Merge branch 'main' into feat/point-in-time-revamp

frontend/src/hooks/api/admin/index.ts

@@ -3,6 +3,7 @@ export {
   useAdminGrantServerAdminAccess,
   useAdminRemoveIdentitySuperAdminAccess,
   useCreateAdminUser,
+  useInvalidateCache,
   useRemoveUserServerAdminAccess,
   useUpdateServerConfig,
   useUpdateServerEncryptionStrategy

frontend/src/hooks/api/admin/mutation.ts

@@ -8,6 +8,7 @@ import { adminQueryKeys, adminStandaloneKeys } from "./queries";
 import {
   RootKeyEncryptionStrategy,
   TCreateAdminUserDTO,
+  TInvalidateCacheDTO,
   TServerConfig,
   TUpdateServerConfigDTO
 } from "./types";
@@ -126,3 +127,15 @@ export const useUpdateServerEncryptionStrategy = () => {
     }
   });
 };
+
+export const useInvalidateCache = () => {
+  const queryClient = useQueryClient();
+  return useMutation<void, object, TInvalidateCacheDTO>({
+    mutationFn: async (dto) => {
+      await apiRequest.post("/api/v1/admin/invalidate-cache", dto);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: adminQueryKeys.getInvalidateCache() });
+    }
+  });
+};

frontend/src/hooks/api/admin/queries.ts

@@ -8,6 +8,7 @@ import {
   AdminGetIdentitiesFilters,
   AdminGetUsersFilters,
   AdminIntegrationsConfig,
+  TGetInvalidatingCacheStatus,
   TGetServerRootKmsEncryptionDetails,
   TServerConfig
 } from "./types";
@@ -22,8 +23,10 @@ export const adminQueryKeys = {
   getUsers: (filters: AdminGetUsersFilters) => [adminStandaloneKeys.getUsers, { filters }] as const,
   getIdentities: (filters: AdminGetIdentitiesFilters) =>
     [adminStandaloneKeys.getIdentities, { filters }] as const,
-  getAdminIntegrationsConfig: () => ["admin-integrations-config"] as const,
-  getServerEncryptionStrategies: () => ["server-encryption-strategies"] as const
+  getAdminSlackConfig: () => ["admin-slack-config"] as const,
+  getServerEncryptionStrategies: () => ["server-encryption-strategies"] as const,
+  getInvalidateCache: () => ["admin-invalidate-cache"] as const,
+  getAdminIntegrationsConfig: () => ["admin-integrations-config"] as const
 };
 
 export const fetchServerConfig = async () => {
@@ -118,3 +121,18 @@ export const useGetServerRootKmsEncryptionDetails = () => {
     }
   });
 };
+
+export const useGetInvalidatingCacheStatus = (enabled = true) => {
+  return useQuery({
+    queryKey: adminQueryKeys.getInvalidateCache(),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGetInvalidatingCacheStatus>(
+        "/api/v1/admin/invalidating-cache-status"
+      );
+
+      return data.invalidating;
+    },
+    enabled,
+    refetchInterval: (data) => (data ? 3000 : false)
+  });
+};

frontend/src/hooks/api/admin/types.ts

@@ -24,6 +24,7 @@ export type TServerConfig = {
   enabledLoginMethods: LoginMethod[];
   authConsentContent?: string;
   pageFrameContent?: string;
+  invalidatingCache: boolean;
 };
 
 export type TUpdateServerConfigDTO = {
@@ -84,3 +85,16 @@ export enum RootKeyEncryptionStrategy {
   Software = "SOFTWARE",
   HSM = "HSM"
 }
+
+export enum CacheType {
+  ALL = "all",
+  SECRETS = "secrets"
+}
+
+export type TInvalidateCacheDTO = {
+  type: CacheType;
+};
+
+export type TGetInvalidatingCacheStatus = {
+  invalidating: boolean;
+};

frontend/src/hooks/api/appConnections/enums.ts

@@ -16,5 +16,6 @@ export enum AppConnection {
   Auth0 = "auth0",
   HCVault = "hashicorp-vault",
   LDAP = "ldap",
-  TeamCity = "teamcity"
+  TeamCity = "teamcity",
+  OCI = "oci"
 }

frontend/src/hooks/api/appConnections/oci/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/oci/queries.tsx

@@ -0,0 +1,108 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import {
+  TListOCIVaultKeys,
+  TListOCIVaults,
+  TOCICompartment,
+  TOCIVault,
+  TOCIVaultKey
+} from "./types";
+
+const ociConnectionKeys = {
+  all: [...appConnectionKeys.all, "oci"] as const,
+  listCompartments: (connectionId: string) =>
+    [...ociConnectionKeys.all, "compartments", connectionId] as const,
+  listVaults: (connectionId: string, compartmentOcid: string) =>
+    [...ociConnectionKeys.all, "vaults", connectionId, compartmentOcid] as const,
+  listVaultKeys: (connectionId: string, compartmentOcid: string, vaultOcid: string) =>
+    [...ociConnectionKeys.all, "keys", connectionId, compartmentOcid, vaultOcid] as const
+};
+
+export const useOCIConnectionListCompartments = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TOCICompartment[],
+      unknown,
+      TOCICompartment[],
+      ReturnType<typeof ociConnectionKeys.listCompartments>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: ociConnectionKeys.listCompartments(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TOCICompartment[]>(
+        `/api/v1/app-connections/oci/${connectionId}/compartments`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
+
+export const useOCIConnectionListVaults = (
+  { connectionId, compartmentOcid }: TListOCIVaults,
+  options?: Omit<
+    UseQueryOptions<
+      TOCIVault[],
+      unknown,
+      TOCIVault[],
+      ReturnType<typeof ociConnectionKeys.listVaults>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: ociConnectionKeys.listVaults(connectionId, compartmentOcid),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TOCIVault[]>(
+        `/api/v1/app-connections/oci/${connectionId}/vaults`,
+        {
+          params: {
+            compartmentOcid
+          }
+        }
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
+
+export const useOCIConnectionListVaultKeys = (
+  { connectionId, compartmentOcid, vaultOcid }: TListOCIVaultKeys,
+  options?: Omit<
+    UseQueryOptions<
+      TOCIVaultKey[],
+      unknown,
+      TOCIVaultKey[],
+      ReturnType<typeof ociConnectionKeys.listVaultKeys>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: ociConnectionKeys.listVaultKeys(connectionId, compartmentOcid, vaultOcid),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TOCIVaultKey[]>(
+        `/api/v1/app-connections/oci/${connectionId}/vault-keys`,
+        {
+          params: {
+            compartmentOcid,
+            vaultOcid
+          }
+        }
+      );
+
+      return data;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/oci/types.ts

@@ -0,0 +1,27 @@
+// Response types
+export type TOCICompartment = {
+  id: string;
+  name: string;
+};
+
+export type TOCIVault = {
+  id: string;
+  displayName: string;
+};
+
+export type TOCIVaultKey = {
+  id: string;
+  displayName: string;
+};
+
+// Param types
+export type TListOCIVaults = {
+  connectionId: string;
+  compartmentOcid: string;
+};
+
+export type TListOCIVaultKeys = {
+  connectionId: string;
+  compartmentOcid: string;
+  vaultOcid: string;
+};

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -84,6 +84,10 @@ export type TTeamCityConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.TeamCity;
 };
 
+export type TOCIConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.OCI;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
@@ -101,7 +105,8 @@ export type TAppConnectionOption =
   | TWindmillConnectionOption
   | TAuth0ConnectionOption
   | THCVaultConnectionOption
-  | TTeamCityConnectionOption;
+  | TTeamCityConnectionOption
+  | TOCIConnectionOption;
 
 export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
@@ -122,4 +127,5 @@ export type TAppConnectionOptionMap = {
   [AppConnection.HCVault]: THCVaultConnectionOption;
   [AppConnection.LDAP]: TLdapConnectionOption;
   [AppConnection.TeamCity]: TTeamCityConnectionOption;
+  [AppConnection.OCI]: TOCIConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/index.ts

