Merge branch 'main' into ENG-3723

frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx

@@ -64,7 +64,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
 
   const { currentProject } = useProject();
   const { data, isPending } = useListWorkspaceCertificates({
-    projectId: currentProject?.slug ?? "",
+    projectId: currentProject?.id ?? "",
     offset: (page - 1) * perPage,
     limit: perPage
   });

frontend/src/pages/cert-manager/IntegrationsListPage/IntegrationsListPage.tsx

@@ -0,0 +1,69 @@
+import { Helmet } from "react-helmet";
+import { useTranslation } from "react-i18next";
+import { useNavigate, useSearch } from "@tanstack/react-router";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { PageHeader, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { ProjectPermissionSub, useProject } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { IntegrationsListPageTabs } from "@app/types/integrations";
+
+import { PkiSyncsTab } from "./components";
+
+export const IntegrationsListPage = () => {
+  const navigate = useNavigate();
+  const { currentProject } = useProject();
+  const { t } = useTranslation();
+
+  const { selectedTab } = useSearch({
+    from: ROUTE_PATHS.CertManager.IntegrationsListPage.id
+  });
+
+  const currentTab = selectedTab || IntegrationsListPageTabs.PkiSyncs;
+
+  const updateSelectedTab = (tab: string) => {
+    navigate({
+      to: ROUTE_PATHS.CertManager.IntegrationsListPage.path,
+      search: {
+        selectedTab: tab as IntegrationsListPageTabs
+      },
+      params: {
+        projectId: currentProject?.id
+      }
+    });
+  };
+
+  return (
+    <>
+      <Helmet>
+        <title>{t("common.head-title", { title: t("integrations.title") })}</title>
+        <meta property="og:image" content="/images/message.png" />
+        <meta property="og:title" content="Manage your certificates in seconds" />
+        <meta name="og:description" content="Sync and manage PKI certificates across services" />
+      </Helmet>
+      <div className="container relative mx-auto max-w-7xl pb-12 text-white">
+        <div className="mb-8">
+          <PageHeader
+            title="Integrations"
+            description="Manage integrations with third-party certificate services."
+          />
+          <Tabs value={currentTab} onValueChange={updateSelectedTab}>
+            <TabList>
+              <Tab value={IntegrationsListPageTabs.PkiSyncs}>Certificate Syncs</Tab>
+            </TabList>
+            <TabPanel value={IntegrationsListPageTabs.PkiSyncs}>
+              <ProjectPermissionCan
+                renderGuardBanner
+                I={ProjectPermissionPkiSyncActions.Read}
+                a={ProjectPermissionSub.PkiSyncs}
+              >
+                <PkiSyncsTab />
+              </ProjectPermissionCan>
+            </TabPanel>
+          </Tabs>
+        </div>
+      </div>
+    </>
+  );
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncDestinationCol/PkiSyncDestinationCol.tsx

@@ -0,0 +1,14 @@
+import { TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+import { getPkiSyncDestinationColValues } from "../helpers";
+import { PkiSyncTableCell } from "../PkiSyncTableCell";
+
+type Props = {
+  pkiSync: TPkiSync;
+};
+
+export const PkiSyncDestinationCol = ({ pkiSync }: Props) => {
+  const { primaryText, secondaryText } = getPkiSyncDestinationColValues(pkiSync);
+
+  return <PkiSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncDestinationCol/index.ts

@@ -0,0 +1 @@
+export { PkiSyncDestinationCol } from "./PkiSyncDestinationCol";

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncRow.tsx

@@ -0,0 +1,398 @@
+import { useCallback, useMemo } from "react";
+import { subject } from "@casl/ability";
+import {
+  faBan,
+  faCalendarCheck,
+  faCheck,
+  faCopy,
+  faDownload,
+  faEllipsisV,
+  faEraser,
+  faInfoCircle,
+  faRotate,
+  faToggleOff,
+  faToggleOn,
+  faTrash,
+  faTriangleExclamation,
+  faXmark
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate } from "@tanstack/react-router";
+import { format } from "date-fns";
+import { twMerge } from "tailwind-merge";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import {
+  PkiSyncImportStatusBadge,
+  PkiSyncRemoveStatusBadge,
+  PkiSyncStatusBadge
+} from "@app/components/pki-syncs";
+import {
+  Badge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  Td,
+  Tooltip,
+  Tr
+} from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
+import { useToggle } from "@app/hooks";
+import { PkiSyncStatus, TPkiSync, usePkiSyncOption } from "@app/hooks/api/pkiSyncs";
+
+import { PkiSyncDestinationCol } from "./PkiSyncDestinationCol";
+import { PkiSyncTableCell } from "./PkiSyncTableCell";
+
+type Props = {
+  pkiSync: TPkiSync;
+  onDelete: (pkiSync: TPkiSync) => void;
+  onTriggerSyncCertificates: (pkiSync: TPkiSync) => void;
+  onTriggerImportCertificates: (pkiSync: TPkiSync) => void;
+  onTriggerRemoveCertificates: (pkiSync: TPkiSync) => void;
+  onToggleEnable: (pkiSync: TPkiSync) => void;
+};
+
+export const PkiSyncRow = ({
+  pkiSync,
+  onDelete,
+  onTriggerSyncCertificates,
+  onTriggerImportCertificates,
+  onTriggerRemoveCertificates,
+  onToggleEnable
+}: Props) => {
+  const navigate = useNavigate();
+  const {
+    id,
+    subscriberId,
+    lastSyncMessage,
+    destination,
+    lastSyncedAt,
+    name,
+    description,
+    syncStatus,
+    isAutoSyncEnabled,
+    projectId
+  } = pkiSync;
+
+  const destinationName = PKI_SYNC_MAP[destination].name;
+
+  const { syncOption } = usePkiSyncOption(destination);
+
+  const [isIdCopied, setIsIdCopied] = useToggle(false);
+
+  const handleCopyId = useCallback(() => {
+    setIsIdCopied.on();
+    navigator.clipboard.writeText(id);
+
+    createNotification({
+      text: "PKI Sync ID copied to clipboard",
+      type: "info"
+    });
+
+    const timer = setTimeout(() => setIsIdCopied.off(), 2000);
+
+    // eslint-disable-next-line consistent-return
+    return () => clearTimeout(timer);
+  }, [isIdCopied]);
+
+  const failureMessage = useMemo(() => {
+    if (syncStatus === PkiSyncStatus.Failed) {
+      if (lastSyncMessage)
+        try {
+          return JSON.stringify(JSON.parse(lastSyncMessage), null, 2);
+        } catch {
+          return lastSyncMessage;
+        }
+
+      return "An Unknown Error Occurred.";
+    }
+    return null;
+  }, [syncStatus, lastSyncMessage]);
+
+  const destinationDetails = PKI_SYNC_MAP[destination];
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: subscriberId || ""
+  });
+
+  return (
+    <Tr
+      onClick={() => {
+        // console.log("PKI Sync navigation:", { syncId: id, projectId });
+        navigate({
+          to: ROUTE_PATHS.CertManager.PkiSyncDetailsByIDPage.path,
+          params: {
+            syncId: id,
+            projectId
+          }
+        });
+      }}
+      className={twMerge(
+        "group h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700",
+        syncStatus === PkiSyncStatus.Failed && "bg-red/5 hover:bg-red/10"
+      )}
+      key={`sync-${id}`}
+    >
+      <Td>
+        <img
+          alt={`${destinationDetails.name} sync`}
+          src={`/images/integrations/${destinationDetails.image}`}
+          className="min-w-[1.75rem]"
+        />
+      </Td>
+      <Td className="!min-w-[8rem] max-w-0">
+        <div>
+          <div className="flex w-full items-center">
+            <p className="truncate">{name}</p>
+            {description && (
+              <Tooltip content={description}>
+                <FontAwesomeIcon
+                  icon={faInfoCircle}
+                  size="xs"
+                  className="ml-1 text-mineshaft-400"
+                />
+              </Tooltip>
+            )}
+          </div>
+          <p className="truncate text-xs leading-4 text-bunker-300">{destinationDetails.name}</p>
+        </div>
+      </Td>
+      {subscriberId ? (
+        <PkiSyncTableCell primaryText={pkiSync.subscriber?.name || subscriberId} secondaryText="PKI Subscriber" />
+      ) : (
+        <Td>
+          <Tooltip content="The PKI subscriber for this sync has been deleted. Configure a new source or remove this sync.">
+            <div className="w-min">
+              <Badge
+                className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap"
+                variant="primary"
+              >
+                <FontAwesomeIcon icon={faTriangleExclamation} />
+                <span>Source Deleted</span>
+              </Badge>
+            </div>
+          </Tooltip>
+        </Td>
+      )}
+      <PkiSyncDestinationCol pkiSync={pkiSync} />
+      <Td>
+        <div className="flex items-center gap-1">
+          {syncStatus && (
+            <Tooltip
+              position="left"
+              className="max-w-sm"
+              content={
+                [PkiSyncStatus.Succeeded, PkiSyncStatus.Failed].includes(syncStatus) ? (
+                  <div className="flex flex-col gap-2 whitespace-normal py-1">
+                    {lastSyncedAt && (
+                      <div>
+                        <div
+                          className={`mb-2 flex self-start ${syncStatus === PkiSyncStatus.Failed ? "text-yellow" : "text-green"}`}
+                        >
+                          <FontAwesomeIcon
+                            icon={faCalendarCheck}
+                            className="ml-1 pr-1.5 pt-0.5 text-sm"
+                          />
+                          <div className="text-xs">Last Synced</div>
+                        </div>
+                        <div className="rounded bg-mineshaft-600 p-2 text-xs">
+                          {format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
+                        </div>
+                      </div>
+                    )}
+                    {failureMessage && (
+                      <div>
+                        <div className="mb-2 flex self-start text-red">
+                          <FontAwesomeIcon icon={faXmark} className="ml-1 pr-1.5 pt-0.5 text-sm" />
+                          <div className="text-xs">Failure Reason</div>
+                        </div>
+                        <div className="break-words rounded bg-mineshaft-600 p-2 text-xs">
+                          {failureMessage}
+                        </div>
+                      </div>
+                    )}
+                  </div>
+                ) : undefined
+              }
+            >
+              <div>
+                <PkiSyncStatusBadge status={syncStatus} />
+              </div>
+            </Tooltip>
+          )}
+          {!isAutoSyncEnabled && (
+            <Tooltip
+              className="text-xs"
+              content="Auto-Sync is disabled. Certificate changes in the PKI subscriber will not be automatically synced to the destination."
+            >
+              <div>
+                <Badge className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap bg-mineshaft-400/50 text-bunker-300">
+                  <FontAwesomeIcon icon={faBan} />
+                  {!syncStatus && "Auto-Sync Disabled"}
+                </Badge>
+              </div>
+            </Tooltip>
+          )}
+          {syncOption?.canImportCertificates && <PkiSyncImportStatusBadge mini pkiSync={pkiSync} />}
+          <PkiSyncRemoveStatusBadge mini pkiSync={pkiSync} />
+        </div>
+      </Td>
+      <Td>
+        <Tooltip className="max-w-sm text-center" content="Options">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton
+                ariaLabel="Options"
+                colorSchema="secondary"
+                className="w-6"
+                variant="plain"
+              >
+                <FontAwesomeIcon icon={faEllipsisV} />
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent sideOffset={2} align="end">
+              <DropdownMenuItem
+                icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  handleCopyId();
+                }}
+              >
+                Copy Sync ID
+              </DropdownMenuItem>
+              <ProjectPermissionCan
+                I={ProjectPermissionPkiSyncActions.SyncCertificates}
+                a={permissionSubject}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faRotate} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onTriggerSyncCertificates(pkiSync);
+                    }}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Manually trigger a sync for this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span> Trigger Sync</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              {syncOption?.canImportCertificates && (
+                <ProjectPermissionCan
+                  I={ProjectPermissionPkiSyncActions.ImportCertificates}
+                  a={permissionSubject}
+                >
+                  {(isAllowed: boolean) => (
+                    <DropdownMenuItem
+                      icon={<FontAwesomeIcon icon={faDownload} />}
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        onTriggerImportCertificates(pkiSync);
+                      }}
+                      isDisabled={!isAllowed}
+                    >
+                      <Tooltip
+                        position="left"
+                        sideOffset={42}
+                        content={`Import certificates from this ${destinationName} destination into Infisical.`}
+                      >
+                        <div className="flex h-full w-full items-center justify-between gap-1">
+                          <span>Import Certificates</span>
+                          <FontAwesomeIcon
+                            className="text-bunker-300"
+                            size="sm"
+                            icon={faInfoCircle}
+                          />
+                        </div>
+                      </Tooltip>
+                    </DropdownMenuItem>
+                  )}
+                </ProjectPermissionCan>
+              )}
+              <ProjectPermissionCan
+                I={ProjectPermissionPkiSyncActions.RemoveCertificates}
+                a={permissionSubject}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faEraser} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onTriggerRemoveCertificates(pkiSync);
+                    }}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Remove certificates synced by Infisical from this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span>Remove Certificates</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    isDisabled={!isAllowed}
+                    icon={<FontAwesomeIcon icon={isAutoSyncEnabled ? faToggleOff : faToggleOn} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onToggleEnable(pkiSync);
+                    }}
+                  >
+                    {isAutoSyncEnabled ? "Disable" : "Enable"} Auto-Sync
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              <ProjectPermissionCan
+                I={ProjectPermissionPkiSyncActions.Delete}
+                a={permissionSubject}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    isDisabled={!isAllowed}
+                    icon={<FontAwesomeIcon icon={faTrash} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onDelete(pkiSync);
+                    }}
+                  >
+                    Delete Sync
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </Tooltip>
+      </Td>
+    </Tr>
+  );
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncTableCell.tsx

@@ -0,0 +1,71 @@
+import { ReactNode } from "react";
+import { faInfoCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { twMerge } from "tailwind-merge";
+
+import { Td, Tooltip } from "@app/components/v2";
+
+export type PkiSyncTableCellProps = {
+  primaryText: string;
+  secondaryText?: string;
+  infoBadge?: "primary" | "secondary";
+  additionalTooltipContent?: ReactNode;
+  primaryClassName?: string;
+  secondaryClassName?: string;
+};
+
+export const PkiSyncTableCell = ({
+  primaryText,
+  secondaryText,
+  infoBadge,
+  additionalTooltipContent,
+  primaryClassName,
+  secondaryClassName
+}: PkiSyncTableCellProps) => {
+  return (
+    <Td className="!min-w-[8rem] max-w-0">
+      <Tooltip
+        side="left"
+        className="max-w-2xl break-words"
+        content={
+          <>
+            <p className="text-sm">{primaryText}</p>
+            {secondaryText && (
+              <p className={twMerge("text-xs leading-3 text-bunker-300", secondaryClassName)}>
+                {secondaryText}
+              </p>
+            )}
+            {additionalTooltipContent}
+          </>
+        }
+      >
+        <div>
+          <p className={twMerge("truncate text-sm", primaryClassName)}>
+            {primaryText}
+            {infoBadge === "primary" && (
+              <FontAwesomeIcon
+                size="xs"
+                icon={faInfoCircle}
+                className="ml-1 inline-block text-bunker-300"
+              />
+            )}
+          </p>
+          {secondaryText && (
+            <p
+              className={twMerge("truncate text-xs leading-4 text-bunker-300", secondaryClassName)}
+            >
+              {secondaryText}
+              {infoBadge === "secondary" && (
+                <FontAwesomeIcon
+                  size="xs"
+                  icon={faInfoCircle}
+                  className="ml-1 inline-block text-bunker-300"
+                />
+              )}
+            </p>
+          )}
+        </div>
+      </Tooltip>
+    </Td>
+  );
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncsTable.tsx

@@ -0,0 +1,479 @@
+import { useMemo, useState } from "react";
+import {
+  faArrowDown,
+  faArrowUp,
+  faCheck,
+  faCheckCircle,
+  faFilter,
+  faMagnifyingGlass,
+  faRotate,
+  faSearch,
+  faWarning
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { twMerge } from "tailwind-merge";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  DeletePkiSyncModal,
+  PkiSyncImportCertificatesModal,
+  PkiSyncRemoveCertificatesModal
+} from "@app/components/pki-syncs";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  EmptyState,
+  IconButton,
+  Input,
+  Pagination,
+  Table,
+  TableContainer,
+  TBody,
+  Th,
+  THead,
+  Tr
+} from "@app/components/v2";
+import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
+import {
+  getUserTablePreference,
+  PreferenceKey,
+  setUserTablePreference
+} from "@app/helpers/userTablePreferences";
+import { usePagination, usePopUp, useResetPageHelper } from "@app/hooks";
+import { OrderByDirection } from "@app/hooks/api/generic/types";
+import {
+  PkiSync,
+  PkiSyncStatus,
+  TPkiSync,
+  useTriggerPkiSyncSyncCertificates,
+  useUpdatePkiSync
+} from "@app/hooks/api/pkiSyncs";
+
+import { getPkiSyncDestinationColValues } from "./helpers";
+import { PkiSyncRow } from "./PkiSyncRow";
+
+enum PkiSyncsOrderBy {
+  Destination = "destination",
+  Source = "source",
+  Name = "name",
+  Status = "status"
+}
+
+type PkiSyncFilters = {
+  destinations: PkiSync[];
+  status: PkiSyncStatus[];
+};
+
+const getSyncStatusOrderValue = (syncStatus: PkiSyncStatus | null) => {
+  switch (syncStatus) {
+    case PkiSyncStatus.Failed:
+      return 0;
+    case PkiSyncStatus.Pending:
+    case PkiSyncStatus.Running:
+      return 1;
+    case PkiSyncStatus.Succeeded:
+      return 2;
+    default:
+      return 3;
+  }
+};
+
+type Props = {
+  pkiSyncs: TPkiSync[];
+};
+
+const STATUS_ICON_MAP = {
+  [PkiSyncStatus.Succeeded]: { icon: faCheck, className: "text-green", name: "Synced" },
+  [PkiSyncStatus.Failed]: { icon: faWarning, className: "text-red", name: "Not Synced" },
+  [PkiSyncStatus.Pending]: { icon: faRotate, className: "text-yellow", name: "Syncing" },
+  [PkiSyncStatus.Running]: { icon: faRotate, className: "text-yellow", name: "Syncing" }
+};
+
+export const PkiSyncsTable = ({ pkiSyncs }: Props) => {
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+    "deleteSync",
+    "importCertificates",
+    "removeCertificates"
+  ] as const);
+  const triggerSync = useTriggerPkiSyncSyncCertificates();
+  const updateSync = useUpdatePkiSync();
+
+  const [filters, setFilters] = useState<PkiSyncFilters>({
+    destinations: [],
+    status: []
+  });
+
+  const {
+    search,
+    setSearch,
+    setPage,
+    page,
+    perPage,
+    setPerPage,
+    offset,
+    orderDirection,
+    toggleOrderDirection,
+    orderBy,
+    setOrderDirection,
+    setOrderBy
+  } = usePagination<PkiSyncsOrderBy>(PkiSyncsOrderBy.Name, {
+    initPerPage: getUserTablePreference("pkiSyncTable", PreferenceKey.PerPage, 20)
+  });
+
+  const handlePerPageChange = (newPerPage: number) => {
+    setPerPage(newPerPage);
+    setUserTablePreference("pkiSyncTable", PreferenceKey.PerPage, newPerPage);
+  };
+
+  const filteredPkiSyncs = useMemo(
+    () =>
+      pkiSyncs
+        .filter((pkiSync) => {
+          const { destination, name, syncStatus } = pkiSync;
+
+          if (filters.destinations.length && !filters.destinations.includes(destination))
+            return false;
+
+          if (filters.status.length && (!syncStatus || !filters.status.includes(syncStatus))) {
+            return false;
+          }
+
+          const searchValue = search.trim().toLowerCase();
+
+          const destinationValues = getPkiSyncDestinationColValues(pkiSync);
+
+          return (
+            (PKI_SYNC_MAP[destination]?.name || "Unknown Service")
+              .toLowerCase()
+              .includes(searchValue) ||
+            name.toLowerCase().includes(searchValue) ||
+            (pkiSync.appConnectionName &&
+              pkiSync.appConnectionName.toLowerCase().includes(searchValue)) ||
+            destinationValues.primaryText.toLowerCase().includes(searchValue) ||
+            destinationValues.secondaryText?.toLowerCase().includes(searchValue)
+          );
+        })
+        .sort((a, b) => {
+          const [syncOne, syncTwo] = orderDirection === OrderByDirection.ASC ? [a, b] : [b, a];
+
+          switch (orderBy) {
+            case PkiSyncsOrderBy.Source:
+              return (syncOne.subscriber?.name ?? syncOne.subscriberId ?? "")
+                .toLowerCase()
+                .localeCompare(
+                  syncTwo.subscriber?.name?.toLowerCase() ??
+                    syncTwo.subscriberId?.toLowerCase() ??
+                    ""
+                );
+            case PkiSyncsOrderBy.Destination:
+              return getPkiSyncDestinationColValues(syncOne)
+                .primaryText.toLowerCase()
+                .localeCompare(getPkiSyncDestinationColValues(syncTwo).primaryText.toLowerCase());
+            case PkiSyncsOrderBy.Status:
+              if (!syncOne.syncStatus && syncTwo.syncStatus) return 1;
+              if (syncOne.syncStatus && !syncTwo.syncStatus) return -1;
+              if (!syncOne.syncStatus && !syncTwo.syncStatus) return 0;
+
+              return (
+                getSyncStatusOrderValue(syncOne.syncStatus) -
+                getSyncStatusOrderValue(syncTwo.syncStatus)
+              );
+            case PkiSyncsOrderBy.Name:
+            default:
+              return syncOne.name.toLowerCase().localeCompare(syncTwo.name.toLowerCase());
+          }
+        }),
+    [pkiSyncs, orderDirection, search, orderBy, filters]
+  );
+
+  useResetPageHelper({
+    totalCount: filteredPkiSyncs.length,
+    offset,
+    setPage
+  });
+
+  const handleSort = (column: PkiSyncsOrderBy) => {
+    if (column === orderBy) {
+      toggleOrderDirection();
+      return;
+    }
+
+    setOrderBy(column);
+    setOrderDirection(OrderByDirection.ASC);
+  };
+
+  const getClassName = (col: PkiSyncsOrderBy) =>
+    twMerge("ml-2", orderBy === col ? "" : "opacity-30");
+
+  const getColSortIcon = (col: PkiSyncsOrderBy) =>
+    orderDirection === OrderByDirection.DESC && orderBy === col ? faArrowUp : faArrowDown;
+
+  const isTableFiltered = Boolean(filters.destinations.length || filters.status.length);
+
+  const handleDelete = (pkiSync: TPkiSync) => handlePopUpOpen("deleteSync", pkiSync);
+
+  const handleTriggerImportCertificates = (pkiSync: TPkiSync) =>
+    handlePopUpOpen("importCertificates", pkiSync);
+
+  const handleTriggerRemoveCertificates = (pkiSync: TPkiSync) =>
+    handlePopUpOpen("removeCertificates", pkiSync);
+
+  const handleToggleEnableSync = async (pkiSync: TPkiSync) => {
+    const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
+
+    const isAutoSyncEnabled = !pkiSync.isAutoSyncEnabled;
+
+    try {
+      await updateSync.mutateAsync({
+        syncId: pkiSync.id,
+        projectId: pkiSync.projectId,
+        destination: pkiSync.destination,
+        isAutoSyncEnabled
+      });
+
+      createNotification({
+        text: `Successfully ${isAutoSyncEnabled ? "enabled" : "disabled"} auto-sync for ${destinationName} Sync`,
+        type: "success"
+      });
+    } catch {
+      createNotification({
+        text: `Failed to ${isAutoSyncEnabled ? "enable" : "disable"} auto-sync for ${destinationName} Sync`,
+        type: "error"
+      });
+    }
+  };
+
+  const handleTriggerSync = async (pkiSync: TPkiSync) => {
+    const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
+
+    try {
+      await triggerSync.mutateAsync({
+        syncId: pkiSync.id,
+        destination: pkiSync.destination,
+        projectId: pkiSync.projectId
+      });
+
+      createNotification({
+        text: `Successfully triggered ${destinationName} Sync`,
+        type: "success"
+      });
+    } catch {
+      createNotification({
+        text: `Failed to trigger ${destinationName} Sync`,
+        type: "error"
+      });
+    }
+  };
+
+  return (
+    <div>
+      <div className="flex gap-2">
+        <Input
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+          leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+          placeholder="Search PKI syncs..."
+          className="flex-1"
+        />
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton
+              ariaLabel="Filter PKI syncs"
+              variant="plain"
+              size="sm"
+              className={twMerge(
+                "flex h-10 w-11 items-center justify-center overflow-hidden border border-mineshaft-600 bg-mineshaft-800 p-0 transition-all hover:border-primary/60 hover:bg-primary/10",
+                isTableFiltered && "border-primary/50 text-primary"
+              )}
+            >
+              <FontAwesomeIcon icon={faFilter} />
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent className="thin-scrollbar max-h-[70vh] overflow-y-auto" align="end">
+            <DropdownMenuLabel>Status</DropdownMenuLabel>
+            {[PkiSyncStatus.Running, PkiSyncStatus.Succeeded, PkiSyncStatus.Failed].map(
+              (status) => (
+                <DropdownMenuItem
+                  onClick={(e) => {
+                    e.preventDefault();
+                    setFilters((prev) => ({
+                      ...prev,
+                      status: prev.status.includes(status)
+                        ? prev.status.filter((s) => s !== status)
+                        : [...prev.status, status]
+                    }));
+                  }}
+                  key={status}
+                  icon={
+                    filters.status.includes(status) && (
+                      <FontAwesomeIcon className="text-primary" icon={faCheckCircle} />
+                    )
+                  }
+                  iconPos="right"
+                >
+                  <div className="flex items-center gap-2">
+                    <FontAwesomeIcon
+                      icon={STATUS_ICON_MAP[status].icon}
+                      className={STATUS_ICON_MAP[status].className}
+                    />
+                    <span className="capitalize">{STATUS_ICON_MAP[status].name}</span>
+                  </div>
+                </DropdownMenuItem>
+              )
+            )}
+            <DropdownMenuLabel>Service</DropdownMenuLabel>
+            {pkiSyncs.length ? (
+              [...new Set(pkiSyncs.map(({ destination }) => destination))].map((destination) => {
+                const { name, image } = PKI_SYNC_MAP[destination];
+
+                return (
+                  <DropdownMenuItem
+                    onClick={(e) => {
+                      e.preventDefault();
+                      setFilters((prev) => ({
+                        ...prev,
+                        destinations: prev.destinations.includes(destination)
+                          ? prev.destinations.filter((a) => a !== destination)
+                          : [...prev.destinations, destination]
+                      }));
+                    }}
+                    key={destination}
+                    icon={
+                      filters.destinations.includes(destination) && (
+                        <FontAwesomeIcon className="text-primary" icon={faCheckCircle} />
+                      )
+                    }
+                    iconPos="right"
+                  >
+                    <div className="flex items-center gap-2">
+                      <img
+                        alt={`${name} integration`}
+                        src={`/images/integrations/${image}`}
+                        className="h-4 w-4"
+                      />
+                      <span>{name}</span>
+                    </div>
+                  </DropdownMenuItem>
+                );
+              })
+            ) : (
+              <DropdownMenuItem isDisabled>No PKI Syncs Configured</DropdownMenuItem>
+            )}
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </div>
+      <TableContainer className="mt-4">
+        <Table>
+          <THead>
+            <Tr>
+              <Th className="w-2" />
+              <Th className="w-1/4">
+                <div className="flex items-center">
+                  Name
+                  <IconButton
+                    variant="plain"
+                    className={getClassName(PkiSyncsOrderBy.Name)}
+                    ariaLabel="sort"
+                    onClick={() => handleSort(PkiSyncsOrderBy.Name)}
+                  >
+                    <FontAwesomeIcon icon={getColSortIcon(PkiSyncsOrderBy.Name)} />
+                  </IconButton>
+                </div>
+              </Th>
+              <Th className="w-1/3">
+                <div className="flex items-center">
+                  Source
+                  <IconButton
+                    variant="plain"
+                    className={getClassName(PkiSyncsOrderBy.Source)}
+                    ariaLabel="sort"
+                    onClick={() => handleSort(PkiSyncsOrderBy.Source)}
+                  >
+                    <FontAwesomeIcon icon={getColSortIcon(PkiSyncsOrderBy.Source)} />
+                  </IconButton>
+                </div>
+              </Th>
+              <Th className="w-1/3">
+                <div className="flex items-center">
+                  Destination
+                  <IconButton
+                    variant="plain"
+                    className={getClassName(PkiSyncsOrderBy.Destination)}
+                    ariaLabel="sort"
+                    onClick={() => handleSort(PkiSyncsOrderBy.Destination)}
+                  >
+                    <FontAwesomeIcon icon={getColSortIcon(PkiSyncsOrderBy.Destination)} />
+                  </IconButton>
+                </div>
+              </Th>
+              <Th className="min-w-[10.5rem]">
+                <div className="flex items-center">
+                  Status
+                  <IconButton
+                    variant="plain"
+                    className={getClassName(PkiSyncsOrderBy.Status)}
+                    ariaLabel="sort"
+                    onClick={() => handleSort(PkiSyncsOrderBy.Status)}
+                  >
+                    <FontAwesomeIcon icon={getColSortIcon(PkiSyncsOrderBy.Status)} />
+                  </IconButton>
+                </div>
+              </Th>
+              <Th className="w-5" />
+            </Tr>
+          </THead>
+          <TBody>
+            {filteredPkiSyncs.slice(offset, perPage * page).map((pkiSync) => (
+              <PkiSyncRow
+                key={pkiSync.id}
+                pkiSync={pkiSync}
+                onDelete={handleDelete}
+                onTriggerSyncCertificates={handleTriggerSync}
+                onTriggerImportCertificates={handleTriggerImportCertificates}
+                onTriggerRemoveCertificates={handleTriggerRemoveCertificates}
+                onToggleEnable={handleToggleEnableSync}
+              />
+            ))}
+          </TBody>
+        </Table>
+        {Boolean(filteredPkiSyncs.length) && (
+          <Pagination
+            count={filteredPkiSyncs.length}
+            page={page}
+            perPage={perPage}
+            onChangePage={setPage}
+            onChangePerPage={handlePerPageChange}
+          />
+        )}
+        {!filteredPkiSyncs?.length && (
+          <EmptyState
+            title={
+              pkiSyncs.length ? "No syncs match search..." : "This project has no syncs configured"
+            }
+            icon={pkiSyncs.length ? faSearch : faRotate}
+          />
+        )}
+      </TableContainer>
+      <DeletePkiSyncModal
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteSync", isOpen)}
+        isOpen={popUp.deleteSync.isOpen}
+        pkiSync={popUp.deleteSync.data}
+      />
+      {popUp.importCertificates.data && (
+        <PkiSyncImportCertificatesModal
+          onOpenChange={(isOpen) => handlePopUpToggle("importCertificates", isOpen)}
+          isOpen={popUp.importCertificates.isOpen}
+          pkiSync={popUp.importCertificates.data}
+        />
+      )}
+      <PkiSyncRemoveCertificatesModal
+        onOpenChange={(isOpen) => handlePopUpToggle("removeCertificates", isOpen)}
+        isOpen={popUp.removeCertificates.isOpen}
+        pkiSync={popUp.removeCertificates.data}
+      />
+    </div>
+  );
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/helpers.ts

