app connection + finishing touches

backend/src/services/app-connection/app-connection-enums.ts

@@ -66,3 +66,8 @@ export enum AWSRegion {
   // South America
   SA_EAST_1 = "sa-east-1" // Sao Paulo
 }
+
+export enum AppConnectionPlanType {
+  Enterprise = "enterprise",
+  Regular = "regular"
+}

backend/src/services/app-connection/app-connection-fns.ts

@@ -8,6 +8,11 @@ import {
 } from "@app/services/app-connection/shared/sql";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
+import {
+  getOCIConnectionListItem,
+  OCIConnectionMethod,
+  validateOCIConnectionCredentials
+} from "../../ee/services/app-connections/oci";
 import { AppConnection } from "./app-connection-enums";
 import { TAppConnectionServiceFactoryDep } from "./app-connection-service";
 import {
@@ -53,7 +58,6 @@ import {
 } from "./humanitec";
 import { getLdapConnectionListItem, LdapConnectionMethod, validateLdapConnectionCredentials } from "./ldap";
 import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
-import { getOCIConnectionListItem, OCIConnectionMethod, validateOCIConnectionCredentials } from "./oci";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import {
   getTeamCityConnectionListItem,

backend/src/services/app-connection/app-connection-maps.ts

@@ -1,4 +1,4 @@
-import { AppConnection } from "./app-connection-enums";
+import { AppConnection, AppConnectionPlanType } from "./app-connection-enums";
 
 export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AWS]: "AWS",
@@ -21,3 +21,25 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.TeamCity]: "TeamCity",
   [AppConnection.OCI]: "OCI"
 };
+
+export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
+  [AppConnection.AWS]: AppConnectionPlanType.Regular,
+  [AppConnection.GitHub]: AppConnectionPlanType.Regular,
+  [AppConnection.GCP]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureKeyVault]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureAppConfiguration]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureClientSecrets]: AppConnectionPlanType.Regular,
+  [AppConnection.Databricks]: AppConnectionPlanType.Regular,
+  [AppConnection.Humanitec]: AppConnectionPlanType.Regular,
+  [AppConnection.TerraformCloud]: AppConnectionPlanType.Regular,
+  [AppConnection.Vercel]: AppConnectionPlanType.Regular,
+  [AppConnection.Postgres]: AppConnectionPlanType.Regular,
+  [AppConnection.MsSql]: AppConnectionPlanType.Regular,
+  [AppConnection.Camunda]: AppConnectionPlanType.Regular,
+  [AppConnection.Windmill]: AppConnectionPlanType.Regular,
+  [AppConnection.Auth0]: AppConnectionPlanType.Regular,
+  [AppConnection.HCVault]: AppConnectionPlanType.Regular,
+  [AppConnection.LDAP]: AppConnectionPlanType.Regular,
+  [AppConnection.TeamCity]: AppConnectionPlanType.Regular,
+  [AppConnection.OCI]: AppConnectionPlanType.Enterprise
+};

backend/src/services/app-connection/app-connection-service.ts

@@ -1,5 +1,6 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionAppConnectionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { generateHash } from "@app/lib/crypto/encryption";
@@ -17,9 +18,11 @@ import {
 import { auth0ConnectionService } from "@app/services/app-connection/auth0/auth0-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
+import { ValidateOCIConnectionCredentialsSchema } from "../../ee/services/app-connections/oci";
+import { ociConnectionService } from "../../ee/services/app-connections/oci/oci-connection-service";
 import { TAppConnectionDALFactory } from "./app-connection-dal";
-import { AppConnection } from "./app-connection-enums";
-import { APP_CONNECTION_NAME_MAP } from "./app-connection-maps";
+import { AppConnection, AppConnectionPlanType } from "./app-connection-enums";
+import { APP_CONNECTION_NAME_MAP, APP_CONNECTION_PLAN_MAP } from "./app-connection-maps";
 import {
   TAppConnection,
   TAppConnectionConfig,
@@ -49,8 +52,6 @@ import { ValidateHumanitecConnectionCredentialsSchema } from "./humanitec";
 import { humanitecConnectionService } from "./humanitec/humanitec-connection-service";
 import { ValidateLdapConnectionCredentialsSchema } from "./ldap";
 import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
-import { ValidateOCIConnectionCredentialsSchema } from "./oci";
-import { ociConnectionService } from "./oci/oci-connection-service";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
 import { ValidateTeamCityConnectionCredentialsSchema } from "./teamcity";
 import { teamcityConnectionService } from "./teamcity/teamcity-connection-service";
@@ -65,6 +66,7 @@ export type TAppConnectionServiceFactoryDep = {
   appConnectionDAL: TAppConnectionDALFactory;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TAppConnectionServiceFactory = ReturnType<typeof appConnectionServiceFactory>;
@@ -94,7 +96,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
 export const appConnectionServiceFactory = ({
   appConnectionDAL,
   permissionService,
-  kmsService
+  kmsService,
+  licenseService
 }: TAppConnectionServiceFactoryDep) => {
   const listAppConnectionsByOrg = async (actor: OrgServiceActor, app?: AppConnection) => {
     const { permission } = await permissionService.getOrgPermission(
@@ -191,6 +194,16 @@ export const appConnectionServiceFactory = ({
       OrgPermissionSubjects.AppConnections
     );
 
