merge deconflict

frontend/src/hooks/api/appConnections/enums.ts

@@ -6,6 +6,7 @@ export enum AppConnection {
   AzureAppConfiguration = "azure-app-configuration",
   Databricks = "databricks",
   Humanitec = "humanitec",
+  TerraformCloud = "terraform-cloud",
   Vercel = "vercel",
   Postgres = "postgres",
   MsSql = "mssql",

frontend/src/hooks/api/appConnections/terraform-cloud/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/terraform-cloud/queries.tsx

@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TTerraformCloudOrganization } from "./types";
+
+const terraformCloudConnectionKeys = {
+  all: [...appConnectionKeys.all, "terraform-cloud"] as const,
+  listOrganizations: (connectionId: string) =>
+    [...terraformCloudConnectionKeys.all, "organizations", connectionId] as const
+};
+
+export const useTerraformCloudConnectionListOrganizations = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TTerraformCloudOrganization[],
+      unknown,
+      TTerraformCloudOrganization[],
+      ReturnType<typeof terraformCloudConnectionKeys.listOrganizations>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: terraformCloudConnectionKeys.listOrganizations(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TTerraformCloudOrganization[]>(
+        `/api/v1/app-connections/terraform-cloud/${connectionId}/organizations`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/terraform-cloud/types.ts

@@ -0,0 +1,56 @@
+export type TTerraformCloudOrganization = {
+  name: string;
+  id: string;
+  variableSets: TTerraformCloudVariableSet[];
+  workspaces: TTerraformCloudWorkspace[];
+};
+
+export type TTerraformCloudVariableSet = {
+  id: string;
+  name: string;
+};
+
+export type TTerraformCloudWorkspace = {
+  id: string;
+  name: string;
+};
+
+export type TTerraformCloudConnectionOrganization = {
+  id: string;
+  name: string;
+  variableSets: TTerraformCloudConnectionVariableSet[];
+  workspaces: TTerraformCloudConnectionWorkspace[];
+};
+
+export type TTerraformCloudConnectionVariableSet = {
+  id: string;
+  name: string;
+  description: string;
+  global: boolean;
+};
+
+export type TTerraformCloudConnectionWorkspace = {
+  id: string;
+  name: string;
+};
+
+export enum TerraformCloudSyncScope {
+  VariableSet = "variable-set",
+  Workspace = "workspace"
+}
+
+export enum TerraformCloudSyncCategory {
+  Environment = "env",
+  Terraform = "terraform"
+}
+
+export const TERRAFORM_CLOUD_SYNC_SCOPES = {
+  [TerraformCloudSyncScope.VariableSet]: {
+    name: "Variable Set",
+    description: "Sync secrets to a specific variable set in Terraform Cloud."
+  },
+  [TerraformCloudSyncScope.Workspace]: {
+    name: "Workspace",
+    description: "Sync secrets to a specific workspace in Terraform Cloud."
+  }
+};

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -39,6 +39,10 @@ export type THumanitecConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Humanitec;
 };
 
+export type TTerraformCloudConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.TerraformCloud;
+};
+
 export type TVercelConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Vercel;
 };
@@ -67,6 +71,7 @@ export type TAppConnectionOption =
   | TAzureKeyVaultConnectionOption
   | TDatabricksConnectionOption
   | THumanitecConnectionOption
+  | TTerraformCloudConnectionOption
   | TVercelConnectionOption
   | TPostgresConnectionOption
   | TMsSqlConnectionOption
@@ -81,6 +86,7 @@ export type TAppConnectionOptionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnectionOption;
   [AppConnection.Databricks]: TDatabricksConnectionOption;
   [AppConnection.Humanitec]: THumanitecConnectionOption;
+  [AppConnection.TerraformCloud]: TTerraformCloudConnectionOption;
   [AppConnection.Vercel]: TVercelConnectionOption;
   [AppConnection.Postgres]: TPostgresConnectionOption;
   [AppConnection.MsSql]: TMsSqlConnectionOption;

frontend/src/hooks/api/appConnections/types/index.ts

@@ -11,6 +11,7 @@ import { TGitHubConnection } from "./github-connection";
 import { THumanitecConnection } from "./humanitec-connection";
 import { TMsSqlConnection } from "./mssql-connection";
 import { TPostgresConnection } from "./postgres-connection";
+import { TTerraformCloudConnection } from "./terraform-cloud-connection";
 import { TVercelConnection } from "./vercel-connection";
 
