Merge pull request #1248 from akhilmhdh/fix/secret-approval-patch

fix: secret approval loading failed for commiter on approval

backend/package-lock.json

@@ -24,7 +24,7 @@
         "ajv": "^8.12.0",
         "argon2": "^0.30.3",
         "aws-sdk": "^2.1364.0",
-        "axios": "^1.3.5",
+        "axios": "^1.6.0",
         "axios-retry": "^3.4.0",
         "bcrypt": "^5.1.0",
         "bigint-conversion": "^2.4.0",
@@ -8325,9 +8325,9 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
-      "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.0.tgz",
+      "integrity": "sha512-EZ1DYihju9pwVB+jg67ogm+Tmqc6JmhamRN6I4Zt8DfZu5lbcQGw3ozH9lFejSJgs/ibaef3A9PMXPLeefFGJg==",
       "dependencies": {
         "follow-redirects": "^1.15.0",
         "form-data": "^4.0.0",
@@ -25250,9 +25250,9 @@
       }
     },
     "axios": {
-      "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
-      "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.0.tgz",
+      "integrity": "sha512-EZ1DYihju9pwVB+jg67ogm+Tmqc6JmhamRN6I4Zt8DfZu5lbcQGw3ozH9lFejSJgs/ibaef3A9PMXPLeefFGJg==",
       "requires": {
         "follow-redirects": "^1.15.0",
         "form-data": "^4.0.0",

backend/package.json

@@ -15,7 +15,7 @@
     "ajv": "^8.12.0",
     "argon2": "^0.30.3",
     "aws-sdk": "^2.1364.0",
-    "axios": "^1.3.5",
+    "axios": "^1.6.0",
     "axios-retry": "^3.4.0",
     "bcrypt": "^5.1.0",
     "bigint-conversion": "^2.4.0",

backend/src/controllers/v1/universalAuthController.ts

@@ -3,28 +3,28 @@ import { Types } from "mongoose";
 import jwt from "jsonwebtoken";
 import crypto from "crypto";
 import bcrypt from "bcrypt";
-import { 
-  IIdentity, 
-  IIdentityTrustedIp, 
-  IIdentityUniversalAuthClientSecret,
-  Identity,
-  IdentityAccessToken,
-  IdentityAuthMethod,
-  IdentityMembershipOrg,
-  IdentityUniversalAuth,
-  IdentityUniversalAuthClientSecret,
+import {
+    IIdentity,
+    IIdentityTrustedIp,
+    IIdentityUniversalAuthClientSecret,
+    Identity,
+    IdentityAccessToken,
+    IdentityAuthMethod,
+    IdentityMembershipOrg,
+    IdentityUniversalAuth,
+    IdentityUniversalAuthClientSecret,
 } from "../../models";
 import { createToken } from "../../helpers/auth";
 import { AuthTokenType } from "../../variables";
-import { 
-  BadRequestError, 
-  ForbiddenRequestError, 
-  ResourceNotFoundError,
-  UnauthorizedRequestError
+import {
+    BadRequestError,
+    ForbiddenRequestError,
+    ResourceNotFoundError,
+    UnauthorizedRequestError
 } from "../../utils/errors";
 import {
-  getAuthSecret,
-  getSaltRounds
+    getAuthSecret,
+    getSaltRounds
 } from "../../config";
 import { ActorType, EventType, IRole } from "../../ee/models";
 import { validateRequest } from "../../helpers/validation";
@@ -32,12 +32,12 @@ import * as reqValidator from "../../validation/auth";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr } from "../../utils/ip";
 import { getUserAgentType } from "../../utils/posthog";
 import { EEAuditLogService, EELicenseService } from "../../ee/services";
-import { 
-  OrgPermissionActions, 
-  OrgPermissionSubjects, 
-  getAuthDataOrgPermissions, 
-  getOrgRolePermissions, 
-  isAtLeastAsPrivilegedOrg 
+import {
+    OrgPermissionActions,
+    OrgPermissionSubjects,
+    getAuthDataOrgPermissions,
+    getOrgRolePermissions,
+    isAtLeastAsPrivilegedOrg
 } from "../../ee/services/RoleService";
 import { ForbiddenError } from "@casl/ability";
 
@@ -53,13 +53,59 @@ const packageUniversalAuthClientSecretData = (identityUniversalAuthClientSecret:
     createdAt: identityUniversalAuthClientSecret.createdAt,
     updatedAt: identityUniversalAuthClientSecret.updatedAt
 });
-  
+
 /**
  * Renews an access token by its TTL
  * @param req 
  * @param res 
  */
 export const renewAccessToken = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Renew access token'
+        #swagger.description = 'Renew access token'
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "accessToken": {
+                                "type": "string",
+                                "description": "Access token to renew",
+                                "example": "..."
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "accessToken": {
+                                "type": "string",
+                                "description": "(Same) Access token after successful renewal"
+                            },
+                            "expiresIn": {
+                                "type": "number",
+                                "description": "TTL of access token in seconds"
+                            },
+                            "tokenType": {
+                                "type": "string",
+                                "description": "Type of access token (e.g. Bearer)"
+                            }
+                        },
+                        "description": "Access token and its details"
+                    }
+                }
+            }
+        }
+    */
     const {
         body: {
             accessToken
@@ -86,9 +132,6 @@ export const renewAccessToken = async (req: Request, res: Response) => {
         createdAt: accessTokenCreatedAt
     } = identityAccessToken;
 
-    if (accessTokenTTL === accessTokenMaxTTL) throw UnauthorizedRequestError({
-        message: "Failed to renew non-renewable access token"
-    });
 
     // ttl check
     if (accessTokenTTL > 0) {
@@ -141,6 +184,7 @@ export const renewAccessToken = async (req: Request, res: Response) => {
     return res.status(200).send({
         accessToken,
         expiresIn: identityAccessToken.accessTokenTTL,
+        accessTokenMaxTTL: identityAccessToken.accessTokenMaxTTL,
         tokenType: "Bearer"
     });
 }
@@ -152,6 +196,57 @@ export const renewAccessToken = async (req: Request, res: Response) => {
  * @param res 
  */
 export const loginIdentityUniversalAuth = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Login with Universal Auth'
+        #swagger.description = 'Login with Universal Auth'
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientId": {
+                                "type": "string",
+                                "description": "Client ID for identity to login with Universal Auth",
+                                "example": "..."
+                            },
+                            "clientSecret": {
+                                "type": "string",
+                                "description": "Client Secret for identity to login with Universal Auth",
+                                "example": "..."
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "accessToken": {
+                                "type": "string",
+                                "description": "Access token issued after successful login"
+                            },
+                            "expiresIn": {
+                                "type": "number",
+                                "description": "TTL of access token in seconds"
+                            },
+                            "tokenType": {
+                                "type": "string",
+                                "description": "Type of access token (e.g. Bearer)"
+                            }
+                        },
+                        "description": "Access token and its details"
+                    }
+                }
+            }
+        }
+    */
     const {
         body: {
             clientId,
@@ -162,7 +257,7 @@ export const loginIdentityUniversalAuth = async (req: Request, res: Response) =>
     const identityUniversalAuth = await IdentityUniversalAuth.findOne({
         clientId
     }).populate<{ identity: IIdentity }>("identity");
-    
+
     if (!identityUniversalAuth) throw UnauthorizedRequestError();
 
     checkIPAgainstBlocklist({
@@ -237,16 +332,16 @@ export const loginIdentityUniversalAuth = async (req: Request, res: Response) =>
 
     // increment usage count by 1
     await IdentityUniversalAuthClientSecret
-    .findByIdAndUpdate(
-        validatedClientSecretDatum._id,
-        {
-            clientSecretLastUsedAt: new Date(),
-            $inc: { clientSecretNumUses: 1 }
-        },
-        {
-            new: true
-        }
-    );
+        .findByIdAndUpdate(
+            validatedClientSecretDatum._id,
+            {
+                clientSecretLastUsedAt: new Date(),
+                $inc: { clientSecretNumUses: 1 }
+            },
+            {
+                new: true
+            }
+        );
 
     const identityAccessToken = await new IdentityAccessToken({
         identity: identityUniversalAuth.identity,
@@ -300,11 +395,110 @@ export const loginIdentityUniversalAuth = async (req: Request, res: Response) =>
     return res.status(200).send({
         accessToken,
         expiresIn: identityUniversalAuth.accessTokenTTL,
-        tokenType: "Bearer"
+        accessTokenMaxTTL: identityUniversalAuth.accessTokenMaxTTL,
+        tokenType: "Bearer",
     });
 }
 
-export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
+/**
+ * Attach identity universal auth method onto identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
+export const attachIdentityUniversalAuth = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Attach Universal Auth configuration onto identity'
+        #swagger.description = 'Attach Universal Auth configuration onto identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity to attach Universal Auth onto",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientSecretTrustedIps": {
+                                type: "array",
+                                items: {
+                                    type: "object",
+                                    "properties": {
+                                        "ipAddress": {
+                                            type: "string",
+                                            description: "IP address to trust",
+                                            default: "0.0.0.0/0"
+                                        }
+                                    }
+                                },
+                                "description": "List of IPs or CIDR ranges that the Client Secret can be used from together with the Client ID to get back an access token. By default, Client Secrets are given the 0.0.0.0/0 entry representing all possible IPv4 addresses.",
+                                "example": "...",
+                                "default": [{ ipAddress: "0.0.0.0/0" }]
+                            },
+                            "accessTokenTTL": {
+                                "type": "number",
+                                "description": "The incremental lifetime for an acccess token in seconds; a value of 0 implies an infinite incremental lifetime.",
+                                "example": "...",
+                                "default": 100
+                            },
+                            "accessTokenMaxTTL": {
+                                "type": "number",
+                                "description": "The maximum lifetime for an acccess token in seconds; a value of 0 implies an infinite maximum lifetime.",
+                                "example": "...",
+                                "default": 2592000
+                            },
+                            "accessTokenNumUsesLimit": {
+                                "type": "number",
+                                "description": "The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses.",
+                                "example": "...",
+                                "default": 0
+                            },
+                            "accessTokenTrustedIps": {
+                                type: "array",
+                                items: {
+                                    type: "object",
+                                    "properties": {
+                                        "ipAddress": {
+                                            type: "string",
+                                            description: "IP address to trust",
+                                            default: "0.0.0.0/0"
+                                        }
+                                    }
+                                },
+                                "description": "List of IPs or CIDR ranges that access tokens can be used from. By default, each token is given the 0.0.0.0/0 entry representing all possible IPv4 addresses.",
+                                "example": "...",
+                                "default": [{ ipAddress: "0.0.0.0/0" }]
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identityUniversalAuth": {
+                                $ref: '#/definitions/IdentityUniversalAuth'
+                            }
+                        },
+                        "description": "Details of attached Universal Auth"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId },
         body: {
@@ -328,7 +522,7 @@ export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
     if (!identityMembershipOrg) throw ResourceNotFoundError({
         message: `Failed to find identity with id ${identityId}`
     });
-    
+
     if (identityMembershipOrg.identity?.authMethod) throw BadRequestError({
         message: "Failed to add universal auth to already-configured identity"
     });
@@ -377,7 +571,7 @@ export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
 
         return extractIPDetails(accessTokenTrustedIp.ipAddress);
     });
-    
+
     const identityUniversalAuth = await new IdentityUniversalAuth({
         identity: identityMembershipOrg.identity._id,
         clientId: crypto.randomUUID(),
@@ -387,7 +581,7 @@ export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
         accessTokenNumUsesLimit,
         accessTokenTrustedIps: reformattedAccessTokenTrustedIps,
     }).save();
-    
+
     await Identity.findByIdAndUpdate(
         identityMembershipOrg.identity._id,
         {
@@ -415,7 +609,98 @@ export const addIdentityUniversalAuth = async (req: Request, res: Response) => {
     });
 }
 
+/**
+ * Update identity universal auth method on identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
 export const updateIdentityUniversalAuth = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Update Universal Auth configuration on identity'
+        #swagger.description = 'Update Universal Auth configuration on identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity to update Universal Auth on",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientSecretTrustedIps": {
+                                type: "array",
+                                items: {
+                                    type: "object",
+                                    "properties": {
+                                        "ipAddress": {
+                                            type: "string",
+                                            description: "IP address to trust"
+                                        }
+                                    }
+                                },
+                                "description": "List of IPs or CIDR ranges that the Client Secret can be used from together with the Client ID to get back an access token. By default, Client Secrets are given the 0.0.0.0/0 entry representing all possible IPv4 addresses.",
+                                "example": "...",
+                            },
+                            "accessTokenTTL": {
+                                "type": "number",
+                                "description": "The incremental lifetime for an acccess token in seconds; a value of 0 implies an infinite incremental lifetime.",
+                                "example": "...",
+                            },
+                            "accessTokenMaxTTL": {
+                                "type": "number",
+                                "description": "The maximum lifetime for an acccess token in seconds; a value of 0 implies an infinite maximum lifetime.",
+                                "example": "...",
+                            },
+                            "accessTokenNumUsesLimit": {
+                                "type": "number",
+                                "description": "The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses.",
+                                "example": "...",
+                            },
+                            "accessTokenTrustedIps": {
+                                type: "array",
+                                items: {
+                                    type: "object",
+                                    "properties": {
+                                        "ipAddress": {
+                                            type: "string",
+                                            description: "IP address to trust"
+                                        }
+                                    }
+                                },
+                                "description": "List of IPs or CIDR ranges that access tokens can be used from. By default, each token is given the 0.0.0.0/0 entry representing all possible IPv4 addresses.",
+                                "example": "...",
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identityUniversalAuth": {
+                                $ref: '#/definitions/IdentityUniversalAuth'
+                            }
+                        },
+                        "description": "Details of updated Universal Auth"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId },
         body: {
@@ -439,7 +724,7 @@ export const updateIdentityUniversalAuth = async (req: Request, res: Response) =
     if (!identityMembershipOrg) throw ResourceNotFoundError({
         message: `Failed to find identity with id ${identityId}`
     });
-    
+
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
         message: "Failed to add universal auth to already-configured identity"
     });
@@ -490,7 +775,7 @@ export const updateIdentityUniversalAuth = async (req: Request, res: Response) =
             return extractIPDetails(accessTokenTrustedIp.ipAddress);
         });
     }
-    
+
     const identityUniversalAuth = await IdentityUniversalAuth.findOneAndUpdate(
         {
             identity: identityMembershipOrg.identity._id,
@@ -527,11 +812,47 @@ export const updateIdentityUniversalAuth = async (req: Request, res: Response) =
     });
 }
 
+/**
+ * Return identity universal auth method on identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
 export const getIdentityUniversalAuth = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Retrieve Universal Auth configuration on identity'
+        #swagger.description = 'Retrieve Universal Auth configuration on identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity to retrieve Universal Auth on",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identityUniversalAuth": {
+                                $ref: '#/definitions/IdentityUniversalAuth'
+                            }
+                        },
+                        "description": "Details of retrieved Universal Auth"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId }
     } = await validateRequest(reqValidator.GetUniversalAuthForIdentityV1, req);
-    
+
     const identityMembershipOrg = await IdentityMembershipOrg
         .findOne({
             identity: new Types.ObjectId(identityId)
@@ -558,7 +879,7 @@ export const getIdentityUniversalAuth = async (req: Request, res: Response) => {
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) throw BadRequestError({
         message: "The identity does not have universal auth configured"
     });
-    
+
     const identityUniversalAuth = await IdentityUniversalAuth.findOne({
         identity: identityMembershipOrg.identity._id,
     });
@@ -578,7 +899,77 @@ export const getIdentityUniversalAuth = async (req: Request, res: Response) => {
     });
 }
 
+
+/**
+ * Create client secret for identity universal auth method on identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
 export const createUniversalAuthClientSecret = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Create Universal Auth Client Secret for identity'
+        #swagger.description = 'Create Universal Auth Client Secret for identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity to create Universal Auth Client Secret for",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "description": {
+                                "type": "string",
+                                "description": "A description for the Client Secret to create.",
+                                "example": "..."
+                            },
+                            "ttl": {
+                                "type": "number",
+                                "description": "The time-to-live for the Client Secret to create. By default, the TTL will be set to 0 which implies that the Client Secret will never expire; a value of 0 implies an infinite lifetime.",
+                                "example": "...",
+                                "default": 0
+                            },
+                            "numUsesLimit": {
+                                "type": "number",
+                                "description": "The maximum number of times that the Client Secret can be used together with the Client ID to get back an access token; a value of 0 implies infinite number of uses.",
+                                "example": "...",
+                                "default": 0
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientSecret": {
+                                "type": "string",
+                                "description": "The created Client Secret"
+                            },
+                            "clientSecretData": {
+                                $ref: '#/definitions/IdentityUniversalAuthClientSecretData'
+                            }
+                        },
+                        "description": "Details of the created Client Secret"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId },
         body: {
@@ -625,11 +1016,11 @@ export const createUniversalAuthClientSecret = async (req: Request, res: Respons
 
     const clientSecret = crypto.randomBytes(32).toString("hex");
     const clientSecretHash = await bcrypt.hash(clientSecret, await getSaltRounds());
-    
+
     const identityUniversalAuth = await IdentityUniversalAuth.findOne({
         identity: identityMembershipOrg.identity._id
     });
-    
+
     if (!identityUniversalAuth) throw ResourceNotFoundError();
 
     const identityUniversalAuthClientSecret = await new IdentityUniversalAuthClientSecret({
@@ -661,11 +1052,50 @@ export const createUniversalAuthClientSecret = async (req: Request, res: Respons
     });
 }
 
-export const getUniversalAuthClientSecrets = async (req: Request, res: Response) => {
+/**
+ * Return list of client secret details for identity universal auth method on identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
+export const getUniversalAuthClientSecretsDetails = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'List Universal Auth Client Secrets for identity'
+        #swagger.description = 'List Universal Auth Client Secrets for identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity for which to get Client Secrets for",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientSecretData": {
+                                type: "array",
+                                items: {
+                                    $ref: '#/definitions/IdentityUniversalAuthClientSecretData'
+                                }
+                            }
+                        },
+                        "description": "Details of the Client Secrets"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId }
     } = await validateRequest(reqValidator.GetUniversalAuthClientSecretsV1, req);
-    
+
     const identityMembershipOrg = await IdentityMembershipOrg.findOne({
         identity: new Types.ObjectId(identityId)
     }).populate<{
@@ -721,11 +1151,54 @@ export const getUniversalAuthClientSecrets = async (req: Request, res: Response)
     });
 }
 