@@ -0,0 +1,13 @@
+import { TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+export const getPkiSyncDestinationColValues = (pkiSync: TPkiSync) => {
+  const { destination } = pkiSync;
+
+  switch (destination) {
+    default:
+      return {
+        primaryText: pkiSync.name,
+        secondaryText: pkiSync.appConnectionName || "Unknown Connection"
+      };
+  }
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/index.ts

@@ -0,0 +1 @@
+export { PkiSyncsTable } from "./PkiSyncsTable";

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncsTab.tsx

@@ -0,0 +1,113 @@
+import { useCallback, useEffect, useMemo } from "react";
+import { faArrowUpRightFromSquare, faBookOpen, faPlus } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate, useSearch } from "@tanstack/react-router";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { CreatePkiSyncModal } from "@app/components/pki-syncs";
+import { Button, Spinner } from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { ProjectPermissionSub, useProject } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { usePopUp } from "@app/hooks";
+import { useListPkiSyncs } from "@app/hooks/api/pkiSyncs";
+
+import { PkiSyncsTable } from "./PkiSyncTable";
+
+export const PkiSyncsTab = () => {
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["addSync"] as const);
+
+  const { addSync, ...search } = useSearch({
+    from: ROUTE_PATHS.CertManager.IntegrationsListPage.id
+  });
+
+  const navigate = useNavigate();
+
+  const { currentProject } = useProject();
+
+  const memoizedSearch = useMemo(() => search, [search]);
+
+  const navigateToBase = useCallback(() => {
+    navigate({
+      to: ROUTE_PATHS.CertManager.IntegrationsListPage.path,
+      params: {
+        projectId: currentProject?.id
+      },
+      search: memoizedSearch
+    });
+  }, [navigate, currentProject?.id, memoizedSearch]);
+
+  useEffect(() => {
+    if (!addSync) return;
+
+    handlePopUpOpen("addSync", addSync);
+    navigateToBase();
+  }, [addSync, handlePopUpOpen, navigateToBase]);
+
+  const { data: pkiSyncs = [], isPending: isPkiSyncsPending } = useListPkiSyncs(
+    currentProject?.id || "",
+    {
+      refetchInterval: 30000
+    }
+  );
+
+  if (isPkiSyncsPending)
+    return (
+      <div className="flex h-[60vh] flex-col items-center justify-center gap-2">
+        <Spinner />
+      </div>
+    );
+
+  return (
+    <>
+      <div className="w-full rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+        <div className="mb-4 flex items-center justify-between">
+          <div>
+            <div className="flex items-start gap-1">
+              <p className="text-xl font-semibold text-mineshaft-100">Certificate Syncs</p>
+              <a
+                href="https://infisical.com/docs/integrations/pki-syncs/overview"
+                target="_blank"
+                rel="noopener noreferrer"
+              >
+                <div className="ml-1 mt-[0.32rem] inline-block rounded-md bg-yellow/20 px-1.5 text-sm text-yellow opacity-80 hover:opacity-100">
+                  <FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
+                  <span>Docs</span>
+                  <FontAwesomeIcon
+                    icon={faArrowUpRightFromSquare}
+                    className="mb-[0.07rem] ml-1.5 text-[10px]"
+                  />
+                </div>
+              </a>
+            </div>
+            <p className="text-sm text-bunker-300">
+              Use App Connections to sync certificates to third-party services.
+            </p>
+          </div>
+          <ProjectPermissionCan
+            I={ProjectPermissionPkiSyncActions.Create}
+            a={ProjectPermissionSub.PkiSyncs}
+          >
+            {(isAllowed) => (
+              <Button
+                colorSchema="secondary"
+                type="button"
+                leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                onClick={() => handlePopUpOpen("addSync")}
+                isDisabled={!isAllowed}
+              >
+                Add Sync
+              </Button>
+            )}
+          </ProjectPermissionCan>
+        </div>
+        <PkiSyncsTable pkiSyncs={pkiSyncs} />
+      </div>
+      <CreatePkiSyncModal
+        selectSync={popUp.addSync.data}
+        isOpen={popUp.addSync.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("addSync", isOpen)}
+      />
+    </>
+  );
+};

frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/index.ts

@@ -0,0 +1 @@
+export { PkiSyncsTab } from "./PkiSyncsTab";

frontend/src/pages/cert-manager/IntegrationsListPage/components/index.ts

@@ -0,0 +1 @@
+export { PkiSyncsTab } from "./PkiSyncsTab";

frontend/src/pages/cert-manager/IntegrationsListPage/index.ts

@@ -0,0 +1 @@
+export { IntegrationsListPage } from "./IntegrationsListPage";

frontend/src/pages/cert-manager/IntegrationsListPage/route.tsx

@@ -0,0 +1,30 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { zodValidator } from "@tanstack/zod-adapter";
+import { z } from "zod";
+
+import { PkiSync } from "@app/hooks/api/pkiSyncs";
+import { IntegrationsListPageTabs } from "@app/types/integrations";
+
+import { IntegrationsListPage } from "./IntegrationsListPage";
+
+const IntegrationsListPageQuerySchema = z.object({
+  selectedTab: z.nativeEnum(IntegrationsListPageTabs).optional(),
+  addSync: z.nativeEnum(PkiSync).optional()
+});
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/projects/cert-management/$projectId/_cert-manager-layout/integrations/"
+)({
+  component: IntegrationsListPage,
+  validateSearch: zodValidator(IntegrationsListPageQuerySchema),
+  beforeLoad: ({ context }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Integrations"
+        }
+      ]
+    };
+  }
+});

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/PkiSyncDetailsByIDPage.tsx

@@ -0,0 +1,146 @@
+import { Helmet } from "react-helmet";
+import { faBan, faChevronLeft } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate, useParams } from "@tanstack/react-router";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { EditPkiSyncModal } from "@app/components/pki-syncs";
+import { PkiSyncEditFields } from "@app/components/pki-syncs/types";
+import { Button, ContentLoader, EmptyState } from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
+import { usePopUp } from "@app/hooks";
+import { useGetPkiSync } from "@app/hooks/api/pkiSyncs";
+import { IntegrationsListPageTabs } from "@app/types/integrations";
+
+import {
+  PkiSyncActionTriggers,
+  PkiSyncAuditLogsSection,
+  PkiSyncDestinationSection,
+  PkiSyncDetailsSection,
+  PkiSyncOptionsSection,
+  PkiSyncSourceSection
+} from "./components";
+
+const PageContent = () => {
+  const navigate = useNavigate();
+  const { syncId, projectId } = useParams({
+    from: ROUTE_PATHS.CertManager.PkiSyncDetailsByIDPage.id
+  });
+
+  const { handlePopUpToggle, popUp, handlePopUpOpen } = usePopUp(["editSync"] as const);
+
+  const { data: pkiSync, isPending } = useGetPkiSync(
+    { syncId, projectId },
+    {
+      refetchInterval: 30000
+    }
+  );
+
+  if (isPending) {
+    return (
+      <div className="flex h-full w-full items-center justify-center">
+        <ContentLoader />
+      </div>
+    );
+  }
+
+  if (!pkiSync) {
+    return (
+      <div className="flex h-full w-full items-center justify-center px-20">
+        <EmptyState
+          className="max-w-2xl rounded-md text-center"
+          icon={faBan}
+          title={`Could not find PKI Sync with ID ${syncId}`}
+        />
+      </div>
+    );
+  }
+
+  const destinationDetails = PKI_SYNC_MAP[pkiSync.destination];
+
+  const handleEditDetails = () => handlePopUpOpen("editSync", PkiSyncEditFields.Details);
+  const handleEditSource = () => handlePopUpOpen("editSync", PkiSyncEditFields.Source);
+  const handleEditOptions = () => handlePopUpOpen("editSync", PkiSyncEditFields.Options);
+  const handleEditDestination = () => handlePopUpOpen("editSync", PkiSyncEditFields.Destination);
+
+  return (
+    <>
+      <div className="container mx-auto flex flex-col justify-between bg-bunker-800 font-inter text-white">
+        <div className="mx-auto mb-6 w-full max-w-7xl">
+          <Button
+            variant="link"
+            type="submit"
+            leftIcon={<FontAwesomeIcon icon={faChevronLeft} />}
+            onClick={() => {
+              navigate({
+                to: ROUTE_PATHS.CertManager.IntegrationsListPage.path,
+                params: {
+                  projectId
+                },
+                search: {
+                  selectedTab: IntegrationsListPageTabs.PkiSyncs
+                }
+              });
+            }}
+          >
+            PKI Syncs
+          </Button>
+          <div className="mb-6 flex w-full items-center gap-3">
+            <img
+              alt={`${destinationDetails.name} sync`}
+              src={`/images/integrations/${destinationDetails.image}`}
+              className="ml-1 mt-3 w-16"
+            />
+            <div>
+              <p className="text-3xl font-semibold text-white">{pkiSync.name}</p>
+              <p className="leading-3 text-bunker-300">{destinationDetails.name} PKI Sync</p>
+            </div>
+            <PkiSyncActionTriggers pkiSync={pkiSync} />
+          </div>
+          <div className="flex justify-center">
+            <div className="mr-4 flex w-72 flex-col gap-4">
+              <PkiSyncDetailsSection pkiSync={pkiSync} onEditDetails={handleEditDetails} />
+              <PkiSyncSourceSection pkiSync={pkiSync} onEditSource={handleEditSource} />
+              <PkiSyncOptionsSection pkiSync={pkiSync} onEditOptions={handleEditOptions} />
+            </div>
+            <div className="flex flex-1 flex-col gap-4">
+              <PkiSyncDestinationSection
+                pkiSync={pkiSync}
+                onEditDestination={handleEditDestination}
+              />
+              <PkiSyncAuditLogsSection pkiSync={pkiSync} />
+            </div>
+          </div>
+        </div>
+      </div>
+      <EditPkiSyncModal
+        isOpen={popUp.editSync.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("editSync", isOpen)}
+        fields={popUp.editSync.data}
+        pkiSync={pkiSync}
+      />
+    </>
+  );
+};
+
+export const PkiSyncDetailsByIDPage = () => {
+  return (
+    <>
+      <Helmet>
+        <title>PKI Sync | Infisical</title>
+        <link rel="icon" href="/infisical.ico" />
+      </Helmet>
+      <ProjectPermissionCan
+        renderGuardBanner
+        passThrough={false}
+        I={ProjectPermissionPkiSyncActions.Read}
+        a={ProjectPermissionSub.PkiSyncs}
+      >
+        <PageContent />
+      </ProjectPermissionCan>
+    </>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncActionTriggers.tsx

@@ -0,0 +1,321 @@
+import { useCallback } from "react";
+import { subject } from "@casl/ability";
+import {
+  faBan,
+  faCheck,
+  faCopy,
+  faDownload,
+  faEllipsisV,
+  faEraser,
+  faInfoCircle,
+  faRotate,
+  faToggleOff,
+  faToggleOn,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate } from "@tanstack/react-router";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import {
+  DeletePkiSyncModal,
+  PkiSyncImportCertificatesModal,
+  PkiSyncImportStatusBadge,
+  PkiSyncRemoveCertificatesModal,
+  PkiSyncRemoveStatusBadge
+} from "@app/components/pki-syncs";
+import {
+  Badge,
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  Tooltip
+} from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
+import { usePopUp, useToggle } from "@app/hooks";
+import {
+  TPkiSync,
+  usePkiSyncOption,
+  useTriggerPkiSyncSyncCertificates,
+  useUpdatePkiSync
+} from "@app/hooks/api/pkiSyncs";
+import { IntegrationsListPageTabs } from "@app/types/integrations";
+
+type Props = {
+  pkiSync: TPkiSync;
+};
+
+export const PkiSyncActionTriggers = ({ pkiSync }: Props) => {
+  const { destination, subscriberId, projectId, id } = pkiSync;
+
+  const navigate = useNavigate();
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+    "importCertificates",
+    "removeCertificates",
+    "deleteSync"
+  ] as const);
+
+  const [isIdCopied, setIsIdCopied] = useToggle(false);
+
+  // API mutations
+  const triggerSyncMutation = useTriggerPkiSyncSyncCertificates();
+  const updatePkiSyncMutation = useUpdatePkiSync();
+
+  const { syncOption } = usePkiSyncOption(destination);
+
+  const destinationName = PKI_SYNC_MAP[destination].name;
+
+  const handleCopyId = useCallback(() => {
+    setIsIdCopied.on();
+    navigator.clipboard.writeText(pkiSync.id);
+
+    createNotification({
+      text: "PKI Sync ID copied to clipboard",
+      type: "info"
+    });
+
+    const timer = setTimeout(() => setIsIdCopied.off(), 2000);
+    return () => clearTimeout(timer);
+  }, [pkiSync.id, setIsIdCopied]);
+
+  const handleTriggerSync = useCallback(async () => {
+    try {
+      await triggerSyncMutation.mutateAsync({
+        syncId: id,
+        destination,
+        projectId
+      });
+      createNotification({
+        text: "PKI sync job queued successfully",
+        type: "success"
+      });
+    } catch (error) {
+      console.error("Failed to trigger sync:", error);
+      createNotification({
+        text: "Failed to trigger PKI sync",
+        type: "error"
+      });
+    }
+  }, [triggerSyncMutation, id, destination, projectId]);
+
+  const handleToggleAutoSync = useCallback(async () => {
+    try {
+      await updatePkiSyncMutation.mutateAsync({
+        syncId: id,
+        projectId,
+        destination,
+        isAutoSyncEnabled: !pkiSync.isAutoSyncEnabled
+      });
+      createNotification({
+        text: `Auto-sync ${pkiSync.isAutoSyncEnabled ? "disabled" : "enabled"} successfully`,
+        type: "success"
+      });
+    } catch (error) {
+      console.error("Failed to toggle auto-sync:", error);
+      createNotification({
+        text: "Failed to toggle auto-sync",
+        type: "error"
+      });
+    }
+  }, [updatePkiSyncMutation, id, projectId, pkiSync.isAutoSyncEnabled]);
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: subscriberId || ""
+  });
+
+  return (
+    <>
+      <div className="ml-auto mt-4 flex flex-wrap items-center justify-end gap-2">
+        {syncOption?.canImportCertificates && <PkiSyncImportStatusBadge pkiSync={pkiSync} />}
+        <PkiSyncRemoveStatusBadge pkiSync={pkiSync} />
+        {pkiSync.isAutoSyncEnabled ? (
+          <Badge
+            variant="success"
+            className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap"
+          >
+            <FontAwesomeIcon icon={faRotate} />
+            <span>Auto-Sync Enabled</span>
+          </Badge>
+        ) : (
+          <Tooltip
+            className="text-xs"
+            content="Auto-Sync is disabled. Certificate changes in the PKI subscriber will not be automatically synced to the destination."
+          >
+            <div>
+              <Badge className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap bg-mineshaft-400/50 text-bunker-300">
+                <FontAwesomeIcon icon={faBan} />
+                <span>Auto-Sync Disabled</span>
+              </Badge>
+            </div>
+          </Tooltip>
+        )}
+        <div>
+          <ProjectPermissionCan
+            I={ProjectPermissionPkiSyncActions.SyncCertificates}
+            a={permissionSubject}
+          >
+            {(isAllowed: boolean) => (
+              <Button
+                variant="outline_bg"
+                leftIcon={<FontAwesomeIcon icon={faRotate} />}
+                className="h-9 rounded-r-none bg-mineshaft-500"
+                isDisabled={!isAllowed || triggerSyncMutation.isPending}
+                isLoading={triggerSyncMutation.isPending}
+                onClick={handleTriggerSync}
+              >
+                Trigger Sync
+              </Button>
+            )}
+          </ProjectPermissionCan>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton
+                ariaLabel="add-folder-or-import"
+                variant="outline_bg"
+                className="h-9 w-10 rounded-l-none border-l-2 border-mineshaft border-l-mineshaft-700 bg-mineshaft-500"
+              >
+                <FontAwesomeIcon icon={faEllipsisV} />
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
+              <DropdownMenuItem
+                icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  handleCopyId();
+                }}
+              >
+                Copy Sync ID
+              </DropdownMenuItem>
+
+              {syncOption?.canImportCertificates && (
+                <ProjectPermissionCan
+                  I={ProjectPermissionPkiSyncActions.ImportCertificates}
+                  a={permissionSubject}
+                >
+                  {(isAllowed: boolean) => (
+                    <DropdownMenuItem
+                      icon={<FontAwesomeIcon icon={faDownload} />}
+                      onClick={() => handlePopUpOpen("importCertificates")}
+                      isDisabled={!isAllowed}
+                    >
+                      <Tooltip
+                        position="left"
+                        sideOffset={42}
+                        content={`Import certificates from this ${destinationName} destination into Infisical.`}
+                      >
+                        <div className="flex h-full w-full items-center justify-between gap-1">
+                          <span>Import Certificates</span>
+                          <FontAwesomeIcon
+                            className="text-bunker-300"
+                            size="sm"
+                            icon={faInfoCircle}
+                          />
+                        </div>
+                      </Tooltip>
+                    </DropdownMenuItem>
+                  )}
+                </ProjectPermissionCan>
+              )}
+
+              <ProjectPermissionCan
+                I={ProjectPermissionPkiSyncActions.RemoveCertificates}
+                a={permissionSubject}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faEraser} />}
+                    onClick={() => handlePopUpOpen("removeCertificates")}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Remove certificates synced by Infisical from this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span>Remove Certificates</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+
+              <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    isDisabled={!isAllowed || updatePkiSyncMutation.isPending}
+                    icon={
+                      <FontAwesomeIcon
+                        icon={pkiSync.isAutoSyncEnabled ? faToggleOff : faToggleOn}
+                      />
+                    }
+                    onClick={handleToggleAutoSync}
+                  >
+                    {pkiSync.isAutoSyncEnabled ? "Disable" : "Enable"} Auto-Sync
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+
+              <ProjectPermissionCan
+                I={ProjectPermissionPkiSyncActions.Delete}
+                a={permissionSubject}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    isDisabled={!isAllowed}
+                    icon={<FontAwesomeIcon icon={faTrash} />}
+                    onClick={() => handlePopUpOpen("deleteSync")}
+                  >
+                    Delete Sync
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </div>
+
+      {syncOption?.canImportCertificates && (
+        <PkiSyncImportCertificatesModal
+          onOpenChange={(isOpen) => handlePopUpToggle("importCertificates", isOpen)}
+          isOpen={popUp.importCertificates.isOpen}
+          pkiSync={pkiSync}
+        />
+      )}
+      <PkiSyncRemoveCertificatesModal
+        onOpenChange={(isOpen) => handlePopUpToggle("removeCertificates", isOpen)}
+        isOpen={popUp.removeCertificates.isOpen}
+        pkiSync={pkiSync}
+      />
+      <DeletePkiSyncModal
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteSync", isOpen)}
+        isOpen={popUp.deleteSync.isOpen}
+        pkiSync={pkiSync}
+        onComplete={() =>
+          navigate({
+            to: ROUTE_PATHS.CertManager.IntegrationsListPage.path,
+            params: {
+              projectId
+            },
+            search: {
+              selectedTab: IntegrationsListPageTabs.PkiSyncs
+            }
+          })
+        }
+      />
+    </>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncAuditLogsSection.tsx

