { registerSshCertificateTemplateRouter } from "./ssh-certificate-template-router";
-import { registerSshHostGroupRouter } from "./ssh-host-group-router";
 import { registerSshHostRouter } from "./ssh-host-router";
 import { registerTrustedIpRouter } from "./trusted-ip-router";
 import { registerUserAdditionalPrivilegeRouter } from "./user-additional-privilege-router";
@@ -48,7 +45,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
       await projectRouter.register(registerProjectRoleRouter);
       await projectRouter.register(registerProjectRouter);
       await projectRouter.register(registerTrustedIpRouter);
-      await projectRouter.register(registerAssumePrivilegeRouter);
     },
     { prefix: "/workspace" }
   );
@@ -74,7 +70,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   );
 
   await server.register(registerGatewayRouter, { prefix: "/gateways" });
-  await server.register(registerGithubOrgSyncRouter, { prefix: "/github-org-sync-config" });
 
   await server.register(
     async (pkiRouter) => {
@@ -89,7 +84,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
       await sshRouter.register(registerSshCertRouter, { prefix: "/certificates" });
       await sshRouter.register(registerSshCertificateTemplateRouter, { prefix: "/certificate-templates" });
       await sshRouter.register(registerSshHostRouter, { prefix: "/hosts" });
-      await sshRouter.register(registerSshHostGroupRouter, { prefix: "/host-groups" });
     },
     { prefix: "/ssh" }
   );

backend/src/ee/routes/v1/project-role-router.ts

@@ -1,7 +1,7 @@
 import { packRules } from "@casl/ability/extra";
 import { z } from "zod";
 
-import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas";
+import { ProjectMembershipRole, ProjectMembershipsSchema, ProjectRolesSchema } from "@app/db/schemas";
 import {
   backfillPermissionV1SchemaToV2Schema,
   ProjectPermissionV1Schema
@@ -245,22 +245,13 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           data: z.object({
-            membership: z.object({
-              id: z.string(),
+            membership: ProjectMembershipsSchema.extend({
               roles: z
                 .object({
                   role: z.string()
                 })
                 .array()
             }),
-            assumedPrivilegeDetails: z
-              .object({
-                actorId: z.string(),
-                actorType: z.string(),
-                actorName: z.string(),
-                actorEmail: z.string().optional()
-              })
-              .optional(),
             permissions: z.any().array()
           })
         })
@@ -268,20 +259,14 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const { permissions, membership, assumedPrivilegeDetails } = await server.services.projectRole.getUserPermission(
+      const { permissions, membership } = await server.services.projectRole.getUserPermission(
         req.permission.id,
         req.params.projectId,
         req.permission.authMethod,
         req.permission.orgId
       );
 
-      return {
-        data: {
-          permissions,
-          membership,
-          assumedPrivilegeDetails
-        }
-      };
+      return { data: { permissions, membership } };
     }
   });
 };

backend/src/ee/routes/v1/ssh-host-group-router.ts

@@ -1,360 +0,0 @@
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { loginMappingSchema, sanitizedSshHost } from "@app/ee/services/ssh-host/ssh-host-schema";
-import { sanitizedSshHostGroup } from "@app/ee/services/ssh-host-group/ssh-host-group-schema";
-import { EHostGroupMembershipFilter } from "@app/ee/services/ssh-host-group/ssh-host-group-types";
-import { ApiDocsTags, SSH_HOST_GROUPS } from "@app/lib/api-docs";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { slugSchema } from "@app/server/lib/schemas";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerSshHostGroupRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/:sshHostGroupId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Get SSH Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().describe(SSH_HOST_GROUPS.GET.sshHostGroupId)
-      }),
-      response: {
-        200: sanitizedSshHostGroup.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const sshHostGroup = await server.services.sshHostGroup.getSshHostGroup({
-        sshHostGroupId: req.params.sshHostGroupId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHostGroup.projectId,
-        event: {
-          type: EventType.GET_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            name: sshHostGroup.name
-          }
-        }
-      });
-
-      return sshHostGroup;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Create SSH Host Group",
-      body: z.object({
-        projectId: z.string().describe(SSH_HOST_GROUPS.CREATE.projectId),
-        name: slugSchema({ min: 1, max: 64, field: "name" }).describe(SSH_HOST_GROUPS.CREATE.name),
-        loginMappings: z.array(loginMappingSchema).default([]).describe(SSH_HOST_GROUPS.CREATE.loginMappings)
-      }),
-      response: {
-        200: sanitizedSshHostGroup.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const sshHostGroup = await server.services.sshHostGroup.createSshHostGroup({
-        ...req.body,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHostGroup.projectId,
-        event: {
-          type: EventType.CREATE_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            name: sshHostGroup.name,
-            loginMappings: sshHostGroup.loginMappings
-          }
-        }
-      });
-
-      return sshHostGroup;
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:sshHostGroupId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Update SSH Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().trim().describe(SSH_HOST_GROUPS.UPDATE.sshHostGroupId)
-      }),
-      body: z.object({
-        name: slugSchema({ min: 1, max: 64, field: "name" }).describe(SSH_HOST_GROUPS.UPDATE.name).optional(),
-        loginMappings: z.array(loginMappingSchema).optional().describe(SSH_HOST_GROUPS.UPDATE.loginMappings)
-      }),
-      response: {
-        200: sanitizedSshHostGroup.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    handler: async (req) => {
-      const sshHostGroup = await server.services.sshHostGroup.updateSshHostGroup({
-        sshHostGroupId: req.params.sshHostGroupId,
-        ...req.body,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHostGroup.projectId,
-        event: {
-          type: EventType.UPDATE_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            name: sshHostGroup.name,
-            loginMappings: sshHostGroup.loginMappings
-          }
-        }
-      });
-
-      return sshHostGroup;
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:sshHostGroupId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Delete SSH Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().describe(SSH_HOST_GROUPS.DELETE.sshHostGroupId)
-      }),
-      response: {
-        200: sanitizedSshHostGroup.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const sshHostGroup = await server.services.sshHostGroup.deleteSshHostGroup({
-        sshHostGroupId: req.params.sshHostGroupId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHostGroup.projectId,
-        event: {
-          type: EventType.DELETE_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            name: sshHostGroup.name
-          }
-        }
-      });
-
-      return sshHostGroup;
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:sshHostGroupId/hosts",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Get SSH Hosts in a Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().describe(SSH_HOST_GROUPS.GET.sshHostGroupId)
-      }),
-      querystring: z.object({
-        filter: z.nativeEnum(EHostGroupMembershipFilter).optional().describe(SSH_HOST_GROUPS.GET.filter)
-      }),
-      response: {
-        200: z.object({
-          hosts: sanitizedSshHost
-            .pick({
-              id: true,
-              hostname: true,
-              alias: true
-            })
-            .merge(
-              z.object({
-                isPartOfGroup: z.boolean(),
-                joinedGroupAt: z.date().nullable()
-              })
-            )
-            .array(),
-          totalCount: z.number()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { sshHostGroup, hosts, totalCount } = await server.services.sshHostGroup.listSshHostGroupHosts({
-        sshHostGroupId: req.params.sshHostGroupId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.query
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHostGroup.projectId,
-        event: {
-          type: EventType.GET_SSH_HOST_GROUP_HOSTS,
-          metadata: {
-            sshHostGroupId: req.params.sshHostGroupId,
-            name: sshHostGroup.name
-          }
-        }
-      });
-
-      return { hosts, totalCount };
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/:sshHostGroupId/hosts/:hostId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Add an SSH Host to a Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().describe(SSH_HOST_GROUPS.ADD_HOST.sshHostGroupId),
-        hostId: z.string().describe(SSH_HOST_GROUPS.ADD_HOST.hostId)
-      }),
-      response: {
-        200: sanitizedSshHost.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { sshHostGroup, sshHost } = await server.services.sshHostGroup.addHostToSshHostGroup({
-        sshHostGroupId: req.params.sshHostGroupId,
-        hostId: req.params.hostId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHost.projectId,
-        event: {
-          type: EventType.ADD_HOST_TO_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            sshHostId: sshHost.id,
-            hostname: sshHost.hostname
-          }
-        }
-      });
-
-      return sshHost;
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:sshHostGroupId/hosts/:hostId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHostGroups],
-      description: "Remove an SSH Host from a Host Group",
-      params: z.object({
-        sshHostGroupId: z.string().describe(SSH_HOST_GROUPS.DELETE_HOST.sshHostGroupId),
-        hostId: z.string().describe(SSH_HOST_GROUPS.DELETE_HOST.hostId)
-      }),
-      response: {
-        200: sanitizedSshHost.extend({
-          loginMappings: z.array(loginMappingSchema)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { sshHostGroup, sshHost } = await server.services.sshHostGroup.removeHostFromSshHostGroup({
-        sshHostGroupId: req.params.sshHostGroupId,
-        hostId: req.params.hostId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: sshHost.projectId,
-        event: {
-          type: EventType.REMOVE_HOST_FROM_SSH_HOST_GROUP,
-          metadata: {
-            sshHostGroupId: sshHostGroup.id,
-            sshHostId: sshHost.id,
-            hostname: sshHost.hostname
-          }
-        }
-      });
-
-      return sshHost;
-    }
-  });
-};

backend/src/ee/routes/v1/ssh-host-router.ts

@@ -3,12 +3,10 @@ import { z } from "zod";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types";
 import { loginMappingSchema, sanitizedSshHost } from "@app/ee/services/ssh-host/ssh-host-schema";
-import { LoginMappingSource } from "@app/ee/services/ssh-host/ssh-host-types";
 import { isValidHostname } from "@app/ee/services/ssh-host/ssh-host-validators";
-import { ApiDocsTags, SSH_HOSTS } from "@app/lib/api-docs";
+import { SSH_HOSTS } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
 import { publicSshCaLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { slugSchema } from "@app/server/lib/schemas";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -22,16 +20,10 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: readLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       response: {
         200: z.array(
           sanitizedSshHost.extend({
-            loginMappings: loginMappingSchema
-              .extend({
-                source: z.nativeEnum(LoginMappingSource)
-              })
-              .array()
+            loginMappings: z.array(loginMappingSchema)
           })
         )
       }
@@ -56,18 +48,12 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: readLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       params: z.object({
         sshHostId: z.string().describe(SSH_HOSTS.GET.sshHostId)
       }),
       response: {
         200: sanitizedSshHost.extend({
-          loginMappings: loginMappingSchema
-            .extend({
-              source: z.nativeEnum(LoginMappingSource)
-            })
-            .array()
+          loginMappings: z.array(loginMappingSchema)
         })
       }
     },
@@ -104,20 +90,16 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: writeLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
-      description: "Register SSH Host",
+      description: "Add an SSH Host",
       body: z.object({
         projectId: z.string().describe(SSH_HOSTS.CREATE.projectId),
         hostname: z
           .string()
           .min(1)
-          .trim()
           .refine((v) => isValidHostname(v), {
             message: "Hostname must be a valid hostname"
           })
           .describe(SSH_HOSTS.CREATE.hostname),
-        alias: slugSchema({ min: 0, max: 64, field: "alias" }).describe(SSH_HOSTS.CREATE.alias).default(""),
         userCertTtl: z
           .string()
           .refine((val) => ms(val) > 0, "TTL must be a positive number")
@@ -134,11 +116,7 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: sanitizedSshHost.extend({
-          loginMappings: loginMappingSchema
-            .extend({
-              source: z.nativeEnum(LoginMappingSource)
-            })
-            .array()
+          loginMappings: z.array(loginMappingSchema)
         })
       }
     },
@@ -160,7 +138,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
           metadata: {
             sshHostId: host.id,
             hostname: host.hostname,
-            alias: host.alias ?? null,
             userCertTtl: host.userCertTtl,
             hostCertTtl: host.hostCertTtl,
             loginMappings: host.loginMappings,
@@ -182,8 +159,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       description: "Update SSH Host",
       params: z.object({
         sshHostId: z.string().trim().describe(SSH_HOSTS.UPDATE.sshHostId)
@@ -191,14 +166,12 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       body: z.object({
         hostname: z
           .string()
-          .trim()
           .min(1)
           .refine((v) => isValidHostname(v), {
             message: "Hostname must be a valid hostname"
           })
           .optional()
           .describe(SSH_HOSTS.UPDATE.hostname),
-        alias: slugSchema({ min: 0, max: 64, field: "alias" }).describe(SSH_HOSTS.UPDATE.alias).optional(),
         userCertTtl: z
           .string()
           .refine((val) => ms(val) > 0, "TTL must be a positive number")
@@ -213,11 +186,7 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: sanitizedSshHost.extend({
-          loginMappings: loginMappingSchema
-            .extend({
-              source: z.nativeEnum(LoginMappingSource)
-            })
-            .array()
+          loginMappings: z.array(loginMappingSchema)
         })
       }
     },
@@ -239,7 +208,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
           metadata: {
             sshHostId: host.id,
             hostname: host.hostname,
-            alias: host.alias,
             userCertTtl: host.userCertTtl,
             hostCertTtl: host.hostCertTtl,
             loginMappings: host.loginMappings,
@@ -260,19 +228,12 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: writeLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
-      description: "Delete SSH Host",
       params: z.object({
         sshHostId: z.string().describe(SSH_HOSTS.DELETE.sshHostId)
       }),
       response: {
         200: sanitizedSshHost.extend({
-          loginMappings: loginMappingSchema
-            .extend({
-              source: z.nativeEnum(LoginMappingSource)
-            })
-            .array()
+          loginMappings: z.array(loginMappingSchema)
         })
       }
     },
@@ -310,8 +271,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       description: "Issue SSH certificate for user",
       params: z.object({
         sshHostId: z.string().describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.sshHostId)
@@ -384,8 +343,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       description: "Issue SSH certificate for host",
       params: z.object({
         sshHostId: z.string().describe(SSH_HOSTS.ISSUE_HOST_CERT.sshHostId)
@@ -450,8 +407,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: publicSshCaLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       description: "Get public key of the user SSH CA linked to the host",
       params: z.object({
         sshHostId: z.string().trim().describe(SSH_HOSTS.GET_USER_CA_PUBLIC_KEY.sshHostId)
@@ -473,8 +428,6 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => {
       rateLimit: publicSshCaLimit
     },
     schema: {
-      hide: false,
-      tags: [ApiDocsTags.SshHosts],
       description: "Get public key of the host SSH CA linked to the host",
       params: z.object({
         sshHostId: z.string().trim().describe(SSH_HOSTS.GET_HOST_CA_PUBLIC_KEY.sshHostId)

backend/src/ee/routes/v2/secret-rotation-v2-routers/aws-iam-user-secret-rotation-router.ts

@@ -1,19 +0,0 @@
-import {
-  AwsIamUserSecretRotationGeneratedCredentialsSchema,
-  AwsIamUserSecretRotationSchema,
-  CreateAwsIamUserSecretRotationSchema,
-  UpdateAwsIamUserSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/aws-iam-user-secret";
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-
-import { registerSecretRotationEndpoints } from "./secret-rotation-v2-endpoints";
-
-export const registerAwsIamUserSecretRotationRouter = async (server: FastifyZodProvider) =>
-  registerSecretRotationEndpoints({
-    type: SecretRotation.AwsIamUserSecret,
-    server,
-    responseSchema: AwsIamUserSecretRotationSchema,
-    createSchema: CreateAwsIamUserSecretRotationSchema,
-    updateSchema: UpdateAwsIamUserSecretRotationSchema,
-    generatedCredentialsSchema: AwsIamUserSecretRotationGeneratedCredentialsSchema
-  });

backend/src/ee/routes/v2/secret-rotation-v2-routers/azure-client-secret-rotation-router.ts

@@ -1,19 +0,0 @@
-import {
-  AzureClientSecretRotationGeneratedCredentialsSchema,
-  AzureClientSecretRotationSchema,
-  CreateAzureClientSecretRotationSchema,
-  UpdateAzureClientSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/azure-client-secret";
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-
-import { registerSecretRotationEndpoints } from "./secret-rotation-v2-endpoints";
-
-export const registerAzureClientSecretRotationRouter = async (server: FastifyZodProvider) =>
-  registerSecretRotationEndpoints({
-    type: SecretRotation.AzureClientSecret,
-    server,
-    responseSchema: AzureClientSecretRotationSchema,
-    createSchema: CreateAzureClientSecretRotationSchema,
-    updateSchema: UpdateAzureClientSecretRotationSchema,
-    generatedCredentialsSchema: AzureClientSecretRotationGeneratedCredentialsSchema
-  });

backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts

@@ -1,9 +1,6 @@
 import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
 
 import { registerAuth0ClientSecretRotationRouter } from "./auth0-client-secret-rotation-router";
-import { registerAwsIamUserSecretRotationRouter } from "./aws-iam-user-secret-rotation-router";
-import { registerAzureClientSecretRotationRouter } from "./azure-client-secret-rotation-router";
-import { registerLdapPasswordRotationRouter } from "./ldap-password-rotation-router";
 import { registerMsSqlCredentialsRotationRouter } from "./mssql-credentials-rotation-router";
 import { registerPostgresCredentialsRotationRouter } from "./postgres-credentials-rotation-router";
 