@@ -13,6 +13,7 @@ import { THCVaultConnection } from "./hc-vault-connection";
 import { THumanitecConnection } from "./humanitec-connection";
 import { TLdapConnection } from "./ldap-connection";
 import { TMsSqlConnection } from "./mssql-connection";
+import { TOCIConnection } from "./oci-connection";
 import { TPostgresConnection } from "./postgres-connection";
 import { TTeamCityConnection } from "./teamcity-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
@@ -32,6 +33,7 @@ export * from "./hc-vault-connection";
 export * from "./humanitec-connection";
 export * from "./ldap-connection";
 export * from "./mssql-connection";
+export * from "./oci-connection";
 export * from "./postgres-connection";
 export * from "./teamcity-connection";
 export * from "./terraform-cloud-connection";
@@ -56,7 +58,8 @@ export type TAppConnection =
   | TAuth0Connection
   | THCVaultConnection
   | TLdapConnection
-  | TTeamCityConnection;
+  | TTeamCityConnection
+  | TOCIConnection;
 
 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
 
@@ -102,4 +105,5 @@ export type TAppConnectionMap = {
   [AppConnection.HCVault]: THCVaultConnection;
   [AppConnection.LDAP]: TLdapConnection;
   [AppConnection.TeamCity]: TTeamCityConnection;
+  [AppConnection.OCI]: TOCIConnection;
 };

frontend/src/hooks/api/appConnections/types/oci-connection.ts

@@ -0,0 +1,17 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum OCIConnectionMethod {
+  AccessKey = "access-key"
+}
+
+export type TOCIConnection = TRootAppConnection & { app: AppConnection.OCI } & {
+  method: OCIConnectionMethod.AccessKey;
+  credentials: {
+    userOcid: string;
+    tenancyOcid: string;
+    region: string;
+    fingerprint: string;
+    privateKey: string;
+  };
+};

frontend/src/hooks/api/auditLogs/constants.tsx

@@ -72,6 +72,8 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.DELETE_CERT]: "Delete certificate",
   [EventType.REVOKE_CERT]: "Revoke certificate",
   [EventType.GET_CERT_BODY]: "Get certificate body",
+  [EventType.GET_CERT_PRIVATE_KEY]: "Get certificate private key",
+  [EventType.GET_CERT_BUNDLE]: "Get certificate bundle",
   [EventType.CREATE_PKI_ALERT]: "Create PKI alert",
   [EventType.GET_PKI_ALERT]: "Get PKI alert",
   [EventType.UPDATE_PKI_ALERT]: "Update PKI alert",
@@ -180,10 +182,17 @@ export const eventToNameMap: { [K in EventType]: string } = {
     "Microsoft Teams Workflow Integration Check Installation Status",
   [EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET_TEAMS]: "Get Microsoft Teams tenant teams",
   [EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET]: "Get Microsoft Teams Workflow Integration",
-  [EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST]: "List Microsoft Teams Workflow Integration"
+  [EventType.MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST]:
+    "List Microsoft Teams Workflow Integration",
+
+  [EventType.LOGIN_IDENTITY_LDAP_AUTH]: "Identity login via LDAP Auth",
+  [EventType.ADD_IDENTITY_LDAP_AUTH]: "Attached LDAP Auth to identity",
+  [EventType.UPDATE_IDENTITY_LDAP_AUTH]: "Updated LDAP Auth for identity",
+  [EventType.GET_IDENTITY_LDAP_AUTH]: "Retrieved LDAP Auth for identity",
+  [EventType.REVOKE_IDENTITY_LDAP_AUTH]: "Revoked LDAP Auth for identity"
 };
 
-export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = {
+export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = {
   [UserAgentType.WEB]: "Web",
   [UserAgentType.CLI]: "CLI",
   [UserAgentType.K8_OPERATOR]: "K8s operator",

frontend/src/hooks/api/auditLogs/enums.tsx

@@ -47,6 +47,13 @@ export enum EventType {
   CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "create-identity-universal-auth-client-secret",
   REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "revoke-identity-universal-auth-client-secret",
   GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS = "get-identity-universal-auth-client-secret",
+
+  LOGIN_IDENTITY_LDAP_AUTH = "login-identity-ldap-auth",
+  ADD_IDENTITY_LDAP_AUTH = "add-identity-ldap-auth",
+  UPDATE_IDENTITY_LDAP_AUTH = "update-identity-ldap-auth",
+  GET_IDENTITY_LDAP_AUTH = "get-identity-ldap-auth",
+  REVOKE_IDENTITY_LDAP_AUTH = "revoke-identity-ldap-auth",
+
   CREATE_ENVIRONMENT = "create-environment",
   UPDATE_ENVIRONMENT = "update-environment",
   DELETE_ENVIRONMENT = "delete-environment",
@@ -78,6 +85,8 @@ export enum EventType {
   DELETE_CERT = "delete-cert",
   REVOKE_CERT = "revoke-cert",
   GET_CERT_BODY = "get-cert-body",
+  GET_CERT_PRIVATE_KEY = "get-cert-private-key",
+  GET_CERT_BUNDLE = "get-cert-bundle",
   CREATE_PKI_ALERT = "create-pki-alert",
   GET_PKI_ALERT = "get-pki-alert",
   UPDATE_PKI_ALERT = "update-pki-alert",

frontend/src/hooks/api/auditLogs/types.tsx

@@ -620,6 +620,24 @@ interface GetCertBody {
   };
 }
 
+interface GetCertPrivateKey {
+  type: EventType.GET_CERT_PRIVATE_KEY;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
+interface GetCertBundle {
+  type: EventType.GET_CERT_BUNDLE;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
 interface CreatePkiAlert {
   type: EventType.CREATE_PKI_ALERT;
   metadata: {
@@ -881,6 +899,8 @@ export type Event =
   | DeleteCert
   | RevokeCert
   | GetCertBody
+  | GetCertPrivateKey
+  | GetCertBundle
   | CreatePkiAlert
   | GetPkiAlert
   | UpdatePkiAlert

frontend/src/hooks/api/certificates/mutations.tsx

@@ -2,6 +2,7 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 
 import { apiRequest } from "@app/config/request";
 
+import { pkiSubscriberKeys } from "../pkiSubscriber/queries";
 import { workspaceKeys } from "../workspace";
 import { TCertificate, TDeleteCertDTO, TRevokeCertDTO } from "./types";
 