@@ -0,0 +1,78 @@
+import { faFingerprint } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { Link } from "@tanstack/react-router";
+
+import { useProject, useSubscription } from "@app/context";
+import { EventType } from "@app/hooks/api/auditLogs/enums";
+import { TPkiSync } from "@app/hooks/api/pkiSyncs";
+import { LogsSection } from "@app/pages/organization/AuditLogsPage/components/LogsSection";
+
+const PKI_SYNC_EVENTS = [
+  EventType.PKI_SYNC_SYNC_CERTIFICATES,
+  EventType.PKI_SYNC_IMPORT_CERTIFICATES,
+  EventType.PKI_SYNC_REMOVE_CERTIFICATES
+];
+
+type Props = {
+  pkiSync: TPkiSync;
+};
+
+export const PkiSyncAuditLogsSection = ({ pkiSync }: Props) => {
+  const { subscription } = useSubscription();
+  const { currentProject } = useProject();
+
+  const auditLogsRetentionDays = subscription?.auditLogsRetentionDays ?? 30;
+
+  return (
+    <div className="flex max-h-full w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
+      <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
+        <h3 className="font-semibold text-mineshaft-100">Sync Logs</h3>
+        {subscription.auditLogs && (
+          <p className="text-xs text-bunker-300">
+            Displaying audit logs from the last {Math.min(auditLogsRetentionDays, 60)} days
+          </p>
+        )}
+      </div>
+      {subscription.auditLogs ? (
+        <LogsSection
+          refetchInterval={4000}
+          showFilters={false}
+          project={currentProject}
+          presets={{
+            eventMetadata: { syncId: pkiSync.id },
+            startDate: new Date(
+              new Date().setDate(new Date().getDate() - Math.min(auditLogsRetentionDays, 60))
+            ),
+            eventType: PKI_SYNC_EVENTS
+          }}
+        />
+      ) : (
+        <div className="flex h-full items-center justify-center rounded-lg bg-mineshaft-800 text-sm text-mineshaft-200">
+          <div className="flex flex-col items-center gap-4 py-20">
+            <FontAwesomeIcon size="2x" icon={faFingerprint} />
+            <p>
+              Please{" "}
+              {subscription && subscription.slug !== null ? (
+                <Link to="/organization/billing" target="_blank" rel="noopener noreferrer">
+                  <span className="cursor-pointer underline transition-all hover:text-white">
+                    upgrade your subscription
+                  </span>
+                </Link>
+              ) : (
+                <a
+                  href="https://infisical.com/scheduledemo"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="cursor-pointer underline transition-all hover:text-white"
+                >
+                  upgrade your subscription
+                </a>
+              )}{" "}
+              to view sync logs.
+            </p>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDestinationSection.tsx

@@ -0,0 +1,73 @@
+/* eslint-disable jsx-a11y/label-has-associated-control */
+import { ReactNode } from "react";
+import { subject } from "@casl/ability";
+import { faEdit } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { IconButton } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
+import { PkiSync, TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+import { AzureKeyVaultPkiSyncDestinationSection } from "./PkiSyncDestinationSection/index";
+
+const GenericFieldLabel = ({ label, children }: { label: string; children: React.ReactNode }) => (
+  <div>
+    <label className="text-sm text-bunker-300">{label}</label>
+    <div className="mt-1">{children}</div>
+  </div>
+);
+
+type Props = {
+  pkiSync: TPkiSync;
+  onEditDestination: VoidFunction;
+};
+
+export const PkiSyncDestinationSection = ({ pkiSync, onEditDestination }: Props) => {
+  const { destination, subscriberId } = pkiSync;
+
+  const destinationDetails = PKI_SYNC_MAP[destination];
+
+  let DestinationComponents: ReactNode;
+  switch (destination) {
+    case PkiSync.AzureKeyVault:
+      DestinationComponents = <AzureKeyVaultPkiSyncDestinationSection pkiSync={pkiSync} />;
+      break;
+    default:
+      // For future destinations, return null (no additional fields to show)
+      DestinationComponents = null;
+  }
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: subscriberId || ""
+  });
+
+  return (
+    <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
+      <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
+        <h3 className="font-semibold text-mineshaft-100">Destination Configuration</h3>
+        <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+          {(isAllowed) => (
+            <IconButton
+              variant="plain"
+              colorSchema="secondary"
+              isDisabled={!isAllowed}
+              ariaLabel="Edit destination"
+              onClick={onEditDestination}
+            >
+              <FontAwesomeIcon icon={faEdit} />
+            </IconButton>
+          )}
+        </ProjectPermissionCan>
+      </div>
+      <div className="flex w-full flex-wrap gap-8">
+        <GenericFieldLabel label={`${destinationDetails.name} Connection`}>
+          {pkiSync.appConnectionName || "Default Connection"}
+        </GenericFieldLabel>
+        {DestinationComponents}
+      </div>
+    </div>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDestinationSection/AzureKeyVaultPkiSyncDestinationSection.tsx

@@ -0,0 +1,21 @@
+/* eslint-disable jsx-a11y/label-has-associated-control */
+import { TAzureKeyVaultPkiSync } from "@app/hooks/api/pkiSyncs/types/azure-key-vault-sync";
+
+const GenericFieldLabel = ({ label, children }: { label: string; children: React.ReactNode }) => (
+  <div>
+    <label className="text-sm text-bunker-300">{label}</label>
+    <div className="mt-1">{children}</div>
+  </div>
+);
+
+type Props = {
+  pkiSync: TAzureKeyVaultPkiSync;
+};
+
+export const AzureKeyVaultPkiSyncDestinationSection = ({ pkiSync }: Props) => {
+  return (
+    <GenericFieldLabel label="Key Vault URL">
+      {pkiSync.destinationConfig.vaultBaseUrl}
+    </GenericFieldLabel>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDestinationSection/index.ts

@@ -0,0 +1 @@
+export { AzureKeyVaultPkiSyncDestinationSection } from "./AzureKeyVaultPkiSyncDestinationSection";

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDetailsSection.tsx

@@ -0,0 +1,101 @@
+/* eslint-disable jsx-a11y/label-has-associated-control */
+import { useMemo } from "react";
+import { subject } from "@casl/ability";
+import { faEdit } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { format } from "date-fns";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { PkiSyncStatusBadge } from "@app/components/pki-syncs";
+import { IconButton } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { PkiSyncStatus, TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+const GenericFieldLabel = ({
+  label,
+  children,
+  labelClassName
+}: {
+  label: string;
+  children: React.ReactNode;
+  labelClassName?: string;
+}) => (
+  <div>
+    <label className={`text-sm text-bunker-300 ${labelClassName || ""}`}>{label}</label>
+    <div className="mt-1">{children}</div>
+  </div>
+);
+
+type Props = {
+  pkiSync: TPkiSync;
+  onEditDetails: VoidFunction;
+};
+
+export const PkiSyncDetailsSection = ({ pkiSync, onEditDetails }: Props) => {
+  const { syncStatus, lastSyncMessage, lastSyncedAt, name, description, subscriberId, subscriber } =
+    pkiSync;
+
+  const failureMessage = useMemo(() => {
+    if (syncStatus === PkiSyncStatus.Failed) {
+      if (lastSyncMessage)
+        try {
+          return JSON.stringify(JSON.parse(lastSyncMessage), null, 2);
+        } catch {
+          return lastSyncMessage;
+        }
+
+      return "An Unknown Error Occurred.";
+    }
+    return null;
+  }, [syncStatus, lastSyncMessage]);
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: subscriber?.id || subscriberId || ""
+  });
+
+  return (
+    <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
+      <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
+        <h3 className="font-semibold text-mineshaft-100">Details</h3>
+        <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+          {(isAllowed) => (
+            <IconButton
+              variant="plain"
+              colorSchema="secondary"
+              isDisabled={!isAllowed}
+              ariaLabel="Edit sync details"
+              onClick={onEditDetails}
+            >
+              <FontAwesomeIcon icon={faEdit} />
+            </IconButton>
+          )}
+        </ProjectPermissionCan>
+      </div>
+      <div>
+        <div className="space-y-3">
+          <GenericFieldLabel label="Name">{name}</GenericFieldLabel>
+          <GenericFieldLabel label="Description">{description || "None"}</GenericFieldLabel>
+          <GenericFieldLabel label="Source Subscriber">
+            {subscriber ? subscriber.name : "Subscriber deleted"}
+          </GenericFieldLabel>
+          {syncStatus && (
+            <GenericFieldLabel label="Status">
+              <PkiSyncStatusBadge status={syncStatus} />
+            </GenericFieldLabel>
+          )}
+          {lastSyncedAt && (
+            <GenericFieldLabel label="Last Synced">
+              {format(new Date(lastSyncedAt), "yyyy-MM-dd, h:mm aaa")}
+            </GenericFieldLabel>
+          )}
+          {syncStatus === PkiSyncStatus.Failed && failureMessage && (
+            <GenericFieldLabel labelClassName="text-red" label="Last Sync Error">
+              <p className="break-words rounded bg-mineshaft-600 p-2 text-xs">{failureMessage}</p>
+            </GenericFieldLabel>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncOptionsSection/PkiSyncOptionsSection.tsx

@@ -0,0 +1,64 @@
+import { subject } from "@casl/ability";
+import { faEdit } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { Badge, IconButton } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+type Props = {
+  pkiSync: TPkiSync;
+  onEditOptions: VoidFunction;
+};
+
+export const PkiSyncOptionsSection = ({ pkiSync, onEditOptions }: Props) => {
+  const {
+    syncOptions: { canRemoveCertificates }
+  } = pkiSync;
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: pkiSync.subscriberId || ""
+  });
+
+  return (
+    <div>
+      <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
+        <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
+          <h3 className="font-semibold text-mineshaft-100">Sync Options</h3>
+          <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+            {(isAllowed) => (
+              <IconButton
+                variant="plain"
+                colorSchema="secondary"
+                isDisabled={!isAllowed}
+                ariaLabel="Edit sync options"
+                onClick={onEditOptions}
+              >
+                <FontAwesomeIcon icon={faEdit} />
+              </IconButton>
+            )}
+          </ProjectPermissionCan>
+        </div>
+        <div>
+          <div className="space-y-3">
+            {/* Hidden for now - Import certificates functionality disabled
+            <GenericFieldLabel label="Certificate Import">
+              <Badge variant={canImportCertificates ? "success" : "danger"}>
+                {canImportCertificates ? "Enabled" : "Disabled"}
+              </Badge>
+            </GenericFieldLabel>
+            */}
+            <GenericFieldLabel label="Certificate Removal">
+              <Badge variant={canRemoveCertificates ? "success" : "danger"}>
+                {canRemoveCertificates ? "Enabled" : "Disabled"}
+              </Badge>
+            </GenericFieldLabel>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncOptionsSection/index.ts

@@ -0,0 +1 @@
+export { PkiSyncOptionsSection } from "./PkiSyncOptionsSection";

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncSourceSection.tsx

@@ -0,0 +1,75 @@
+/* eslint-disable jsx-a11y/label-has-associated-control */
+import { subject } from "@casl/ability";
+import { faEdit, faTriangleExclamation } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Badge, IconButton, Tooltip } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
+import { TPkiSync } from "@app/hooks/api/pkiSyncs";
+
+const GenericFieldLabel = ({ label, children }: { label: string; children: React.ReactNode }) => (
+  <div>
+    <label className="text-sm text-bunker-300">{label}</label>
+    <div className="mt-1">{children}</div>
+  </div>
+);
+
+type Props = {
+  pkiSync: TPkiSync;
+  onEditSource: VoidFunction;
+};
+
+export const PkiSyncSourceSection = ({ pkiSync, onEditSource }: Props) => {
+  const { subscriberId, subscriber } = pkiSync;
+
+  const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
+    subscriberId: subscriberId || ""
+  });
+
+  return (
+    <div>
+      <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
+        <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
+          <h3 className="font-semibold text-mineshaft-100">Source</h3>
+          <div>
+            {!subscriberId && (
+              <Tooltip content="The PKI subscriber for this sync has been deleted. Configure a new source or remove this sync.">
+                <div className="mr-1 inline-block w-min">
+                  <Badge
+                    className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap"
+                    variant="primary"
+                  >
+                    <FontAwesomeIcon icon={faTriangleExclamation} />
+                    <span>Source Deleted</span>
+                  </Badge>
+                </div>
+              </Tooltip>
+            )}
+            <ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
+              {(isAllowed) => (
+                <IconButton
+                  variant="plain"
+                  colorSchema="secondary"
+                  isDisabled={!isAllowed}
+                  ariaLabel="Edit sync source"
+                  onClick={onEditSource}
+                >
+                  <FontAwesomeIcon icon={faEdit} />
+                </IconButton>
+              )}
+            </ProjectPermissionCan>
+          </div>
+        </div>
+        <div>
+          <div className="space-y-3">
+            <GenericFieldLabel label="PKI Subscriber">
+              {subscriber ? subscriber.name : "Deleted"}
+            </GenericFieldLabel>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+};

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/index.ts

@@ -0,0 +1,6 @@
+export { PkiSyncActionTriggers } from "./PkiSyncActionTriggers";
+export { PkiSyncAuditLogsSection } from "./PkiSyncAuditLogsSection";
+export { PkiSyncDestinationSection } from "./PkiSyncDestinationSection";
+export { PkiSyncDetailsSection } from "./PkiSyncDetailsSection";
+export { PkiSyncOptionsSection } from "./PkiSyncOptionsSection";
+export { PkiSyncSourceSection } from "./PkiSyncSourceSection";

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/index.tsx

@@ -0,0 +1 @@
+export { PkiSyncDetailsByIDPage } from "./PkiSyncDetailsByIDPage";

frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/route.tsx

@@ -0,0 +1,31 @@
+import { createFileRoute, linkOptions } from "@tanstack/react-router";
+
+import { IntegrationsListPageTabs } from "@app/types/integrations";
+
+import { PkiSyncDetailsByIDPage } from "./index";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/projects/cert-management/$projectId/_cert-manager-layout/integrations/$syncId"
+)({
+  component: PkiSyncDetailsByIDPage,
+  beforeLoad: ({ context, params }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Integrations",
+          link: linkOptions({
+            to: "/projects/cert-management/$projectId/integrations",
+            params,
+            search: {
+              selectedTab: IntegrationsListPageTabs.PkiSyncs
+            }
+          })
+        },
+        {
+          label: "PKI Sync"
+        }
+      ]
+    };
+  }
+});

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx

@@ -42,7 +42,14 @@ const schema = z.object({
     message: "Access Token Max TTL cannot be greater than 315360000"
   }),
   accessTokenNumUsesLimit: z.string(),
-  oidcDiscoveryUrl: z.string().url().min(1),
+  oidcDiscoveryUrl: z
+    .string()
+    .url()
+    .min(1)
+    .refine(
+      (el) => !el.endsWith("/.well-known/openid-configuration"),
+      "Please remove /.well-known/openid-configuration."
+    ),
   caCert: z.string().trim().default(""),
   boundIssuer: z.string().min(1),
   boundAudiences: z.string().optional().default(""),

frontend/src/pages/organization/Gateways/GatewayListPage/GatewayListPage.tsx

@@ -1,267 +0,0 @@
-import { useState } from "react";
-import { Helmet } from "react-helmet";
-import {
-  faArrowUpRightFromSquare,
-  faBookOpen,
-  faCopy,
-  faDoorClosed,
-  faEdit,
-  faEllipsisV,
-  faInfoCircle,
-  faMagnifyingGlass,
-  faSearch,
-  faTrash
-} from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { useQuery } from "@tanstack/react-query";
-import { formatRelative } from "date-fns";
-
-import { createNotification } from "@app/components/notifications";
-import { OrgPermissionCan } from "@app/components/permissions";
-import {
-  DeleteActionModal,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-  EmptyState,
-  IconButton,
-  Input,
-  Modal,
-  ModalContent,
-  PageHeader,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tooltip,
-  Tr
-} from "@app/components/v2";
-import {
-  OrgGatewayPermissionActions,
-  OrgPermissionAppConnectionActions,
-  OrgPermissionSubjects
-} from "@app/context/OrgPermissionContext/types";
-import { withPermission } from "@app/hoc";
-import { usePopUp } from "@app/hooks";
-import { gatewaysQueryKeys, useDeleteGatewayById } from "@app/hooks/api/gateways";
-import { useDeleteGatewayV2ById } from "@app/hooks/api/gateways-v2";
-
-import { EditGatewayDetailsModal } from "./components/EditGatewayDetailsModal";
-
-export const GatewayListPage = withPermission(
-  () => {
-    const [search, setSearch] = useState("");
-    const { data: gateways, isPending: isGatewaysLoading } = useQuery(gatewaysQueryKeys.list());
-
-    const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
-      "deleteGateway",
-      "editDetails"
-    ] as const);
-
-    const deleteGatewayById = useDeleteGatewayById();
-    const deleteGatewayV2ById = useDeleteGatewayV2ById();
-
-    const handleDeleteGateway = async () => {
-      const data = popUp.deleteGateway.data as { id: string; isV1: boolean };
-      if (data.isV1) {
-        await deleteGatewayById.mutateAsync(data.id);
-      } else {
-        await deleteGatewayV2ById.mutateAsync(data.id);
-      }
-
-      handlePopUpToggle("deleteGateway");
-      createNotification({
-        type: "success",
-        text: "Successfully deleted gateway"
-      });
-    };
-
-    const filteredGateway = gateways?.filter((el) =>
-      el.name.toLowerCase().includes(search.toLowerCase())
-    );
-
-    return (
-      <div className="bg-bunker-800">
-        <Helmet>
-          <title>Infisical | Gateways</title>
-          <meta property="og:image" content="/images/message.png" />
-        </Helmet>
-        <div className="flex w-full justify-center bg-bunker-800 text-white">
-          <div className="w-full max-w-7xl">
-            <PageHeader
-              className="w-full"
-              title={
-                <div className="flex w-full items-center">
-                  <span>Gateways</span>
-                  <a
-                    className="-mt-1.5"
-                    href="https://infisical.com/docs/documentation/platform/gateways/overview"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                  >
-                    <div className="ml-2 inline-block rounded-md bg-yellow/20 px-1.5 text-sm font-normal text-yellow opacity-80 hover:opacity-100">
-                      <FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
-                      <span>Docs</span>
-                      <FontAwesomeIcon
-                        icon={faArrowUpRightFromSquare}
-                        className="mb-[0.07rem] ml-1.5 text-[10px]"
-                      />
-                    </div>
-                  </a>
-                </div>
-              }
-              description="Create and configure gateway to access private network resources from Infisical"
-            />
-            <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-              <div>
-                <div className="flex gap-2">
-                  <Input
-                    value={search}
-                    onChange={(e) => setSearch(e.target.value)}
-                    leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
-                    placeholder="Search gateway..."
-                    className="flex-1"
-                  />
-                </div>
-                <TableContainer className="mt-4">
-                  <Table>
-                    <THead>
-                      <Tr>
-                        <Th className="w-1/3">Name</Th>
-                        <Th>Identity</Th>
-                        <Th>
-                          Health Check
-                          <Tooltip
-                            asChild={false}
-                            className="normal-case"
-                            content="The last known healthcheck. Triggers every 1 hour."
-                          >
-                            <FontAwesomeIcon icon={faInfoCircle} className="ml-2" />
-                          </Tooltip>
-                        </Th>
-                        <Th className="w-5" />
-                      </Tr>
-                    </THead>
-                    <TBody>
-                      {isGatewaysLoading && (
-                        <TableSkeleton innerKey="gateway-table" columns={4} key="gateway-table" />
-                      )}
-                      {filteredGateway?.map((el) => (
-                        <Tr key={el.id}>
-                          <Td>
-                            <div className="flex items-center gap-2">
-                              <span>{el.name}</span>
-                              <span className="rounded bg-mineshaft-700 px-1.5 py-0.5 text-xs text-mineshaft-400">
-                                Gateway v{el.isV1 ? "1" : "2"}
-                              </span>
-                            </div>
-                          </Td>
-                          <Td>{el.identity.name}</Td>
-                          <Td>
-                            {el.heartbeat
-                              ? formatRelative(new Date(el.heartbeat), new Date())
-                              : "-"}
-                          </Td>
-                          <Td className="w-5">
-                            <Tooltip className="max-w-sm text-center" content="Options">
-                              <DropdownMenu>
-                                <DropdownMenuTrigger asChild>
-                                  <IconButton
-                                    ariaLabel="Options"
-                                    colorSchema="secondary"
-                                    className="w-6"
-                                    variant="plain"
-                                  >
-                                    <FontAwesomeIcon icon={faEllipsisV} />
-                                  </IconButton>
-                                </DropdownMenuTrigger>
-                                <DropdownMenuContent align="end">
-                                  <DropdownMenuItem
-                                    icon={<FontAwesomeIcon icon={faCopy} />}
-                                    onClick={() => navigator.clipboard.writeText(el.id)}
-                                  >
-                                    Copy ID
-                                  </DropdownMenuItem>
-                                  {el.isV1 && (
-                                    <OrgPermissionCan
-                                      I={OrgGatewayPermissionActions.EditGateways}
-                                      a={OrgPermissionSubjects.Gateway}
-                                    >
-                                      {(isAllowed: boolean) => (
-                                        <DropdownMenuItem
-                                          isDisabled={!isAllowed}
-                                          icon={<FontAwesomeIcon icon={faEdit} />}
-                                          onClick={() => handlePopUpOpen("editDetails", el)}
-                                        >
-                                          Edit Details
-                                        </DropdownMenuItem>
-                                      )}
-                                    </OrgPermissionCan>
-                                  )}
-                                  <OrgPermissionCan
-                                    I={OrgPermissionAppConnectionActions.Delete}
-                                    a={OrgPermissionSubjects.AppConnections}
-                                  >
-                                    {(isAllowed: boolean) => (
-                                      <DropdownMenuItem
-                                        isDisabled={!isAllowed}
-                                        icon={<FontAwesomeIcon icon={faTrash} />}
-                                        className="text-red"
-                                        onClick={() => handlePopUpOpen("deleteGateway", el)}
-                                      >
-                                        Delete Gateway
-                                      </DropdownMenuItem>
-                                    )}
-                                  </OrgPermissionCan>
-                                </DropdownMenuContent>
-                              </DropdownMenu>
-                            </Tooltip>
-                          </Td>
-                        </Tr>
-                      ))}
-                    </TBody>
-                  </Table>
-                  <Modal
-                    isOpen={popUp.editDetails.isOpen}
-                    onOpenChange={(isOpen) => handlePopUpToggle("editDetails", isOpen)}
-                  >
-                    <ModalContent title="Edit Gateway">
-                      <EditGatewayDetailsModal
-                        gatewayDetails={popUp.editDetails.data}
-                        onClose={() => handlePopUpToggle("editDetails")}
-                      />
-                    </ModalContent>
-                  </Modal>
-                  {!isGatewaysLoading && !filteredGateway?.length && (
-                    <EmptyState
-                      title={
-                        gateways?.length
-                          ? "No Gateways match search..."
-                          : "No Gateways have been configured"
-                      }
-                      icon={gateways?.length ? faSearch : faDoorClosed}
-                    />
-                  )}
-                  <DeleteActionModal
-                    isOpen={popUp.deleteGateway.isOpen}
-                    title={`Are you sure you want to delete gateway ${
-                      (popUp?.deleteGateway?.data as { name: string })?.name || ""
-                    }?`}
-                    onChange={(isOpen) => handlePopUpToggle("deleteGateway", isOpen)}
-                    deleteKey="confirm"
-                    onDeleteApproved={() => handleDeleteGateway()}
-                  />
-                </TableContainer>
-              </div>
-            </div>
-          </div>
-        </div>
-      </div>
-    );
-  },
-  { action: OrgGatewayPermissionActions.ListGateways, subject: OrgPermissionSubjects.Gateway }
-);

frontend/src/pages/organization/Gateways/GatewayListPage/route.tsx

@@ -1,16 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import { GatewayListPage } from "./GatewayListPage";
-
-export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organization/gateways/"
-)({
-  component: GatewayListPage,
-  context: () => ({
-    breadcrumbs: [
-      {
-        label: "Gateways"
-      }
-    ]
-  })
-});

frontend/src/pages/organization/NetworkingPage/NetworkingPage.tsx

@@ -0,0 +1,25 @@
+import { Helmet } from "react-helmet";
+
+import { PageHeader } from "@app/components/v2";
+
+import { NetworkingTabGroup } from "./components/NetworkingTabGroup/NetworkingTabGroup";
+
+export const NetworkingPage = () => {
+  return (
+    <>
+      <Helmet>
+        <title>Infisical | Networking</title>
+        <meta property="og:image" content="/images/message.png" />
+      </Helmet>
+      <div className="flex w-full justify-center bg-bunker-800 text-white">
+        <div className="w-full max-w-7xl">
+          <PageHeader
+            title="Networking"
+            description="Manage gateways and relays to securely access private network resources from Infisical"
+          />
+          <NetworkingTabGroup />
+        </div>
+      </div>
+    </>
+  );
+};

frontend/src/pages/organization/NetworkingPage/components/GatewayTab/GatewayTab.tsx

