Merge branch 'main' into ENG-3723

2026-10-17 08:35:52 +00:00 · 2025-09-27 01:58:44 -04:00
parent 4b1664c30f 83755d0bba
commit 1c83189978
162 changed files with 7033 additions and 424 deletions
@@ -36,7 +36,8 @@ export enum AppConnection {
  Supabase = "supabase",
  DigitalOcean = "digital-ocean",
  Netlify = "netlify",
-  Okta = "okta"
+  Okta = "okta",
+  Redis = "redis"
 }

 export enum AWSRegion {
@@ -111,6 +111,7 @@ import { getNetlifyConnectionListItem, validateNetlifyConnectionCredentials } fr
 import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
+import { getRedisConnectionListItem, RedisConnectionMethod, validateRedisConnectionCredentials } from "./redis";
 import { RenderConnectionMethod } from "./render/render-connection-enums";
 import { getRenderConnectionListItem, validateRenderConnectionCredentials } from "./render/render-connection-fns";
 import {
@@ -196,7 +197,8 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
    getSupabaseConnectionListItem(),
    getDigitalOceanConnectionListItem(),
    getNetlifyConnectionListItem(),
-    getOktaConnectionListItem()
+    getOktaConnectionListItem(),
+    getRedisConnectionListItem()
  ]
    .filter((option) => {
      switch (projectType) {
@@ -324,7 +326,8 @@ export const validateAppConnectionCredentials = async (
    [AppConnection.Supabase]: validateSupabaseConnectionCredentials as TAppConnectionCredentialsValidator,
    [AppConnection.DigitalOcean]: validateDigitalOceanConnectionCredentials as TAppConnectionCredentialsValidator,
    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
  };

  return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection, gatewayService, gatewayV2Service);
@@ -371,6 +374,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
    case MySqlConnectionMethod.UsernameAndPassword:
    case OracleDBConnectionMethod.UsernameAndPassword:
    case AzureADCSConnectionMethod.UsernamePassword:
+    case RedisConnectionMethod.UsernameAndPassword:
      return "Username & Password";
    case WindmillConnectionMethod.AccessToken:
    case HCVaultConnectionMethod.AccessToken:
@@ -458,7 +462,8 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
  [AppConnection.Supabase]: platformManagedCredentialsNotSupported,
  [AppConnection.DigitalOcean]: platformManagedCredentialsNotSupported,
  [AppConnection.Netlify]: platformManagedCredentialsNotSupported,
-  [AppConnection.Okta]: platformManagedCredentialsNotSupported
+  [AppConnection.Okta]: platformManagedCredentialsNotSupported,
+  [AppConnection.Redis]: platformManagedCredentialsNotSupported
 };

 export const enterpriseAppCheck = async (
@@ -38,7 +38,8 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
  [AppConnection.Supabase]: "Supabase",
  [AppConnection.DigitalOcean]: "DigitalOcean App Platform",
  [AppConnection.Netlify]: "Netlify",
-  [AppConnection.Okta]: "Okta"
+  [AppConnection.Okta]: "Okta",
+  [AppConnection.Redis]: "Redis"
 };

 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -79,5 +80,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
  [AppConnection.Supabase]: AppConnectionPlanType.Regular,
  [AppConnection.DigitalOcean]: AppConnectionPlanType.Regular,
  [AppConnection.Netlify]: AppConnectionPlanType.Regular,
-  [AppConnection.Okta]: AppConnectionPlanType.Regular
+  [AppConnection.Okta]: AppConnectionPlanType.Regular,
+  [AppConnection.Redis]: AppConnectionPlanType.Regular
 };
@@ -99,6 +99,7 @@ import { oktaConnectionService } from "./okta/okta-connection-service";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
 import { ValidateRailwayConnectionCredentialsSchema } from "./railway";
 import { railwayConnectionService } from "./railway/railway-connection-service";
+import { ValidateRedisConnectionCredentialsSchema } from "./redis";
 import { ValidateRenderConnectionCredentialsSchema } from "./render/render-connection-schema";
 import { renderConnectionService } from "./render/render-connection-service";
 import { ValidateSupabaseConnectionCredentialsSchema } from "./supabase";
@@ -166,7 +167,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
  [AppConnection.Supabase]: ValidateSupabaseConnectionCredentialsSchema,
  [AppConnection.DigitalOcean]: ValidateDigitalOceanConnectionCredentialsSchema,
  [AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
-  [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema
+  [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
+  [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema
 };

 export const appConnectionServiceFactory = ({
@@ -179,6 +179,12 @@ import {
  TRailwayConnectionInput,
  TValidateRailwayConnectionCredentialsSchema
 } from "./railway";
+import {
+  TRedisConnection,
+  TRedisConnectionConfig,
+  TRedisConnectionInput,
+  TValidateRedisConnectionCredentialsSchema
+} from "./redis";
 import {
  TRenderConnection,
  TRenderConnectionConfig,
@@ -261,6 +267,7 @@ export type TAppConnection = { id: string } & (
  | TDigitalOceanConnection
  | TNetlifyConnection
  | TOktaConnection
+  | TRedisConnection
 );