@@ -42,6 +43,9 @@ export const useRevokeCert = () => {
       queryClient.invalidateQueries({
         queryKey: workspaceKeys.forWorkspaceCertificates(projectSlug)
       });
+      queryClient.invalidateQueries({
+        queryKey: pkiSubscriberKeys.allPkiSubscriberCertificates()
+      });
     }
   });
 };

frontend/src/hooks/api/certificates/queries.tsx

@@ -6,7 +6,8 @@ import { TCertificate } from "./types";
 
 export const certKeys = {
   getCertById: (serialNumber: string) => [{ serialNumber }, "cert"],
-  getCertBody: (serialNumber: string) => [{ serialNumber }, "certBody"]
+  getCertBody: (serialNumber: string) => [{ serialNumber }, "certBody"],
+  getCertBundle: (serialNumber: string) => [{ serialNumber }, "certBundle"]
 };
 
 export const useGetCert = (serialNumber: string) => {
@@ -38,3 +39,19 @@ export const useGetCertBody = (serialNumber: string) => {
     enabled: Boolean(serialNumber)
   });
 };
+
+export const useGetCertBundle = (serialNumber: string) => {
+  return useQuery({
+    queryKey: certKeys.getCertBundle(serialNumber),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        certificate: string;
+        certificateChain: string;
+        serialNumber: string;
+        privateKey: string | null;
+      }>(`/api/v1/pki/certificates/${serialNumber}/bundle`);
+      return data;
+    },
+    enabled: Boolean(serialNumber)
+  });
+};

frontend/src/hooks/api/gateways/mutation.tsx

@@ -20,8 +20,8 @@ export const useDeleteGatewayById = () => {
 export const useUpdateGatewayById = () => {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: ({ id, name, projectIds }: TUpdateGatewayDTO) => {
-      return apiRequest.patch(`/api/v1/gateways/${id}`, { name, projectIds });
+    mutationFn: ({ id, name }: TUpdateGatewayDTO) => {
+      return apiRequest.patch(`/api/v1/gateways/${id}`, { name });
     },
     onSuccess: () => {
       queryClient.invalidateQueries(gatewaysQueryKeys.list());

frontend/src/hooks/api/gateways/queries.tsx

@@ -2,7 +2,7 @@ import { queryOptions } from "@tanstack/react-query";
 
 import { apiRequest } from "@app/config/request";
 
-import { TGateway, TListProjectGatewayDTO, TProjectGateway } from "./types";
+import { TGateway } from "./types";
 
 export const gatewaysQueryKeys = {
   allKey: () => ["gateways"],
@@ -14,20 +14,5 @@ export const gatewaysQueryKeys = {
         const { data } = await apiRequest.get<{ gateways: TGateway[] }>("/api/v1/gateways");
         return data.gateways;
       }
-    }),
-  listProjectGatewayKey: ({ projectId }: TListProjectGatewayDTO) => [
-    ...gatewaysQueryKeys.allKey(),
-    "list",
-    { projectId }
-  ],
-  listProjectGateways: ({ projectId }: TListProjectGatewayDTO) =>
-    queryOptions({
-      queryKey: gatewaysQueryKeys.listProjectGatewayKey({ projectId }),
-      queryFn: async () => {
-        const { data } = await apiRequest.get<{ gateways: TProjectGateway[] }>(
-          `/api/v1/gateways/projects/${projectId}`
-        );
-        return data.gateways;
-      }
     })
 };

frontend/src/hooks/api/gateways/types.ts

@@ -11,39 +11,13 @@ export type TGateway = {
     name: string;
     id: string;
   };
-  projects: {
-    name: string;
-    id: string;
-    slug: string;
-  }[];
-};
-
-export type TProjectGateway = {
-  id: string;
-  identityId: string;
-  name: string;
-  createdAt: string;
-  updatedAt: string;
-  issuedAt: string;
-  serialNumber: string;
-  heartbeat: string;
-  projectGatewayId: string;
-  identity: {
-    name: string;
-    id: string;
-  };
 };
 
 export type TUpdateGatewayDTO = {
   id: string;
   name?: string;
-  projectIds?: string[];
 };
 
 export type TDeleteGatewayDTO = {
   id: string;
 };
-
-export type TListProjectGatewayDTO = {
-  projectId: string;
-};

frontend/src/hooks/api/identities/constants.tsx

@@ -7,6 +7,8 @@ export const identityAuthToNameMap: { [I in IdentityAuthMethod]: string } = {
   [IdentityAuthMethod.GCP_AUTH]: "GCP Auth",
   [IdentityAuthMethod.AWS_AUTH]: "AWS Auth",
   [IdentityAuthMethod.AZURE_AUTH]: "Azure Auth",
+  [IdentityAuthMethod.OCI_AUTH]: "OCI Auth",
   [IdentityAuthMethod.OIDC_AUTH]: "OIDC Auth",
+  [IdentityAuthMethod.LDAP_AUTH]: "LDAP Auth",
   [IdentityAuthMethod.JWT_AUTH]: "JWT Auth"
 };

frontend/src/hooks/api/identities/enums.tsx

@@ -5,7 +5,9 @@ export enum IdentityAuthMethod {
   GCP_AUTH = "gcp-auth",
   AWS_AUTH = "aws-auth",
   AZURE_AUTH = "azure-auth",
+  OCI_AUTH = "oci-auth",
   OIDC_AUTH = "oidc-auth",
+  LDAP_AUTH = "ldap-auth",
   JWT_AUTH = "jwt-auth"
 }
 

frontend/src/hooks/api/identities/index.tsx

@@ -1,51 +1,4 @@
 export { identityAuthToNameMap } from "./constants";
 export { IdentityAuthMethod } from "./enums";
-export {
-  useAddIdentityAwsAuth,
-  useAddIdentityAzureAuth,
-  useAddIdentityGcpAuth,
-  useAddIdentityJwtAuth,
-  useAddIdentityKubernetesAuth,
-  useAddIdentityOidcAuth,
-  useAddIdentityTokenAuth,
-  useAddIdentityUniversalAuth,
-  useCreateIdentity,
-  useCreateIdentityUniversalAuthClientSecret,
-  useCreateTokenIdentityTokenAuth,
-  useDeleteIdentity,
-  useDeleteIdentityAwsAuth,
-  useDeleteIdentityAzureAuth,
-  useDeleteIdentityGcpAuth,
-  useDeleteIdentityJwtAuth,
-  useDeleteIdentityKubernetesAuth,
-  useDeleteIdentityOidcAuth,
-  useDeleteIdentityTokenAuth,
-  useDeleteIdentityUniversalAuth,
-  useRevokeIdentityTokenAuthToken,
-  useRevokeIdentityUniversalAuthClientSecret,
-  useUpdateIdentity,
-  useUpdateIdentityAwsAuth,
-  useUpdateIdentityAzureAuth,
-  useUpdateIdentityGcpAuth,
-  useUpdateIdentityJwtAuth,
-  useUpdateIdentityKubernetesAuth,
-  useUpdateIdentityOidcAuth,
-  useUpdateIdentityTokenAuth,
-  useUpdateIdentityTokenAuthToken,
-  useUpdateIdentityUniversalAuth
-} from "./mutations";
-export {
-  useGetIdentityAwsAuth,
-  useGetIdentityAzureAuth,
-  useGetIdentityById,
-  useGetIdentityGcpAuth,
-  useGetIdentityJwtAuth,
-  useGetIdentityKubernetesAuth,
-  useGetIdentityOidcAuth,
-  useGetIdentityProjectMemberships,
-  useGetIdentityTokenAuth,
-  useGetIdentityTokensTokenAuth,
-  useGetIdentityUniversalAuth,
-  useGetIdentityUniversalAuthClientSecrets,
-  useSearchIdentities
-} from "./queries";
+export * from "./mutations";
+export * from "./queries";

frontend/src/hooks/api/identities/mutations.tsx

@@ -10,6 +10,8 @@ import {
   AddIdentityGcpAuthDTO,
   AddIdentityJwtAuthDTO,
   AddIdentityKubernetesAuthDTO,
+  AddIdentityLdapAuthDTO,
+  AddIdentityOciAuthDTO,
   AddIdentityOidcAuthDTO,
   AddIdentityTokenAuthDTO,
   AddIdentityUniversalAuthDTO,
@@ -25,6 +27,8 @@ import {
   DeleteIdentityGcpAuthDTO,
   DeleteIdentityJwtAuthDTO,
   DeleteIdentityKubernetesAuthDTO,
+  DeleteIdentityLdapAuthDTO,
+  DeleteIdentityOciAuthDTO,
   DeleteIdentityOidcAuthDTO,
   DeleteIdentityTokenAuthDTO,
   DeleteIdentityUniversalAuthClientSecretDTO,
@@ -36,6 +40,8 @@ import {
   IdentityGcpAuth,
   IdentityJwtAuth,
   IdentityKubernetesAuth,
+  IdentityLdapAuth,
+  IdentityOciAuth,
   IdentityOidcAuth,
   IdentityTokenAuth,
   IdentityUniversalAuth,
@@ -47,6 +53,8 @@ import {
   UpdateIdentityGcpAuthDTO,
   UpdateIdentityJwtAuthDTO,
   UpdateIdentityKubernetesAuthDTO,
+  UpdateIdentityLdapAuthDTO,
+  UpdateIdentityOciAuthDTO,
   UpdateIdentityOidcAuthDTO,
   UpdateIdentityTokenAuthDTO,
   UpdateIdentityUniversalAuthDTO,
@@ -448,6 +456,101 @@ export const useDeleteIdentityAwsAuth = () => {
   });
 };
 
