improvements: address feedback

backend/src/db/migrations/20241219210911_secret-sync.ts

@@ -14,8 +14,12 @@ export async function up(knex: Knex): Promise<void> {
       t.integer("version").defaultTo(1).notNullable();
       t.jsonb("destinationConfig").notNullable();
       t.jsonb("syncOptions").notNullable();
-      t.uuid("folderId").notNullable();
-      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+      // we're including projectId in addition to folder ID because we allow folderId to be null (if the folder
+      // is deleted), to preserve sync configuration
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.uuid("folderId");
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("SET NULL");
       t.uuid("connectionId").notNullable();
       t.foreign("connectionId").references("id").inTable(TableName.AppConnection);
       t.timestamps(true, true, true);

backend/src/db/schemas/secret-syncs.ts

@@ -16,7 +16,8 @@ export const SecretSyncsSchema = z.object({
   version: z.number().default(1),
   destinationConfig: z.unknown(),
   syncOptions: z.unknown(),
-  folderId: z.string().uuid(),
+  projectId: z.string(),
+  folderId: z.string().uuid().nullable().optional(),
   connectionId: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),

backend/src/ee/routes/v1/org-role-router.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
 
 import { OrgMembershipRole, OrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
-import { OrgPermissionSchema } from "@app/ee/services/permission/org-permission";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -25,7 +24,8 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
         ),
         name: z.string().trim(),
         description: z.string().trim().nullish(),
-        permissions: OrgPermissionSchema.array()
+        // TODO(scott): once UI refactored permissions: OrgPermissionSchema.array()
+        permissions: z.any().array()
       }),
       response: {
         200: z.object({
@@ -97,7 +97,8 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
           .optional(),
         name: z.string().trim().optional(),
         description: z.string().trim().nullish(),
-        permissions: OrgPermissionSchema.array().optional()
+        // TODO(scott): once UI refactored permissions: OrgPermissionSchema.array().optional()
+        permissions: z.any().array().optional()
       }),
       response: {
         200: z.object({

backend/src/ee/services/permission/project-permission.ts

@@ -34,6 +34,16 @@ export enum ProjectPermissionDynamicSecretActions {
   Lease = "lease"
 }
 
+export enum ProjectPermissionSecretSyncActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  SyncSecrets = "sync-secrets",
+  ImportSecrets = "import-secrets",
+  RemoveSecrets = "remove-secrets"
+}
+
 export enum ProjectPermissionSub {
   Role = "role",
   Member = "member",
@@ -145,7 +155,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateTemplates]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
-  | [ProjectPermissionActions, ProjectPermissionSub.SecretSyncs]
+  | [ProjectPermissionSecretSyncActions, ProjectPermissionSub.SecretSyncs]
   | [ProjectPermissionCmekActions, ProjectPermissionSub.Cmek]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
@@ -396,7 +406,7 @@ const GeneralPermissionSchema = [
   }),
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretSyncs).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretSyncActions).describe(
       "Describe what action an entity can take."
     )
   })
@@ -514,8 +524,7 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.PkiCollections,
     ProjectPermissionSub.SshCertificateAuthorities,
     ProjectPermissionSub.SshCertificates,
-    ProjectPermissionSub.SshCertificateTemplates,
-    ProjectPermissionSub.SecretSyncs
+    ProjectPermissionSub.SshCertificateTemplates
   ].forEach((el) => {
     can(
       [
@@ -553,6 +562,18 @@ const buildAdminPermissionRules = () => {
     ],
     ProjectPermissionSub.Cmek
   );
+  can(
+    [
+      ProjectPermissionSecretSyncActions.Create,
+      ProjectPermissionSecretSyncActions.Edit,
+      ProjectPermissionSecretSyncActions.Delete,
+      ProjectPermissionSecretSyncActions.Read,
+      ProjectPermissionSecretSyncActions.SyncSecrets,
+      ProjectPermissionSecretSyncActions.ImportSecrets,
+      ProjectPermissionSecretSyncActions.RemoveSecrets
+    ],
+    ProjectPermissionSub.SecretSyncs
+  );
   return rules;
 };
 
