Merge pull request #4784 from Infisical/feat/chef-data-bag-app-connection-secret-sync

[ENG-4034] feat: Adds chef data bag app connection and secret sync

backend/src/lib/api-docs/constants.ts

@@ -2379,6 +2379,12 @@ export const AppConnections = {
     },
     LARAVEL_FORGE: {
       apiToken: "The API token used to authenticate with Laravel Forge."
+    },
+    CHEF: {
+      serverUrl: "The URL of the Chef server to connect to.",
+      orgName: "The short name of the Chef organization to connect to.",
+      userName: "The username used to access Chef.",
+      privateKey: "The private key used to access Chef."
     }
   }
 };
@@ -2624,6 +2630,10 @@ export const SecretSyncs = {
       siteId: "The ID of the Netlify site to sync secrets to.",
       context: "The Netlify context to sync secrets to."
     },
+    CHEF: {
+      dataBagName: "The name of the Chef data bag to sync secrets to.",
+      dataBagItemName: "The name of the Chef data bag item to sync secrets to."
+    },
     NORTHFLANK: {
       projectId: "The ID of the Northflank project to sync secrets to.",
       projectName: "The name of the Northflank project to sync secrets to.",

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -48,6 +48,7 @@ import {
   ChecklyConnectionListItemSchema,
   SanitizedChecklyConnectionSchema
 } from "@app/services/app-connection/checkly";
+import { ChefConnectionListItemSchema, SanitizedChefConnectionSchema } from "@app/services/app-connection/chef";
 import {
   CloudflareConnectionListItemSchema,
   SanitizedCloudflareConnectionSchema
@@ -168,7 +169,8 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedOktaConnectionSchema.options,
   ...SanitizedAzureADCSConnectionSchema.options,
   ...SanitizedRedisConnectionSchema.options,
-  ...SanitizedLaravelForgeConnectionSchema.options
+  ...SanitizedLaravelForgeConnectionSchema.options,
+  ...SanitizedChefConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -212,7 +214,8 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   OktaConnectionListItemSchema,
   AzureADCSConnectionListItemSchema,
   RedisConnectionListItemSchema,
-  LaravelForgeConnectionListItemSchema
+  LaravelForgeConnectionListItemSchema,
+  ChefConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/chef-connection-router.ts

@@ -0,0 +1,85 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateChefConnectionSchema,
+  SanitizedChefConnectionSchema,
+  UpdateChefConnectionSchema
+} from "@app/services/app-connection/chef";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerChefConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.Chef,
+    server,
+    sanitizedResponseSchema: SanitizedChefConnectionSchema,
+    createSchema: CreateChefConnectionSchema,
+    updateSchema: UpdateChefConnectionSchema
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/data-bags`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const dataBags = await server.services.appConnection.chef.listDataBags(connectionId, req.permission);
+
+      return dataBags;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/data-bag-items`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      querystring: z.object({
+        dataBagName: z.string()
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const { dataBagName } = req.query;
+      const dataBagItems = await server.services.appConnection.chef.listDataBagItems(
+        connectionId,
+        dataBagName,
+        req.permission
+      );
+
+      return dataBagItems;
+    }
+  });
+};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -13,6 +13,7 @@ import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connect
 import { registerBitbucketConnectionRouter } from "./bitbucket-connection-router";
 import { registerCamundaConnectionRouter } from "./camunda-connection-router";
 import { registerChecklyConnectionRouter } from "./checkly-connection-router";
+import { registerChefConnectionRouter } from "./chef-connection-router";
 import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
 import { registerDigitalOceanConnectionRouter } from "./digital-ocean-connection-router";
@@ -86,5 +87,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.Netlify]: registerNetlifyConnectionRouter,
     [AppConnection.Northflank]: registerNorthflankConnectionRouter,
     [AppConnection.Okta]: registerOktaConnectionRouter,
-    [AppConnection.Redis]: registerRedisConnectionRouter
+    [AppConnection.Redis]: registerRedisConnectionRouter,
+    [AppConnection.Chef]: registerChefConnectionRouter
   };

backend/src/server/routes/v1/secret-sync-routers/chef-sync-router.ts

@@ -0,0 +1,13 @@
+import { ChefSyncSchema, CreateChefSyncSchema, UpdateChefSyncSchema } from "@app/services/secret-sync/chef";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+
+import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
+
+export const registerChefSyncRouter = async (server: FastifyZodProvider) =>
+  registerSyncSecretsEndpoints({
+    destination: SecretSync.Chef,
+    server,
+    responseSchema: ChefSyncSchema,
+    createSchema: CreateChefSyncSchema,
+    updateSchema: UpdateChefSyncSchema
+  });