@@ -15,8 +12,5 @@ export const SECRET_ROTATION_REGISTER_ROUTER_MAP: Record<
 > = {
   [SecretRotation.PostgresCredentials]: registerPostgresCredentialsRotationRouter,
   [SecretRotation.MsSqlCredentials]: registerMsSqlCredentialsRotationRouter,
-  [SecretRotation.Auth0ClientSecret]: registerAuth0ClientSecretRotationRouter,
-  [SecretRotation.AzureClientSecret]: registerAzureClientSecretRotationRouter,
-  [SecretRotation.AwsIamUserSecret]: registerAwsIamUserSecretRotationRouter,
-  [SecretRotation.LdapPassword]: registerLdapPasswordRotationRouter
+  [SecretRotation.Auth0ClientSecret]: registerAuth0ClientSecretRotationRouter
 };

backend/src/ee/routes/v2/secret-rotation-v2-routers/ldap-password-rotation-router.ts

@@ -1,19 +0,0 @@
-import {
-  CreateLdapPasswordRotationSchema,
-  LdapPasswordRotationGeneratedCredentialsSchema,
-  LdapPasswordRotationSchema,
-  UpdateLdapPasswordRotationSchema
-} from "@app/ee/services/secret-rotation-v2/ldap-password";
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-
-import { registerSecretRotationEndpoints } from "./secret-rotation-v2-endpoints";
-
-export const registerLdapPasswordRotationRouter = async (server: FastifyZodProvider) =>
-  registerSecretRotationEndpoints({
-    type: SecretRotation.LdapPassword,
-    server,
-    responseSchema: LdapPasswordRotationSchema,
-    createSchema: CreateLdapPasswordRotationSchema,
-    updateSchema: UpdateLdapPasswordRotationSchema,
-    generatedCredentialsSchema: LdapPasswordRotationGeneratedCredentialsSchema
-  });

backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts

@@ -2,9 +2,6 @@ import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { Auth0ClientSecretRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/auth0-client-secret";
-import { AwsIamUserSecretRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/aws-iam-user-secret";
-import { AzureClientSecretRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/azure-client-secret";
-import { LdapPasswordRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/ldap-password";
 import { MsSqlCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/mssql-credentials";
 import { PostgresCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 import { SecretRotationV2Schema } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema";
@@ -16,10 +13,7 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SecretRotationV2OptionsSchema = z.discriminatedUnion("type", [
   PostgresCredentialsRotationListItemSchema,
   MsSqlCredentialsRotationListItemSchema,
-  Auth0ClientSecretRotationListItemSchema,
-  AzureClientSecretRotationListItemSchema,
-  AwsIamUserSecretRotationListItemSchema,
-  LdapPasswordRotationListItemSchema
+  Auth0ClientSecretRotationListItemSchema
 ]);
 
 export const registerSecretRotationV2Router = async (server: FastifyZodProvider) => {

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -6,15 +6,13 @@ import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
-import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
-import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 import { TProjectSlackConfigDALFactory } from "@app/services/slack/project-slack-config-dal";
+import { triggerSlackNotification } from "@app/services/slack/slack-fns";
+import { SlackTriggerFeature } from "@app/services/slack/slack-types";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
@@ -69,8 +67,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   >;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   projectSlackConfigDAL: Pick<TProjectSlackConfigDALFactory, "getIntegrationDetailsByProject">;
-  microsoftTeamsService: Pick<TMicrosoftTeamsServiceFactory, "sendNotification">;
-  projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
 };
 
 export type TAccessApprovalRequestServiceFactory = ReturnType<typeof accessApprovalRequestServiceFactory>;
@@ -88,8 +84,6 @@ export const accessApprovalRequestServiceFactory = ({
   smtpService,
   userDAL,
   kmsService,
-  microsoftTeamsService,
-  projectMicrosoftTeamsConfigDAL,
   projectSlackConfigDAL
 }: TSecretApprovalRequestServiceFactoryDep) => {
   const createAccessApprovalRequest = async ({
@@ -225,30 +219,24 @@ export const accessApprovalRequestServiceFactory = ({
       const requesterFullName = `${requestedByUser.firstName} ${requestedByUser.lastName}`;
       const approvalUrl = `${cfg.SITE_URL}/secret-manager/${project.id}/approval`;
 
-      await triggerWorkflowIntegrationNotification({
-        input: {
-          notification: {
-            type: TriggerFeature.ACCESS_REQUEST,
-            payload: {
-              projectName: project.name,
-              requesterFullName,
-              isTemporary,
-              requesterEmail: requestedByUser.email as string,
-              secretPath,
-              environment: envSlug,
-              permissions: accessTypes,
-              approvalUrl,
-              note
-            }
-          },
-          projectId: project.id
-        },
-        dependencies: {
-          projectDAL,
-          projectSlackConfigDAL,
-          kmsService,
-          microsoftTeamsService,
-          projectMicrosoftTeamsConfigDAL
+      await triggerSlackNotification({
+        projectId: project.id,
+        projectSlackConfigDAL,
+        projectDAL,
+        kmsService,
+        notification: {
+          type: SlackTriggerFeature.ACCESS_REQUEST,
+          payload: {
+            projectName: project.name,
+            requesterFullName,
+            isTemporary,
+            requesterEmail: requestedByUser.email as string,
+            secretPath,
+            environment: envSlug,
+            permissions: accessTypes,
+            approvalUrl,
+            note
+          }
         }
       });
 

backend/src/ee/services/assume-privilege/assume-privilege-service.ts

@@ -1,101 +0,0 @@
-import { ForbiddenError } from "@casl/ability";
-import jwt from "jsonwebtoken";
-
-import { ActionProjectType } from "@app/db/schemas";
-import { getConfig } from "@app/lib/config/env";
-import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { ActorType } from "@app/services/auth/auth-type";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-
-import { TPermissionServiceFactory } from "../permission/permission-service";
-import {
-  ProjectPermissionIdentityActions,
-  ProjectPermissionMemberActions,
-  ProjectPermissionSub
-} from "../permission/project-permission";
-import { TAssumeProjectPrivilegeDTO } from "./assume-privilege-types";
-
-type TAssumePrivilegeServiceFactoryDep = {
-  projectDAL: Pick<TProjectDALFactory, "findById">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-};
-
-export type TAssumePrivilegeServiceFactory = ReturnType<typeof assumePrivilegeServiceFactory>;
-
-export const assumePrivilegeServiceFactory = ({ projectDAL, permissionService }: TAssumePrivilegeServiceFactoryDep) => {
-  const assumeProjectPrivileges = async ({
-    targetActorType,
-    targetActorId,
-    projectId,
-    actorPermissionDetails,
-    tokenVersionId
-  }: TAssumeProjectPrivilegeDTO) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actorPermissionDetails.type,
-      actorId: actorPermissionDetails.id,
-      projectId,
-      actorAuthMethod: actorPermissionDetails.authMethod,
-      actorOrgId: actorPermissionDetails.orgId,
-      actionProjectType: ActionProjectType.Any
-    });
-
-    if (targetActorType === ActorType.USER) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionMemberActions.AssumePrivileges,
-        ProjectPermissionSub.Member
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionIdentityActions.AssumePrivileges,
-        ProjectPermissionSub.Identity
-      );
-    }
-
-    // check entity is  part of project
-    await permissionService.getProjectPermission({
-      actor: targetActorType,
-      actorId: targetActorId,
-      projectId,
-      actorAuthMethod: actorPermissionDetails.authMethod,
-      actorOrgId: actorPermissionDetails.orgId,
-      actionProjectType: ActionProjectType.Any
-    });
-
-    const appCfg = getConfig();
-    const assumePrivilegesToken = jwt.sign(
-      {
-        tokenVersionId,
-        actorType: targetActorType,
-        actorId: targetActorId,
-        projectId,
-        requesterId: actorPermissionDetails.id
-      },
-      appCfg.AUTH_SECRET,
-      { expiresIn: "1hr" }
-    );
-
-    return { actorType: targetActorType, actorId: targetActorId, projectId, assumePrivilegesToken };
-  };
-
-  const verifyAssumePrivilegeToken = (token: string, tokenVersionId: string) => {
-    const appCfg = getConfig();
-    const decodedToken = jwt.verify(token, appCfg.AUTH_SECRET) as {
-      tokenVersionId: string;
-      projectId: string;
-      requesterId: string;
-      actorType: ActorType;
-      actorId: string;
-    };
-    if (decodedToken.tokenVersionId !== tokenVersionId) {
-      throw new ForbiddenRequestError({ message: "Invalid token version" });
-    }
-    return decodedToken;
-  };
-
-  return {
-    assumeProjectPrivileges,
-    verifyAssumePrivilegeToken
-  };
-};

backend/src/ee/services/assume-privilege/assume-privilege-types.ts

@@ -1,10 +0,0 @@
-import { OrgServiceActor } from "@app/lib/types";
-import { ActorType } from "@app/services/auth/auth-type";
-
-export type TAssumeProjectPrivilegeDTO = {
-  targetActorType: ActorType.USER | ActorType.IDENTITY;
-  targetActorId: string;
-  projectId: string;
-  tokenVersionId: string;
-  actorPermissionDetails: OrgServiceActor;
-};

backend/src/ee/services/audit-log/audit-log-dal.ts

@@ -177,6 +177,7 @@ export const auditLogDALFactory = (db: TDbClient) => {
           .del()
           .returning("id");
         numberOfRetryOnFailure = 0; // reset
+        logger.info(`${QueueName.DailyResourceCleanUp}: ${deletedAuditLogIds?.length} audit logs deleted`);
       } catch (error) {
         numberOfRetryOnFailure += 1;
         logger.error(error, "Failed to delete audit log on pruning");

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -12,7 +12,6 @@ import {
 import { SshCaStatus, SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types";
 import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types";
 import { SshCertTemplateStatus } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-types";
-import { TLoginMapping } from "@app/ee/services/ssh-host/ssh-host-types";
 import { SymmetricKeyAlgorithm } from "@app/lib/crypto/cipher";
 import { AsymmetricKeyAlgorithm, SigningAlgorithm } from "@app/lib/crypto/sign/types";
 import { TProjectPermission } from "@app/lib/types";
@@ -30,7 +29,6 @@ import {
   TSecretSyncRaw,
   TUpdateSecretSyncDTO
 } from "@app/services/secret-sync/secret-sync-types";
-import { WorkflowIntegration } from "@app/services/workflow-integration/workflow-integration-types";
 
 import { KmipPermission } from "../kmip/kmip-enum";
 import { ApprovalStatus } from "../secret-approval-request/secret-approval-request-types";
@@ -193,19 +191,12 @@ export enum EventType {
   UPDATE_SSH_CERTIFICATE_TEMPLATE = "update-ssh-certificate-template",
   DELETE_SSH_CERTIFICATE_TEMPLATE = "delete-ssh-certificate-template",
   GET_SSH_CERTIFICATE_TEMPLATE = "get-ssh-certificate-template",
-  GET_SSH_HOST = "get-ssh-host",
   CREATE_SSH_HOST = "create-ssh-host",
   UPDATE_SSH_HOST = "update-ssh-host",
   DELETE_SSH_HOST = "delete-ssh-host",
+  GET_SSH_HOST = "get-ssh-host",
   ISSUE_SSH_HOST_USER_CERT = "issue-ssh-host-user-cert",
   ISSUE_SSH_HOST_HOST_CERT = "issue-ssh-host-host-cert",
-  GET_SSH_HOST_GROUP = "get-ssh-host-group",
-  CREATE_SSH_HOST_GROUP = "create-ssh-host-group",
-  UPDATE_SSH_HOST_GROUP = "update-ssh-host-group",
-  DELETE_SSH_HOST_GROUP = "delete-ssh-host-group",
-  GET_SSH_HOST_GROUP_HOSTS = "get-ssh-host-group-hosts",
-  ADD_HOST_TO_SSH_HOST_GROUP = "add-host-to-ssh-host-group",
-  REMOVE_HOST_FROM_SSH_HOST_GROUP = "remove-host-from-ssh-host-group",
   CREATE_CA = "create-certificate-authority",
   GET_CA = "get-certificate-authority",
   UPDATE_CA = "update-certificate-authority",
@@ -224,8 +215,6 @@ export enum EventType {
   DELETE_CERT = "delete-cert",
   REVOKE_CERT = "revoke-cert",
   GET_CERT_BODY = "get-cert-body",
-  GET_CERT_PRIVATE_KEY = "get-cert-private-key",
-  GET_CERT_BUNDLE = "get-cert-bundle",
   CREATE_PKI_ALERT = "create-pki-alert",
   GET_PKI_ALERT = "get-pki-alert",
   UPDATE_PKI_ALERT = "update-pki-alert",
@@ -245,7 +234,6 @@ export enum EventType {
   GET_PROJECT_KMS_BACKUP = "get-project-kms-backup",
   LOAD_PROJECT_KMS_BACKUP = "load-project-kms-backup",
   ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project",
-  ORG_ADMIN_BYPASS_SSO = "org-admin-bypassed-sso",
   CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template",
   UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template",
   DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template",
@@ -255,16 +243,11 @@ export enum EventType {
   GET_CERTIFICATE_TEMPLATE_EST_CONFIG = "get-certificate-template-est-config",
   ATTEMPT_CREATE_SLACK_INTEGRATION = "attempt-create-slack-integration",
   ATTEMPT_REINSTALL_SLACK_INTEGRATION = "attempt-reinstall-slack-integration",
-  GET_PROJECT_SLACK_CONFIG = "get-project-slack-config",
-  UPDATE_PROJECT_SLACK_CONFIG = "update-project-slack-config",
   GET_SLACK_INTEGRATION = "get-slack-integration",
   UPDATE_SLACK_INTEGRATION = "update-slack-integration",
   DELETE_SLACK_INTEGRATION = "delete-slack-integration",
-  GET_PROJECT_WORKFLOW_INTEGRATION_CONFIG = "get-project-workflow-integration-config",
-  UPDATE_PROJECT_WORKFLOW_INTEGRATION_CONFIG = "update-project-workflow-integration-config",
-
-  GET_PROJECT_SSH_CONFIG = "get-project-ssh-config",
-  UPDATE_PROJECT_SSH_CONFIG = "update-project-ssh-config",
+  GET_PROJECT_SLACK_CONFIG = "get-project-slack-config",
+  UPDATE_PROJECT_SLACK_CONFIG = "update-project-slack-config",
   INTEGRATION_SYNCED = "integration-synced",
   CREATE_CMEK = "create-cmek",
   UPDATE_CMEK = "update-cmek",
@@ -334,18 +317,7 @@ export enum EventType {
   DELETE_SECRET_ROTATION = "delete-secret-rotation",
   SECRET_ROTATION_ROTATE_SECRETS = "secret-rotation-rotate-secrets",
 
-  PROJECT_ACCESS_REQUEST = "project-access-request",
-
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_CREATE = "microsoft-teams-workflow-integration-create",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_DELETE = "microsoft-teams-workflow-integration-delete",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_UPDATE = "microsoft-teams-workflow-integration-update",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_CHECK_INSTALLATION_STATUS = "microsoft-teams-workflow-integration-check-installation-status",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET_TEAMS = "microsoft-teams-workflow-integration-get-teams",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET = "microsoft-teams-workflow-integration-get",
-  MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST = "microsoft-teams-workflow-integration-list",
-
-  PROJECT_ASSUME_PRIVILEGE_SESSION_START = "project-assume-privileges-session-start",
-  PROJECT_ASSUME_PRIVILEGE_SESSION_END = "project-assume-privileges-session-end"
+  PROJECT_ACCESS_REQUEST = "project-access-request"
 }
 
 export const filterableSecretEvents: EventType[] = [
@@ -1519,10 +1491,14 @@ interface CreateSshHost {
   metadata: {
     sshHostId: string;
     hostname: string;
-    alias: string | null;
     userCertTtl: string;
     hostCertTtl: string;
-    loginMappings: TLoginMapping[];
+    loginMappings: {
+      loginUser: string;
+      allowedPrincipals: {
+        usernames: string[];
+      };
+    }[];
     userSshCaId: string;
     hostSshCaId: string;
   };
@@ -1533,10 +1509,14 @@ interface UpdateSshHost {
   metadata: {
     sshHostId: string;
     hostname?: string;
-    alias?: string | null;
     userCertTtl?: string;
     hostCertTtl?: string;
-    loginMappings?: TLoginMapping[];
+    loginMappings?: {
+      loginUser: string;
+      allowedPrincipals: {
+        usernames: string[];
+      };
+    }[];
     userSshCaId?: string;
     hostSshCaId?: string;
   };
@@ -1580,66 +1560,6 @@ interface IssueSshHostHostCert {
   };
 }
 