+export const useAddIdentityOciAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityOciAuth, object, AddIdentityOciAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      tenancyOcid,
+      allowedUsernames,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const {
+        data: { identityOciAuth }
+      } = await apiRequest.post<{ identityOciAuth: IdentityOciAuth }>(
+        `/api/v1/auth/oci-auth/identities/${identityId}`,
+        {
+          tenancyOcid,
+          allowedUsernames,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+
+      return identityOciAuth;
+    },
+    onSuccess: (_, { identityId, organizationId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityOciAuth(identityId) });
+    }
+  });
+};
+
+export const useUpdateIdentityOciAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityOciAuth, object, UpdateIdentityOciAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      tenancyOcid,
+      allowedUsernames,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const {
+        data: { identityOciAuth }
+      } = await apiRequest.patch<{ identityOciAuth: IdentityOciAuth }>(
+        `/api/v1/auth/oci-auth/identities/${identityId}`,
+        {
+          tenancyOcid,
+          allowedUsernames,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+
+      return identityOciAuth;
+    },
+    onSuccess: (_, { identityId, organizationId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityOciAuth(identityId) });
+    }
+  });
+};
+
+export const useDeleteIdentityOciAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityOciAuth, object, DeleteIdentityOciAuthDTO>({
+    mutationFn: async ({ identityId }) => {
+      const {
+        data: { identityOciAuth }
+      } = await apiRequest.delete(`/api/v1/auth/oci-auth/identities/${identityId}`);
+      return identityOciAuth;
+    },
+    onSuccess: (_, { organizationId, identityId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityOciAuth(identityId) });
+    }
+  });
+};
+
 export const useUpdateIdentityOidcAuth = () => {
   const queryClient = useQueryClient();
   return useMutation<IdentityOidcAuth, object, UpdateIdentityOidcAuthDTO>({
@@ -737,7 +840,8 @@ export const useAddIdentityKubernetesAuth = () => {
       accessTokenTTL,
       accessTokenMaxTTL,
       accessTokenNumUsesLimit,
-      accessTokenTrustedIps
+      accessTokenTrustedIps,
+      gatewayId
     }) => {
       const {
         data: { identityKubernetesAuth }
@@ -753,7 +857,8 @@ export const useAddIdentityKubernetesAuth = () => {
           accessTokenTTL,
           accessTokenMaxTTL,
           accessTokenNumUsesLimit,
-          accessTokenTrustedIps
+          accessTokenTrustedIps,
+          gatewayId
         }
       );
 
@@ -842,7 +947,8 @@ export const useUpdateIdentityKubernetesAuth = () => {
       accessTokenTTL,
       accessTokenMaxTTL,
       accessTokenNumUsesLimit,
-      accessTokenTrustedIps
+      accessTokenTrustedIps,
+      gatewayId
     }) => {
       const {
         data: { identityKubernetesAuth }
@@ -858,7 +964,8 @@ export const useUpdateIdentityKubernetesAuth = () => {
           accessTokenTTL,
           accessTokenMaxTTL,
           accessTokenNumUsesLimit,
-          accessTokenTrustedIps
+          accessTokenTrustedIps,
+          gatewayId
         }
       );
 
@@ -1049,3 +1156,116 @@ export const useRevokeIdentityTokenAuthToken = () => {
     }
   });
 };
+
+export const useAddIdentityLdapAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityLdapAuth, object, AddIdentityLdapAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      url,
+      bindDN,
+      bindPass,
+      searchBase,
+      searchFilter,
+      ldapCaCertificate,
+      allowedFields,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const { data } = await apiRequest.post<{ identityLdapAuth: IdentityLdapAuth }>(
+        `/api/v1/auth/ldap-auth/identities/${identityId}`,
+        {
+          url,
+          bindDN,
+          bindPass,
+          searchBase,
+          searchFilter,
+          ldapCaCertificate,
+          allowedFields,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+      return data.identityLdapAuth;
+    },
+    onSuccess: (_, { identityId, organizationId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({
+        queryKey: identitiesKeys.getIdentityLdapAuth(identityId)
+      });
+    }
+  });
+};
+
+export const useUpdateIdentityLdapAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityLdapAuth, object, UpdateIdentityLdapAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      url,
+      bindDN,
+      bindPass,
+      searchBase,
+      searchFilter,
+      ldapCaCertificate,
+      allowedFields,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const { data } = await apiRequest.patch<{ identityLdapAuth: IdentityLdapAuth }>(
+        `/api/v1/auth/ldap-auth/identities/${identityId}`,
+        {
+          url,
+          bindDN,
+          bindPass,
+          searchBase,
+          searchFilter,
+          ldapCaCertificate,
+          allowedFields,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+      return data.identityLdapAuth;
+    },
+    onSuccess: (_, { identityId, organizationId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({
+        queryKey: identitiesKeys.getIdentityLdapAuth(identityId)
+      });
+    }
+  });
+};
+
+export const useDeleteIdentityLdapAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityLdapAuth, object, DeleteIdentityLdapAuthDTO>({
+    mutationFn: async ({ identityId }) => {
+      const { data } = await apiRequest.delete(`/api/v1/auth/ldap-auth/identities/${identityId}`);
+      return data.identityLdapAuth;
+    },
+    onSuccess: (_, { organizationId, identityId }) => {
+      queryClient.invalidateQueries({
+        queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
+      });
+      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
+      queryClient.invalidateQueries({
+        queryKey: identitiesKeys.getIdentityLdapAuth(identityId)
+      });
+    }
+  });
+};

frontend/src/hooks/api/identities/queries.tsx

@@ -11,8 +11,10 @@ import {
   IdentityGcpAuth,
   IdentityJwtAuth,
   IdentityKubernetesAuth,
+  IdentityLdapAuth,
   IdentityMembership,
   IdentityMembershipOrg,
+  IdentityOciAuth,
   IdentityOidcAuth,
   IdentityTokenAuth,
   IdentityUniversalAuth,
@@ -31,9 +33,11 @@ export const identitiesKeys = {
   getIdentityGcpAuth: (identityId: string) => [{ identityId }, "identity-gcp-auth"] as const,
   getIdentityOidcAuth: (identityId: string) => [{ identityId }, "identity-oidc-auth"] as const,
   getIdentityAwsAuth: (identityId: string) => [{ identityId }, "identity-aws-auth"] as const,
+  getIdentityOciAuth: (identityId: string) => [{ identityId }, "identity-oci-auth"] as const,
   getIdentityAzureAuth: (identityId: string) => [{ identityId }, "identity-azure-auth"] as const,
   getIdentityTokenAuth: (identityId: string) => [{ identityId }, "identity-token-auth"] as const,
   getIdentityJwtAuth: (identityId: string) => [{ identityId }, "identity-jwt-auth"] as const,
+  getIdentityLdapAuth: (identityId: string) => [{ identityId }, "identity-ldap-auth"] as const,
   getIdentityTokensTokenAuth: (identityId: string) =>
     [{ identityId }, "identity-tokens-token-auth"] as const,
   getIdentityProjectMemberships: (identityId: string) =>
@@ -168,6 +172,27 @@ export const useGetIdentityAwsAuth = (
   });
 };
 