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -10,6 +10,7 @@ import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
 import { registerBitbucketSyncRouter } from "./bitbucket-sync-router";
 import { registerCamundaSyncRouter } from "./camunda-sync-router";
 import { registerChecklySyncRouter } from "./checkly-sync-router";
+import { registerChefSyncRouter } from "./chef-sync-router";
 import { registerCloudflarePagesSyncRouter } from "./cloudflare-pages-sync-router";
 import { registerCloudflareWorkersSyncRouter } from "./cloudflare-workers-sync-router";
 import { registerDatabricksSyncRouter } from "./databricks-sync-router";
@@ -67,5 +68,6 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
   [SecretSync.Netlify]: registerNetlifySyncRouter,
   [SecretSync.Northflank]: registerNorthflankSyncRouter,
   [SecretSync.Bitbucket]: registerBitbucketSyncRouter,
-  [SecretSync.LaravelForge]: registerLaravelForgeSyncRouter
+  [SecretSync.LaravelForge]: registerLaravelForgeSyncRouter,
+  [SecretSync.Chef]: registerChefSyncRouter
 };

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -24,6 +24,7 @@ import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/s
 import { BitbucketSyncListItemSchema, BitbucketSyncSchema } from "@app/services/secret-sync/bitbucket";
 import { CamundaSyncListItemSchema, CamundaSyncSchema } from "@app/services/secret-sync/camunda";
 import { ChecklySyncListItemSchema, ChecklySyncSchema } from "@app/services/secret-sync/checkly/checkly-sync-schemas";
+import { ChefSyncListItemSchema, ChefSyncSchema } from "@app/services/secret-sync/chef";
 import {
   CloudflarePagesSyncListItemSchema,
   CloudflarePagesSyncSchema
@@ -88,7 +89,8 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
   NetlifySyncSchema,
   NorthflankSyncSchema,
   BitbucketSyncSchema,
-  LaravelForgeSyncSchema
+  LaravelForgeSyncSchema,
+  ChefSyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
@@ -123,7 +125,8 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   NetlifySyncListItemSchema,
   NorthflankSyncListItemSchema,
   BitbucketSyncListItemSchema,
-  LaravelForgeSyncListItemSchema
+  LaravelForgeSyncListItemSchema,
+  ChefSyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {

backend/src/services/app-connection/app-connection-enums.ts

@@ -39,6 +39,7 @@ export enum AppConnection {
   Okta = "okta",
   Redis = "redis",
   LaravelForge = "laravel-forge",
+  Chef = "chef",
   Northflank = "northflank"
 }
 

backend/src/services/app-connection/app-connection-fns.ts

@@ -68,6 +68,7 @@ import {
 } from "./bitbucket";
 import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
 import { ChecklyConnectionMethod, getChecklyConnectionListItem, validateChecklyConnectionCredentials } from "./checkly";
+import { ChefConnectionMethod, getChefConnectionListItem, validateChefConnectionCredentials } from "./chef";
 import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
 import {
   getCloudflareConnectionListItem,
@@ -210,7 +211,8 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getNetlifyConnectionListItem(),
     getNorthflankConnectionListItem(),
     getOktaConnectionListItem(),
-    getRedisConnectionListItem()
+    getRedisConnectionListItem(),
+    getChefConnectionListItem()
   ]
     .filter((option) => {
       switch (projectType) {
@@ -341,6 +343,7 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Northflank]: validateNorthflankConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Chef]: validateChefConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
@@ -409,6 +412,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case RenderConnectionMethod.ApiKey:
     case ChecklyConnectionMethod.ApiKey:
       return "API Key";
+    case ChefConnectionMethod.UserKey:
+      return "User Key";
     case SupabaseConnectionMethod.AccessToken:
       return "Access Token";
     default:
@@ -483,7 +488,8 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Northflank]: platformManagedCredentialsNotSupported,
   [AppConnection.Okta]: platformManagedCredentialsNotSupported,
   [AppConnection.Redis]: platformManagedCredentialsNotSupported,
-  [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported
+  [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported,
+  [AppConnection.Chef]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (

backend/src/services/app-connection/app-connection-maps.ts

@@ -41,6 +41,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.Netlify]: "Netlify",
   [AppConnection.Okta]: "Okta",
   [AppConnection.Redis]: "Redis",
+  [AppConnection.Chef]: "Chef",
   [AppConnection.Northflank]: "Northflank"
 };
 