@@ -719,10 +740,13 @@ const buildMemberPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionActions.Read,
-      ProjectPermissionActions.Edit,
-      ProjectPermissionActions.Create,
-      ProjectPermissionActions.Delete
+      ProjectPermissionSecretSyncActions.Create,
+      ProjectPermissionSecretSyncActions.Edit,
+      ProjectPermissionSecretSyncActions.Delete,
+      ProjectPermissionSecretSyncActions.Read,
+      ProjectPermissionSecretSyncActions.SyncSecrets,
+      ProjectPermissionSecretSyncActions.ImportSecrets,
+      ProjectPermissionSecretSyncActions.RemoveSecrets
     ],
     ProjectPermissionSub.SecretSyncs
   );
@@ -760,7 +784,7 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateAuthorities);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateTemplates);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+  can(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs);
 
   return rules;
 };

backend/src/lib/api-docs/constants.ts

@@ -1688,7 +1688,8 @@ export const SecretSyncs = {
     };
   },
   DELETE: (destination: SecretSync) => ({
-    syncId: `The ID of the ${SECRET_SYNC_NAME_MAP[destination]} Sync to be deleted.`
+    syncId: `The ID of the ${SECRET_SYNC_NAME_MAP[destination]} Sync to be deleted.`,
+    removeSecrets: `Whether previously synced secrets should be removed prior to deletion.`
   }),
   SYNC_SECRETS: (destination: SecretSync) => ({
     syncId: `The ID of the ${SECRET_SYNC_NAME_MAP[destination]} Sync to trigger a sync for.`

backend/src/lib/fn/string.ts

@@ -16,7 +16,3 @@ export const prefixWithSlash = (str: string) => {
 };
 
 export const startsWithVowel = (str: string) => /^[aeiou]/i.test(str);
-
-export const wrapWithSlashes = (str: string) => {
-  return `${str.startsWith("/") ? "" : "/"}${str}${str.endsWith("/") ? "" : `/`}`;
-};

backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts

@@ -143,7 +143,7 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
 
   server.route({
     method: "GET",
-    url: `/name/:connectionName`,
+    url: `/connection-name/:connectionName`,
     config: {
       rateLimit: readLimit
     },

backend/src/server/routes/v1/secret-sync-routers/secret-sync-endpoints.ts

@@ -127,7 +127,7 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
 
   server.route({
     method: "GET",
-    url: `/name/:syncName`,
+    url: `/sync-name/:syncName`,
     config: {
       rateLimit: readLimit
     },
@@ -219,7 +219,7 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
       rateLimit: writeLimit
     },
     schema: {
-      description: `Update the specified ${destinationName} Connection.`,
+      description: `Update the specified ${destinationName} Sync.`,
       params: z.object({
         syncId: z.string().uuid().describe(SecretSyncs.UPDATE(destination).syncId)
       }),
@@ -261,10 +261,17 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
       rateLimit: writeLimit
     },
     schema: {
-      description: `Delete the specified ${destinationName} Connection.`,
+      description: `Delete the specified ${destinationName} Sync.`,
       params: z.object({
         syncId: z.string().uuid().describe(SecretSyncs.DELETE(destination).syncId)
       }),
+      querystring: z.object({
+        removeSecrets: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(SecretSyncs.DELETE(destination).removeSecrets)
+      }),
       response: {
         200: z.object({ secretSync: responseSchema })
       }
@@ -272,9 +279,10 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { syncId } = req.params;
+      const { removeSecrets } = req.query;
 
       const secretSync = (await server.services.secretSync.deleteSecretSync(
-        { destination, syncId },
+        { destination, syncId, removeSecrets },
         req.permission
       )) as T;
 
@@ -285,7 +293,8 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
           type: EventType.DELETE_SECRET_SYNC,
           metadata: {
             destination,
-            syncId
+            syncId,
+            removeSecrets
           }
         }
       });

backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts

@@ -1,6 +1,7 @@
 import AWS, { AWSError } from "aws-sdk";
 