+/**
+ * Revoke client secret for identity universal auth method on identity with id [identityId]
+ * @param req 
+ * @param res 
+ */
 export const revokeUniversalAuthClientSecret = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Revoke Universal Auth Client Secret for identity'
+        #swagger.description = 'Revoke Universal Auth Client Secret for identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity under which Client Secret was issued for",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+
+        #swagger.parameters['clientSecretId'] = {
+            "description": "ID of Client Secret to revoke",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "clientSecretData": {
+                                $ref: '#/definitions/IdentityUniversalAuthClientSecretData'
+                            }
+                        },
+                        "description": "Details of the revoked Client Secret"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId, clientSecretId }
     } = await validateRequest(reqValidator.RevokeUniversalAuthClientSecretV1, req);
-    
+
     const identityMembershipOrg = await IdentityMembershipOrg
         .findOne({
             identity: new Types.ObjectId(identityId)
@@ -773,7 +1246,7 @@ export const revokeUniversalAuthClientSecret = async (req: Request, res: Respons
     );
 
     if (!clientSecretData) throw ResourceNotFoundError();
-    
+
     await EEAuditLogService.createAuditLog(
         req.authData,
         {

backend/src/controllers/v2/organizationsController.ts

@@ -33,11 +33,12 @@ import { ForbiddenError } from "@casl/ability";
  */
 export const getOrganizationMemberships = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Return organization memberships'
-    #swagger.description = 'Return organization memberships'
+    #swagger.summary = 'Return organization user memberships'
+    #swagger.description = 'Return organization user memberships'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
 	#swagger.parameters['organizationId'] = {
@@ -94,11 +95,12 @@ export const getOrganizationMemberships = async (req: Request, res: Response) =>
  */
 export const updateOrganizationMembership = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Update organization membership'
-    #swagger.description = 'Update organization membership'
+    #swagger.summary = 'Update organization user membership'
+    #swagger.description = 'Update organization user membership'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
 	#swagger.parameters['organizationId'] = {
@@ -214,11 +216,12 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
  */
 export const deleteOrganizationMembership = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Delete organization membership'
-    #swagger.description = 'Delete organization membership'
+    #swagger.summary = 'Delete organization user membership'
+    #swagger.description = 'Delete organization user membership'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
 	#swagger.parameters['organizationId'] = {
@@ -425,6 +428,40 @@ export const deleteOrganizationById = async (req: Request, res: Response) => {
  * @returns 
  */
  export const getOrganizationIdentityMemberships = async (req: Request, res: Response) => {
+   /*
+    #swagger.summary = 'Return organization identity memberships'
+    #swagger.description = 'Return organization identity memberships'
+
+    #swagger.security = [{
+        "bearerAuth": []
+    }]
+    
+    #swagger.parameters['organizationId'] = {
+        "description": "ID of organization",
+        "required": true,
+        "type": "string",
+        "in": "path"
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+              "schema": { 
+                "type": "object",
+                "properties": {
+                  "identityMemberships": {
+                    "type": "array",
+                    "items": {
+                      $ref: "#/components/schemas/IdentityMembershipOrg" 
+                    },
+                    "description": "Identity memberships of organization"
+                  }
+                }
+              }
+            }           
+        }
+    }
+  */
   const {
     params: { organizationId }
   } = await validateRequest(reqValidator.GetOrgIdentityMembershipsV2, req);

backend/src/controllers/v2/workspaceController.ts

@@ -1,10 +1,10 @@
 import { Request, Response } from "express";
 import { Types } from "mongoose";
-import { 
+import {
   IIdentity,
   IdentityMembership,
   IdentityMembershipOrg,
-  Key, 
+  Key,
   Membership,
   ServiceTokenData,
   Workspace
@@ -182,11 +182,11 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
         "apiKeyAuth": []
     }]
 
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['workspaceId'] = {
+    "description": "ID of project",
+    "required": true,
+    "type": "string"
+  } 
 
     #swagger.responses[200] = {
         content: {
@@ -211,7 +211,7 @@ export const getWorkspaceKey = async (req: Request, res: Response) => {
     receiver: req.user._id
   }).populate("sender", "+publicKey");
 
-  if (!key) throw new Error("Failed to find workspace key");
+  if (!key) throw new Error(`getWorkspaceKey: Failed to find workspace key [workspaceId=${workspaceId}] [receiver=${req.user._id}]`);
 
   await EEAuditLogService.createAuditLog(
     req.authData,
@@ -249,33 +249,34 @@ export const getWorkspaceServiceTokenData = async (req: Request, res: Response)
  */
 export const getWorkspaceMemberships = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Return project memberships'
-    #swagger.description = 'Return project memberships'
+    #swagger.summary = 'Return project user memberships'
+    #swagger.description = 'Return project user memberships'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['workspaceId'] = {
+    "description": "ID of project",
+    "required": true,
+    "type": "string"
+  } 
 
     #swagger.responses[200] = {
         content: {
             "application/json": {
                 "schema": { 
                     "type": "object",
-					"properties": {
-						"memberships": {
-							"type": "array",
-							"items": {
-								$ref: "#/components/schemas/Membership" 
-							},
-							"description": "Memberships of project"
-						}
-					}
+          "properties": {
+            "memberships": {
+              "type": "array",
+              "items": {
+                $ref: "#/components/schemas/Membership" 
+              },
+              "description": "Memberships of project"
+            }
+          }
                 }
             }           
         }
@@ -312,26 +313,27 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
  */
 export const updateWorkspaceMembership = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Update project membership'
-    #swagger.description = 'Update project membership'
+    #swagger.summary = 'Update project user membership'
+    #swagger.description = 'Update project user membership'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['workspaceId'] = {
+    "description": "ID of project",
+    "required": true,
+    "type": "string"
+  } 
 
-	#swagger.parameters['membershipId'] = {
-		"description": "ID of project membership to update",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['membershipId'] = {
+    "description": "ID of project membership to update",
+    "required": true,
+    "type": "string"
+  } 
 
-	#swagger.requestBody = {
+  #swagger.requestBody = {
       "required": true,
       "content": {
         "application/json": {
@@ -340,7 +342,7 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
             "properties": {
                 "role": {
                     "type": "string",
-                    "description": "Role of membership - either admin or member",
+                    "description": "Role to update to for project membership",
                 }
             }
           }
@@ -352,13 +354,13 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
         content: {
             "application/json": {
                 "schema": { 
-					"type": "object",
-					"properties": {
-						"membership": {
-							$ref: "#/components/schemas/Membership",
-							"description": "Updated membership"
-						}
-					}
+          "type": "object",
+          "properties": {
+            "membership": {
+              $ref: "#/components/schemas/Membership",
+              "description": "Updated membership"
+            }
+          }
                 }
             }           
         }
@@ -402,36 +404,37 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
  */
 export const deleteWorkspaceMembership = async (req: Request, res: Response) => {
   /* 
-    #swagger.summary = 'Delete project membership'
-    #swagger.description = 'Delete project membership'
+    #swagger.summary = 'Delete project user membership'
+    #swagger.description = 'Delete project user membership'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
-	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['workspaceId'] = {
+    "description": "ID of project",
+    "required": true,
+    "type": "string"
+  } 
 
-	#swagger.parameters['membershipId'] = {
-		"description": "ID of project membership to delete",
-		"required": true,
-		"type": "string"
-	} 
+  #swagger.parameters['membershipId'] = {
+    "description": "ID of project membership to delete",
+    "required": true,
+    "type": "string"
+  } 
 
     #swagger.responses[200] = {
         content: {
             "application/json": {
                 "schema": { 
-					"type": "object",
-					"properties": {
-						"membership": {
-							$ref: "#/components/schemas/Membership",
-							"description": "Deleted membership"
-						}
-					}
+          "type": "object",
+          "properties": {
+            "membership": {
+              $ref: "#/components/schemas/Membership",
+              "description": "Deleted membership"
+            }
+          }
                 }
             }           
         }
@@ -511,14 +514,14 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
  * @param req 
  * @param res 
  */
- export const addIdentityToWorkspace = async (req: Request, res: Response) => {
+export const addIdentityToWorkspace = async (req: Request, res: Response) => {
   const {
     params: { workspaceId, identityId },
     body: {
       role
     }
   } = await validateRequest(reqValidator.AddIdentityToWorkspaceV2, req);
-  
+
   const { permission } = await getAuthDataProjectPermissions({
     authData: req.authData,
     workspaceId: new Types.ObjectId(workspaceId)
@@ -538,7 +541,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     message: `Identity with id ${identityId} already exists in project with id ${workspaceId}`
   });
 
-  
+
   const workspace = await Workspace.findById(workspaceId);
   if (!workspace) throw ResourceNotFoundError();
 
@@ -550,16 +553,16 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
   if (!identityMembershipOrg) throw ResourceNotFoundError({
     message: `Failed to find identity with id ${identityId}`
   });
-  
+
   if (!identityMembershipOrg.organization.equals(workspace.organization)) throw BadRequestError({
     message: "Failed to add identity to project in another organization"
   });
 
   const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
-  
+
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
-      message: "Failed to add identity to project with more privileged role"
+    message: "Failed to add identity to project with more privileged role"
   });
 
   let customRole;
@@ -571,18 +574,18 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
         isOrgRole: false,
         workspace: new Types.ObjectId(workspaceId)
       });
-      
+
       if (!customRole) throw BadRequestError({ message: "Role not found" });
     }
   }
-  
+
   identityMembership = await new IdentityMembership({
     identity: identityMembershipOrg.identity,
     workspace: new Types.ObjectId(workspaceId),
     role: customRole ? CUSTOM : role,
     customRole
   }).save();
-  
+
   return res.status(200).send({
     identityMembership
   });
@@ -595,13 +598,66 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
  * @param res 
  */
  export const updateIdentityWorkspaceRole = async (req: Request, res: Response) => {
+   /* 
+    #swagger.summary = 'Update project identity membership'
+    #swagger.description = 'Update project identity membership'
+    
+    #swagger.security = [{
+        "bearerAuth": []
+    }]
+
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
+
+	#swagger.parameters['identityId'] = {
+		"description": "ID of identity whose membership to update in project",
+		"required": true,
+		"type": "string"
+	} 
+
+	#swagger.requestBody = {
+      "required": true,
+      "content": {
+        "application/json": {
+          "schema": {
+            "type": "object",
+            "properties": {
+                "role": {
+                    "type": "string",
+                    "description": "Role to update to for identity project membership",
+                }
+            }
+          }
+        }
+      }
+    }
+
+    #swagger.responses[200] = {
+        content: {
+          "application/json": {
+            "schema": { 
+              "type": "object",
+              "properties": {
+                "identityMembership": {
+                  $ref: "#/components/schemas/IdentityMembership",
+                  "description": "Updated identity membership"
+                }
+              }
+            }
+          }           
+        }
+    }   
+    */
   const {
     params: { workspaceId, identityId },
     body: {
       role
     }
   } = await validateRequest(reqValidator.UpdateIdentityWorkspaceRoleV2, req);
-  
+
   const { permission } = await getAuthDataProjectPermissions({
     authData: req.authData,
     workspaceId: new Types.ObjectId(workspaceId)
@@ -611,7 +667,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     ProjectPermissionActions.Edit,
     ProjectPermissionSub.Identity
   );
-  
+
   let identityMembership = await IdentityMembership
     .findOne({
       identity: new Types.ObjectId(identityId),
@@ -625,21 +681,21 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
   if (!identityMembership) throw BadRequestError({
     message: `Identity with id ${identityId} does not exist in project with id ${workspaceId}`
   });
-  
+
   const identityRolePermission = await getWorkspaceRolePermissions(
-    identityMembership?.customRole?.slug ?? identityMembership.role, 
+    identityMembership?.customRole?.slug ?? identityMembership.role,
     identityMembership.workspace.toString()
   );
   const isAsPrivilegedAsIdentity = isAtLeastAsPrivilegedWorkspace(permission, identityRolePermission);
   if (!isAsPrivilegedAsIdentity) throw ForbiddenRequestError({
-      message: "Failed to update role of more privileged identity"
+    message: "Failed to update role of more privileged identity"
   });
 
   const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
-  
+
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
-      message: "Failed to update identity to a more privileged role"
+    message: "Failed to update identity to a more privileged role"
   });
 
   let customRole;
@@ -651,11 +707,11 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
         isOrgRole: false,
         workspace: new Types.ObjectId(workspaceId)
       });
-      
+
       if (!customRole) throw BadRequestError({ message: "Role not found" });
     }
   }
-  
+
   identityMembership = await IdentityMembership.findOneAndUpdate(
     {
       identity: identityMembership.identity._id,
@@ -676,16 +732,52 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
 }
 
 /**
- * Delete identity with id [identityId] to workspace
+ * Delete identity with id [identityId] from workspace
  * with id [workspaceId]
  * @param req 
  * @param res 
  */
  export const deleteIdentityFromWorkspace = async (req: Request, res: Response) => {
+   /* 
+    #swagger.summary = 'Delete project identity membership'
+    #swagger.description = 'Delete project identity membership'
+    
+    #swagger.security = [{
+        "bearerAuth": []
+    }]
+
+	#swagger.parameters['workspaceId'] = {
+		"description": "ID of project",
+		"required": true,
+		"type": "string"
+	} 
+
+	#swagger.parameters['identityId'] = {
+		"description": "ID of identity whose membership to delete in project",
+		"required": true,
+		"type": "string"
+	} 
+
+    #swagger.responses[200] = {
+        content: {
+          "application/json": {
+            "schema": { 
+              "type": "object",
+              "properties": {
+                "identityMembership": {
+                  $ref: "#/components/schemas/IdentityMembership",
+                  "description": "Deleted identity membership"
+                }
+              }
+            }
+          }           
+        }
+    }   
+    */
   const {
     params: { workspaceId, identityId }
   } = await validateRequest(reqValidator.DeleteIdentityFromWorkspaceV2, req);
-  
+
   const { permission } = await getAuthDataProjectPermissions({
     authData: req.authData,
     workspaceId: new Types.ObjectId(workspaceId)
@@ -695,7 +787,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
     ProjectPermissionActions.Delete,
     ProjectPermissionSub.Identity
   );
-  
+
   const identityMembership = await IdentityMembership
     .findOne({
       identity: new Types.ObjectId(identityId),
@@ -705,20 +797,20 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
       identity: IIdentity,
       customRole: IRole
     }>("identity customRole");
-  
+
   if (!identityMembership) throw ResourceNotFoundError({
     message: `Identity with id ${identityId} does not exist in project with id ${workspaceId}`
   });
-  
+
   const identityRolePermission = await getWorkspaceRolePermissions(
-    identityMembership?.customRole?.slug ?? identityMembership.role, 
+    identityMembership?.customRole?.slug ?? identityMembership.role,
     identityMembership.workspace.toString()
   );
   const isAsPrivilegedAsIdentity = isAtLeastAsPrivilegedWorkspace(permission, identityRolePermission);
   if (!isAsPrivilegedAsIdentity) throw ForbiddenRequestError({
-      message: "Failed to remove more privileged identity from project"
+    message: "Failed to remove more privileged identity from project"
   });
-  
+
   await IdentityMembership.findByIdAndDelete(identityMembership._id);
 
   return res.status(200).send({
@@ -733,10 +825,44 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
  * @returns 
  */
  export const getWorkspaceIdentityMemberships = async (req: Request, res: Response) => {
+   /*
+    #swagger.summary = 'Return project identity memberships'
+    #swagger.description = 'Return project identity memberships'
+
+    #swagger.security = [{
+        "bearerAuth": []
+    }]
+    
+    #swagger.parameters['workspaceId'] = {
+        "description": "ID of project",
+        "required": true,
+        "type": "string",
+        "in": "path"
+    }
+
+    #swagger.responses[200] = {
+        content: {
+            "application/json": {
+              "schema": { 
+                "type": "object",
+                "properties": {
+                  "identityMemberships": {
+                    "type": "array",
+                    "items": {
+                      $ref: "#/components/schemas/IdentityMembership" 
+                    },
+                    "description": "Identity memberships of project"
+                  }
+                }
+              }
+            }           
+        }
+    }
+  */
   const {
     params: { workspaceId }
   } = await validateRequest(reqValidator.GetWorkspaceIdentityMembersV2, req);
-  
+
   const { permission } = await getAuthDataProjectPermissions({
     authData: req.authData,
     workspaceId: new Types.ObjectId(workspaceId)

backend/src/ee/controllers/v1/identitiesController.ts

@@ -42,6 +42,58 @@ import { ForbiddenError } from "@casl/ability";
  * @returns 
  */
 export const createIdentity = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Create identity'
+        #swagger.description = 'Create identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "name": {
+                                "type": "string",
+                                "description": "Name of entity to create",
+                                "example": "development"
+                            },
+                            "organizationId": {
+                                "type": "string",
+                                "description": "ID of organization where to create identity",
+                                "example": "dev-environment"
+                            },
+                            "role": {
+                                "type": "string",
+                                "description": "Role to assume for organization membership",
+                                "example": "no-access"
+                            }
+                        },
+                        "required": ["name", "organizationId", "role"]
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identity": {
+                                $ref: '#/definitions/Identity'
+                            }
+                        },
+                        "description": "Details of the created identity"
+                    }
+                }
+            }
+        }
+    */
     const {
         body: {
             name,
@@ -120,6 +172,59 @@ export const createIdentity = async (req: Request, res: Response) => {
  * @returns 
  */
  export const updateIdentity = async (req: Request, res: Response) => {
+    /*
+        #swagger.summary = 'Update identity'
+        #swagger.description = 'Update identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity to update",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+        
+        #swagger.requestBody = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "name": {
+                                "type": "string",
+                                "description": "Name of entity to update to",
+                                "example": "development"
+                            },
+                            "role": {
+                                "type": "string",
+                                "description": "Role to update to for organization membership",
+                                "example": "no-access"
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identity": {
+                                $ref: '#/definitions/Identity'
+                            }
+                        },
+                        "description": "Details of the updated identity"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId  },
         body: {
@@ -242,6 +347,37 @@ export const createIdentity = async (req: Request, res: Response) => {
  * @returns 
  */
  export const deleteIdentity = async (req: Request, res: Response) => {
+     /*
+        #swagger.summary = 'Delete identity'
+        #swagger.description = 'Delete identity'
+
+        #swagger.security = [{
+            "bearerAuth": []
+        }]
+
+        #swagger.parameters['identityId'] = {
+            "description": "ID of identity",
+            "required": true,
+            "type": "string",
+            "in": "path"
+        }
+
+        #swagger.responses[200] = {
+            content: {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {
+                            "identity": {
+                                $ref: '#/definitions/Identity'
+                            }
+                        },
+                        "description": "Details of the deleted identity"
+                    }
+                }
+            }
+        }
+    */
     const {
         params: { identityId }
     } = await validateRequest(reqValidator.DeleteIdentityV1, req);

backend/src/ee/controllers/v1/secretApprovalRequestsController.ts

@@ -17,12 +17,12 @@ export const getSecretApprovalRequestCount = async (req: Request, res: Response)
   } = await validateRequest(reqValidator.getSecretApprovalRequestCount, req);
 
   if (!(req.authData.authPayload instanceof User)) return;
-  
+
   const membership = await Membership.findOne({
     user: req.authData.authPayload._id,
     workspace: new Types.ObjectId(workspaceId)
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   const approvalRequestCount = await SecretApprovalRequest.aggregate([
@@ -73,12 +73,12 @@ export const getSecretApprovalRequests = async (req: Request, res: Response) =>
   } = await validateRequest(reqValidator.getSecretApprovalRequests, req);
 
   if (!(req.authData.authPayload instanceof User)) return;
-  
+
   const membership = await Membership.findOne({
     user: req.authData.authPayload._id,
     workspace: new Types.ObjectId(workspaceId)
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   const query = {
@@ -168,13 +168,13 @@ export const getSecretApprovalRequestDetails = async (req: Request, res: Respons
     user: req.authData.authPayload._id,
     workspace: secretApprovalRequest.workspace
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   // allow to fetch only if its admin or is the committer or approver
   if (
     membership.role !== "admin" &&
-    secretApprovalRequest.committer !== membership.id &&
+    !secretApprovalRequest.committer.equals(membership.id) &&
     !secretApprovalRequest.policy.approvers.find(
       (approverId) => approverId.toString() === membership._id.toString()
     )
@@ -215,7 +215,7 @@ export const updateSecretApprovalReviewStatus = async (req: Request, res: Respon
     user: req.authData.authPayload._id,
     workspace: secretApprovalRequest.workspace
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   if (
@@ -257,7 +257,7 @@ export const mergeSecretApprovalRequest = async (req: Request, res: Response) =>
     user: req.authData.authPayload._id,
     workspace: secretApprovalRequest.workspace
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   if (
@@ -307,7 +307,7 @@ export const updateSecretApprovalRequestStatus = async (req: Request, res: Respo
     user: req.authData.authPayload._id,
     workspace: secretApprovalRequest.workspace
   });
-  
+
   if (!membership) throw UnauthorizedRequestError();
 
   if (

backend/src/ee/controllers/v1/workspaceController.ts

@@ -62,15 +62,30 @@ export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) =
     #swagger.description = 'Return project secret snapshots ids'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
 	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
+		"description": "ID of project where to get secret snapshots for",
 		"required": true,
 		"type": "string"
 	} 
 
+	#swagger.parameters['environment'] = {
+      "description": "Slug of environment where to get secret snapshots for",
+      "required": true,
+      "type": "string",
+      "in": "query"
+  }
+
+  #swagger.parameters['directory'] = {
+      "description": "Path where to get secret snapshots for like / or /foo/bar. Default is /",
+      "required": false,
+      "type": "string",
+      "in": "query"
+  }
+
 	#swagger.parameters['offset'] = {
 		"description": "Number of secret snapshots to skip",
 		"required": false,
@@ -195,11 +210,12 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
     #swagger.description = 'Roll back project secrets to those captured in a secret snapshot version.'
     