@@ -85,5 +86,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.Netlify]: AppConnectionPlanType.Regular,
   [AppConnection.Okta]: AppConnectionPlanType.Regular,
   [AppConnection.Redis]: AppConnectionPlanType.Regular,
+  [AppConnection.Chef]: AppConnectionPlanType.Regular,
   [AppConnection.Northflank]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -67,6 +67,8 @@ import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
 import { ValidateChecklyConnectionCredentialsSchema } from "./checkly";
 import { checklyConnectionService } from "./checkly/checkly-connection-service";
+import { ValidateChefConnectionCredentialsSchema } from "./chef";
+import { chefConnectionService } from "./chef/chef-connection-service";
 import { ValidateCloudflareConnectionCredentialsSchema } from "./cloudflare/cloudflare-connection-schema";
 import { cloudflareConnectionService } from "./cloudflare/cloudflare-connection-service";
 import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
@@ -174,7 +176,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
   [AppConnection.Northflank]: ValidateNorthflankConnectionCredentialsSchema,
   [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
-  [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema
+  [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema,
+  [AppConnection.Chef]: ValidateChefConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -881,6 +884,7 @@ export const appConnectionServiceFactory = ({
     netlify: netlifyConnectionService(connectAppConnectionById),
     northflank: northflankConnectionService(connectAppConnectionById),
     okta: oktaConnectionService(connectAppConnectionById),
-    laravelForge: laravelForgeConnectionService(connectAppConnectionById)
+    laravelForge: laravelForgeConnectionService(connectAppConnectionById),
+    chef: chefConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -82,6 +82,12 @@ import {
   TChecklyConnectionInput,
   TValidateChecklyConnectionCredentialsSchema
 } from "./checkly";
+import {
+  TChefConnection,
+  TChefConnectionConfig,
+  TChefConnectionInput,
+  TValidateChefConnectionCredentialsSchema
+} from "./chef";
 import {
   TCloudflareConnection,
   TCloudflareConnectionConfig,
@@ -282,6 +288,7 @@ export type TAppConnection = { id: string } & (
   | TNorthflankConnection
   | TOktaConnection
   | TRedisConnection
+  | TChefConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -330,6 +337,7 @@ export type TAppConnectionInput = { id: string } & (
   | TNorthflankConnectionInput
   | TOktaConnectionInput
   | TRedisConnectionInput
+  | TChefConnectionInput
 );
 
 export type TSqlConnectionInput =
@@ -395,7 +403,8 @@ export type TAppConnectionConfig =
   | TNetlifyConnectionConfig
   | TNorthflankConnectionConfig
   | TOktaConnectionConfig
-  | TRedisConnectionConfig;
+  | TRedisConnectionConfig
+  | TChefConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -438,7 +447,8 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateNetlifyConnectionCredentialsSchema
   | TValidateNorthflankConnectionCredentialsSchema
   | TValidateOktaConnectionCredentialsSchema
-  | TValidateRedisConnectionCredentialsSchema;
+  | TValidateRedisConnectionCredentialsSchema
+  | TValidateChefConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/chef/chef-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum ChefConnectionMethod {
+  UserKey = "user-key"
+}