 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -306,6 +313,7 @@ export type TAppConnectionInput = { id: string } & (
  | TDigitalOceanConnectionInput
  | TNetlifyConnectionInput
  | TOktaConnectionInput
+  | TRedisConnectionInput
 );

 export type TSqlConnectionInput =
@@ -368,7 +376,8 @@ export type TAppConnectionConfig =
  | TSupabaseConnectionConfig
  | TDigitalOceanConnectionConfig
  | TNetlifyConnectionConfig
-  | TOktaConnectionConfig;
+  | TOktaConnectionConfig
+  | TRedisConnectionConfig;

 export type TValidateAppConnectionCredentialsSchema =
  | TValidateAwsConnectionCredentialsSchema
@@ -408,7 +417,8 @@ export type TValidateAppConnectionCredentialsSchema =
  | TValidateSupabaseConnectionCredentialsSchema
  | TValidateDigitalOceanCredentialsSchema
  | TValidateNetlifyConnectionCredentialsSchema
-  | TValidateOktaConnectionCredentialsSchema;
+  | TValidateOktaConnectionCredentialsSchema
+  | TValidateRedisConnectionCredentialsSchema;

 export type TListAwsConnectionKmsKeys = {
  connectionId: string;
@@ -22,13 +22,13 @@ interface HerokuOAuthTokenResponse {
 }

 export const getHerokuConnectionListItem = () => {
-  const { CLIENT_ID_HEROKU } = getConfig();
+  const { INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID } = getConfig();

  return {
    name: "Heroku" as const,
    app: AppConnection.Heroku as const,
    methods: Object.values(HerokuConnectionMethod) as [HerokuConnectionMethod.AuthToken, HerokuConnectionMethod.OAuth],
-    oauthClientId: CLIENT_ID_HEROKU
+    oauthClientId: INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID
  };
 };

@@ -40,12 +40,12 @@ export const refreshHerokuToken = async (
  appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ): Promise<string> => {
-  const { CLIENT_SECRET_HEROKU } = getConfig();
+  const { INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET } = getConfig();

  const payload = {
    grant_type: "refresh_token",
    refresh_token: refreshToken,
-    client_secret: CLIENT_SECRET_HEROKU
+    client_secret: INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET
  };

  const { data } = await request.post<{ access_token: string; expires_in: number }>(
@@ -75,7 +75,7 @@ export const refreshHerokuToken = async (
 };

 export const exchangeHerokuOAuthCode = async (code: string): Promise<HerokuOAuthTokenResponse> => {
-  const { CLIENT_SECRET_HEROKU } = getConfig();
+  const { INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET } = getConfig();

  try {
    const response = await request.post<HerokuOAuthTokenResponse>(
@@ -83,7 +83,7 @@ export const exchangeHerokuOAuthCode = async (code: string): Promise<HerokuOAuth
      {
        grant_type: "authorization_code",
        code,
-        client_secret: CLIENT_SECRET_HEROKU
+        client_secret: INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET
      },
      {
        headers: {
@@ -0,0 +1,4 @@
+export * from "./redis-connection-enums";
+export * from "./redis-connection-fns";
+export * from "./redis-connection-schemas";
+export * from "./redis-connection-types";
@@ -0,0 +1,3 @@
+export enum RedisConnectionMethod {
+  UsernameAndPassword = "username-and-password"
+}
@@ -0,0 +1,59 @@
+import Redis from "ioredis";
+
+import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { RedisConnectionMethod } from "./redis-connection-enums";
+import { TRedisConnectionConfig } from "./redis-connection-types";
+
+export const getRedisConnectionListItem = () => {
+  return {
+    name: "Redis" as const,
+    app: AppConnection.Redis as const,
+    methods: Object.values(RedisConnectionMethod) as [RedisConnectionMethod.UsernameAndPassword],
+    supportsPlatformManagement: false as const
+  };
+};
+
+export const validateRedisConnectionCredentials = async (config: TRedisConnectionConfig) => {
+  const [hostIp] = await verifyHostInputValidity(config.credentials.host);
+
+  let connection: Redis | null = null;
+  try {
+    connection = new Redis({
+      username: config.credentials.username,
+      host: hostIp,
+      port: config.credentials.port,
+      password: config.credentials.password,
+      ...(config.credentials.sslEnabled && {
+        tls: {
+          rejectUnauthorized: config.credentials.sslRejectUnauthorized,
+          ca: config.credentials.sslCertificate
+        }
+      })
+    });
+
+    let result: string;
+    if (config.credentials.password) {
+      result = await connection.auth(config.credentials.username, config.credentials.password, () => {});
+    } else {
+      result = await connection.auth(config.credentials.username, () => {});
+    }
+
+    if (result !== "OK") {
+      throw new BadRequestError({ message: `Invalid credentials, Redis returned ${result} status` });
+    }
+
+    return config.credentials;
+  } catch (err) {
+    if (err instanceof BadRequestError) {
+      throw err;
+    }
+    throw new BadRequestError({
+      message: `Unable to validate connection: ${(err as Error)?.message || "verify credentials"}`
+    });
+  } finally {
+    if (connection) await connection.quit();
+  }
+};
@@ -0,0 +1,87 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AppConnection } from "../app-connection-enums";
+import { RedisConnectionMethod } from "./redis-connection-enums";
+
+export const BaseRedisUsernameAndPasswordConnectionSchema = z.object({
+  host: z.string().toLowerCase().min(1),
+  port: z.coerce.number(),
+  username: z.string().min(1),
+  password: z.string().min(1).optional(),
+
+  sslRejectUnauthorized: z.boolean(),
+  sslEnabled: z.boolean(),
+  sslCertificate: z
+    .string()
+    .trim()
+    .transform((value) => value || undefined)
+    .optional()
+});
+
+export const RedisConnectionAccessTokenCredentialsSchema = BaseRedisUsernameAndPasswordConnectionSchema;
+
+const BaseRedisConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Redis) });
+
+export const RedisConnectionSchema = BaseRedisConnectionSchema.extend({
+  method: z.literal(RedisConnectionMethod.UsernameAndPassword),
+  credentials: RedisConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedRedisConnectionSchema = z.discriminatedUnion("method", [
+  BaseRedisConnectionSchema.extend({
+    method: z.literal(RedisConnectionMethod.UsernameAndPassword),
+    credentials: RedisConnectionAccessTokenCredentialsSchema.pick({
+      host: true,
+      port: true,
+      username: true,
+      sslEnabled: true,
+      sslRejectUnauthorized: true,
+      sslCertificate: true
+    })
+  })
+]);
+
+export const ValidateRedisConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(RedisConnectionMethod.UsernameAndPassword)
+      .describe(AppConnections.CREATE(AppConnection.Redis).method),
+    credentials: RedisConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Redis).credentials
+    )
+  })
+]);
+
+export const CreateRedisConnectionSchema = ValidateRedisConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Redis, {
+    supportsPlatformManagedCredentials: false,
+    supportsGateways: false
+  })
+);
+
+export const UpdateRedisConnectionSchema = z
+  .object({
+    credentials: RedisConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Redis).credentials
+    )
+  })
+  .and(
+    GenericUpdateAppConnectionFieldsSchema(AppConnection.Redis, {
+      supportsPlatformManagedCredentials: false,
+      supportsGateways: false
+    })
+  );
+
+export const RedisConnectionListItemSchema = z.object({
+  name: z.literal("Redis"),
+  app: z.literal(AppConnection.Redis),
+  methods: z.nativeEnum(RedisConnectionMethod).array(),
+  supportsPlatformManagement: z.literal(false)
+});
@@ -0,0 +1,22 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateRedisConnectionSchema,
+  RedisConnectionSchema,
+  ValidateRedisConnectionCredentialsSchema
+} from "./redis-connection-schemas";
+
+export type TRedisConnection = z.infer<typeof RedisConnectionSchema>;
+
+export type TRedisConnectionInput = z.infer<typeof CreateRedisConnectionSchema> & {
+  app: AppConnection.Redis;
+};
+
+export type TValidateRedisConnectionCredentialsSchema = typeof ValidateRedisConnectionCredentialsSchema;
+
+export type TRedisConnectionConfig = DiscriminativePick<TRedisConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
@@ -684,7 +684,8 @@ export const authLoginServiceFactory = ({
    mfaJwtToken,
    ip,
    userAgent,
-    orgId
+    orgId,
+    isRecoveryCode = false
  }: TVerifyMfaTokenDTO) => {
    const appCfg = getConfig();
    const user = await userDAL.findById(userId);
@@ -698,16 +699,21 @@ export const authLoginServiceFactory = ({
          code: mfaToken
        });
      } else if (mfaMethod === MfaMethod.TOTP) {
-        if (mfaToken.length === 6) {
-          await totpService.verifyUserTotp({
-            userId,
-            totp: mfaToken
-          });
-        } else {
+        if (isRecoveryCode) {
          await totpService.verifyWithUserRecoveryCode({
            userId,
            recoveryCode: mfaToken
          });
+        } else {
+          if (mfaToken.length !== 6) {
+            throw new BadRequestError({
+              message: "Please use a valid TOTP code."
+            });
+          }
+          await totpService.verifyUserTotp({
+            userId,
+            totp: mfaToken
+          });
        }
      }
    } catch (err) {
@@ -24,6 +24,7 @@ export type TVerifyMfaTokenDTO = {
  ip: string;
  userAgent: string;
  orgId?: string;
+  isRecoveryCode?: boolean;
 };