     #swagger.security = [{
-        "apiKeyAuth": []
+        "apiKeyAuth": [],
+        "bearerAuth": []
     }]
 
 	#swagger.parameters['workspaceId'] = {
-		"description": "ID of project",
+		"description": "ID of project where to roll back",
 		"required": true,
 		"type": "string"
 	} 
@@ -211,6 +227,14 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
           "schema": {
             "type": "object",
             "properties": {
+                "environment": {
+                  "type": "string",
+                  "description": "Slug of environment where to roll back"
+                },
+                "directory": {
+                  "type": "string",
+                  "description": "Path where to roll back for like / or /foo/bar. Default is /"
+                },
                 "version": {
                     "type": "integer",
                     "description": "Version of secret snapshot to roll back to",

backend/src/ee/routes/v1/workspace.ts

@@ -7,7 +7,7 @@ import { workspaceController } from "../../controllers/v1";
 router.get(
   "/:workspaceId/secret-snapshots",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.getWorkspaceSecretSnapshots
 );
@@ -23,7 +23,7 @@ router.get(
 router.post(
   "/:workspaceId/secret-snapshots/rollback",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.rollbackWorkspaceSecretSnapshot
 );
@@ -31,7 +31,7 @@ router.post(
 router.get(
   "/:workspaceId/audit-logs",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.getWorkspaceAuditLogs
 );

backend/src/helpers/bot.ts

@@ -13,7 +13,7 @@ import {
   SECRET_SHARED
 } from "../variables";
 import { client, getEncryptionKey, getRootEncryptionKey } from "../config";
-import { InternalServerError } from "../utils/errors";
+import { BotNotFoundError, InternalServerError } from "../utils/errors";
 import { Folder } from "../models";
 import { getFolderByPath } from "../services/FolderService";
 import { getAllImportedSecrets } from "../services/SecretImportService";
@@ -223,7 +223,7 @@ export const getKey = async ({ workspaceId }: { workspaceId: Types.ObjectId }) =
     workspace: workspaceId
   }).populate<{ sender: IUser }>("sender", "publicKey");
 
-  if (!botKey) throw new Error("Failed to find bot key");
+  if (!botKey) throw BotNotFoundError({ message: `getKey: Failed to find bot key for [workspaceId=${workspaceId}]` })
 
   const bot = await Bot.findOne({
     workspace: workspaceId

backend/src/models/identityAccessToken.ts

@@ -53,13 +53,13 @@ const identityAccessTokenSchema = new Schema(
         accessTokenTTL: { // seconds
             // incremental lifetime
             type: Number,
-            default: 7200,
+            default: 2592000, // 30 days
             required: true
         },
         accessTokenMaxTTL: { // seconds
             // max lifetime
             type: Number,
-            default: 7200,
+            default: 2592000, // 30 days 
             required: true
         },
         accessTokenTrustedIps: {

backend/src/routes/v1/secretImps.ts

@@ -7,7 +7,7 @@ import { AuthMode } from "../../variables";
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   secretImpsController.createSecretImp
 );
@@ -15,7 +15,7 @@ router.post(
 router.put(
   "/:id",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   secretImpsController.updateSecretImport
 );
@@ -23,7 +23,7 @@ router.put(
 router.delete(
   "/:id",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   secretImpsController.deleteSecretImport
 );
@@ -31,7 +31,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   secretImpsController.getSecretImports
 );

backend/src/routes/v1/secretsFolder.ts

@@ -12,7 +12,7 @@ import { AuthMode } from "../../variables";
 router.post(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   createFolder
 );
@@ -20,7 +20,7 @@ router.post(
 router.patch(
   "/:folderName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   updateFolderById
 );
@@ -28,7 +28,7 @@ router.patch(
 router.delete(
   "/:folderName",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   deleteFolder
 );
@@ -36,7 +36,7 @@ router.delete(
 router.get(
   "/",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.SERVICE_TOKEN, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   getFolders
 );

backend/src/routes/v1/universalAuth.ts

@@ -18,15 +18,15 @@ router.post(
 router.post(
     "/universal-auth/identities/:identityId",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
-    universalAuthController.addIdentityUniversalAuth
+    universalAuthController.attachIdentityUniversalAuth
 );
 
 router.patch(
     "/universal-auth/identities/:identityId",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
     universalAuthController.updateIdentityUniversalAuth
 );
@@ -34,7 +34,7 @@ router.patch(
 router.get(
     "/universal-auth/identities/:identityId",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
     universalAuthController.getIdentityUniversalAuth
 );
@@ -42,7 +42,7 @@ router.get(
 router.post(
     "/universal-auth/identities/:identityId/client-secrets",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
     universalAuthController.createUniversalAuthClientSecret
 );
@@ -50,15 +50,15 @@ router.post(
 router.get(
     "/universal-auth/identities/:identityId/client-secrets",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
-    universalAuthController.getUniversalAuthClientSecrets
+    universalAuthController.getUniversalAuthClientSecretsDetails
 );
 
 router.post(
     "/universal-auth/identities/:identityId/client-secrets/:clientSecretId/revoke",
     requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
     }),
     universalAuthController.revokeUniversalAuthClientSecret
 );

backend/src/routes/v2/environment.ts

@@ -7,7 +7,7 @@ import { AuthMode } from "../../variables";
 router.post(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   environmentController.createWorkspaceEnvironment
 );
@@ -15,7 +15,7 @@ router.post(
 router.put(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   environmentController.renameWorkspaceEnvironment
 );
@@ -23,7 +23,7 @@ router.put(
 router.patch(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   environmentController.reorderWorkspaceEnvironments
 );
@@ -31,7 +31,7 @@ router.patch(
 router.delete(
   "/:workspaceId/environments",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   environmentController.deleteWorkspaceEnvironment
 );

backend/src/routes/v2/organizations.ts

@@ -9,7 +9,7 @@ import { organizationsController } from "../../controllers/v2";
 router.get(
   "/:organizationId/memberships",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   organizationsController.getOrganizationMemberships
 );
@@ -17,7 +17,7 @@ router.get(
 router.patch(
   "/:organizationId/memberships/:membershipId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   organizationsController.updateOrganizationMembership
 );
@@ -25,7 +25,7 @@ router.patch(
 router.delete(
   "/:organizationId/memberships/:membershipId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   organizationsController.deleteOrganizationMembership
 );
@@ -33,7 +33,7 @@ router.delete(
 router.get(
   "/:organizationId/workspaces",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   organizationsController.getOrganizationWorkspaces
 );

backend/src/routes/v2/workspace.ts

@@ -62,7 +62,7 @@ router.get(
   // new - TODO: rewire dashboard to this route
   "/:workspaceId/memberships",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.getWorkspaceMemberships
 );
@@ -71,7 +71,7 @@ router.patch(
   // TODO - rewire dashboard to this route
   "/:workspaceId/memberships/:membershipId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.updateWorkspaceMembership
 );
@@ -80,7 +80,7 @@ router.delete(
   // TODO - rewire dashboard to this route
   "/:workspaceId/memberships/:membershipId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.deleteWorkspaceMembership
 );
@@ -96,7 +96,7 @@ router.patch(
 router.post(
   "/:workspaceId/identity-memberships/:identityId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.addIdentityToWorkspace
 );
@@ -104,7 +104,7 @@ router.post(
 router.patch(
   "/:workspaceId/identity-memberships/:identityId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.updateIdentityWorkspaceRole
 );
@@ -112,7 +112,7 @@ router.patch(
 router.delete(
   "/:workspaceId/identity-memberships/:identityId",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.deleteIdentityFromWorkspace
 );
@@ -120,7 +120,7 @@ router.delete(
 router.get(
   "/:workspaceId/identity-memberships",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT]
+    acceptedAuthModes: [AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]
   }),
   workspaceController.getWorkspaceIdentityMemberships
 );

backend/src/services/TelemetryService.ts

@@ -8,12 +8,12 @@ import {
   getTelemetryEnabled,
 } from "../config";
 import {
+  Identity,
   ServiceTokenData,
-  User,
+  User
 } from "../models";
 import {
   AccountNotFoundError,
-  BadRequestError,
 } from "../utils/errors";
 
 class Telemetry {
@@ -22,7 +22,7 @@ class Telemetry {
    */
   static logTelemetryMessage = async () => {
 
-    if(!(await getTelemetryEnabled())){
+    if (!(await getTelemetryEnabled())) {
       [
         "To improve, Infisical collects telemetry data about general usage.",
         "This helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth as we support Infisical as open-source software.",
@@ -42,8 +42,8 @@ class Telemetry {
       postHogClient = new PostHog(await getPostHogProjectApiKey(), {
         host: await getPostHogHost(),
       });
-    } 
-    
+    }
+
     return postHogClient;
   }
 
@@ -52,6 +52,7 @@ class Telemetry {
   }: {
     authData: AuthData;
   }) => {
+
     let distinctId = "";
     if (authData.authPayload instanceof User) {
       distinctId = authData.authPayload.email;
@@ -59,14 +60,14 @@ class Telemetry {
       if (authData.authPayload.user) {
         const user = await User.findById(authData.authPayload.user, "email");
         if (!user) throw AccountNotFoundError();
-        distinctId = user.email; 
+        distinctId = user.email;
       }
+    } else if (authData.authPayload instanceof Identity) {
+      distinctId = `identity-${authData.authPayload._id.toString()}`
+    } else {
+      distinctId = "unknown-auth-data"
     }
-    
-    if (distinctId === "") throw BadRequestError({
-      message: "Failed to obtain distinct id for logging telemetry",
-    });
-    
+
     return distinctId;
   }
 }

backend/src/utils/authn/passport/saml.ts

@@ -75,7 +75,7 @@ export const initializeSamlStrategy = async () => {
           const organization = await Organization.findById(req.ssoConfig.organization);
           
           if (!organization) return done(OrganizationNotFoundError());
-    
+          
           const email = profile.email;
           const firstName = profile.firstName;
           const lastName = profile.lastName;
@@ -154,6 +154,7 @@ export const initializeSamlStrategy = async () => {
               firstName,
               lastName,
               organizationName: organization?.name,
+              organizationId: organization?._id,
               authMethod: req.ssoConfig.authProvider,
               isUserCompleted,
               ...(req.body.RelayState ? {

backend/src/validation/auth.ts

@@ -116,8 +116,12 @@ export const AddUniversalAuthToIdentityV1 = z.object({
       .array()
       .min(1)
       .default([{ ipAddress: "0.0.0.0/0" }]),
-    accessTokenTTL: z.number().int().min(0).default(7200),
-    accessTokenMaxTTL: z.number().int().min(0).default(0),
+    accessTokenTTL: z.number().int().min(1).refine(value => value !== 0, {
+      message: "accessTokenTTL must have a non zero number",
+    }).default(2592000),
+    accessTokenMaxTTL: z.number().int().refine(value => value !== 0, {
+      message: "accessTokenMaxTTL must have a non zero number",
+    }).default(2592000), // 30 days
     accessTokenNumUsesLimit: z.number().int().min(0).default(0)
   })
 });
@@ -143,7 +147,9 @@ export const UpdateUniversalAuthToIdentityV1 = z.object({
       .optional(),
     accessTokenTTL: z.number().int().min(0).optional(),
     accessTokenNumUsesLimit: z.number().int().min(0).optional(),
-    accessTokenMaxTTL: z.number().int().min(0).default(0),
+    accessTokenMaxTTL: z.number().int().refine(value => value !== 0, {
+      message: "accessTokenMaxTTL must have a non zero number",
+    }).optional(),
   }),
 });
 

backend/src/validation/secrets.ts

@@ -429,6 +429,9 @@ export const UpdateSecretByNameBatchV3 = z.object({
         secretValueCiphertext: z.string().trim(),
         secretValueIV: z.string().trim(),
         secretValueTag: z.string().trim(),
+        secretKeyCiphertext: z.string().trim(),
+        secretKeyIV: z.string().trim(),
+        secretKeyTag: z.string().trim(),
         secretCommentCiphertext: z.string().trim().optional(),
         secretCommentIV: z.string().trim().optional(),
         secretCommentTag: z.string().trim().optional(),

backend/swagger/index.ts

@@ -30,7 +30,7 @@ const generateOpenAPISpec = async () => {
         type: "http",
         scheme: "bearer",
         bearerFormat: "JWT",
-        description: "A service token in Infisical"
+        description: "An access token in Infisical"
       },
       apiKeyAuth: {
         type: "apiKey",
@@ -52,6 +52,41 @@ const generateOpenAPISpec = async () => {
         updatedAt: "2023-01-13T14:16:12.210Z",
         createdAt: "2023-01-13T14:16:12.210Z"
       },
+      Identity: {
+        _id: "",
+        name: "Machine 1",
+        authMethod: "universal-auth"
+      },
+      IdentityUniversalAuth: {
+        _id: "",
+        identity: "",
+        clientId: "...",
+        clientSecretTrustedIps: [{
+          ipAddress: "0.0.0.0",
+          type: "ipv4",
+          prefix: "0"
+        }],
+        accessTokenTTL: 7200,
+        accessTokenMaxTTL: 2592000,
+        accessTokenNumUsesLimit: 0,
+        accessTokenTrustedIps: [{
+          ipAddress: "0.0.0.0",
+          type: "ipv4",
+          prefix: "0"
+        }]
+      },
+      IdentityUniversalAuthClientSecretData: {
+        _id: "",
+        identityUniversalAuth: "",
+        isClientSecretRevoked: false,
+        description: "",
+        clientSecretPrefix: "abc",
+        clientSecretNumUses: 0,
+        clientSecretNumUsesLimit: 0,
+        clientSecretTTL: 0,
+        createdAt: "2023-01-13T14:16:12.210Z",
+        updatedAt: "2023-01-13T14:16:12.210Z"
+      },
       Membership: {
         user: {
           _id: "",
@@ -79,6 +114,25 @@ const generateOpenAPISpec = async () => {
         role: "owner",
         status: "accepted"
       },
+      IdentityMembership: {
+        identity: {
+          _id: "",
+          name: "Machine 1",
+          authMethod: "universal-auth"
+        },
+        workspace: "",
+        role: "member"
+      },
+      IdentityMembershipOrg: {
+        identity: {
+          _id: "",
+          name: "Machine 1",
+          authMethod: "universal-auth"
+        },
+        organization: "",
+        role: "member",
+        status: "accepted"
+      },
       Organization: {
         _id: "",
         name: "Acme Corp.",

cli/agent-config.yaml

@@ -0,0 +1,15 @@
+infisical:
+  address: "http://localhost:8080"
+auth:
+  type: "universal-auth"
+  config:
+    client-id: "./client-id"
+    client-secret: "./client-secret"
+    remove_client_secret_on_read: false
+sinks:
+  - type: "file"
+    config:
+      path: "access-token"
+templates:
+  - source-path: my-dot-ev-secret-template
+    destination-path: my-dot-env.env

cli/example-agent-config.yaml

@@ -1,17 +0,0 @@
-infisical:
-  address: "http://localhost:8080"
-auth:
-  type: "token"
-  config:
-    token-path: "./role-id"
-sinks:
-  - type: "file"
-    config:
-      path: "/Users/maidulislam/Desktop/test/infisical-token"
-  - type: "file"
-    config:
-      path: "access-token"
-  - type: "file"
-    config:
-      path: "maiduls-access-token"
-templates:

cli/go.mod

@@ -21,8 +21,9 @@ require (
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/viper v1.8.1
 	github.com/stretchr/testify v1.8.1
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
-	golang.org/x/term v0.11.0
+	golang.org/x/crypto v0.14.0
+	golang.org/x/term v0.13.0
+	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
@@ -56,18 +57,17 @@ require (
 	github.com/subosito/gotenv v1.2.0 // indirect
 	github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c // indirect
 	go.mongodb.org/mongo-driver v1.10.0 // indirect
-	golang.org/x/net v0.7.0 // indirect
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.11.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
 require (
 	github.com/fatih/color v1.13.0
-	github.com/go-resty/resty/v2 v2.7.0
+	github.com/go-resty/resty/v2 v2.10.0
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedib0t/go-pretty v4.3.0+incompatible
 	github.com/manifoldco/promptui v0.9.0

cli/go.sum

@@ -105,8 +105,8 @@ github.com/go-openapi/errors v0.20.2 h1:dxy7PGTqEh94zj2E3h1cUmQQWiM1+aeCROfAr02E
 github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
 github.com/go-openapi/strfmt v0.21.3 h1:xwhj5X6CjXEZZHMWy1zKJxvW9AfHC9pkyUjLvHtKG7o=
 github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
-github.com/go-resty/resty/v2 v2.7.0 h1:me+K9p3uhSmXtrBZ4k9jcEAfJmuC8IivWHwaLZwPrFY=
-github.com/go-resty/resty/v2 v2.7.0/go.mod h1:9PWDzw47qPphMRFfhsyk0NnSgvluHcljSMVIq3w7q0I=
+github.com/go-resty/resty/v2 v2.10.0 h1:Qla4W/+TMmv0fOeeRqzEpXPLfTUnR5HZ1+lGs+CkiCo=
+github.com/go-resty/resty/v2 v2.10.0/go.mod h1:iiP/OpA0CkcL3IGt1O0+/SIItFUbkkyw5BGXiVdTu+A=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -354,6 +354,7 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
@@ -376,9 +377,11 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215165025-cf75a172585e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -414,6 +417,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -451,10 +456,12 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -477,8 +484,10 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -528,11 +537,18 @@ golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -542,11 +558,15 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -599,6 +619,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

cli/packages/api/api.go

@@ -425,24 +425,44 @@ func CallCreateServiceToken(httpClient *resty.Client, request CreateServiceToken
 	return createServiceTokenResponse, nil
 }
 