backend/src/services/app-connection/chef/chef-connection-fns.ts

@@ -0,0 +1,288 @@
+import { AxiosError } from "axios";
+import crypto from "crypto";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { removeTrailingSlash } from "@app/lib/fn";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { TChefDataBagItemContent } from "../../secret-sync/chef/chef-sync-types";
+import { AppConnection } from "../app-connection-enums";
+import { ChefConnectionMethod } from "./chef-connection-enums";
+import {
+  TChefConnection,
+  TChefConnectionConfig,
+  TChefDataBag,
+  TChefDataBagItem,
+  TGetChefDataBagItem,
+  TUpdateChefDataBagItem
+} from "./chef-connection-types";
+
+export const getChefServerUrl = async (serverUrl?: string) => {
+  const chefServerUrl = serverUrl ? removeTrailingSlash(serverUrl) : IntegrationUrls.CHEF_API_URL;
+
+  await blockLocalAndPrivateIpAddresses(chefServerUrl);
+
+  return chefServerUrl;
+};
+
+// Helper to ensure private key is in proper PEM format
+const formatPrivateKey = (key: string): string => {
+  let formattedKey = key.trim();
+
+  // Ensure proper line breaks in PEM format (handle escaped newlines)
+  formattedKey = formattedKey.replace(/\\n/g, "\n");
+
+  // Remove any extra whitespace between lines
+  formattedKey = formattedKey.replace(/\n\s+/g, "\n");
+
+  // If key doesn't have headers, add PKCS#1 RSA headers
+  if (!formattedKey.includes("BEGIN")) {
+    formattedKey = `-----BEGIN RSA PRIVATE KEY-----\n${formattedKey}\n-----END RSA PRIVATE KEY-----`;
+  }
+
+  // Ensure the key has proper line breaks after headers and before footers
+  formattedKey = formattedKey.replace(/(-----BEGIN[^-]+-----)\s*/g, "$1\n").replace(/\s*(-----END[^-]+-----)/g, "\n$1");
+
+  // Remove any duplicate newlines
+  formattedKey = formattedKey.replace(/\n{3,}/g, "\n\n");
+
+  return formattedKey;
+};
+
+const getChefAuthHeaders = (
+  method: string,
+  path: string,
+  body: string,
+  userId: string,
+  privateKey: string,
+  apiVersion: "1.0" | "1.3" = "1.3"
+) => {
+  const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, "Z"); // Remove milliseconds from timestamp
+
+  // Calculate content hash based on version
+  let contentHash: string;
+  if (apiVersion === "1.3") {
+    contentHash = crypto.createHash("sha256").update(body).digest("base64");
+  } else {
+    contentHash = crypto.createHash("sha1").update(body).digest("base64");
+  }
+
+  // Build canonical request based on version
+  let canonicalRequest: string;
+  if (apiVersion === "1.3") {
+    canonicalRequest = [
+      `Method:${method}`,
+      `Path:${path}`,
+      `X-Ops-Content-Hash:${contentHash}`,
+      "X-Ops-Sign:version=1.3",
+      `X-Ops-Timestamp:${timestamp}`,
+      `X-Ops-UserId:${userId}`,
+      "X-Ops-Server-API-Version:1"
+    ].join("\n");
+  } else {
+    const hashedPath = crypto.createHash("sha1").update(path).digest("base64");
+    canonicalRequest = [
+      `Method:${method}`,
+      `Hashed Path:${hashedPath}`,
+      `X-Ops-Content-Hash:${contentHash}`,
+      `X-Ops-Timestamp:${timestamp}`,
+      `X-Ops-UserId:${userId}`
+    ].join("\n");
+  }
+
+  // Format the private key properly
+  const formattedKey = formatPrivateKey(privateKey);
+
+  // Sign the canonical request
+  const sign = crypto.createSign(apiVersion === "1.3" ? "RSA-SHA256" : "RSA-SHA1");
+  sign.update(canonicalRequest);
+  const signature = sign.sign(formattedKey, "base64");
+
+  // Split signature into 60-character chunks
+  const authHeaders: Record<string, string> = {};
+  const signatureLines = signature.match(/.{1,60}/g) || [];
+  signatureLines.forEach((line, index) => {
+    authHeaders[`X-Ops-Authorization-${index + 1}`] = line;
+  });
+
+  return {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+    "X-Chef-Version": "14.0.0",
+    "X-Ops-Timestamp": timestamp,
+    "X-Ops-UserId": userId,
+    "X-Ops-Sign": apiVersion === "1.3" ? "version=1.3" : "algorithm=sha1;version=1.0",
+    "X-Ops-Content-Hash": contentHash,
+    ...(apiVersion === "1.3" && { "X-Ops-Server-API-Version": "1" }),
+    ...authHeaders
+  };
+};
+
+export const getChefConnectionListItem = () => {
+  return {
+    name: "Chef" as const,
+    app: AppConnection.Chef as const,
+    methods: Object.values(ChefConnectionMethod) as [ChefConnectionMethod.UserKey]
+  };
+};
+
+export const validateChefConnectionCredentials = async (config: TChefConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  try {
+    const path = `/organizations/${inputCredentials.orgName}/users/${inputCredentials.userName}`;
+
+    const hostServerUrl = await getChefServerUrl(inputCredentials.serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, "", inputCredentials.userName, inputCredentials.privateKey);
+
+    await request.get(`${hostServerUrl}${path}`, {
+      headers
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate Chef credentials: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate Chef connection: verify credentials"
+    });
+  }
+
+  return inputCredentials;
+};
+
+export const listChefDataBags = async (appConnection: TChefConnection): Promise<TChefDataBag[]> => {
+  const {
+    credentials: { serverUrl, userName, privateKey, orgName }
+  } = appConnection;
+
+  try {
+    const path = `/organizations/${orgName}/data`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<Record<string, string>>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return Object.keys(res.data).map((name) => ({
+      name
+    }));
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Chef data bags: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list Chef data bags"
+    });
+  }
+};
+
+export const listChefDataBagItems = async (
+  appConnection: TChefConnection,
+  dataBagName: string
+): Promise<TChefDataBagItem[]> => {
+  const {
+    credentials: { serverUrl, userName, privateKey, orgName }
+  } = appConnection;
+
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<Record<string, string>>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return Object.keys(res.data).map((name) => ({
+      name
+    }));
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Chef data bag items: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list Chef data bag items"
+    });
+  }
+};
+
+export const getChefDataBagItem = async ({
+  serverUrl,
+  userName,
+  privateKey,
+  orgName,
+  dataBagName,
+  dataBagItemName
+}: TGetChefDataBagItem): Promise<TChefDataBagItemContent> => {
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}/${dataBagItemName}`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<TChefDataBagItemContent>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return res.data;
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to get Chef data bag item: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to get Chef data bag item"
+    });
+  }
+};
+
+export const updateChefDataBagItem = async ({
+  serverUrl,
+  userName,
+  privateKey,
+  orgName,
+  dataBagName,
+  dataBagItemName,
+  data
+}: TUpdateChefDataBagItem): Promise<void> => {
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}/${dataBagItemName}`;
+    const body = JSON.stringify(data);
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("PUT", path, body, userName, privateKey);
+
+    await request.put(`${hostServerUrl}${path}`, data, {
+      headers
+    });
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to update Chef data bag item: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to update Chef data bag item"
+    });
+  }
+};

