Merge branch 'main' into shubham/eng-984-make-secret-sharing-public-even-for-non-infisical-users

frontend/src/hooks/api/auditLogs/constants.tsx

@@ -26,7 +26,6 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET]: "Create universal auth client secret",
   [EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET]: "Revoke universal auth client secret",
   [EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS]: "Get universal auth client secrets",
-  [EventType.GET_IDENTITY_UNIVERSAL_AUTH]: "Get universal auth",
   [EventType.CREATE_ENVIRONMENT]: "Create environment",
   [EventType.UPDATE_ENVIRONMENT]: "Update environment",
   [EventType.DELETE_ENVIRONMENT]: "Delete environment",
@@ -43,7 +42,21 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.UPDATE_SECRET_IMPORT]: "Update secret import",
   [EventType.DELETE_SECRET_IMPORT]: "Delete secret import",
   [EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS]: "Update denied permissions",
-  [EventType.UPDATE_USER_WORKSPACE_ROLE]: "Update user role"
+  [EventType.UPDATE_USER_WORKSPACE_ROLE]: "Update user role",
+  [EventType.CREATE_CA]: "Create CA",
+  [EventType.GET_CA]: "Get CA",
+  [EventType.UPDATE_CA]: "Update CA",
+  [EventType.DELETE_CA]: "Delete CA",
+  [EventType.GET_CA_CSR]: "Get CA CSR",
+  [EventType.GET_CA_CERT]: "Get CA certificate",
+  [EventType.SIGN_INTERMEDIATE]: "Sign intermediate",
+  [EventType.IMPORT_CA_CERT]: "Import CA certificate",
+  [EventType.GET_CA_CRL]: "Get CA CRL",
+  [EventType.ISSUE_CERT]: "Issue certificate",
+  [EventType.GET_CERT]: "Get certificate",
+  [EventType.DELETE_CERT]: "Delete certificate",
+  [EventType.REVOKE_CERT]: "Revoke certificate",
+  [EventType.GET_CERT_BODY]: "Get certificate body"
 };
 
 export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = {

frontend/src/hooks/api/auditLogs/enums.tsx

@@ -56,5 +56,19 @@ export enum EventType {
   UPDATE_SECRET_IMPORT = "update-secret-import",
   DELETE_SECRET_IMPORT = "delete-secret-import",
   UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role",
-  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions"
+  UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions",
+  CREATE_CA = "create-certificate-authority",
+  GET_CA = "get-certificate-authority",
+  UPDATE_CA = "update-certificate-authority",
+  DELETE_CA = "delete-certificate-authority",
+  GET_CA_CSR = "get-certificate-authority-csr",
+  GET_CA_CERT = "get-certificate-authority-cert",
+  SIGN_INTERMEDIATE = "sign-intermediate",
+  IMPORT_CA_CERT = "import-certificate-authority-cert",
+  GET_CA_CRL = "get-certificate-authority-crl",
+  ISSUE_CERT = "issue-cert",
+  GET_CERT = "get-cert",
+  DELETE_CERT = "delete-cert",
+  REVOKE_CERT = "revoke-cert",
+  GET_CERT_BODY = "get-cert-body"
 }

frontend/src/hooks/api/auditLogs/types.tsx

@@ -1,3 +1,4 @@
+import { CaStatus } from "../ca";
 import { IdentityTrustedIp } from "../identities/types";
 import { ActorType, EventType, UserAgentType } from "./enums";
 