-interface GetSshHostGroupEvent {
-  type: EventType.GET_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    name: string;
-  };
-}
-
-interface CreateSshHostGroupEvent {
-  type: EventType.CREATE_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    name: string;
-    loginMappings: TLoginMapping[];
-  };
-}
-
-interface UpdateSshHostGroupEvent {
-  type: EventType.UPDATE_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    name?: string;
-    loginMappings?: TLoginMapping[];
-  };
-}
-
-interface DeleteSshHostGroupEvent {
-  type: EventType.DELETE_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    name: string;
-  };
-}
-
-interface GetSshHostGroupHostsEvent {
-  type: EventType.GET_SSH_HOST_GROUP_HOSTS;
-  metadata: {
-    sshHostGroupId: string;
-    name: string;
-  };
-}
-
-interface AddHostToSshHostGroupEvent {
-  type: EventType.ADD_HOST_TO_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    sshHostId: string;
-    hostname: string;
-  };
-}
-
-interface RemoveHostFromSshHostGroupEvent {
-  type: EventType.REMOVE_HOST_FROM_SSH_HOST_GROUP;
-  metadata: {
-    sshHostGroupId: string;
-    sshHostId: string;
-    hostname: string;
-  };
-}
-
 interface CreateCa {
   type: EventType.CREATE_CA;
   metadata: {
@@ -1792,24 +1712,6 @@ interface GetCertBody {
   };
 }
 
-interface GetCertPrivateKey {
-  type: EventType.GET_CERT_PRIVATE_KEY;
-  metadata: {
-    certId: string;
-    cn: string;
-    serialNumber: string;
-  };
-}
-
-interface GetCertBundle {
-  type: EventType.GET_CERT_BUNDLE;
-  metadata: {
-    certId: string;
-    cn: string;
-    serialNumber: string;
-  };
-}
-
 interface CreatePkiAlert {
   type: EventType.CREATE_PKI_ALERT;
   metadata: {
@@ -2005,11 +1907,6 @@ interface OrgAdminAccessProjectEvent {
   }; // no metadata yet
 }
 
-interface OrgAdminBypassSSOEvent {
-  type: EventType.ORG_ADMIN_BYPASS_SSO;
-  metadata: Record<string, string>; // no metadata yet
-}
-
 interface CreateCertificateTemplateEstConfig {
   type: EventType.CREATE_CERTIFICATE_TEMPLATE_EST_CONFIG;
   metadata: {
@@ -2071,45 +1968,24 @@ interface GetSlackIntegration {
   };
 }
 
-interface UpdateProjectWorkflowIntegrationConfig {
-  type: EventType.UPDATE_PROJECT_WORKFLOW_INTEGRATION_CONFIG;
+interface UpdateProjectSlackConfig {
+  type: EventType.UPDATE_PROJECT_SLACK_CONFIG;
   metadata: {
     id: string;
-    integrationId: string;
-    integration: WorkflowIntegration;
+    slackIntegrationId: string;
     isAccessRequestNotificationEnabled: boolean;
-    accessRequestChannels?: string | { teamId: string; channelIds: string[] };
+    accessRequestChannels: string;
     isSecretRequestNotificationEnabled: boolean;
-    secretRequestChannels?: string | { teamId: string; channelIds: string[] };
+    secretRequestChannels: string;
   };
 }
 
-interface GetProjectWorkflowIntegrationConfig {
-  type: EventType.GET_PROJECT_WORKFLOW_INTEGRATION_CONFIG;
+interface GetProjectSlackConfig {
+  type: EventType.GET_PROJECT_SLACK_CONFIG;
   metadata: {
     id: string;
-    integration: WorkflowIntegration;
   };
 }
-
-interface GetProjectSshConfig {
-  type: EventType.GET_PROJECT_SSH_CONFIG;
-  metadata: {
-    id: string;
-    projectId: string;
-  };
-}
-
-interface UpdateProjectSshConfig {
-  type: EventType.UPDATE_PROJECT_SSH_CONFIG;
-  metadata: {
-    id: string;
-    projectId: string;
-    defaultUserSshCaId?: string | null;
-    defaultHostSshCaId?: string | null;
-  };
-}
-
 interface IntegrationSyncedEvent {
   type: EventType.INTEGRATION_SYNCED;
   metadata: {
@@ -2549,29 +2425,6 @@ interface ProjectAccessRequestEvent {
   };
 }
 
-interface ProjectAssumePrivilegesEvent {
-  type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_START;
-  metadata: {
-    projectId: string;
-    requesterId: string;
-    requesterEmail: string;
-    targetActorType: ActorType;
-    targetActorId: string;
-    duration: string;
-  };
-}
-
-interface ProjectAssumePrivilegesExitEvent {
-  type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_END;
-  metadata: {
-    projectId: string;
-    requesterId: string;
-    requesterEmail: string;
-    targetActorType: ActorType;
-    targetActorId: string;
-  };
-}
-
 interface SetupKmipEvent {
   type: EventType.SETUP_KMIP;
   metadata: {
@@ -2654,66 +2507,6 @@ interface RotateSecretRotationEvent {
   };
 }
 
-interface MicrosoftTeamsWorkflowIntegrationCreateEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_CREATE;
-  metadata: {
-    tenantId: string;
-    slug: string;
-    description?: string;
-  };
-}
-
-interface MicrosoftTeamsWorkflowIntegrationDeleteEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_DELETE;
-  metadata: {
-    tenantId: string;
-    id: string;
-    slug: string;
-  };
-}
-
-interface MicrosoftTeamsWorkflowIntegrationCheckInstallationStatusEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_CHECK_INSTALLATION_STATUS;
-  metadata: {
-    tenantId: string;
-    slug: string;
-  };
-}
-
-interface MicrosoftTeamsWorkflowIntegrationGetTeamsEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET_TEAMS;
-  metadata: {
-    tenantId: string;
-    slug: string;
-    id: string;
-  };
-}
-
-interface MicrosoftTeamsWorkflowIntegrationGetEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET;
-  metadata: {
-    tenantId: string;
-    slug: string;
-    id: string;
-  };
-}
-
-interface MicrosoftTeamsWorkflowIntegrationListEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST;
-  metadata: Record<string, string>;
-}
-
-interface MicrosoftTeamsWorkflowIntegrationUpdateEvent {
-  type: EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_UPDATE;
-  metadata: {
-    tenantId: string;
-    slug: string;
-    id: string;
-    newSlug?: string;
-    newDescription?: string;
-  };
-}
-
 export type Event =
   | GetSecretsEvent
   | GetSecretEvent
@@ -2844,8 +2637,6 @@ export type Event =
   | DeleteCert
   | RevokeCert
   | GetCertBody
-  | GetCertPrivateKey
-  | GetCertBundle
   | CreatePkiAlert
   | GetPkiAlert
   | UpdatePkiAlert
@@ -2865,7 +2656,6 @@ export type Event =
   | GetProjectKmsBackupEvent
   | LoadProjectKmsBackupEvent
   | OrgAdminAccessProjectEvent
-  | OrgAdminBypassSSOEvent
   | CreateCertificateTemplate
   | UpdateCertificateTemplate
   | GetCertificateTemplate
@@ -2878,10 +2668,8 @@ export type Event =
   | UpdateSlackIntegration
   | DeleteSlackIntegration
   | GetSlackIntegration
-  | UpdateProjectWorkflowIntegrationConfig
-  | GetProjectWorkflowIntegrationConfig
-  | GetProjectSshConfig
-  | UpdateProjectSshConfig
+  | UpdateProjectSlackConfig
+  | GetProjectSlackConfig
   | IntegrationSyncedEvent
   | CreateCmekEvent
   | UpdateCmekEvent
@@ -2908,13 +2696,6 @@ export type Event =
   | CreateAppConnectionEvent
   | UpdateAppConnectionEvent
   | DeleteAppConnectionEvent
-  | GetSshHostGroupEvent
-  | CreateSshHostGroupEvent
-  | UpdateSshHostGroupEvent
-  | DeleteSshHostGroupEvent
-  | GetSshHostGroupHostsEvent
-  | AddHostToSshHostGroupEvent
-  | RemoveHostFromSshHostGroupEvent
   | CreateSharedSecretEvent
   | DeleteSharedSecretEvent
   | ReadSharedSecretEvent
@@ -2946,8 +2727,6 @@ export type Event =
   | KmipOperationLocateEvent
   | KmipOperationRegisterEvent
   | ProjectAccessRequestEvent
-  | ProjectAssumePrivilegesEvent
-  | ProjectAssumePrivilegesExitEvent
   | CreateSecretRequestEvent
   | SecretApprovalRequestReview
   | GetSecretRotationsEvent
@@ -2956,11 +2735,4 @@ export type Event =
   | CreateSecretRotationEvent
   | UpdateSecretRotationEvent
   | DeleteSecretRotationEvent
-  | RotateSecretRotationEvent
-  | MicrosoftTeamsWorkflowIntegrationCreateEvent
-  | MicrosoftTeamsWorkflowIntegrationDeleteEvent
-  | MicrosoftTeamsWorkflowIntegrationCheckInstallationStatusEvent
-  | MicrosoftTeamsWorkflowIntegrationGetTeamsEvent
-  | MicrosoftTeamsWorkflowIntegrationGetEvent
-  | MicrosoftTeamsWorkflowIntegrationListEvent
-  | MicrosoftTeamsWorkflowIntegrationUpdateEvent;
+  | RotateSecretRotationEvent;

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -130,17 +130,7 @@ export const dynamicSecretLeaseServiceFactory = ({
       if (expireAt > maxExpiryDate) throw new BadRequestError({ message: "TTL cannot be larger than max TTL" });
     }
 
-    let result;
-    try {
-      result = await selectedProvider.create(decryptedStoredInput, expireAt.getTime());
-    } catch (error: unknown) {
-      if (error && typeof error === "object" && error !== null && "sqlMessage" in error) {
-        throw new BadRequestError({ message: error.sqlMessage as string });
-      }
-      throw error;
-    }
-    const { entityId, data } = result;
-
+    const { entityId, data } = await selectedProvider.create(decryptedStoredInput, expireAt.getTime());
     const dynamicSecretLease = await dynamicSecretLeaseDAL.create({
       expireAt,
       version: 1,

backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts

@@ -24,16 +24,8 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) =
       if (net.isIPv4(el)) {
         exclusiveIps.push(el);
       } else {
-        try {
-          const resolvedIps = await dns.resolve4(el);
-          exclusiveIps.push(...resolvedIps);
-        } catch (error) {
-          // only try lookup if not found
-          if ((error as { code: string })?.code !== "ENOTFOUND") throw error;
-
-          const resolvedIps = (await dns.lookup(el, { all: true, family: 4 })).map(({ address }) => address);
-          exclusiveIps.push(...resolvedIps);
-        }
+        const resolvedIps = await dns.resolve4(el);
+        exclusiveIps.push(...resolvedIps);
       }
     }
   }
@@ -46,16 +38,8 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) =
     if (normalizedHost === "localhost" || normalizedHost === "host.docker.internal") {
       throw new BadRequestError({ message: "Invalid db host" });
     }
-    try {
-      const resolvedIps = await dns.resolve4(host);
-      inputHostIps.push(...resolvedIps);
-    } catch (error) {
-      // only try lookup if not found
-      if ((error as { code: string })?.code !== "ENOTFOUND") throw error;
-
-      const resolvedIps = (await dns.lookup(host, { all: true, family: 4 })).map(({ address }) => address);
-      inputHostIps.push(...resolvedIps);
-    }
+    const resolvedIps = await dns.resolve4(host);
+    inputHostIps.push(...resolvedIps);
   }
 
   if (!isGateway && !(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) {

backend/src/ee/services/external-kms/external-kms-service.ts

@@ -83,26 +83,18 @@ export const externalKmsServiceFactory = ({
             throw error;
           });
 
-          try {
-            // if missing kms key this generate a new kms key id and returns new provider input
-            const newProviderInput = await externalKms.generateInputKmsKey();
-            sanitizedProviderInput = JSON.stringify(newProviderInput);
+          // if missing kms key this generate a new kms key id and returns new provider input
+          const newProviderInput = await externalKms.generateInputKmsKey();
+          sanitizedProviderInput = JSON.stringify(newProviderInput);
 
-            await externalKms.validateConnection();
-          } finally {
-            await externalKms.cleanup();
-          }
+          await externalKms.validateConnection();
         }
         break;
       case KmsProviders.Gcp:
         {
           const externalKms = await GcpKmsProviderFactory({ inputs: provider.inputs });
-          try {
-            await externalKms.validateConnection();
-            sanitizedProviderInput = JSON.stringify(provider.inputs);
-          } finally {
-            await externalKms.cleanup();
-          }
+          await externalKms.validateConnection();
+          sanitizedProviderInput = JSON.stringify(provider.inputs);
         }
         break;
       default:
@@ -194,12 +186,8 @@ export const externalKmsServiceFactory = ({
             );
             const updatedProviderInput = { ...decryptedProviderInput, ...provider.inputs };
             const externalKms = await AwsKmsProviderFactory({ inputs: updatedProviderInput });
-            try {
-              await externalKms.validateConnection();
-              sanitizedProviderInput = JSON.stringify(updatedProviderInput);
-            } finally {
-              await externalKms.cleanup();
-            }
+            await externalKms.validateConnection();
+            sanitizedProviderInput = JSON.stringify(updatedProviderInput);
           }
           break;
         case KmsProviders.Gcp:
@@ -209,12 +197,8 @@ export const externalKmsServiceFactory = ({
             );
             const updatedProviderInput = { ...decryptedProviderInput, ...provider.inputs };
             const externalKms = await GcpKmsProviderFactory({ inputs: updatedProviderInput });
-            try {
-              await externalKms.validateConnection();
-              sanitizedProviderInput = JSON.stringify(updatedProviderInput);
-            } finally {
-              await externalKms.cleanup();
-            }
+            await externalKms.validateConnection();
+            sanitizedProviderInput = JSON.stringify(updatedProviderInput);
           }
           break;
         default:
@@ -384,11 +368,7 @@ export const externalKmsServiceFactory = ({
 
   const fetchGcpKeys = async ({ credential, gcpRegion }: Pick<TExternalKmsGcpSchema, "credential" | "gcpRegion">) => {
     const externalKms = await GcpKmsProviderFactory({ inputs: { credential, gcpRegion, keyName: "" } });
-    try {
-      return await externalKms.getKeysList();
-    } finally {
-      await externalKms.cleanup();
-    }
+    return externalKms.getKeysList();
   };
 
   return {

backend/src/ee/services/external-kms/providers/aws-kms.ts

@@ -102,19 +102,10 @@ export const AwsKmsProviderFactory = async ({ inputs }: AwsKmsProviderArgs): Pro
     return { data: Buffer.from(decryptionCommand.Plaintext) };
   };
 
-  const cleanup = async () => {
-    try {
-      awsClient.destroy();
-    } catch (error) {
-      throw new Error("Failed to cleanup AWS KMS client", { cause: error });
-    }
-  };
-
   return {
     generateInputKmsKey,
     validateConnection,
     encrypt,
-    decrypt,
-    cleanup
+    decrypt
   };
 };

backend/src/ee/services/external-kms/providers/gcp-kms.ts

@@ -45,14 +45,6 @@ export const GcpKmsProviderFactory = async ({ inputs }: GcpKmsProviderArgs): Pro
     }
   };
 