 export * from "./auth0-connection";
@@ -24,6 +25,7 @@ export * from "./github-connection";
 export * from "./humanitec-connection";
 export * from "./mssql-connection";
 export * from "./postgres-connection";
+export * from "./terraform-cloud-connection";
 export * from "./vercel-connection";
 
 export type TAppConnection =
@@ -34,6 +36,7 @@ export type TAppConnection =
   | TAzureAppConfigurationConnection
   | TDatabricksConnection
   | THumanitecConnection
+  | TTerraformCloudConnection
   | TVercelConnection
   | TPostgresConnection
   | TMsSqlConnection
@@ -73,6 +76,7 @@ export type TAppConnectionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
+  [AppConnection.TerraformCloud]: TTerraformCloudConnection;
   [AppConnection.Vercel]: TVercelConnection;
   [AppConnection.Postgres]: TPostgresConnection;
   [AppConnection.MsSql]: TMsSqlConnection;

frontend/src/hooks/api/appConnections/types/terraform-cloud-connection.ts

@@ -0,0 +1,15 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum TerraformCloudConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TTerraformCloudConnection = TRootAppConnection & {
+  app: AppConnection.TerraformCloud;
+} & {
+  method: TerraformCloudConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+  };
+};

frontend/src/hooks/api/auditLogs/constants.tsx

@@ -106,6 +106,10 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.GET_CMEK]: "Get KMS key",
   [EventType.CMEK_ENCRYPT]: "Encrypt with KMS key",
   [EventType.CMEK_DECRYPT]: "Decrypt with KMS key",
+  [EventType.CMEK_SIGN]: "Sign with KMS key",
+  [EventType.CMEK_VERIFY]: "Verify with KMS key",
+  [EventType.CMEK_LIST_SIGNING_ALGORITHMS]: "List signing algorithms for KMS key",
+  [EventType.CMEK_GET_PUBLIC_KEY]: "Get public key for KMS key",
   [EventType.UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]:
     "Update SSO group to organization role mapping",
   [EventType.GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]: "List SSO group to organization role mapping",

frontend/src/hooks/api/auditLogs/enums.tsx

@@ -110,6 +110,10 @@ export enum EventType {
   GET_CMEK = "get-cmek",
   CMEK_ENCRYPT = "cmek-encrypt",
   CMEK_DECRYPT = "cmek-decrypt",
+  CMEK_SIGN = "cmek-sign",
+  CMEK_VERIFY = "cmek-verify",
+  CMEK_LIST_SIGNING_ALGORITHMS = "cmek-list-signing-algorithms",
+  CMEK_GET_PUBLIC_KEY = "cmek-get-public-key",
   UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
   GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "get-external-group-org-role-mapping",
   GET_PROJECT_TEMPLATES = "get-project-templates",

frontend/src/hooks/api/cmeks/mutations.tsx

@@ -8,6 +8,10 @@ import {
   TCmekDecryptResponse,
   TCmekEncrypt,
   TCmekEncryptResponse,
+  TCmekSign,
+  TCmekSignResponse,
+  TCmekVerify,
+  TCmekVerifyResponse,
   TCreateCmek,
   TDeleteCmek,
   TUpdateCmek
@@ -74,6 +78,44 @@ export const useCmekEncrypt = () => {
   });
 };
 
+export const useCmekSign = () => {
+  return useMutation({
+    mutationFn: async ({
+      keyId,
+      data,
+      signingAlgorithm,
+      isBase64Encoded
+    }: TCmekSign & { isBase64Encoded: boolean }) => {
+      const res = await apiRequest.post<TCmekSignResponse>(`/api/v1/kms/keys/${keyId}/sign`, {
+        data: isBase64Encoded ? data : encodeBase64(Buffer.from(data)),
+        signingAlgorithm
+      });
+
+      return res.data;
+    }
+  });
+};
+
+export const useCmekVerify = () => {
+  return useMutation({
+    mutationFn: async ({
+      keyId,
+      data,
+      signature,
+      signingAlgorithm,
+      isBase64Encoded
+    }: TCmekVerify & { isBase64Encoded: boolean }) => {
+      const res = await apiRequest.post<TCmekVerifyResponse>(`/api/v1/kms/keys/${keyId}/verify`, {
+        data: isBase64Encoded ? data : encodeBase64(Buffer.from(data)),
+        signature,
+        signingAlgorithm
+      });
+
+      return res.data;
+    }
+  });
+};
+
 export const useCmekDecrypt = () => {
   return useMutation({
     mutationFn: async ({ keyId, ciphertext }: TCmekDecrypt) => {