@@ -462,6 +463,125 @@ interface UpdateUserDeniedPermissions {
   };
 }
 
+interface CreateCa {
+  type: EventType.CREATE_CA;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface GetCa {
+  type: EventType.GET_CA;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface UpdateCa {
+  type: EventType.UPDATE_CA;
+  metadata: {
+    caId: string;
+    dn: string;
+    status: CaStatus;
+  };
+}
+
+interface DeleteCa {
+  type: EventType.DELETE_CA;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface GetCaCsr {
+  type: EventType.GET_CA_CSR;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface GetCaCert {
+  type: EventType.GET_CA_CERT;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface SignIntermediate {
+  type: EventType.SIGN_INTERMEDIATE;
+  metadata: {
+    caId: string;
+    dn: string;
+    serialNumber: string;
+  };
+}
+
+interface ImportCaCert {
+  type: EventType.IMPORT_CA_CERT;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface GetCaCrl {
+  type: EventType.GET_CA_CRL;
+  metadata: {
+    caId: string;
+    dn: string;
+  };
+}
+
+interface IssueCert {
+  type: EventType.ISSUE_CERT;
+  metadata: {
+    caId: string;
+    dn: string;
+    serialNumber: string;
+  };
+}
+
+interface GetCert {
+  type: EventType.GET_CERT;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
+interface DeleteCert {
+  type: EventType.DELETE_CERT;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
+interface RevokeCert {
+  type: EventType.REVOKE_CERT;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
+interface GetCertBody {
+  type: EventType.GET_CERT_BODY;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
+
 export type Event =
   | GetSecretsEvent
   | GetSecretEvent
@@ -504,7 +624,21 @@ export type Event =
   | UpdateSecretImportEvent
   | DeleteSecretImportEvent
   | UpdateUserRole
-  | UpdateUserDeniedPermissions;
+  | UpdateUserDeniedPermissions
+  | CreateCa
+  | GetCa
+  | UpdateCa
+  | DeleteCa
+  | GetCaCsr
+  | GetCaCert
+  | SignIntermediate
+  | ImportCaCert
+  | GetCaCrl
+  | IssueCert
+  | GetCert
+  | DeleteCert
+  | RevokeCert
+  | GetCertBody;
 
 export type AuditLog = {
   id: string;

frontend/src/hooks/api/auth/types.ts

@@ -30,6 +30,7 @@ export type Login1DTO = {
 };
 
 export type Login2DTO = {
+  captchaToken?: string;
   email: string;
   clientProof: string;
   providerAuthToken?: string;

frontend/src/hooks/api/ca/constants.tsx

@@ -0,0 +1,12 @@
+import { CaStatus,CaType } from "./enums";
+
+export const caTypeToNameMap: { [K in CaType]: string } = {
+  [CaType.ROOT]: "Root",
+  [CaType.INTERMEDIATE]: "Intermediate"
+};
+
+export const caStatusToNameMap: { [K in CaStatus]: string } = {
+  [CaStatus.ACTIVE]: "Active",
+  [CaStatus.DISABLED]: "Disabled",
+  [CaStatus.PENDING_CERTIFICATE]: "Pending Certificate"
+};

frontend/src/hooks/api/ca/enums.tsx

@@ -0,0 +1,10 @@
+export enum CaType {
+  ROOT = "root",
+  INTERMEDIATE = "intermediate"
+}
+
+export enum CaStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+  PENDING_CERTIFICATE = "pending-certificate"
+}

frontend/src/hooks/api/ca/index.tsx

@@ -0,0 +1,10 @@
+export { CaStatus, CaType } from "./enums";
+export {
+  useCreateCa,
+  useCreateCertificate,
+  useDeleteCa,
+  useImportCaCertificate,
+  useSignIntermediate,
+  useUpdateCa
+} from "./mutations";
+export { useGetCaById, useGetCaCert, useGetCaCrl,useGetCaCsr } from "./queries";