+    // Enterprise check
+    if (APP_CONNECTION_PLAN_MAP[app] === AppConnectionPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseAppConnections)
+        throw new BadRequestError({
+          message:
+            "Failed to create app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+        });
+    }
+
     const validatedCredentials = await validateAppConnectionCredentials({
       app,
       credentials,
@@ -253,6 +266,16 @@ export const appConnectionServiceFactory = ({
 
     if (!appConnection) throw new NotFoundError({ message: `Could not find App Connection with ID ${connectionId}` });
 
+    // Enterprise check
+    if (APP_CONNECTION_PLAN_MAP[appConnection.app as AppConnection] === AppConnectionPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseAppConnections)
+        throw new BadRequestError({
+          message:
+            "Failed to update app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+        });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -399,6 +422,16 @@ export const appConnectionServiceFactory = ({
 
     if (!appConnection) throw new NotFoundError({ message: `Could not find App Connection with ID ${connectionId}` });
 
+    // Enterprise check
+    if (APP_CONNECTION_PLAN_MAP[app] === AppConnectionPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseAppConnections)
+        throw new BadRequestError({
+          message:
+            "Failed to connect app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+        });
+    }
+
     const { permission: orgPermission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -468,6 +501,6 @@ export const appConnectionServiceFactory = ({
     hcvault: hcVaultConnectionService(connectAppConnectionById),
     windmill: windmillConnectionService(connectAppConnectionById),
     teamcity: teamcityConnectionService(connectAppConnectionById),
-    oci: ociConnectionService(connectAppConnectionById)
+    oci: ociConnectionService(connectAppConnectionById, licenseService)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -2,6 +2,12 @@ import { TAppConnectionDALFactory } from "@app/services/app-connection/app-conne
 import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
+import {
+  TOCIConnection,
+  TOCIConnectionConfig,
+  TOCIConnectionInput,
+  TValidateOCIConnectionCredentialsSchema
+} from "../../ee/services/app-connections/oci";
 import { AWSRegion } from "./app-connection-enums";
 import {
   TAuth0Connection,
@@ -76,12 +82,6 @@ import {
   TValidateLdapConnectionCredentialsSchema
 } from "./ldap";
 import { TMsSqlConnection, TMsSqlConnectionInput, TValidateMsSqlConnectionCredentialsSchema } from "./mssql";
-import {
-  TOCIConnection,
-  TOCIConnectionConfig,
-  TOCIConnectionInput,
-  TValidateOCIConnectionCredentialsSchema
-} from "./oci";
 import {
   TPostgresConnection,
   TPostgresConnectionInput,

backend/src/services/app-connection/oci/index.ts

@@ -1,4 +0,0 @@
-export * from "./oci-connection-enums";
-export * from "./oci-connection-fns";
-export * from "./oci-connection-schemas";
-export * from "./oci-connection-types";

backend/src/services/app-connection/oci/oci-connection-enums.ts

@@ -1,3 +0,0 @@
-export enum OCIConnectionMethod {
-  AccessKey = "access-key"
-}