-  const cleanup = async () => {
-    try {
-      await gcpKmsClient.close();
-    } catch (error) {
-      throw new Error("Failed to cleanup GCP KMS client", { cause: error });
-    }
-  };
-
   // Used when adding the KMS to fetch the list of keys in specified region
   const getKeysList = async () => {
     try {
@@ -116,7 +108,6 @@ export const GcpKmsProviderFactory = async ({ inputs }: GcpKmsProviderArgs): Pro
     validateConnection,
     getKeysList,
     encrypt,
-    decrypt,
-    cleanup
+    decrypt
   };
 };

backend/src/ee/services/external-kms/providers/model.ts

@@ -98,5 +98,4 @@ export type TExternalKmsProviderFns = {
   validateConnection: () => Promise<boolean>;
   encrypt: (data: Buffer) => Promise<{ encryptedBlob: Buffer }>;
   decrypt: (encryptedBlob: Buffer) => Promise<{ data: Buffer }>;
-  cleanup: () => Promise<void>;
 };

backend/src/ee/services/github-org-sync/github-org-sync-dal.ts

@@ -1,10 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TGithubOrgSyncDALFactory = ReturnType<typeof githubOrgSyncDALFactory>;
-
-export const githubOrgSyncDALFactory = (db: TDbClient) => {
-  const orm = ormify(db, TableName.GithubOrgSyncConfig);
-  return orm;
-};

backend/src/ee/services/github-org-sync/github-org-sync-service.ts

@@ -1,354 +0,0 @@
-import { ForbiddenError } from "@casl/ability";
-import { Octokit } from "@octokit/core";
-import { paginateGraphQL } from "@octokit/plugin-paginate-graphql";
-import { Octokit as OctokitRest } from "@octokit/rest";
-
-import { OrgMembershipRole } from "@app/db/schemas";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
-import { groupBy } from "@app/lib/fn";
-import { logger } from "@app/lib/logger";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { TGroupDALFactory } from "../group/group-dal";
-import { TUserGroupMembershipDALFactory } from "../group/user-group-membership-dal";
-import { TLicenseServiceFactory } from "../license/license-service";
-import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPermissionServiceFactory } from "../permission/permission-service";
-import { TGithubOrgSyncDALFactory } from "./github-org-sync-dal";
-import { TCreateGithubOrgSyncDTO, TDeleteGithubOrgSyncDTO, TUpdateGithubOrgSyncDTO } from "./github-org-sync-types";
-
-const OctokitWithPlugin = Octokit.plugin(paginateGraphQL);
-
-type TGithubOrgSyncServiceFactoryDep = {
-  githubOrgSyncDAL: TGithubOrgSyncDALFactory;
-  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  userGroupMembershipDAL: Pick<
-    TUserGroupMembershipDALFactory,
-    "findGroupMembershipsByUserIdInOrg" | "insertMany" | "delete"
-  >;
-  groupDAL: Pick<TGroupDALFactory, "insertMany" | "transaction" | "find">;
-  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-};
-
-export type TGithubOrgSyncServiceFactory = ReturnType<typeof githubOrgSyncServiceFactory>;
-
-export const githubOrgSyncServiceFactory = ({
-  githubOrgSyncDAL,
-  permissionService,
-  kmsService,
-  userGroupMembershipDAL,
-  groupDAL,
-  licenseService
-}: TGithubOrgSyncServiceFactoryDep) => {
-  const createGithubOrgSync = async ({
-    githubOrgName,
-    orgPermission,
-    githubOrgAccessToken,
-    isActive
-  }: TCreateGithubOrgSyncDTO) => {
-    const { permission } = await permissionService.getOrgPermission(
-      orgPermission.type,
-      orgPermission.id,
-      orgPermission.orgId,
-      orgPermission.authMethod,
-      orgPermission.orgId
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.GithubOrgSync);
-    const plan = await licenseService.getPlan(orgPermission.orgId);
-    if (!plan.githubOrgSync) {
-      throw new BadRequestError({
-        message:
-          "Failed to create github organization team sync due to plan restriction. Upgrade plan to create github organization sync."
-      });
-    }
-
-    const existingConfig = await githubOrgSyncDAL.findOne({ orgId: orgPermission.orgId });
-    if (existingConfig)
-      throw new BadRequestError({
-        message: `Organization ${orgPermission.orgId} already has GitHub Organization sync config.`
-      });
-
-    const octokit = new OctokitRest({
-      auth: githubOrgAccessToken,
-      request: {
-        signal: AbortSignal.timeout(5000)
-      }
-    });
-    const { data } = await octokit.rest.orgs.get({
-      org: githubOrgName
-    });
-    if (data.login.toLowerCase() !== githubOrgName.toLowerCase())
-      throw new BadRequestError({ message: "Invalid GitHub organisation" });
-
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: orgPermission.orgId
-    });
-
-    const config = await githubOrgSyncDAL.create({
-      orgId: orgPermission.orgId,
-      githubOrgName,
-      isActive,
-      encryptedGithubOrgAccessToken: githubOrgAccessToken
-        ? encryptor({ plainText: Buffer.from(githubOrgAccessToken) }).cipherTextBlob
-        : null
-    });
-
-    return config;
-  };
-
-  const updateGithubOrgSync = async ({
-    githubOrgName,
-    orgPermission,
-    githubOrgAccessToken,
-    isActive
-  }: TUpdateGithubOrgSyncDTO) => {
-    const { permission } = await permissionService.getOrgPermission(
-      orgPermission.type,
-      orgPermission.id,
-      orgPermission.orgId,
-      orgPermission.authMethod,
-      orgPermission.orgId
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.GithubOrgSync);
-    const plan = await licenseService.getPlan(orgPermission.orgId);
-    if (!plan.githubOrgSync) {
-      throw new BadRequestError({
-        message:
-          "Failed to update github organization team sync due to plan restriction. Upgrade plan to update github organization sync."
-      });
-    }
-
-    const existingConfig = await githubOrgSyncDAL.findOne({ orgId: orgPermission.orgId });
-    if (!existingConfig)
-      throw new BadRequestError({
-        message: `Organization ${orgPermission.orgId} GitHub organization sync config missing.`
-      });
-
-    const { encryptor, decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: orgPermission.orgId
-    });
-    const newData = {
-      githubOrgName: githubOrgName || existingConfig.githubOrgName,
-      githubOrgAccessToken:
-        githubOrgAccessToken ||
-        (existingConfig.encryptedGithubOrgAccessToken
-          ? decryptor({ cipherTextBlob: existingConfig.encryptedGithubOrgAccessToken }).toString()
-          : null)
-    };
-
-    if (githubOrgName || githubOrgAccessToken) {
-      const octokit = new OctokitRest({
-        auth: newData.githubOrgAccessToken,
-        request: {
-          signal: AbortSignal.timeout(5000)
-        }
-      });
-      const { data } = await octokit.rest.orgs.get({
-        org: newData.githubOrgName
-      });
-
-      if (data.login.toLowerCase() !== newData.githubOrgName.toLowerCase())
-        throw new BadRequestError({ message: "Invalid GitHub organisation" });
-    }
-
-    const config = await githubOrgSyncDAL.updateById(existingConfig.id, {
-      orgId: orgPermission.orgId,
-      githubOrgName: newData.githubOrgName,
-      isActive,
-      encryptedGithubOrgAccessToken: newData.githubOrgAccessToken
-        ? encryptor({ plainText: Buffer.from(newData.githubOrgAccessToken) }).cipherTextBlob
-        : null
-    });
-
-    return config;
-  };
-
-  const deleteGithubOrgSync = async ({ orgPermission }: TDeleteGithubOrgSyncDTO) => {
-    const { permission } = await permissionService.getOrgPermission(
-      orgPermission.type,
-      orgPermission.id,
-      orgPermission.orgId,
-      orgPermission.authMethod,
-      orgPermission.orgId
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.GithubOrgSync);
-
-    const plan = await licenseService.getPlan(orgPermission.orgId);
-    if (!plan.githubOrgSync) {
-      throw new BadRequestError({
-        message:
-          "Failed to delete github organization team sync due to plan restriction. Upgrade plan to delete github organization sync."
-      });
-    }
-
-    const existingConfig = await githubOrgSyncDAL.findOne({ orgId: orgPermission.orgId });
-    if (!existingConfig)
-      throw new BadRequestError({
-        message: `Organization ${orgPermission.orgId} GitHub organization sync config missing.`
-      });
-
-    const config = await githubOrgSyncDAL.deleteById(existingConfig.id);
-
-    return config;
-  };
-
-  const getGithubOrgSync = async ({ orgPermission }: TDeleteGithubOrgSyncDTO) => {
-    const { permission } = await permissionService.getOrgPermission(
-      orgPermission.type,
-      orgPermission.id,
-      orgPermission.orgId,
-      orgPermission.authMethod,
-      orgPermission.orgId
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.GithubOrgSync);
-
-    const existingConfig = await githubOrgSyncDAL.findOne({ orgId: orgPermission.orgId });
-    if (!existingConfig)
-      throw new NotFoundError({
-        message: `Organization ${orgPermission.orgId} GitHub organization sync config missing.`
-      });
-
-    return existingConfig;
-  };
-
-  const syncUserGroups = async (orgId: string, userId: string, accessToken: string) => {
-    const config = await githubOrgSyncDAL.findOne({ orgId });
-    if (!config || !config?.isActive) return;
-
-    const infisicalUserGroups = await userGroupMembershipDAL.findGroupMembershipsByUserIdInOrg(userId, orgId);
-    const infisicalUserGroupSet = new Set(infisicalUserGroups.map((el) => el.groupName));
-
-    const octoRest = new OctokitRest({
-      auth: accessToken,
-      request: {
-        signal: AbortSignal.timeout(5000)
-      }
-    });
-    const { data: userOrgMembershipDetails } = await octoRest.rest.orgs
-      .getMembershipForAuthenticatedUser({
-        org: config.githubOrgName
-      })
-      .catch((err) => {
-        logger.error(err, "User not part of GitHub synced organization");
-        throw new BadRequestError({ message: "User not part of GitHub synced organization" });
-      });
-    const username = userOrgMembershipDetails?.user?.login;
-    if (!username) throw new BadRequestError({ message: "User not part of GitHub synced organization" });
-
-    const octokit = new OctokitWithPlugin({
-      auth: accessToken,
-      request: {
-        signal: AbortSignal.timeout(5000)
-      }
-    });
-    const data = await octokit.graphql
-      .paginate<{
-        organization: { teams: { totalCount: number; edges: { node: { name: string; description: string } }[] } };
-      }>(
-        `
-      query orgTeams($cursor: String,$org: String!, $username: String!){
-        organization(login: $org) {
-          teams(first: 100, userLogins: [$username], after: $cursor) {
-            totalCount
-            edges {
-              node {
-                name
-                description
-              }
-            }
-            pageInfo {
-              hasNextPage
-              endCursor
-            }
-          }
-        }
-      }
-      `,
-        {
-          org: config.githubOrgName,
-          username
-        }
-      )
-      .catch((err) => {
-        if ((err as Error)?.message?.includes("Although you appear to have the correct authorization credential")) {
-          throw new BadRequestError({
-            message:
-              "Please check your organization have approved Infisical Oauth application. For more info: https://infisical.com/docs/documentation/platform/github-org-sync#troubleshooting"
-          });
-        }
-        throw new BadRequestError({ message: (err as Error)?.message });
-      });
-
-    const {
-      organization: { teams }
-    } = data;
-    const githubUserTeams = teams?.edges?.map((el) => el.node.name.toLowerCase()) || [];
-    const githubUserTeamSet = new Set(githubUserTeams);
-    const githubUserTeamOnInfisical = await groupDAL.find({ orgId, $in: { name: githubUserTeams } });
-    const githubUserTeamOnInfisicalGroupByName = groupBy(githubUserTeamOnInfisical, (i) => i.name);
-
-    const newTeams = githubUserTeams.filter(
-      (el) => !infisicalUserGroupSet.has(el) && !Object.hasOwn(githubUserTeamOnInfisicalGroupByName, el)
-    );
-    const updateTeams = githubUserTeams.filter(
-      (el) => !infisicalUserGroupSet.has(el) && Object.hasOwn(githubUserTeamOnInfisicalGroupByName, el)
-    );
-    const removeFromTeams = infisicalUserGroups.filter((el) => !githubUserTeamSet.has(el.groupName));
-
-    if (newTeams.length || updateTeams.length || removeFromTeams.length) {
-      await groupDAL.transaction(async (tx) => {
-        if (newTeams.length) {
-          const newGroups = await groupDAL.insertMany(
-            newTeams.map((newGroupName) => ({
-              name: newGroupName,
-              role: OrgMembershipRole.Member,
-              slug: newGroupName,
-              orgId
-            })),
-            tx
-          );
-          await userGroupMembershipDAL.insertMany(
-            newGroups.map((el) => ({
-              groupId: el.id,
-              userId
-            })),
-            tx
-          );
-        }
-
-        if (updateTeams.length) {
-          await userGroupMembershipDAL.insertMany(
-            updateTeams.map((el) => ({
-              groupId: githubUserTeamOnInfisicalGroupByName[el][0].id,
-              userId
-            })),
-            tx
-          );
-        }
-
-        if (removeFromTeams.length) {
-          await userGroupMembershipDAL.delete(
-            { userId, $in: { groupId: removeFromTeams.map((el) => el.groupId) } },
-            tx
-          );
-        }
-      });
-    }
-  };
-
-  return {
-    createGithubOrgSync,
-    updateGithubOrgSync,
-    deleteGithubOrgSync,
-    getGithubOrgSync,
-    syncUserGroups
-  };
-};

backend/src/ee/services/github-org-sync/github-org-sync-types.ts

@@ -1,23 +0,0 @@
-import { OrgServiceActor } from "@app/lib/types";
-
-export interface TCreateGithubOrgSyncDTO {
-  orgPermission: OrgServiceActor;
-  githubOrgName: string;
-  githubOrgAccessToken?: string;
-  isActive?: boolean;
-}
-
-export interface TUpdateGithubOrgSyncDTO {
-  orgPermission: OrgServiceActor;
-  githubOrgName?: string;
-  githubOrgAccessToken?: string;
-  isActive?: boolean;
-}
-
-export interface TDeleteGithubOrgSyncDTO {
-  orgPermission: OrgServiceActor;
-}
-
-export interface TGetGithubOrgSyncDTO {
-  orgPermission: OrgServiceActor;
-}

backend/src/ee/services/group/group-dal.ts

@@ -153,7 +153,7 @@ export const groupDALFactory = (db: TDbClient) => {
         totalCount: Number(members?.[0]?.total_count ?? 0)
       };
     } catch (error) {
-      throw new DatabaseError({ error, name: "Find all user group members" });
+      throw new DatabaseError({ error, name: "Find all org members" });
     }
   };
 

backend/src/ee/services/license/__mocks__/license-fns.ts

@@ -28,8 +28,7 @@ export const getDefaultOnPremFeatures = () => {
     has_used_trial: true,
     secretApproval: true,
     secretRotation: true,
-    caCrl: false,
-    sshHostGroups: false
+    caCrl: false
   };
 };
 

backend/src/ee/services/license/licence-enums.ts

@@ -10,7 +10,6 @@ export const BillingPlanRows = {
   CustomAlerts: { name: "Custom alerts", field: "customAlerts" },
   AuditLogs: { name: "Audit logs", field: "auditLogs" },
   SamlSSO: { name: "SAML SSO", field: "samlSSO" },
-  SshHostGroups: { name: "SSH Host Groups", field: "sshHostGroups" },
   Hsm: { name: "Hardware Security Module (HSM)", field: "hsm" },
   OidcSSO: { name: "OIDC SSO", field: "oidcSSO" },
   SecretApproval: { name: "Secret approvals", field: "secretApproval" },

backend/src/ee/services/license/license-fns.ts

@@ -22,7 +22,6 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   pitRecovery: false,
   ipAllowlisting: false,
   rbac: false,
-  githubOrgSync: false,
   customRateLimits: false,
   customAlerts: false,
   secretAccessInsights: false,
@@ -53,8 +52,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   enforceMfa: false,
   projectTemplates: false,
   kmip: false,
-  gateway: false,
-  sshHostGroups: false
+  gateway: false
 });
 
 export const setupLicenseRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => {

backend/src/ee/services/license/license-types.ts

@@ -45,7 +45,6 @@ export type TFeatureSet = {
   auditLogsRetentionDays: 0;
   auditLogStreams: false;
   auditLogStreamLimit: 3;
-  githubOrgSync: false;
   samlSSO: false;
   hsm: false;
   oidcSSO: false;
@@ -71,7 +70,6 @@ export type TFeatureSet = {
   projectTemplates: false;
   kmip: false;
   gateway: false;
-  sshHostGroups: false;
 };
 
 export type TOrgPlansTableDTO = {

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -685,16 +685,10 @@ export const oidcConfigServiceFactory = ({
       id_token_signed_response_alg: oidcCfg.jwtSignatureAlgorithm
     });
 