@@ -0,0 +1,266 @@
+import { useState } from "react";
+import {
+  faArrowUpRightFromSquare,
+  faBookOpen,
+  faCopy,
+  faDoorClosed,
+  faEdit,
+  faEllipsisV,
+  faInfoCircle,
+  faMagnifyingGlass,
+  faSearch,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useQuery } from "@tanstack/react-query";
+
+import { createNotification } from "@app/components/notifications";
+import { OrgPermissionCan } from "@app/components/permissions";
+import {
+  DeleteActionModal,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  EmptyState,
+  IconButton,
+  Input,
+  Modal,
+  ModalContent,
+  Table,
+  TableContainer,
+  TableSkeleton,
+  TBody,
+  Td,
+  Th,
+  THead,
+  Tooltip,
+  Tr
+} from "@app/components/v2";
+import {
+  OrgGatewayPermissionActions,
+  OrgPermissionSubjects
+} from "@app/context/OrgPermissionContext/types";
+import { withPermission } from "@app/hoc";
+import { usePopUp } from "@app/hooks";
+import { gatewaysQueryKeys, useDeleteGatewayById } from "@app/hooks/api/gateways";
+import { useDeleteGatewayV2ById } from "@app/hooks/api/gateways-v2";
+
+import { EditGatewayDetailsModal } from "./components/EditGatewayDetailsModal";
+
+const GatewayHealthStatus = ({ heartbeat }: { heartbeat?: string }) => {
+  const heartbeatDate = heartbeat ? new Date(heartbeat) : null;
+  const now = new Date();
+  const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000);
+
+  const isHealthy = heartbeatDate && heartbeatDate >= oneHourAgo;
+  const tooltipContent = heartbeatDate
+    ? `Last heartbeat: ${heartbeatDate.toLocaleString()}`
+    : "No heartbeat data available";
+
+  return (
+    <Tooltip content={tooltipContent}>
+      <span className={`cursor-default ${isHealthy ? "text-green-400" : "text-red-400"}`}>
+        {isHealthy ? "Healthy" : "Unreachable"}
+      </span>
+    </Tooltip>
+  );
+};
+
+export const GatewayTab = withPermission(
+  () => {
+    const [search, setSearch] = useState("");
+    const { data: gateways, isPending: isGatewaysLoading } = useQuery(gatewaysQueryKeys.list());
+
+    const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+      "deleteGateway",
+      "editDetails"
+    ] as const);
+
+    const deleteGatewayById = useDeleteGatewayById();
+    const deleteGatewayV2ById = useDeleteGatewayV2ById();
+
+    const handleDeleteGateway = async () => {
+      const data = popUp.deleteGateway.data as { id: string; isV1: boolean };
+      if (data.isV1) {
+        await deleteGatewayById.mutateAsync(data.id);
+      } else {
+        await deleteGatewayV2ById.mutateAsync(data.id);
+      }
+
+      handlePopUpToggle("deleteGateway");
+      createNotification({
+        type: "success",
+        text: "Successfully deleted gateway"
+      });
+    };
+
+    const filteredGateway = gateways?.filter((el) =>
+      el.name.toLowerCase().includes(search.toLowerCase())
+    );
+
+    return (
+      <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+        <div className="mb-4 flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <h3 className="text-lg font-semibold text-mineshaft-100">Gateways</h3>
+            <a
+              href="https://infisical.com/docs/documentation/platform/gateways/overview"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              <div className="inline-block rounded-md bg-yellow/20 px-1.5 py-0.5 text-sm font-normal text-yellow opacity-80 hover:opacity-100">
+                <FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
+                <span>Docs</span>
+                <FontAwesomeIcon
+                  icon={faArrowUpRightFromSquare}
+                  className="mb-[0.07rem] ml-1.5 text-[10px]"
+                />
+              </div>
+            </a>
+          </div>
+        </div>
+        <p className="mb-4 text-sm text-mineshaft-400">
+          Create and configure gateway to access private network resources from Infisical
+        </p>
+        <div>
+          <div className="flex gap-2">
+            <Input
+              value={search}
+              onChange={(e) => setSearch(e.target.value)}
+              leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+              placeholder="Search gateway..."
+              className="flex-1"
+            />
+          </div>
+          <TableContainer className="mt-4">
+            <Table>
+              <THead>
+                <Tr>
+                  <Th className="w-1/2">Name</Th>
+                  <Th>
+                    Health Check
+                    <Tooltip
+                      asChild={false}
+                      className="normal-case"
+                      content="The last known healthcheck. Triggers every 1 hour."
+                    >
+                      <FontAwesomeIcon icon={faInfoCircle} className="ml-2" />
+                    </Tooltip>
+                  </Th>
+                  <Th className="w-5" />
+                </Tr>
+              </THead>
+              <TBody>
+                {isGatewaysLoading && (
+                  <TableSkeleton innerKey="gateway-table" columns={4} key="gateway-table" />
+                )}
+                {filteredGateway?.map((el) => (
+                  <Tr key={el.id}>
+                    <Td>
+                      <div className="flex items-center gap-2">
+                        <span>{el.name}</span>
+                        <span className="rounded bg-mineshaft-700 px-1.5 py-0.5 text-xs text-mineshaft-400">
+                          Gateway v{el.isV1 ? "1" : "2"}
+                        </span>
+                      </div>
+                    </Td>
+                    <Td>
+                      <GatewayHealthStatus heartbeat={el.heartbeat} />
+                    </Td>
+                    <Td className="w-5">
+                      <Tooltip className="max-w-sm text-center" content="Options">
+                        <DropdownMenu>
+                          <DropdownMenuTrigger asChild>
+                            <IconButton
+                              ariaLabel="Options"
+                              colorSchema="secondary"
+                              className="w-6"
+                              variant="plain"
+                            >
+                              <FontAwesomeIcon icon={faEllipsisV} />
+                            </IconButton>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent align="end">
+                            <DropdownMenuItem
+                              icon={<FontAwesomeIcon icon={faCopy} />}
+                              onClick={() => navigator.clipboard.writeText(el.id)}
+                            >
+                              Copy ID
+                            </DropdownMenuItem>
+                            {el.isV1 && (
+                              <OrgPermissionCan
+                                I={OrgGatewayPermissionActions.EditGateways}
+                                a={OrgPermissionSubjects.Gateway}
+                              >
+                                {(isAllowed: boolean) => (
+                                  <DropdownMenuItem
+                                    isDisabled={!isAllowed}
+                                    icon={<FontAwesomeIcon icon={faEdit} />}
+                                    onClick={() => handlePopUpOpen("editDetails", el)}
+                                  >
+                                    Edit Details
+                                  </DropdownMenuItem>
+                                )}
+                              </OrgPermissionCan>
+                            )}
+                            <OrgPermissionCan
+                              I={OrgGatewayPermissionActions.DeleteGateways}
+                              a={OrgPermissionSubjects.Gateway}
+                            >
+                              {(isAllowed: boolean) => (
+                                <DropdownMenuItem
+                                  isDisabled={!isAllowed}
+                                  icon={<FontAwesomeIcon icon={faTrash} />}
+                                  className="text-red"
+                                  onClick={() => handlePopUpOpen("deleteGateway", el)}
+                                >
+                                  Delete Gateway
+                                </DropdownMenuItem>
+                              )}
+                            </OrgPermissionCan>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      </Tooltip>
+                    </Td>
+                  </Tr>
+                ))}
+              </TBody>
+            </Table>
+            <Modal
+              isOpen={popUp.editDetails.isOpen}
+              onOpenChange={(isOpen) => handlePopUpToggle("editDetails", isOpen)}
+            >
+              <ModalContent title="Edit Gateway">
+                <EditGatewayDetailsModal
+                  gatewayDetails={popUp.editDetails.data}
+                  onClose={() => handlePopUpToggle("editDetails")}
+                />
+              </ModalContent>
+            </Modal>
+            {!isGatewaysLoading && !filteredGateway?.length && (
+              <EmptyState
+                title={
+                  gateways?.length
+                    ? "No Gateways match search..."
+                    : "No Gateways have been configured"
+                }
+                icon={gateways?.length ? faSearch : faDoorClosed}
+              />
+            )}
+            <DeleteActionModal
+              isOpen={popUp.deleteGateway.isOpen}
+              title={`Are you sure you want to delete gateway ${
+                (popUp?.deleteGateway?.data as { name: string })?.name || ""
+              }?`}
+              onChange={(isOpen) => handlePopUpToggle("deleteGateway", isOpen)}
+              deleteKey="confirm"
+              onDeleteApproved={() => handleDeleteGateway()}
+            />
+          </TableContainer>
+        </div>
+      </div>
+    );
+  },
+  { action: OrgGatewayPermissionActions.ListGateways, subject: OrgPermissionSubjects.Gateway }
+);

frontend/src/pages/organization/NetworkingPage/components/GatewayTab/index.tsx

@@ -0,0 +1 @@
+export { GatewayTab } from "./GatewayTab";

frontend/src/pages/organization/NetworkingPage/components/NetworkingTabGroup/NetworkingTabGroup.tsx

@@ -0,0 +1,37 @@
+import { useState } from "react";
+import { useSearch } from "@tanstack/react-router";
+
+import { Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
+
+import { GatewayTab } from "../GatewayTab/GatewayTab";
+import { RelayTab } from "../RelayTab/RelayTab";
+
+export const NetworkingTabGroup = () => {
+  const search = useSearch({
+    from: "/_authenticate/_inject-org-details/_org-layout/organization/networking/"
+  });
+
+  const tabs = [
+    { name: "Gateways", key: "gateways", component: GatewayTab },
+    { name: "Relays", key: "relays", component: RelayTab }
+  ];
+
+  const [selectedTab, setSelectedTab] = useState(search.selectedTab || tabs[0].key);
+
+  return (
+    <Tabs value={selectedTab} onValueChange={setSelectedTab}>
+      <TabList>
+        {tabs.map((tab) => (
+          <Tab value={tab.key} key={tab.key}>
+            {tab.name}
+          </Tab>
+        ))}
+      </TabList>
+      {tabs.map(({ key, component: Component }) => (
+        <TabPanel value={key} key={`tab-panel-${key}`}>
+          <Component />
+        </TabPanel>
+      ))}
+    </Tabs>
+  );
+};

frontend/src/pages/organization/NetworkingPage/components/NetworkingTabGroup/index.tsx

@@ -0,0 +1 @@
+export { NetworkingTabGroup } from "./NetworkingTabGroup";

frontend/src/pages/organization/NetworkingPage/components/RelayTab/RelayTab.tsx

@@ -0,0 +1,198 @@
+import { useState } from "react";
+import {
+  faArrowUpRightFromSquare,
+  faBookOpen,
+  faCopy,
+  faDoorClosed,
+  faEllipsisV,
+  faMagnifyingGlass,
+  faSearch,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { formatRelative } from "date-fns";
+
+import { createNotification } from "@app/components/notifications";
+import { OrgPermissionCan } from "@app/components/permissions";
+import {
+  DeleteActionModal,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  EmptyState,
+  IconButton,
+  Input,
+  Table,
+  TableContainer,
+  TableSkeleton,
+  TBody,
+  Td,
+  Th,
+  THead,
+  Tooltip,
+  Tr
+} from "@app/components/v2";
+import {
+  OrgPermissionSubjects,
+  OrgRelayPermissionActions
+} from "@app/context/OrgPermissionContext/types";
+import { withPermission } from "@app/hoc";
+import { usePopUp } from "@app/hooks";
+import { useDeleteRelayById, useGetRelays } from "@app/hooks/api/relays";
+
+export const RelayTab = withPermission(
+  () => {
+    const [search, setSearch] = useState("");
+    const { data: relays, isPending: isRelaysLoading } = useGetRelays();
+
+    const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["deleteRelay"] as const);
+
+    const deleteRelayById = useDeleteRelayById();
+
+    const handleDeleteRelay = async () => {
+      const data = popUp.deleteRelay.data as { id: string };
+      await deleteRelayById.mutateAsync(data.id);
+
+      handlePopUpToggle("deleteRelay");
+      createNotification({
+        type: "success",
+        text: "Successfully deleted relay"
+      });
+    };
+
+    const filteredRelays = relays?.filter((el) =>
+      el.name.toLowerCase().includes(search.toLowerCase())
+    );
+
+    return (
+      <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+        <div className="mb-4 flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <h3 className="text-lg font-semibold text-mineshaft-100">Relays</h3>
+            <a
+              href="https://infisical.com/docs/documentation/platform/gateways/relay-deployment"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              <div className="inline-block rounded-md bg-yellow/20 px-1.5 py-0.5 text-sm font-normal text-yellow opacity-80 hover:opacity-100">
+                <FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
+                <span>Docs</span>
+                <FontAwesomeIcon
+                  icon={faArrowUpRightFromSquare}
+                  className="mb-[0.07rem] ml-1.5 text-[10px]"
+                />
+              </div>
+            </a>
+          </div>
+        </div>
+        <p className="mb-4 text-sm text-mineshaft-400">
+          Create and configure relays to securely access private network resources from Infisical
+        </p>
+        <div>
+          <div className="flex gap-2">
+            <Input
+              value={search}
+              onChange={(e) => setSearch(e.target.value)}
+              leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+              placeholder="Search relay..."
+              className="flex-1"
+            />
+          </div>
+          <TableContainer className="mt-4">
+            <Table>
+              <THead>
+                <Tr>
+                  <Th className="w-1/3">Name</Th>
+                  <Th>Host</Th>
+                  <Th>Created</Th>
+                  <Th className="w-5" />
+                </Tr>
+              </THead>
+              <TBody>
+                {isRelaysLoading && (
+                  <TableSkeleton innerKey="relay-table" columns={4} key="relay-table" />
+                )}
+                {filteredRelays?.map((el) => (
+                  <Tr key={el.id}>
+                    <Td>
+                      <div className="flex items-center gap-2">
+                        <span>{el.name}</span>
+                        {!el.orgId && (
+                          <Tooltip content="This is a managed relay provided by Infisical">
+                            <span className="rounded bg-mineshaft-700 px-1.5 py-0.5 text-xs text-mineshaft-400">
+                              Managed
+                            </span>
+                          </Tooltip>
+                        )}
+                      </div>
+                    </Td>
+                    <Td>{el.host}</Td>
+                    <Td>{formatRelative(new Date(el.createdAt), new Date())}</Td>
+                    <Td className="w-5">
+                      <Tooltip className="max-w-sm text-center" content="Options">
+                        <DropdownMenu>
+                          <DropdownMenuTrigger asChild>
+                            <IconButton
+                              ariaLabel="Options"
+                              colorSchema="secondary"
+                              className="w-6"
+                              variant="plain"
+                            >
+                              <FontAwesomeIcon icon={faEllipsisV} />
+                            </IconButton>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent align="end">
+                            <DropdownMenuItem
+                              icon={<FontAwesomeIcon icon={faCopy} />}
+                              onClick={() => navigator.clipboard.writeText(el.id)}
+                            >
+                              Copy ID
+                            </DropdownMenuItem>
+                            <OrgPermissionCan
+                              I={OrgRelayPermissionActions.DeleteRelays}
+                              a={OrgPermissionSubjects.Relay}
+                            >
+                              {(isAllowed: boolean) => (
+                                <DropdownMenuItem
+                                  isDisabled={!isAllowed || !el.orgId}
+                                  icon={<FontAwesomeIcon icon={faTrash} />}
+                                  className="text-red"
+                                  onClick={() => handlePopUpOpen("deleteRelay", el)}
+                                >
+                                  Delete Relay
+                                </DropdownMenuItem>
+                              )}
+                            </OrgPermissionCan>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      </Tooltip>
+                    </Td>
+                  </Tr>
+                ))}
+              </TBody>
+            </Table>
+            {!isRelaysLoading && !filteredRelays?.length && (
+              <EmptyState
+                title={
+                  relays?.length ? "No Relays match search..." : "No Relays have been configured"
+                }
+                icon={relays?.length ? faSearch : faDoorClosed}
+              />
+            )}
+            <DeleteActionModal
+              isOpen={popUp.deleteRelay.isOpen}
+              title={`Are you sure you want to delete relay ${
+                (popUp?.deleteRelay?.data as { name: string })?.name || ""
+              }?`}
+              onChange={(isOpen) => handlePopUpToggle("deleteRelay", isOpen)}
+              deleteKey="confirm"
+              onDeleteApproved={() => handleDeleteRelay()}
+            />
+          </TableContainer>
+        </div>
+      </div>
+    );
+  },
+  { action: OrgRelayPermissionActions.ListRelays, subject: OrgPermissionSubjects.Relay }
+);

frontend/src/pages/organization/NetworkingPage/components/RelayTab/index.tsx

@@ -0,0 +1 @@
+export { RelayTab } from "./RelayTab";

frontend/src/pages/organization/NetworkingPage/components/index.tsx

@@ -0,0 +1,3 @@
+export { GatewayTab } from "./GatewayTab/GatewayTab";
+export { NetworkingTabGroup } from "./NetworkingTabGroup/NetworkingTabGroup";
+export { RelayTab } from "./RelayTab/RelayTab";

frontend/src/pages/organization/NetworkingPage/route.tsx

@@ -0,0 +1,26 @@
+import { createFileRoute, stripSearchParams } from "@tanstack/react-router";
+import { zodValidator } from "@tanstack/zod-adapter";
+import { z } from "zod";
+
+import { NetworkingPage } from "./NetworkingPage";
+
+const NetworkingPageQueryParams = z.object({
+  selectedTab: z.string().catch("")
+});
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organization/networking/"
+)({
+  component: NetworkingPage,
+  validateSearch: zodValidator(NetworkingPageQueryParams),
+  search: {
+    middlewares: [stripSearchParams({ selectedTab: "" })]
+  },
+  context: () => ({
+    breadcrumbs: [
+      {
+        label: "Networking"
+      }
+    ]
+  })
+});

frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts

@@ -11,7 +11,8 @@ import {
   OrgPermissionIdentityActions,
   OrgPermissionKmipActions,
   OrgPermissionMachineIdentityAuthTemplateActions,
-  OrgPermissionSecretShareAction
+  OrgPermissionSecretShareAction,
+  OrgRelayPermissionActions
 } from "@app/context/OrgPermissionContext/types";
 import { TPermission } from "@app/hooks/api/roles/types";
 
@@ -90,6 +91,15 @@ const orgGatewayPermissionSchema = z
   })
   .optional();
 