backend/src/services/app-connection/oci/oci-connection-fns.ts

@@ -1,139 +0,0 @@
-import { common, identity, keymanagement } from "oci-sdk";
-
-import { BadRequestError } from "@app/lib/errors";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-import { OCIConnectionMethod } from "./oci-connection-enums";
-import { TOCIConnection, TOCIConnectionConfig } from "./oci-connection-types";
-
-export const getOCIProvider = async (config: TOCIConnectionConfig) => {
-  const {
-    credentials: { fingerprint, privateKey, region, tenancyOcid, userOcid }
-  } = config;
-
-  const provider = new common.SimpleAuthenticationDetailsProvider(
-    tenancyOcid,
-    userOcid,
-    fingerprint,
-    privateKey,
-    null,
-    common.Region.fromRegionId(region)
-  );
-
-  return provider;
-};
-
-export const getOCIConnectionListItem = () => {
-  return {
-    name: "OCI" as const,
-    app: AppConnection.OCI as const,
-    methods: Object.values(OCIConnectionMethod) as [OCIConnectionMethod.AccessKey]
-  };
-};
-
-export const validateOCIConnectionCredentials = async (config: TOCIConnectionConfig) => {
-  const provider = await getOCIProvider(config);
-
-  try {
-    const identityClient = new identity.IdentityClient({
-      authenticationDetailsProvider: provider
-    });
-
-    // Get user details - a lightweight call that validates all credentials
-    await identityClient.getUser({ userId: config.credentials.userOcid });
-  } catch (error: unknown) {
-    if (error instanceof Error) {
-      throw new BadRequestError({
-        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
-      });
-    }
-    throw new BadRequestError({
-      message: "Unable to validate connection: verify credentials"
-    });
-  }
-
-  return config.credentials;
-};
-
-export const listOCICompartments = async (appConnection: TOCIConnection) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const identityClient = new identity.IdentityClient({ authenticationDetailsProvider: provider });
-  const keyManagementClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const rootCompartment = await identityClient
-    .getTenancy({
-      tenancyId: appConnection.credentials.tenancyOcid
-    })
-    .then((response) => ({
-      ...response.tenancy,
-      id: appConnection.credentials.tenancyOcid,
-      name: response.tenancy.name ? `${response.tenancy.name} (root)` : "root"
-    }));
-
-  const compartments = await identityClient.listCompartments({
-    compartmentId: appConnection.credentials.tenancyOcid,
-    compartmentIdInSubtree: true,
-    accessLevel: identity.requests.ListCompartmentsRequest.AccessLevel.Any,
-    lifecycleState: identity.models.Compartment.LifecycleState.Active
-  });
-
-  const allCompartments = [rootCompartment, ...compartments.items];
-  const filteredCompartments = [];
-
-  for await (const compartment of allCompartments) {
-    try {
-      // Check if user can list vaults in this compartment
-      await keyManagementClient.listVaults({
-        compartmentId: compartment.id,
-        limit: 1
-      });
-
-      filteredCompartments.push(compartment);
-    } catch (error) {
-      // Do nothing
-    }
-  }
-
-  return filteredCompartments;
-};
-
-export const listOCIVaults = async (appConnection: TOCIConnection, compartmentOcid: string) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const keyManagementClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const vaults = await keyManagementClient.listVaults({
-    compartmentId: compartmentOcid
-  });
-
-  return vaults.items.filter((v) => v.lifecycleState === keymanagement.models.Vault.LifecycleState.Active);
-};
-
-export const listOCIVaultKeys = async (appConnection: TOCIConnection, compartmentOcid: string, vaultOcid: string) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const kmsVaultClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const vault = await kmsVaultClient.getVault({
-    vaultId: vaultOcid
-  });
-
-  const keyManagementClient = new keymanagement.KmsManagementClient({
-    authenticationDetailsProvider: provider
-  });
-
-  keyManagementClient.endpoint = vault.vault.managementEndpoint;
-
-  const keys = await keyManagementClient.listKeys({
-    compartmentId: compartmentOcid
-  });
-
-  return keys.items.filter((v) => v.lifecycleState === keymanagement.models.KeySummary.LifecycleState.Enabled);
-};