 export type TOauthLoginDTO = {
@@ -6,6 +6,7 @@ import { OrgServiceActor } from "@app/lib/types";

 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TokenType } from "../auth-token/auth-token-types";
+import { TOrgMembershipDALFactory } from "../org-membership/org-membership-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TTotpConfigDALFactory } from "../totp/totp-config-dal";
 import { TUserDALFactory } from "../user/user-dal";
@@ -22,6 +23,7 @@ import { ActorType, AuthMethod, AuthTokenType } from "./auth-type";
 type TAuthPasswordServiceFactoryDep = {
  authDAL: TAuthDALFactory;
  userDAL: TUserDALFactory;
+  orgMembershipDAL: Pick<TOrgMembershipDALFactory, "find">;
  tokenService: TAuthTokenServiceFactory;
  smtpService: TSmtpService;
  totpConfigDAL: Pick<TTotpConfigDALFactory, "delete">;
@@ -31,6 +33,7 @@ export type TAuthPasswordFactory = ReturnType<typeof authPaswordServiceFactory>;
 export const authPaswordServiceFactory = ({
  authDAL,
  userDAL,
+  orgMembershipDAL,
  tokenService,
  smtpService,
  totpConfigDAL
@@ -47,21 +50,46 @@ export const authPaswordServiceFactory = ({

      if (user && user.isAccepted) {
        const cfg = getConfig();
-        const token = await tokenService.createTokenForUser({
-          type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
-          userId: user.id
-        });

-        await smtpService.sendMail({
-          template: SmtpTemplates.ResetPassword,
-          recipients: [email],
-          subjectLine: "Infisical password reset",
-          substitutions: {
+        const hasEmailAuth = user.authMethods?.includes(AuthMethod.EMAIL);
+
+        if (!hasEmailAuth) {
+          const orgMemberships = await orgMembershipDAL.find({ userId: user.id });
+          const lastLoginMethod =
+            orgMemberships
+              .filter((membership) => membership.lastLoginAuthMethod)
+              .sort((a, b) => (b.updatedAt || new Date(0)).getTime() - (a.updatedAt || new Date(0)).getTime())[0]
+              ?.lastLoginAuthMethod || null;
+          const substitutions = {
            email,
-            token,
-            callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
-          }
-        });
+            lastLoginMethod,
+            isCloud: cfg.isCloud,
+            siteUrl: cfg.SITE_URL || ""
+          };
+
+          await smtpService.sendMail({
+            template: SmtpTemplates.OAuthPasswordReset,
+            recipients: [email],
+            subjectLine: "Password reset not available",
+            substitutions
+          });
+        } else {
+          const token = await tokenService.createTokenForUser({
+            type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
+            userId: user.id
+          });
+
+          await smtpService.sendMail({
+            template: SmtpTemplates.ResetPassword,
+            recipients: [email],
+            subjectLine: "Infisical password reset",
+            substitutions: {
+              email,
+              token,
+              callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
+            }
+          });
+        }
      }
    };