+const orgRelayPermissionSchema = z
+  .object({
+    [OrgRelayPermissionActions.ListRelays]: z.boolean().optional(),
+    [OrgRelayPermissionActions.EditRelays]: z.boolean().optional(),
+    [OrgRelayPermissionActions.DeleteRelays]: z.boolean().optional(),
+    [OrgRelayPermissionActions.CreateRelays]: z.boolean().optional()
+  })
+  .optional();
+
 const machineIdentityAuthTemplatePermissionSchema = z
   .object({
     [OrgPermissionMachineIdentityAuthTemplateActions.ListTemplates]: z.boolean().optional(),
@@ -147,6 +157,7 @@ export const formSchema = z.object({
       "app-connections": appConnectionsPermissionSchema,
       kmip: kmipPermissionSchema,
       gateway: orgGatewayPermissionSchema,
+      relay: orgRelayPermissionSchema,
       "machine-identity-auth-template": machineIdentityAuthTemplatePermissionSchema,
       "secret-share": secretSharingPermissionSchema
     })

frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionRelayRow.tsx

@@ -0,0 +1,180 @@
+import { useEffect, useMemo } from "react";
+import { Control, Controller, UseFormSetValue, useWatch } from "react-hook-form";
+import { faChevronDown, faChevronRight } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import { Checkbox, Select, SelectItem, Td, Tr } from "@app/components/v2";
+import { OrgRelayPermissionActions } from "@app/context/OrgPermissionContext/types";
+import { useToggle } from "@app/hooks";
+
+import { TFormSchema } from "../OrgRoleModifySection.utils";
+
+type Props = {
+  isEditable: boolean;
+  setValue: UseFormSetValue<TFormSchema>;
+  control: Control<TFormSchema>;
+};
+
+enum Permission {
+  NoAccess = "no-access",
+  ReadOnly = "read-only",
+  FullAccess = "full-access",
+  Custom = "custom"
+}
+
+const PERMISSION_ACTIONS = [
+  { action: OrgRelayPermissionActions.ListRelays, label: "List Relays" },
+  { action: OrgRelayPermissionActions.CreateRelays, label: "Create Relays" },
+  { action: OrgRelayPermissionActions.EditRelays, label: "Edit Relays" },
+  { action: OrgRelayPermissionActions.DeleteRelays, label: "Delete Relays" }
+] as const;
+
+export const OrgRelayPermissionRow = ({ isEditable, control, setValue }: Props) => {
+  const [isRowExpanded, setIsRowExpanded] = useToggle();
+  const [isCustom, setIsCustom] = useToggle();
+
+  const rule = useWatch({
+    control,
+    name: "permissions.relay"
+  });
+
+  const selectedPermissionCategory = useMemo(() => {
+    const actions = Object.keys(rule || {}) as Array<keyof typeof rule>;
+    const totalActions = PERMISSION_ACTIONS.length;
+    const score = actions.map((key) => (rule?.[key] ? 1 : 0)).reduce((a, b) => a + b, 0 as number);
+
+    if (isCustom) return Permission.Custom;
+    if (score === 0) return Permission.NoAccess;
+    if (score === totalActions) return Permission.FullAccess;
+    if (score === 1 && rule?.[OrgRelayPermissionActions.ListRelays]) return Permission.ReadOnly;
+
+    return Permission.Custom;
+  }, [rule, isCustom]);
+
+  useEffect(() => {
+    if (selectedPermissionCategory === Permission.Custom) setIsCustom.on();
+    else setIsCustom.off();
+  }, [selectedPermissionCategory]);
+
+  useEffect(() => {
+    const isRowCustom = selectedPermissionCategory === Permission.Custom;
+    if (isRowCustom) {
+      setIsRowExpanded.on();
+    }
+  }, []);
+
+  const handlePermissionChange = (val: Permission) => {
+    if (!val) return;
+    if (val === Permission.Custom) {
+      setIsRowExpanded.on();
+      setIsCustom.on();
+      return;
+    }
+    setIsCustom.off();
+
+    switch (val) {
+      case Permission.FullAccess:
+        setValue(
+          "permissions.relay",
+          {
+            [OrgRelayPermissionActions.ListRelays]: true,
+            [OrgRelayPermissionActions.EditRelays]: true,
+            [OrgRelayPermissionActions.CreateRelays]: true,
+            [OrgRelayPermissionActions.DeleteRelays]: true
+          },
+          { shouldDirty: true }
+        );
+        break;
+      case Permission.ReadOnly:
+        setValue(
+          "permissions.relay",
+          {
+            [OrgRelayPermissionActions.ListRelays]: true,
+            [OrgRelayPermissionActions.EditRelays]: false,
+            [OrgRelayPermissionActions.CreateRelays]: false,
+            [OrgRelayPermissionActions.DeleteRelays]: false
+          },
+          { shouldDirty: true }
+        );
+        break;
+
+      case Permission.NoAccess:
+      default:
+        setValue(
+          "permissions.relay",
+          {
+            [OrgRelayPermissionActions.ListRelays]: false,
+            [OrgRelayPermissionActions.EditRelays]: false,
+            [OrgRelayPermissionActions.CreateRelays]: false,
+            [OrgRelayPermissionActions.DeleteRelays]: false
+          },
+          { shouldDirty: true }
+        );
+    }
+  };
+
+  return (
+    <>
+      <Tr
+        className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
+        onClick={() => setIsRowExpanded.toggle()}
+      >
+        <Td className="w-4">
+          <FontAwesomeIcon className="w-4" icon={isRowExpanded ? faChevronDown : faChevronRight} />
+        </Td>
+        <Td className="w-full select-none">Relays</Td>
+        <Td>
+          <Select
+            value={selectedPermissionCategory}
+            className="h-8 w-40 bg-mineshaft-700"
+            dropdownContainerClassName="border text-left border-mineshaft-600 bg-mineshaft-800"
+            onValueChange={handlePermissionChange}
+            isDisabled={!isEditable}
+            position="popper"
+          >
+            <SelectItem value={Permission.NoAccess}>No Access</SelectItem>
+            <SelectItem value={Permission.ReadOnly}>Read Only</SelectItem>
+            <SelectItem value={Permission.FullAccess}>Full Access</SelectItem>
+            <SelectItem value={Permission.Custom}>Custom</SelectItem>
+          </Select>
+        </Td>
+      </Tr>
+      {isRowExpanded && (
+        <Tr>
+          <Td colSpan={3} className="border-mineshaft-500 bg-mineshaft-900 p-8">
+            <div className="flex flex-grow flex-wrap justify-start gap-x-8 gap-y-4">
+              {PERMISSION_ACTIONS.map(({ action, label }) => {
+                return (
+                  <Controller
+                    name={`permissions.relay.${action}`}
+                    key={`permissions.relay.${action}`}
+                    control={control}
+                    render={({ field }) => (
+                      <Checkbox
+                        isChecked={Boolean(field.value)}
+                        onCheckedChange={(e) => {
+                          if (!isEditable) {
+                            createNotification({
+                              type: "error",
+                              text: "Failed to update default role"
+                            });
+                            return;
+                          }
+                          field.onChange(e);
+                        }}
+                        id={`permissions.relay.${action}`}
+                      >
+                        {label}
+                      </Checkbox>
+                    )}
+                  />
+                );
+              })}
+            </div>
+          </Td>
+        </Tr>
+      )}
+    </>
+  );
+};

frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionRow.tsx

@@ -69,6 +69,7 @@ type Props = {
     | "organization-admin-console"
     | "kmip"
     | "gateway"
+    | "relay"
     | "secret-share"
     | "billing"
     | "audit-logs"

frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx

@@ -23,6 +23,7 @@ import { OrgPermissionGroupRow } from "./OrgPermissionGroupRow";
 import { OrgPermissionIdentityRow } from "./OrgPermissionIdentityRow";
 import { OrgPermissionKmipRow } from "./OrgPermissionKmipRow";
 import { OrgPermissionMachineIdentityAuthTemplateRow } from "./OrgPermissionMachineIdentityAuthTemplateRow";
+import { OrgRelayPermissionRow } from "./OrgPermissionRelayRow";
 import { OrgPermissionSecretShareRow } from "./OrgPermissionSecretShareRow";
 import { OrgRoleWorkspaceRow } from "./OrgRoleWorkspaceRow";
 import { RolePermissionRow } from "./RolePermissionRow";
@@ -188,6 +189,11 @@ export const RolePermissionsSection = ({ roleId }: Props) => {
                 setValue={setValue}
                 isEditable={isCustomRole}
               />
+              <OrgRelayPermissionRow
+                control={control}
+                setValue={setValue}
+                isEditable={isCustomRole}
+              />
               <OrgPermissionBillingRow
                 control={control}
                 setValue={setValue}

frontend/src/pages/project/RoleDetailsBySlugPage/components/ConditionsFields.tsx

@@ -41,12 +41,12 @@ export const ConditionsFields = ({
   } = useFormContext<TFormSchema>();
   const items = useFieldArray({
     control,
-    name: `permissions.${subject}.${position}.conditions`
+    name: `permissions.${subject}.${position}.conditions` as const
   });
 
   const conditionErrorMessage =
-    errors?.permissions?.[subject]?.[position]?.conditions?.message ||
-    errors?.permissions?.[subject]?.[position]?.conditions?.root?.message;
+    (errors?.permissions as any)?.[subject]?.[position]?.conditions?.message ||
+    (errors?.permissions as any)?.[subject]?.[position]?.conditions?.root?.message;
 
   return (
     <div className="mt-6 border-t border-t-mineshaft-600 bg-mineshaft-800 pt-2">
@@ -91,7 +91,7 @@ export const ConditionsFields = ({
         {Boolean(items.fields.length) &&
           items.fields.map((el, index) => {
             const condition =
-              (watch(`permissions.${subject}.${position}.conditions.${index}`) as {
+              (watch(`permissions.${subject}.${position}.conditions.${index}` as const) as {
                 lhs: string;
                 rhs: string;
                 operator: string;
@@ -104,7 +104,7 @@ export const ConditionsFields = ({
                 <div className="w-1/4">
                   <Controller
                     control={control}
-                    name={`permissions.${subject}.${position}.conditions.${index}.lhs`}
+                    name={`permissions.${subject}.${position}.conditions.${index}.lhs` as const}
                     render={({ field, fieldState: { error } }) => (
                       <FormControl
                         isError={Boolean(error?.message)}
@@ -116,7 +116,7 @@ export const ConditionsFields = ({
                           {...field}
                           onValueChange={(e) => {
                             setValue(
-                              `permissions.${subject}.${position}.conditions.${index}.operator`,
+                              `permissions.${subject}.${position}.conditions.${index}.operator` as const,
                               PermissionConditionOperators.$IN as never
                             );
                             field.onChange(e);
@@ -137,7 +137,9 @@ export const ConditionsFields = ({
                 <div className="flex w-44 items-center space-x-2">
                   <Controller
                     control={control}
-                    name={`permissions.${subject}.${position}.conditions.${index}.operator`}
+                    name={
+                      `permissions.${subject}.${position}.conditions.${index}.operator` as const
+                    }
                     render={({ field, fieldState: { error } }) => (
                       <FormControl
                         isError={Boolean(error?.message)}
@@ -171,7 +173,7 @@ export const ConditionsFields = ({
                 <div className="flex-grow">
                   <Controller
                     control={control}
-                    name={`permissions.${subject}.${position}.conditions.${index}.rhs`}
+                    name={`permissions.${subject}.${position}.conditions.${index}.rhs` as const}
                     render={({ field, fieldState: { error } }) => (
                       <FormControl
                         isError={Boolean(error?.message)}

frontend/src/pages/project/RoleDetailsBySlugPage/components/PkiSyncPermissionConditions.tsx

@@ -0,0 +1,19 @@
+import { ProjectPermissionSub } from "@app/context/ProjectPermissionContext/types";
+
+import { ConditionsFields } from "./ConditionsFields";
+
+type Props = {
+  position?: number;
+  isDisabled?: boolean;
+};
+
+export const PkiSyncPermissionConditions = ({ position = 0, isDisabled }: Props) => {
+  return (
+    <ConditionsFields
+      isDisabled={isDisabled}
+      subject={ProjectPermissionSub.PkiSyncs}
+      position={position}
+      selectOptions={[{ value: "subscriberName", label: "Subscriber Name" }]}
+    />
+  );
+};

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx

@@ -21,6 +21,7 @@ import {
   ProjectPermissionKmipActions,
   ProjectPermissionMemberActions,
   ProjectPermissionPkiSubscriberActions,
+  ProjectPermissionPkiSyncActions,
   ProjectPermissionPkiTemplateActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSecretEventActions,
@@ -101,6 +102,16 @@ const SecretSyncPolicyActionSchema = z.object({
   [ProjectPermissionSecretSyncActions.RemoveSecrets]: z.boolean().optional()
 });
 
+const PkiSyncPolicyActionSchema = z.object({
+  [ProjectPermissionPkiSyncActions.Read]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.Create]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.Edit]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.Delete]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.SyncCertificates]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.ImportCertificates]: z.boolean().optional(),
+  [ProjectPermissionPkiSyncActions.RemoveCertificates]: z.boolean().optional()
+});
+
 const CommitPolicyActionSchema = z.object({
   [ProjectPermissionCommitsActions.Read]: z.boolean().optional(),
   [ProjectPermissionCommitsActions.PerformRollback]: z.boolean().optional()
@@ -326,6 +337,12 @@ export const projectRoleFormSchema = z.object({
       })
         .array()
         .default([]),
+      [ProjectPermissionSub.PkiSyncs]: PkiSyncPolicyActionSchema.extend({
+        inverted: z.boolean().optional(),
+        conditions: ConditionSchema
+      })
+        .array()
+        .default([]),
 
       [ProjectPermissionSub.Commits]: CommitPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Member]: MemberPolicyActionSchema.array().default([]),
@@ -408,6 +425,7 @@ type TConditionalFields =
   | ProjectPermissionSub.SecretRotation
   | ProjectPermissionSub.Identity
   | ProjectPermissionSub.SecretSyncs
+  | ProjectPermissionSub.PkiSyncs
   | ProjectPermissionSub.SecretEvents
   | ProjectPermissionSub.AppConnections;
 
@@ -424,6 +442,7 @@ export const isConditionalSubjects = (
   subject === ProjectPermissionSub.PkiSubscribers ||
   subject === ProjectPermissionSub.CertificateTemplates ||
   subject === ProjectPermissionSub.SecretSyncs ||
+  subject === ProjectPermissionSub.PkiSyncs ||
   subject === ProjectPermissionSub.SecretEvents ||
   subject === ProjectPermissionSub.AppConnections;
 
@@ -532,6 +551,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ProjectPermissionSub.SshCertificates,
         ProjectPermissionSub.SshHostGroups,
         ProjectPermissionSub.SecretSyncs,
+        ProjectPermissionSub.PkiSyncs,
         ProjectPermissionSub.SecretEvents,
         ProjectPermissionSub.AppConnections
       ].includes(subject)
@@ -594,6 +614,38 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
           return;
         }
 
+        if (subject === ProjectPermissionSub.PkiSyncs) {
+          const canRead = action.includes(ProjectPermissionPkiSyncActions.Read);
+          const canEdit = action.includes(ProjectPermissionPkiSyncActions.Edit);
+          const canDelete = action.includes(ProjectPermissionPkiSyncActions.Delete);
+          const canCreate = action.includes(ProjectPermissionPkiSyncActions.Create);
+          const canSyncCertificates = action.includes(
+            ProjectPermissionPkiSyncActions.SyncCertificates
+          );
+          const canImportCertificates = action.includes(
+            ProjectPermissionPkiSyncActions.ImportCertificates
+          );
+          const canRemoveCertificates = action.includes(
+            ProjectPermissionPkiSyncActions.RemoveCertificates
+          );
+
+          if (!formVal[subject]) formVal[subject] = [{ conditions: [], inverted: false }];
+
+          // from above statement we are sure it won't be undefined
+          formVal[subject]!.push({
+            [ProjectPermissionPkiSyncActions.Read]: canRead,
+            [ProjectPermissionPkiSyncActions.Create]: canCreate,
+            [ProjectPermissionPkiSyncActions.Edit]: canEdit,
+            [ProjectPermissionPkiSyncActions.Delete]: canDelete,
+            [ProjectPermissionPkiSyncActions.SyncCertificates]: canSyncCertificates,
+            [ProjectPermissionPkiSyncActions.ImportCertificates]: canImportCertificates,
+            [ProjectPermissionPkiSyncActions.RemoveCertificates]: canRemoveCertificates,
+            conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
+            inverted
+          });
+          return;
+        }
+
         if (subject === ProjectPermissionSub.DynamicSecrets) {
           const canRead = action.includes(ProjectPermissionDynamicSecretActions.ReadRootCredential);
           const canEdit = action.includes(ProjectPermissionDynamicSecretActions.EditRootCredential);
@@ -1532,6 +1584,24 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       }
     ]
   },
+  [ProjectPermissionSub.PkiSyncs]: {
+    title: "Certificate Syncs",
+    actions: [
+      { label: "Read", value: ProjectPermissionPkiSyncActions.Read },
+      { label: "Create", value: ProjectPermissionPkiSyncActions.Create },
+      { label: "Modify", value: ProjectPermissionPkiSyncActions.Edit },
+      { label: "Remove", value: ProjectPermissionPkiSyncActions.Delete },
+      { label: "Trigger Syncs", value: ProjectPermissionPkiSyncActions.SyncCertificates },
+      {
+        label: "Import Certificates from Destination",
+        value: ProjectPermissionPkiSyncActions.ImportCertificates
+      },
+      {
+        label: "Remove Certificates from Destination",
+        value: ProjectPermissionPkiSyncActions.RemoveCertificates
+      }
+    ]
+  },
   [ProjectPermissionSub.Kmip]: {
     title: "KMIP",
     actions: [
@@ -1703,6 +1773,7 @@ const CertificateManagerPermissionSubjects = (enabled = false) => ({
   [ProjectPermissionSub.PkiCollections]: enabled,
   [ProjectPermissionSub.PkiAlerts]: enabled,
   [ProjectPermissionSub.PkiSubscribers]: enabled,
+  [ProjectPermissionSub.PkiSyncs]: enabled,
   [ProjectPermissionSub.CertificateAuthorities]: enabled,
   [ProjectPermissionSub.CertificateTemplates]: enabled,
   [ProjectPermissionSub.Certificates]: enabled
@@ -1950,6 +2021,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
             ProjectPermissionCertificateActions.Read,
             ProjectPermissionCertificateActions.ReadPrivateKey
           ]
+        },
+        {
+          subject: ProjectPermissionSub.PkiSyncs,
+          actions: [ProjectPermissionPkiSyncActions.Read]
         }
       ]
     },
@@ -1977,6 +2052,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
         {
           subject: ProjectPermissionSub.Certificates,
           actions: Object.values(ProjectPermissionCertificateActions)
+        },
+        {
+          subject: ProjectPermissionSub.PkiSyncs,
+          actions: Object.values(ProjectPermissionPkiSyncActions)
         }
       ]
     },

frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx

@@ -23,6 +23,7 @@ import { GeneralPermissionPolicies } from "./GeneralPermissionPolicies";
 import { IdentityManagementPermissionConditions } from "./IdentityManagementPermissionConditions";
 import { PermissionEmptyState } from "./PermissionEmptyState";
 import { PkiSubscriberPermissionConditions } from "./PkiSubscriberPermissionConditions";
+import { PkiSyncPermissionConditions } from "./PkiSyncPermissionConditions";
 import { PkiTemplatePermissionConditions } from "./PkiTemplatePermissionConditions";
 import {
   EXCLUDED_PERMISSION_SUBS,
@@ -74,6 +75,10 @@ export const renderConditionalComponents = (
       return <SecretSyncPermissionConditions isDisabled={isDisabled} />;
     }
 
+    if (subject === ProjectPermissionSub.PkiSyncs) {
+      return <PkiSyncPermissionConditions isDisabled={isDisabled} />;
+    }
+
     if (subject === ProjectPermissionSub.SecretEvents) {
       return <SecretEventPermissionConditions isDisabled={isDisabled} />;
     }

frontend/src/pages/secret-manager/IntegrationsListPage/IntegrationsListPage.tsx

@@ -28,7 +28,9 @@ export const IntegrationsListPage = () => {
   const updateSelectedTab = (tab: string) => {
     navigate({
       to: ROUTE_PATHS.SecretManager.IntegrationsListPage.path,
-      search: (prev) => ({ ...prev, selectedTab: tab as IntegrationsListPageTabs }),
+      search: {
+        selectedTab: tab as IntegrationsListPageTabs
+      },
       params: {
         projectId: currentProject.id
       }

frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx

@@ -349,9 +349,7 @@ export const OverviewPage = () => {
     getSecretRotationStatusesByName
   } = useSecretRotationOverview(secretRotations);
 
-  const { secKeys, getEnvSecretKeyCount } = useSecretOverview(
-    secrets?.concat(secretImportsShaped) || []
-  );
+  const { secKeys, getEnvSecretKeyCount } = useSecretOverview(secrets || []);
 
   const getSecretByKey = useCallback(
     (env: string, key: string) => {

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewSecretRotationRow/SecretOverviewRotationSecretRow.tsx

@@ -0,0 +1,77 @@
+import { twMerge } from "tailwind-merge";
+
+import { SecretInput, Tooltip } from "@app/components/v2";
+import { Blur } from "@app/components/v2/Blur";
+import { useProject } from "@app/context";
+import { useToggle } from "@app/hooks";
+import { useGetSecretValue } from "@app/hooks/api/dashboard/queries";
+import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types";
+import { HIDDEN_SECRET_VALUE } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";
+
+interface SecretOverviewRotationSecretRowProps {
+  secret: SecretV3RawSanitized | null;
+  isSecretVisible: boolean;
+  environment: string;
+  secretPath: string;
+}
+
+export const SecretOverviewRotationSecretRow = ({
+  secret,
+  isSecretVisible,
+  environment,
+  secretPath
+}: SecretOverviewRotationSecretRowProps) => {
+  const [isFieldFocused, setIsFieldFocused] = useToggle();
+
+  const { currentProject } = useProject();
+
+  const canFetchValue = Boolean(secret);
+
+  const { data: secretValueData, isError } = useGetSecretValue(
+    {
+      secretKey: secret?.key ?? "",
+      environment,
+      secretPath,
+      projectId: currentProject.id
+    },
+    {
+      enabled: canFetchValue && (isSecretVisible || isFieldFocused)
+    }
+  );
+
+  const secretValue = isError
+    ? "Error loading secret value..."
+    : (secretValueData?.valueOverride ?? secretValueData?.value ?? HIDDEN_SECRET_VALUE);
+
+  return (
+    <Tooltip
+      className="max-w-sm"
+      content={secret ? undefined : "You do not have permission to view this secret."}
+    >
+      <tr className="!last:border-b-0 h-full hover:bg-mineshaft-700">
+        <td className="flex h-full items-center" style={{ padding: "0.5rem 1rem" }}>
+          <span className={twMerge(!secret && "blur")}>{secret?.key ?? "********"}</span>
+        </td>
+        <td className="col-span-2 h-full w-full" style={{ padding: "0.5rem 1rem" }}>
+          {/* eslint-disable-next-line no-nested-ternary */}
+          {!secret ? (
+            <div className="h-full pl-4 blur">********</div>
+          ) : secret.secretValueHidden ? (
+            <Blur
+              className="py-0"
+              tooltipText="You do not have permission to read the value of this secret."
+            />
+          ) : (
+            <SecretInput
+              isReadOnly
+              value={secretValue}
+              isVisible={isSecretVisible}
+              onFocus={() => setIsFieldFocused.on()}
+              onBlur={() => setIsFieldFocused.off()}
+            />
+          )}
+        </td>
+      </tr>
+    </Tooltip>
+  );
+};

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewSecretRotationRow/SecretOverviewSecretRotationRow.tsx

@@ -16,8 +16,6 @@ import { twMerge } from "tailwind-merge";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretRotationV2StatusBadge } from "@app/components/secret-rotations-v2/SecretRotationV2StatusBadge";
 import { Badge, IconButton, TableContainer, Tag, Td, Tooltip, Tr } from "@app/components/v2";
-import { Blur } from "@app/components/v2/Blur";
-import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
 import {
   ProjectPermissionSecretRotationActions,
   ProjectPermissionSub
@@ -27,6 +25,8 @@ import { useToggle } from "@app/hooks";
 import { SecretRotationStatus, TSecretRotationV2 } from "@app/hooks/api/secretRotationsV2";
 import { getExpandedRowStyle } from "@app/pages/secret-manager/OverviewPage/components/utils";
 
+import { SecretOverviewRotationSecretRow } from "./SecretOverviewRotationSecretRow";
+
 type Props = {
   secretRotationName: string;
   environments: { name: string; slug: string }[];
@@ -256,52 +256,13 @@ export const SecretOverviewSecretRotationRow = ({
                       <tbody className="border-t-2 border-mineshaft-600">
                         {secrets.map((secret, index) => {
                           return (
-                            <Tooltip
-                              className="max-w-sm"
-                              content={
-                                secret
-                                  ? undefined
-                                  : "You do not have permission to view this secret."
-                              }
-                            >
-                              <tr
-                                // eslint-disable-next-line react/no-array-index-key
-                                key={`rotation-secret-${secretRotation.id}-${index}`}
-                                className="!last:border-b-0 h-full hover:bg-mineshaft-700"
-                              >
-                                <td
-                                  className="flex h-full items-center"
-                                  style={{ padding: "0.5rem 1rem" }}
-                                >
-                                  <span className={twMerge(!secret && "blur")}>
-                                    {secret?.key ?? "********"}
-                                  </span>
-                                </td>
-                                <td
-                                  className="col-span-2 h-full w-full"
-                                  style={{ padding: "0.5rem 1rem" }}
-                                >
-                                  {/* eslint-disable-next-line no-nested-ternary */}
-                                  {!secret ? (
-                                    <div className="h-full pl-4 blur">********</div>
-                                  ) : secret.secretValueHidden ? (
-                                    <Blur
-                                      className="py-0"
-                                      tooltipText="You do not have permission to read the value of this secret."
-                                    />
-                                  ) : (
-                                    <InfisicalSecretInput
-                                      isReadOnly
-                                      value={secret.value}
-                                      isVisible={isSecretVisible}
-                                      secretPath={secretRotation.folder.path}
-                                      environment={secretRotation.environment.slug}
-                                      onChange={() => {}}
-                                    />
-                                  )}
-                                </td>
-                              </tr>
-                            </Tooltip>
+                            <SecretOverviewRotationSecretRow
+                              key={`rotation-secret-${secretRotation.id}-${index + 1}`}
+                              secret={secret}
+                              secretPath={secretRotation.folder.path}
+                              environment={secretRotation.environment.slug}
+                              isSecretVisible={isSecretVisible}
+                            />
                           );
                         })}
                       </tbody>