frontend/src/hooks/api/ca/mutations.tsx

@@ -0,0 +1,108 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { workspaceKeys } from "../workspace/queries";
+import {
+  TCertificateAuthority,
+  TCreateCaDTO,
+  TCreateCertificateDTO,
+  TCreateCertificateResponse,
+  TDeleteCaDTO,
+  TImportCaCertificateDTO,
+  TImportCaCertificateResponse,
+  TSignIntermediateDTO,
+  TSignIntermediateResponse,
+  TUpdateCaDTO
+} from "./types";
+
+export const useCreateCa = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateAuthority, {}, TCreateCaDTO>({
+    mutationFn: async (body) => {
+      const {
+        data: { ca }
+      } = await apiRequest.post<{ ca: TCertificateAuthority }>("/api/v1/pki/ca/", body);
+      return ca;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug }));
+    }
+  });
+};
+
+export const useUpdateCa = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateAuthority, {}, TUpdateCaDTO>({
+    mutationFn: async ({ caId, projectSlug, ...body }) => {
+      const {
+        data: { ca }
+      } = await apiRequest.patch<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`, body);
+      return ca;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug }));
+    }
+  });
+};
+
+export const useDeleteCa = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateAuthority, {}, TDeleteCaDTO>({
+    mutationFn: async ({ caId }) => {
+      const {
+        data: { ca }
+      } = await apiRequest.delete<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`);
+      return ca;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug }));
+    }
+  });
+};
+
+export const useSignIntermediate = () => {
+  // TODO: consider renaming
+  return useMutation<TSignIntermediateResponse, {}, TSignIntermediateDTO>({
+    mutationFn: async (body) => {
+      const { data } = await apiRequest.post<TSignIntermediateResponse>(
+        `/api/v1/pki/ca/${body.caId}/sign-intermediate`,
+        body
+      );
+      return data;
+    }
+  });
+};
+
+export const useImportCaCertificate = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TImportCaCertificateResponse, {}, TImportCaCertificateDTO>({
+    mutationFn: async ({ caId, ...body }) => {
+      const { data } = await apiRequest.post<TImportCaCertificateResponse>(
+        `/api/v1/pki/ca/${caId}/import-certificate`,
+        body
+      );
+      return data;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug }));
+    }
+  });
+};
+
+// consider rename to issue certificate
+export const useCreateCertificate = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCreateCertificateResponse, {}, TCreateCertificateDTO>({
+    mutationFn: async ({ caId, ...body }) => {
+      const { data } = await apiRequest.post<TCreateCertificateResponse>(
+        `/api/v1/pki/ca/${caId}/issue-certificate`,
+        body
+      );
+      return data;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug));
+    }
+  });
+};

frontend/src/hooks/api/ca/queries.tsx

@@ -0,0 +1,70 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TCertificateAuthority } from "./types";
+
+export const caKeys = {
+  getCaById: (caId: string) => [{ caId }, "ca"],
+  getCaCert: (caId: string) => [{ caId }, "ca-cert"],
+  getCaCsr: (caId: string) => [{ caId }, "ca-csr"],
+  getCaCrl: (caId: string) => [{ caId }, "ca-crl"]
+};
+
+export const useGetCaById = (caId: string) => {
+  return useQuery({
+    queryKey: caKeys.getCaById(caId),
+    queryFn: async () => {
+      const {
+        data: { ca }
+      } = await apiRequest.get<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`);
+      return ca;
+    },
+    enabled: Boolean(caId)
+  });
+};
+
+export const useGetCaCert = (caId: string) => {
+  return useQuery({
+    queryKey: caKeys.getCaCert(caId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        certificate: string;
+        certificateChain: string;
+        serialNumber: string;
+      }>(`/api/v1/pki/ca/${caId}/certificate`);
+      return data;
+    },
+    enabled: Boolean(caId)
+  });
+};
+
+export const useGetCaCsr = (caId: string) => {
+  return useQuery({
+    queryKey: caKeys.getCaCsr(caId),
+    queryFn: async () => {
+      const {
+        data: { csr }
+      } = await apiRequest.get<{
+        csr: string;
+      }>(`/api/v1/pki/ca/${caId}/csr`);
+      return csr;
+    },
+    enabled: Boolean(caId)
+  });
+};
+
+export const useGetCaCrl = (caId: string) => {
+  return useQuery({
+    queryKey: caKeys.getCaCrl(caId),
+    queryFn: async () => {
+      const {
+        data: { crl }
+      } = await apiRequest.get<{
+        crl: string;
+      }>(`/api/v1/pki/ca/${caId}/crl`);
+      return crl;
+    },
+    enabled: Boolean(caId)
+  });
+};