backend/src/services/app-connection/oci/oci-connection-schemas.ts

@@ -1,65 +0,0 @@
-import z from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { OCIConnectionMethod } from "./oci-connection-enums";
-
-export const OCIConnectionAccessTokenCredentialsSchema = z.object({
-  userOcid: z.string().trim().min(1, "User OCID required").describe(AppConnections.CREDENTIALS.OCI.userOcid),
-  tenancyOcid: z.string().trim().min(1, "Tenancy OCID required").describe(AppConnections.CREDENTIALS.OCI.tenancyOcid),
-  region: z.string().trim().min(1, "Region required").describe(AppConnections.CREDENTIALS.OCI.region),
-  fingerprint: z.string().trim().min(1, "Fingerprint required").describe(AppConnections.CREDENTIALS.OCI.fingerprint),
-  privateKey: z.string().trim().min(1, "Private Key required").describe(AppConnections.CREDENTIALS.OCI.privateKey)
-});
-
-const BaseOCIConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.OCI) });
-
-export const OCIConnectionSchema = BaseOCIConnectionSchema.extend({
-  method: z.literal(OCIConnectionMethod.AccessKey),
-  credentials: OCIConnectionAccessTokenCredentialsSchema
-});
-
-export const SanitizedOCIConnectionSchema = z.discriminatedUnion("method", [
-  BaseOCIConnectionSchema.extend({
-    method: z.literal(OCIConnectionMethod.AccessKey),
-    credentials: OCIConnectionAccessTokenCredentialsSchema.pick({
-      userOcid: true,
-      tenancyOcid: true,
-      region: true,
-      fingerprint: true
-    })
-  })
-]);
-
-export const ValidateOCIConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(OCIConnectionMethod.AccessKey).describe(AppConnections.CREATE(AppConnection.OCI).method),
-    credentials: OCIConnectionAccessTokenCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.OCI).credentials
-    )
-  })
-]);
-
-export const CreateOCIConnectionSchema = ValidateOCIConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.OCI)
-);
-
-export const UpdateOCIConnectionSchema = z
-  .object({
-    credentials: OCIConnectionAccessTokenCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.OCI).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.OCI));
-
-export const OCIConnectionListItemSchema = z.object({
-  name: z.literal("OCI"),
-  app: z.literal(AppConnection.OCI),
-  methods: z.nativeEnum(OCIConnectionMethod).array()
-});

backend/src/services/app-connection/oci/oci-connection-service.ts

@@ -1,70 +0,0 @@
-import { logger } from "@app/lib/logger";
-import { OrgServiceActor } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import { listOCICompartments, listOCIVaultKeys, listOCIVaults } from "./oci-connection-fns";
-import { TOCIConnection } from "./oci-connection-types";
-
-type TGetAppConnectionFunc = (
-  app: AppConnection,
-  connectionId: string,
-  actor: OrgServiceActor
-) => Promise<TOCIConnection>;
-
-type TListOCIVaultsDTO = {
-  connectionId: string;
-  compartmentOcid: string;
-};
-
-type TListOCIVaultKeysDTO = {
-  connectionId: string;
-  compartmentOcid: string;
-  vaultOcid: string;
-};
-
-export const ociConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
-  const listCompartments = async (connectionId: string, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const compartments = await listOCICompartments(appConnection);
-      return compartments;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  const listVaults = async ({ connectionId, compartmentOcid }: TListOCIVaultsDTO, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const vaults = await listOCIVaults(appConnection, compartmentOcid);
-      return vaults;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  const listVaultKeys = async (
-    { connectionId, compartmentOcid, vaultOcid }: TListOCIVaultKeysDTO,
-    actor: OrgServiceActor
-  ) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const keys = await listOCIVaultKeys(appConnection, compartmentOcid, vaultOcid);
-      return keys;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  return {
-    listCompartments,
-    listVaults,
-    listVaultKeys
-  };
-};

backend/src/services/app-connection/oci/oci-connection-types.ts

@@ -1,22 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  CreateOCIConnectionSchema,
-  OCIConnectionSchema,
-  ValidateOCIConnectionCredentialsSchema
-} from "./oci-connection-schemas";
-
-export type TOCIConnection = z.infer<typeof OCIConnectionSchema>;
-
-export type TOCIConnectionInput = z.infer<typeof CreateOCIConnectionSchema> & {
-  app: AppConnection.OCI;
-};
-
-export type TValidateOCIConnectionCredentialsSchema = typeof ValidateOCIConnectionCredentialsSchema;
-
-export type TOCIConnectionConfig = DiscriminativePick<TOCIConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -26,3 +26,8 @@ export enum SecretSyncImportBehavior {
   PrioritizeSource = "prioritize-source",
   PrioritizeDestination = "prioritize-destination"
 }
+
+export enum SecretSyncPlanType {
+  Enterprise = "enterprise",
+  Regular = "regular"
+}