frontend/src/hooks/api/cmeks/types.ts

@@ -1,10 +1,18 @@
+import { z } from "zod";
+
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 
+export enum KmsKeyUsage {
+  ENCRYPT_DECRYPT = "encrypt-decrypt",
+  SIGN_VERIFY = "sign-verify"
+}
+
 export type TCmek = {
   id: string;
+  keyUsage: KmsKeyUsage;
   name: string;
   description?: string;
-  encryptionAlgorithm: EncryptionAlgorithm;
+  encryptionAlgorithm: AsymmetricKeyAlgorithm | SymmetricKeyAlgorithm;
   projectId: string;
   isDisabled: boolean;
   isReserved: boolean;
@@ -17,7 +25,8 @@ export type TCmek = {
 type ProjectRef = { projectId: string };
 type KeyRef = { keyId: string };
 
-export type TCreateCmek = Pick<TCmek, "name" | "description" | "encryptionAlgorithm"> & ProjectRef;
+export type TCreateCmek = Pick<TCmek, "name" | "description" | "encryptionAlgorithm" | "keyUsage"> &
+  ProjectRef;
 export type TUpdateCmek = KeyRef &
   Partial<Pick<TCmek, "name" | "description" | "isDisabled">> &
   ProjectRef;
@@ -26,6 +35,13 @@ export type TDeleteCmek = KeyRef & ProjectRef;
 export type TCmekEncrypt = KeyRef & { plaintext: string; isBase64Encoded?: boolean };
 export type TCmekDecrypt = KeyRef & { ciphertext: string };
 
+export type TCmekSign = KeyRef & { data: string; signingAlgorithm: SigningAlgorithm };
+export type TCmekVerify = KeyRef & {
+  data: string;
+  signature: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
 export type TProjectCmeksList = {
   keys: TCmek[];
   totalCount: number;
@@ -44,6 +60,18 @@ export type TCmekEncryptResponse = {
   ciphertext: string;
 };
 
+export type TCmekSignResponse = {
+  signature: string;
+  keyId: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
+export type TCmekVerifyResponse = {
+  signatureValid: boolean;
+  keyId: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
 export type TCmekDecryptResponse = {
   plaintext: string;
 };
@@ -52,7 +80,35 @@ export enum CmekOrderBy {
   Name = "name"
 }
 
-export enum EncryptionAlgorithm {
+export enum AsymmetricKeyAlgorithm {
+  RSA_4096 = "RSA_4096",
+  ECC_NIST_P256 = "ECC_NIST_P256"
+}
+
+// Supported symmetric encrypt/decrypt algorithms
+export enum SymmetricKeyAlgorithm {
   AES_GCM_256 = "aes-256-gcm",
   AES_GCM_128 = "aes-128-gcm"
 }
+
+export const AllowedEncryptionKeyAlgorithms = z.enum([
+  ...Object.values(SymmetricKeyAlgorithm),
+  ...Object.values(AsymmetricKeyAlgorithm)
+] as [string, ...string[]]).options;
+
+export enum SigningAlgorithm {
+  // RSA PSS algorithms
+  RSASSA_PSS_SHA_256 = "RSASSA_PSS_SHA_256",
+  RSASSA_PSS_SHA_384 = "RSASSA_PSS_SHA_384",
+  RSASSA_PSS_SHA_512 = "RSASSA_PSS_SHA_512",
+
+  // RSA PKCS#1 v1.5 algorithms
+  RSASSA_PKCS1_V1_5_SHA_256 = "RSASSA_PKCS1_V1_5_SHA_256",
+  RSASSA_PKCS1_V1_5_SHA_384 = "RSASSA_PKCS1_V1_5_SHA_384",
+  RSASSA_PKCS1_V1_5_SHA_512 = "RSASSA_PKCS1_V1_5_SHA_512",
+
+  // ECDSA algorithms
+  ECDSA_SHA_256 = "ECDSA_SHA_256",
+  ECDSA_SHA_384 = "ECDSA_SHA_384",
+  ECDSA_SHA_512 = "ECDSA_SHA_512"
+}

frontend/src/hooks/api/dashboard/types.ts

@@ -24,6 +24,7 @@ export type DashboardProjectSecretsOverviewResponse = {
   totalUniqueDynamicSecretsInPage: number;
   totalUniqueFoldersInPage: number;
   totalUniqueSecretImportsInPage: number;
+  importedByEnvs?: { environment: string; importedBy: ProjectSecretsImportedBy[] }[];
   totalUniqueSecretRotationsInPage: number;
 };
 