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretEditRow.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { subject } from "@casl/ability";
 import {
@@ -10,14 +10,12 @@ import {
   faXmark
 } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useQueryClient } from "@tanstack/react-query";
 import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import {
-  hasSecretReference,
-  SecretReferenceTree
-} from "@app/components/secrets/SecretReferenceDetails";
+import { SecretReferenceTree } from "@app/components/secrets/SecretReferenceDetails";
 import {
   DeleteActionModal,
   IconButton,
@@ -27,12 +25,23 @@ import {
   Tooltip
 } from "@app/components/v2";
 import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
-import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  useProject,
+  useProjectPermission
+} from "@app/context";
 import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionContext/types";
 import { usePopUp, useToggle } from "@app/hooks";
-import { SecretType } from "@app/hooks/api/types";
+import {
+  dashboardKeys,
+  fetchSecretValue,
+  useGetSecretValue
+} from "@app/hooks/api/dashboard/queries";
+import { ProjectEnv, SecretType, SecretV3RawSanitized } from "@app/hooks/api/types";
 import { hasSecretReadValueOrDescribePermission } from "@app/lib/fn/permission";
 import { CollapsibleSecretImports } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/CollapsibleSecretImports";
+import { HIDDEN_SECRET_VALUE } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";
 
 type Props = {
   defaultValue?: string | null;
@@ -56,6 +65,15 @@ type Props = {
   ) => Promise<void>;
   onSecretDelete: (env: string, key: string, secretId?: string) => Promise<void>;
   isRotatedSecret?: boolean;
+  isEmpty?: boolean;
+  importedSecret?:
+    | {
+        secretPath: string;
+        secret?: SecretV3RawSanitized;
+        environmentInfo?: ProjectEnv;
+        environment: string;
+      }
+    | undefined;
   importedBy?: {
     environment: { name: string; slug: string };
     folders: {
@@ -81,24 +99,68 @@ export const SecretEditRow = ({
   isVisible,
   secretId,
   isRotatedSecret,
-  importedBy
+  importedBy,
+  importedSecret,
+  isEmpty
 }: Props) => {
   const { handlePopUpOpen, handlePopUpToggle, handlePopUpClose, popUp } = usePopUp([
     "editSecret"
   ] as const);
 
+  const queryClient = useQueryClient();
+
+  const { currentProject } = useProject();
+
+  const [isFieldFocused, setIsFieldFocused] = useToggle();
+
+  const fetchSecretValueParams = importedSecret
+    ? {
+        environment: importedSecret.environment,
+        secretPath: importedSecret.secretPath,
+        secretKey: importedSecret.secret?.key ?? "",
+        projectId: currentProject.id
+      }
+    : {
+        environment,
+        secretPath,
+        secretKey: secretName,
+        projectId: currentProject.id,
+        isOverride
+      };
+
+  // scott: only fetch value if secret exists, has non-empty value and user has permission
+  const canFetchValue = Boolean(importedSecret ?? secretId) && !isEmpty && !secretValueHidden;
+
+  const {
+    data: secretValueData,
+    isPending: isPendingSecretValueData,
+    isError: isErrorFetchingSecretValue
+  } = useGetSecretValue(fetchSecretValueParams, {
+    enabled: canFetchValue && (isVisible || isFieldFocused)
+  });
+
+  const isFetchingSecretValue = canFetchValue && isPendingSecretValueData;
+  const isSecretValueFetched = Boolean(secretValueData);
+
   const {
     handleSubmit,
     control,
     reset,
     getValues,
+    setValue,
     formState: { isDirty, isSubmitting }
   } = useForm({
-    values: {
-      value: defaultValue || null
+    defaultValues: {
+      value: secretValueData?.valueOverride ?? secretValueData?.value ?? (defaultValue || null)
     }
   });
 
+  useEffect(() => {
+    if (secretValueData && !isDirty) {
+      setValue("value", secretValueData.valueOverride ?? secretValueData.value);
+    }
+  }, [secretValueData]);
+
   const { permission } = useProjectPermission();
 
   const [isDeleting, setIsDeleting] = useToggle();
@@ -113,6 +175,25 @@ export const SecretEditRow = ({
   };
 
   const handleCopySecretToClipboard = async () => {
+    if (!isSecretValueFetched && !isDirty) {
+      try {
+        const data = await fetchSecretValue(fetchSecretValueParams);
+
+        queryClient.setQueryData(dashboardKeys.getSecretValue(fetchSecretValueParams), data);
+
+        await window.navigator.clipboard.writeText(data.valueOverride ?? data.value);
+        createNotification({ type: "success", text: "Copied secret to clipboard" });
+        return;
+      } catch (e) {
+        console.error(e);
+        createNotification({
+          type: "error",
+          text: "Failed to fetch secret value."
+        });
+        return;
+      }
+    }
+
     const { value } = getValues();
     if (value) {
       try {
@@ -221,14 +302,25 @@ export const SecretEditRow = ({
       )}
       <div className="flex-grow border-r border-r-mineshaft-600 pl-1 pr-2">
         <Controller
-          disabled={isImportedSecret && !defaultValue}
           control={control}
           name="value"
           render={({ field }) => (
             <InfisicalSecretInput
               {...field}
-              isReadOnly={isImportedSecret || (isRotatedSecret && !isOverride)}
-              value={field.value as string}
+              isReadOnly={
+                isImportedSecret ||
+                (isRotatedSecret && !isOverride) ||
+                isFetchingSecretValue ||
+                isErrorFetchingSecretValue
+              }
+              value={
+                // eslint-disable-next-line no-nested-ternary
+                isFetchingSecretValue
+                  ? HIDDEN_SECRET_VALUE
+                  : isErrorFetchingSecretValue
+                    ? "Error fetching secret value..."
+                    : (field.value as string)
+              }
               key="secret-input"
               isVisible={isVisible && !secretValueHidden}
               secretPath={secretPath}
@@ -236,6 +328,11 @@ export const SecretEditRow = ({
               isImport={isImportedSecret}
               defaultValue={secretValueHidden ? "" : undefined}
               canEditButNotView={secretValueHidden && !isOverride}
+              onFocus={() => setIsFieldFocused.on()}
+              onBlur={() => {
+                field.onBlur();
+                setIsFieldFocused.off();
+              }}
             />
           )}
         />
@@ -309,18 +406,12 @@ export const SecretEditRow = ({
               <Modal>
                 <ModalTrigger asChild>
                   <div className="opacity-0 group-hover:opacity-100">
-                    <Tooltip
-                      content={
-                        hasSecretReference(defaultValue || "")
-                          ? "Secret Reference Tree"
-                          : "Secret does not contain references"
-                      }
-                    >
+                    <Tooltip content="Secret Reference Tree">
                       <IconButton
                         variant="plain"
                         ariaLabel="reference-tree"
                         className="h-full"
-                        isDisabled={!hasSecretReference(defaultValue || "") || !canReadSecretValue}
+                        isDisabled={!canReadSecretValue || !secretId || isEmpty}
                       >
                         <FontAwesomeIcon icon={faProjectDiagram} />
                       </IconButton>

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx

@@ -50,7 +50,14 @@ type Props = {
   getImportedSecretByKey: (
     env: string,
     secretName: string
-  ) => { secret?: SecretV3RawSanitized; environmentInfo?: ProjectEnv } | undefined;
+  ) =>
+    | {
+        secret?: SecretV3RawSanitized;
+        secretPath: string;
+        environment: string;
+        environmentInfo?: ProjectEnv;
+      }
+    | undefined;
   scrollOffset: number;
   importedBy?: {
     environment: { name: string; slug: string };
@@ -140,7 +147,7 @@ export const SecretOverviewTableRow = ({
           const isSecretImported = isImportedSecretPresentInEnv(slug, secretKey);
 
           const isSecretPresent = Boolean(secret);
-          const isSecretEmpty = secret?.value === "";
+          const isSecretEmpty = secret?.isEmpty;
           return (
             <Td
               key={`sec-overview-${slug}-${i + 1}-value`}
@@ -254,7 +261,7 @@ export const SecretOverviewTableRow = ({
                                   <FontAwesomeIcon icon={faRotate} />
                                 </Tooltip>
                               )}
-                              {secret?.valueOverride && (
+                              {secret?.idOverride && (
                                 <Tooltip content="Personal Override">
                                   <FontAwesomeIcon icon={faCodeBranch} />
                                 </Tooltip>
@@ -266,11 +273,13 @@ export const SecretOverviewTableRow = ({
                               secretPath={secretPath}
                               isVisible={isSecretVisible}
                               secretName={secretKey}
+                              isEmpty={secret?.isEmpty}
                               secretValueHidden={secret?.secretValueHidden || false}
                               defaultValue={getDefaultValue(secret, importedSecret)}
                               secretId={secret?.id}
-                              isOverride={Boolean(secret?.valueOverride)}
+                              isOverride={Boolean(secret?.idOverride)}
                               isImportedSecret={isImportedSecret}
+                              importedSecret={importedSecret}
                               isCreatable={isCreatable}
                               onSecretDelete={onSecretDelete}
                               onSecretCreate={onSecretCreate}

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx

@@ -113,7 +113,6 @@ function SecretRenameRow({ environments, getSecretByKey, secretKey, secretPath }
           projectId,
           secretPath,
           secretKey: secret.key,
-          secretValue: secret.value || "",
           type: SecretType.Shared,
           tagIds: secret.tags?.map((tag) => tag.id),
           secretComment: secret.comment,

frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx

@@ -25,8 +25,10 @@ import {
   Tooltip,
   Tr
 } from "@app/components/v2";
+import { useProject } from "@app/context";
 import { reverseTruncate } from "@app/helpers/reverseTruncate";
 import { useTimedReset } from "@app/hooks";
+import { fetchSecretValue } from "@app/hooks/api/dashboard/queries";
 import { TDashboardProjectSecretsQuickSearch } from "@app/hooks/api/dashboard/types";
 import { ProjectEnv } from "@app/hooks/api/projects/types";
 
@@ -53,6 +55,8 @@ export const QuickSearchSecretItem = ({
     initialState: false
   });
 
+  const { currentProject } = useProject();
+
   const [groupSecret] = secretGroup;
 
   const handleNavigate = () => {
@@ -67,14 +71,29 @@ export const QuickSearchSecretItem = ({
     onClose();
   };
 
-  const handleCopy = (value: string, env: string) => {
-    navigator.clipboard.writeText(value);
-    createNotification({
-      type: "info",
-      title: isSingleEnv ? "Secret value copied." : `Secret value copied from ${env}.`,
-      text: ""
-    });
-    setIsUrlCopied(true);
+  const handleCopy = async (env: string) => {
+    try {
+      const data = await fetchSecretValue({
+        environment: groupSecret.env,
+        secretPath: groupSecret.path!,
+        secretKey: groupSecret.key,
+        projectId: currentProject.id
+      });
+
+      navigator.clipboard.writeText(data.valueOverride ?? data.value!);
+      createNotification({
+        type: "info",
+        title: isSingleEnv ? "Secret value copied." : `Secret value copied from ${env}.`,
+        text: ""
+      });
+      setIsUrlCopied(true);
+    } catch (error) {
+      console.error(error);
+      createNotification({
+        type: "error",
+        text: "Error fetching secret value"
+      });
+    }
   };
 
   const secretGroupTags = secretGroup.flatMap((secret) => secret.tags);
@@ -146,7 +165,7 @@ export const QuickSearchSecretItem = ({
                   e.stopPropagation();
                   const el = envSlugMap.get(groupSecret.env)?.name;
                   if (el) {
-                    handleCopy(groupSecret.value!, el);
+                    handleCopy(el);
                   }
                 }}
               >
@@ -173,7 +192,7 @@ export const QuickSearchSecretItem = ({
                       e.stopPropagation();
                       const el = envSlugMap.get(secret.env)?.name;
                       if (el) {
-                        handleCopy(secret.value!, el);
+                        handleCopy(el);
                       }
                     }}
                     key={secret.id}
@@ -214,7 +233,7 @@ export const QuickSearchSecretItem = ({
                     e.stopPropagation();
                     const el = envSlugMap.get(secret.env)?.name;
                     if (el) {
-                      handleCopy(secret.value!, el);
+                      handleCopy(el);
                     }
                   }}
                   key={secret.id}

frontend/src/pages/secret-manager/SecretApprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx

@@ -23,6 +23,7 @@ export type Props = {
   newVersion?: Omit<TSecretApprovalSecChange, "tags"> & {
     tags?: WsTag[];
     secretMetadata?: { key: string; value: string }[];
+    skipMultilineEncoding?: boolean;
   };
   presentSecretVersionNumber: number;
   hasMerged?: boolean;
@@ -217,6 +218,14 @@ export const SecretApprovalRequestChangeItem = ({
                   )}
                 </div>
               </div>
+              <div className="mb-2">
+                <div className="text-sm font-medium text-mineshaft-300">Multi-line Encoding</div>
+                <div className="text-sm">
+                  {secretVersion?.skipMultilineEncoding?.toString() || (
+                    <span className="text-sm text-mineshaft-300">-</span>
+                  )}{" "}
+                </div>
+              </div>
             </div>
           ) : (
             <div className="text-md flex w-full items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-800 text-mineshaft-300 xl:w-1/2">
@@ -263,7 +272,7 @@ export const SecretApprovalRequestChangeItem = ({
                         isReadOnly
                         valueAlwaysHidden={newVersion?.secretValueHidden}
                         isVisible={isNewSecretValueVisible}
-                        value={newVersion?.secretValue}
+                        value={newVersion?.secretValue ?? secretVersion?.secretValue}
                         containerClassName={twMerge(
                           "border border-mineshaft-600 bg-bunker-700 py-1.5 text-bunker-300 hover:border-primary-400/50",
                           newVersion?.secretValueHidden ? "pl-8 pr-2" : "px-2"
@@ -287,7 +296,7 @@ export const SecretApprovalRequestChangeItem = ({
               <div className="mb-2">
                 <div className="text-sm font-medium text-mineshaft-300">Comment</div>
                 <div className="thin-scrollbar max-h-[5rem] max-w-[34rem] overflow-y-auto break-words text-sm xl:max-w-[28rem]">
-                  {newVersion?.secretComment || (
+                  {(newVersion?.secretComment ?? secretVersion?.secretComment) || (
                     <span className="text-sm text-mineshaft-300">-</span>
                   )}{" "}
                 </div>
@@ -315,9 +324,9 @@ export const SecretApprovalRequestChangeItem = ({
               </div>
               <div className="mb-2">
                 <div className="text-sm font-medium text-mineshaft-300">Metadata</div>
-                {newVersion?.secretMetadata?.length ? (
+                {(newVersion?.secretMetadata ?? secretVersion?.secretMetadata)?.length ? (
                   <div className="mt-1 flex flex-wrap gap-2 text-sm text-mineshaft-300">
-                    {newVersion.secretMetadata?.map((el) => (
+                    {(newVersion?.secretMetadata ?? secretVersion?.secretMetadata)?.map((el) => (
                       <div key={el.key} className="flex items-center">
                         <Tag
                           size="xs"
@@ -353,6 +362,15 @@ export const SecretApprovalRequestChangeItem = ({
                   <p className="text-sm text-mineshaft-300">-</p>
                 )}
               </div>
+              <div className="mb-2">
+                <div className="text-sm font-medium text-mineshaft-300">Multi-line Encoding</div>
+                <div className="text-sm">
+                  {newVersion?.skipMultilineEncoding?.toString() ??
+                    secretVersion?.skipMultilineEncoding?.toString() ?? (
+                      <span className="text-sm text-mineshaft-300">-</span>
+                    )}{" "}
+                </div>
+              </div>
             </div>
           ) : (
             <div className="text-md flex w-full items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-800 text-mineshaft-300 xl:w-1/2">

frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx

@@ -47,10 +47,12 @@ import {
   useGetWsTags
 } from "@app/hooks/api";
 import { useGetProjectSecretsDetails } from "@app/hooks/api/dashboard";
+import { dashboardKeys } from "@app/hooks/api/dashboard/queries";
 import { DashboardSecretsOrderBy } from "@app/hooks/api/dashboard/types";
 import { useGetFolderCommitsCount } from "@app/hooks/api/folderCommits";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import { ProjectVersion } from "@app/hooks/api/projects/types";
+import { queryClient } from "@app/hooks/api/reactQuery";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 import { useCreateCommit } from "@app/hooks/api/secrets/mutations";
 import { SecretV3RawSanitized } from "@app/hooks/api/types";
@@ -152,6 +154,10 @@ const Page = () => {
     }
   }, [isBatchMode, projectId, environment, secretPath, loadPendingChanges]);
 
+  useEffect(() => {
+    if (isVisible) setIsVisible(false);
+  }, [environment]);
+
   const canReadSecret = hasSecretReadValueOrDescribePermission(
     permission,
     ProjectPermissionSecretActions.DescribeSecret,
@@ -183,17 +189,6 @@ const Page = () => {
     })
   );
 
-  const canReadSecretValue = hasSecretReadValueOrDescribePermission(
-    permission,
-    ProjectPermissionSecretActions.ReadValue,
-    {
-      environment,
-      secretPath,
-      secretName: "*",
-      secretTags: ["*"]
-    }
-  );
-
   const canReadSecretImports = permission.can(
     ProjectPermissionActions.Read,
     subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
@@ -271,7 +266,6 @@ const Page = () => {
     orderDirection,
     includeImports: canReadSecretImports && (isResourceTypeFiltered ? filter.include.import : true),
     includeFolders: isResourceTypeFiltered ? filter.include.folder : true,
-    viewSecretValue: canReadSecretValue,
     includeDynamicSecrets:
       canReadDynamicSecret && (isResourceTypeFiltered ? filter.include.dynamic : true),
     includeSecrets: canReadSecret && (isResourceTypeFiltered ? filter.include.secret : true),
@@ -347,6 +341,24 @@ const Page = () => {
         pendingChanges: changes,
         message
       });
+
+      if (!isProtectedBranch) {
+        pendingChanges.secrets.forEach((secret) => {
+          if (secret.type === "update" && secret.secretValue !== undefined) {
+            queryClient.setQueryData(
+              dashboardKeys.getSecretValue({
+                projectId,
+                environment,
+                secretPath,
+                secretKey: secret.newSecretName ?? secret.secretKey,
+                isOverride: false
+              }),
+              { value: secret.secretValue }
+            );
+          }
+        });
+      }
+
       createNotification({
         text: isProtectedBranch
           ? "Requested changes have been sent for review"
@@ -604,7 +616,9 @@ const Page = () => {
       return secrets;
     }
 
-    const mergedSecrets = [...(secrets || [])];
+    const mergedSecrets = [...(secrets || [])] as (SecretV3RawSanitized & {
+      originalKey?: string;
+    })[];
 
     pendingChanges.secrets.forEach((change) => {
       switch (change.type) {
@@ -655,7 +669,8 @@ const Page = () => {
                     updatedAt: new Date().toISOString(),
                     __v: 0
                   })) || []
-                : mergedSecrets[updateIndex].tags
+                : mergedSecrets[updateIndex].tags,
+              originalKey: mergedSecrets[updateIndex].key
             };
           }
           break;

frontend/src/pages/secret-manager/SecretDashboardPage/SecretMainPage.store.tsx

@@ -54,6 +54,7 @@ export interface PendingSecretDelete extends BasePendingChange {
   type: PendingAction.Delete;
   secretKey: string;
   secretValue: string;
+  secretValueHidden: boolean;
 }
 
 // Folder-related change types
@@ -408,7 +409,7 @@ const createBatchModeStore: StateCreator<CombinedState, [], [], BatchModeState>
                 const mergedUpdate: PendingSecretUpdate = {
                   ...existingUpdate,
                   secretKey: existingUpdate.secretKey,
-                  originalValue: existingUpdate.originalValue,
+                  originalValue: change.originalValue,
                   originalComment: existingUpdate.originalComment,
                   originalSkipMultilineEncoding: existingUpdate.originalSkipMultilineEncoding,
                   originalTags: existingUpdate.originalTags,

frontend/src/pages/secret-manager/SecretDashboardPage/components/CommitForm/CommitForm.tsx

@@ -13,6 +13,7 @@ import { AnimatePresence, motion } from "framer-motion";
 import { Badge, Button, Input, Modal, ModalContent } from "@app/components/v2";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 import { SecretVersionDiffView } from "@app/pages/secret-manager/CommitDetailsPage/components/SecretVersionDiffView";
+import { HIDDEN_SECRET_VALUE_API_MASK } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";
 
 import {
   PendingChange,
@@ -105,7 +106,12 @@ const RenderSecretChanges = ({ onDiscard, change }: RenderResourceProps) => {
               version: 1, // placeholder, not used
               secretKey: change.newSecretName ? existingSecret.key : undefined,
               secretValue:
-                change.secretValue !== undefined ? (existingSecret.value ?? "") : undefined,
+                // eslint-disable-next-line no-nested-ternary
+                change.secretValue !== undefined
+                  ? change.existingSecret.secretValueHidden
+                    ? HIDDEN_SECRET_VALUE_API_MASK
+                    : (change.originalValue ?? "")
+                  : undefined,
               tags: change.tags ? (existingSecret.tags?.map((tag) => tag.slug) ?? []) : undefined,
               secretMetadata: change.secretMetadata ? existingSecret.secretMetadata : undefined,
               skipMultilineEncoding:
@@ -130,7 +136,7 @@ const RenderSecretChanges = ({ onDiscard, change }: RenderResourceProps) => {
   }
 
   if (change.type === PendingAction.Delete) {
-    const { secretKey, secretValue } = change;
+    const { secretKey, secretValue, secretValueHidden } = change;
     return (
       <SecretVersionDiffView
         onDiscard={onDiscard}
@@ -143,7 +149,12 @@ const RenderSecretChanges = ({ onDiscard, change }: RenderResourceProps) => {
             {
               version: 1, // placeholder, not used
               secretKey,
-              secretValue
+              // eslint-disable-next-line no-nested-ternary
+              secretValue: secretValue
+                ? secretValueHidden
+                  ? HIDDEN_SECRET_VALUE_API_MASK
+                  : secretValue
+                : undefined
             }
           ]
         }}

frontend/src/pages/secret-manager/SecretDashboardPage/components/EnvironmentTabs/EnvironmentTabs.tsx

@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { faArrowRightArrowLeft, faEllipsisH, faPlus } from "@fortawesome/free-solid-svg-icons";
+import { faEllipsisH, faPlus } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { useQueryClient } from "@tanstack/react-query";
 import { useNavigate, useParams } from "@tanstack/react-router";
@@ -199,14 +199,15 @@ export const EnvironmentTabs = ({ secretPath }: Props) => {
               </Tooltip>
             </Tab>
           )}
-          {currentProject.environments.length > 1 && (
+          {/* scott: removing until we have time to update for fetching secret value */}
+          {/* {currentProject.environments.length > 1 && (
             <Tab className="ml-auto" value={COMPARE_ENVIRONMENT_TAB}>
               <div className="flex items-center gap-x-2 whitespace-nowrap">
                 <FontAwesomeIcon icon={faArrowRightArrowLeft} />
                 Compare Environments
               </div>
             </Tab>
-          )}
+          )} */}
         </TabList>
       </Tabs>
       <Modal

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretImportListView/SecretImportItem.tsx

@@ -20,12 +20,14 @@ import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { EmptyState, IconButton, SecretInput, TableContainer, Tooltip } from "@app/components/v2";
+import { EmptyState, IconButton, TableContainer, Tooltip } from "@app/components/v2";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import { useToggle } from "@app/hooks";
 import { useResyncSecretReplication } from "@app/hooks/api";
 import { TSecretImport } from "@app/hooks/api/types";
 
+import { SecretImportSecretRow } from "./SecretImportSecretRow";
+
 type Props = {
   onDelete: () => void;
   environment: string;
@@ -35,7 +37,10 @@ type Props = {
   importedSecrets: {
     key: string;
     value?: string;
-    overriden: { env: string; secretPath: string };
+    overridden: { env: string; secretPath: string };
+    environment: string;
+    secretPath?: string;
+    isEmpty?: boolean;
   }[];
   searchTerm: string;
   onExpandReplicateSecrets: (id: string) => void;
@@ -299,7 +304,6 @@ export const SecretImportItem = ({
                   <tr>
                     <td style={{ padding: "0.25rem 1rem" }}>Key</td>
                     <td style={{ padding: "0.25rem 1rem" }}>Value</td>
-                    {/* <td style={{ padding: "0.25rem 1rem" }}>Override</td> */}
                   </tr>
                 </thead>
                 <tbody>
@@ -317,18 +321,11 @@ export const SecretImportItem = ({
                       </td>
                     </tr>
                   )}
-                  {filteredImportedSecrets.map(({ key, value }, index) => (
-                    <tr key={`${id}-${key}-${index + 1}`}>
-                      <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
-                        {key}
-                      </td>
-                      <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
-                        <SecretInput value={value} isReadOnly />
-                      </td>
-                      {/* <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
-                          <EnvFolderIcon env={overriden?.env} secretPath={overriden?.secretPath} />
-                        </td> */}
-                    </tr>
+                  {filteredImportedSecrets.map((secret, index) => (
+                    <SecretImportSecretRow
+                      secret={secret}
+                      key={`${id}-${secret.key}-${index + 1}`}
+                    />
                   ))}
                 </tbody>
               </table>