frontend/src/hooks/api/ca/types.ts

@@ -0,0 +1,95 @@
+import { CertKeyAlgorithm } from "../certificates/enums";
+import { CaStatus, CaType } from "./enums";
+
+export type TCertificateAuthority = {
+  id: string;
+  parentCaId?: string;
+  projectId: string;
+  type: CaType;
+  status: CaStatus;
+  friendlyName: string;
+  organization: string;
+  ou: string;
+  country: string;
+  province: string;
+  locality: string;
+  commonName: string;
+  dn: string;
+  maxPathLength?: number;
+  notAfter?: string;
+  notBefore?: string;
+  keyAlgorithm: CertKeyAlgorithm;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type TCreateCaDTO = {
+  projectSlug: string;
+  type: string;
+  friendlyName?: string;
+  organization: string;
+  ou: string;
+  country: string;
+  province: string;
+  locality: string;
+  commonName: string;
+  notAfter?: string;
+  maxPathLength: number;
+  keyAlgorithm: CertKeyAlgorithm;
+};
+
+export type TUpdateCaDTO = {
+  projectSlug: string;
+  caId: string;
+  status?: CaStatus;
+};
+
+export type TDeleteCaDTO = {
+  projectSlug: string;
+  caId: string;
+};
+
+export type TSignIntermediateDTO = {
+  caId: string;
+  csr: string;
+  maxPathLength: number;
+  notBefore?: string;
+  notAfter?: string;
+};
+
+export type TSignIntermediateResponse = {
+  certificate: string;
+  certificateChain: string;
+  issuingCaCertificate: string;
+  serialNumber: string;
+};
+
+export type TImportCaCertificateDTO = {
+  caId: string;
+  projectSlug: string;
+  certificate: string;
+  certificateChain: string;
+};
+
+export type TImportCaCertificateResponse = {
+  message: string;
+  caId: string;
+};
+
+export type TCreateCertificateDTO = {
+  projectSlug: string;
+  caId: string;
+  friendlyName?: string;
+  commonName: string;
+  ttl: string; // string compatible with ms
+  notBefore?: string;
+  notAfter?: string;
+};
+
+export type TCreateCertificateResponse = {
+  certificate: string;
+  issuingCertificate: string;
+  certificateChain: string;
+  privateKey: string;
+  serialNumber: string;
+};

frontend/src/hooks/api/certificates/constants.tsx

@@ -0,0 +1,60 @@
+import { CertKeyAlgorithm, CertStatus,CrlReason } from "./enums";
+
+export const certStatusToNameMap: { [K in CertStatus]: string } = {
+  [CertStatus.ACTIVE]: "Active",
+  [CertStatus.REVOKED]: "Revoked"
+};
+
+export const certKeyAlgorithmToNameMap: { [K in CertKeyAlgorithm]: string } = {
+  [CertKeyAlgorithm.RSA_2048]: "RSA 2048",
+  [CertKeyAlgorithm.RSA_4096]: "RSA 4096",
+  [CertKeyAlgorithm.ECDSA_P256]: "ECDSA P256",
+  [CertKeyAlgorithm.ECDSA_P384]: "ECDSA P384"
+};
+
+export const certKeyAlgorithms = [
+  { label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.RSA_2048], value: CertKeyAlgorithm.RSA_2048 },
+  { label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.RSA_4096], value: CertKeyAlgorithm.RSA_4096 },
+  {
+    label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.ECDSA_P256],
+    value: CertKeyAlgorithm.ECDSA_P256
+  },
+  {
+    label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.ECDSA_P384],
+    value: CertKeyAlgorithm.ECDSA_P384
+  }
+];
+
+export const crlReasonToNameMap: { [K in CrlReason]: string } = {
+  [CrlReason.UNSPECIFIED]: "Unspecified",
+  [CrlReason.KEY_COMPROMISE]: "Key Compromise",
+  [CrlReason.CA_COMPROMISE]: "CA Compromise",
+  [CrlReason.AFFILIATION_CHANGED]: "Affiliation Changed",
+  [CrlReason.SUPERSEDED]: "Superseded",
+  [CrlReason.CESSATION_OF_OPERATION]: "Cessation of Operation",
+  [CrlReason.CERTIFICATE_HOLD]: "Certificate Hold",
+  // [CrlReason.REMOVE_FROM_CRL]: "Remove from CRL",
+  [CrlReason.PRIVILEGE_WITHDRAWN]: "Privilege Withdrawn",
+  [CrlReason.A_A_COMPROMISE]: "A/A Compromise"
+};
+
+export const crlReasons = [
+  { label: crlReasonToNameMap[CrlReason.UNSPECIFIED], value: CrlReason.UNSPECIFIED },
+  { label: crlReasonToNameMap[CrlReason.KEY_COMPROMISE], value: CrlReason.KEY_COMPROMISE },
+  { label: crlReasonToNameMap[CrlReason.CA_COMPROMISE], value: CrlReason.CA_COMPROMISE },
+  {
+    label: crlReasonToNameMap[CrlReason.AFFILIATION_CHANGED],
+    value: CrlReason.AFFILIATION_CHANGED
+  },
+  { label: crlReasonToNameMap[CrlReason.SUPERSEDED], value: CrlReason.SUPERSEDED },
+  {
+    label: crlReasonToNameMap[CrlReason.CESSATION_OF_OPERATION],
+    value: CrlReason.CESSATION_OF_OPERATION
+  },
+  { label: crlReasonToNameMap[CrlReason.CERTIFICATE_HOLD], value: CrlReason.CERTIFICATE_HOLD },
+  {
+    label: crlReasonToNameMap[CrlReason.PRIVILEGE_WITHDRAWN],
+    value: CrlReason.PRIVILEGE_WITHDRAWN
+  },
+  { label: crlReasonToNameMap[CrlReason.A_A_COMPROMISE], value: CrlReason.A_A_COMPROMISE }
+];