-    // Check if the OIDC provider supports PKCE
-    const codeChallengeMethods = client.issuer.metadata.code_challenge_methods_supported;
-    const supportsPKCE = Array.isArray(codeChallengeMethods) && codeChallengeMethods.includes("S256");
-
     const strategy = new OpenIdStrategy(
       {
         client,
-        passReqToCallback: true,
-        usePKCE: supportsPKCE,
-        params: supportsPKCE ? { code_challenge_method: "S256" } : undefined
+        passReqToCallback: true
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (_req: any, tokenSet: TokenSet, cb: any) => {

backend/src/ee/services/oidc/oidc-config-types.ts

@@ -8,8 +8,7 @@ export enum OIDCConfigurationType {
 export enum OIDCJWTSignatureAlgorithm {
   RS256 = "RS256",
   HS256 = "HS256",
-  RS512 = "RS512",
-  EDDSA = "EdDSA"
+  RS512 = "RS512"
 }
 
 export type TOidcLoginDTO = {

backend/src/ee/services/permission/org-permission.ts

@@ -74,7 +74,6 @@ export enum OrgPermissionSubjects {
   IncidentAccount = "incident-contact",
   Sso = "sso",
   Scim = "scim",
-  GithubOrgSync = "github-org-sync",
   Ldap = "ldap",
   Groups = "groups",
   Billing = "billing",
@@ -102,7 +101,6 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.IncidentAccount]
   | [OrgPermissionActions, OrgPermissionSubjects.Sso]
   | [OrgPermissionActions, OrgPermissionSubjects.Scim]
-  | [OrgPermissionActions, OrgPermissionSubjects.GithubOrgSync]
   | [OrgPermissionActions, OrgPermissionSubjects.Ldap]
   | [OrgPermissionGroupActions, OrgPermissionSubjects.Groups]
   | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
@@ -167,10 +165,6 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [
     subject: z.literal(OrgPermissionSubjects.Scim).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.")
   }),
-  z.object({
-    subject: z.literal(OrgPermissionSubjects.GithubOrgSync).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.")
-  }),
   z.object({
     subject: z.literal(OrgPermissionSubjects.Ldap).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.")
@@ -279,11 +273,6 @@ const buildAdminPermission = () => {
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Scim);
   can(OrgPermissionActions.Delete, OrgPermissionSubjects.Scim);
 
-  can(OrgPermissionActions.Read, OrgPermissionSubjects.GithubOrgSync);
-  can(OrgPermissionActions.Create, OrgPermissionSubjects.GithubOrgSync);
-  can(OrgPermissionActions.Edit, OrgPermissionSubjects.GithubOrgSync);
-  can(OrgPermissionActions.Delete, OrgPermissionSubjects.GithubOrgSync);
-
   can(OrgPermissionActions.Read, OrgPermissionSubjects.Ldap);
   can(OrgPermissionActions.Create, OrgPermissionSubjects.Ldap);
   can(OrgPermissionActions.Edit, OrgPermissionSubjects.Ldap);

backend/src/ee/services/permission/permission-service.ts

@@ -551,26 +551,13 @@ export const permissionServiceFactory = ({
   };
 
   const getProjectPermission = async <T extends ActorType>({
-    actor: inputActor,
-    actorId: inputActorId,
+    actor,
+    actorId,
     projectId,
     actorAuthMethod,
     actorOrgId,
     actionProjectType
   }: TGetProjectPermissionArg): Promise<TProjectPermissionRT<T>> => {
-    let actor = inputActor;
-    let actorId = inputActorId;
-    const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails");
-    if (
-      assumedPrivilegeDetailsCtx &&
-      actor === ActorType.USER &&
-      actorId === assumedPrivilegeDetailsCtx.requesterId &&
-      projectId === assumedPrivilegeDetailsCtx.projectId
-    ) {
-      actor = assumedPrivilegeDetailsCtx.actorType;
-      actorId = assumedPrivilegeDetailsCtx.actorId;
-    }
-
     switch (actor) {
       case ActorType.USER:
         return getUserProjectPermission({

backend/src/ee/services/permission/project-permission.ts

@@ -17,14 +17,6 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
-export enum ProjectPermissionCertificateActions {
-  Read = "read",
-  Create = "create",
-  Edit = "edit",
-  Delete = "delete",
-  ReadPrivateKey = "read-private-key"
-}
-
 export enum ProjectPermissionSecretActions {
   DescribeAndReadValue = "read",
   DescribeSecret = "describeSecret",
@@ -58,8 +50,7 @@ export enum ProjectPermissionIdentityActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  GrantPrivileges = "grant-privileges",
-  AssumePrivileges = "assume-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionMemberActions {
@@ -67,8 +58,7 @@ export enum ProjectPermissionMemberActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  GrantPrivileges = "grant-privileges",
-  AssumePrivileges = "assume-privileges"
+  GrantPrivileges = "grant-privileges"
 }
 
 export enum ProjectPermissionGroupActions {
@@ -142,7 +132,6 @@ export enum ProjectPermissionSub {
   SshCertificates = "ssh-certificates",
   SshCertificateTemplates = "ssh-certificate-templates",
   SshHosts = "ssh-hosts",
-  SshHostGroups = "ssh-host-groups",
   PkiAlerts = "pki-alerts",
   PkiCollections = "pki-collections",
   Kms = "kms",
@@ -240,7 +229,7 @@ export type ProjectPermissionSet =
       ProjectPermissionSub.Identity | (ForcedSubject<ProjectPermissionSub.Identity> & IdentityManagementSubjectFields)
     ]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
-  | [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
+  | [ProjectPermissionActions, ProjectPermissionSub.Certificates]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateAuthorities]
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificates]
@@ -249,7 +238,6 @@ export type ProjectPermissionSet =
       ProjectPermissionSshHostActions,
       ProjectPermissionSub.SshHosts | (ForcedSubject<ProjectPermissionSub.SshHosts> & SshHostSubjectFields)
     ]
-  | [ProjectPermissionActions, ProjectPermissionSub.SshHostGroups]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
   | [ProjectPermissionSecretSyncActions, ProjectPermissionSub.SecretSyncs]
@@ -486,7 +474,7 @@ const GeneralPermissionSchema = [
   }),
   z.object({
     subject: z.literal(ProjectPermissionSub.Certificates).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCertificateActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
       "Describe what action an entity can take."
     )
   }),
@@ -518,12 +506,6 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SshHostGroups).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
-      "Describe what action an entity can take."
-    )
-  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.PkiAlerts).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
@@ -696,13 +678,13 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.AuditLogs,
     ProjectPermissionSub.IpAllowList,
     ProjectPermissionSub.CertificateAuthorities,
+    ProjectPermissionSub.Certificates,
     ProjectPermissionSub.CertificateTemplates,
     ProjectPermissionSub.PkiAlerts,
     ProjectPermissionSub.PkiCollections,
     ProjectPermissionSub.SshCertificateAuthorities,
     ProjectPermissionSub.SshCertificates,
-    ProjectPermissionSub.SshCertificateTemplates,
-    ProjectPermissionSub.SshHostGroups
+    ProjectPermissionSub.SshCertificateTemplates
   ].forEach((el) => {
     can(
       [
@@ -715,17 +697,6 @@ const buildAdminPermissionRules = () => {
     );
   });
 
-  can(
-    [
-      ProjectPermissionCertificateActions.Read,
-      ProjectPermissionCertificateActions.Edit,
-      ProjectPermissionCertificateActions.Create,
-      ProjectPermissionCertificateActions.Delete,
-      ProjectPermissionCertificateActions.ReadPrivateKey
-    ],
-    ProjectPermissionSub.Certificates
-  );
-
   can(
     [
       ProjectPermissionSshHostActions.Edit,
@@ -743,8 +714,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionMemberActions.Edit,
       ProjectPermissionMemberActions.Delete,
       ProjectPermissionMemberActions.Read,
-      ProjectPermissionMemberActions.GrantPrivileges,
-      ProjectPermissionMemberActions.AssumePrivileges
+      ProjectPermissionMemberActions.GrantPrivileges
     ],
     ProjectPermissionSub.Member
   );
@@ -766,8 +736,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionIdentityActions.Edit,
       ProjectPermissionIdentityActions.Delete,
       ProjectPermissionIdentityActions.Read,
-      ProjectPermissionIdentityActions.GrantPrivileges,
-      ProjectPermissionIdentityActions.AssumePrivileges
+      ProjectPermissionIdentityActions.GrantPrivileges
     ],
     ProjectPermissionSub.Identity
   );
@@ -983,10 +952,10 @@ const buildMemberPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionCertificateActions.Read,
-      ProjectPermissionCertificateActions.Edit,
-      ProjectPermissionCertificateActions.Create,
-      ProjectPermissionCertificateActions.Delete
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
     ],
     ProjectPermissionSub.Certificates
   );
@@ -996,6 +965,7 @@ const buildMemberPermissionRules = () => {
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiAlerts);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiCollections);
 
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.SshCertificateAuthorities);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SshCertificates);
   can([ProjectPermissionActions.Create], ProjectPermissionSub.SshCertificates);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SshCertificateTemplates);
@@ -1059,8 +1029,9 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
-  can(ProjectPermissionCertificateActions.Read, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
   can(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateAuthorities);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateTemplates);
   can(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs);

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -17,13 +17,9 @@ import { groupBy, pick, unique } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { EnforcementLevel } from "@app/lib/types";
-import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
-import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
-import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
-import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
@@ -56,6 +52,8 @@ import {
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
 import { TProjectSlackConfigDALFactory } from "@app/services/slack/project-slack-config-dal";
+import { triggerSlackNotification } from "@app/services/slack/slack-fns";
+import { SlackTriggerFeature } from "@app/services/slack/slack-types";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
@@ -128,8 +126,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   secretApprovalPolicyDAL: Pick<TSecretApprovalPolicyDALFactory, "findById">;
   projectSlackConfigDAL: Pick<TProjectSlackConfigDALFactory, "getIntegrationDetailsByProject">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-  projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
-  microsoftTeamsService: Pick<TMicrosoftTeamsServiceFactory, "sendNotification">;
 };
 
 export type TSecretApprovalRequestServiceFactory = ReturnType<typeof secretApprovalRequestServiceFactory>;
@@ -159,9 +155,7 @@ export const secretApprovalRequestServiceFactory = ({
   secretVersionTagV2BridgeDAL,
   licenseService,
   projectSlackConfigDAL,
-  resourceMetadataDAL,
-  projectMicrosoftTeamsConfigDAL,
-  microsoftTeamsService
+  resourceMetadataDAL
 }: TSecretApprovalRequestServiceFactoryDep) => {
   const requestCount = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TApprovalRequestCountDTO) => {
     if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" });
@@ -1177,28 +1171,21 @@ export const secretApprovalRequestServiceFactory = ({
 
     const env = await projectEnvDAL.findOne({ id: policy.envId });
     const user = await userDAL.findById(secretApprovalRequest.committerUserId);
-
-    await triggerWorkflowIntegrationNotification({
-      input: {
-        projectId,
-        notification: {
-          type: TriggerFeature.SECRET_APPROVAL,
-          payload: {
-            userEmail: user.email as string,
-            environment: env.name,
-            secretPath,
-            projectId,
-            requestId: secretApprovalRequest.id,
-            secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretName) ?? []))]
-          }
+    await triggerSlackNotification({
+      projectId,
+      projectDAL,
+      kmsService,
+      projectSlackConfigDAL,
+      notification: {
+        type: SlackTriggerFeature.SECRET_APPROVAL,
+        payload: {
+          userEmail: user.email as string,
+          environment: env.name,
+          secretPath,
+          projectId,
+          requestId: secretApprovalRequest.id,
+          secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretName) ?? []))]
         }
-      },
-      dependencies: {
-        projectDAL,
-        projectSlackConfigDAL,
-        kmsService,
-        projectMicrosoftTeamsConfigDAL,
-        microsoftTeamsService
       }
     });
 
@@ -1516,28 +1503,21 @@ export const secretApprovalRequestServiceFactory = ({
 
     const user = await userDAL.findById(secretApprovalRequest.committerUserId);
     const env = await projectEnvDAL.findOne({ id: policy.envId });
-
-    await triggerWorkflowIntegrationNotification({
-      input: {
-        projectId,
-        notification: {
-          type: TriggerFeature.SECRET_APPROVAL,
-          payload: {
-            userEmail: user.email as string,
-            environment: env.name,
-            secretPath,
-            projectId,
-            requestId: secretApprovalRequest.id,
-            secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretKey) ?? []))]
-          }
+    await triggerSlackNotification({
+      projectId,
+      projectDAL,
+      kmsService,
+      projectSlackConfigDAL,
+      notification: {
+        type: SlackTriggerFeature.SECRET_APPROVAL,
+        payload: {
+          userEmail: user.email as string,
+          environment: env.name,
+          secretPath,
+          projectId,
+          requestId: secretApprovalRequest.id,
+          secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretKey) ?? []))]
         }
-      },
-      dependencies: {
-        projectDAL,
-        kmsService,
-        projectSlackConfigDAL,
-        microsoftTeamsService,
-        projectMicrosoftTeamsConfigDAL
       }
     });
 

backend/src/ee/services/secret-approval-request/secret-approval-request-types.ts

@@ -33,7 +33,6 @@ export type TApprovalCreateSecretV2Bridge = {
   secretComment?: string;
   reminderNote?: string | null;
   reminderRepeatDays?: number | null;
-  secretReminderRecipients?: string[] | null;
   skipMultilineEncoding?: boolean;
   metadata?: Record<string, string>;
   secretMetadata?: ResourceMetadataDTO;

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -267,6 +267,7 @@ export const secretReplicationServiceFactory = ({
       const sourceLocalSecrets = await secretV2BridgeDAL.find({ folderId: folder.id, type: SecretType.Shared });
       const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id });
       const sourceImportedSecrets = await fnSecretsV2FromImports({
+        projectId,
         secretImports: sourceSecretImports,
         secretDAL: secretV2BridgeDAL,
         folderDAL,

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-constants.ts

@@ -1,15 +0,0 @@
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import { TSecretRotationV2ListItem } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION: TSecretRotationV2ListItem = {
-  name: "AWS IAM User Secret",
-  type: SecretRotation.AwsIamUserSecret,
-  connection: AppConnection.AWS,
-  template: {
-    secretsMapping: {
-      accessKeyId: "AWS_ACCESS_KEY_ID",
-      secretAccessKey: "AWS_SECRET_ACCESS_KEY"
-    }
-  }
-};

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts

@@ -1,123 +0,0 @@
-import AWS from "aws-sdk";
-
-import {
-  TAwsIamUserSecretRotationGeneratedCredentials,
-  TAwsIamUserSecretRotationWithConnection
-} from "@app/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-types";
-import {
-  TRotationFactory,
-  TRotationFactoryGetSecretsPayload,
-  TRotationFactoryIssueCredentials,
-  TRotationFactoryRevokeCredentials,
-  TRotationFactoryRotateCredentials
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { getAwsConnectionConfig } from "@app/services/app-connection/aws";
-
-const getCreateDate = (key: AWS.IAM.AccessKeyMetadata): number => {
-  return key.CreateDate ? new Date(key.CreateDate).getTime() : 0;
-};
-
-export const awsIamUserSecretRotationFactory: TRotationFactory<
-  TAwsIamUserSecretRotationWithConnection,
-  TAwsIamUserSecretRotationGeneratedCredentials
-> = (secretRotation) => {
-  const {
-    parameters: { region, userName },
-    connection,
-    secretsMapping
-  } = secretRotation;
-
-  const $rotateClientSecret = async () => {
-    const { credentials } = await getAwsConnectionConfig(connection, region);
-    const iam = new AWS.IAM({ credentials });
-
-    const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: userName }).promise();
-
-    if (AccessKeyMetadata && AccessKeyMetadata.length > 0) {
-      // Sort keys by creation date (oldest first)
-      const sortedKeys = [...AccessKeyMetadata].sort((a, b) => getCreateDate(a) - getCreateDate(b));
-
-      // If we already have 2 keys, delete the oldest one
-      if (sortedKeys.length >= 2) {
-        const accessId = sortedKeys[0].AccessKeyId || sortedKeys[1].AccessKeyId;
-        if (accessId) {
-          await iam
-            .deleteAccessKey({
-              UserName: userName,
-              AccessKeyId: accessId
-            })
-            .promise();
-        }
-      }
-    }
-
-    const { AccessKey } = await iam.createAccessKey({ UserName: userName }).promise();
-
-    return {
-      accessKeyId: AccessKey.AccessKeyId,
-      secretAccessKey: AccessKey.SecretAccessKey
-    };
-  };
-
-  const issueCredentials: TRotationFactoryIssueCredentials<TAwsIamUserSecretRotationGeneratedCredentials> = async (
-    callback
-  ) => {
-    const credentials = await $rotateClientSecret();
-
-    return callback(credentials);
-  };
-
-  const revokeCredentials: TRotationFactoryRevokeCredentials<TAwsIamUserSecretRotationGeneratedCredentials> = async (
-    generatedCredentials,
-    callback
-  ) => {
-    const { credentials } = await getAwsConnectionConfig(connection, region);
-    const iam = new AWS.IAM({ credentials });
-
-    await Promise.all(
-      generatedCredentials.map((generatedCredential) =>
-        iam
-          .deleteAccessKey({
-            UserName: userName,
-            AccessKeyId: generatedCredential.accessKeyId
-          })
-          .promise()
-      )
-    );
-
-    return callback();
-  };
-
-  const rotateCredentials: TRotationFactoryRotateCredentials<TAwsIamUserSecretRotationGeneratedCredentials> = async (
-    _,
-    callback
-  ) => {
-    const credentials = await $rotateClientSecret();
-
-    return callback(credentials);
-  };
-
-  const getSecretsPayload: TRotationFactoryGetSecretsPayload<TAwsIamUserSecretRotationGeneratedCredentials> = (
-    generatedCredentials
-  ) => {
-    const secrets = [
-      {
-        key: secretsMapping.accessKeyId,
-        value: generatedCredentials.accessKeyId
-      },
-      {
-        key: secretsMapping.secretAccessKey,
-        value: generatedCredentials.secretAccessKey
-      }
-    ];
-
-    return secrets;
-  };
-
-  return {
-    issueCredentials,
-    revokeCredentials,
-    rotateCredentials,
-    getSecretsPayload
-  };
-};