backend/src/services/app-connection/chef/chef-connection-schemas.ts

@@ -0,0 +1,77 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { ChefConnectionMethod } from "./chef-connection-enums";
+
+export const ChefConnectionUserKeyCredentialsSchema = z.object({
+  serverUrl: z
+    .string()
+    .trim()
+    .url("Valid Chef Server URL required")
+    .optional()
+    .describe(AppConnections.CREDENTIALS.CHEF.serverUrl),
+  orgName: z
+    .string()
+    .trim()
+    .min(1, "Organization name required")
+    .max(256, "Organization name cannot exceed 256 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.orgName),
+  userName: z
+    .string()
+    .trim()
+    .min(1, "User name required")
+    .max(256, "User name cannot exceed 256 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.userName),
+  privateKey: z
+    .string()
+    .trim()
+    .min(1, "Private key required")
+    .max(16384, "Private key cannot exceed 16384 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.privateKey)
+});
+
+const BaseChefConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Chef) });
+
+export const ChefConnectionSchema = BaseChefConnectionSchema.extend({
+  method: z.literal(ChefConnectionMethod.UserKey),
+  credentials: ChefConnectionUserKeyCredentialsSchema
+});
+
+export const SanitizedChefConnectionSchema = z.discriminatedUnion("method", [
+  BaseChefConnectionSchema.extend({
+    method: z.literal(ChefConnectionMethod.UserKey),
+    credentials: ChefConnectionUserKeyCredentialsSchema.pick({ serverUrl: true, orgName: true, userName: true })
+  })
+]);
+
+export const ValidateChefConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(ChefConnectionMethod.UserKey).describe(AppConnections.CREATE(AppConnection.Chef).method),
+    credentials: ChefConnectionUserKeyCredentialsSchema.describe(AppConnections.CREATE(AppConnection.Chef).credentials)
+  })
+]);
+
+export const CreateChefConnectionSchema = ValidateChefConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Chef)
+);
+
+export const UpdateChefConnectionSchema = z
+  .object({
+    credentials: ChefConnectionUserKeyCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Chef).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Chef));
+
+export const ChefConnectionListItemSchema = z.object({
+  name: z.literal("Chef"),
+  app: z.literal(AppConnection.Chef),
+  methods: z.nativeEnum(ChefConnectionMethod).array()
+});

backend/src/services/app-connection/chef/chef-connection-service.ts

@@ -0,0 +1,39 @@
+import { ForbiddenRequestError } from "@app/lib/errors";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listChefDataBagItems, listChefDataBags } from "./chef-connection-fns";
+import { TChefConnection } from "./chef-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TChefConnection>;
+
+export const chefConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listDataBags = async (appConnectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
+
+    if (!appConnection) {
+      throw new ForbiddenRequestError({ message: "App connection not found" });
+    }
+
+    return listChefDataBags(appConnection);
+  };
+
+  const listDataBagItems = async (appConnectionId: string, dataBagName: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
+
+    if (!appConnection) {
+      throw new ForbiddenRequestError({ message: "App connection not found" });
+    }
+
+    return listChefDataBagItems(appConnection, dataBagName);
+  };
+
+  return {
+    listDataBags,
+    listDataBagItems
+  };
+};

backend/src/services/app-connection/chef/chef-connection-types.ts

@@ -0,0 +1,50 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+import { TChefDataBagItemContent } from "@app/services/secret-sync/chef";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  ChefConnectionSchema,
+  CreateChefConnectionSchema,
+  ValidateChefConnectionCredentialsSchema
+} from "./chef-connection-schemas";
+
+export type TChefConnection = z.infer<typeof ChefConnectionSchema>;
+
+export type TChefConnectionInput = z.infer<typeof CreateChefConnectionSchema> & {
+  app: AppConnection.Chef;
+};
+
+export type TValidateChefConnectionCredentialsSchema = typeof ValidateChefConnectionCredentialsSchema;
+
+export type TChefConnectionConfig = DiscriminativePick<TChefConnectionInput, "method" | "app" | "credentials"> & {
+  orgName: string;
+};
+
+export type TChefDataBag = {
+  name: string;
+};
+
+export type TChefDataBagItem = {
+  name: string;
+};
+
+export type TGetChefDataBagItem = {
+  serverUrl?: string;
+  userName: string;
+  privateKey: string;
+  orgName: string;
+  dataBagName: string;
+  dataBagItemName: string;
+};
+
+export type TUpdateChefDataBagItem = {
+  serverUrl?: string;
+  userName: string;
+  privateKey: string;
+  orgName: string;
+  dataBagName: string;
+  dataBagItemName: string;
+  data: TChefDataBagItemContent;
+};

backend/src/services/app-connection/chef/index.ts

@@ -0,0 +1,4 @@
+export * from "./chef-connection-enums";
+export * from "./chef-connection-fns";
+export * from "./chef-connection-schemas";
+export * from "./chef-connection-types";

backend/src/services/integration-auth/integration-list.ts

@@ -104,7 +104,8 @@ export enum IntegrationUrls {
   GCP_SERVICE_USAGE_URL = "https://serviceusage.googleapis.com",
   GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform",
 
-  GITHUB_USER_INSTALLATIONS = "https://api.github.com/user/installations"
+  GITHUB_USER_INSTALLATIONS = "https://api.github.com/user/installations",
+  CHEF_API_URL = "https://api.chef.io"
 }
 
 export const getIntegrationOptions = async () => {

backend/src/services/secret-sync/chef/chef-sync-constants.ts

@@ -0,0 +1,10 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const CHEF_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Chef",
+  destination: SecretSync.Chef,
+  connection: AppConnection.Chef,
+  canImportSecrets: true
+};