-func CallServiceTokenV3Refresh(httpClient *resty.Client, request ServiceTokenV3RefreshTokenRequest) (ServiceTokenV3RefreshTokenResponse, error) {
-	var serviceTokenV3RefreshTokenResponse ServiceTokenV3RefreshTokenResponse
+func CallUniversalAuthLogin(httpClient *resty.Client, request UniversalAuthLoginRequest) (UniversalAuthLoginResponse, error) {
+	var universalAuthLoginResponse UniversalAuthLoginResponse
 	response, err := httpClient.
 		R().
-		SetResult(&serviceTokenV3RefreshTokenResponse).
+		SetResult(&universalAuthLoginResponse).
 		SetHeader("User-Agent", USER_AGENT).
 		SetBody(request).
-		Post(fmt.Sprintf("%v/v3/service-token/me/token", config.INFISICAL_URL))
+		Post(fmt.Sprintf("%v/v1/auth/universal-auth/login/", config.INFISICAL_URL))
 
 	if err != nil {
-		return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unable to complete api request [err=%s]", err)
+		return UniversalAuthLoginResponse{}, fmt.Errorf("CallUniversalAuthLogin: Unable to complete api request [err=%s]", err)
 	}
 
 	if response.IsError() {
-		return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
+		return UniversalAuthLoginResponse{}, fmt.Errorf("CallUniversalAuthLogin: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
 	}
 
-	return serviceTokenV3RefreshTokenResponse, nil
+	return universalAuthLoginResponse, nil
+}
+
+func CallUniversalAuthRefreshAccessToken(httpClient *resty.Client, request UniversalAuthRefreshRequest) (UniversalAuthRefreshResponse, error) {
+	var universalAuthRefreshResponse UniversalAuthRefreshResponse
+	response, err := httpClient.
+		R().
+		SetResult(&universalAuthRefreshResponse).
+		SetHeader("User-Agent", USER_AGENT).
+		SetBody(request).
+		Post(fmt.Sprintf("%v/v1/auth/token/renew", config.INFISICAL_URL))
+
+	if err != nil {
+		return UniversalAuthRefreshResponse{}, fmt.Errorf("CallUniversalAuthRefreshAccessToken: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return UniversalAuthRefreshResponse{}, fmt.Errorf("CallUniversalAuthRefreshAccessToken: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
+	}
+
+	return universalAuthRefreshResponse, nil
 }
 
 func CallGetRawSecretsV3(httpClient *resty.Client, request GetRawSecretsV3Request) (GetRawSecretsV3Response, error) {
@@ -461,12 +481,12 @@ func CallGetRawSecretsV3(httpClient *resty.Client, request GetRawSecretsV3Reques
 		return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unable to complete api request [err=%w]", err)
 	}
 
-	if response.IsError() && strings.Contains(response.String(), "Failed to find bot key") {
+	if response.IsError() && strings.Contains(response.String(), "bot_not_found_error") {
 		return GetRawSecretsV3Response{}, fmt.Errorf("project with id %s is a legacy project type, please navigate to project settings and disable end to end encryption then try again", request.WorkspaceId)
 	}
 
 	if response.IsError() {
-		return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unsuccessful response [%v %v] [status-code=%v]", response.Request.Method, response.Request.URL, response.StatusCode())
+		return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
 	}
 
 	return getRawSecretsV3Response, nil

cli/packages/api/model.go

@@ -463,14 +463,27 @@ type CreateServiceTokenResponse struct {
 	ServiceTokenData ServiceTokenData `json:"serviceTokenData"`
 }
 
-type ServiceTokenV3RefreshTokenRequest struct {
-	RefreshToken string `json:"refresh_token"`
+type UniversalAuthLoginRequest struct {
+	ClientSecret string `json:"clientSecret"`
+	ClientId     string `json:"clientId"`
 }
-type ServiceTokenV3RefreshTokenResponse struct {
-	RefreshToken string `json:"refresh_token"`
-	AccessToken  string `json:"access_token"`
-	ExpiresIn    int    `json:"expires_in"`
-	TokenType    string `json:"token_type"`
+
+type UniversalAuthLoginResponse struct {
+	AccessToken       string `json:"accessToken"`
+	AccessTokenTTL    int    `json:"expiresIn"`
+	TokenType         string `json:"tokenType"`
+	AccessTokenMaxTTL int    `json:"accessTokenMaxTTL"`
+}
+
+type UniversalAuthRefreshRequest struct {
+	AccessToken string `json:"accessToken"`
+}
+
+type UniversalAuthRefreshResponse struct {
+	AccessToken       string `json:"accessToken"`
+	AccessTokenTTL    int    `json:"expiresIn"`
+	TokenType         string `json:"tokenType"`
+	AccessTokenMaxTTL int    `json:"accessTokenMaxTTL"`
 }
 
 type GetRawSecretsV3Request struct {

cli/packages/cmd/agent.go

@@ -5,12 +5,13 @@ package cmd
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
 	"os/signal"
+	"path"
 	"strings"
+	"sync"
 	"syscall"
 	"text/template"
 	"time"
@@ -44,8 +45,10 @@ type AuthConfig struct {
 	Config interface{} `yaml:"config"`
 }
 
-type TokenAuthConfig struct {
-	TokenPath string `yaml:"token-path"`
+type UniversalAuth struct {
+	ClientIDPath             string `yaml:"client-id"`
+	ClientSecretPath         string `yaml:"client-secret"`
+	RemoveClientSecretOnRead bool   `yaml:"remove_client_secret_on_read"`
 }
 
 type OAuthConfig struct {
@@ -149,11 +152,12 @@ func ParseAgentConfig(filePath string) (*Config, error) {
 	}
 
 	switch rawConfig.Auth.Type {
-	case "token":
-		var tokenConfig TokenAuthConfig
+	case "universal-auth":
+		var tokenConfig UniversalAuth
 		if err := yaml.Unmarshal(configBytes, &tokenConfig); err != nil {
 			return nil, err
 		}
+
 		config.Auth.Config = tokenConfig
 	case "oauth": // aws, gcp, k8s service account, etc
 		var oauthConfig OAuthConfig
@@ -186,7 +190,9 @@ func ProcessTemplate(templatePath string, data interface{}, accessToken string)
 		"secret": secretFunction,
 	}
 
-	tmpl, err := template.New(templatePath).Funcs(funcs).ParseFiles(templatePath)
+	templateName := path.Base(templatePath)
+
+	tmpl, err := template.New(templateName).Funcs(funcs).ParseFiles(templatePath)
 	if err != nil {
 		return nil, err
 	}
@@ -199,59 +205,231 @@ func ProcessTemplate(templatePath string, data interface{}, accessToken string)
 	return &buf, nil
 }
 
-func refreshTokenAndProcessTemplate(refreshToken string, config *Config, errChan chan error) {
-	for {
-		httpClient := resty.New()
-		httpClient.SetRetryCount(10000).
-			SetRetryMaxWaitTime(20 * time.Second).
-			SetRetryWaitTime(5 * time.Second)
+type TokenManager struct {
+	accessToken                    string
+	accessTokenTTL                 time.Duration
+	accessTokenMaxTTL              time.Duration
+	accessTokenFetchedTime         time.Time
+	accessTokenRefreshedTime       time.Time
+	mutex                          sync.Mutex
+	filePaths                      []Sink // Store file paths if needed
+	templates                      []Template
+	clientIdPath                   string
+	clientSecretPath               string
+	newAccessTokenNotificationChan chan bool
+	removeClientSecretOnRead       bool
+	cachedClientSecret             string
+}
 
-		tokenResponse, err := api.CallServiceTokenV3Refresh(httpClient, api.ServiceTokenV3RefreshTokenRequest{RefreshToken: refreshToken})
-		if err != nil {
-			errChan <- fmt.Errorf("unable to complete renewal because [%s]", err)
-		}
+func NewTokenManager(fileDeposits []Sink, templates []Template, clientIdPath string, clientSecretPath string, newAccessTokenNotificationChan chan bool, removeClientSecretOnRead bool) *TokenManager {
+	return &TokenManager{filePaths: fileDeposits, templates: templates, clientIdPath: clientIdPath, clientSecretPath: clientSecretPath, newAccessTokenNotificationChan: newAccessTokenNotificationChan, removeClientSecretOnRead: removeClientSecretOnRead}
+}
 
-		for _, sinkFile := range config.Sinks {
-			if sinkFile.Type == "file" {
-				err = ioutil.WriteFile(sinkFile.Config.Path, []byte(tokenResponse.AccessToken), 0644)
-				if err != nil {
-					errChan <- err
-					return
-				}
-			} else {
-				errChan <- errors.New("unsupported sink type. Only 'file' type is supported")
-				return
-			}
-		}
+func (tm *TokenManager) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) {
+	tm.mutex.Lock()
+	defer tm.mutex.Unlock()
 
-		refreshToken = tokenResponse.RefreshToken
-		nextRefreshCycle := time.Duration(tokenResponse.ExpiresIn-5) * time.Second // when the next access refresh will happen
+	tm.accessToken = token
+	tm.accessTokenTTL = accessTokenTTL
+	tm.accessTokenMaxTTL = accessTokenMaxTTL
 
-		d, err := time.ParseDuration(nextRefreshCycle.String())
-		if err != nil {
-			errChan <- fmt.Errorf("unable to parse refresh time because %s", err)
-			return
-		}
+	tm.newAccessTokenNotificationChan <- true
+}
 
-		log.Info().Msgf("token refreshed and saved to selected path; next cycle will occur in %s", d.String())
+func (tm *TokenManager) GetToken() string {
+	tm.mutex.Lock()
+	defer tm.mutex.Unlock()
 
-		for _, secretTemplate := range config.Templates {
-			processedTemplate, err := ProcessTemplate(secretTemplate.SourcePath, nil, tokenResponse.AccessToken)
-			if err != nil {
-				errChan <- err
-				return
-			}
+	return tm.accessToken
+}
 
-			if err := WriteBytesToFile(processedTemplate, secretTemplate.DestinationPath); err != nil {
-				errChan <- err
-				return
-			}
-
-			log.Info().Msgf("secret template at path %s has been rendered and saved to path %s", secretTemplate.SourcePath, secretTemplate.DestinationPath)
-		}
-
-		time.Sleep(nextRefreshCycle)
+// Fetches a new access token using client credentials
+func (tm *TokenManager) FetchNewAccessToken() error {
+	clientIDAsByte, err := ReadFile(tm.clientIdPath)
+	if err != nil {
+		return fmt.Errorf("unable to read client id from file path '%s' due to error: %v", tm.clientIdPath, err)
 	}
+
+	clientSecretAsByte, err := ReadFile(tm.clientSecretPath)
+	if err != nil {
+		if len(tm.cachedClientSecret) == 0 {
+			return fmt.Errorf("unable to read client secret from file and no cached client secret found: %v", err)
+		} else {
+			clientSecretAsByte = []byte(tm.cachedClientSecret)
+		}
+	}
+
+	// remove client secret after first read
+	if tm.removeClientSecretOnRead {
+		os.Remove(tm.clientSecretPath)
+	}
+
+	clientId := string(clientIDAsByte)
+	clientSecret := string(clientSecretAsByte)
+
+	// save as cache in memory
+	tm.cachedClientSecret = clientSecret
+
+	err, loginResponse := universalAuthLogin(clientId, clientSecret)
+	if err != nil {
+		return err
+	}
+
+	accessTokenTTL := time.Duration(loginResponse.AccessTokenTTL * int(time.Second))
+	accessTokenMaxTTL := time.Duration(loginResponse.AccessTokenMaxTTL * int(time.Second))
+
+	if accessTokenTTL <= time.Duration(5)*time.Second {
+		util.PrintErrorMessageAndExit("At this this, agent does not support refresh of tokens with 5 seconds or less ttl. Please increase access token ttl and try again")
+	}
+
+	tm.accessTokenFetchedTime = time.Now()
+	tm.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL)
+
+	return nil
+}
+
+// Refreshes the existing access token
+func (tm *TokenManager) RefreshAccessToken() error {
+	httpClient := resty.New()
+	httpClient.SetRetryCount(10000).
+		SetRetryMaxWaitTime(20 * time.Second).
+		SetRetryWaitTime(5 * time.Second)
+
+	accessToken := tm.GetToken()
+	response, err := api.CallUniversalAuthRefreshAccessToken(httpClient, api.UniversalAuthRefreshRequest{AccessToken: accessToken})
+	if err != nil {
+		return err
+	}
+
+	accessTokenTTL := time.Duration(response.AccessTokenTTL * int(time.Second))
+	accessTokenMaxTTL := time.Duration(response.AccessTokenMaxTTL * int(time.Second))
+	tm.accessTokenRefreshedTime = time.Now()
+
+	tm.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL)
+
+	return nil
+}
+
+func (tm *TokenManager) ManageTokenLifecycle() {
+	for {
+		accessTokenMaxTTLExpiresInTime := tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second))
+		accessTokenRefreshedTime := tm.accessTokenRefreshedTime
+
+		if accessTokenRefreshedTime.IsZero() {
+			accessTokenRefreshedTime = tm.accessTokenFetchedTime
+		}
+
+		nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second))
+
+		if tm.accessTokenFetchedTime.IsZero() && tm.accessTokenRefreshedTime.IsZero() {
+			// case: init login to get access token
+			log.Info().Msg("attempting to authenticate...")
+			err := tm.FetchNewAccessToken()
+			if err != nil {
+				log.Error().Msgf("unable to authenticate because %v. Will retry in 30 seconds", err)
+
+				// wait a bit before trying again
+				time.Sleep((30 * time.Second))
+				continue
+			}
+		} else if time.Now().After(accessTokenMaxTTLExpiresInTime) {
+			log.Info().Msgf("token has reached max ttl, attempting to re authenticate...")
+			err := tm.FetchNewAccessToken()
+			if err != nil {
+				log.Error().Msgf("unable to authenticate because %v. Will retry in 30 seconds", err)
+
+				// wait a bit before trying again
+				time.Sleep((30 * time.Second))
+				continue
+			}
+		} else {
+			log.Info().Msgf("attempting to refresh existing token...")
+			err := tm.RefreshAccessToken()
+			if err != nil {
+				log.Error().Msgf("unable to refresh token because %v. Will retry in 30 seconds", err)
+
+				// wait a bit before trying again
+				time.Sleep((30 * time.Second))
+				continue
+			}
+		}
+
+		if accessTokenRefreshedTime.IsZero() {
+			accessTokenRefreshedTime = tm.accessTokenFetchedTime
+		} else {
+			accessTokenRefreshedTime = tm.accessTokenRefreshedTime
+		}
+
+		nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second))
+		accessTokenMaxTTLExpiresInTime = tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second))
+
+		if nextAccessTokenExpiresInTime.After(accessTokenMaxTTLExpiresInTime) {
+			// case: Refreshed so close that the next refresh would occur beyond max ttl (this is because currently, token renew tries to add +access-token-ttl amount of time)
+			// example: access token ttl is 11 sec and max ttl is 30 sec. So it will start with 11 seconds, then 22 seconds but the next time you call refresh it would try to extend it to 33 but max ttl only allows 30, so the token will be valid until 30 before we need to reauth
+			time.Sleep(tm.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime))
+		} else {
+			time.Sleep(tm.accessTokenTTL - (5 * time.Second))
+		}
+	}
+}
+
+func (tm *TokenManager) WriteTokenToFiles() {
+	token := tm.GetToken()
+	for _, sinkFile := range tm.filePaths {
+		if sinkFile.Type == "file" {
+			err := ioutil.WriteFile(sinkFile.Config.Path, []byte(token), 0644)
+			if err != nil {
+				log.Error().Msgf("unable to write file sink to path '%s' because %v", sinkFile.Config.Path, err)
+			}
+
+			log.Info().Msgf("new access token saved to file at path '%s'", sinkFile.Config.Path)
+
+		} else {
+			log.Error().Msg("unsupported sink type. Only 'file' type is supported")
+		}
+	}
+}
+
+func (tm *TokenManager) FetchSecrets() {
+	log.Info().Msgf("template engine started...")
+	for {
+		token := tm.GetToken()
+		if token != "" {
+			for _, secretTemplate := range tm.templates {
+				processedTemplate, err := ProcessTemplate(secretTemplate.SourcePath, nil, token)
+				if err != nil {
+					log.Error().Msgf("template engine: unable to render secrets because %s. Will try again on next cycle", err)
+
+					continue
+				}
+
+				if err := WriteBytesToFile(processedTemplate, secretTemplate.DestinationPath); err != nil {
+					log.Error().Msgf("template engine: unable to write secrets to path because %s. Will try again on next cycle", err)
+
+					continue
+				}
+
+				log.Info().Msgf("template engine: secret template at path %s has been rendered and saved to path %s", secretTemplate.SourcePath, secretTemplate.DestinationPath)
+			}
+
+			// fetch new secrets every 5 minutes (TODO: add PubSub in the future )
+			time.Sleep(5 * time.Minute)
+		}
+	}
+}
+
+func universalAuthLogin(clientId string, clientSecret string) (error, api.UniversalAuthLoginResponse) {
+	httpClient := resty.New()
+	httpClient.SetRetryCount(10000).
+		SetRetryMaxWaitTime(20 * time.Second).
+		SetRetryWaitTime(5 * time.Second)
+
+	tokenResponse, err := api.CallUniversalAuthLogin(httpClient, api.UniversalAuthLoginRequest{ClientId: clientId, ClientSecret: clientSecret})
+	if err != nil {
+		return err, api.UniversalAuthLoginResponse{}
+	}
+
+	return nil, tokenResponse
 }
 
 // runCmd represents the run command
@@ -260,7 +438,7 @@ var agentCmd = &cobra.Command{
 	infisical agent
 	`,
 	Use:                   "agent",
-	Short:                 "Used to launch a client daemon that streamlines authentication and secret retrieval processes in some environments",
+	Short:                 "Used to launch a client daemon that streamlines authentication and secret retrieval processes in various environments",
 	DisableFlagsInUseLine: true,
 	Run: func(cmd *cobra.Command, args []string) {
 