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-schemas.ts

@@ -1,68 +0,0 @@
-import { z } from "zod";
-
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import {
-  BaseCreateSecretRotationSchema,
-  BaseSecretRotationSchema,
-  BaseUpdateSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-schemas";
-import { SecretRotations } from "@app/lib/api-docs";
-import { SecretNameSchema } from "@app/server/lib/schemas";
-import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
-
-export const AwsIamUserSecretRotationGeneratedCredentialsSchema = z
-  .object({
-    accessKeyId: z.string(),
-    secretAccessKey: z.string()
-  })
-  .array()
-  .min(1)
-  .max(2);
-
-const AwsIamUserSecretRotationParametersSchema = z.object({
-  userName: z
-    .string()
-    .trim()
-    .min(1, "Client Name Required")
-    .describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.userName),
-  region: z.nativeEnum(AWSRegion).describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.region).optional()
-});
-
-const AwsIamUserSecretRotationSecretsMappingSchema = z.object({
-  accessKeyId: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AWS_IAM_USER_SECRET.accessKeyId),
-  secretAccessKey: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AWS_IAM_USER_SECRET.secretAccessKey)
-});
-
-export const AwsIamUserSecretRotationTemplateSchema = z.object({
-  secretsMapping: z.object({
-    accessKeyId: z.string(),
-    secretAccessKey: z.string()
-  })
-});
-
-export const AwsIamUserSecretRotationSchema = BaseSecretRotationSchema(SecretRotation.AwsIamUserSecret).extend({
-  type: z.literal(SecretRotation.AwsIamUserSecret),
-  parameters: AwsIamUserSecretRotationParametersSchema,
-  secretsMapping: AwsIamUserSecretRotationSecretsMappingSchema
-});
-
-export const CreateAwsIamUserSecretRotationSchema = BaseCreateSecretRotationSchema(
-  SecretRotation.AwsIamUserSecret
-).extend({
-  parameters: AwsIamUserSecretRotationParametersSchema,
-  secretsMapping: AwsIamUserSecretRotationSecretsMappingSchema
-});
-
-export const UpdateAwsIamUserSecretRotationSchema = BaseUpdateSecretRotationSchema(
-  SecretRotation.AwsIamUserSecret
-).extend({
-  parameters: AwsIamUserSecretRotationParametersSchema.optional(),
-  secretsMapping: AwsIamUserSecretRotationSecretsMappingSchema.optional()
-});
-
-export const AwsIamUserSecretRotationListItemSchema = z.object({
-  name: z.literal("AWS IAM User Secret"),
-  connection: z.literal(AppConnection.AWS),
-  type: z.literal(SecretRotation.AwsIamUserSecret),
-  template: AwsIamUserSecretRotationTemplateSchema
-});

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-types.ts

@@ -1,24 +0,0 @@
-import { z } from "zod";
-
-import { TAwsConnection } from "@app/services/app-connection/aws";
-
-import {
-  AwsIamUserSecretRotationGeneratedCredentialsSchema,
-  AwsIamUserSecretRotationListItemSchema,
-  AwsIamUserSecretRotationSchema,
-  CreateAwsIamUserSecretRotationSchema
-} from "./aws-iam-user-secret-rotation-schemas";
-
-export type TAwsIamUserSecretRotation = z.infer<typeof AwsIamUserSecretRotationSchema>;
-
-export type TAwsIamUserSecretRotationInput = z.infer<typeof CreateAwsIamUserSecretRotationSchema>;
-
-export type TAwsIamUserSecretRotationListItem = z.infer<typeof AwsIamUserSecretRotationListItemSchema>;
-
-export type TAwsIamUserSecretRotationWithConnection = TAwsIamUserSecretRotation & {
-  connection: TAwsConnection;
-};
-
-export type TAwsIamUserSecretRotationGeneratedCredentials = z.infer<
-  typeof AwsIamUserSecretRotationGeneratedCredentialsSchema
->;

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/index.ts

@@ -1,3 +0,0 @@
-export * from "./aws-iam-user-secret-rotation-constants";
-export * from "./aws-iam-user-secret-rotation-schemas";
-export * from "./aws-iam-user-secret-rotation-types";

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-constants.ts

@@ -1,15 +0,0 @@
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import { TSecretRotationV2ListItem } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const AZURE_CLIENT_SECRET_ROTATION_LIST_OPTION: TSecretRotationV2ListItem = {
-  name: "Azure Client Secret",
-  type: SecretRotation.AzureClientSecret,
-  connection: AppConnection.AzureClientSecrets,
-  template: {
-    secretsMapping: {
-      clientId: "AZURE_CLIENT_ID",
-      clientSecret: "AZURE_CLIENT_SECRET"
-    }
-  }
-};

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts

@@ -1,202 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import { AxiosError } from "axios";
-
-import {
-  AzureAddPasswordResponse,
-  TAzureClientSecretRotationGeneratedCredentials,
-  TAzureClientSecretRotationWithConnection
-} from "@app/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-types";
-import {
-  TRotationFactory,
-  TRotationFactoryGetSecretsPayload,
-  TRotationFactoryIssueCredentials,
-  TRotationFactoryRevokeCredentials,
-  TRotationFactoryRotateCredentials
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
-import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-client-secrets";
-
-const GRAPH_API_BASE = "https://graph.microsoft.com/v1.0";
-
-type AzureErrorResponse = { error: { message: string } };
-
-const sleep = async () =>
-  new Promise((resolve) => {
-    setTimeout(resolve, 1000);
-  });
-
-export const azureClientSecretRotationFactory: TRotationFactory<
-  TAzureClientSecretRotationWithConnection,
-  TAzureClientSecretRotationGeneratedCredentials
-> = (secretRotation, appConnectionDAL, kmsService) => {
-  const {
-    connection,
-    parameters: { objectId, clientId: clientIdParam },
-    secretsMapping
-  } = secretRotation;
-
-  /**
-   * Creates a new client secret for the Azure app.
-   */
-  const $rotateClientSecret = async () => {
-    const accessToken = await getAzureConnectionAccessToken(connection.id, appConnectionDAL, kmsService);
-    const endpoint = `${GRAPH_API_BASE}/applications/${objectId}/addPassword`;
-
-    const now = new Date();
-    const formattedDate = `${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(
-      2,
-      "0"
-    )}-${now.getFullYear()}`;
-
-    const endDateTime = new Date();
-    endDateTime.setFullYear(now.getFullYear() + 5);
-
-    try {
-      const { data } = await request.post<AzureAddPasswordResponse>(
-        endpoint,
-        {
-          passwordCredential: {
-            displayName: `Infisical Rotated Secret (${formattedDate})`,
-            endDateTime: endDateTime.toISOString()
-          }
-        },
-        {
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json"
-          }
-        }
-      );
-
-      if (!data?.secretText || !data?.keyId) {
-        throw new Error("Invalid response from Azure: missing secretText or keyId.");
-      }
-
-      return {
-        clientSecret: data.secretText,
-        keyId: data.keyId,
-        clientId: clientIdParam
-      };
-    } catch (error: unknown) {
-      if (error instanceof AxiosError) {
-        let message;
-        if (
-          error.response?.data &&
-          typeof error.response.data === "object" &&
-          "error" in error.response.data &&
-          typeof (error.response.data as AzureErrorResponse).error.message === "string"
-        ) {
-          message = (error.response.data as AzureErrorResponse).error.message;
-        }
-        throw new BadRequestError({
-          message: `Failed to add client secret to Azure app ${objectId}: ${
-            message || error.message || "Unknown error"
-          }`
-        });
-      }
-      throw new BadRequestError({
-        message: "Unable to validate connection: verify credentials"
-      });
-    }
-  };
-
-  /**
-   * Revokes a client secret from the Azure app using its keyId.
-   */
-  const revokeCredential = async (keyId: string) => {
-    const accessToken = await getAzureConnectionAccessToken(connection.id, appConnectionDAL, kmsService);
-    const endpoint = `${GRAPH_API_BASE}/applications/${objectId}/removePassword`;
-
-    try {
-      await request.post(
-        endpoint,
-        { keyId },
-        {
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json"
-          }
-        }
-      );
-    } catch (error: unknown) {
-      if (error instanceof AxiosError) {
-        let message;
-        if (
-          error.response?.data &&
-          typeof error.response.data === "object" &&
-          "error" in error.response.data &&
-          typeof (error.response.data as AzureErrorResponse).error.message === "string"
-        ) {
-          message = (error.response.data as AzureErrorResponse).error.message;
-        }
-        throw new BadRequestError({
-          message: `Failed to remove client secret with keyId ${keyId} from app ${objectId}: ${
-            message || error.message || "Unknown error"
-          }`
-        });
-      }
-      throw new BadRequestError({
-        message: "Unable to validate connection: verify credentials"
-      });
-    }
-  };
-
-  /**
-   * Issues a new set of credentials.
-   */
-  const issueCredentials: TRotationFactoryIssueCredentials<TAzureClientSecretRotationGeneratedCredentials> = async (
-    callback
-  ) => {
-    const credentials = await $rotateClientSecret();
-    return callback(credentials);
-  };
-
-  /**
-   * Revokes a list of credentials.
-   */
-  const revokeCredentials: TRotationFactoryRevokeCredentials<TAzureClientSecretRotationGeneratedCredentials> = async (
-    credentials,
-    callback
-  ) => {
-    if (!credentials?.length) return callback();
-
-    for (const { keyId } of credentials) {
-      await revokeCredential(keyId);
-      await sleep();
-    }
-    return callback();
-  };
-
-  /**
-   * Rotates credentials by issuing new ones and revoking the old.
-   */
-  const rotateCredentials: TRotationFactoryRotateCredentials<TAzureClientSecretRotationGeneratedCredentials> = async (
-    oldCredentials,
-    callback
-  ) => {
-    const newCredentials = await $rotateClientSecret();
-    if (oldCredentials?.keyId) {
-      await revokeCredential(oldCredentials.keyId);
-    }
-
-    return callback(newCredentials);
-  };
-
-  /**
-   * Maps the generated credentials into the secret payload format.
-   */
-  const getSecretsPayload: TRotationFactoryGetSecretsPayload<TAzureClientSecretRotationGeneratedCredentials> = ({
-    clientSecret
-  }) => [
-    { key: secretsMapping.clientSecret, value: clientSecret },
-    { key: secretsMapping.clientId, value: clientIdParam }
-  ];
-
-  return {
-    issueCredentials,
-    revokeCredentials,
-    rotateCredentials,
-    getSecretsPayload
-  };
-};

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts

@@ -1,74 +0,0 @@
-import { z } from "zod";
-
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import {
-  BaseCreateSecretRotationSchema,
-  BaseSecretRotationSchema,
-  BaseUpdateSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-schemas";
-import { SecretRotations } from "@app/lib/api-docs";
-import { SecretNameSchema } from "@app/server/lib/schemas";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const AzureClientSecretRotationGeneratedCredentialsSchema = z
-  .object({
-    clientId: z.string(),
-    clientSecret: z.string(),
-    keyId: z.string()
-  })
-  .array()
-  .min(1)
-  .max(2);
-
-const AzureClientSecretRotationParametersSchema = z.object({
-  objectId: z
-    .string()
-    .trim()
-    .min(1, "Object ID Required")
-    .describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.objectId),
-  appName: z.string().trim().describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appName).optional(),
-  clientId: z
-    .string()
-    .trim()
-    .min(1, "Client ID Required")
-    .describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.clientId)
-});
-
-const AzureClientSecretRotationSecretsMappingSchema = z.object({
-  clientId: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AZURE_CLIENT_SECRET.clientId),
-  clientSecret: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AZURE_CLIENT_SECRET.clientSecret)
-});
-
-export const AzureClientSecretRotationTemplateSchema = z.object({
-  secretsMapping: z.object({
-    clientId: z.string(),
-    clientSecret: z.string()
-  })
-});
-
-export const AzureClientSecretRotationSchema = BaseSecretRotationSchema(SecretRotation.AzureClientSecret).extend({
-  type: z.literal(SecretRotation.AzureClientSecret),
-  parameters: AzureClientSecretRotationParametersSchema,
-  secretsMapping: AzureClientSecretRotationSecretsMappingSchema
-});
-
-export const CreateAzureClientSecretRotationSchema = BaseCreateSecretRotationSchema(
-  SecretRotation.AzureClientSecret
-).extend({
-  parameters: AzureClientSecretRotationParametersSchema,
-  secretsMapping: AzureClientSecretRotationSecretsMappingSchema
-});
-
-export const UpdateAzureClientSecretRotationSchema = BaseUpdateSecretRotationSchema(
-  SecretRotation.AzureClientSecret
-).extend({
-  parameters: AzureClientSecretRotationParametersSchema.optional(),
-  secretsMapping: AzureClientSecretRotationSecretsMappingSchema.optional()
-});
-
-export const AzureClientSecretRotationListItemSchema = z.object({
-  name: z.literal("Azure Client Secret"),
-  connection: z.literal(AppConnection.AzureClientSecrets),
-  type: z.literal(SecretRotation.AzureClientSecret),
-  template: AzureClientSecretRotationTemplateSchema
-});