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretImportListView/SecretImportListView.tsx

@@ -64,18 +64,24 @@ export const computeImportedSecretRows = (
   const importedSecretEntries: {
     key: string;
     value?: string;
-    overriden: {
+    environment: string;
+    secretPath?: string;
+    overridden: {
       env: string;
       secretPath: string;
     };
+    isEmpty?: boolean;
   }[] = [];
 
-  importedSec.secrets.forEach(({ key, value }) => {
+  importedSec.secrets.forEach(({ key, value, env, path, isEmpty }) => {
     if (!importedEntry[key]) {
       importedSecretEntries.push({
         key,
         value,
-        overriden: overridenSec?.[key]
+        environment: env,
+        secretPath: path,
+        overridden: overridenSec?.[key],
+        isEmpty
       });
       importedEntry[key] = true;
     }

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretImportListView/SecretImportSecretRow.tsx

@@ -0,0 +1,68 @@
+import { SecretInput } from "@app/components/v2";
+import { useProject } from "@app/context";
+import { useToggle } from "@app/hooks";
+import { useGetSecretValue } from "@app/hooks/api/dashboard/queries";
+import { HIDDEN_SECRET_VALUE } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";
+
+type SecretImportSecretRowProps = {
+  secret: {
+    key: string;
+    value?: string;
+    environment: string;
+    secretPath?: string;
+    isEmpty?: boolean;
+    overridden: { env: string; secretPath: string };
+  };
+};
+
+export const SecretImportSecretRow = ({
+  secret: { key, environment, secretPath = "/", isEmpty }
+}: SecretImportSecretRowProps) => {
+  const [isFieldFocused, setIsFieldFocused] = useToggle();
+
+  const { currentProject } = useProject();
+
+  const canFetchSecretValue = !isEmpty;
+
+  const {
+    data: secretValue,
+    isPending: isPendingSecretValue,
+    isError: isErrorFetchingSecretValue
+  } = useGetSecretValue(
+    {
+      environment,
+      secretPath,
+      secretKey: key,
+      projectId: currentProject.id
+    },
+    {
+      enabled: isFieldFocused && canFetchSecretValue
+    }
+  );
+
+  const isLoadingSecretValue = canFetchSecretValue && isPendingSecretValue;
+
+  const getValue = () => {
+    if (isLoadingSecretValue) return HIDDEN_SECRET_VALUE;
+
+    if (isErrorFetchingSecretValue) return "Error loading secret value";
+
+    return secretValue?.value || "";
+  };
+
+  return (
+    <tr>
+      <td className="h-10 w-1/2" style={{ padding: "0.25rem 1rem" }}>
+        {key}
+      </td>
+      <td className="h-10 w-1/2" style={{ padding: "0.25rem 1rem" }}>
+        <SecretInput
+          value={getValue()}
+          onFocus={() => setIsFieldFocused.on()}
+          onBlur={() => setIsFieldFocused.off()}
+          isReadOnly
+        />
+      </td>
+    </tr>
+  );
+};

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx

@@ -1,36 +1,27 @@
 import { useEffect } from "react";
 import { Controller, useFieldArray, useForm } from "react-hook-form";
 import { subject } from "@casl/ability";
-import { faCircleQuestion, faEye } from "@fortawesome/free-regular-svg-icons";
+import { faCircleQuestion } from "@fortawesome/free-regular-svg-icons";
 import {
-  faArrowRotateRight,
   faCheckCircle,
   faCopy,
-  faDesktop,
-  faEyeSlash,
   faPlus,
   faProjectDiagram,
   faSearch,
-  faServer,
   faShare,
   faTag,
   faTrash,
-  faTriangleExclamation,
-  faUser
+  faTriangleExclamation
 } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { Link, useNavigate } from "@tanstack/react-router";
-import { format } from "date-fns";
-import { twMerge } from "tailwind-merge";
+import { useQueryClient } from "@tanstack/react-query";
+import { Link } from "@tanstack/react-router";
 
 import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import {
-  hasSecretReference,
-  SecretReferenceTree
-} from "@app/components/secrets/SecretReferenceDetails";
+import { SecretReferenceTree } from "@app/components/secrets/SecretReferenceDetails";
 import {
   Button,
   Drawer,
@@ -60,9 +51,13 @@ import {
 } from "@app/context";
 import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionContext/types";
 import { getProjectBaseURL } from "@app/helpers/project";
-import { usePopUp } from "@app/hooks";
+import { usePopUp, useToggle } from "@app/hooks";
 import { useGetSecretVersion } from "@app/hooks/api";
-import { ActorType } from "@app/hooks/api/auditLogs/enums";
+import {
+  dashboardKeys,
+  fetchSecretValue,
+  useGetSecretValue
+} from "@app/hooks/api/dashboard/queries";
 import { useGetSecretAccessList } from "@app/hooks/api/secrets/queries";
 import { SecretV3RawSanitized, WsTag } from "@app/hooks/api/types";
 import { hasSecretReadValueOrDescribePermission } from "@app/lib/fn/permission";
@@ -70,6 +65,7 @@ import { camelCaseToSpaces } from "@app/lib/fn/string";
 
 import { HIDDEN_SECRET_VALUE } from "./SecretItem";
 import { formSchema, SecretActionType, TFormSchema } from "./SecretListView.utils";
+import { SecretVersionItem } from "./SecretVersionItem";
 
 type Props = {
   isOpen?: boolean;
@@ -77,7 +73,7 @@ type Props = {
   secretPath: string;
   onToggle: (isOpen: boolean) => void;
   onClose: () => void;
-  secret: SecretV3RawSanitized;
+  secret: SecretV3RawSanitized & { originalKey?: string };
   onDeleteSecret: () => void;
   onSaveSecret: (
     orgSec: SecretV3RawSanitized,
@@ -92,7 +88,7 @@ type Props = {
 export const SecretDetailSidebar = ({
   isOpen,
   onToggle,
-  secret,
+  secret: originalSecret,
   onDeleteSecret,
   onSaveSecret,
   tags,
@@ -101,16 +97,90 @@ export const SecretDetailSidebar = ({
   secretPath,
   handleSecretShare
 }: Props) => {
+  const { currentProject } = useProject();
+  const [isFieldFocused, setIsFieldFocused] = useToggle();
+  const queryClient = useQueryClient();
+
+  const canFetchSecretValue =
+    Boolean(originalSecret) && !originalSecret.secretValueHidden && !originalSecret.isEmpty;
+
+  const fetchSecretValueParams = {
+    environment,
+    secretPath,
+    secretKey: originalSecret?.originalKey || originalSecret?.key,
+    projectId: currentProject.id,
+    isOverride: Boolean(originalSecret?.idOverride)
+  };
+
+  const {
+    data: secretValueData,
+    isPending: isPendingSecretValue,
+    isError: isErrorFetchingSecretValue
+  } = useGetSecretValue(fetchSecretValueParams, {
+    enabled: canFetchSecretValue && isFieldFocused
+  });
+
+  const isLoadingSecretValue = canFetchSecretValue && isPendingSecretValue;
+  const hasFetchedSecretValue = !canFetchSecretValue || Boolean(secretValueData);
+
+  const secret = {
+    ...originalSecret,
+    value: originalSecret?.value ?? secretValueData?.value,
+    valueOverride: originalSecret?.valueOverride ?? secretValueData?.valueOverride
+  };
+
+  const { permission } = useProjectPermission();
+
+  const canEditSecretValue = permission.can(
+    ProjectPermissionSecretActions.Edit,
+    subject(ProjectPermissionSub.Secrets, {
+      environment,
+      secretPath,
+      secretName: secret.key,
+      secretTags: ["*"]
+    })
+  );
+
+  const getDefaultValue = () => {
+    if (isLoadingSecretValue) return HIDDEN_SECRET_VALUE;
+
+    if (secret.secretValueHidden) {
+      return canEditSecretValue ? HIDDEN_SECRET_VALUE : "";
+    }
+
+    if (isErrorFetchingSecretValue) return "Error loading secret value...";
+
+    return secret.value || "";
+  };
+
+  const getOverrideDefaultValue = () => {
+    if (isLoadingSecretValue) return HIDDEN_SECRET_VALUE;
+
+    if (secret.secretValueHidden) {
+      return canEditSecretValue ? HIDDEN_SECRET_VALUE : "";
+    }
+
+    if (isErrorFetchingSecretValue) return "Error loading secret value...";
+
+    return secret.valueOverride || "";
+  };
+
   const {
     control,
     watch,
     handleSubmit,
     setValue,
     reset,
+    getValues,
+    getFieldState,
     formState: { isDirty }
   } = useForm<TFormSchema>({
     resolver: zodResolver(formSchema),
-    values: secret,
+    values: {
+      ...secret,
+      valueOverride: getOverrideDefaultValue(),
+      value: getDefaultValue()
+    },
     disabled: !secret
   });
 
@@ -119,9 +189,6 @@ export const SecretDetailSidebar = ({
     "secretReferenceTree"
   ] as const);
 
-  const { permission } = useProjectPermission();
-  const { currentProject } = useProject();
-
   const tagFields = useFieldArray({
     control,
     name: "tags"
@@ -139,7 +206,6 @@ export const SecretDetailSidebar = ({
     {}
   );
   const selectTagSlugs = selectedTags.map((i) => i.slug);
-  const navigate = useNavigate();
 
   const cannotEditSecret = permission.cannot(
     ProjectPermissionSecretActions.Edit,
@@ -205,7 +271,16 @@ export const SecretDetailSidebar = ({
   };
 
   const handleFormSubmit = async (data: TFormSchema) => {
-    await onSaveSecret(secret, { ...secret, ...data }, () => reset());
+    await onSaveSecret(
+      secret,
+      {
+        ...secret,
+        ...data,
+        value: getFieldState("value").isDirty ? data.value : undefined,
+        valueOverride: getFieldState("valueOverride").isDirty ? data.valueOverride : undefined
+      },
+      () => reset()
+    );
   };
 
   useEffect(() => {
@@ -218,58 +293,22 @@ export const SecretDetailSidebar = ({
     );
   }, [secret?.secretReminderRecipients]);
 
-  const getModifiedByIcon = (userType: string | undefined | null) => {
-    switch (userType) {
-      case ActorType.USER:
-        return faUser;
-      case ActorType.IDENTITY:
-        return faDesktop;
-      default:
-        return faServer;
-    }
-  };
+  const fetchValue = async () => {
+    if (secretValueData) return secretValueData.valueOverride ?? secretValueData.value;
 
-  const getModifiedByName = (
-    userType: string | undefined | null,
-    userName: string | null | undefined
-  ) => {
-    switch (userType) {
-      case ActorType.PLATFORM:
-        return "System-generated";
-      case ActorType.IDENTITY:
-        return userName || "Deleted Identity";
-      case ActorType.USER:
-        return userName || "Deleted User";
-      default:
-        return "Unknown";
-    }
-  };
+    try {
+      const data = await fetchSecretValue(fetchSecretValueParams);
 
-  const getLinkToModifyHistoryEntity = (
-    actorId: string,
-    actorType: string,
-    membershipId: string | null = ""
-  ) => {
-    switch (actorType) {
-      case ActorType.USER:
-        return `/projects/secret-management/${currentProject.id}/members/${membershipId}`;
-      case ActorType.IDENTITY:
-        return `/projects/secret-management/${currentProject.id}/identities/${actorId}`;
-      default:
-        return null;
-    }
-  };
+      queryClient.setQueryData(dashboardKeys.getSecretValue(fetchSecretValueParams), data);
 
-  const onModifyHistoryClick = (
-    actorId: string | undefined | null,
-    actorType: string | undefined | null,
-    membershipId: string | undefined | null
-  ) => {
-    if (actorType && actorId && actorType !== ActorType.PLATFORM) {
-      const redirectLink = getLinkToModifyHistoryEntity(actorId, actorType, membershipId);
-      if (redirectLink) {
-        navigate({ to: redirectLink });
-      }
+      return data?.valueOverride ?? data.value;
+    } catch (error) {
+      console.error(error);
+      createNotification({
+        type: "error",
+        text: "Error fetching secret value"
+      });
+      throw error;
     }
   };
 
@@ -313,6 +352,7 @@ export const SecretDetailSidebar = ({
           title={`Secret – ${secret?.key}`}
           className="thin-scrollbar h-full"
           cardBodyClassName="pb-0"
+          onOpenAutoFocus={(e) => e.preventDefault()}
         >
           <form
             onSubmit={handleSubmit(handleFormSubmit)}
@@ -356,7 +396,14 @@ export const SecretDetailSidebar = ({
                     >
                       <div className="flex items-start gap-x-2">
                         <InfisicalSecretInput
-                          isReadOnly={isReadOnly || !isAllowed || secret?.isRotatedSecret}
+                          isReadOnly={
+                            isReadOnly ||
+                            !isAllowed ||
+                            secret?.isRotatedSecret ||
+                            isLoadingSecretValue ||
+                            isErrorFetchingSecretValue
+                          }
+                          canEditButNotView={secret.secretValueHidden && canEditSecretValue}
                           environment={environment}
                           secretPath={secretPath}
                           key="secret-value"
@@ -364,6 +411,11 @@ export const SecretDetailSidebar = ({
                           containerClassName="text-bunker-300 w-full hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
                           {...field}
                           autoFocus={false}
+                          onFocus={() => setIsFieldFocused.on()}
+                          onBlur={() => {
+                            setIsFieldFocused.off();
+                            field.onBlur();
+                          }}
                         />
                         <Tooltip
                           content={
@@ -378,11 +430,17 @@ export const SecretDetailSidebar = ({
                             className="px-2 py-[0.43rem] font-normal"
                             variant="outline_bg"
                             leftIcon={<FontAwesomeIcon icon={faShare} />}
-                            onClick={() => {
-                              const value = secret?.valueOverride ?? secret?.value;
-                              if (value) {
-                                handleSecretShare(value);
+                            onClick={async () => {
+                              let value: string | undefined;
+
+                              if (hasFetchedSecretValue) {
+                                const values = getValues(["value", "valueOverride"]);
+                                value = secret.idOverride ? values[1] : values[0];
+                              } else {
+                                value = await fetchValue();
                               }
+
+                              handleSecretShare(value ?? "");
                             }}
                           >
                             Share
@@ -644,179 +702,21 @@ export const SecretDetailSidebar = ({
             <div className="dark flex max-h-[24rem] flex-1 cursor-default flex-col text-sm text-bunker-300">
               <div className="mb-0.5 text-mineshaft-400">Version History</div>
               <div className="thin-scrollbar flex flex-1 flex-col space-y-2 overflow-y-auto overflow-x-hidden rounded-md border border-mineshaft-600 bg-mineshaft-900 p-4 dark:[color-scheme:dark]">
-                {secretVersion?.map(
-                  ({ createdAt, secretValue, secretValueHidden, version, id, actor }) => (
-                    <div className="flex flex-row" key={id}>
-                      <div className="flex w-full flex-col space-y-1">
-                        <div className="flex items-center">
-                          <div className="w-10">
-                            <div className="w-fit rounded-md border border-mineshaft-600 bg-mineshaft-700 px-1 text-sm text-mineshaft-300">
-                              v{version}
-                            </div>
-                          </div>
-                          <div>{format(new Date(createdAt), "Pp")}</div>
-                        </div>
-                        <div className="flex w-full cursor-default">
-                          <div className="relative w-10">
-                            <div className="absolute bottom-0 left-3 top-0 mt-0.5 border-l border-mineshaft-400/60" />
-                          </div>
-                          <div className="flex w-full cursor-default flex-col">
-                            {actor && (
-                              <div className="flex flex-row">
-                                <div className="flex w-fit flex-row text-sm">
-                                  Modified by:
-                                  <Tooltip content={getModifiedByName(actor.actorType, actor.name)}>
-                                    {/* eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions */}
-                                    <div
-                                      onClick={() =>
-                                        onModifyHistoryClick(
-                                          actor.actorId,
-                                          actor.actorType,
-                                          actor.membershipId
-                                        )
-                                      }
-                                      className="cursor-pointer"
-                                    >
-                                      <FontAwesomeIcon
-                                        icon={getModifiedByIcon(actor.actorType)}
-                                        className="ml-2"
-                                      />
-                                    </div>
-                                  </Tooltip>
-                                </div>
-                              </div>
-                            )}
-                            <div className="flex flex-row">
-                              <div className="h-min w-fit rounded-sm bg-primary-500/10 px-1 text-primary-300/70">
-                                Value:
-                              </div>
-                              <div className="group break-all pl-1 font-mono">
-                                <div className="relative hidden cursor-pointer transition-all duration-200 group-[.show-value]:inline">
-                                  <button
-                                    type="button"
-                                    className="select-none text-left"
-                                    onClick={(e) => {
-                                      if (secretValueHidden) return;
+                {secretVersion?.map((version) => (
+                  <SecretVersionItem
+                    canReadValue={!cannotReadSecretValue}
+                    secretVersion={version}
+                    secret={secret}
+                    currentVersion={secretVersion.length}
+                    onRevert={async (versionValue) => {
+                      await fetchValue();
 
-                                      navigator.clipboard.writeText(secretValue || "");
-                                      const target = e.currentTarget;
-                                      target.style.borderBottom = "1px dashed";
-                                      target.style.paddingBottom = "-1px";
-
-                                      // Create and insert popup
-                                      const popup = document.createElement("div");
-                                      popup.className =
-                                        "w-16 flex justify-center absolute top-6 left-0 text-xs text-primary-100 bg-mineshaft-800 px-1 py-0.5 rounded-md border border-primary-500/50";
-                                      popup.textContent = "Copied!";
-                                      target.parentElement?.appendChild(popup);
-
-                                      // Remove popup and border after delay
-                                      setTimeout(() => {
-                                        popup.remove();
-                                        target.style.borderBottom = "none";
-                                      }, 3000);
-                                    }}
-                                    onKeyDown={(e) => {
-                                      if (secretValueHidden) return;
-
-                                      if (e.key === "Enter" || e.key === " ") {
-                                        navigator.clipboard.writeText(secretValue || "");
-                                        const target = e.currentTarget;
-                                        target.style.borderBottom = "1px dashed";
-                                        target.style.paddingBottom = "-1px";
-
-                                        // Create and insert popup
-                                        const popup = document.createElement("div");
-                                        popup.className =
-                                          "w-16 flex justify-center absolute top-6 left-0 text-xs text-primary-100 bg-mineshaft-800 px-1 py-0.5 rounded-md border border-primary-500/50";
-                                        popup.textContent = "Copied!";
-                                        target.parentElement?.appendChild(popup);
-
-                                        // Remove popup and border after delay
-                                        setTimeout(() => {
-                                          popup.remove();
-                                          target.style.borderBottom = "none";
-                                        }, 3000);
-                                      }
-                                    }}
-                                  >
-                                    <span
-                                      className={twMerge(
-                                        secretValueHidden && "text-xs text-bunker-300 opacity-40"
-                                      )}
-                                    >
-                                      {secretValueHidden ? "Hidden" : secretValue}
-                                    </span>
-                                  </button>
-                                  <button
-                                    type="button"
-                                    className="ml-1 cursor-pointer"
-                                    onClick={(e) => {
-                                      e.stopPropagation();
-                                      e.currentTarget
-                                        .closest(".group")
-                                        ?.classList.remove("show-value");
-                                    }}
-                                    onKeyDown={(e) => {
-                                      if (e.key === "Enter" || e.key === " ") {
-                                        e.stopPropagation();
-                                        e.currentTarget
-                                          .closest(".group")
-                                          ?.classList.remove("show-value");
-                                      }
-                                    }}
-                                  >
-                                    <FontAwesomeIcon icon={faEyeSlash} />
-                                  </button>
-                                </div>
-                                <span className="group-[.show-value]:hidden">
-                                  {secretValueHidden
-                                    ? HIDDEN_SECRET_VALUE
-                                    : secretValue?.replace(/./g, "*")}
-                                  <button
-                                    type="button"
-                                    className="ml-1 cursor-pointer"
-                                    onClick={(e) => {
-                                      e.currentTarget
-                                        .closest(".group")
-                                        ?.classList.add("show-value");
-                                    }}
-                                    onKeyDown={(e) => {
-                                      if (e.key === "Enter" || e.key === " ") {
-                                        e.currentTarget
-                                          .closest(".group")
-                                          ?.classList.add("show-value");
-                                      }
-                                    }}
-                                  >
-                                    <FontAwesomeIcon icon={faEye} />
-                                  </button>
-                                </span>
-                              </div>
-                            </div>
-                          </div>
-                        </div>
-                      </div>
-                      {!secret?.isRotatedSecret && (
-                        <div
-                          className={`flex items-center justify-center ${version === secretVersion.length ? "hidden" : ""}`}
-                        >
-                          <Tooltip content="Restore Secret Value">
-                            <IconButton
-                              ariaLabel="Restore"
-                              variant="outline_bg"
-                              size="sm"
-                              className="h-8 w-8 rounded-md"
-                              onClick={() => setValue("value", secretValue, { shouldDirty: true })}
-                            >
-                              <FontAwesomeIcon icon={faArrowRotateRight} />
-                            </IconButton>
-                          </Tooltip>
-                        </div>
-                      )}
-                    </div>
-                  )
-                )}
+                      setTimeout(() => {
+                        setValue("value", versionValue, { shouldDirty: true });
+                      }, 5);
+                    }}
+                  />
+                ))}
               </div>
             </div>
             <div className="dark flex flex-col text-sm text-bunker-300">
@@ -942,26 +842,15 @@ export const SecretDetailSidebar = ({
               )}
             </div>
             <div className="mt-auto flex items-center space-x-2 pb-4">
-              <Tooltip
-                content={
-                  hasSecretReference(secret?.value)
-                    ? undefined
-                    : "Secret does not contain any references."
-                }
-                className="z-[100] text-center"
+              <Button
+                className="flex-1"
+                variant="outline_bg"
+                isDisabled={cannotReadSecretValue || secret.isEmpty}
+                leftIcon={<FontAwesomeIcon icon={faProjectDiagram} />}
+                onClick={() => handlePopUpOpen("secretReferenceTree", secretKey)}
               >
-                <div className="flex-1">
-                  <Button
-                    className="w-full"
-                    variant="outline_bg"
-                    isDisabled={cannotReadSecretValue || !hasSecretReference(secret?.value)}
-                    leftIcon={<FontAwesomeIcon icon={faProjectDiagram} />}
-                    onClick={() => handlePopUpOpen("secretReferenceTree", secretKey)}
-                  >
-                    Secret Reference Tree
-                  </Button>
-                </div>
-              </Tooltip>
+                Secret Reference Tree
+              </Button>
               <Tooltip content="Copy Secret ID" className="z-[100]">
                 <IconButton
                   variant="outline_bg"

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem.tsx

@@ -27,8 +27,8 @@ import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
 import {
   ProjectPermissionActions,
   ProjectPermissionSub,
-  useProjectPermission,
-  useProject
+  useProject,
+  useProjectPermission
 } from "@app/context";
 import { usePopUp, useToggle } from "@app/hooks";
 import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types";
@@ -47,6 +47,13 @@ import { faEyeSlash, faKey, faRotate } from "@fortawesome/free-solid-svg-icons";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 import { format } from "date-fns";
 import { CreateReminderForm } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/CreateReminderForm";
+import {
+  dashboardKeys,
+  fetchSecretValue,
+  useGetSecretValue
+} from "@app/hooks/api/dashboard/queries";
+import { createNotification } from "@app/components/notifications";
+import { useQueryClient } from "@tanstack/react-query";
 import {
   FontAwesomeSpriteName,
   formSchema,
@@ -56,11 +63,11 @@ import {
 import { CollapsibleSecretImports } from "./CollapsibleSecretImports";
 import { useBatchModeActions } from "../../SecretMainPage.store";
 
-export const HIDDEN_SECRET_VALUE = "*****************************";
+export const HIDDEN_SECRET_VALUE = "*************************";
 export const HIDDEN_SECRET_VALUE_API_MASK = "<hidden-by-infisical>";
 
 type Props = {
-  secret: SecretV3RawSanitized;
+  secret: SecretV3RawSanitized & { originalKey?: string };
   onSaveSecret: (
     orgSec: SecretV3RawSanitized,
     modSec: Omit<SecretV3RawSanitized, "tags"> & { tags?: { id: string }[] },
@@ -91,7 +98,7 @@ type Props = {
 
 export const SecretItem = memo(
   ({
-    secret,
+    secret: originalSecret,
     onSaveSecret,
     onDeleteSecret,
     onDetailViewSecret,
@@ -114,9 +121,43 @@ export const SecretItem = memo(
     ] as const);
     const { currentProject } = useProject();
     const { permission } = useProjectPermission();
-    const { isRotatedSecret } = secret;
     const { removePendingChange } = useBatchModeActions();
 