@@ -282,36 +460,31 @@ var agentCmd = &cobra.Command{
 			return
 		}
 
-		errChan := make(chan error)
-		sigChan := make(chan os.Signal, 1)
-
-		signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
-
-		switch configAuthType := agentConfig.Auth.Config.(type) {
-		case TokenAuthConfig:
-			content, err := ReadFile(configAuthType.TokenPath)
-			if err != nil {
-				log.Error().Msgf("unable to read initial token from file path %s because %v", configAuthType.TokenPath, err)
-				return
-			}
-
-			refreshToken := string(content)
-			go refreshTokenAndProcessTemplate(refreshToken, agentConfig, errChan)
-
-		case OAuthConfig:
-			// future auth types
-		default:
-			log.Error().Msgf("unknown auth config type. Only 'file' type is supported")
-			return
+		if agentConfig.Auth.Type != "universal-auth" {
+			util.PrintErrorMessageAndExit("Only auth type of 'universal-auth' is supported at this time")
 		}
 
-		select {
-		case err := <-errChan:
-			log.Fatal().Msgf("agent stopped due to error: %v", err)
-			os.Exit(1)
-		case <-sigChan:
-			log.Info().Msg("agent is gracefully shutting...")
-			os.Exit(1)
+		configUniversalAuthType := agentConfig.Auth.Config.(UniversalAuth)
+
+		tokenRefreshNotifier := make(chan bool)
+		sigChan := make(chan os.Signal, 1)
+		signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+
+		filePaths := agentConfig.Sinks
+		tm := NewTokenManager(filePaths, agentConfig.Templates, configUniversalAuthType.ClientIDPath, configUniversalAuthType.ClientSecretPath, tokenRefreshNotifier, configUniversalAuthType.RemoveClientSecretOnRead)
+
+		go tm.ManageTokenLifecycle()
+		go tm.FetchSecrets()
+
+		for {
+			select {
+			case <-tokenRefreshNotifier:
+				go tm.WriteTokenToFiles()
+			case <-sigChan:
+				log.Info().Msg("agent is gracefully shutting...")
+				// TODO: check if we are in the middle of writing files to disk
+				os.Exit(1)
+			}
 		}
 
 	},

cli/packages/cmd/run.go

@@ -204,7 +204,8 @@ func init() {
 func executeSingleCommandWithEnvs(args []string, secretsCount int, env []string) error {
 	command := args[0]
 	argsForCommand := args[1:]
-	color.Green("Injecting %v Infisical secrets into your application process", secretsCount)
+
+	log.Info().Msgf(color.GreenString("Injecting %v Infisical secrets into your application process", secretsCount))
 
 	cmd := exec.Command(command, argsForCommand...)
 	cmd.Stdin = os.Stdin
@@ -232,7 +233,7 @@ func executeMultipleCommandWithEnvs(fullCommand string, secretsCount int, env []
 	cmd.Stderr = os.Stderr
 	cmd.Env = env
 
-	color.Green("Injecting %v Infisical secrets into your application process", secretsCount)
+	log.Info().Msgf(color.GreenString("Injecting %v Infisical secrets into your application process", secretsCount))
 	log.Debug().Msgf("executing command: %s %s %s \n", shell[0], shell[1], fullCommand)
 
 	return execCmd(cmd)

cli/packages/util/check-for-update.go

@@ -11,7 +11,6 @@ import (
 	"os/exec"
 	"runtime"
 	"strings"
-	"time"
 
 	"github.com/fatih/color"
 	"github.com/rs/zerolog/log"
@@ -21,16 +20,16 @@ func CheckForUpdate() {
 	if checkEnv := os.Getenv("INFISICAL_DISABLE_UPDATE_CHECK"); checkEnv != "" {
 		return
 	}
-	latestVersion, publishedDate, err := getLatestTag("Infisical", "infisical")
+	latestVersion, _, err := getLatestTag("Infisical", "infisical")
 	if err != nil {
 		log.Debug().Err(err)
 		// do nothing and continue
 		return
 	}
 
-	daysSinceRelease, _ := daysSinceDate(publishedDate)
+	// daysSinceRelease, _ := daysSinceDate(publishedDate)
 
-	if latestVersion != CLI_VERSION && daysSinceRelease > 2 {
+	if latestVersion != CLI_VERSION {
 		yellow := color.New(color.FgYellow).SprintFunc()
 		blue := color.New(color.FgCyan).SprintFunc()
 		black := color.New(color.FgBlack).SprintFunc()
@@ -151,15 +150,15 @@ func IsRunningInDocker() bool {
 	return strings.Contains(string(cgroup), "docker")
 }
 
-func daysSinceDate(dateString string) (int, error) {
-	layout := "2006-01-02T15:04:05Z"
-	parsedDate, err := time.Parse(layout, dateString)
-	if err != nil {
-		return 0, err
-	}
+// func daysSinceDate(dateString string) (int, error) {
+// 	layout := "2006-01-02T15:04:05Z"
+// 	parsedDate, err := time.Parse(layout, dateString)
+// 	if err != nil {
+// 		return 0, err
+// 	}
 
-	currentTime := time.Now()
-	difference := currentTime.Sub(parsedDate)
-	days := int(difference.Hours() / 24)
-	return days, nil
-}
+// 	currentTime := time.Now()
+// 	difference := currentTime.Sub(parsedDate)
+// 	days := int(difference.Hours() / 24)
+// 	return days, nil
+// }

docs/api-reference/endpoints/environments/create.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Create"
-openapi: "POST /api/v1/workspace/{workspaceId}/environments"
+openapi: "POST /api/v2/workspace/{workspaceId}/environments"
 ---

docs/api-reference/endpoints/identities/create.mdx

@@ -0,0 +1,4 @@
+---
+title: "Create"
+openapi: "POST /api/v1/identities/"
+---

docs/api-reference/endpoints/identities/delete.mdx

@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/identities/{identityId}"
+---

docs/api-reference/endpoints/identities/update.mdx

@@ -0,0 +1,4 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/identities/{identityId}"
+---

docs/api-reference/endpoints/organizations/delete-membership.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Delete Membership"
+title: "Delete User Membership"
 openapi: "DELETE /api/v2/organizations/{organizationId}/memberships/{membershipId}"
 ---

docs/api-reference/endpoints/organizations/list-identity-memberships.mdx

@@ -0,0 +1,4 @@
+---
+title: "List Identity Memberships"
+openapi: "GET /api/v2/organizations/{organizationId}/identity-memberships"
+---

docs/api-reference/endpoints/organizations/memberships.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Get Memberships"
+title: "Get User Memberships"
 openapi: "GET /api/v2/organizations/{organizationId}/memberships"
 ---

docs/api-reference/endpoints/organizations/update-membership.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Update Membership"
+title: "Update User Membership"
 openapi: "PATCH /api/v2/organizations/{organizationId}/memberships/{membershipId}"
 ---

docs/api-reference/endpoints/organizations/workspaces.mdx

@@ -2,3 +2,9 @@
 title: "Get Projects"
 openapi: "GET /api/v2/organizations/{organizationId}/workspaces"
 ---
+
+<Warning>
+    This endpoint will be deprecated in the near future in Q1/Q2 2024.
+
+    We recommend switching to using [identities](/documentation/platform/identities/overview).
+</Warning>

docs/api-reference/endpoints/service-tokens/get.mdx

@@ -2,3 +2,9 @@
 title: "Get"
 openapi: "GET /api/v2/service-token/"
 ---
+
+<Warning>
+    This endpoint will be deprecated in the near future with the removal of service tokens in Q1/Q2 2024.
+
+    We recommend switching to using [identities](/documentation/platform/identities/overview) if your client supports it.
+</Warning>

docs/api-reference/endpoints/universal-auth/attach.mdx

@@ -0,0 +1,4 @@
+---
+title: "Attach"
+openapi: "POST /api/v1/auth/universal-auth/identities/{identityId}"
+---

docs/api-reference/endpoints/universal-auth/create-client-secret.mdx

@@ -0,0 +1,4 @@
+---
+title: "Create Client Secret"
+openapi: "POST /api/v1/auth/universal-auth/identities/{identityId}/client-secrets"
+---

docs/api-reference/endpoints/universal-auth/list-client-secrets.mdx

@@ -0,0 +1,4 @@
+---
+title: "List Client Secrets"
+openapi: "GET /api/v1/auth/universal-auth/identities/{identityId}/client-secrets"
+---

docs/api-reference/endpoints/universal-auth/login.mdx

@@ -0,0 +1,4 @@
+---
+title: "Login"
+openapi: "POST /api/v1/auth/universal-auth/login"
+---

docs/api-reference/endpoints/universal-auth/renew-access-token.mdx

@@ -0,0 +1,4 @@
+---
+title: "Renew Access Token"
+openapi: "POST /api/v1/auth/token/renew"
+---

docs/api-reference/endpoints/universal-auth/retrieve.mdx

@@ -0,0 +1,4 @@
+---
+title: "Retrieve"
+openapi: "GET /api/v1/auth/universal-auth/identities/{identityId}"
+---

docs/api-reference/endpoints/universal-auth/revoke-client-secret.mdx

@@ -0,0 +1,4 @@
+---
+title: "Revoke Client Secret"
+openapi: "POST /api/v1/auth/universal-auth/identities/{identityId}/client-secrets/{clientSecretId}/revoke"
+---

docs/api-reference/endpoints/universal-auth/update.mdx

@@ -0,0 +1,4 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/auth/universal-auth/identities/{identityId}"
+---

docs/api-reference/endpoints/users/me.mdx

@@ -2,3 +2,9 @@
 title: "Get My User"
 openapi: "GET /api/v2/users/me"
 ---
+
+<Warning>
+    This endpoint will be deprecated in the near future in Q1/Q2 2024.
+
+    We recommend switching to using [identities](/documentation/platform/identities/overview).
+</Warning>

docs/api-reference/endpoints/users/my-organizations.mdx

@@ -2,3 +2,9 @@
 title: "Get My Organizations"
 openapi: "GET /api/v2/users/me/organizations"
 ---
+
+<Warning>
+    This endpoint will be deprecated in the near future in Q1/Q2 2024.
+
+    We recommend switching to using [identities](/documentation/platform/identities/overview).
+</Warning>

docs/api-reference/endpoints/workspaces/delete-identity-membership.mdx

@@ -0,0 +1,4 @@
+---
+title: "Delete Identity Membership"
+openapi: "DELETE /api/v2/workspace/{workspaceId}/identity-memberships/{identityId}"
+---

docs/api-reference/endpoints/workspaces/delete-membership.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Delete Membership"
+title: "Delete User Membership"
 openapi: "DELETE /api/v2/workspace/{workspaceId}/memberships/{membershipId}"
 ---

docs/api-reference/endpoints/workspaces/list-identity-memberships.mdx

@@ -0,0 +1,4 @@
+---
+title: "List Identity Memberships"
+openapi: "GET /api/v2/workspace/{workspaceId}/identity-memberships"
+---

docs/api-reference/endpoints/workspaces/memberships.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Get Memberships"
+title: "Get User Memberships"
 openapi: "GET /api/v2/workspace/{workspaceId}/memberships"
 ---

docs/api-reference/endpoints/workspaces/update-identity-membership.mdx

@@ -0,0 +1,4 @@
+---
+title: "Update Identity Membership"
+openapi: "PATCH /api/v2/workspace/{workspaceId}/identity-memberships/{identityId}"
+---

docs/api-reference/endpoints/workspaces/update-membership.mdx

@@ -1,4 +1,4 @@
 ---
-title: "Update Membership"
+title: "Update User Membership"
 openapi: "PATCH /api/v2/workspace/{workspaceId}/memberships/{membershipId}"
 ---

docs/api-reference/endpoints/workspaces/workspace-key.mdx

@@ -2,3 +2,8 @@
 title: "Get Key"
 openapi: "GET /api/v2/workspace/{workspaceId}/encrypted-key"
 ---
+<Warning>
+    This endpoint will be deprecated in the near future in Q1/Q2 2024.
+
+    We recommend using Infisical in non-E2EE mode going forward.
+</Warning>

docs/api-reference/overview/authentication.mdx

@@ -3,29 +3,34 @@ title: "Authentication"
 description: "How to authenticate with the Infisical Public API"
 ---
 
-The Public API accepts multiple modes of authentication being via [Infisical Token](/documentation/platform/token) or API Key.
+You can authenticate with the Infisical API using [Identities](/documentation/platform/identities/overview) paired with authentication modes such as [Universal Auth](/documentation/platform/identities/universal-auth).
 
-- [Infisical Token](/documentation/platform/token): Provides short-lived, scoped CRUD access to the secrets of a specific project and environment.
-- API Key: Provides full access to all endpoints representing the user without ability to encrypt/decrypt secrets for **E2EE** endpoints.
+To interact with the Infisical API, you will need to obtain an access token. Follow the step by [step guide](/documentation/platform/identities/universal-auth) to get an access token via Universal Auth.
 
-<Tabs>
-    <Tab title="Infisical Token">
-        The Infisical Token mode uses an Infisical Token to authenticate with the API.
 
-        To authenticate requests with Infisical using the Infisical Token, you must include your Infisical Token in the `Authorization` header of HTTP requests made to the platform with the value `Bearer <infisical_token>`.
+**FAQ**
 
-        You can obtain an Infisical Token in Project Settings > Service Tokens.
+<AccordionGroup>
+<Accordion title="What happened to the Service Token and API Key authentication modes?">
+    The Service Token and API Key authentication modes are being deprecated out in favor of [Identities](/documentation/platform/identity).
+    We expect to make a deprecation notice in the coming months alongside a larger deprecation initiative planned for Q1/Q2 2024.
 
-        ![token add](../../images/project-token-add.png)
-    </Tab>
-    <Tab title="API Key">
-        The API key mode uses an API key to authenticate with the API.
-
-        To authenticate requests with Infisical using the API Key, you must include an API key in the `X-API-KEY` header of HTTP requests made to the platform. 
-
-        You can obtain an API key in User Settings > API Keys
-
-        ![API key dashboard](../../images/api-key-dashboard.png)
-        ![API key in personal settings](../../images/api-key-settings.png)
-    </Tab>
-</Tabs>
+    With identities, we're improving significantly over the shortcomings of Service Tokens and API Keys. Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
+    permission system used by users, and comes with ample more configurable security measures.
+</Accordion>
+<Accordion title="Why can I not create, read, update, or delete an identity?">
+  There are a few reasons for why this might happen:
+  
+  - You have insufficient organization permissions to create, read, update, delete identities.
+  - The identity you are trying to read, update, or delete is more privileged than yourself.
+  - The role you are trying to create an identity for or update an identity to is more privileged than yours.
+</Accordion>
+<Accordion title="Why is the Infisical API rejecting my identity credentials?">
+  There are a few reasons for why this might happen:
+  
+  - The client secret or access token has expired.
+  - The identity is insufficently permissioned to interact with the resources you wish to access.
+  - You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE.
+  - The client secret/access token is being used from an untrusted IP.
+</Accordion>
+</AccordionGroup>

docs/api-reference/overview/blind-indices.mdx

@@ -1,18 +0,0 @@
----
-title: "Blind Indices"
----
-
-In April 2023, we added the capability for users to query for secrets by name to improve the user experience of Infisical. Previously, it was only possible to query by id of the secret or fetch all secrets belonging to a project and environment.
-
-Blind indexing must be enabled for projects created prior to April 2023 to take effect. If your project can be blind indexed, then you'll see a section in your project settings appear as shown below:
-
-![project enable blind indices](../../images/project-settings-blind-indices.png)
-
-
-It works using virtually irreversible blind indices generated by applying `argon2id` to the name of each secret and a random 128-bit salt assigned to each project on the server. We continue to keep the values of secrets E2EE by default. 
-
-You can read more about it [here](/security/mechanics).
-
-<Note>
-    As previously mentioned, all projects made after April 2023 are automatically blind indexed. If you created a project before this date, you have to enable it manually in your project settings.
-</Note>

docs/api-reference/overview/examples/e2ee-enabled.mdx

@@ -2,6 +2,10 @@
 title: "E2EE Enabled"
 ---
 
+<Note>
+    E2EE enabled mode only works with [Service Tokens](/documentation/platform/token) and cannot be used with [Identities](/documentation/platform/identities/overview).
+</Note>
+
 Using Infisical's API to read/write secrets with E2EE enabled allows you to create, update, and retrieve secrets
 but requires you to perform client-side encryption/decryption operations. For this reason, we recommend using one of the available
 SDKs instead.

docs/api-reference/overview/introduction.mdx

@@ -6,8 +6,4 @@ Infisical's Public (REST) API provides users an alternative way to programmatica
 secrets via HTTPS requests. This can be useful for automating tasks, such as
 rotating credentials, or for integrating secret management into a larger system.
 
-With the Public API, users can create, read, update, and delete secrets, as well as manage access control, query audit logs, and more.
-
-<Warning>
-  In April 2023, we added the capability for users to query for secrets by name to improve the user experience of Infisical. If your project was created prior to April 2023, please read and follow the section on [blind indices](./blind-indices) and how to enable them for better usage of Infisical.
-</Warning>
+With the Public API, you can create, read, update, and delete secrets, as well as manage access control, query audit logs, and more.

docs/changelog/overview.mdx

@@ -4,6 +4,10 @@ title: "Changelog"
 
 The changelog below reflects new product developments and updates on a monthly basis.
 
+## December 2023
+
+- Added ability to [manage folders via CLI](https://infisical.com/docs/cli/commands/secrets).  
+
 ## November 2023
 
 - Replaced internal [Winston](https://github.com/winstonjs/winston) with [Pino](https://github.com/pinojs/pino) logging library with external logging to AWS CloudWatch

docs/documentation/getting-started/api.mdx

@@ -2,58 +2,127 @@
 title: "REST API"
 ---
 
-Infisical's Public (REST) API is the most flexible, platform-agnostic way to read/write secrets for your application.
+Infisical's REST API is the most flexible way to read/write secrets for your application.
 
-Prerequisites:
+In this brief, we'll explore how to fetch a secret back from a project on [Infisical Cloud](https://app.infisical.com) via the REST API.
 
-- Have a project with secrets ready in [Infisical Cloud](https://app.infisical.com).
-- Create an [Infisical Token](/documentation/platform/token) scoped to an environment in your project in Infisical.
+<Steps>
+    <Step title="Create a project with a secret">
+        To create a project, head to your Organization Overview and press **Add New Project**; we'll call the project **Demo App**.
+        ![create project](../../images/getting-started/api/org-create-project-1.png)
+        
+        ![create project](../../images/getting-started/api/org-create-project-2.png)
+        
+        Next, let's head to the **Development** environment of the project and add a secret `FOO=BAR` to it.
+        
+        ![explore project env](../../images/getting-started/api/project-explore-env.png)
+        
+        ![create secret](../../images/getting-started/api/project-create-secret.png)
+        
+        ![project dashboard](../../images/getting-started/api/project-dashboard.png)
 
-To keep it simple, we're going to fetch secrets from the API with **End-to-End Encryption (E2EE)** disabled.
+        <Note>
+            For this brief, you'll need to disable end-to-end encryption in your Project Settings
+        </Note>
+    </Step>
+    <Step title="Create an identity">
+        Next, we need to create an identity to represent your application. To create one, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
 
-<Note>
-    It's possible to use the API with **E2EE** enabled but this means learning about how encryption works with Infisical and performing client-side encryption/decryption operations yourself.
-    yourself. 
-    
-    If **E2EE** is a must for your team, we recommend either using one of the [Infisical SDKs](/documentation/getting-started/sdks) or checking out the [examples for E2EE](/api-reference/overview/examples/e2ee-disabled).
-</Note>
+        ![identities organization](../../images/platform/identities/identities-org.png)
+        
+        When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+        
+        ![identities organization create](../../images/platform/identities/identities-org-create.png)
+        
+        Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
+        
+        ![identities organization create auth method](../../images/platform/identities/identities-org-create-auth-method.png)
 
-## Configuration
+    </Step>
+    <Step title="Create a Client Secret">
+        In order to use the identity, you'll need the non-sensitive **Client ID**
+        of the identity and a **Client Secret** for it; you can think of these credentials akin to a username
+        and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
+        for it.
+        
+        ![identities client secret create](../../images/platform/identities/identities-org-client-secret.png)
+        ![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-1.png)
+        ![identities client secret create](../../images/platform/identities/identities-org-client-secret-create-2.png)
+    </Step>
+    <Step title="Add the identity to the project">
+        To enable the identity to access your project, we need to add it to the project. To do this, head over to the **Demo App** Project Settings > Access Control > Machine Identities and press **Add identity**.
 