frontend/src/hooks/api/certificates/enums.tsx

@@ -0,0 +1,24 @@
+export enum CertStatus {
+  ACTIVE = "active",
+  REVOKED = "revoked"
+}
+
+export enum CertKeyAlgorithm {
+  RSA_2048 = "RSA_2048",
+  RSA_4096 = "RSA_4096",
+  ECDSA_P256 = "EC_prime256v1",
+  ECDSA_P384 = "EC_secp384r1"
+}
+
+export enum CrlReason {
+  UNSPECIFIED = "UNSPECIFIED",
+  KEY_COMPROMISE = "KEY_COMPROMISE",
+  CA_COMPROMISE = "CA_COMPROMISE",
+  AFFILIATION_CHANGED = "AFFILIATION_CHANGED",
+  SUPERSEDED = "SUPERSEDED",
+  CESSATION_OF_OPERATION = "CESSATION_OF_OPERATION",
+  CERTIFICATE_HOLD = "CERTIFICATE_HOLD",
+  // REMOVE_FROM_CRL = "REMOVE_FROM_CRL",
+  PRIVILEGE_WITHDRAWN = "PRIVILEGE_WITHDRAWN",
+  A_A_COMPROMISE = "A_A_COMPROMISE"
+}

frontend/src/hooks/api/certificates/index.tsx

@@ -0,0 +1,2 @@
+export { useDeleteCert, useRevokeCert } from "./mutations";
+export { useGetCert, useGetCertBody } from "./queries";

frontend/src/hooks/api/certificates/mutations.tsx

@@ -0,0 +1,43 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { workspaceKeys } from "../workspace/queries";
+import { TCertificate, TDeleteCertDTO, TRevokeCertDTO } from "./types";
+
+export const useDeleteCert = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificate, {}, TDeleteCertDTO>({
+    mutationFn: async ({ serialNumber }) => {
+      const {
+        data: { certificate }
+      } = await apiRequest.delete<{ certificate: TCertificate }>(
+        `/api/v1/pki/certificates/${serialNumber}`
+      );
+      return certificate;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug));
+    }
+  });
+};
+
+export const useRevokeCert = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificate, {}, TRevokeCertDTO>({
+    mutationFn: async ({ serialNumber, revocationReason }) => {
+      const {
+        data: { certificate }
+      } = await apiRequest.post<{ certificate: TCertificate }>(
+        `/api/v1/pki/certificates/${serialNumber}/revoke`,
+        {
+          revocationReason
+        }
+      );
+      return certificate;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug));
+    }
+  });
+};