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-types.ts

@@ -1,41 +0,0 @@
-import { z } from "zod";
-
-import { TAzureClientSecretsConnection } from "@app/services/app-connection/azure-client-secrets";
-
-import {
-  AzureClientSecretRotationGeneratedCredentialsSchema,
-  AzureClientSecretRotationListItemSchema,
-  AzureClientSecretRotationSchema,
-  CreateAzureClientSecretRotationSchema
-} from "./azure-client-secret-rotation-schemas";
-
-export type TAzureClientSecretRotation = z.infer<typeof AzureClientSecretRotationSchema>;
-
-export type TAzureClientSecretRotationInput = z.infer<typeof CreateAzureClientSecretRotationSchema>;
-
-export type TAzureClientSecretRotationListItem = z.infer<typeof AzureClientSecretRotationListItemSchema>;
-
-export type TAzureClientSecretRotationWithConnection = TAzureClientSecretRotation & {
-  connection: TAzureClientSecretsConnection;
-};
-
-export type TAzureClientSecretRotationGeneratedCredentials = z.infer<
-  typeof AzureClientSecretRotationGeneratedCredentialsSchema
->;
-
-export interface TAzureClientSecretRotationParameters {
-  appId: string;
-  keyId?: string;
-  displayName?: string;
-}
-
-export interface TAzureClientSecretRotationSecretsMapping {
-  appId: string;
-  clientSecret: string;
-  keyId: string;
-}
-
-export interface AzureAddPasswordResponse {
-  secretText: string;
-  keyId: string;
-}

backend/src/ee/services/secret-rotation-v2/azure-client-secret/index.ts

@@ -1,3 +0,0 @@
-export * from "./azure-client-secret-rotation-constants";
-export * from "./azure-client-secret-rotation-schemas";
-export * from "./azure-client-secret-rotation-types";

backend/src/ee/services/secret-rotation-v2/ldap-password/index.ts

@@ -1,3 +0,0 @@
-export * from "./ldap-password-rotation-constants";
-export * from "./ldap-password-rotation-schemas";
-export * from "./ldap-password-rotation-types";

backend/src/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-constants.ts

@@ -1,15 +0,0 @@
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import { TSecretRotationV2ListItem } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const LDAP_PASSWORD_ROTATION_LIST_OPTION: TSecretRotationV2ListItem = {
-  name: "LDAP Password",
-  type: SecretRotation.LdapPassword,
-  connection: AppConnection.LDAP,
-  template: {
-    secretsMapping: {
-      dn: "LDAP_DN",
-      password: "LDAP_PASSWORD"
-    }
-  }
-};

backend/src/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-fns.ts

@@ -1,181 +0,0 @@
-import ldap from "ldapjs";
-
-import {
-  TRotationFactory,
-  TRotationFactoryGetSecretsPayload,
-  TRotationFactoryIssueCredentials,
-  TRotationFactoryRevokeCredentials,
-  TRotationFactoryRotateCredentials
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { logger } from "@app/lib/logger";
-import { encryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
-import { getLdapConnectionClient, LdapProvider, TLdapConnection } from "@app/services/app-connection/ldap";
-
-import { generatePassword } from "../shared/utils";
-import {
-  TLdapPasswordRotationGeneratedCredentials,
-  TLdapPasswordRotationWithConnection
-} from "./ldap-password-rotation-types";
-
-const getEncodedPassword = (password: string) => Buffer.from(`"${password}"`, "utf16le");
-
-export const ldapPasswordRotationFactory: TRotationFactory<
-  TLdapPasswordRotationWithConnection,
-  TLdapPasswordRotationGeneratedCredentials
-> = (secretRotation, appConnectionDAL, kmsService) => {
-  const {
-    connection,
-    parameters: { dn, passwordRequirements },
-    secretsMapping
-  } = secretRotation;
-
-  const $verifyCredentials = async (credentials: Pick<TLdapConnection["credentials"], "dn" | "password">) => {
-    try {
-      const client = await getLdapConnectionClient({ ...connection.credentials, ...credentials });
-
-      client.unbind();
-      client.destroy();
-    } catch (error) {
-      throw new Error(`Failed to verify credentials - ${(error as Error).message}`);
-    }
-  };
-
-  const $rotatePassword = async () => {
-    const { credentials, orgId } = connection;
-
-    if (!credentials.url.startsWith("ldaps")) throw new Error("Password Rotation requires an LDAPS connection");
-
-    const client = await getLdapConnectionClient(credentials);
-    const isPersonalRotation = credentials.dn === dn;
-
-    const password = generatePassword(passwordRequirements);
-
-    let changes: ldap.Change[] | ldap.Change;
-
-    switch (credentials.provider) {
-      case LdapProvider.ActiveDirectory:
-        {
-          const encodedPassword = getEncodedPassword(password);
-
-          // service account vs personal password rotation require different changes
-          if (isPersonalRotation) {
-            const currentEncodedPassword = getEncodedPassword(credentials.password);
-
-            changes = [
-              new ldap.Change({
-                operation: "delete",
-                modification: {
-                  type: "unicodePwd",
-                  values: [currentEncodedPassword]
-                }
-              }),
-              new ldap.Change({
-                operation: "add",
-                modification: {
-                  type: "unicodePwd",
-                  values: [encodedPassword]
-                }
-              })
-            ];
-          } else {
-            changes = new ldap.Change({
-              operation: "replace",
-              modification: {
-                type: "unicodePwd",
-                values: [encodedPassword]
-              }
-            });
-          }
-        }
-        break;
-      default:
-        throw new Error(`Unhandled provider: ${credentials.provider as LdapProvider}`);
-    }
-
-    try {
-      await new Promise((resolve, reject) => {
-        client.modify(dn, changes, (err) => {
-          if (err) {
-            logger.error(err, "LDAP Password Rotation Failed");
-            reject(new Error(`Provider Modify Error: ${err.message}`));
-          } else {
-            resolve(true);
-          }
-        });
-      });
-    } finally {
-      client.unbind();
-      client.destroy();
-    }
-
-    await $verifyCredentials({ dn, password });
-
-    if (isPersonalRotation) {
-      const updatedCredentials: TLdapConnection["credentials"] = {
-        ...credentials,
-        password
-      };
-
-      const encryptedCredentials = await encryptAppConnectionCredentials({
-        credentials: updatedCredentials,
-        orgId,
-        kmsService
-      });
-
-      await appConnectionDAL.updateById(connection.id, { encryptedCredentials });
-    }
-
-    return { dn, password };
-  };
-
-  const issueCredentials: TRotationFactoryIssueCredentials<TLdapPasswordRotationGeneratedCredentials> = async (
-    callback
-  ) => {
-    const credentials = await $rotatePassword();
-
-    return callback(credentials);
-  };
-
-  const revokeCredentials: TRotationFactoryRevokeCredentials<TLdapPasswordRotationGeneratedCredentials> = async (
-    _,
-    callback
-  ) => {
-    // we just rotate to a new password, essentially revoking old credentials
-    await $rotatePassword();
-
-    return callback();
-  };
-
-  const rotateCredentials: TRotationFactoryRotateCredentials<TLdapPasswordRotationGeneratedCredentials> = async (
-    _,
-    callback
-  ) => {
-    const credentials = await $rotatePassword();
-
-    return callback(credentials);
-  };
-
-  const getSecretsPayload: TRotationFactoryGetSecretsPayload<TLdapPasswordRotationGeneratedCredentials> = (
-    generatedCredentials
-  ) => {
-    const secrets = [
-      {
-        key: secretsMapping.dn,
-        value: generatedCredentials.dn
-      },
-      {
-        key: secretsMapping.password,
-        value: generatedCredentials.password
-      }
-    ];
-
-    return secrets;
-  };
-
-  return {
-    issueCredentials,
-    revokeCredentials,
-    rotateCredentials,
-    getSecretsPayload
-  };
-};

backend/src/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-schemas.ts

@@ -1,68 +0,0 @@
-import RE2 from "re2";
-import { z } from "zod";
-
-import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
-import {
-  BaseCreateSecretRotationSchema,
-  BaseSecretRotationSchema,
-  BaseUpdateSecretRotationSchema
-} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-schemas";
-import { PasswordRequirementsSchema } from "@app/ee/services/secret-rotation-v2/shared/general";
-import { SecretRotations } from "@app/lib/api-docs";
-import { DistinguishedNameRegex } from "@app/lib/regex";
-import { SecretNameSchema } from "@app/server/lib/schemas";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-export const LdapPasswordRotationGeneratedCredentialsSchema = z
-  .object({
-    dn: z.string(),
-    password: z.string()
-  })
-  .array()
-  .min(1)
-  .max(2);
-
-const LdapPasswordRotationParametersSchema = z.object({
-  dn: z
-    .string()
-    .trim()
-    .regex(new RE2(DistinguishedNameRegex), "Invalid DN format, ie; CN=user,OU=users,DC=example,DC=com")
-    .min(1, "Distinguished Name (DN) Required")
-    .describe(SecretRotations.PARAMETERS.LDAP_PASSWORD.dn),
-  passwordRequirements: PasswordRequirementsSchema.optional()
-});
-
-const LdapPasswordRotationSecretsMappingSchema = z.object({
-  dn: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.LDAP_PASSWORD.dn),
-  password: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.LDAP_PASSWORD.password)
-});
-
-export const LdapPasswordRotationTemplateSchema = z.object({
-  secretsMapping: z.object({
-    dn: z.string(),
-    password: z.string()
-  })
-});
-
-export const LdapPasswordRotationSchema = BaseSecretRotationSchema(SecretRotation.LdapPassword).extend({
-  type: z.literal(SecretRotation.LdapPassword),
-  parameters: LdapPasswordRotationParametersSchema,
-  secretsMapping: LdapPasswordRotationSecretsMappingSchema
-});
-
-export const CreateLdapPasswordRotationSchema = BaseCreateSecretRotationSchema(SecretRotation.LdapPassword).extend({
-  parameters: LdapPasswordRotationParametersSchema,
-  secretsMapping: LdapPasswordRotationSecretsMappingSchema
-});
-
-export const UpdateLdapPasswordRotationSchema = BaseUpdateSecretRotationSchema(SecretRotation.LdapPassword).extend({
-  parameters: LdapPasswordRotationParametersSchema.optional(),
-  secretsMapping: LdapPasswordRotationSecretsMappingSchema.optional()
-});
-
-export const LdapPasswordRotationListItemSchema = z.object({
-  name: z.literal("LDAP Password"),
-  connection: z.literal(AppConnection.LDAP),
-  type: z.literal(SecretRotation.LdapPassword),
-  template: LdapPasswordRotationTemplateSchema
-});

backend/src/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-types.ts

@@ -1,22 +0,0 @@
-import { z } from "zod";
-
-import { TLdapConnection } from "@app/services/app-connection/ldap";
-
-import {
-  CreateLdapPasswordRotationSchema,
-  LdapPasswordRotationGeneratedCredentialsSchema,
-  LdapPasswordRotationListItemSchema,
-  LdapPasswordRotationSchema
-} from "./ldap-password-rotation-schemas";
-
-export type TLdapPasswordRotation = z.infer<typeof LdapPasswordRotationSchema>;
-
-export type TLdapPasswordRotationInput = z.infer<typeof CreateLdapPasswordRotationSchema>;
-
-export type TLdapPasswordRotationListItem = z.infer<typeof LdapPasswordRotationListItemSchema>;
-
-export type TLdapPasswordRotationWithConnection = TLdapPasswordRotation & {
-  connection: TLdapConnection;
-};
-
-export type TLdapPasswordRotationGeneratedCredentials = z.infer<typeof LdapPasswordRotationGeneratedCredentialsSchema>;

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts

@@ -1,10 +1,7 @@
 export enum SecretRotation {
   PostgresCredentials = "postgres-credentials",
   MsSqlCredentials = "mssql-credentials",
-  Auth0ClientSecret = "auth0-client-secret",
-  AzureClientSecret = "azure-client-secret",
-  AwsIamUserSecret = "aws-iam-user-secret",
-  LdapPassword = "ldap-password"
+  Auth0ClientSecret = "auth0-client-secret"
 }
 
 export enum SecretRotationStatus {

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts

@@ -4,9 +4,6 @@ import { getConfig } from "@app/lib/config/env";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { AUTH0_CLIENT_SECRET_ROTATION_LIST_OPTION } from "./auth0-client-secret";
-import { AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION } from "./aws-iam-user-secret";
-import { AZURE_CLIENT_SECRET_ROTATION_LIST_OPTION } from "./azure-client-secret";
-import { LDAP_PASSWORD_ROTATION_LIST_OPTION } from "./ldap-password";
 import { MSSQL_CREDENTIALS_ROTATION_LIST_OPTION } from "./mssql-credentials";
 import { POSTGRES_CREDENTIALS_ROTATION_LIST_OPTION } from "./postgres-credentials";
 import { SecretRotation, SecretRotationStatus } from "./secret-rotation-v2-enums";
@@ -21,10 +18,7 @@ import {
 const SECRET_ROTATION_LIST_OPTIONS: Record<SecretRotation, TSecretRotationV2ListItem> = {
   [SecretRotation.PostgresCredentials]: POSTGRES_CREDENTIALS_ROTATION_LIST_OPTION,
   [SecretRotation.MsSqlCredentials]: MSSQL_CREDENTIALS_ROTATION_LIST_OPTION,
-  [SecretRotation.Auth0ClientSecret]: AUTH0_CLIENT_SECRET_ROTATION_LIST_OPTION,
-  [SecretRotation.AzureClientSecret]: AZURE_CLIENT_SECRET_ROTATION_LIST_OPTION,
-  [SecretRotation.AwsIamUserSecret]: AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION,
-  [SecretRotation.LdapPassword]: LDAP_PASSWORD_ROTATION_LIST_OPTION
+  [SecretRotation.Auth0ClientSecret]: AUTH0_CLIENT_SECRET_ROTATION_LIST_OPTION
 };
 
 export const listSecretRotationOptions = () => {
@@ -219,7 +213,7 @@ export const parseRotationErrorMessage = (err: unknown): string => {
   if (err instanceof AxiosError) {
     errorMessage += err?.response?.data
       ? JSON.stringify(err?.response?.data)
-      : (err?.message ?? "An unknown error occurred.");
+      : err?.message ?? "An unknown error occurred.";
   } else {
     errorMessage += (err as Error)?.message || "An unknown error occurred.";
   }

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts

@@ -3,18 +3,12 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 
 export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
   [SecretRotation.PostgresCredentials]: "PostgreSQL Credentials",
-  [SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials",
-  [SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret",
-  [SecretRotation.AzureClientSecret]: "Azure Client Secret",
-  [SecretRotation.AwsIamUserSecret]: "AWS IAM User Secret",
-  [SecretRotation.LdapPassword]: "LDAP Password"
+  [SecretRotation.MsSqlCredentials]: "Microsoft SQL Sever Credentials",
+  [SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret"
 };
 
 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
   [SecretRotation.PostgresCredentials]: AppConnection.Postgres,
   [SecretRotation.MsSqlCredentials]: AppConnection.MsSql,
-  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0,
-  [SecretRotation.AzureClientSecret]: AppConnection.AzureClientSecrets,
-  [SecretRotation.AwsIamUserSecret]: AppConnection.AWS,
-  [SecretRotation.LdapPassword]: AppConnection.LDAP
+  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0
 };

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-schemas.ts

@@ -20,7 +20,7 @@ export const BaseSecretRotationSchema = (type: SecretRotation) =>
     // unique to provider
     type: true,
     parameters: true,
-    secretsMapping: true
+    secretMappings: true
   }).extend({
     connection: z.object({
       app: z.literal(SECRET_ROTATION_CONNECTION_MAP[type]),

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts

@@ -14,8 +14,6 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { auth0ClientSecretRotationFactory } from "@app/ee/services/secret-rotation-v2/auth0-client-secret/auth0-client-secret-rotation-fns";
-import { azureClientSecretRotationFactory } from "@app/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns";
-import { ldapPasswordRotationFactory } from "@app/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-fns";
 import { SecretRotation, SecretRotationStatus } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
 import {
   calculateNextRotationAt,
@@ -79,7 +77,6 @@ import {
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
 
-import { awsIamUserSecretRotationFactory } from "./aws-iam-user-secret/aws-iam-user-secret-rotation-fns";
 import { TSecretRotationV2DALFactory } from "./secret-rotation-v2-dal";
 
 export type TSecretRotationV2ServiceFactoryDep = {
@@ -103,7 +100,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
   secretQueueService: Pick<TSecretQueueFactory, "syncSecrets" | "removeSecretReminder">;
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   queueService: Pick<TQueueServiceFactory, "queuePg">;
-  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">;
 };
 
 export type TSecretRotationV2ServiceFactory = ReturnType<typeof secretRotationV2ServiceFactory>;
@@ -117,10 +114,7 @@ type TRotationFactoryImplementation = TRotationFactory<
 const SECRET_ROTATION_FACTORY_MAP: Record<SecretRotation, TRotationFactoryImplementation> = {
   [SecretRotation.PostgresCredentials]: sqlCredentialsRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.MsSqlCredentials]: sqlCredentialsRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.Auth0ClientSecret]: auth0ClientSecretRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.AzureClientSecret]: azureClientSecretRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.AwsIamUserSecret]: awsIamUserSecretRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.LdapPassword]: ldapPasswordRotationFactory as TRotationFactoryImplementation
+  [SecretRotation.Auth0ClientSecret]: auth0ClientSecretRotationFactory as TRotationFactoryImplementation
 };
 
 export const secretRotationV2ServiceFactory = ({
@@ -449,25 +443,12 @@ export const secretRotationV2ServiceFactory = ({
       {
         parameters: payload.parameters,
         secretsMapping,
-        connection,
-        rotationInterval: payload.rotationInterval
+        connection
       } as TSecretRotationV2WithConnection,
       appConnectionDAL,
       kmsService
     );
 
-    // even though we have a db constraint we want to check before any rotation of credentials is attempted
-    // to prevent creation failure after external credentials have been modified
-    const conflictingRotation = await secretRotationV2DAL.findOne({
-      name: payload.name,
-      folderId: folder.id
-    });
-
-    if (conflictingRotation)
-      throw new BadRequestError({
-        message: `A Secret Rotation with the name "${payload.name}" already exists at the secret path "${secretPath}"`
-      });
-
     try {
       const currentTime = new Date();
 