-Head to your Project Settings, where you created your service token, and un-check the **E2EE** setting.
+        Next, select the identity you want to add to the project and the role you want to assign it.
 
-## Retrieve Secret
+        ![identities project](../../images/platform/identities/identities-project.png)
+        
+        ![identities project create](../../images/platform/identities/identities-project-create.png)
+    </Step>
+    <Step title="Get an access token for the Infisical API">
+        To access the Infisical API as the identity, you should first perform a login operation
+        that is to exchange the **Client ID** and **Client Secret** of the identity for an access token
+        by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
+        
+        #### Sample request
 
-Retrieve a secret from the project and environment in Infisical scoped to your service token by making a HTTP request with the following format/details:
+        ```
+        curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' \
+        --header 'Content-Type: application/x-www-form-urlencoded' \
+        --data-urlencode 'clientSecret=<client_secret>' \
+        --data-urlencode 'clientId=<client_id>'
+        ```
+        
+        #### Sample response
+        
+        ```
+        {
+        "accessToken": "...",
+        "expiresIn": 7200,
+        "tokenType": "Bearer"
+        }
+        ```
 
-```bash
-curl --location --request GET 'https://app.infisical.com/api/v3/secrets/raw/secretName?workspaceId=workspaceId&environment=environment' \
-    --header 'Authorization: Bearer serviceToken'
-```
+        Next, we can use the access token to authenticate with the [Infisical API](/api-reference/overview/introduction) to read/write secrets
+        
+        <Note>
+        Each identity access token has a time-to-live (TLL) which you can infer from the response of the login operation;
+        the default TTL is `7200` seconds which can be adjusted.
 
-<ParamField path="secretName" type="string" required>
-    Name of secret to retrieve
-</ParamField>
-<ParamField query="workspaceId" type="string" required>
-    The ID of the workspace
-</ParamField>
-<ParamField query="environment" type="string" required>
-    The environment slug
-</ParamField>
-<ParamField query="secretPath" type="string" default="/" optional>
-    Path to secrets in workspace
-</ParamField>
-<ParamField query="type" type="string" optional default="personal">
-    The type of the secret. Valid options are “shared” or “personal”
-</ParamField>
+        If an identity access token expires, it can no longer authenticate with the Infisical API. In this case,
+        a new access token should be obtained from the aforementioned login operation.
+        </Note>
+    </Step>
+    <Step title="Fetch back secret">
+        Finally, you can fetch the secret `FOO=BAR` back from **Step 1** by including the access token in the previous step in another request to the `/api/v3/secrets/raw/{secretName}` endpoint.
 
-Depending on your application requirements, you may wish to use Infisical's API in different ways such as by retaining **E2EE**
-or fetching multiple secrets at once instead of one at a time.
+        ### Sample request
+        
+        ```
+        curl --location --request GET 'http://localhost:8080/api/v3/secrets/raw/FOO?workspaceId=657830d579cfc8415d06ce5b&environment=dev' \
+            --header 'Authorization: Bearer <access_token>'
+        ```
+        
+        ### Sample response
 
-Whatever the case, we recommend glossing over the [API Examples](/api-reference/overview/examples/note)
-to gain a deeper understanding of how you to best leverage the Infisical API for your use-case.
+        ```
+        {
+            "secret": {
+                "_id": "6564234b934d634e1fcd6cdf",
+                "version": 1,
+                "workspace": "6564173e934d634e1fcd6950",
+                "type": "shared",
+                "environment": "dev",
+                "secretKey": "FOO2",
+                "secretValue": "BAR2",
+                "secretComment": ""
+            }
+        }
+        ```
+        
+        Note that you can fetch a list of secrets back by making a request to the `/api/v3/secrets/raw` endpoint.
+    </Step>
+</Steps>
 
 See also:
 
-- Explore the [API Examples](/api-reference/overview/examples/note)
 - [API Reference](/api-reference/overview/introduction)

docs/documentation/platform/identities/overview.mdx

@@ -0,0 +1,54 @@
+---
+title:  Identities
+description: "Programmatically interact with Infisical"
+---
+
+<Note>
+  Currently, identities can only be used to make authenticated requests to the Infisical API and do not work with any clients such as [Node SDK](https://github.com/Infisical/infisical-node)
+  , [Python SDK](https://github.com/Infisical/infisical-python), CLI, K8s operator, Terraform Provider, etc.
+
+  We will be releasing compatibility with it across clients in the coming quarter.
+</Note>
+
+## Concept
+
+A (machine) identity is an entity that you can create in an Infisical organization to represent a workload or application that requires access to the Infisical API. This is conceptually similar to an IAM user in AWS or service account in Google Cloud Platform (GCP).
+
+Each identity must authenticate with the API using a supported authentication method like [Universal Auth](/documentation/platform/identities/universal-auth) to get back a short-lived access token to be used in subsequent requests.
+
+Key Features:
+
+- Role Assignment: Identities must be assigned [roles](/documentation/platform/role-based-access-controls). These roles determine the scope of access to resources, either at the organization level or project level.
+- Auth/Token Configuration: Identities must be configured with auth methods and access token properties to securely interact with the Infisical API.
+
+## Workflow
+
+A typical workflow for using identities consists of four steps:
+
+1. Creating the identity with a name and [role](/documentation/platform/role-based-access-controls) in Organization Access Control > Machine Identities.
+This step also involves configuring an authentication method for it such as [Universal Auth](/documentation/platform/identities/universal-auth).
+2. Adding the identity to the project(s) you want it to have access to.
+3. Authenticating the identity with the Infisical API based on the configured authentication method on it and receiving a short-lived access token back.
+4. Authenticating subsequent requests with the Infisical API using the short-lived access token.
+
+Check out the following authentication method-specific guides for step-by-step instruction on how to use identities to access Infisical:
+
+- [Universal Auth](/documentation/platform/identities/universal-auth)
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="What is the difference between an identity and service token?">
+  A service token is a project-level authentication method that is being phased out in favor of identities.
+  
+  Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
+  permission system used by users, and comes with ample more configurable authentication and security features.
+</Accordion>
+<Accordion title="Why can I not create, read, update, or delete an identity?">
+  There are a few reasons for why this might happen:
+  
+  - You have insufficient organization permissions to create, read, update, delete identities.
+  - The identity you are trying to read, update, or delete is more privileged than yourself.
+  - The role you are trying to create an identity for or update an identity to is more privileged than yours.
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/identities/universal-auth.mdx

@@ -0,0 +1,140 @@
+---
+title: Universal Auth
+description: "Authenticate with Infisical from any platform/environment"
+---
+
+**Universal Auth** is the most versatile authentication method that can be configured on an identity from any platform/environment to access Infisical.
+
+In this method, each identity is given a **Client ID** for which you can generate one or more **Client Secret(s)**. Together, a **Client ID** and **Client Secret** can be exchanged for an access token to authenticate with the Infisical API.
+
+## Properties
+
+Universal Auth supports many settings that can be beneficial for tightening your workflow security configuration:
+
+- Support for restrictions on the number of times that the **Client Secret(s)** and access token(s) can be used.
+- Support for expiration, so, if specified, the **Client Secret** of the identity will automatically be defunct after a period of time.
+- Support for IP allowlisting; this means you can restrict the usage of **Client Secret(s)** and access token to a specific IP or CIDR range.
+
+## Workflow
+
+In the following steps, we explore how to create and use identities for your workloads and applications to access the Infisical API
+using the Universal Auth authentication method.
+
+<Steps>
+  <Step title="Creating an identity">
+    To create an identity, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
+
+    ![identities organization](/images/platform/identities/identities-org.png)
+
+    When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+    
+    ![identities organization create](/images/platform/identities/identities-org-create.png)
+
+    Now input a few details for your new identity. Here's some guidance for each field:
+
+    - Name (required): A friendly name for the identity.
+    - Role (required): A role from the **Organization Roles** tab for the identity to assume. The organization role assigned will determine what organization level resources this identity can have access to.
+    
+    Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
+    
+    ![identities organization create auth method](/images/platform/identities/identities-org-create-auth-method.png)
+    
+    Here's some more guidance on each field:
+
+    - Access Token TTL (default is `2592000` equivalent to 30 days): The lifetime for an acccess token in seconds. This value will be referenced at renewal time.
+    - Access Token Max TTL (default is `2592000`  equivalent to 30 days): The maximum lifetime for an acccess token in seconds. This value will be referenced at renewal time.
+    - Access Token Max Number of Uses (default is `0`): The maximum number of times that an access token can be used; a value of `0` implies infinite number of uses.
+    - Client Secret Trusted IPs: The IPs or CIDR ranges that the **Client Secret** can be used from together with the **Client ID** to get back an access token. By default, **Client Secrets** are given the `0.0.0.0/0`, allowing usage from any network address.
+    - Access Token Trusted IPs: The IPs or CIDR ranges that access tokens can be used from. By default, each token is given the `0.0.0.0/0`, allowing usage from any network address.
+
+    <Warning>
+    Restricting **Client Secret** and access token usage to specific trusted IPs is a paid feature.
+
+    If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact team@infisical.com to purchase an enterprise license to use it.
+    </Warning>
+
+  </Step>
+  <Step title="Creating a Client Secret">
+    In order to use the identity, you'll need the non-sensitive **Client ID**
+    of the identity and a **Client Secret** for it; you can think of these credentials akin to a username
+    and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
+    for it.
+    
+    ![identities client secret create](/images/platform/identities/identities-org-client-secret.png)
+    ![identities client secret create](/images/platform/identities/identities-org-client-secret-create-1.png)
+    ![identities client secret create](/images/platform/identities/identities-org-client-secret-create-2.png)
+    
+    Feel free to input any (optional) details for the **Client Secret** configuration:
+    
+    - Description: A description for the **Client Secret**.
+    - TTL (default is `0`): The time-to-live for the **Client Secret**. By default, the TTL will be set to 0 which implies that the **Client Secret** will never expire; a value of `0` implies an infinite lifetime.
+    - Max Number of Uses (default is `0`): The maximum number of times that the **Client Secret** can be used together with the **Client ID** to get back an access token; a value of `0` implies infinite number of uses.
+  </Step>
+  <Step title="Adding an identity to a project">
+    To enable the identity to access project-level resources such as secrets within a specific project, you should add it to that project.
+
+    To do this, head over to the project you want to add the identity to and go to Project Settings > Access Control > Machine Identities and press **Add identity**.
+
+    Next, select the identity you want to add to the project and the project level role you want to allow it to assume. The project role assigned will determine what project level resources this identity can have access to.
+
+    ![identities project](/images/platform/identities/identities-project.png)
+    
+    ![identities project create](/images/platform/identities/identities-project-create.png)
+  </Step>
+  <Step title="Accessing the Infisical API with the identity">
+    To access the Infisical API as the identity, you should first perform a login operation
+    that is to exchange the **Client ID** and **Client Secret** of the identity for an access token
+    by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
+    
+    #### Sample request
+
+    ```
+    curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' \
+      --header 'Content-Type: application/x-www-form-urlencoded' \
+      --data-urlencode 'clientSecret=...' \
+      --data-urlencode 'clientId=...'
+    ```
+    
+    #### Sample response
+    
+    ```
+    {
+      "accessToken": "...",
+      "expiresIn": 7200,
+      "accessTokenMaxTTL": 43244
+      "tokenType": "Bearer"
+    }
+    ```
+
+    Next, you can use the access token to authenticate with the [Infisical API](/api-reference/overview/introduction)
+    
+    <Note>
+      Each identity access token has a time-to-live (TLL) which you can infer from the response of the login operation;
+      the default TTL is `7200` seconds which can be adjusted.
+
+      If an identity access token expires, it can no longer authenticate with the Infisical API. In this case,
+      a new access token should be obtained by performing another login operation.
+    </Note>
+  </Step>
+</Steps>
+
+**FAQ**
+
+<AccordionGroup>
+<Accordion title="Why is the Infisical API rejecting my identity credentials?">
+  There are a few reasons for why this might happen:
+  
+  - The client secret or access token has expired.
+  - The identity is insufficently permissioned to interact with the resources you wish to access.
+  - You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE.
+  - The client secret/access token is being used from an untrusted IP.
+</Accordion>
+<Accordion title="What is access token renewal and TTL/Max TTL?">
+  A identity access token can have a time-to-live (TTL) or incremental lifetime afterwhich it expires.
+  
+  In certain cases, you may want to extend the lifespan of an access token; to do so, you must set a max TTL parameter.
+
+  A token can be renewed any number of time and each call to renew it will extend the toke life by increments of access token TTL. 
+  Regardless of how frequently an access token is renewed, its lifespan remains bound to the maximum TTL determined at its creation
+</Accordion>
+</AccordionGroup>

docs/documentation/platform/identity.mdx

@@ -1,168 +0,0 @@
----
-title:  Identity
-description: "Programmatically interact with Infisical"
----
-
-A (machine) identity is an entity that you can create in Infisical. 
-Each identity represents a workload that wishes to access the Infisical API via an authentication method; this is similar to an IAM user in AWS or service account in GCP.
-
-An identity can be provisioned scoped access to resources at the organization or project-level via [role-based access controls (RBAC)](/documentation/platform/role-based-access-controls). For instance, you may create a identity with scoped access to
-fetch secrets back from the `/` path of the `development` environment in some project.
-
-<Note>
-  The identity feature is in beta.
-  
-  Currently, an identity can only be used to make authenticated requests to the Infisical API and does not work with any clients such as [Node SDK](https://github.com/Infisical/infisical-node)
-  , [Python SDK](https://github.com/Infisical/infisical-python), CLI, K8s operator, Terraform Provider, etc.
-
-  We will be releasing compatibility with it across clients in the coming quarter.
-</Note>
-
-Each identity can be configured an authentication method. The only supported method at the moment is **Universal Auth (UA)**
-which has the following properties:
-
-- In UA, each identity is assigned a **Client ID** for which you can generate one or more **Client Secret(s)**. Together, a **Client ID** and **Client Secret** can be exchanged for an access token (i.e. login operation) to authenticate with the Infisical API.
-- UA supports restrictions on the number of times that the **Client Secret(s)** and access token(s) can be used.
-- UA supports token renewal that is the ability to extend the lifetime of a token by its TTL up to its maximum TTL since its creation.
-- UA supports IP allowlisting; this means you can restrict the usage of **Client Secret(s)** and access token to a specific IP or CIDR range.
-- UA support expiration, so, if specified, the client secret of the identity will automatically be defunct after a period of time.
-- UA tracks most recent usage of their client secrets and access tokens; it also keeps track of each token's usage count.
-
-## Using identities
-
-In the following steps, we explore how to create and use identities for your applications to access the Infisical API.
-
-<Steps>
-  <Step title="Creating an identity">
-    To create an identity, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**.
-
-    ![machine identities organization](../../images/platform/machine-identity/machine-identity-org.png)
-    
-    ![machine identities organization create](../../images/platform/machine-identity/machine-identity-org-create.png)
-
-    Now input a few details for your new identity. Here's some guidance for each field:
-
-    - Name (required): A friendly name for the identity.
-    - Role (required): A role from the **Organization Roles** tab to permit the identity to access certain resources.
-    
-    Once you've created an identity, you'll be prompted to configure the **Universal Auth** authentication method for it.
-
-    - Access Token TTL (default is `7200`): The incremental lifetime for an acccess token in seconds; a value of `0` implies an infinite incremental lifetime.
-    - Access Token Max TTL (default is `7200`): The maximum lifetime for an acccess token in seconds; a value of `0` implies an infinite maximum lifetime.
-    - Access Token Max Number of Uses (default is `0`): The maximum number of times that an access token can be used; a value of `0` implies infinite number of uses.
-    - Client Secret Trusted IPs: The IPs or CIDR ranges that the **Client Secret** can be used from together with the **Client ID** to get back an access token. By default, **Client Secrets** are given the `0.0.0.0/0` entry representing all possible IPv4 addresses.
-    - Access Token Trusted IPs: The IPs or CIDR ranges that access tokens can be used from. By default, each token is given the `0.0.0.0/0` entry representing all possible IPv4 addresses.
-
-    <Warning>
-    Restricting **Client Secret** and access token usage to specific trusted IPs is a paid feature.
-
-    If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact team@infisical.com to purchase an enterprise license to use it.
-    </Warning>
-
-  </Step>
-  <Step title="Creating a Client Secret">
-    In order to use the identity, you'll need the non-sensitive **Client ID**
-    of the identity and a **Client Secret** for it; you can think of these credentials akin to a username
-    and password used to authenticate with the Infisical API. With that, press on the key icon on the identity to generate a **Client Secret**
-    for it.
-    
-    ![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret.png)
-    ![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret-create-1.png)
-    ![machine identities client secret create](../../images/platform/machine-identity/machine-identity-org-client-secret-create-2.png)
-    
-    Feel free to input any (optional) details for the **Client Secret** configuration:
-    
-    - Description: A description for the **Client Secret**.
-    - TTL (default is `0`): The time-to-live for the **Client Secret**. By default, the TTL will be set to 0 which implies that the **Client Secret** will never expire; a value of `0` implies an infinite lifetime.
-    - Max Number of Uses (default is `0`): The maximum number of times that the **Client Secret** can be used together with the **Client ID** to get back an access token; a value of `0` implies infinite number of uses.
-  </Step>
-  <Step title="Adding an identity to a project">
-    To enable the identity to access project-level resources such as secrets within a specific project, you should add it to that project.
-
-    To do this, head over to the project you want to add the identity to and go to Project Settings > Access Control > Machine Identities and press **Add identity**.
-
-    Next, select the identity you want to add to the project and the role you want to assign it.
-
-    ![machine identities project](../../images/platform/machine-identity/machine-identity-project.png)
-    
-    ![machine identities project create](../../images/platform/machine-identity/machine-identity-project-create.png)
-  </Step>
-  <Step title="Accessing the Infisical API with the identity">
-    To access the Infisical API as the identity, you should first perform a login operation
-    that is to exchange the **Client ID** and **Client Secret** of the MI for an access token
-    by making a request to the `/api/v1/auth/universal-auth/login` endpoint.
-    
-    #### Sample request
-
-    ```
-    curl --location --request POST 'https://app.infisical.com/api/v1/auth/universal-auth/login' \
-      --header 'Content-Type: application/x-www-form-urlencoded' \
-      --data-urlencode 'clientSecret=...' \
-      --data-urlencode 'clientId=...'
-    ```
-    
-    #### Sample response
-    
-    ```
-    {
-      "accessToken": "...",
-      "expiresIn": 7200,
-      "tokenType": "Bearer"
-    }
-    ```
-
-    Next, you can use the access token to authenticate with the [Infisical API](/api-reference/overview/introduction)
-    
-    <Note>
-      Each identity access token has a time-to-live (TLL) which you can infer from the response of the login operation;
-      the default TTL is `7200` seconds which can be adjusted.
-
-      If an identity access token expires, it can no longer authenticate with the Infisical API. In this case,
-      a new access token should be obtained from the aforementioned login operation.
-    </Note>
-  </Step>
-</Steps>
-
-**FAQ**
-
-<AccordionGroup>
-<Accordion title="What is the difference between an identity and service token?">
-  A service token is a project-level authentication method that is being phased out in favor of identities.
-  
-  Amongst many differences, identities provide broader access over the Infisical API, utilizes the same role-based
-  permission system used by users, and comes with ample more configurable security measures.
-</Accordion>
-<Accordion title="Why is the Infisical API rejecting my identity credentials?">
-  There are a few reasons for why this might happen:
-  
-  - The client secret or access token has expired.
-  - The identity is insufficently permissioned to interact with the resources you wish to access.
-  - You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE.
-  - The client secret/access token is being used from an untrusted IP.
-</Accordion>
-<Accordion title="What is token renewal and TTL/Max TTL?">
-  A identity access token can have a time-to-live (TTL) or incremental lifetime afterwhich it expires.
-  
-  In certain cases, you may want to extend the lifespan of an access token; to do so, you must use the max TTL parameter.
-  When TTL and max TTL are equal, a token is not renewable; when max TTL is greater than TTL, a token is renewable.
-  In the latter case, a token still expires at its TTL but its lifetime can be extended/renewed up until its max TLL.
-  
-  Note that the max TTL cannot be less than the TTL for an access token.
-</Accordion>
-<Accordion title="Why can I not create, read, update, or delete an identity?">
-  There are a few reasons for why this might happen:
-  
-  - You have insufficient organization permissions to create, read, update, delete identities.
-  - The identity you are trying to read, update, or delete is more privileged than yourself.
-  - The role you are trying to create an identity for or update an identity to is more privileged than yours.
-</Accordion>
-<Accordion title="Can you provide examples for using glob patterns?">
-  1. `/**`: This pattern matches all folders at any depth in the directory structure. For example, it would match folders like `/folder1/`, `/folder1/subfolder/`, and so on.
-
-  2. `/*`: This pattern matches all immediate subfolders in the current directory. It does not match any folders at a deeper level. For example, it would match folders like `/folder1/`, `/folder2/`, but not `/folder1/subfolder/`.
-
-  3. `/*/*`: This pattern matches all subfolders at a depth of two levels in the current directory. It does not match any folders at a shallower or deeper level. For example, it would match folders like `/folder1/subfolder/`, `/folder2/subfolder/`, but not `/folder1/` or `/folder1/subfolder/subsubfolder/`.
-
-  4. `/folder1/*`: This pattern matches all immediate subfolders within the `/folder1/` directory. It does not match any folders outside of `/folder1/`, nor does it match any subfolders within those immediate subfolders. For example, it would match folders like `/folder1/subfolder1/`, `/folder1/subfolder2/`, but not `/folder2/subfolder/`.
-</Accordion>
-</AccordionGroup>