+    const [isFieldFocused, setIsFieldFocused] = useToggle();
+    const queryClient = useQueryClient();
+
+    const canFetchSecretValue =
+      !originalSecret.secretValueHidden &&
+      !originalSecret.isEmpty &&
+      pendingAction !== PendingAction.Create;
+
+    const fetchSecretValueParams = {
+      environment,
+      secretPath,
+      secretKey: originalSecret.originalKey || originalSecret.key,
+      projectId: currentProject.id,
+      isOverride: Boolean(originalSecret.idOverride)
+    };
+
+    const {
+      data: secretValueData,
+      isPending: isPendingSecretValueData,
+      isError: isErrorFetchingSecretValue
+    } = useGetSecretValue(fetchSecretValueParams, {
+      enabled: canFetchSecretValue && (isVisible || isFieldFocused)
+    });
+
+    const isLoadingSecretValue = canFetchSecretValue && isPendingSecretValueData;
+    const hasFetchedSecretValue = !canFetchSecretValue || Boolean(secretValueData);
+
+    const secret = {
+      ...originalSecret,
+      value: originalSecret.value ?? secretValueData?.value,
+      valueOverride: originalSecret.valueOverride ?? secretValueData?.valueOverride
+    };
+
+    const { isRotatedSecret } = secret;
+
     const autoSaveTimeoutRef = useRef<NodeJS.Timeout>();
     const isAutoSavingRef = useRef(false);
 
@@ -139,10 +180,27 @@ export const SecretItem = memo(
     );
 
     const getDefaultValue = () => {
+      if (isLoadingSecretValue) return undefined;
+
       if (secret.secretValueHidden && !isPending) {
         return canEditSecretValue ? HIDDEN_SECRET_VALUE : "";
       }
-      return secret.valueOverride || secret.value || "";
+
+      if (isErrorFetchingSecretValue) return undefined;
+
+      return secret.value || "";
+    };
+
+    const getOverrideDefaultValue = () => {
+      if (isLoadingSecretValue) return undefined;
+
+      if (secret.secretValueHidden && !isPending) {
+        return canEditSecretValue ? HIDDEN_SECRET_VALUE : "";
+      }
+
+      if (isErrorFetchingSecretValue) return undefined;
+
+      return secret.valueOverride || "";
     };
 
     const {
@@ -154,14 +212,17 @@ export const SecretItem = memo(
       reset,
       getValues,
       trigger,
-      formState: { isDirty, isSubmitting, errors }
+      formState: { isDirty, isSubmitting, errors },
+      getFieldState
     } = useForm<TFormSchema>({
       defaultValues: {
         ...secret,
+        valueOverride: getOverrideDefaultValue(),
         value: getDefaultValue()
       },
       values: {
         ...secret,
+        valueOverride: getOverrideDefaultValue(),
         value: getDefaultValue()
       },
       resolver: zodResolver(formSchema)
@@ -255,7 +316,10 @@ export const SecretItem = memo(
       );
 
     const isReadOnlySecret =
-      isReadOnly || isRotatedSecret || (isPending && pendingAction === PendingAction.Delete);
+      isReadOnly ||
+      isRotatedSecret ||
+      (isPending && pendingAction === PendingAction.Delete) ||
+      isLoadingSecretValue;
 
     const { secretValueHidden } = secret;
 
@@ -322,12 +386,36 @@ export const SecretItem = memo(
       }
     };
 
-    const copyTokenToClipboard = () => {
-      const [overrideValue, value] = getValues(["value", "valueOverride"]);
-      if (isOverridden) {
-        navigator.clipboard.writeText(value as string);
+    const fetchValue = async () => {
+      if (secretValueData) return secretValueData;
+
+      try {
+        const data = await fetchSecretValue(fetchSecretValueParams);
+
+        queryClient.setQueryData(dashboardKeys.getSecretValue(fetchSecretValueParams), data);
+
+        return data;
+      } catch (e) {
+        console.error(e);
+        createNotification({
+          type: "error",
+          text: "Failed to fetch secret value"
+        });
+        throw e;
+      }
+    };
+
+    const copyTokenToClipboard = async () => {
+      if (hasFetchedSecretValue) {
+        const [overrideValue, value] = getValues(["value", "valueOverride"]);
+        if (isOverridden) {
+          navigator.clipboard.writeText(value as string);
+        } else {
+          navigator.clipboard.writeText(overrideValue as string);
+        }
       } else {
-        navigator.clipboard.writeText(overrideValue as string);
+        const data = await fetchValue();
+        navigator.clipboard.writeText((data.valueOverride ?? data.value) as string);
       }
       setIsSecValueCopied.on();
     };
@@ -410,7 +498,7 @@ export const SecretItem = memo(
               tabIndex={0}
               role="button"
             >
-              {secretValueHidden && !isOverridden && !isPending && (
+              {secretValueHidden && !getFieldState("value").isDirty && (
                 <Tooltip
                   content={`You do not have access to view the current value${canEditSecretValue && !isRotatedSecret ? ", but you can set a new one" : "."}`}
                 >
@@ -424,10 +512,18 @@ export const SecretItem = memo(
                   control={control}
                   render={({ field }) => (
                     <SecretInput
+                      isLoadingValue={isLoadingSecretValue && Boolean(secret.idOverride)}
+                      isErrorLoadingValue={isErrorFetchingSecretValue}
                       key="value-overriden"
                       isVisible={isVisible}
-                      isReadOnly={isReadOnly}
                       {...field}
+                      onFocus={() => {
+                        if (secret.idOverride) setIsFieldFocused.on();
+                      }}
+                      onBlur={() => {
+                        setIsFieldFocused.off();
+                        field.onBlur();
+                      }}
                       containerClassName="py-1.5 rounded-md transition-all"
                     />
                   )}
@@ -439,6 +535,8 @@ export const SecretItem = memo(
                   control={control}
                   render={({ field }) => (
                     <InfisicalSecretInput
+                      isLoadingValue={isLoadingSecretValue}
+                      isErrorLoadingValue={isErrorFetchingSecretValue}
                       isReadOnly={isReadOnlySecret}
                       key="secret-value"
                       isVisible={isVisible && (!secretValueHidden || isPending)}
@@ -446,6 +544,13 @@ export const SecretItem = memo(
                       environment={environment}
                       secretPath={secretPath}
                       {...field}
+                      onFocus={() => {
+                        setIsFieldFocused.on();
+                      }}
+                      onBlur={() => {
+                        setIsFieldFocused.off();
+                        field.onBlur();
+                      }}
                       defaultValue={
                         secretValueHidden && !isPending ? HIDDEN_SECRET_VALUE : undefined
                       }
@@ -613,7 +718,7 @@ export const SecretItem = memo(
                     </DropdownMenuContent>
                   </DropdownMenu>
                   <ProjectPermissionCan
-                    I={ProjectPermissionActions.Edit}
+                    I={ProjectPermissionActions.Create}
                     a={subject(ProjectPermissionSub.Secrets, {
                       environment,
                       secretPath,
@@ -682,7 +787,19 @@ export const SecretItem = memo(
                       variant="plain"
                       size="md"
                       ariaLabel="share-secret"
-                      onClick={() => onShareSecret(secret)}
+                      onClick={async () => {
+                        if (hasFetchedSecretValue) {
+                          onShareSecret(secret);
+                          return;
+                        }
+
+                        const data = await fetchValue();
+
+                        onShareSecret({
+                          ...secret,
+                          ...data
+                        });
+                      }}
                     >
                       <Tooltip content="Share Secret">
                         <FontAwesomeSymbol

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretListView.tsx

@@ -466,7 +466,12 @@ export const SecretListView = ({
   );
 
   const handleSecretDelete = useCallback(async () => {
-    const { key, id: secretId, value } = popUp.deleteSecret?.data as SecretV3RawSanitized;
+    const {
+      key,
+      id: secretId,
+      value,
+      secretValueHidden
+    } = popUp.deleteSecret?.data as SecretV3RawSanitized;
     try {
       if (isBatchMode) {
         const deleteChange: PendingSecretDelete = {
@@ -475,7 +480,8 @@ export const SecretListView = ({
           secretKey: key,
           secretValue: value || "",
           timestamp: Date.now(),
-          resourceType: "secret"
+          resourceType: "secret",
+          secretValueHidden
         };
 
         addPendingChange(deleteChange, {
@@ -616,19 +622,21 @@ export const SecretListView = ({
           </>
         }
       />
-      <SecretDetailSidebar
-        environment={environment}
-        secretPath={secretPath}
-        isOpen={popUp.secretDetail.isOpen}
-        onToggle={(isOpen) => handlePopUpToggle("secretDetail", isOpen)}
-        secret={popUp.secretDetail.data as SecretV3RawSanitized}
-        onDeleteSecret={() => handlePopUpOpen("deleteSecret", popUp.secretDetail.data)}
-        onClose={() => handlePopUpClose("secretDetail")}
-        onSaveSecret={handleSaveSecret}
-        tags={wsTags}
-        onCreateTag={() => handlePopUpOpen("createTag")}
-        handleSecretShare={(value: string) => handlePopUpOpen("createSharedSecret", { value })}
-      />
+      {popUp.secretDetail.data && (
+        <SecretDetailSidebar
+          environment={environment}
+          secretPath={secretPath}
+          isOpen={popUp.secretDetail.isOpen}
+          onToggle={(isOpen) => handlePopUpToggle("secretDetail", isOpen)}
+          secret={popUp.secretDetail.data as SecretV3RawSanitized}
+          onDeleteSecret={() => handlePopUpOpen("deleteSecret", popUp.secretDetail.data)}
+          onClose={() => handlePopUpClose("secretDetail")}
+          onSaveSecret={handleSaveSecret}
+          tags={wsTags}
+          onCreateTag={() => handlePopUpOpen("createTag")}
+          handleSecretShare={(value: string) => handlePopUpOpen("createSharedSecret", { value })}
+        />
+      )}
       <CreateTagModal
         isOpen={popUp.createTag.isOpen}
         onToggle={(isOpen) => handlePopUpToggle("createTag", isOpen)}

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretVersionItem.tsx

@@ -0,0 +1,277 @@
+import { useState } from "react";
+import { faEye } from "@fortawesome/free-regular-svg-icons";
+import {
+  faArrowRotateRight,
+  faDesktop,
+  faEyeSlash,
+  faServer,
+  faUser
+} from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate } from "@tanstack/react-router";
+import { format } from "date-fns";
+import { twMerge } from "tailwind-merge";
+
+import { createNotification } from "@app/components/notifications";
+import { IconButton, Tooltip } from "@app/components/v2";
+import { useProject } from "@app/context";
+import { ActorType } from "@app/hooks/api/auditLogs/enums";
+import { fetchSecretVersionValue } from "@app/hooks/api/secrets/queries";
+import { SecretV3RawSanitized, SecretVersions } from "@app/hooks/api/secrets/types";
+
+interface SecretVersionItemProps {
+  secretVersion: SecretVersions;
+  secret: SecretV3RawSanitized;
+  currentVersion: number;
+  onRevert: (secretValue: string) => void;
+  canReadValue: boolean;
+}
+
+export const SecretVersionItem = ({
+  secretVersion: { createdAt, version, actor, secretValueHidden },
+  secret,
+  currentVersion,
+  onRevert,
+  canReadValue
+}: SecretVersionItemProps) => {
+  const { currentProject } = useProject();
+
+  const navigate = useNavigate();
+
+  const getModifiedByIcon = (userType: string | undefined | null) => {
+    switch (userType) {
+      case ActorType.USER:
+        return faUser;
+      case ActorType.IDENTITY:
+        return faDesktop;
+      default:
+        return faServer;
+    }
+  };
+
+  const getModifiedByName = (
+    userType: string | undefined | null,
+    userName: string | null | undefined
+  ) => {
+    switch (userType) {
+      case ActorType.PLATFORM:
+        return "System-generated";
+      case ActorType.IDENTITY:
+        return userName || "Deleted Identity";
+      case ActorType.USER:
+        return userName || "Deleted User";
+      default:
+        return "Unknown";
+    }
+  };
+
+  const getLinkToModifyHistoryEntity = (
+    actorId: string,
+    actorType: string,
+    membershipId: string | null = ""
+  ) => {
+    switch (actorType) {
+      case ActorType.USER:
+        return `/projects/secret-management/${currentProject.id}/members/${membershipId}`;
+      case ActorType.IDENTITY:
+        return `/projects/secret-management/${currentProject.id}/identities/${actorId}`;
+      default:
+        return null;
+    }
+  };
+
+  const onModifyHistoryClick = (
+    actorId: string | undefined | null,
+    actorType: string | undefined | null,
+    membershipId: string | undefined | null
+  ) => {
+    if (actorType && actorId && actorType !== ActorType.PLATFORM) {
+      const redirectLink = getLinkToModifyHistoryEntity(actorId, actorType, membershipId);
+      if (redirectLink) {
+        navigate({ to: redirectLink });
+      }
+    }
+  };
+
+  const [secretValue, setSecretValue] = useState<string | null>(null);
+  const [isFetchingValue, setIsFetchingValue] = useState(false);
+  const handleGetSecretValue = async () => {
+    if (secretValue) return secretValue;
+    try {
+      setIsFetchingValue(true);
+      const value = await fetchSecretVersionValue(secret.id, version);
+      setSecretValue(value);
+      return value;
+    } catch (e) {
+      console.error(e);
+      createNotification({
+        type: "error",
+        text: "Failed to fetch secret version value"
+      });
+      throw e;
+    } finally {
+      setIsFetchingValue(false);
+    }
+  };
+
+  const handleCopyValue = async (
+    e: React.MouseEvent<HTMLButtonElement> | React.KeyboardEvent<HTMLButtonElement>
+  ) => {
+    const value = await handleGetSecretValue();
+    navigator.clipboard.writeText(value || "");
+    const target = e.currentTarget;
+    target.style.borderBottom = "1px dashed";
+    target.style.paddingBottom = "-1px";
+
+    // Create and insert popup
+    const popup = document.createElement("div");
+    popup.className =
+      "w-16 flex justify-center absolute top-6 left-0 text-xs text-primary-100 bg-mineshaft-800 px-1 py-0.5 rounded-md border border-primary-500/50";
+    popup.textContent = "Copied!";
+    target.parentElement?.appendChild(popup);
+
+    // Remove popup and border after delay
+    setTimeout(() => {
+      popup.remove();
+      target.style.borderBottom = "none";
+    }, 3000);
+  };
+
+  return (
+    <div className="flex flex-row">
+      <div className="flex w-full flex-col space-y-1">
+        <div className="flex items-center">
+          <div className="w-10">
+            <div className="w-fit rounded-md border border-mineshaft-600 bg-mineshaft-700 px-1 text-sm text-mineshaft-300">
+              v{version}
+            </div>
+          </div>
+          <div>{format(new Date(createdAt), "Pp")}</div>
+        </div>
+        <div className="flex w-full cursor-default">
+          <div className="relative w-10">
+            <div className="absolute bottom-0 left-3 top-0 mt-0.5 border-l border-mineshaft-400/60" />
+          </div>
+          <div className="flex w-full cursor-default flex-col">
+            {actor && (
+              <div className="flex flex-row">
+                <div className="flex w-fit flex-row text-sm">
+                  Modified by:
+                  <Tooltip content={getModifiedByName(actor.actorType, actor.name)}>
+                    {/* eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions */}
+                    <div
+                      onClick={() =>
+                        onModifyHistoryClick(actor.actorId, actor.actorType, actor.membershipId)
+                      }
+                      className="cursor-pointer"
+                    >
+                      <FontAwesomeIcon icon={getModifiedByIcon(actor.actorType)} className="ml-2" />
+                    </div>
+                  </Tooltip>
+                </div>
+              </div>
+            )}
+            <div className="flex flex-row">
+              <div className="h-min w-fit rounded-sm bg-primary-500/10 px-1 text-primary-300/70">
+                Value:
+              </div>
+              <div className="group break-all pl-1 font-mono">
+                <div className="relative hidden cursor-pointer transition-all duration-200 group-[.show-value]:inline">
+                  <button
+                    type="button"
+                    className="select-none text-left"
+                    onClick={async (e) => {
+                      if (secretValueHidden) return;
+
+                      await handleCopyValue(e);
+                    }}
+                    onKeyDown={async (e) => {
+                      if (secretValueHidden) return;
+
+                      if (e.key === "Enter" || e.key === " ") {
+                        await handleCopyValue(e);
+                      }
+                    }}
+                  >
+                    <span
+                      className={twMerge(secretValueHidden && "text-xs text-bunker-300 opacity-40")}
+                    >
+                      {/* eslint-disable-next-line no-nested-ternary */}
+                      {secretValueHidden
+                        ? "Hidden"
+                        : isFetchingValue
+                          ? "****"
+                          : ((secretValue || <span className="text-mineshaft-400">EMPTY</span>) ??
+                            "Error fetching secret value...")}
+                    </span>
+                  </button>
+                  <button
+                    type="button"
+                    className="ml-1 cursor-pointer"
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      e.currentTarget.closest(".group")?.classList.remove("show-value");
+                    }}
+                    onKeyDown={(e) => {
+                      if (e.key === "Enter" || e.key === " ") {
+                        e.stopPropagation();
+                        e.currentTarget.closest(".group")?.classList.remove("show-value");
+                      }
+                    }}
+                  >
+                    <FontAwesomeIcon icon={faEyeSlash} />
+                  </button>
+                </div>
+                <span className="group-[.show-value]:hidden">
+                  ****
+                  <button
+                    type="button"
+                    className="ml-1 cursor-pointer"
+                    onClick={async (e) => {
+                      e.currentTarget.closest(".group")?.classList.add("show-value");
+                      await handleGetSecretValue();
+                    }}
+                    onKeyDown={async (e) => {
+                      if (e.key === "Enter" || e.key === " ") {
+                        e.currentTarget.closest(".group")?.classList.add("show-value");
+                        await handleGetSecretValue();
+                      }
+                    }}
+                  >
+                    <FontAwesomeIcon icon={faEye} />
+                  </button>
+                </span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+      {!secret?.isRotatedSecret && canReadValue && (
+        <div
+          className={`flex items-center justify-center ${version === currentVersion ? "hidden" : ""}`}
+        >
+          <Tooltip content="Restore Secret Value">
+            <IconButton
+              ariaLabel="Restore"
+              variant="outline_bg"
+              size="sm"
+              className="h-8 w-8 rounded-md"
+              onClick={async () => {
+                if (secretValue) {
+                  onRevert(secretValue);
+                  return;
+                }
+
+                const value = await handleGetSecretValue();
+
+                onRevert(value);
+              }}
+            >
+              <FontAwesomeIcon icon={faArrowRotateRight} />
+            </IconButton>
+          </Tooltip>
+        </div>
+      )}
+    </div>
+  );
+};

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretRotationListView/SecretRotationItem.tsx

@@ -15,13 +15,13 @@ import { twMerge } from "tailwind-merge";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretRotationV2StatusBadge } from "@app/components/secret-rotations-v2/SecretRotationV2StatusBadge";
 import { IconButton, Modal, ModalContent, TableContainer, Tag, Tooltip } from "@app/components/v2";
-import { Blur } from "@app/components/v2/Blur";
-import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
 import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionSecretRotationActions } from "@app/context/ProjectPermissionContext/types";
 import { SECRET_ROTATION_MAP } from "@app/helpers/secretRotationsV2";
 import { TSecretRotationV2 } from "@app/hooks/api/secretRotationsV2";
 
+import { SecretRotationSecretRow } from "./SecretRotationSecretRow";
+
 type Props = {
   secretRotation: TSecretRotationV2;
   onEdit: () => void;
@@ -209,43 +209,13 @@ export const SecretRotationItem = ({
               <tbody>
                 {secrets.map((secret, index) => {
                   return (
-                    <Tooltip
-                      className="max-w-sm"
-                      content={
-                        secret ? undefined : "You do not have permission to view this secret."
-                      }
-                    >
-                      <tr
-                        // eslint-disable-next-line react/no-array-index-key
-                        key={`rotation-secret-${secretRotation.id}-${index}`}
-                        className="h-full last:!border-b-0 hover:bg-mineshaft-700"
-                      >
-                        <td className="flex h-full items-center" style={{ padding: "0.5rem 1rem" }}>
-                          <span className={twMerge(!secret && "blur")}>
-                            {secret?.key ?? "********"}
-                          </span>
-                        </td>
-                        <td className="col-span-2 h-full w-full" style={{ padding: "0.5rem 1rem" }}>
-                          {/* eslint-disable-next-line no-nested-ternary */}
-                          {!secret ? (
-                            <div className="h-full pl-4 blur">********</div>
-                          ) : secret.secretValueHidden ? (
-                            <Blur
-                              className="py-0"
-                              tooltipText="You do not have permission to read the value of this secret."
-                            />
-                          ) : (
-                            <InfisicalSecretInput
-                              isReadOnly
-                              value={secret.value}
-                              secretPath={secretRotation.folder.path}
-                              environment={secretRotation.environment.slug}
-                              onChange={() => {}}
-                            />
-                          )}
-                        </td>
-                      </tr>
-                    </Tooltip>
+                    <SecretRotationSecretRow
+                      // eslint-disable-next-line react/no-array-index-key
+                      key={`rotation-secret-${secretRotation.id}-${index}`}
+                      secret={secret}
+                      environment={secretRotation.environment.slug}
+                      secretPath={secretRotation.folder.path}
+                    />
                   );
                 })}
               </tbody>

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretRotationListView/SecretRotationSecretRow.tsx

@@ -0,0 +1,76 @@
+import { twMerge } from "tailwind-merge";
+
+import { SecretInput, Tooltip } from "@app/components/v2";
+import { Blur } from "@app/components/v2/Blur";
+import { useProject } from "@app/context";
+import { useToggle } from "@app/hooks";
+import { useGetSecretValue } from "@app/hooks/api/dashboard/queries";
+import { TSecretRotationV2 } from "@app/hooks/api/secretRotationsV2";
+import { HIDDEN_SECRET_VALUE } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";
+
+interface SecretRotationSecretRowProps {
+  secret: TSecretRotationV2["secrets"][number];
+  secretPath: string;
+  environment: string;
+}
+
+export const SecretRotationSecretRow = ({
+  secret,
+  environment,
+  secretPath
+}: SecretRotationSecretRowProps) => {
+  const [isFieldFocused, setIsFieldFocused] = useToggle();
+
+  const { currentProject } = useProject();
+
+  const { data: secretValue, isPending: isLoadingSecretValue } = useGetSecretValue(
+    {
+      environment,
+      secretPath,
+      secretKey: secret?.key ?? "",
+      projectId: currentProject.id
+    },
+    {
+      enabled: isFieldFocused && Boolean(secret)
+    }
+  );
+
+  const getValue = () => {
+    if (isLoadingSecretValue) return HIDDEN_SECRET_VALUE;
+
+    if (!secretValue) return "Error loading secret value";
+
+    return secretValue.value || "";
+  };
+
+  return (
+    <Tooltip
+      className="max-w-sm"
+      content={secret ? undefined : "You do not have permission to view this secret."}
+    >
+      <tr className="h-full last:!border-b-0 hover:bg-mineshaft-700">
+        <td className="flex h-full items-center" style={{ padding: "0.5rem 1rem" }}>
+          <span className={twMerge(!secret && "blur")}>{secret?.key ?? "********"}</span>
+        </td>
+        <td className="col-span-2 h-full w-full" style={{ padding: "0.5rem 1rem" }}>
+          {/* eslint-disable-next-line no-nested-ternary */}
+          {!secret ? (
+            <div className="h-full pl-4 blur">********</div>
+          ) : secret.secretValueHidden ? (
+            <Blur
+              className="py-0"
+              tooltipText="You do not have permission to read the value of this secret."
+            />
+          ) : (
+            <SecretInput
+              isReadOnly
+              value={getValue()}
+              onFocus={() => setIsFieldFocused.on()}
+              onBlur={() => setIsFieldFocused.off()}
+            />
+          )}
+        </td>
+      </tr>
+    </Tooltip>
+  );
+};