backend/src/services/secret-sync/chef/chef-sync-fns.ts

@@ -0,0 +1,151 @@
+import { getChefDataBagItem, updateChefDataBagItem } from "@app/services/app-connection/chef";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import {
+  ChefSecret,
+  TChefDataBagItemContent,
+  TChefSecret,
+  TChefSecrets,
+  TChefSyncWithCredentials,
+  TGetChefSecrets
+} from "./chef-sync-types";
+
+const getChefSecretsRaw = async ({
+  serverUrl,
+  userName,
+  privateKey,
+  orgName,
+  dataBagName,
+  dataBagItemName
+}: TGetChefSecrets): Promise<TChefDataBagItemContent> => {
+  const dataBagItem = await getChefDataBagItem({
+    serverUrl,
+    userName,
+    privateKey,
+    orgName,
+    dataBagName,
+    dataBagItemName
+  });
+
+  // Ensure the data bag item has an id field
+  if (!dataBagItem.id) {
+    dataBagItem.id = dataBagItemName;
+  }
+
+  return dataBagItem;
+};
+
+const getChefSecrets = async (secretSync: TChefSyncWithCredentials): Promise<TChefSecrets> => {
+  const {
+    connection,
+    destinationConfig: { dataBagName, dataBagItemName }
+  } = secretSync;
+
+  const { serverUrl, userName, privateKey, orgName } = connection.credentials;
+
+  const dataBagItem = await getChefSecretsRaw({
+    serverUrl,
+    orgName,
+    userName,
+    privateKey,
+    dataBagName,
+    dataBagItemName
+  });
+
+  const { id, ...existingSecrets } = dataBagItem;
+
+  // Convert data bag item to key-value pairs
+  const secrets: ChefSecret[] = [];
+  Object.entries(existingSecrets).forEach(([key, value]) => {
+    if (key !== "id" && value !== null && value !== undefined) {
+      secrets.push({ key, value: String(value) });
+    }
+  });
+
+  return { id, secrets };
+};
+
+const updateChefSecrets = async (
+  secretSync: TChefSyncWithCredentials,
+  id: string,
+  secrets: Record<string, TChefSecret>
+) => {
+  const {
+    connection,
+    destinationConfig: { dataBagName, dataBagItemName }
+  } = secretSync;
+
+  const { serverUrl, userName, privateKey, orgName } = connection.credentials;
+
+  // Chef data bag items must have an 'id' field
+  const dataBagItemContent: TChefDataBagItemContent = {
+    id,
+    ...secrets
+  };
+
+  await updateChefDataBagItem({
+    serverUrl,
+    orgName,
+    userName,
+    privateKey,
+    dataBagName,
+    dataBagItemName,
+    data: dataBagItemContent
+  });
+};
+
+export const ChefSyncFns = {
+  async syncSecrets(secretSync: TChefSyncWithCredentials, secretMap: TSecretMap) {
+    const {
+      environment,
+      syncOptions: { disableSecretDeletion, keySchema }
+    } = secretSync;
+
+    const { id, secrets } = await getChefSecrets(secretSync);
+
+    // Create a map of the existing secrets
+    const updatedSecretsMap = new Map(secrets.map((secret) => [secret.key, secret.value]));
+
+    // Add/update new secrets
+    for (const [key, { value }] of Object.entries(secretMap)) {
+      updatedSecretsMap.set(key, value);
+    }
+
+    // Delete secrets if not disabled
+    if (!disableSecretDeletion) {
+      secrets.forEach((secret) => {
+        if (!matchesSchema(secret.key, environment?.slug || "", keySchema)) return;
+
+        if (!secretMap[secret.key]) {
+          updatedSecretsMap.delete(secret.key);
+        }
+      });
+    }
+
+    // Convert map to object for Chef API
+    const updatedSecrets = Object.fromEntries(updatedSecretsMap.entries());
+
+    await updateChefSecrets(secretSync, id, updatedSecrets);
+  },
+
+  async getSecrets(secretSync: TChefSyncWithCredentials): Promise<TSecretMap> {
+    const { secrets } = await getChefSecrets(secretSync);
+
+    return Object.fromEntries(secrets.map((secret) => [secret.key, { value: secret.value }]));
+  },
+
+  async removeSecrets(secretSync: TChefSyncWithCredentials, secretMap: TSecretMap) {
+    const { id, secrets: existingSecrets } = await getChefSecrets(secretSync);
+
+    const newSecrets = existingSecrets.filter((secret) => !Object.hasOwn(secretMap, secret.key));
+
+    if (newSecrets.length === existingSecrets.length) {
+      return;
+    }
+
+    const updatedSecrets = Object.fromEntries(newSecrets.map((secret) => [secret.key, secret.value]));
+
+    await updateChefSecrets(secretSync, id, updatedSecrets);
+  }
+};