+export const useGetIdentityOciAuth = (
+  identityId: string,
+  options?: TReactQueryOptions["options"]
+) => {
+  return useQuery({
+    queryKey: identitiesKeys.getIdentityOciAuth(identityId),
+    queryFn: async () => {
+      const {
+        data: { identityOciAuth }
+      } = await apiRequest.get<{ identityOciAuth: IdentityOciAuth }>(
+        `/api/v1/auth/oci-auth/identities/${identityId}`
+      );
+      return identityOciAuth;
+    },
+    staleTime: 0,
+    gcTime: 0,
+    ...options,
+    enabled: Boolean(identityId) && (options?.enabled ?? true)
+  });
+};
+
 export const useGetIdentityAzureAuth = (
   identityId: string,
   options?: TReactQueryOptions["options"]
@@ -231,6 +256,27 @@ export const useGetIdentityTokenAuth = (
   });
 };
 
+export const useGetIdentityLdapAuth = (
+  identityId: string,
+  options?: TReactQueryOptions["options"]
+) => {
+  return useQuery({
+    queryKey: identitiesKeys.getIdentityLdapAuth(identityId),
+    queryFn: async () => {
+      const {
+        data: { identityLdapAuth }
+      } = await apiRequest.get<{ identityLdapAuth: IdentityLdapAuth }>(
+        `/api/v1/auth/ldap-auth/identities/${identityId}`
+      );
+      return identityLdapAuth;
+    },
+    staleTime: 0,
+    gcTime: 0,
+    ...options,
+    enabled: Boolean(identityId) && (options?.enabled ?? true)
+  });
+};
+
 export const useGetIdentityTokensTokenAuth = (identityId: string) => {
   return useQuery({
     enabled: Boolean(identityId),

frontend/src/hooks/api/identities/types.ts

@@ -290,6 +290,48 @@ export type DeleteIdentityAwsAuthDTO = {
   identityId: string;
 };
 
+export type IdentityOciAuth = {
+  identityId: string;
+  type: "iam";
+  tenancyOcid: string;
+  allowedUsernames?: string | null;
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: IdentityTrustedIp[];
+};
+
+export type AddIdentityOciAuthDTO = {
+  organizationId: string;
+  identityId: string;
+  tenancyOcid: string;
+  allowedUsernames?: string | null;
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: {
+    ipAddress: string;
+  }[];
+};
+
+export type UpdateIdentityOciAuthDTO = {
+  organizationId: string;
+  identityId: string;
+  tenancyOcid?: string;
+  allowedUsernames?: string | null;
+  accessTokenTTL?: number;
+  accessTokenMaxTTL?: number;
+  accessTokenNumUsesLimit?: number;
+  accessTokenTrustedIps?: {
+    ipAddress: string;
+  }[];
+};
+
+export type DeleteIdentityOciAuthDTO = {
+  organizationId: string;
+  identityId: string;
+};
+
 export type IdentityAzureAuth = {
   identityId: string;
   tenantId: string;
@@ -346,6 +388,7 @@ export type IdentityKubernetesAuth = {
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
   accessTokenTrustedIps: IdentityTrustedIp[];
+  gatewayId?: string | null;
 };
 
 export type AddIdentityKubernetesAuthDTO = {
@@ -356,6 +399,7 @@ export type AddIdentityKubernetesAuthDTO = {
   allowedNamespaces: string;
   allowedNames: string;
   allowedAudience: string;
+  gatewayId?: string | null;
   caCert: string;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
@@ -373,6 +417,7 @@ export type UpdateIdentityKubernetesAuthDTO = {
   allowedNamespaces?: string;
   allowedNames?: string;
   allowedAudience?: string;
+  gatewayId?: string | null;
   caCert?: string;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
@@ -425,6 +470,72 @@ export type IdentityTokenAuth = {
   accessTokenTrustedIps: IdentityTrustedIp[];
 };
 
+export type AddIdentityLdapAuthDTO = {
+  organizationId: string;
+  identityId: string;
+  url: string;
+  bindDN: string;
+  bindPass: string;
+  searchBase: string;
+  searchFilter: string;
+  ldapCaCertificate?: string;
+  allowedFields?: {
+    key: string;
+    value: string;
+  }[];
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: {
+    ipAddress: string;
+  }[];
+};
+
+export type UpdateIdentityLdapAuthDTO = {
+  identityId: string;
+  organizationId: string;
+  url?: string;
+  bindDN?: string;
+  bindPass?: string;
+  searchBase?: string;
+  searchFilter?: string;
+  ldapCaCertificate?: string;
+  allowedFields?: {
+    key: string;
+    value: string;
+  }[];
+  accessTokenTTL?: number;
+  accessTokenMaxTTL?: number;
+  accessTokenNumUsesLimit?: number;
+  accessTokenTrustedIps?: {
+    ipAddress: string;
+  }[];
+};
+
+export type DeleteIdentityLdapAuthDTO = {
+  organizationId: string;
+  identityId: string;
+};
+
+export type IdentityLdapAuth = {
+  url: string;
+  bindDN: string;
+  bindPass: string;
+  searchBase: string;
+  searchFilter: string;
+  ldapCaCertificate?: string;
+  allowedFields?: {
+    key: string;
+    value: string;
+  }[];
+
+  identityId: string;
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: IdentityTrustedIp[];
+};
+
 export type AddIdentityTokenAuthDTO = {
   organizationId: string;
   identityId: string;

frontend/src/hooks/api/index.tsx

@@ -27,6 +27,7 @@ export * from "./orgAdmin";
 export * from "./organization";
 export * from "./pkiAlerts";
 export * from "./pkiCollections";
+export * from "./pkiSubscriber";
 export * from "./projectUserAdditionalPrivilege";
 export * from "./rateLimit";
 export * from "./roles";

frontend/src/hooks/api/organization/queries.tsx

@@ -112,7 +112,15 @@ export const useUpdateOrg = () => {
       selectedMfaMethod,
       allowSecretSharingOutsideOrganization,
       bypassOrgAuthEnabled,
-      userTokenExpiration
+      userTokenExpiration,
+      secretsProductEnabled,
+      pkiProductEnabled,
+      kmsProductEnabled,
+      sshProductEnabled,
+      scannerProductEnabled,
+      shareSecretsProductEnabled,
+      maxSharedSecretLifetime,
+      maxSharedSecretViewLimit
     }) => {
       return apiRequest.patch(`/api/v1/organization/${orgId}`, {
         name,
@@ -124,7 +132,15 @@ export const useUpdateOrg = () => {
         selectedMfaMethod,
         allowSecretSharingOutsideOrganization,
         bypassOrgAuthEnabled,
-        userTokenExpiration
+        userTokenExpiration,
+        secretsProductEnabled,
+        pkiProductEnabled,
+        kmsProductEnabled,
+        sshProductEnabled,
+        scannerProductEnabled,
+        shareSecretsProductEnabled,
+        maxSharedSecretLifetime,
+        maxSharedSecretViewLimit
       });
     },
     onSuccess: () => {

frontend/src/hooks/api/organization/types.ts

@@ -20,6 +20,14 @@ export type Organization = {
   allowSecretSharingOutsideOrganization?: boolean;
   userTokenExpiration?: string;
   userRole: string;
+  secretsProductEnabled: boolean;
+  pkiProductEnabled: boolean;
+  kmsProductEnabled: boolean;
+  sshProductEnabled: boolean;
+  scannerProductEnabled: boolean;
+  shareSecretsProductEnabled: boolean;
+  maxSharedSecretLifetime: number;
+  maxSharedSecretViewLimit: number | null;
 };
 