docs/documentation/platform/secret-rotation/postgres.mdx

@@ -1,6 +1,6 @@
 ---
 title: "PostgreSQL/CockroachDB"
-description: "Rotated database user password of a postgreSQL or cochroach db"
+description: "Rotated database user password of a postgreSQL or cockroach db"
 ---
 
 Infisical will update periodically the provided database user's password.

docs/documentation/platform/sso/azure.mdx

@@ -10,97 +10,97 @@ description: "Configure Azure SAML for Infisical SSO"
    then you should contact team@infisical.com to purchase an enterprise license to use it.
 </Info>
 
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
-   Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
+<Steps>
+   <Step title="Prepare the SAML SSO configuration in Infisical">
+      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
 
-![Azure SAML initial configuration](../../../images/sso/azure/init-config.png)
+      Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
 
-2. In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select
-   **+ New application**.
+      ![Azure SAML initial configuration](../../../images/sso/azure/init-config.png)
+   </Step>
+   <Step title="Create a SAML application in Azure">
+      In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select **+ New application**.
 
-![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png)
+      ![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png)
 
-![Azure SAML new application](../../../images/sso/azure/new-application.png)
+      ![Azure SAML new application](../../../images/sso/azure/new-application.png)
+      
+      On the next screen, press the **+ Create your own application** button.
+      Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
+      option and hit the **Create** button.
 
-2. On the next screen, press the **+ Create your own application** button.
-   Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
-   option and hit the **Create** button.
+      ![Azure SAML create own application](../../../images/sso/azure/create-own-application.png)
 
-![Azure SAML create own application](../../../images/sso/azure/create-own-application.png)
+      On the application overview screen, select **Single sign-on** from the left sidebar. From there, select the **SAML** single sign-on method.
 
-3. On the application overview screen, select **Single sign-on** from the left sidebar. From there,
-   select the **SAML** single sign-on method.
+      ![Azure SAML sign on method](../../../images/sso/azure/sso-method.png)
 
-![Azure SAML sign on method](../../../images/sso/azure/sso-method.png)
+      Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
 
-4. Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)**
-   to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
+      ![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png)
 
-![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png)
+      ![Azure SAML edit basic configuration 2](../../../images/sso/azure/edit-basic-config-2.png)
 
-![Azure SAML edit basic configuration 2](../../../images/sso/azure/edit-basic-config-2.png)
+      <Note>
+      If you're self-hosting Infisical, then you will want to replace
+      `https://app.infisical.com` with your own domain.
+      </Note>
 
-<Note>
-  If you're self-hosting Infisical, then you will want to replace
-  `https://app.infisical.com` with your own domain.
-</Note>
+      Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
 
-5. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
+      - `email -> user.userprinciplename`
+      - `firstName -> user.firstName`
+      - `lastName -> user.lastName`
 
-- `email -> user.userprinciplename`
-- `firstName -> user.firstName`
-- `lastName -> user.lastName`
+      ![Azure SAML edit attributes and claims](../../../images/sso/azure/edit-attributes-claims.png)
 
-![Azure SAML edit attributes and claims](../../../images/sso/azure/edit-attributes-claims.png)
+      ![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png)
 
-![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png)
+      Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
 
-6. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
+      ![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png)
 
-![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png)
+      ![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png)
+   </Step>
+   <Step title="Retrieve Identity Provider (IdP) Information from Okta">
+      In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
 
-![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png)
+      ![Azure SAML identity provider values 1](../../../images/sso/azure/idp-values.png)
 
-7. Get IdP values:
+      In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.
 
-In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
+      ![Azure SAML identity provider values 2](../../../images/sso/azure/idp-values-2.png)
+   </Step>
+   <Step title="Finish configuring SAML in Infisical">
+      Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
 
-![Azure SAML identity provider values 1](../../../images/sso/azure/idp-values.png)
+      ![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-3.png)
 
-In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.
+      <Note>
+      When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
+      CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
+      of the text area respectively.
 
-![Azure SAML identity provider values 2](../../../images/sso/azure/idp-values-2.png)
+      Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
 
-Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
+      </Note>
+   </Step>
+   <Step title="Assign users in Azure to the application">
+      Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
+      
+      ![Azure SAML assignment](../../../images/sso/azure/assignment.png)
+   </Step>   
+   <Step title="Enable SAML SSO in Infisical">
+      Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
 
-![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-3.png)
-
-<Note>
-When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
-  CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
-  of the text area respectively.
-
-Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
-
-</Note>
-
-7. Assignments
-
-Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
-![Azure SAML assignment](../../../images/sso/azure/assignment.png)
-
-8. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
-
-![Azure SAML assignment](../../../images/sso/azure/enable-saml.png)
+      ![Azure SAML assignment](../../../images/sso/azure/enable-saml.png)
+   </Step>
+</Steps>
 
 <Note>
    If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
-   set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+   set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
    
-   - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+   - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-</Note>
-
-
+</Note>

docs/documentation/platform/sso/github.mdx

@@ -5,38 +5,39 @@ description: "Configure GitHub SSO for Infisical"
 
 Using GitHub SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GitHub and registering your instance with it.
 
-## Create an OAuth application in GitHub
+<Steps>
+  <Step title="Create an OAuth application in GitHub">
+    Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
 
-Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
+    ![GitHub settings](../../../images/sso/github/settings.png)
+    ![GitHub developer settings](../../../images/sso/github/dev-settings.png)
+    ![GitHub create new OAuth application](../../../images/sso/github/new-app.png)
 
-![GitHub settings](../../../images/sso/github/settings.png)
-![GitHub developer settings](../../../images/sso/github/dev-settings.png)
-![GitHub create new OAuth application](../../../images/sso/github/new-app.png)
+    Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
+    and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`.
 
-Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
-and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`.
+    ![GitHub create new OAuth application form](../../../images/sso/github/new-app-form.png)
 
-![GitHub create new OAuth application form](../../../images/sso/github/new-app-form.png)
+    <Note>
+        If you have a GitHub organization, you can create an OAuth application under it
+        in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
+    </Note>
+  </Step>
+  <Step title="Add your OAuth application credentials to Infisical">
+    Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
 
-<Note>
-    If you have a GitHub organization, you can create an OAuth application under it
-    in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
-</Note>
+    ![GCP obtain OAuth2 credentials](../../../images/sso/github/credentials.png)
 
-## Add your OAuth application credentials to Infisical
+    Back in your Infisical instance, make sure to set the following environment variables:
 
-Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
-
-![GCP obtain OAuth2 credentials](../../../images/sso/github/credentials.png)
-
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application.
-- `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-   
-Once added, restart your Infisical instance and log in with GitHub.
+    - `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application.
+    - `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application.
+    - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+      
+    Once added, restart your Infisical instance and log in with GitHub.
+  </Step>
+</Steps>
 
 ## FAQ
 
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitHub.
     It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
 
     - Check that you have set the `CLIENT_ID_GITHUB_LOGIN`, `CLIENT_SECRET_GITHUB_LOGIN`, 
-    `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+    `AUTH_SECRET`, and `SITE_URL` environment variables.
     - Check that the **Authorization callback URL** specified in GitHub matches the `SITE_URL` environment variable.
     For example, if the former is `https://app.infisical.com/api/v1/sso/github` then the latter should be `https://app.infisical.com`.
   </Accordion>

docs/documentation/platform/sso/gitlab.mdx

@@ -5,38 +5,39 @@ description: "Configure GitLab SSO for Infisical"
 
 Using GitLab SSO on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.
 
-## Create an OAuth application in GitLab
+<Steps>
+  <Step title="Create an OAuth application in GitLab">
+    Navigate to your user Settings > Applications to create a new GitLab application.
 
-Navigate to your user Settings > Applications to create a new GitLab application.
+    ![sso gitlab config](/images/sso/gitlab/edit-profile.png) 
+    ![sso gitlab config](/images/sso/gitlab/new-app.png) 
 
-![sso gitlab config](/images/sso/gitlab/edit-profile.png) 
-![sso gitlab config](/images/sso/gitlab/new-app.png) 
+    Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`.
+    Note that only `read_user` is required as part of the **Scopes** configuration.
 
-Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`.
-Note that only `read_user` is required as part of the **Scopes** configuration.
+    ![sso gitlab config](/images/sso/gitlab/new-app-form.png) 
 
-![sso gitlab config](/images/sso/gitlab/new-app-form.png) 
+    <Note>
+        If you have a GitLab group, you can create an OAuth application under it
+        in your group Settings > Applications.
+    </Note>
+  </Step>
+  <Step title="Add your OAuth application credentials to Infisical">
+    Obtain the **Application ID** and **Secret** for your GitLab application.
 
-<Note>
-    If you have a GitLab group, you can create an OAuth application under it
-    in your group Settings > Applications.
-</Note>
+    ![sso gitlab config](/images/sso/gitlab/credentials.png) 
 
-## Add your OAuth application credentials to Infisical
+    Back in your Infisical instance, make sure to set the following environment variables:
 
-Obtain the **Application ID** and **Secret** for your GitLab application.
-
-![sso gitlab config](/images/sso/gitlab/credentials.png) 
-
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application.
-- `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application.
-- (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-   
-Once added, restart your Infisical instance and log in with GitLab.
+    - `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application.
+    - `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application.
+    - (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`.
+    - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+      
+    Once added, restart your Infisical instance and log in with GitLab.
+  </Step>
+</Steps>
 
 ## FAQ
 
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitLab.
     It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
 
     - Check that you have set the `CLIENT_ID_GITLAB_LOGIN`, `CLIENT_SECRET_GITLAB_LOGIN`, 
-    `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+    `AUTH_SECRET`, and `SITE_URL` environment variables.
     - Check that the **Redirect URI** specified in GitLab matches the `SITE_URL` environment variable.
     For example, if the former is `https://app.infisical.com/api/v1/sso/gitlab` then the latter should be `https://app.infisical.com`.
   </Accordion>

docs/documentation/platform/sso/google.mdx

@@ -5,31 +5,32 @@ description: "Configure Google SSO for Infisical"
 
 Using Google SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP and registering your instance with it.
 
-## Create an OAuth2 application in GCP
+<Steps>
+  <Step title="Create an OAuth2 application in GCP">
+    Navigate to your project API & Services > Credentials to create a new OAuth2 application.
+        
+    ![GCP API services](../../../images/sso/google/api-services.png)
+    ![GCP create new OAuth2 application](../../../images/sso/google/new-app.png)
 
-Navigate to your project API & Services > Credentials to create a new OAuth2 application.
-    
-![GCP API services](../../../images/sso/google/api-services.png)
-![GCP create new OAuth2 application](../../../images/sso/google/new-app.png)
+    Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`.
 
-Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`.
+    ![GCP create new OAuth2 application form](../../../images/sso/google/new-app-form.png)
+  </Step>
+  <Step title="Add your OAuth2 application credentials to Infisical">
+    Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
 
-![GCP create new OAuth2 application form](../../../images/sso/google/new-app-form.png)
+    ![GCP obtain OAuth2 credentials](../../../images/sso/google/credentials.png)
+      
+    Back in your Infisical instance, make sure to set the following environment variables:
 
-## Add your OAuth2 application credentials to Infisical
-   
-Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
-
-![GCP obtain OAuth2 credentials](../../../images/sso/google/credentials.png)
-   
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application.
-- `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-   
-Once added, restart your Infisical instance and log in with Google
+    - `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application.
+    - `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application.
+    - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+      
+    Once added, restart your Infisical instance and log in with Google
+  </Step>
+</Steps>
 
 ## FAQ
 
@@ -38,7 +39,7 @@ Once added, restart your Infisical instance and log in with Google
     It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
 
     - Check that you have set the `CLIENT_ID_GOOGLE_LOGIN`, `CLIENT_SECRET_GOOGLE_LOGIN`, 
-    `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+    `AUTH_SECRET`, and `SITE_URL` environment variables.
     - Check that the **Authorized redirect URI** specified in GCP matches the `SITE_URL` environment variable.
     For example, if the former is `https://app.infisical.com/api/v1/sso/google` then the latter should be `https://app.infisical.com`.
   </Accordion>

docs/documentation/platform/sso/jumpcloud.mdx

@@ -10,73 +10,77 @@ description: "Configure JumpCloud SAML for Infisical SSO"
    then you should contact team@infisical.com to purchase an enterprise license to use it.
 </Info>
 
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
-   Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
+<Steps>
+   <Step title="Prepare the SAML SSO configuration in Infisical">
+      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
 
-![JumpCloud SAML initial configuration](../../../images/sso/jumpcloud/init-config.png)
+      Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
 
-2. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**;
-   if not, select **+Add New Application**
+      ![JumpCloud SAML initial configuration](../../../images/sso/jumpcloud/init-config.png)
+   </Step>
+   <Step title="Create a SAML application in JumpCloud">
+      2.1. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**; if not, select **+Add New Application**
 
-![JumpCloud SAML new application](../../../images/sso/jumpcloud/new-application.png)
+      ![JumpCloud SAML new application](../../../images/sso/jumpcloud/new-application.png)
 
-3. Next, select **Custom SAML App** to open up the **New SSO** dialog.
+      2.2. Next, select **Custom SAML App** to open up the **New SSO** dialog.
 
-![JumpCloud custom SAML app](../../../images/sso/jumpcloud/custom-saml-app.png)
+      ![JumpCloud custom SAML app](../../../images/sso/jumpcloud/custom-saml-app.png)
 
-4. In the **General Info** tab, give the application a unique name like Infisical.
+      2.3. In the **General Info** tab, give the application a unique name like Infisical.
 
-![JumpCloud general info](../../../images/sso/jumpcloud/general-info.png)
+      ![JumpCloud general info](../../../images/sso/jumpcloud/general-info.png)
 
-5. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
+      2.4. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
 
-![JumpCloud edit basic config](../../../images/sso/jumpcloud/edit-basic-config.png)
+      ![JumpCloud edit basic config](../../../images/sso/jumpcloud/edit-basic-config.png)
 
-6. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
-   Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical.
+      2.5. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
+         Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical.
 
-![JumpCloud edit basic config 2](../../../images/sso/jumpcloud/edit-basic-config-2.png)
+      ![JumpCloud edit basic config 2](../../../images/sso/jumpcloud/edit-basic-config-2.png)
 
-7. On the same tab, in the **Attributes** section, configure the following map:
+      2.6. On the same tab, in the **Attributes** section, configure the following map:
 
-- `email -> email`
-- `firstName -> firstname`
-- `lastName -> lastname`
+      - `email -> email`
+      - `firstName -> firstname`
+      - `lastName -> lastname`
 
-![JumpCloud attribute statements](../../../images/sso/jumpcloud/attribute-statements.png)
+      ![JumpCloud attribute statements](../../../images/sso/jumpcloud/attribute-statements.png)
 
-Finally press activate to create the SAML application.
+      Finally press activate to create the SAML application.
 
-8. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
+      2.7. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
 
-![JumpCloud download certificate](../../../images/sso/jumpcloud/download-saml-certificate.png)
+      ![JumpCloud download certificate](../../../images/sso/jumpcloud/download-saml-certificate.png)
+   </Step>
+   <Step title="Finish configuring SAML in Infisical">
+      Back in Infisical, set the **IDP URL** from step 2.5 and the **IdP Entity ID** from step 2.4. Also, paste the certificate from the previous step.
 