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -1,5 +1,5 @@
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { SecretSync, SecretSyncPlanType } from "@app/services/secret-sync/secret-sync-enums";
 
 export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.AWSParameterStore]: "AWS Parameter Store",
@@ -36,3 +36,21 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.TeamCity]: AppConnection.TeamCity,
   [SecretSync.OCIVault]: AppConnection.OCI
 };
+
+export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
+  [SecretSync.AWSParameterStore]: SecretSyncPlanType.Regular,
+  [SecretSync.AWSSecretsManager]: SecretSyncPlanType.Regular,
+  [SecretSync.GitHub]: SecretSyncPlanType.Regular,
+  [SecretSync.GCPSecretManager]: SecretSyncPlanType.Regular,
+  [SecretSync.AzureKeyVault]: SecretSyncPlanType.Regular,
+  [SecretSync.AzureAppConfiguration]: SecretSyncPlanType.Regular,
+  [SecretSync.Databricks]: SecretSyncPlanType.Regular,
+  [SecretSync.Humanitec]: SecretSyncPlanType.Regular,
+  [SecretSync.TerraformCloud]: SecretSyncPlanType.Regular,
+  [SecretSync.Camunda]: SecretSyncPlanType.Regular,
+  [SecretSync.Vercel]: SecretSyncPlanType.Regular,
+  [SecretSync.Windmill]: SecretSyncPlanType.Regular,
+  [SecretSync.HCVault]: SecretSyncPlanType.Regular,
+  [SecretSync.TeamCity]: SecretSyncPlanType.Regular,
+  [SecretSync.OCIVault]: SecretSyncPlanType.Enterprise
+};

backend/src/services/secret-sync/secret-sync-queue.ts

@@ -5,8 +5,10 @@ import { Job } from "bullmq";
 import { ProjectMembershipRole, SecretType } from "@app/db/schemas";
 import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
+import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { decryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
@@ -29,11 +31,12 @@ import { TSecretSyncDALFactory } from "@app/services/secret-sync/secret-sync-dal
 import {
   SecretSync,
   SecretSyncImportBehavior,
-  SecretSyncInitialSyncBehavior
+  SecretSyncInitialSyncBehavior,
+  SecretSyncPlanType
 } from "@app/services/secret-sync/secret-sync-enums";
 import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
 import { parseSyncErrorMessage, SecretSyncFns } from "@app/services/secret-sync/secret-sync-fns";
-import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
+import { SECRET_SYNC_NAME_MAP, SECRET_SYNC_PLAN_MAP } from "@app/services/secret-sync/secret-sync-maps";
 import {
   SecretSyncAction,
   SecretSyncStatus,
@@ -93,6 +96,7 @@ type TSecretSyncQueueFactoryDep = {
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 type SecretSyncActionJob = Job<
@@ -133,7 +137,8 @@ export const secretSyncQueueFactory = ({
   secretVersionTagDAL,
   secretVersionV2BridgeDAL,
   secretVersionTagV2BridgeDAL,
-  resourceMetadataDAL
+  resourceMetadataDAL,
+  licenseService
 }: TSecretSyncQueueFactoryDep) => {
   const appCfg = getConfig();
 
@@ -323,7 +328,22 @@ export const secretSyncQueueFactory = ({
     secretSync: TSecretSyncWithCredentials,
     importBehavior: SecretSyncImportBehavior
   ): Promise<TSecretMap> => {
-    const { projectId, environment, folder } = secretSync;
+    const {
+      projectId,
+      environment,
+      folder,
+      destination,
+      connection: { orgId }
+    } = secretSync;
+
+    // Enterprise Check
+    if (SECRET_SYNC_PLAN_MAP[destination] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message: "Failed to import secrets due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
 
     if (!environment || !folder)
       throw new Error(
@@ -400,6 +420,15 @@ export const secretSyncQueueFactory = ({
 
     if (!secretSync) throw new Error(`Cannot find secret sync with ID ${syncId}`);
 