@@ -782,7 +782,7 @@ export const expandSecretReferencesFactory = ({
 };

 export const reshapeBridgeSecret = (
-  workspaceId: string,
+  projectId: string,
  environment: string,
  secretPath: string,
  secret: Omit<TSecretsV2, "encryptedValue" | "encryptedComment"> & {
@@ -809,7 +809,8 @@ export const reshapeBridgeSecret = (
 ) => ({
  secretKey: secret.key,
  secretPath,
-  workspace: workspaceId,
+  workspace: projectId,
+  projectId,
  environment,
  secretComment: secret.comment || "",
  version: secret.version,
@@ -0,0 +1,80 @@
+import { Heading, Section, Text } from "@react-email/components";
+import React from "react";
+
+import { BaseEmailWrapper, BaseEmailWrapperProps } from "./BaseEmailWrapper";
+import { BaseLink } from "./BaseLink";
+
+interface OAuthPasswordResetTemplateProps extends Omit<BaseEmailWrapperProps, "title" | "preview" | "children"> {
+  email: string;
+  lastLoginMethod?: string | null;
+  isCloud: boolean;
+}
+
+export const OAuthPasswordResetTemplate = ({
+  email,
+  lastLoginMethod,
+  isCloud,
+  siteUrl
+}: OAuthPasswordResetTemplateProps) => {
+  const getAuthMethodDisplayName = (method: string) => {
+    return method
+      .split("-")
+      .map((word) => {
+        const upperWord = word.toUpperCase();
+        if (["SAML", "LDAP", "OIDC", "SSO"].includes(upperWord)) {
+          return upperWord;
+        }
+        return word.charAt(0).toUpperCase() + word.slice(1);
+      })
+      .join(" ");
+  };
+
+  const getAuthMethodMessage = () => {
+    if (lastLoginMethod) {
+      const displayName = getAuthMethodDisplayName(lastLoginMethod);
+      return `Please continue by signing in with ${displayName}.`;
+    }
+    return "Please continue using the same authentication method you previously used to sign in (e.g., SSO, SAML, OAuth, or another configured provider).";
+  };
+  return (
+    <BaseEmailWrapper
+      title="Password Reset Not Available"
+      preview="Your account doesn't have password login enabled."
+      siteUrl={siteUrl}
+    >
+      <Heading className="text-black text-[18px] leading-[28px] text-center font-normal p-0 mx-0">
+        <strong>Password Reset Not Available</strong>
+      </Heading>
+      <Section className="px-[24px] mb-[28px] mt-[36px] pt-[12px] pb-[8px] border border-solid border-gray-200 rounded-md bg-gray-50">
+        <Text className="text-[14px]">
+          <strong>Password reset is not available for this account.</strong>
+        </Text>
+        <Text className="text-[14px]">
+          A password reset was requested for your Infisical account ({email}), but password login has not been enabled
+          for your account.
+        </Text>
+        <Text className="text-[14px]">{getAuthMethodMessage()}</Text>
+        <Text className="text-[14px]">
+          If you did not initiate this request, please contact{" "}
+          {isCloud ? (
+            <>
+              us immediately at <BaseLink href="mailto:[email protected]">support@infisical.com</BaseLink>
+            </>
+          ) : (
+            "your administrator immediately"
+          )}
+          .
+        </Text>
+      </Section>
+    </BaseEmailWrapper>
+  );
+};
+
+export default OAuthPasswordResetTemplate;
+
+OAuthPasswordResetTemplate.PreviewProps = {
+  email: "[email protected]",
+  lastLoginMethod: "github",
+  isCloud: true,
+  siteUrl: "https://infisical.com"
+} as OAuthPasswordResetTemplateProps;
@@ -7,6 +7,7 @@ export * from "./ExternalImportStartedTemplate";
 export * from "./ExternalImportSucceededTemplate";
 export * from "./IntegrationSyncFailedTemplate";
 export * from "./NewDeviceLoginTemplate";
+export * from "./OAuthPasswordResetTemplate";
 export * from "./OrgAdminBreakglassAccessTemplate";
 export * from "./OrgAdminProjectGrantAccessTemplate";
 export * from "./OrganizationAssignmentTemplate";
@@ -16,6 +16,7 @@ import {
  ExternalImportSucceededTemplate,
  IntegrationSyncFailedTemplate,
  NewDeviceLoginTemplate,
+  OAuthPasswordResetTemplate,
  OrgAdminBreakglassAccessTemplate,
  OrgAdminProjectGrantAccessTemplate,
  OrganizationAssignmentTemplate,
@@ -63,6 +64,7 @@ export enum SmtpTemplates {
  NewDeviceJoin = "newDevice",
  OrgInvite = "organizationInvitation",
  OrgAssignment = "organizationAssignment",
+  OAuthPasswordReset = "oAuthPasswordReset",
  ResetPassword = "passwordReset",
  SetupPassword = "passwordSetup",
  SecretLeakIncident = "secretLeakIncident",
@@ -121,6 +123,7 @@ const EmailTemplateMap: Record<SmtpTemplates, React.FC<any>> = {
  [SmtpTemplates.OrgAdminProjectDirectAccess]: OrgAdminProjectGrantAccessTemplate,
  [SmtpTemplates.ProjectAccessRequest]: ProjectAccessRequestTemplate,
  [SmtpTemplates.SecretApprovalRequestNeedsReview]: SecretApprovalRequestNeedsReviewTemplate,
+  [SmtpTemplates.OAuthPasswordReset]: OAuthPasswordResetTemplate,
  [SmtpTemplates.ResetPassword]: PasswordResetTemplate,
  [SmtpTemplates.SetupPassword]: PasswordSetupTemplate,
  [SmtpTemplates.PkiExpirationAlert]: PkiExpirationAlertTemplate,
@@ -131,15 +131,20 @@ export const totpServiceFactory = ({ totpConfigDAL, kmsService, userDAL }: TTotp
      secret
    });