frontend/src/hooks/api/certificates/queries.tsx

@@ -0,0 +1,40 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TCertificate } from "./types";
+
+export const certKeys = {
+  getCertById: (serialNumber: string) => [{ serialNumber }, "cert"],
+  getCertBody: (serialNumber: string) => [{ serialNumber }, "certBody"]
+};
+
+export const useGetCert = (serialNumber: string) => {
+  return useQuery({
+    queryKey: certKeys.getCertById(serialNumber),
+    queryFn: async () => {
+      const {
+        data: { certificate }
+      } = await apiRequest.get<{ certificate: TCertificate }>(
+        `/api/v1/pki/certificates/${serialNumber}`
+      );
+      return certificate;
+    },
+    enabled: Boolean(serialNumber)
+  });
+};
+
+export const useGetCertBody = (serialNumber: string) => {
+  return useQuery({
+    queryKey: certKeys.getCertBody(serialNumber),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        certificate: string;
+        certificateChain: string;
+        serialNumber: string;
+      }>(`/api/v1/pki/certificates/${serialNumber}/certificate`);
+      return data;
+    },
+    enabled: Boolean(serialNumber)
+  });
+};

frontend/src/hooks/api/certificates/types.ts

@@ -0,0 +1,23 @@
+import { CertStatus } from "./enums";
+
+export type TCertificate = {
+  id: string;
+  caId: string;
+  status: CertStatus;
+  friendlyName: string;
+  commonName: string;
+  serialNumber: string;
+  notBefore: string;
+  notAfter: string;
+};
+
+export type TDeleteCertDTO = {
+  projectSlug: string;
+  serialNumber: string;
+};
+
+export type TRevokeCertDTO = {
+  projectSlug: string;
+  serialNumber: string;
+  revocationReason: string;
+};

frontend/src/hooks/api/index.tsx

@@ -5,6 +5,8 @@ export * from "./auditLogs";
 export * from "./auditLogStreams";
 export * from "./auth";
 export * from "./bots";
+export * from "./ca";
+export * from "./certificates";
 export * from "./dynamicSecret";
 export * from "./dynamicSecretLease";
 export * from "./groups";
@@ -17,6 +19,7 @@ export * from "./keys";
 export * from "./ldapConfig";
 export * from "./organization";
 export * from "./projectUserAdditionalPrivilege";
+export * from "./rateLimit";
 export * from "./roles";
 export * from "./scim";
 export * from "./secretApproval";

frontend/src/hooks/api/integrations/queries.tsx

@@ -73,6 +73,9 @@ export const useCreateIntegration = () => {
         }[];
         kmsKeyId?: string;
         shouldDisableDelete?: boolean;
+        shouldMaskSecrets?: boolean;
+        shouldProtectSecrets?: boolean;
+        shouldEnableDelete?: boolean;
       };
     }) => {
       const {

frontend/src/hooks/api/rateLimit/index.ts

@@ -0,0 +1,2 @@
+export { useUpdateRateLimit } from "./mutation";
+export { useGetRateLimit } from "./queries";

frontend/src/hooks/api/rateLimit/mutation.ts

@@ -0,0 +1,21 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { rateLimitQueryKeys } from "./queries";
+import { TRateLimit } from "./types";
+
+export const useUpdateRateLimit = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<TRateLimit, {}, TRateLimit>({
+    mutationFn: async (opt) => {
+      const { data } = await apiRequest.put<{ rateLimit: TRateLimit }>("/api/v1/rate-limit", opt);
+      return data.rateLimit;
+    },
+    onSuccess: (data) => {
+      queryClient.setQueryData(rateLimitQueryKeys.rateLimit(), data);
+      queryClient.invalidateQueries(rateLimitQueryKeys.rateLimit());
+    }
+  });
+};

frontend/src/hooks/api/rateLimit/queries.ts

@@ -0,0 +1,34 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TRateLimit } from "./types";
+
+export const rateLimitQueryKeys = {
+  rateLimit: () => ["rate-limit"] as const
+};
+
+const fetchRateLimit = async () => {
+  const { data } = await apiRequest.get<{ rateLimit: TRateLimit }>("/api/v1/rate-limit");
+  return data.rateLimit;
+};
+
+export const useGetRateLimit = ({
+  options = {}
+}: {
+  options?: Omit<
+    UseQueryOptions<
+      TRateLimit,
+      unknown,
+      TRateLimit,
+      ReturnType<typeof rateLimitQueryKeys.rateLimit>
+    >,
+    "queryKey" | "queryFn"
+  >;
+} = {}) =>
+  useQuery({
+    queryKey: rateLimitQueryKeys.rateLimit(),
+    queryFn: fetchRateLimit,
+    ...options,
+    enabled: options?.enabled ?? true
+  });