backend/src/services/secret-sync/chef/chef-sync-schemas.ts

@@ -0,0 +1,46 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+const ChefSyncDestinationConfigSchema = z.object({
+  dataBagName: z
+    .string()
+    .min(1, "Data Bag Name is required")
+    .max(256, "Data Bag Name cannot exceed 256 characters")
+    .describe(SecretSyncs.DESTINATION_CONFIG.CHEF.dataBagName),
+  dataBagItemName: z
+    .string()
+    .min(1, "Data Bag Item Name is required")
+    .max(256, "Data Bag Item Name cannot exceed 256 characters")
+    .describe(SecretSyncs.DESTINATION_CONFIG.CHEF.dataBagItemName)
+});
+
+const ChefSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
+
+export const ChefSyncSchema = BaseSecretSyncSchema(SecretSync.Chef, ChefSyncOptionsConfig).extend({
+  destination: z.literal(SecretSync.Chef),
+  destinationConfig: ChefSyncDestinationConfigSchema
+});
+
+export const CreateChefSyncSchema = GenericCreateSecretSyncFieldsSchema(SecretSync.Chef, ChefSyncOptionsConfig).extend({
+  destinationConfig: ChefSyncDestinationConfigSchema
+});
+
+export const UpdateChefSyncSchema = GenericUpdateSecretSyncFieldsSchema(SecretSync.Chef, ChefSyncOptionsConfig).extend({
+  destinationConfig: ChefSyncDestinationConfigSchema.optional()
+});
+
+export const ChefSyncListItemSchema = z.object({
+  name: z.literal("Chef"),
+  connection: z.literal(AppConnection.Chef),
+  destination: z.literal(SecretSync.Chef),
+  canImportSecrets: z.literal(true)
+});

backend/src/services/secret-sync/chef/chef-sync-types.ts

@@ -0,0 +1,41 @@
+import z from "zod";
+
+import { TChefConnection } from "@app/services/app-connection/chef";
+
+import { ChefSyncListItemSchema, ChefSyncSchema, CreateChefSyncSchema } from "./chef-sync-schemas";
+
+export type TChefSyncListItem = z.infer<typeof ChefSyncListItemSchema>;
+
+export type TChefSync = z.infer<typeof ChefSyncSchema>;
+
+export type TChefSyncInput = z.infer<typeof CreateChefSyncSchema>;
+
+export type TChefSyncWithCredentials = TChefSync & {
+  connection: TChefConnection;
+};
+
+export type TGetChefSecrets = {
+  serverUrl?: string;
+  userName: string;
+  privateKey: string;
+  orgName: string;
+  dataBagName: string;
+  dataBagItemName: string;
+};
+
+export type TChefSecret = string | number | boolean | null;
+
+export type TChefDataBagItemContent = {
+  id: string;
+  [key: string]: TChefSecret;
+};
+
+export type TChefSecrets = {
+  id: string;
+  secrets: ChefSecret[];
+};
+
+export type ChefSecret = {
+  key: string;
+  value: string;
+};

backend/src/services/secret-sync/chef/index.ts

@@ -0,0 +1,4 @@
+export * from "./chef-sync-constants";
+export * from "./chef-sync-fns";
+export * from "./chef-sync-schemas";
+export * from "./chef-sync-types";

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -30,7 +30,8 @@ export enum SecretSync {
   Netlify = "netlify",
   Northflank = "northflank",
   Bitbucket = "bitbucket",
-  LaravelForge = "laravel-forge"
+  LaravelForge = "laravel-forge",
+  Chef = "chef"
 }
 
 export enum SecretSyncInitialSyncBehavior {

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -34,6 +34,7 @@ import { BITBUCKET_SYNC_LIST_OPTION, BitbucketSyncFns } from "./bitbucket";
 import { CAMUNDA_SYNC_LIST_OPTION, camundaSyncFactory } from "./camunda";
 import { CHECKLY_SYNC_LIST_OPTION } from "./checkly/checkly-sync-constants";
 import { ChecklySyncFns } from "./checkly/checkly-sync-fns";
+import { CHEF_SYNC_LIST_OPTION, ChefSyncFns } from "./chef";
 import { CLOUDFLARE_PAGES_SYNC_LIST_OPTION } from "./cloudflare-pages/cloudflare-pages-constants";
 import { CloudflarePagesSyncFns } from "./cloudflare-pages/cloudflare-pages-fns";
 import { CLOUDFLARE_WORKERS_SYNC_LIST_OPTION, CloudflareWorkersSyncFns } from "./cloudflare-workers";
@@ -49,8 +50,7 @@ import { HC_VAULT_SYNC_LIST_OPTION, HCVaultSyncFns } from "./hc-vault";
 import { HEROKU_SYNC_LIST_OPTION, HerokuSyncFns } from "./heroku";
 import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
-import { LARAVEL_FORGE_SYNC_LIST_OPTION } from "./laravel-forge";
-import { LaravelForgeSyncFns } from "./laravel-forge/laravel-forge-sync-fns";
+import { LARAVEL_FORGE_SYNC_LIST_OPTION, LaravelForgeSyncFns } from "./laravel-forge";
 import { NETLIFY_SYNC_LIST_OPTION, NetlifySyncFns } from "./netlify";
 import { NORTHFLANK_SYNC_LIST_OPTION, NorthflankSyncFns } from "./northflank";
 import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
@@ -96,7 +96,8 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.Netlify]: NETLIFY_SYNC_LIST_OPTION,
   [SecretSync.Northflank]: NORTHFLANK_SYNC_LIST_OPTION,
   [SecretSync.Bitbucket]: BITBUCKET_SYNC_LIST_OPTION,
-  [SecretSync.LaravelForge]: LARAVEL_FORGE_SYNC_LIST_OPTION
+  [SecretSync.LaravelForge]: LARAVEL_FORGE_SYNC_LIST_OPTION,
+  [SecretSync.Chef]: CHEF_SYNC_LIST_OPTION
 };
 