-    if (isValid) {
-      await totpConfigDAL.updateById(totpConfig.id, {
-        isVerified: true
-      });
-    } else {
+    if (!isValid) {
      throw new BadRequestError({
        message: "Invalid TOTP token"
      });
    }
+
+    await totpConfigDAL.updateById(totpConfig.id, {
+      isVerified: true
+    });
+
+    const recoveryCodes = decryptWithRoot(totpConfig.encryptedRecoveryCodes).toString().split(",");
+    return {
+      recoveryCodes
+    };
  };

  const verifyUserTotp = async ({ userId, totp }: TVerifyUserTotpDTO) => {
@@ -0,0 +1,242 @@
+/* eslint-disable no-await-in-loop */
+import RE2 from "re2";
+
+import { getConfig } from "@app/lib/config/env";
+
+import { FormattedRelease, GitHubApiError, GitHubRelease } from "./types";
+
+interface GitHubClientConfig {
+  token?: string;
+  timeout: number;
+  maxRetries: number;
+  retryDelay: number;
+  maxPagesPerRequest: number;
+  perPage: number;
+}
+
+interface RateLimitInfo {
+  remaining: number;
+  reset: Date;
+  used: number;
+  limit: number;
+}
+
+const getDefaultConfig = (): GitHubClientConfig => ({
+  token: getConfig().GITHUB_API_TOKEN,
+  timeout: 30000,
+  maxRetries: 3,
+  retryDelay: 1000,
+  maxPagesPerRequest: 10,
+  perPage: 100
+});
+
+const getHeaders = (token?: string): Record<string, string> => {
+  const headers: Record<string, string> = {
+    Accept: "application/vnd.github.v3+json",
+    "User-Agent": "Infisical-Upgrade-Path-Tool/1.0",
+    "X-GitHub-Api-Version": "2022-11-28"
+  };
+
+  if (token) {
+    headers.Authorization = `token ${token}`;
+  }
+
+  return headers;
+};
+
+const delay = (ms: number): Promise<void> => {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+};
+
+const isMainInfisicalRelease = (tagName: string): boolean => {
+  if (
+    tagName.startsWith("infisical-cli/") ||
+    tagName.startsWith("infisical-k8-operator/") ||
+    tagName.startsWith("infisical-k8s-operator/")
+  ) {
+    return false;
+  }
+
+  const patterns = [
+    new RE2(/^v\d+\.\d+\.\d+/),
+    new RE2(/^\d+\.\d+\.\d+/),
+    new RE2(/^infisical\/v?\d+\.\d+\.\d+/),
+    new RE2(/^infisical\/v?\d+\.\d+\.\d+[-\w]*/)
+  ];
+
+  return patterns.some((pattern) => pattern.test(tagName));
+};
+
+const normalizeVersion = (tagName: string): string => {
+  const versionMatch = tagName.match(new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/));
+  if (versionMatch) {
+    return `v${versionMatch[1]}`;
+  }
+
+  if (tagName.startsWith("infisical/")) {
+    const withoutPrefix = tagName.replace(new RE2(/^infisical\//), "");
+    return withoutPrefix.replace(new RE2(/-[a-zA-Z]+$/), "");
+  }
+  return tagName.replace(new RE2(/-[a-zA-Z]+$/), "");
+};
+
+const compareVersions = (v1: string, v2: string): number => {
+  const normalize = (v: string) => {
+    const versionMatch = v.match(new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/));
+    if (versionMatch) {
+      return versionMatch[1];
+    }
+    if (v.startsWith("infisical/")) {
+      return v.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
+    }
+    return v.replace(new RE2(/^v/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
+  };
+
+  const clean1 = normalize(v1);
+  const clean2 = normalize(v2);
+
+  const parts1 = clean1.split(".").map(Number);
+  const parts2 = clean2.split(".").map(Number);
+
+  const maxLength = Math.max(parts1.length, parts2.length);
+  while (parts1.length < maxLength) parts1.push(0);
+  while (parts2.length < maxLength) parts2.push(0);
+
+  for (let i = 0; i < maxLength; i += 1) {
+    if (parts1[i] > parts2[i]) return 1;
+    if (parts1[i] < parts2[i]) return -1;
+  }
+  return 0;
+};
+
+const isVersionAtLeastMinimum = (tagName: string, minimumVersion = "0.147.0"): boolean => {
+  return compareVersions(tagName, minimumVersion) >= 0;
+};
+
+const makeRequest = async <T>(
+  url: string,
+  config: GitHubClientConfig,
+  retryCount = 0
+): Promise<{ data: T; rateLimit: RateLimitInfo }> => {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), config.timeout);
+
+  try {
+    const response = await fetch(url, {
+      headers: getHeaders(config.token),
+      signal: controller.signal
+    });
+
+    clearTimeout(timeout);
+
+    const rateLimit: RateLimitInfo = {
+      remaining: parseInt(response.headers.get("X-RateLimit-Remaining") || "0", 10),
+      reset: new Date(parseInt(response.headers.get("X-RateLimit-Reset") || "0", 10) * 1000),
+      used: parseInt(response.headers.get("X-RateLimit-Used") || "0", 10),
+      limit: parseInt(response.headers.get("X-RateLimit-Limit") || "5000", 10)
+    };
+
+    if (!response.ok) {
+      const error: GitHubApiError = new Error(`GitHub API error: ${response.status}`);
+      error.status = response.status;
+      error.headers = response.headers;
+
+      if (response.status === 403) {
+        const resetTime = rateLimit.reset.toISOString();
+        error.message = `GitHub API rate limit exceeded. Remaining: ${rateLimit.remaining}, Reset at: ${resetTime}. ${
+          !config.token ? "Consider setting GITHUB_TOKEN environment variable." : ""
+        }`;