-9. Back in Infisical, set the **IDP URL** from step 6 and the **IdP Entity ID** from step 5. Also, paste the certificate from the previous step.
+      ![JumpCloud IdP values](../../../images/sso/jumpcloud/idp-values.png)
 
-![JumpCloud IdP values](../../../images/sso/jumpcloud/idp-values.png)
+      <Note>
+         When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
+         CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
+         of the text area respectively.
+      </Note>
+   </Step>
+   <Step title="Assign users in JumpCloud to the application">
+      Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application.
 
-<Note>
-  When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
-  CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
-  of the text area respectively.
-</Note>
+      ![JumpCloud SAML assignment](../../../images/sso/jumpcloud/assignment.png)
+   </Step>
+   <Step title="Enable SAML SSO in Infisical">
+      Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud.
 
-10. Assignments
-
-Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application.
-
-![JumpCloud SAML assignment](../../../images/sso/jumpcloud/assignment.png)
-
-11. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud.
-
-![JumpCloud SAML assignment](../../../images/sso/jumpcloud/enable-saml.png)
+      ![JumpCloud SAML assignment](../../../images/sso/jumpcloud/enable-saml.png)
+   </Step>
+</Steps>
 
 <Note>
    If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
-   set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+   set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
    
-   - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+   - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
 </Note>

docs/documentation/platform/sso/okta.mdx

@@ -10,78 +10,80 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
    then you should contact team@infisical.com to purchase an enterprise license to use it.
 </Info>
 
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
-   Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
+<Steps>
+   <Step title="Prepare the SAML SSO configuration in Infisical">
+      In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+      
+      Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
+      ![Okta SAML initial configuration](../../../images/sso/okta/init-config.png)
+   </Step>
+   <Step title="Create a SAML application in Okta">
+      In the Okta Admin Portal, select Applications > Applications from the navigation. On the Applications screen, select the **Create App Integration**
+      button.
 
-![Okta SAML initial configuration](../../../images/sso/okta/init-config.png)
+      ![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png)
+      
+      In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
 
-2. In the Okta Admin Portal, select Applications > Applications from the
-   navigation. On the Applications screen, select the **Create App Integration**
-   button.
+      ![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png)
+      
+      On the General Settings screen, give the application a unique name like Infisical and select **Next**.
+      
+      ![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png)
+      
+      On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
 
-![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png)
+      ![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png)
+      
+      <Note>
+         If you're self-hosting Infisical, then you will want to replace
+         `https://app.infisical.com` with your own domain.
+      </Note>
+      
+      Also on the Configure SAML screen, configure the **Attribute Statements** to map:
 
-3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
+      - `id -> user.id`,
+      - `email -> user.email`,
+      - `firstName -> user.firstName`
+      - `lastName -> user.lastName`
 
-![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png)
+      ![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png)
 
-4. On the General Settings screen, give the application a unique name like Infisical and select **Next**.
+      Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
+   </Step>
+   <Step title="Retrieve Identity Provider (IdP) Information from Okta">
+      Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
 
-![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png)
+      ![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png)
 
-5. On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
+      Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
 
-![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png)
+      ![SAML Okta IdP values](../../../images/sso/okta/idp-values.png)
+   </Step>
+   <Step title="Finish configuring SAML in Infisical">
+      Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
+      and **Certificate** to **X.509 Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
 
-<Note>
-  If you're self-hosting Infisical, then you will want to replace
-  `https://app.infisical.com` with your own domain.
-</Note>
+      ![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png)
+   </Step>
+   <Step title="Assign users in Okta to the application">
+      Back in Okta, navigate to the **Assignments** tab and select **Assign**. You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
 
-6. Also on the Configure SAML screen, configure the **Attribute Statements** to map:
+      ![SAML Okta assignment](../../../images/sso/okta/assignment.png)
 
-- `id -> user.id`,
-- `email -> user.email`,
-- `firstName -> user.firstName`
-- `lastName -> user.lastName`
+      At this point, you have configured everything you need within the context of the Okta Admin Portal.
+   </Step>
+   <Step title="Enable SAML SSO in Infisical">
+      Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
 
-![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png)
-
-Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
-
-7. Get IdP values
-
-Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
-
-![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png)
-
-Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
-
-![SAML Okta IdP values](../../../images/sso/okta/idp-values.png)
-
-Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
-and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
-
-![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png)
-
-8. Finally, navigate to the **Assignments** tab and select **Assign**
-
-You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
-
-![SAML Okta assignment](../../../images/sso/okta/assignment.png)
-
-At this point, you have configured everything you need within the context of the Okta Admin Portal.
-
-9. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
-
-![SAML Okta assignment](../../../images/sso/okta/enable-saml.png)
+      ![SAML Okta assignment](../../../images/sso/okta/enable-saml.png)
+   </Step>
+</Steps>
 
 <Note>
    If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
-   set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+   set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
    
-   - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+   - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
 </Note>

docs/infisical-agent/overview.mdx

@@ -12,7 +12,7 @@ It eliminates the need to modify application logic by enabling clients to decide
 - Templating: Renders secrets via user provided templates to desired formats for applications to consume
 
 ### Token renewal
-The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a Method, which is the authentication process suitable for your current setup, and Sinks, which are the places where the agent deposits the new access token whenever it receives updates.
+The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a `Method`, which is the authentication process suitable for your current setup, and `Sinks`, which are the places where the agent deposits the new access token whenever it receives updates.
 
 When the Infisical Agent is started, it will attempt to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt. 
 
@@ -43,8 +43,10 @@ While specifying an authentication method is mandatory to start the agent, confi
 | Field                        | Description |
 | ---------------------------- | ----------- |
 | `infisical.address`          | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
-| `auth.type`                  | The type of authentication method used. Only `"token"` type is currently available |
-| `auth.config.token-path`     | The file path where the initial token for authentication is stored.  |
+| `auth.type`                  | The type of authentication method used. Only `"universal-auth"` type is currently available |
+| `auth.config.client-id`      | The file path where the universal-auth client id is stored.  |
+| `auth.config.client-secret`  | The file path where the universal-auth client secret is stored.  |
+| `auth.config.remove_client_secret_on_read`     | This will instruct the agent to remove the client secret from disk.  |
 | `sinks[].type`               | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
 | `sinks[].config.path`        | The file path where the access token should be stored for each sink in the list. |
 | `templates[].source-path`    | The path to the template file that should be used to render secrets. |
@@ -54,15 +56,19 @@ While specifying an authentication method is mandatory to start the agent, confi
 ## Quick start Infisical Agent
 To install the Infisical agent, you must first install the [Infisical CLI](../cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI.
 
-Once you have the CLI installed, you will need to create a agent configuration file in yaml. 
+Once you have the CLI installed, you will need to provision programmatic access for the agent via [Universal Auth](/documentation/platform/identities/universal-auth). To obtain a **Client ID** and a **Client Secret**, follow the step by step guide outlined [here](/documentation/platform/identities/universal-auth).
+
+Next, create agent config file as shown below.
 
 ```yaml example-agent-config-file.yaml
 infisical:
   address: "https://app.infisical.com"
 auth:
-  type: "token"
+  type: "universal-auth"
   config:
-    token-path: "/path/to/initial/token"
+    client-id: "./client-id"
+    client-secret: "./client-secret"
+    remove_client_secret_on_read: false
 sinks:
   - type: "file"
     config:

docs/integrations/cicd/bitbucket.mdx

@@ -7,25 +7,26 @@ Prerequisites:
 
 - Set up and add envars to [Infisical Cloud](https://app.infisical.com)
 
-## Navigate to your project's integrations tab
+<Steps>
+  <Step title="Authorize Infisical for Bitbucket">
+    Navigate to your project's integrations tab in Infisical.
 
-![integrations](../../images/integrations.png)
+    ![integrations](../../images/integrations.png)
 
-## Authorize Infisical for Bitbucket
+    Press on the Bitbucket tile and grant Infisical access to your Bitbucket account.
 
-Press on the Bitbucket tile and grant Infisical access to your Bitbucket account.
+    ![integrations bitbucket authorization](../../images/integrations/bitbucket/integrations-bitbucket-auth.png)
 
-![integrations bitbucket authorization](../../images/integrations/bitbucket/integrations-bitbucket-auth.png)
+    <Info>
+      If this is your project's first cloud integration, then you'll have to grant
+      Infisical access to your project's environment variables. Although this step
+      breaks E2EE, it's necessary for Infisical to sync the environment variables to
+      the cloud platform.
+    </Info>
+  </Step>
+  <Step title="Start integration">
+    Select which Infisical environment secrets you want to sync to which Bitbucket repo and press start integration to start syncing secrets to the repo.
 
-<Info>
-  If this is your project's first cloud integration, then you'll have to grant
-  Infisical access to your project's environment variables. Although this step
-  breaks E2EE, it's necessary for Infisical to sync the environment variables to
-  the cloud platform.
-</Info>
-
-## Start integration
-
-Select which Infisical environment secrets you want to sync to which Bitbucket repo and press start integration to start syncing secrets to the repo.
-
-![integrations bitbucket](../../images/integrations/bitbucket/integrations-bitbucket.png)
+    ![integrations bitbucket](../../images/integrations/bitbucket/integrations-bitbucket.png)
+  </Step>
+</Steps>

docs/integrations/cicd/circleci.mdx

@@ -7,30 +7,31 @@ Prerequisites:
 
 - Set up and add envars to [Infisical Cloud](https://app.infisical.com)
 
-## Navigate to your project's integrations tab
+<Steps>
+  <Step title="Authorize Infisical for CircleCI">
+    Obtain an API token in User Settings > Personal API Tokens
 
-![integrations](../../images/integrations.png)
+    ![integrations circleci token](../../images/integrations/circleci/integrations-circleci-token.png)
 
-## Authorize Infisical for CircleCI
+    Navigate to your project's integrations tab in Infisical.
 
-Obtain an API token in User Settings > Personal API Tokens
+    ![integrations](../../images/integrations.png)
 
-![integrations circleci token](../../images/integrations/circleci/integrations-circleci-token.png)
+    Press on the CircleCI tile and input your CircleCI API token to grant Infisical access to your CircleCI account.
 
-Press on the CircleCI tile and input your CircleCI API token to grant Infisical access to your CircleCI account.
+    ![integrations circleci authorization](../../images/integrations/circleci/integrations-circleci-auth.png)
 
-![integrations circleci authorization](../../images/integrations/circleci/integrations-circleci-auth.png)
+    <Info>
+      If this is your project's first cloud integration, then you'll have to grant
+      Infisical access to your project's environment variables. Although this step
+      breaks E2EE, it's necessary for Infisical to sync the environment variables to
+      the cloud platform.
+    </Info>
+  </Step>
+  <Step title="Start integration">
+    Select which Infisical environment secrets you want to sync to which CircleCI project and press create integration to start syncing secrets to CircleCI.
 
-<Info>
-  If this is your project's first cloud integration, then you'll have to grant
-  Infisical access to your project's environment variables. Although this step
-  breaks E2EE, it's necessary for Infisical to sync the environment variables to
-  the cloud platform.
-</Info>
-
-## Start integration
-
-Select which Infisical environment secrets you want to sync to which CircleCI project and press create integration to start syncing secrets to CircleCI.
-
-![create integration circleci](../../images/integrations/circleci/integrations-circleci-create.png)
-![integrations circleci](../../images/integrations/circleci/integrations-circleci.png)
+    ![create integration circleci](../../images/integrations/circleci/integrations-circleci-create.png)
+    ![integrations circleci](../../images/integrations/circleci/integrations-circleci.png)
+  </Step>
+</Steps>

docs/integrations/cicd/codefresh.mdx

@@ -7,31 +7,32 @@ Prerequisites:
 
 - Set up and add envars to [Infisical Cloud](https://app.infisical.com)
 
-## Navigate to your project's integrations tab
+<Steps>
+  <Step title="Authorize Infisical for Codefresh">
+    Obtain an API key in User Settings > API Keys
 
-![integrations](../../images/integrations.png)
+    ![integrations codefresh dashboard](../../images/integrations/codefresh/integrations-codefresh-dashboard.png)
+    ![integrations codefresh token](../../images/integrations/codefresh/integrations-codefresh-token.png)
+    
+    Navigate to your project's integrations tab in Infisical.
 
-## Authorize Infisical for Codefresh
+    ![integrations](../../images/integrations.png)
+    
+    Press on the Codefresh tile and input your Codefresh API key to grant Infisical access to your Codefresh account.
 
-Obtain an API key in User Settings > API Keys
+    ![integrations codefresh authorization](../../images/integrations/codefresh/integrations-codefresh-auth.png)
 
-![integrations codefresh dashboard](../../images/integrations/codefresh/integrations-codefresh-dashboard.png)
-![integrations codefresh token](../../images/integrations/codefresh/integrations-codefresh-token.png)
+    <Info>
+      If this is your project's first cloud integration, then you'll have to grant
+      Infisical access to your project's environment variables. Although this step
+      breaks E2EE, it's necessary for Infisical to sync the environment variables to
+      the cloud platform.
+    </Info>
+  </Step>
+  <Step title="Start integration">
+    Select which Infisical environment secrets you want to sync to which Codefresh service and press create integration to start syncing secrets to Codefresh.
 
-Press on the Codefresh tile and input your Codefresh API key to grant Infisical access to your Codefresh account.
-
-![integrations codefresh authorization](../../images/integrations/codefresh/integrations-codefresh-auth.png)
-
-<Info>
-  If this is your project's first cloud integration, then you'll have to grant
-  Infisical access to your project's environment variables. Although this step
-  breaks E2EE, it's necessary for Infisical to sync the environment variables to
-  the cloud platform.
-</Info>
-
-## Start integration
-
-Select which Infisical environment secrets you want to sync to which Codefresh service and press create integration to start syncing secrets to Codefresh.
-
-![create integration codefresh](../../images/integrations/codefresh/integrations-codefresh-create.png)
-![integrations codefresh](../../images/integrations/codefresh/integrations-codefresh.png)
+    ![create integration codefresh](../../images/integrations/codefresh/integrations-codefresh-create.png)
+    ![integrations codefresh](../../images/integrations/codefresh/integrations-codefresh.png)
+  </Step>
+</Steps>

docs/integrations/cicd/githubactions.mdx

@@ -5,71 +5,71 @@ description: "How to sync secrets from Infisical to GitHub Actions"
 
 <Tabs>
   <Tab title="Usage">
-  <Warning>
-    Infisical can sync secrets to GitHub repo secrets only. If your repo uses environment secrets, then stay tuned with this [issue](https://github.com/Infisical/infisical/issues/54).
-</Warning>
+    <Warning>
+        Infisical can sync secrets to GitHub repo secrets only. If your repo uses environment secrets, then stay tuned with this [issue](https://github.com/Infisical/infisical/issues/54).
+    </Warning>
 
-Prerequisites:
+    Prerequisites:
 
-- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
-- Ensure you have admin privileges to the repo you want to sync secrets to.
+    - Set up and add envars to [Infisical Cloud](https://app.infisical.com)
+    - Ensure you have admin privileges to the repo you want to sync secrets to.
 
-## Navigate to your project's integrations tab
+    <Steps>
+      <Step title="Authorize Infisical for GitHub">
+        Navigate to your project's integrations tab in Infisical.
 
-![integrations](../../images/integrations.png)
+        ![integrations](../../images/integrations.png)
 
-## Authorize Infisical for GitHub
+        Press on the GitHub tile and grant Infisical access to your GitHub account (repo privileges only).
 
-Press on the GitHub tile and grant Infisical access to your GitHub account (repo privileges only).
+        ![integrations github authorization](../../images/integrations/github/integrations-github-auth.png)
 
-![integrations github authorization](../../images/integrations/github/integrations-github-auth.png)
+        <Info>
+          If this is your project's first cloud integration, then you'll have to grant Infisical access to your project's environment variables.
+          Although this step breaks E2EE, it's necessary for Infisical to sync the environment variables to the cloud platform.
+        </Info>
+      </Step>
+      <Step title="Start integration">
+        Select which Infisical environment secrets you want to sync to which GitHub repo and press start integration to start syncing secrets to the repo.
 
-<Info>
-  If this is your project's first cloud integration, then you'll have to grant Infisical access to your project's environment variables.
-  Although this step breaks E2EE, it's necessary for Infisical to sync the environment variables to the cloud platform.
-</Info>
-
-## Start integration
-
-Select which Infisical environment secrets you want to sync to which GitHub repo and press start integration to start syncing secrets to the repo.
-
-![integrations github](../../images/integrations/github/integrations-github.png)
+        ![integrations github](../../images/integrations/github/integrations-github.png)
+      </Step>
+    </Steps>
   </Tab>
   <Tab title="Self-Hosted Setup">
     Using the GitHub integration on a self-hosted instance of Infisical requires configuring an OAuth application in GitHub
     and registering your instance with it.
-    
-    ## Create an OAuth application in GitHub
-    
-    Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
-    
-   ![integrations github config](../../images/integrations/github/integrations-github-config-settings.png) 
-   ![integrations github config](../../images/integrations/github/integrations-github-config-dev-settings.png) 
-   ![integrations github config](../../images/integrations/github/integrations-github-config-new-app.png) 
+    <Steps>
+      <Step title="Create an OAuth application in GitHub">
+        Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
+        
+        ![integrations github config](../../images/integrations/github/integrations-github-config-settings.png) 
+        ![integrations github config](../../images/integrations/github/integrations-github-config-dev-settings.png) 
+        ![integrations github config](../../images/integrations/github/integrations-github-config-new-app.png) 
 
-    Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
-    and the **Authorization callback URL** to `https://your-domain.com/integrations/github/oauth2/callback`.
+        Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
+        and the **Authorization callback URL** to `https://your-domain.com/integrations/github/oauth2/callback`.
 
-   ![integrations github config](../../images/integrations/github/integrations-github-config-new-app-form.png) 
-    
-    <Note>
-      If you have a GitHub organization, you can create an OAuth application under it
-      in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
-    </Note>
-    
-    ## Add your OAuth application credentials to Infisical
-    
-    Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
-   
-   ![integrations github config](../../images/integrations/github/integrations-github-config-credentials.png) 
-   
-   Back in your Infisical instance, add two new environment variables for the credentials of your GitHub OAuth application:
+        ![integrations github config](../../images/integrations/github/integrations-github-config-new-app-form.png) 
+        
+        <Note>
+          If you have a GitHub organization, you can create an OAuth application under it
+          in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
+        </Note>
+      </Step>
+      <Step title="Add your OAuth application credentials to Infisical">
+        Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
+      
+        ![integrations github config](../../images/integrations/github/integrations-github-config-credentials.png) 
+      
+        Back in your Infisical instance, add two new environment variables for the credentials of your GitHub OAuth application:
 
-   - `CLIENT_ID_GITHUB`: The **Client ID** of your GitHub OAuth application.
-   - `CLIENT_SECRET_GITHUB`: The **Client Secret** of your GitHub OAuth application.
-   
-  Once added, restart your Infisical instance and use the GitHub integration.
-   
+        - `CLIENT_ID_GITHUB`: The **Client ID** of your GitHub OAuth application.
+        - `CLIENT_SECRET_GITHUB`: The **Client Secret** of your GitHub OAuth application.
+      
+        Once added, restart your Infisical instance and use the GitHub integration.
+      </Step>
+    </Steps>
   </Tab>
 </Tabs>