+    // Enterprise Check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(secretSync.connection.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message: "Failed to sync secrets due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     await secretSyncDAL.updateById(syncId, {
       syncStatus: SecretSyncStatus.Running
     });
@@ -659,6 +688,16 @@ export const secretSyncQueueFactory = ({
 
     if (!secretSync) throw new Error(`Cannot find secret sync with ID ${syncId}`);
 
+    // Enterprise Check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(secretSync.connection.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to access secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     await secretSyncDAL.updateById(syncId, {
       removeStatus: SecretSyncStatus.Running
     });

backend/src/services/secret-sync/secret-sync-service.ts

@@ -1,6 +1,7 @@
 import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { throwIfMissingSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
@@ -15,7 +16,7 @@ import { OrgServiceActor } from "@app/lib/types";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { SecretSync, SecretSyncPlanType } from "@app/services/secret-sync/secret-sync-enums";
 import { listSecretSyncOptions } from "@app/services/secret-sync/secret-sync-fns";
 import {
   SecretSyncStatus,
@@ -34,7 +35,7 @@ import {
 
 import { TSecretImportDALFactory } from "../secret-import/secret-import-dal";
 import { TSecretSyncDALFactory } from "./secret-sync-dal";
-import { SECRET_SYNC_CONNECTION_MAP, SECRET_SYNC_NAME_MAP } from "./secret-sync-maps";
+import { SECRET_SYNC_CONNECTION_MAP, SECRET_SYNC_NAME_MAP, SECRET_SYNC_PLAN_MAP } from "./secret-sync-maps";
 import { TSecretSyncQueueFactory } from "./secret-sync-queue";
 
 type TSecretSyncServiceFactoryDep = {
@@ -49,6 +50,7 @@ type TSecretSyncServiceFactoryDep = {
     TSecretSyncQueueFactory,
     "queueSecretSyncSyncSecretsById" | "queueSecretSyncImportSecretsById" | "queueSecretSyncRemoveSecretsById"
   >;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TSecretSyncServiceFactory = ReturnType<typeof secretSyncServiceFactory>;
@@ -61,7 +63,8 @@ export const secretSyncServiceFactory = ({
   appConnectionService,
   projectBotService,
   secretSyncQueue,
-  keyStore
+  keyStore,
+  licenseService
 }: TSecretSyncServiceFactoryDep) => {
   const listSecretSyncsByProjectId = async (
     { projectId, destination }: TListSecretSyncsByProjectId,
@@ -191,6 +194,16 @@ export const secretSyncServiceFactory = ({
     { projectId, secretPath, environment, ...params }: TCreateSecretSyncDTO,
     actor: OrgServiceActor
   ) => {
+    // Enterprise check
+    if (SECRET_SYNC_PLAN_MAP[params.destination] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to create secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     const { permission: projectPermission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorId: actor.id,
@@ -260,6 +273,16 @@ export const secretSyncServiceFactory = ({
         message: `Could not find ${SECRET_SYNC_NAME_MAP[destination]} Sync with ID ${syncId}`
       });
 
+    // Enterprise check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to update secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorId: actor.id,
@@ -408,6 +431,16 @@ export const secretSyncServiceFactory = ({
         message: `Could not find ${SECRET_SYNC_NAME_MAP[destination]} Sync with ID "${syncId}"`
       });
 
+    // Enterprise check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to trigger secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorId: actor.id,
@@ -463,6 +496,16 @@ export const secretSyncServiceFactory = ({
         message: `Could not find ${SECRET_SYNC_NAME_MAP[destination]} Sync with ID "${syncId}"`
       });
 
+    // Enterprise check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to trigger secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorId: actor.id,
@@ -512,6 +555,16 @@ export const secretSyncServiceFactory = ({
         message: `Could not find ${SECRET_SYNC_NAME_MAP[destination]} Sync with ID "${syncId}"`
       });
 
+    // Enterprise check
+    if (SECRET_SYNC_PLAN_MAP[secretSync.destination as SecretSync] === SecretSyncPlanType.Enterprise) {
+      const plan = await licenseService.getPlan(actor.orgId);
+      if (!plan.enterpriseSecretSyncs)
+        throw new BadRequestError({
+          message:
+            "Failed to trigger secret sync due to plan restriction. Upgrade plan to access enterprise secret syncs."
+        });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorId: actor.id,