+      }
+
+      if (retryCount < config.maxRetries && (response.status >= 500 || response.status === 403)) {
+        await delay(config.retryDelay * 2 ** retryCount);
+        return await makeRequest<T>(url, config, retryCount + 1);
+      }
+
+      throw error;
+    }
+
+    const data = (await response.json()) as T;
+    return { data, rateLimit };
+  } catch (error) {
+    clearTimeout(timeout);
+
+    if (error instanceof Error && error.name === "AbortError") {
+      if (retryCount < config.maxRetries) {
+        await delay(config.retryDelay * 2 ** retryCount);
+        return await makeRequest<T>(url, config, retryCount + 1);
+      }
+      throw new Error(`Request timeout after ${config.timeout}ms`);
+    }
+
+    if (retryCount < config.maxRetries && !(error as GitHubApiError).status) {
+      await delay(config.retryDelay * 2 ** retryCount);
+      return await makeRequest<T>(url, config, retryCount + 1);
+    }
+
+    throw error;
+  }
+};
+
+export const fetchReleases = async (includePrerelease = false): Promise<FormattedRelease[]> => {
+  const config = getDefaultConfig();
+  const allReleases: GitHubRelease[] = [];
+  let page = 1;
+  let hasMorePages = true;
+  let reachedMinimumVersion = false;
+
+  const maxConcurrentRequests = Math.min(3, config.maxPagesPerRequest);
+
+  while (hasMorePages && page <= config.maxPagesPerRequest && !reachedMinimumVersion) {
+    const requests: Promise<{ data: GitHubRelease[]; rateLimit: RateLimitInfo }>[] = [];
+
+    for (let i = 0; i < maxConcurrentRequests && page <= config.maxPagesPerRequest; i += 1, page += 1) {
+      const url = `https://api.github.com/repos/Infisical/infisical/releases?page=${page}&per_page=${config.perPage}`;
+      requests.push(makeRequest<GitHubRelease[]>(url, config));
+    }
+
+    const results = await Promise.allSettled(requests);
+    let hasData = false;
+
+    for (const result of results) {
+      if (result.status === "fulfilled") {
+        const { data } = result.value;
+        if (data.length > 0) {
+          for (const release of data) {
+            if (!release.draft && isMainInfisicalRelease(release.tag_name)) {
+              if (isVersionAtLeastMinimum(release.tag_name)) {
+                allReleases.push(release);
+              } else {
+                reachedMinimumVersion = true;
+                break;
+              }
+            }
+          }
+          hasData = true;
+        }
+      }
+    }
+
+    if (!hasData || results.every((r) => r.status === "fulfilled" && r.value.data.length < config.perPage)) {
+      hasMorePages = false;
+    }
+  }
+
+  const formattedReleases = allReleases
+    .map(
+      (release): FormattedRelease => ({
+        tagName: release.tag_name,
+        normalizedTagName: normalizeVersion(release.tag_name),
+        name: release.name,
+        body: release.body,
+        publishedAt: release.published_at,
+        prerelease: release.prerelease,
+        draft: release.draft
+      })
+    )
+    .sort((a, b) => new Date(b.publishedAt).getTime() - new Date(a.publishedAt).getTime());
+
+  return formattedReleases.filter((release) => includePrerelease || !release.prerelease);
+};
@@ -0,0 +1,2 @@
+export type { TUpgradePathService, TUpgradePathServiceFactory } from "./upgrade-path-service";
+export { upgradePathServiceFactory } from "./upgrade-path-service";
@@ -0,0 +1,66 @@
+export interface GitHubRelease {
+  tag_name: string;
+  name: string;
+  body: string;
+  published_at: string;
+  prerelease: boolean;
+  draft: boolean;
+}
+
+export interface FormattedRelease {
+  tagName: string;
+  normalizedTagName: string;
+  name: string;
+  body: string;
+  publishedAt: string;
+  prerelease: boolean;
+  draft: boolean;
+}
+
+export interface BreakingChange {
+  title: string;
+  description: string;
+  action: string;
+}
+
+export interface VersionConfig {
+  breaking_changes?: BreakingChange[];
+  db_schema_changes?: string;
+  notes?: string;
+}
+
+export interface UpgradePathConfig {
+  versions?: Record<string, VersionConfig>;
+}
+
+export interface UpgradePathResult {
+  path: Array<{
+    version: string;
+    name: string;
+    publishedAt: string;
+    prerelease: boolean;
+  }>;
+  breakingChanges: Array<{
+    version: string;
+    changes: BreakingChange[];
+  }>;
+  features: Array<{
+    version: string;
+    name: string;
+    body: string;
+    publishedAt: string;
+  }>;
+  hasDbMigration: boolean;
+  config: Record<string, unknown>;
+}
+
+export interface GitHubApiError extends Error {
+  status?: number;
+  headers?: Headers;
+}
+
+export interface CacheEntry<T> {
+  data: T;
+  timestamp: number;
+  ttl: number;
+}
@@ -0,0 +1,24 @@
+import RE2 from "re2";
+import { z } from "zod";
+
+export const versionSchema = z
+  .string()
+  .min(1)
+  .max(50)
+  .regex(new RE2(/^[a-zA-Z0-9._/-]+$/), "Invalid version format");
+
+export const breakingChangeSchema = z.object({
+  title: z.string().min(1).max(200),
+  description: z.string().min(1).max(1000),
+  action: z.string().min(1).max(500)
+});
+
+export const versionConfigSchema = z.object({