 export type UpdateOrgDTO = {
@@ -34,6 +42,14 @@ export type UpdateOrgDTO = {
   allowSecretSharingOutsideOrganization?: boolean;
   bypassOrgAuthEnabled?: boolean;
   userTokenExpiration?: string;
+  secretsProductEnabled?: boolean;
+  pkiProductEnabled?: boolean;
+  kmsProductEnabled?: boolean;
+  sshProductEnabled?: boolean;
+  scannerProductEnabled?: boolean;
+  shareSecretsProductEnabled?: boolean;
+  maxSharedSecretViewLimit?: number | null;
+  maxSharedSecretLifetime?: number;
 };
 
 export type BillingDetails = {

frontend/src/hooks/api/pkiSubscriber/constants.tsx

@@ -0,0 +1,20 @@
+export enum PkiSubscriberStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled"
+}
+
+export const pkiSubscriberStatusToNameMap: { [K in PkiSubscriberStatus]: string } = {
+  [PkiSubscriberStatus.ACTIVE]: "Active",
+  [PkiSubscriberStatus.DISABLED]: "Disabled"
+};
+
+export const getPkiSubscriberStatusBadgeVariant = (status: PkiSubscriberStatus) => {
+  switch (status) {
+    case PkiSubscriberStatus.ACTIVE:
+      return "success";
+    case PkiSubscriberStatus.DISABLED:
+      return "danger";
+    default:
+      return "primary";
+  }
+};

frontend/src/hooks/api/pkiSubscriber/index.tsx

@@ -0,0 +1,7 @@
+export {
+  useCreatePkiSubscriber,
+  useDeletePkiSubscriber,
+  useIssuePkiSubscriberCert,
+  useUpdatePkiSubscriber
+} from "./mutations";
+export { useGetPkiSubscriber, useGetPkiSubscriberCertificates } from "./queries";

frontend/src/hooks/api/pkiSubscriber/mutations.tsx

@@ -0,0 +1,110 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TCreateCertificateResponse } from "../ca/types";
+import { workspaceKeys } from "../workspace/query-keys";
+import { pkiSubscriberKeys } from "./queries";
+import {
+  TCreatePkiSubscriberDTO,
+  TDeletePkiSubscriberDTO,
+  TIssuePkiSubscriberCertDTO,
+  TPkiSubscriber,
+  TUpdatePkiSubscriberDTO
+} from "./types";
+
+export const useCreatePkiSubscriber = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TPkiSubscriber, object, TCreatePkiSubscriberDTO>({
+    mutationFn: async (body) => {
+      const { data: subscriber } = await apiRequest.post("/api/v1/pki/subscribers", body);
+      return subscriber;
+    },
+    onSuccess: ({ projectId, name }) => {
+      queryClient.invalidateQueries({
+        queryKey: workspaceKeys.getWorkspacePkiSubscribers(projectId)
+      });
+      queryClient.invalidateQueries({
+        queryKey: pkiSubscriberKeys.getPkiSubscriber({
+          subscriberName: name,
+          projectId
+        })
+      });
+    }
+  });
+};
+
+export const useUpdatePkiSubscriber = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TPkiSubscriber, object, TUpdatePkiSubscriberDTO>({
+    mutationFn: async ({ subscriberName, ...body }) => {
+      const { data: subscriber } = await apiRequest.patch(
+        `/api/v1/pki/subscribers/${subscriberName}`,
+        body
+      );
+      return subscriber;
+    },
+    onSuccess: ({ projectId, name }) => {
+      queryClient.invalidateQueries({
+        queryKey: workspaceKeys.getWorkspacePkiSubscribers(projectId)
+      });
+      queryClient.invalidateQueries({
+        queryKey: pkiSubscriberKeys.getPkiSubscriber({
+          subscriberName: name,
+          projectId
+        })
+      });
+    }
+  });
+};
+
+export const useDeletePkiSubscriber = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TPkiSubscriber, object, TDeletePkiSubscriberDTO>({
+    mutationFn: async ({ subscriberName, projectId }) => {
+      const { data: subscriber } = await apiRequest.delete(
+        `/api/v1/pki/subscribers/${subscriberName}`,
+        {
+          data: {
+            projectId
+          }
+        }
+      );
+      return subscriber;
+    },
+    onSuccess: ({ name, projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: workspaceKeys.getWorkspacePkiSubscribers(projectId)
+      });
+      queryClient.invalidateQueries({
+        queryKey: pkiSubscriberKeys.getPkiSubscriber({
+          subscriberName: name,
+          projectId
+        })
+      });
+    }
+  });
+};
+
+export const useIssuePkiSubscriberCert = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCreateCertificateResponse, object, TIssuePkiSubscriberCertDTO>({
+    mutationFn: async ({ subscriberName, projectId }) => {
+      const { data } = await apiRequest.post(
+        `/api/v1/pki/subscribers/${subscriberName}/issue-certificate`,
+        {
+          projectId
+        }
+      );
+      return data;
+    },
+    onSuccess: (_, { subscriberName, projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: pkiSubscriberKeys.forPkiSubscriberCertificates({
+          subscriberName,
+          projectId
+        })
+      });
+    }
+  });
+};

frontend/src/hooks/api/pkiSubscriber/queries.tsx

@@ -0,0 +1,102 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TCertificate } from "../certificates/types";
+import { TPkiSubscriber } from "./types";
+
+export const pkiSubscriberKeys = {
+  getPkiSubscriber: ({
+    subscriberName,
+    projectId
+  }: {
+    subscriberName: string;
+    projectId: string;
+  }) => [{ subscriberName, projectId }, "pki-subscriber"] as const,
+  allPkiSubscriberCertificates: () => ["pki-subscriber-certificates"] as const,
+  forPkiSubscriberCertificates: ({
+    subscriberName,
+    projectId
+  }: {
+    subscriberName: string;
+    projectId: string;
+  }) => [...pkiSubscriberKeys.allPkiSubscriberCertificates(), subscriberName, projectId] as const,
+  specificPkiSubscriberCertificates: ({
+    subscriberName,
+    projectId,
+    offset,
+    limit
+  }: {
+    subscriberName: string;
+    projectId: string;
+    offset: number;
+    limit: number;
+  }) =>
+    [
+      ...pkiSubscriberKeys.forPkiSubscriberCertificates({ subscriberName, projectId }),
+      { offset, limit, projectId }
+    ] as const
+};
+
+export const useGetPkiSubscriber = ({
+  subscriberName,
+  projectId
+}: {
+  subscriberName: string;
+  projectId: string;
+}) => {
+  return useQuery({
+    queryKey: pkiSubscriberKeys.getPkiSubscriber({ subscriberName, projectId }),
+    queryFn: async () => {
+      const { data: pkiSubscriber } = await apiRequest.get<TPkiSubscriber>(
+        `/api/v1/pki/subscribers/${subscriberName}`,
+        {
+          params: {
+            projectId
+          }
+        }
+      );
+      return pkiSubscriber;
+    },
+    enabled: Boolean(subscriberName) && Boolean(projectId)
+  });
+};
+
+export const useGetPkiSubscriberCertificates = ({
+  subscriberName,
+  projectId,
+  offset,
+  limit
+}: {
+  subscriberName: string;
+  projectId: string;
+  offset: number;
+  limit: number;
+}) => {
+  return useQuery({
+    queryKey: pkiSubscriberKeys.specificPkiSubscriberCertificates({
+      subscriberName,
+      projectId,
+      offset,
+      limit
+    }),
+    queryFn: async () => {
+      const params = new URLSearchParams({
+        offset: String(offset),
+        limit: String(limit),
+        projectId
+      });
+
+      const {
+        data: { certificates, totalCount }
+      } = await apiRequest.get<{ certificates: TCertificate[]; totalCount: number }>(
+        `/api/v1/pki/subscribers/${subscriberName}/certificates`,
+        {
+          params
+        }
+      );
+      return { certificates, totalCount };
+    },
+    enabled: Boolean(subscriberName) && Boolean(projectId)
+  });
+};