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
+import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
 import { TAwsParameterStoreSyncWithCredentials } from "./aws-parameter-store-sync-types";
@@ -146,12 +147,19 @@ export const AwsParameterStoreSyncFns = {
         continue;
       }
 
-      await putParameter(ssm, {
-        Name: `${destinationConfig.path}${key}`,
-        Type: "SecureString",
-        Value: value,
-        Overwrite: true
-      });
+      try {
+        await putParameter(ssm, {
+          Name: `${destinationConfig.path}${key}`,
+          Type: "SecureString",
+          Value: value,
+          Overwrite: true
+        });
+      } catch (error) {
+        throw new SecretSyncError({
+          error,
+          secretKey: key
+        });
+      }
     }
 
     const parametersToDelete: AWS.SSM.Parameter[] = [];
@@ -166,7 +174,7 @@ export const AwsParameterStoreSyncFns = {
 
     await deleteParametersBatch(ssm, parametersToDelete);
   },
-  importSecrets: async (secretSync: TAwsParameterStoreSyncWithCredentials): Promise<TSecretMap> => {
+  getSecrets: async (secretSync: TAwsParameterStoreSyncWithCredentials): Promise<TSecretMap> => {
     const { destinationConfig } = secretSync;
 
     const ssm = await getSSM(secretSync);

backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-schemas.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
 
 import { SecretSyncs } from "@app/lib/api-docs";
-import { wrapWithSlashes } from "@app/lib/fn";
 import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 import {
@@ -14,23 +13,10 @@ const AwsParameterStoreSyncDestinationConfigSchema = z.object({
   region: z.nativeEnum(AWSRegion).describe(SecretSyncs.DESTINATION_CONFIG.AWS_PARAMETER_STORE.REGION),
   path: z
     .string()
-    .min(1, "Parameter Store Path Required")
-    .transform(wrapWithSlashes)
-    .superRefine((val, ctx) => {
-      if (!/^\/([/]|(([\w-]+\/)+))?$/.test(val)) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: `Invalid Parameter Store Path - must follow "/example/path/" format`
-        });
-      }
-
-      if (val.length > 2048) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: `Invalid Parameter Store Path - cannot exceed 2048 characters`
-        });
-      }
-    })
+    .trim()
+    .min(1, "Parameter Store Path required")
+    .max(2048, "Cannot exceed 2048 characters")
+    .regex(/^\/([/]|(([\w-]+\/)+))?$/)
     .describe(SecretSyncs.DESTINATION_CONFIG.AWS_PARAMETER_STORE.PATH)
 });
 

backend/src/services/secret-sync/github/github-sync-fns.ts

@@ -6,20 +6,12 @@ import { GitHubSyncScope, GitHubSyncVisibility } from "@app/services/secret-sync
 import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
-import { TGitHubSyncWithCredentials } from "./github-sync-types";
-
-interface GitHubSecret {
-  name: string;
-  created_at: string;
-  updated_at: string;
-  visibility?: "all" | "private" | "selected";
-  selected_repositories_url?: string | undefined;
-}
+import { TGitHubPublicKey, TGitHubSecret, TGitHubSecretPayload, TGitHubSyncWithCredentials } from "./github-sync-types";
 
 // TODO: rate limit handling
 
 const getEncryptedSecrets = async (client: Octokit, secretSync: TGitHubSyncWithCredentials) => {
-  let encryptedSecrets: GitHubSecret[];
+  let encryptedSecrets: TGitHubSecret[];
 
   const { destinationConfig } = secretSync;
 
@@ -52,17 +44,8 @@ const getEncryptedSecrets = async (client: Octokit, secretSync: TGitHubSyncWithC
   return encryptedSecrets;
 };
 
-interface GitHubPublicKey {
-  key_id: string;
-  key: string;
-  id?: number | undefined;
-  url?: string | undefined;
-  title?: string | undefined;
-  created_at?: string | undefined;
-}
-
 const getPublicKey = async (client: Octokit, secretSync: TGitHubSyncWithCredentials) => {
-  let publicKey: GitHubPublicKey;
+  let publicKey: TGitHubPublicKey;
 
   const { destinationConfig } = secretSync;
 