+  breaking_changes: z.array(breakingChangeSchema).optional(),
+  db_schema_changes: z.string().max(1000).optional(),
+  notes: z.string().max(2000).optional()
+});
+
+export const upgradePathConfigSchema = z.object({
+  versions: z.record(versionSchema, versionConfigSchema).optional().nullable()
+});
@@ -0,0 +1,259 @@
+import { readFile } from "fs/promises";
+import * as yaml from "js-yaml";
+import * as path from "path";
+import RE2 from "re2";
+import { z } from "zod";
+
+import { TKeyStoreFactory } from "@app/keystore/keystore";
+import { logger } from "@app/lib/logger";
+
+import { fetchReleases } from "./github-client";
+import { BreakingChange, FormattedRelease, UpgradePathConfig, UpgradePathResult, VersionConfig } from "./types";
+import { versionConfigSchema, versionSchema } from "./upgrade-path-schemas";
+
+export type TUpgradePathServiceFactory = {
+  keyStore: TKeyStoreFactory;
+};
+export type TUpgradePathService = ReturnType<typeof upgradePathServiceFactory>;
+
+interface CalculateUpgradePathParams {
+  fromVersion: string;
+  toVersion: string;
+}
+
+export const upgradePathServiceFactory = ({ keyStore }: TUpgradePathServiceFactory) => {
+  const sanitizeCacheKey = (key: string): string => {
+    return key.replace(new RE2(/[^a-zA-Z0-9\-:._]/g), "_");
+  };
+  const getGitHubReleases = async (): Promise<FormattedRelease[]> => {
+    const cacheKey = "upgrade-path:releases";
+
+    try {
+      const cached = await keyStore.getItem(cacheKey);
+      if (cached) {
+        const cachedReleases = JSON.parse(cached) as FormattedRelease[];
+        if (cachedReleases.length > 0) {
+          return cachedReleases;
+        }
+      }
+    } catch (error) {
+      logger.error(error, "Failed to retrieve releases from cache");
+    }
+
+    try {
+      const releases = await fetchReleases(false);
+      const filteredReleases = releases.filter((v) => !v.tagName.includes("nightly"));
+
+      await keyStore.setItemWithExpiry(cacheKey, 24 * 60 * 60, JSON.stringify(filteredReleases));
+      return filteredReleases;
+    } catch (error) {
+      throw new Error(`GitHub releases unavailable: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  };
+
+  const getUpgradePathConfig = async (): Promise<Record<string, z.infer<typeof versionConfigSchema>>> => {
+    const cacheKey = "upgrade-path:config";
+
+    try {
+      const cached = await keyStore.getItem(cacheKey);
+      if (cached) return JSON.parse(cached) as Record<string, VersionConfig>;
+    } catch (error) {
+      logger.error(error, "Failed to retrieve config from cache");
+    }
+
+    try {
+      const yamlPath = path.join(__dirname, "..", "..", "..", "upgrade-path.yaml");
+      const resolvedPath = path.resolve(yamlPath);
+      const expectedBaseDir = path.resolve(__dirname, "..", "..", "..");
+      if (!resolvedPath.startsWith(expectedBaseDir)) {
+        throw new Error("Invalid configuration file path");
+      }
+
+      const yamlContent = await readFile(yamlPath, "utf8");
+
+      if (yamlContent.length > 1024 * 1024) {
+        throw new Error("Config file too large");
+      }
+
+      const config = yaml.load(yamlContent, { schema: yaml.FAILSAFE_SCHEMA }) as UpgradePathConfig;
+      const versionConfig = config?.versions || {};
+
+      await keyStore.setItemWithExpiry(cacheKey, 24 * 60 * 60, JSON.stringify(versionConfig));
+      return versionConfig;
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        const empty = {};
+        await keyStore.setItemWithExpiry(cacheKey, 24 * 60 * 60, JSON.stringify(empty));
+        return empty;
+      }
+      throw new Error(`Config load failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  };
+
+  const normalizeVersion = (version: string): string => {
+    const versionRegex = new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/);
+    const versionMatch = version.match(versionRegex);
+    if (versionMatch) {
+      return versionMatch[1];
+    }
+
+    if (version.startsWith("infisical/")) {
+      return version.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
+    }
+    return version.replace(new RE2(/^v/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
+  };
+
+  const validateParams = (params: CalculateUpgradePathParams) => {
+    const { fromVersion, toVersion } = params;
+
+    versionSchema.parse(fromVersion);
+    versionSchema.parse(toVersion);
+
+    if (fromVersion === toVersion) {
+      throw new Error("Versions cannot be identical");
+    }
+
+    if (fromVersion.includes("nightly") || toVersion.includes("nightly")) {
+      throw new Error("Nightly releases are not supported for upgrade path calculation");
+    }
+
+    return { fromVersion, toVersion };
+  };
+
+  const calculateUpgradePath = async (params: CalculateUpgradePathParams): Promise<UpgradePathResult> => {
+    const { fromVersion, toVersion } = validateParams(params);
+    const cacheKey = sanitizeCacheKey(`upgrade-path:${fromVersion}:${toVersion}`);
+
+    try {
+      const cached = await keyStore.getItem(cacheKey);