frontend/src/hooks/api/pkiSubscriber/types.ts

@@ -0,0 +1,53 @@
+import { CertExtendedKeyUsage, CertKeyUsage } from "../certificates/enums";
+
+export enum PkiSubscriberStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled"
+}
+
+export type TPkiSubscriber = {
+  id: string;
+  projectId: string;
+  caId: string;
+  name: string;
+  commonName: string;
+  status: PkiSubscriberStatus;
+  ttl: string;
+  subjectAlternativeNames: string[];
+  keyUsages: CertKeyUsage[];
+  extendedKeyUsages: CertExtendedKeyUsage[];
+};
+
+export type TCreatePkiSubscriberDTO = {
+  projectId: string;
+  caId: string;
+  name: string;
+  commonName: string;
+  ttl: string;
+  subjectAlternativeNames: string[];
+  keyUsages: CertKeyUsage[];
+  extendedKeyUsages: CertExtendedKeyUsage[];
+};
+
+export type TUpdatePkiSubscriberDTO = {
+  subscriberName: string;
+  projectId: string;
+  caId?: string;
+  name?: string;
+  commonName?: string;
+  status?: PkiSubscriberStatus;
+  ttl?: string;
+  subjectAlternativeNames?: string[];
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+};
+
+export type TDeletePkiSubscriberDTO = {
+  subscriberName: string;
+  projectId: string;
+};
+
+export type TIssuePkiSubscriberCertDTO = {
+  subscriberName: string;
+  projectId: string;
+};

frontend/src/hooks/api/projectTemplates/queries.tsx

@@ -6,14 +6,17 @@ import {
   TProjectTemplate,
   TProjectTemplateResponse
 } from "@app/hooks/api/projectTemplates/types";
+import { ProjectType } from "@app/hooks/api/workspace/types";
 
 export const projectTemplateKeys = {
   all: ["project-template"] as const,
-  list: () => [...projectTemplateKeys.all, "list"] as const,
+  list: (projectType?: ProjectType) =>
+    [...projectTemplateKeys.all, "list", ...(projectType ? [projectType] : [])] as const,
   byId: (templateId: string) => [...projectTemplateKeys.all, templateId] as const
 };
 
 export const useListProjectTemplates = (
+  type?: ProjectType,
   options?: Omit<
     UseQueryOptions<
       TProjectTemplate[],
@@ -25,9 +28,11 @@ export const useListProjectTemplates = (
   >
 ) => {
   return useQuery({
-    queryKey: projectTemplateKeys.list(),
+    queryKey: projectTemplateKeys.list(type),
     queryFn: async () => {
-      const { data } = await apiRequest.get<TListProjectTemplates>("/api/v1/project-templates");
+      const { data } = await apiRequest.get<TListProjectTemplates>("/api/v1/project-templates", {
+        params: { type }
+      });
 
       return data.projectTemplates;
     },

frontend/src/hooks/api/projectTemplates/types.ts

@@ -1,11 +1,13 @@
 import { TProjectRole } from "@app/hooks/api/roles/types";
+import { ProjectType } from "@app/hooks/api/workspace/types";
 
 export type TProjectTemplate = {
   id: string;
   name: string;
+  type: ProjectType;
   description?: string;
   roles: Pick<TProjectRole, "slug" | "name" | "permissions">[];
-  environments: { name: string; slug: string; position: number }[];
+  environments?: { name: string; slug: string; position: number }[] | null;
   createdAt: string;
   updatedAt: string;
 };
@@ -14,6 +16,7 @@ export type TListProjectTemplates = { projectTemplates: TProjectTemplate[] };
 export type TProjectTemplateResponse = { projectTemplate: TProjectTemplate };
 
 export type TCreateProjectTemplateDTO = {
+  type: ProjectType;
   name: string;
   description?: string;
 };

frontend/src/hooks/api/roles/types.ts

@@ -3,7 +3,9 @@ export enum ProjectMembershipRole {
   Member = "member",
   Custom = "custom",
   Viewer = "viewer",
-  NoAccess = "no-access"
+  NoAccess = "no-access",
+  SshHostBootstrapper = "ssh-host-bootstrapper",
+  KmsCryptographicOperator = "cryptographic-operator"
 }
 
 export type TGetProjectRolesDTO = {
@@ -17,7 +19,7 @@ export type TProjectRole = {
   id: string;
   createdAt: string;
   updatedAt: string;
-  description?: string;
+  description?: string | null;
   permissions: TProjectPermission[];
 };
 
@@ -74,7 +76,7 @@ export type TDeleteOrgRoleDTO = {
 export type TCreateProjectRoleDTO = {
   projectId: string;
   name: string;
-  description?: string;
+  description?: string | null;
   slug: string;
   permissions: TProjectPermission[];
 };

frontend/src/hooks/api/secretScanning/mutation.ts

@@ -10,15 +10,17 @@ import {
 } from "./types";
 
 export const useCreateNewInstallationSession = () => {
-  return useMutation<{ sessionId: string }, object, { organizationId: string }>({
-    mutationFn: async (opt) => {
-      const { data } = await apiRequest.post(
-        "/api/v1/secret-scanning/create-installation-session/organization",
-        opt
-      );
-      return data;
+  return useMutation<{ sessionId: string; gitAppSlug: string }, object, { organizationId: string }>(
+    {
+      mutationFn: async (opt) => {
+        const { data } = await apiRequest.post(
+          "/api/v1/secret-scanning/create-installation-session/organization",
+          opt
+        );
+        return data;
+      }
     }
-  });
+  );
 };
 
 export const useUpdateRiskStatus = () => {

frontend/src/hooks/api/secretSharing/queries.ts

@@ -11,10 +11,13 @@ export const secretSharingKeys = {
   allSecretRequests: () => ["secretRequests"] as const,
   specificSecretRequests: ({ offset, limit }: { offset: number; limit: number }) =>
     [...secretSharingKeys.allSecretRequests(), { offset, limit }] as const,
-  getSecretById: (arg: { id: string; hashedHex: string | null; password?: string }) => [
-    "shared-secret",
-    arg
-  ],
+  getSecretById: (arg: {
+    id: string;
+    hashedHex: string | null;
+    password?: string;
+    email?: string;
+    hash?: string;
+  }) => ["shared-secret", arg],
   getSecretRequestById: (arg: { id: string }) => ["secret-request", arg] as const
 };
 