@@ -100,7 +83,11 @@ const getPublicKey = async (client: Octokit, secretSync: TGitHubSyncWithCredenti
   return publicKey;
 };
 
-const deleteSecret = async (client: Octokit, secretSync: TGitHubSyncWithCredentials, encryptedSecret: GitHubSecret) => {
+const deleteSecret = async (
+  client: Octokit,
+  secretSync: TGitHubSyncWithCredentials,
+  encryptedSecret: TGitHubSecret
+) => {
   const { destinationConfig } = secretSync;
 
   switch (destinationConfig.scope) {
@@ -132,13 +119,7 @@ const deleteSecret = async (client: Octokit, secretSync: TGitHubSyncWithCredenti
   }
 };
 
-interface GitHubSecretPayload {
-  key_id: string;
-  secret_name: string;
-  encrypted_value: string;
-}
-
-const putSecret = async (client: Octokit, secretSync: TGitHubSyncWithCredentials, payload: GitHubSecretPayload) => {
+const putSecret = async (client: Octokit, secretSync: TGitHubSyncWithCredentials, payload: TGitHubSecretPayload) => {
   const { destinationConfig } = secretSync;
 
   switch (destinationConfig.scope) {
@@ -210,7 +191,7 @@ export const GithubSyncFns = {
       }
     });
   },
-  importSecrets: async (secretSync: TGitHubSyncWithCredentials) => {
+  getSecrets: async (secretSync: TGitHubSyncWithCredentials) => {
     throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
   },
   removeSecrets: async (secretSync: TGitHubSyncWithCredentials, affixedSecretMap: TSecretMap) => {

backend/src/services/secret-sync/github/github-sync-schemas.ts

@@ -32,24 +32,24 @@ const GitHubSyncDestinationConfigSchema = z
     })
   ])
   .superRefine((options, ctx) => {
-    if (options.scope !== GitHubSyncScope.Organization) return;
+    if (options.scope === GitHubSyncScope.Organization) {
+      if (options.visibility === GitHubSyncVisibility.Selected) {
+        if (!options.selectedRepositoryIds?.length)
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "Select at least 1 repository",
+            path: ["selectedRepositoryIds"]
+          });
+        return;
+      }
 
-    if (options.visibility === GitHubSyncVisibility.Selected) {
-      if (!options.selectedRepositoryIds?.length)
+      if (options.selectedRepositoryIds?.length) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
-          message: "Select at least 1 repository",
+          message: `Selected repositories is only supported for visibility "Selected"`,
           path: ["selectedRepositoryIds"]
         });
-      return;
-    }
-
-    if (options.selectedRepositoryIds?.length) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `Selected repositories is only supported for visibility "Selected"`,
-        path: ["selectedRepositoryIds"]
-      });
+      }
     }
   });
 

backend/src/services/secret-sync/github/github-sync-types.ts

@@ -13,3 +13,26 @@ export type TGitHubSyncListItem = z.infer<typeof GitHubSyncListItemSchema>;
 export type TGitHubSyncWithCredentials = TGitHubSync & {
   connection: TGitHubConnection;
 };
+
+export type TGitHubSecret = {
+  name: string;
+  created_at: string;
+  updated_at: string;
+  visibility?: "all" | "private" | "selected";
+  selected_repositories_url?: string | undefined;
+};
+
+export type TGitHubPublicKey = {
+  key_id: string;
+  key: string;
+  id?: number | undefined;
+  url?: string | undefined;
+  title?: string | undefined;
+  created_at?: string | undefined;
+};
+
+export type TGitHubSecretPayload = {
+  key_id: string;
+  secret_name: string;
+  encrypted_value: string;
+};

backend/src/services/secret-sync/secret-sync-dal.ts

@@ -13,16 +13,15 @@ type SecretSyncFindFilter = Parameters<typeof buildFindFilter<TSecretSyncs>>[0];
 