frontend/src/hooks/api/rateLimit/types.ts

@@ -0,0 +1,10 @@
+export type TRateLimit = {
+  readRateLimit: number;
+  writeRateLimit: number;
+  secretsRateLimit: number;
+  authRateLimit: number;
+  inviteUserRateLimit: number;
+  mfaRateLimit: number;
+  creationLimit: number;
+  publicEndpointLimit: number;
+};

frontend/src/hooks/api/secretImports/queries.tsx

@@ -264,13 +264,12 @@ export const useGetImportedSecretsAllEnvs = ({
   });
 
   const isImportedSecretPresentInEnv = useCallback(
-    (secPath: string, envSlug: string, secretName: string) => {
+    (envSlug: string, secretName: string) => {
       const selectedEnvIndex = environments.indexOf(envSlug);
 
       if (selectedEnvIndex !== -1) {
-        const isPresent = secretImports?.[selectedEnvIndex]?.data?.find(
-          ({ secretPath, secrets }) =>
-            secretPath === secPath && secrets.some((s) => s.key === secretName)
+        const isPresent = secretImports?.[selectedEnvIndex]?.data?.find(({ secrets }) =>
+          secrets.some((s) => s.key === secretName)
         );
 
         return Boolean(isPresent);

frontend/src/hooks/api/subscriptions/types.ts

@@ -25,14 +25,15 @@ export type SubscriptionPlan = {
   ldap: boolean;
   groups: boolean;
   status:
-  | "incomplete"
-  | "incomplete_expired"
-  | "trialing"
-  | "active"
-  | "past_due"
-  | "canceled"
-  | "unpaid"
-  | null;
+    | "incomplete"
+    | "incomplete_expired"
+    | "trialing"
+    | "active"
+    | "past_due"
+    | "canceled"
+    | "unpaid"
+    | null;
   trial_end: number | null;
   has_used_trial: boolean;
+  caCrl: boolean;
 };

frontend/src/hooks/api/workspace/index.tsx

@@ -21,6 +21,8 @@ export {
   useGetWorkspaceIntegrations,
   useGetWorkspaceSecrets,
   useGetWorkspaceUsers,
+  useListWorkspaceCas,
+  useListWorkspaceCertificates,
   useListWorkspaceGroups,
   useNameWorkspaceSecrets,
   useRenameWorkspace,
@@ -28,5 +30,4 @@ export {
   useUpdateIdentityWorkspaceRole,
   useUpdateUserWorkspaceRole,
   useUpdateWsEnvironment,
-  useUpgradeProject
-} from "./queries";
+  useUpgradeProject} from "./queries";

frontend/src/hooks/api/workspace/queries.tsx

@@ -2,6 +2,9 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 
 import { apiRequest } from "@app/config/request";
 
+import { CaStatus } from "../ca/enums";
+import { TCertificateAuthority } from "../ca/types";
+import { TCertificate } from "../certificates/types";
 import { TGroupMembership } from "../groups/types";
 import { IdentityMembership } from "../identities/types";
 import { IntegrationAuth } from "../integrationAuth/types";
@@ -20,6 +23,7 @@ import {
   TUpdateWorkspaceIdentityRoleDTO,
   TUpdateWorkspaceUserRoleDTO,
   UpdateEnvironmentDTO,
+  UpdatePitVersionLimitDTO,
   Workspace
 } from "./types";
 