@@ -70,20 +73,34 @@ export const useGetSecretRequests = ({
 export const useGetActiveSharedSecretById = ({
   sharedSecretId,
   hashedHex,
-  password
+  password,
+  email,
+  hash
 }: {
   sharedSecretId: string;
   hashedHex: string | null;
   password?: string;
+
+  // For secrets shared to specific emails (optional)
+  email?: string;
+  hash?: string;
 }) => {
   return useQuery({
-    queryKey: secretSharingKeys.getSecretById({ id: sharedSecretId, hashedHex, password }),
+    queryKey: secretSharingKeys.getSecretById({
+      id: sharedSecretId,
+      hashedHex,
+      password,
+      email,
+      hash
+    }),
     queryFn: async () => {
       const { data } = await apiRequest.post<TViewSharedSecretResponse>(
         `/api/v1/secret-sharing/shared/public/${sharedSecretId}`,
         {
           ...(hashedHex && { hashedHex }),
-          password
+          password,
+          email,
+          hash
         }
       );
 

frontend/src/hooks/api/secretSharing/types.ts

@@ -32,6 +32,7 @@ export type TCreateSharedSecretRequest = {
   expiresAt: Date;
   expiresAfterViews?: number;
   accessType?: SecretSharingAccessType;
+  emails?: string[];
 };
 
 export type TCreateSecretRequestRequestDTO = {

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -12,7 +12,8 @@ export enum SecretSync {
   Vercel = "vercel",
   Windmill = "windmill",
   HCVault = "hashicorp-vault",
-  TeamCity = "teamcity"
+  TeamCity = "teamcity",
+  OCIVault = "oci-vault"
 }
 
 export enum SecretSyncStatus {

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -11,6 +11,7 @@ import { TGcpSync } from "./gcp-sync";
 import { TGitHubSync } from "./github-sync";
 import { THCVaultSync } from "./hc-vault-sync";
 import { THumanitecSync } from "./humanitec-sync";
+import { TOCIVaultSync } from "./oci-vault-sync";
 import { TTeamCitySync } from "./teamcity-sync";
 import { TTerraformCloudSync } from "./terraform-cloud-sync";
 import { TVercelSync } from "./vercel-sync";
@@ -36,7 +37,8 @@ export type TSecretSync =
   | TVercelSync
   | TWindmillSync
   | THCVaultSync
-  | TTeamCitySync;
+  | TTeamCitySync
+  | TOCIVaultSync;
 
 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };
 

frontend/src/hooks/api/secretSyncs/types/oci-vault-sync.ts

@@ -0,0 +1,17 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TOCIVaultSync = TRootSecretSync & {
+  destination: SecretSync.OCIVault;
+  destinationConfig: {
+    compartmentOcid: string;
+    vaultOcid: string;
+    keyOcid: string;
+  };
+  connection: {
+    app: AppConnection.OCI;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/secretSyncs/types/root-sync.ts

@@ -4,8 +4,7 @@ import { SecretSyncInitialSyncBehavior, SecretSyncStatus } from "@app/hooks/api/
 export type RootSyncOptions = {
   initialSyncBehavior: SecretSyncInitialSyncBehavior;
   disableSecretDeletion?: boolean;
-  // prependPrefix?: string;
-  // appendSuffix?: string;
+  keySchema?: string;
 };
 
 export type TRootSecretSync = {

frontend/src/hooks/api/sshHost/types.ts

@@ -6,7 +6,8 @@ export enum LoginMappingSource {
 export type TLoginMapping = {
   loginUser: string;
   allowedPrincipals: {
-    usernames: string[];
+    usernames?: string[];
+    groups?: string[];
   };
   source: LoginMappingSource;
 };
@@ -20,6 +21,7 @@ export type TSshHost = {
   hostCertTtl: string;
   loginMappings: TLoginMapping[];
 };
+
 export type TCreateSshHostDTO = {
   projectId: string;
   hostname: string;

frontend/src/hooks/api/workspace/index.tsx

@@ -35,6 +35,7 @@ export {
   useListWorkspaceGroups,
   useListWorkspacePkiAlerts,
   useListWorkspacePkiCollections,
+  useListWorkspacePkiSubscribers,
   useListWorkspaceSshCas,
   useListWorkspaceSshCertificates,
   useListWorkspaceSshCertificateTemplates,

frontend/src/hooks/api/workspace/queries.tsx

@@ -14,6 +14,7 @@ import { IntegrationAuth } from "../integrationAuth/types";
 import { TIntegration } from "../integrations/types";
 import { TPkiAlert } from "../pkiAlerts/types";
 import { TPkiCollection } from "../pkiCollections/types";
+import { TPkiSubscriber } from "../pkiSubscriber/types";
 import { EncryptedSecret } from "../secrets/types";
 import { TSshCertificate, TSshCertificateAuthority } from "../sshCa/types";
 import { TSshCertificateTemplate } from "../sshCertificateTemplates/types";
@@ -276,13 +277,20 @@ export const useUpdateProject = () => {
   const queryClient = useQueryClient();
 
   return useMutation<Workspace, object, UpdateProjectDTO>({
-    mutationFn: async ({ projectID, newProjectName, newProjectDescription, newSlug }) => {
+    mutationFn: async ({
+      projectID,
+      newProjectName,
+      newProjectDescription,
+      newSlug,
+      secretSharing
+    }) => {
       const { data } = await apiRequest.patch<{ workspace: Workspace }>(
         `/api/v1/workspace/${projectID}`,
         {
           name: newProjectName,
           description: newProjectDescription,
-          slug: newSlug
+          slug: newSlug,
+          secretSharing
         }
       );
       return data.workspace;
@@ -874,6 +882,21 @@ export const useListWorkspaceSshHosts = (projectId: string) => {
   });
 };
 
+export const useListWorkspacePkiSubscribers = (projectId: string) => {
+  return useQuery({
+    queryKey: workspaceKeys.getWorkspacePkiSubscribers(projectId),
+    queryFn: async () => {
+      const {
+        data: { subscribers }
+      } = await apiRequest.get<{ subscribers: TPkiSubscriber[] }>(
+        `/api/v2/workspace/${projectId}/pki-subscribers`
+      );
+      return subscribers;
+    },
+    enabled: Boolean(projectId)
+  });
+};
+
 export const useListWorkspaceSshHostGroups = (projectId: string) => {
   return useQuery({
     queryKey: workspaceKeys.getWorkspaceSshHostGroups(projectId),

frontend/src/hooks/api/workspace/query-keys.tsx

@@ -16,8 +16,11 @@ export const workspaceKeys = {
     type ? ["workspaces", { type }] : (["workspaces"] as const),
   getWorkspaceAuditLogs: (workspaceId: string) =>
     [{ workspaceId }, "workspace-audit-logs"] as const,
-  getWorkspaceUsers: (workspaceId: string, includeGroupMembers?: boolean, roles?: string[]) =>
-    [{ workspaceId, includeGroupMembers, roles }, "workspace-users"] as const,
+  getWorkspaceUsers: (
+    workspaceId: string,
+    includeGroupMembers: boolean = false,
+    roles: string[] = []
+  ) => [{ workspaceId, includeGroupMembers, roles }, "workspace-users"] as const,
   getWorkspaceUserDetails: (workspaceId: string, membershipId: string) =>
     [{ workspaceId, membershipId }, "workspace-user-details"] as const,
   getWorkspaceIdentityMemberships: (workspaceId: string) =>
@@ -51,6 +54,8 @@ export const workspaceKeys = {
   }) => [...workspaceKeys.forWorkspaceCertificates(slug), { offset, limit }] as const,
   getWorkspacePkiAlerts: (workspaceId: string) =>
     [{ workspaceId }, "workspace-pki-alerts"] as const,
+  getWorkspacePkiSubscribers: (projectId: string) =>
+    [{ projectId }, "workspace-pki-subscribers"] as const,
   getWorkspacePkiCollections: (workspaceId: string) =>
     [{ workspaceId }, "workspace-pki-collections"] as const,
   getWorkspaceCertificateTemplates: (workspaceId: string) =>

frontend/src/hooks/api/workspace/types.ts

@@ -37,6 +37,7 @@ export type Workspace = {
   createdAt: string;
   roles?: TProjectRole[];
   hasDeleteProtection: boolean;
+  secretSharing: boolean;
 };
 
 export type WorkspaceEnv = {
@@ -73,9 +74,10 @@ export type CreateWorkspaceDTO = {
 
 export type UpdateProjectDTO = {
   projectID: string;
-  newProjectName: string;
+  newProjectName?: string;
   newProjectDescription?: string;
   newSlug?: string;
+  secretSharing?: boolean;
 };
 
 export type UpdatePitVersionLimitDTO = { projectSlug: string; pitVersionLimit: number };