 export const listSecretSyncOptions = () => {
@@ -286,6 +287,8 @@ export const SecretSyncFns = {
         return BitbucketSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:
         return LaravelForgeSyncFns.syncSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Chef:
+        return ChefSyncFns.syncSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -408,6 +411,9 @@ export const SecretSyncFns = {
       case SecretSync.LaravelForge:
         secretMap = await LaravelForgeSyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Chef:
+        secretMap = await ChefSyncFns.getSecrets(secretSync);
+        break;
       default:
         throw new Error(
           `Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -505,6 +511,8 @@ export const SecretSyncFns = {
         return BitbucketSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:
         return LaravelForgeSyncFns.removeSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Chef:
+        return ChefSyncFns.removeSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -34,7 +34,8 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.Netlify]: "Netlify",
   [SecretSync.Northflank]: "Northflank",
   [SecretSync.Bitbucket]: "Bitbucket",
-  [SecretSync.LaravelForge]: "Laravel Forge"
+  [SecretSync.LaravelForge]: "Laravel Forge",
+  [SecretSync.Chef]: "Chef"
 };
 
 export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -69,7 +70,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.Netlify]: AppConnection.Netlify,
   [SecretSync.Northflank]: AppConnection.Northflank,
   [SecretSync.Bitbucket]: AppConnection.Bitbucket,
-  [SecretSync.LaravelForge]: AppConnection.LaravelForge
+  [SecretSync.LaravelForge]: AppConnection.LaravelForge,
+  [SecretSync.Chef]: AppConnection.Chef
 };
 
 export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
@@ -104,7 +106,8 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.Netlify]: SecretSyncPlanType.Regular,
   [SecretSync.Northflank]: SecretSyncPlanType.Regular,
   [SecretSync.Bitbucket]: SecretSyncPlanType.Regular,
-  [SecretSync.LaravelForge]: SecretSyncPlanType.Regular
+  [SecretSync.LaravelForge]: SecretSyncPlanType.Regular,
+  [SecretSync.Chef]: SecretSyncPlanType.Regular
 };
 
 export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
@@ -148,7 +151,8 @@ export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
   [SecretSync.Netlify]: ["accountName", "siteName"],
   [SecretSync.Northflank]: [],
   [SecretSync.Bitbucket]: [],
-  [SecretSync.LaravelForge]: []
+  [SecretSync.LaravelForge]: [],
+  [SecretSync.Chef]: []
 };
 
 const defaultDuplicateCheck: DestinationDuplicateCheckFn = () => true;
@@ -209,5 +213,6 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
   [SecretSync.Netlify]: defaultDuplicateCheck,
   [SecretSync.Northflank]: defaultDuplicateCheck,
   [SecretSync.Bitbucket]: defaultDuplicateCheck,
-  [SecretSync.LaravelForge]: defaultDuplicateCheck
+  [SecretSync.LaravelForge]: defaultDuplicateCheck,
+  [SecretSync.Chef]: defaultDuplicateCheck
 };

backend/src/services/secret-sync/secret-sync-types.ts

@@ -21,6 +21,7 @@ import {
   TCamundaSyncListItem,
   TCamundaSyncWithCredentials
 } from "@app/services/secret-sync/camunda";
+import { TChefSync, TChefSyncInput, TChefSyncListItem, TChefSyncWithCredentials } from "@app/services/secret-sync/chef";
 import {
   TDatabricksSync,
   TDatabricksSyncInput,
@@ -169,6 +170,7 @@ export type TSecretSync =
   | TGitHubSync
   | TGcpSync
   | TAzureKeyVaultSync
+  | TChefSync
   | TAzureAppConfigurationSync
   | TAzureDevOpsSync
   | TDatabricksSync
@@ -202,6 +204,7 @@ export type TSecretSyncWithCredentials =
   | TGitHubSyncWithCredentials
   | TGcpSyncWithCredentials
   | TAzureKeyVaultSyncWithCredentials
+  | TChefSyncWithCredentials
   | TAzureAppConfigurationSyncWithCredentials
   | TAzureDevOpsSyncWithCredentials
   | TDatabricksSyncWithCredentials
@@ -236,6 +239,7 @@ export type TSecretSyncInput =
   | TGitHubSyncInput
   | TGcpSyncInput
   | TAzureKeyVaultSyncInput
+  | TChefSyncInput
   | TAzureAppConfigurationSyncInput
   | TAzureDevOpsSyncInput
   | TDatabricksSyncInput
@@ -270,6 +274,7 @@ export type TSecretSyncListItem =
   | TGitHubSyncListItem
   | TGcpSyncListItem
   | TAzureKeyVaultSyncListItem
+  | TChefSyncListItem
   | TAzureAppConfigurationSyncListItem
   | TAzureDevOpsSyncListItem
   | TDatabricksSyncListItem