+      if (cached) return JSON.parse(cached) as UpgradePathResult;
+    } catch (error) {
+      logger.error(error, "Failed to retrieve upgrade path from cache");
+    }
+
+    const [releases, config] = await Promise.all([getGitHubReleases(), getUpgradePathConfig()]);
+
+    const cleanFrom = normalizeVersion(fromVersion);
+    const cleanTo = normalizeVersion(toVersion);
+
+    const compareVersions = (v1: string, v2: string): number => {
+      const normalize = (v: string) => normalizeVersion(v);
+      const clean1 = normalize(v1);
+      const clean2 = normalize(v2);
+
+      const parts1 = clean1.split(".").map(Number);
+      const parts2 = clean2.split(".").map(Number);
+
+      const maxLength = Math.max(parts1.length, parts2.length);
+      while (parts1.length < maxLength) parts1.push(0);
+      while (parts2.length < maxLength) parts2.push(0);
+
+      for (let i = 0; i < maxLength; i += 1) {
+        if (parts1[i] > parts2[i]) return 1;
+        if (parts1[i] < parts2[i]) return -1;
+      }
+      return 0;
+    };
+
+    if (compareVersions(cleanFrom, cleanTo) >= 0) {
+      throw new Error("fromVersion must be older than toVersion");
+    }
+
+    const fromIdx = releases.findIndex((r) => normalizeVersion(r.normalizedTagName) === cleanFrom);
+    const toIdx = releases.findIndex((r) => normalizeVersion(r.normalizedTagName) === cleanTo);
+
+    let upgradePath: FormattedRelease[] = [];
+    const filteredPath: FormattedRelease[] = [];
+
+    if (fromIdx !== -1 && toIdx !== -1) {
+      if (fromIdx <= toIdx) throw new Error("Invalid version order");
+      upgradePath = releases.slice(toIdx, fromIdx + 1).reverse();
+      const [first, last] = [upgradePath[0], upgradePath[upgradePath.length - 1]];
+
+      filteredPath.push(first);
+      if (last !== first) filteredPath.push(last);
+    }
+
+    const breakingChanges: Array<{ version: string; changes: BreakingChange[] }> = [];
+    const features: Array<{ version: string; name: string; body: string; publishedAt: string }> = [];
+    let hasDbMigration = false;
+
+    const isVersionInRange = (version: string, fromVer: string, toVer: string): boolean => {
+      const versionComp = compareVersions(version, fromVer);
+      const toVersionComp = compareVersions(version, toVer);
+      return versionComp > 0 && toVersionComp < 0;
+    };
+
+    Object.keys(config).forEach((configVersion) => {
+      const versionConfig = config[configVersion];
+      if (versionConfig?.breaking_changes?.length) {
+        if (isVersionInRange(configVersion, cleanFrom, cleanTo)) {
+          breakingChanges.push({
+            version: configVersion,
+            changes: versionConfig.breaking_changes
+          });
+        }
+      }
+    });
+    for (let i = 0; i < upgradePath.length; i += 1) {
+      const version = upgradePath[i];
+      const isFromVersion = normalizeVersion(version.normalizedTagName) === cleanFrom;
+
+      if (!isFromVersion) {
+        const versionNumber = normalizeVersion(version.tagName);
+        const possibleKeys = [
+          version.tagName,
+          version.normalizedTagName,
+          versionNumber,
+          `v${versionNumber}`,
+          version.tagName.replace(new RE2(/^infisical\//), ""),
+          version.tagName.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "")
+        ];
+
+        for (const key of possibleKeys) {
+          const versionConfig = config[key];
+          if (
+            versionConfig?.db_schema_changes &&
+            typeof versionConfig.db_schema_changes === "string" &&
+            versionConfig.db_schema_changes.trim()
+          ) {
+            hasDbMigration = true;
+            break;
+          }
+        }
+      }
+
+      // Collect release notes and features
+      if (version.body) {
+        features.push({
+          version: version.tagName,
+          name: version.name,
+          body: version.body,
+          publishedAt: version.publishedAt
+        });
+      }
+    }
+
+    const result: UpgradePathResult = {
+      path: filteredPath.map((r) => ({
+        version: r.tagName,
+        name: r.name,
+        publishedAt: r.publishedAt,
+        prerelease: r.prerelease
+      })),
+      breakingChanges,
+      features,
+      hasDbMigration,
+      config
+    };
+
+    await keyStore.setItemWithExpiry(cacheKey, 60 * 60, JSON.stringify(result));
+    return result;
+  };
+
+  return {
+    getGitHubReleases,
+    getUpgradePathConfig,
+    calculateUpgradePath: (fromVersion: string, toVersion: string) => calculateUpgradePath({ fromVersion, toVersion })
+  };
+};
@@ -94,6 +94,7 @@ export const getWebhookPayload = (event: TWebhookPayloads) => {
          event: event.type,
          project: {
            workspaceId: projectId,
+            projectId,
            projectName,
            environment,
            secretPath
@@ -147,6 +148,7 @@ export const getWebhookPayload = (event: TWebhookPayloads) => {
        event: event.type,
        project: {
          workspaceId: projectId,
+          projectId,
          projectName,
          environment,
          secretPath,