@@ -41,6 +42,16 @@ export type DashboardProjectSecretsDetailsResponse = {
   totalSecretCount?: number;
   totalSecretRotationCount?: number;
   totalCount: number;
+  importedBy?: ProjectSecretsImportedBy[];
+};
+
+export type ProjectSecretsImportedBy = {
+  environment: { name: string; slug: string };
+  folders: {
+    name: string;
+    secrets?: { secretId: string; referencedSecretKey: string }[];
+    isImported: boolean;
+  }[];
 };
 
 export type DashboardProjectSecretsByKeys = {

frontend/src/hooks/api/dynamicSecret/types.ts

@@ -13,6 +13,7 @@ export type TDynamicSecret = {
   status?: DynamicSecretStatus;
   statusDetails?: string;
   maxTTL: string;
+  metadata?: { key: string; value: string }[];
 };
 
 export enum DynamicSecretProviders {
@@ -261,6 +262,7 @@ export type TDynamicSecretProvider =
             digits?: number;
           };
     };
+
 export type TCreateDynamicSecretDTO = {
   projectSlug: string;
   provider: TDynamicSecretProvider;
@@ -269,6 +271,7 @@ export type TCreateDynamicSecretDTO = {
   path: string;
   environmentSlug: string;
   name: string;
+  metadata?: { key: string; value: string }[];
 };
 
 export type TUpdateDynamicSecretDTO = {
@@ -278,6 +281,7 @@ export type TUpdateDynamicSecretDTO = {
   environmentSlug: string;
   data: {
     newName?: string;
+    metadata?: { key: string; value: string }[];
     defaultTTL?: string;
     maxTTL?: string | null;
     inputs?: unknown;

frontend/src/hooks/api/integrations/types.ts

@@ -1,6 +1,7 @@
 export type TCloudIntegration = {
   name: string;
   slug: string;
+  syncSlug?: string;
   image: string;
   isAvailable: boolean;
   type: string;

frontend/src/hooks/api/secretRotation/types.ts

@@ -45,6 +45,7 @@ export type TSecretRotationProviderTemplate = {
   image?: string;
   description?: string;
   template: THttpProviderTemplate | TDbProviderTemplate;
+  isDeprecated?: boolean;
 };
 
 export type THttpProviderTemplate = {

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -7,6 +7,7 @@ export enum SecretSync {
   AzureAppConfiguration = "azure-app-configuration",
   Databricks = "databricks",
   Humanitec = "humanitec",
+  TerraformCloud = "terraform-cloud",
   Camunda = "camunda",
   Vercel = "vercel"
 }

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -10,6 +10,7 @@ import { TAzureKeyVaultSync } from "./azure-key-vault-sync";
 import { TCamundaSync } from "./camunda-sync";
 import { TGcpSync } from "./gcp-sync";
 import { THumanitecSync } from "./humanitec-sync";
+import { TTerraformCloudSync } from "./terraform-cloud-sync";
 import { TVercelSync } from "./vercel-sync";
 
 export type TSecretSyncOption = {
@@ -27,6 +28,7 @@ export type TSecretSync =
   | TAzureAppConfigurationSync
   | TDatabricksSync
   | THumanitecSync
+  | TTerraformCloudSync
   | TCamundaSync
   | TVercelSync;
 

frontend/src/hooks/api/secretSyncs/types/terraform-cloud-sync.ts

@@ -0,0 +1,34 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+import { TerraformCloudSyncCategory } from "../../appConnections/terraform-cloud";
+
+export type TTerraformCloudSync = TRootSecretSync & {
+  destination: SecretSync.TerraformCloud;
+  destinationConfig:
+    | {
+        scope: TerraformCloudSyncScope.VariableSet;
+        org: string;
+        category: TerraformCloudSyncCategory;
+        variableSetId: string;
+        variableSetName: string;
+      }
+    | {
+        scope: TerraformCloudSyncScope.Workspace;
+        org: string;
+        category: TerraformCloudSyncCategory;
+        workspaceId: string;
+        workspaceName: string;
+      };
+  connection: {
+    app: AppConnection.TerraformCloud;
+    name: string;
+    id: string;
+  };
+};
+
+export enum TerraformCloudSyncScope {
+  VariableSet = "variable-set",
+  Workspace = "workspace"
+}