@@ -39,7 +43,23 @@ export const workspaceKeys = {
   getWorkspaceIdentityMemberships: (workspaceId: string) =>
     [{ workspaceId }, "workspace-identity-memberships"] as const,
   getWorkspaceGroupMemberships: (workspaceId: string) =>
-    [{ workspaceId }, "workspace-groups"] as const
+    [{ workspaceId }, "workspace-groups"] as const,
+  getWorkspaceCas: ({ projectSlug }: { projectSlug: string }) =>
+    [{ projectSlug }, "workspace-cas"] as const,
+  specificWorkspaceCas: ({ projectSlug, status }: { projectSlug: string; status?: CaStatus }) =>
+    [...workspaceKeys.getWorkspaceCas({ projectSlug }), { status }] as const,
+  allWorkspaceCertificates: () => ["workspace-certificates"] as const,
+  forWorkspaceCertificates: (slug: string) =>
+    [...workspaceKeys.allWorkspaceCertificates(), slug] as const,
+  specificWorkspaceCertificates: ({
+    slug,
+    offset,
+    limit
+  }: {
+    slug: string;
+    offset: number;
+    limit: number;
+  }) => [...workspaceKeys.forWorkspaceCertificates(slug), { offset, limit }] as const
 };
 
 const fetchWorkspaceById = async (workspaceId: string) => {
@@ -249,6 +269,21 @@ export const useToggleAutoCapitalization = () => {
   });
 };
 
+export const useUpdateWorkspaceVersionLimit = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<{}, {}, UpdatePitVersionLimitDTO>({
+    mutationFn: ({ projectSlug, pitVersionLimit }) => {
+      return apiRequest.put(`/api/v1/workspace/${projectSlug}/version-limit`, {
+        pitVersionLimit
+      });
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries(workspaceKeys.getAllUserWorkspace);
+    }
+  });
+};
+
 export const useDeleteWorkspace = () => {
   const queryClient = useQueryClient();
 
@@ -469,3 +504,70 @@ export const useListWorkspaceGroups = (projectSlug: string) => {
     enabled: true
   });
 };
+
+export const useListWorkspaceCas = ({
+  projectSlug,
+  status
+}: {
+  projectSlug: string;
+  status?: CaStatus;
+}) => {
+  return useQuery({
+    queryKey: workspaceKeys.specificWorkspaceCas({
+      projectSlug,
+      status
+    }),
+    queryFn: async () => {
+      const params = new URLSearchParams({
+        ...(status && { status })
+      });
+
+      const {
+        data: { cas }
+      } = await apiRequest.get<{ cas: TCertificateAuthority[] }>(
+        `/api/v2/workspace/${projectSlug}/cas`,
+        {
+          params
+        }
+      );
+      return cas;
+    },
+    enabled: Boolean(projectSlug)
+  });
+};
+
+export const useListWorkspaceCertificates = ({
+  projectSlug,
+  offset,
+  limit
+}: {
+  projectSlug: string;
+  offset: number;
+  limit: number;
+}) => {
+  return useQuery({
+    queryKey: workspaceKeys.specificWorkspaceCertificates({
+      slug: projectSlug,
+      offset,
+      limit
+    }),
+    queryFn: async () => {
+      const params = new URLSearchParams({
+        offset: String(offset),
+        limit: String(limit)
+      });
+
+      const {
+        data: { certificates, totalCount }
+      } = await apiRequest.get<{ certificates: TCertificate[]; totalCount: number }>(
+        `/api/v2/workspace/${projectSlug}/certificates`,
+        {
+          params
+        }
+      );
+
+      return { certificates, totalCount };
+    },
+    enabled: Boolean(projectSlug)
+  });
+};

frontend/src/hooks/api/workspace/types.ts

@@ -14,8 +14,10 @@ export type Workspace = {
   orgId: string;
   version: ProjectVersion;
   upgradeStatus: string | null;
+  updatedAt: string;
   autoCapitalization: boolean;
   environments: WorkspaceEnv[];
+  pitVersionLimit: number;
   slug: string;
 };
 
@@ -48,6 +50,7 @@ export type CreateWorkspaceDTO = {
 };
 
 export type RenameWorkspaceDTO = { workspaceID: string; newWorkspaceName: string };
+export type UpdatePitVersionLimitDTO = { projectSlug: string; pitVersionLimit: number };
 export type ToggleAutoCapitalizationDTO = { workspaceID: string; state: boolean };
 
 export type DeleteWorkspaceDTO = { workspaceID: string };
@@ -128,4 +131,4 @@ export type TUpdateWorkspaceGroupRoleDTO = {
         temporaryAccessStartTime: string;
       }
   )[];
-};
+};