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts

@@ -12,27 +12,6 @@ import {
   TAuth0ClientSecretRotationListItem,
   TAuth0ClientSecretRotationWithConnection
 } from "./auth0-client-secret";
-import {
-  TAwsIamUserSecretRotation,
-  TAwsIamUserSecretRotationGeneratedCredentials,
-  TAwsIamUserSecretRotationInput,
-  TAwsIamUserSecretRotationListItem,
-  TAwsIamUserSecretRotationWithConnection
-} from "./aws-iam-user-secret";
-import {
-  TAzureClientSecretRotation,
-  TAzureClientSecretRotationGeneratedCredentials,
-  TAzureClientSecretRotationInput,
-  TAzureClientSecretRotationListItem,
-  TAzureClientSecretRotationWithConnection
-} from "./azure-client-secret";
-import {
-  TLdapPasswordRotation,
-  TLdapPasswordRotationGeneratedCredentials,
-  TLdapPasswordRotationInput,
-  TLdapPasswordRotationListItem,
-  TLdapPasswordRotationWithConnection
-} from "./ldap-password";
 import {
   TMsSqlCredentialsRotation,
   TMsSqlCredentialsRotationInput,
@@ -48,44 +27,26 @@ import {
 import { TSecretRotationV2DALFactory } from "./secret-rotation-v2-dal";
 import { SecretRotation } from "./secret-rotation-v2-enums";
 
-export type TSecretRotationV2 =
-  | TPostgresCredentialsRotation
-  | TMsSqlCredentialsRotation
-  | TAuth0ClientSecretRotation
-  | TAzureClientSecretRotation
-  | TLdapPasswordRotation
-  | TAwsIamUserSecretRotation;
+export type TSecretRotationV2 = TPostgresCredentialsRotation | TMsSqlCredentialsRotation | TAuth0ClientSecretRotation;
 
 export type TSecretRotationV2WithConnection =
   | TPostgresCredentialsRotationWithConnection
   | TMsSqlCredentialsRotationWithConnection
-  | TAuth0ClientSecretRotationWithConnection
-  | TAzureClientSecretRotationWithConnection
-  | TLdapPasswordRotationWithConnection
-  | TAwsIamUserSecretRotationWithConnection;
+  | TAuth0ClientSecretRotationWithConnection;
 
 export type TSecretRotationV2GeneratedCredentials =
   | TSqlCredentialsRotationGeneratedCredentials
-  | TAuth0ClientSecretRotationGeneratedCredentials
-  | TAzureClientSecretRotationGeneratedCredentials
-  | TLdapPasswordRotationGeneratedCredentials
-  | TAwsIamUserSecretRotationGeneratedCredentials;
+  | TAuth0ClientSecretRotationGeneratedCredentials;
 
 export type TSecretRotationV2Input =
   | TPostgresCredentialsRotationInput
   | TMsSqlCredentialsRotationInput
-  | TAuth0ClientSecretRotationInput
-  | TAzureClientSecretRotationInput
-  | TLdapPasswordRotationInput
-  | TAwsIamUserSecretRotationInput;
+  | TAuth0ClientSecretRotationInput;
 
 export type TSecretRotationV2ListItem =
   | TPostgresCredentialsRotationListItem
   | TMsSqlCredentialsRotationListItem
-  | TAuth0ClientSecretRotationListItem
-  | TAzureClientSecretRotationListItem
-  | TLdapPasswordRotationListItem
-  | TAwsIamUserSecretRotationListItem;
+  | TAuth0ClientSecretRotationListItem;
 
 export type TSecretRotationV2Raw = NonNullable<Awaited<ReturnType<TSecretRotationV2DALFactory["findById"]>>>;
 
@@ -209,7 +170,7 @@ export type TRotationFactory<
   C extends TSecretRotationV2GeneratedCredentials
 > = (
   secretRotation: T,
-  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
   issueCredentials: TRotationFactoryIssueCredentials<C>;

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts

@@ -1,18 +1,11 @@
 import { z } from "zod";
 
 import { Auth0ClientSecretRotationSchema } from "@app/ee/services/secret-rotation-v2/auth0-client-secret";
-import { AzureClientSecretRotationSchema } from "@app/ee/services/secret-rotation-v2/azure-client-secret";
-import { LdapPasswordRotationSchema } from "@app/ee/services/secret-rotation-v2/ldap-password";
 import { MsSqlCredentialsRotationSchema } from "@app/ee/services/secret-rotation-v2/mssql-credentials";
 import { PostgresCredentialsRotationSchema } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 
-import { AwsIamUserSecretRotationSchema } from "./aws-iam-user-secret";
-
 export const SecretRotationV2Schema = z.discriminatedUnion("type", [
   PostgresCredentialsRotationSchema,
   MsSqlCredentialsRotationSchema,
-  Auth0ClientSecretRotationSchema,
-  AzureClientSecretRotationSchema,
-  LdapPasswordRotationSchema,
-  AwsIamUserSecretRotationSchema
+  Auth0ClientSecretRotationSchema
 ]);

backend/src/ee/services/secret-rotation-v2/shared/general/index.ts

@@ -1 +0,0 @@
-export * from "./password-requirements-schema";

backend/src/ee/services/secret-rotation-v2/shared/general/password-requirements-schema.ts

@@ -1,44 +0,0 @@
-import RE2 from "re2";
-import { z } from "zod";
-
-import { SecretRotations } from "@app/lib/api-docs";
-
-export const PasswordRequirementsSchema = z
-  .object({
-    length: z
-      .number()
-      .min(1, "Password length must be a positive number")
-      .max(250, "Password length must be less than 250")
-      .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.length),
-    required: z.object({
-      digits: z
-        .number()
-        .min(0, "Digit count must be non-negative")
-        .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.required.digits),
-      lowercase: z
-        .number()
-        .min(0, "Lowercase count must be non-negative")
-        .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.required.lowercase),
-      uppercase: z
-        .number()
-        .min(0, "Uppercase count must be non-negative")
-        .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.required.uppercase),
-      symbols: z
-        .number()
-        .min(0, "Symbol count must be non-negative")
-        .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.required.symbols)
-    }),
-    allowedSymbols: z
-      .string()
-      .regex(new RE2("[!@#$%^&*()_+\\-=\\[\\]{};':\"\\\\|,.<>\\/?~]"), "Invalid symbols")
-      .optional()
-      .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.allowedSymbols)
-  })
-  .refine((data) => {
-    return Object.values(data.required).some((count) => count > 0);
-  }, "At least one character type must be required")
-  .refine((data) => {
-    const total = Object.values(data.required).reduce((sum, count) => sum + count, 0);
-    return total <= data.length;
-  }, "Sum of required characters cannot exceed the total length")
-  .describe(SecretRotations.PARAMETERS.GENERAL.PASSWORD_REQUIREMENTS.base);

backend/src/ee/services/secret-rotation-v2/shared/utils/index.ts

@@ -1,17 +1,6 @@
 import { randomInt } from "crypto";
 
-type TPasswordRequirements = {
-  length: number;
-  required: {
-    lowercase: number;
-    uppercase: number;
-    digits: number;
-    symbols: number;
-  };
-  allowedSymbols?: string;
-};
-
-const DEFAULT_PASSWORD_REQUIREMENTS: TPasswordRequirements = {
+const DEFAULT_PASSWORD_REQUIREMENTS = {
   length: 48,
   required: {
     lowercase: 1,
@@ -22,9 +11,9 @@ const DEFAULT_PASSWORD_REQUIREMENTS: TPasswordRequirements = {
   allowedSymbols: "-_.~!*"
 };
 
-export const generatePassword = (passwordRequirements?: TPasswordRequirements) => {
+export const generatePassword = () => {
   try {
-    const { length, required, allowedSymbols } = passwordRequirements ?? DEFAULT_PASSWORD_REQUIREMENTS;
+    const { length, required, allowedSymbols } = DEFAULT_PASSWORD_REQUIREMENTS;
 
     const chars = {
       lowercase: "abcdefghijklmnopqrstuvwxyz",

backend/src/ee/services/ssh-host-group/ssh-host-group-dal.ts

@@ -1,225 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { BadRequestError, DatabaseError } from "@app/lib/errors";
-import { groupBy, unique } from "@app/lib/fn";
-import { ormify } from "@app/lib/knex";
-
-import { EHostGroupMembershipFilter } from "./ssh-host-group-types";
-
-export type TSshHostGroupDALFactory = ReturnType<typeof sshHostGroupDALFactory>;
-
-export const sshHostGroupDALFactory = (db: TDbClient) => {
-  const sshHostGroupOrm = ormify(db, TableName.SshHostGroup);
-
-  const findSshHostGroupsWithLoginMappings = async (projectId: string, tx?: Knex) => {
-    try {
-      // First, get all the SSH host groups with their login mappings
-      const rows = await (tx || db.replicaNode())(TableName.SshHostGroup)
-        .leftJoin(
-          TableName.SshHostLoginUser,
-          `${TableName.SshHostGroup}.id`,
-          `${TableName.SshHostLoginUser}.sshHostGroupId`
-        )
-        .leftJoin(
-          TableName.SshHostLoginUserMapping,
-          `${TableName.SshHostLoginUser}.id`,
-          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
-        )
-        .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
-        .where(`${TableName.SshHostGroup}.projectId`, projectId)
-        .select(
-          db.ref("id").withSchema(TableName.SshHostGroup).as("sshHostGroupId"),
-          db.ref("projectId").withSchema(TableName.SshHostGroup),
-          db.ref("name").withSchema(TableName.SshHostGroup),
-          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
-          db.ref("username").withSchema(TableName.Users),
-          db.ref("userId").withSchema(TableName.SshHostLoginUserMapping)
-        )
-        .orderBy(`${TableName.SshHostGroup}.updatedAt`, "desc");
-
-      const hostsGrouped = groupBy(rows, (r) => r.sshHostGroupId);
-
-      const hostGroupIds = Object.keys(hostsGrouped);
-
-      type HostCountRow = {
-        sshHostGroupId: string;
-        host_count: string;
-      };
-
-      const hostCountsQuery = (await (tx ||
-        db
-          .replicaNode()(TableName.SshHostGroupMembership)
-          .select(`${TableName.SshHostGroupMembership}.sshHostGroupId`, db.raw(`count(*) as host_count`))
-          .whereIn(`${TableName.SshHostGroupMembership}.sshHostGroupId`, hostGroupIds)
-          .groupBy(`${TableName.SshHostGroupMembership}.sshHostGroupId`))) as HostCountRow[];
-
-      const hostCountsMap = hostCountsQuery.reduce<Record<string, number>>((acc, { sshHostGroupId, host_count }) => {
-        acc[sshHostGroupId] = Number(host_count);
-        return acc;
-      }, {});
-
-      return Object.values(hostsGrouped).map((hostRows) => {
-        const { sshHostGroupId, name } = hostRows[0];
-        const loginMappingGrouped = groupBy(
-          hostRows.filter((r) => r.loginUser),
-          (r) => r.loginUser
-        );
-        const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
-          loginUser,
-          allowedPrincipals: {
-            usernames: unique(entries.map((e) => e.username)).filter(Boolean)
-          }
-        }));
-        return {
-          id: sshHostGroupId,
-          projectId,
-          name,
-          loginMappings,
-          hostCount: hostCountsMap[sshHostGroupId] ?? 0
-        };
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: `${TableName.SshHostGroup}: FindSshHostGroupsWithLoginMappings` });
-    }
-  };
-
-  const findSshHostGroupByIdWithLoginMappings = async (sshHostGroupId: string, tx?: Knex) => {
-    try {
-      const rows = await (tx || db.replicaNode())(TableName.SshHostGroup)
-        .leftJoin(
-          TableName.SshHostLoginUser,
-          `${TableName.SshHostGroup}.id`,
-          `${TableName.SshHostLoginUser}.sshHostGroupId`
-        )
-        .leftJoin(
-          TableName.SshHostLoginUserMapping,
-          `${TableName.SshHostLoginUser}.id`,
-          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
-        )
-        .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
-        .where(`${TableName.SshHostGroup}.id`, sshHostGroupId)
-        .select(
-          db.ref("id").withSchema(TableName.SshHostGroup).as("sshHostGroupId"),
-          db.ref("projectId").withSchema(TableName.SshHostGroup),
-          db.ref("name").withSchema(TableName.SshHostGroup),
-          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
-          db.ref("username").withSchema(TableName.Users),
-          db.ref("userId").withSchema(TableName.SshHostLoginUserMapping)
-        );
-
-      if (rows.length === 0) return null;
-
-      const { sshHostGroupId: id, projectId, name } = rows[0];
-
-      const loginMappingGrouped = groupBy(
-        rows.filter((r) => r.loginUser),
-        (r) => r.loginUser
-      );
-
-      const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
-        loginUser,
-        allowedPrincipals: {
-          usernames: unique(entries.map((e) => e.username)).filter(Boolean)
-        }
-      }));
-
-      return {
-        id,
-        projectId,
-        name,
-        loginMappings
-      };
-    } catch (error) {
-      throw new DatabaseError({ error, name: `${TableName.SshHostGroup}: FindSshHostGroupByIdWithLoginMappings` });
-    }
-  };
-
-  const findAllSshHostsInGroup = async ({
-    sshHostGroupId,
-    offset = 0,
-    limit,
-    filter
-  }: {
-    sshHostGroupId: string;
-    offset?: number;
-    limit?: number;
-    filter?: EHostGroupMembershipFilter;
-  }) => {
-    try {
-      const sshHostGroup = await db
-        .replicaNode()(TableName.SshHostGroup)
-        .where(`${TableName.SshHostGroup}.id`, sshHostGroupId)
-        .select("projectId")
-        .first();
-
-      if (!sshHostGroup) {
-        throw new BadRequestError({
-          message: `SSH host group with ID ${sshHostGroupId} not found`
-        });
-      }
-
-      const query = db
-        .replicaNode()(TableName.SshHost)
-        .where(`${TableName.SshHost}.projectId`, sshHostGroup.projectId)
-        .leftJoin(TableName.SshHostGroupMembership, (bd) => {
-          bd.on(`${TableName.SshHostGroupMembership}.sshHostId`, "=", `${TableName.SshHost}.id`).andOn(
-            `${TableName.SshHostGroupMembership}.sshHostGroupId`,
-            "=",
-            db.raw("?", [sshHostGroupId])
-          );
-        })
-        .select(
-          db.ref("id").withSchema(TableName.SshHost),
-          db.ref("hostname").withSchema(TableName.SshHost),
-          db.ref("alias").withSchema(TableName.SshHost),
-          db.ref("sshHostGroupId").withSchema(TableName.SshHostGroupMembership),
-          db.ref("createdAt").withSchema(TableName.SshHostGroupMembership).as("joinedGroupAt"),
-          db.raw(`count(*) OVER() as total_count`)
-        )
-        .offset(offset)
-        .orderBy(`${TableName.SshHost}.hostname`, "asc");
-
-      if (limit) {
-        void query.limit(limit);
-      }
-
-      if (filter) {
-        switch (filter) {
-          case EHostGroupMembershipFilter.GROUP_MEMBERS:
-            void query.andWhere(`${TableName.SshHostGroupMembership}.createdAt`, "is not", null);
-            break;
-          case EHostGroupMembershipFilter.NON_GROUP_MEMBERS:
-            void query.andWhere(`${TableName.SshHostGroupMembership}.createdAt`, "is", null);
-            break;
-          default:
-            break;
-        }
-      }
-
-      const hosts = await query;
-
-      return {
-        hosts: hosts.map(({ id, hostname, alias, sshHostGroupId: memberGroupId, joinedGroupAt }) => ({
-          id,
-          hostname,
-          alias,
-          isPartOfGroup: !!memberGroupId,
-          joinedGroupAt
-        })),
-        // @ts-expect-error col select is raw and not strongly typed
-        totalCount: Number(hosts?.[0]?.total_count ?? 0)
-      };
-    } catch (error) {
-      throw new DatabaseError({ error, name: `${TableName.SshHostGroupMembership}: FindAllSshHostsInGroup` });
-    }
-  };
-
-  return {
-    findSshHostGroupsWithLoginMappings,
-    findSshHostGroupByIdWithLoginMappings,
-    findAllSshHostsInGroup,
-    ...sshHostGroupOrm
-  };
-};

backend/src/ee/services/ssh-host-group/ssh-host-group-membership-dal.ts

@@ -1,13 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TSshHostGroupMembershipDALFactory = ReturnType<typeof sshHostGroupMembershipDALFactory>;
-
-export const sshHostGroupMembershipDALFactory = (db: TDbClient) => {
-  const sshHostGroupMembershipOrm = ormify(db, TableName.SshHostGroupMembership);
-
-  return {
-    ...sshHostGroupMembershipOrm
-  };
-};

backend/src/ee/services/ssh-host-group/ssh-host-group-schema.ts

@@ -1,7 +0,0 @@
-import { SshHostGroupsSchema } from "@app/db/schemas";
-
-export const sanitizedSshHostGroup = SshHostGroupsSchema.pick({
-  id: true,
-  projectId: true,
-  name: true
-});