 const baseSecretSyncQuery = ({ filter, db, tx }: { db: TDbClient; filter?: SecretSyncFindFilter; tx?: Knex }) => {
   const query = (tx || db.replicaNode())(TableName.SecretSync)
-    .join(TableName.SecretFolder, `${TableName.SecretSync}.folderId`, `${TableName.SecretFolder}.id`)
-    .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
+    .leftJoin(TableName.SecretFolder, `${TableName.SecretSync}.folderId`, `${TableName.SecretFolder}.id`)
+    .leftJoin(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
     .join(TableName.AppConnection, `${TableName.SecretSync}.connectionId`, `${TableName.AppConnection}.id`)
     .select(selectAllTableCols(TableName.SecretSync))
     .select(
-      // evironment
+      // environment
       db.ref("name").withSchema(TableName.Environment).as("envName"),
       db.ref("id").withSchema(TableName.Environment).as("envId"),
       db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
-      db.ref("projectId").withSchema(TableName.Environment),
       // entire connection
       db.ref("name").withSchema(TableName.AppConnection).as("connectionName"),
       db.ref("method").withSchema(TableName.AppConnection).as("connectionMethod"),
@@ -53,7 +52,7 @@ const baseSecretSyncQuery = ({ filter, db, tx }: { db: TDbClient; filter?: Secre
 
 const expandSecretSync = (
   secretSync: Awaited<ReturnType<typeof baseSecretSyncQuery>>[number],
-  folder: Awaited<ReturnType<TSecretFolderDALFactory["findSecretPathByFolderIds"]>>[number]
+  folder?: Awaited<ReturnType<TSecretFolderDALFactory["findSecretPathByFolderIds"]>>[number]
 ) => {
   const {
     envId,
@@ -75,7 +74,7 @@ const expandSecretSync = (
   return {
     ...el,
     connectionId,
-    environment: { id: envId, name: envName, slug: envSlug },
+    environment: envId ? { id: envId, name: envName, slug: envSlug } : null,
     connection: {
       app: connectionApp,
       id: connectionId,
@@ -88,10 +87,12 @@ const expandSecretSync = (
       updatedAt: connectionUpdatedAt,
       version: connectionVersion
     },
-    folder: {
-      id: folder!.id,
-      path: folder!.path
-    }
+    folder: folder
+      ? {
+          id: folder.id,
+          path: folder.path
+        }
+      : null
   };
 };
 
@@ -111,7 +112,9 @@ export const secretSyncDALFactory = (
 
       if (secretSync) {
         // TODO (scott): replace with cached folder path once implemented
-        const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId]);
+        const [folderWithPath] = secretSync.folderId
+          ? await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId])
+          : [];
         return expandSecretSync(secretSync, folderWithPath);
       }
     } catch (error) {
@@ -132,7 +135,9 @@ export const secretSyncDALFactory = (
       }))!;
 
       // TODO (scott): replace with cached folder path once implemented
-      const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId]);
+      const [folderWithPath] = secretSync.folderId
+        ? await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId])
+        : [];
       return expandSecretSync(secretSync, folderWithPath);
     } catch (error) {
       throw new DatabaseError({ error, name: "Create - Secret Sync" });
@@ -152,7 +157,9 @@ export const secretSyncDALFactory = (
       }))!;
 
       // TODO (scott): replace with cached folder path once implemented
-      const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId]);
+      const [folderWithPath] = secretSync.folderId
+        ? await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId])
+        : [];
       return expandSecretSync(secretSync, folderWithPath);
     } catch (error) {
       throw new DatabaseError({ error, name: "Update by ID - Secret Sync" });
@@ -165,7 +172,9 @@ export const secretSyncDALFactory = (
 
       if (secretSync) {
         // TODO (scott): replace with cached folder path once implemented
-        const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId]);
+        const [folderWithPath] = secretSync.folderId
+          ? await folderDAL.findSecretPathByFolderIds(secretSync.projectId, [secretSync.folderId])
+          : [];
         return expandSecretSync(secretSync, folderWithPath);
       }
     } catch (error) {
@@ -181,7 +190,7 @@ export const secretSyncDALFactory = (
 
       const foldersWithPath = await folderDAL.findSecretPathByFolderIds(
         secretSyncs[0].projectId,
-        secretSyncs.map((sync) => sync.folderId)
+        secretSyncs.filter((sync) => Boolean(sync.folderId)).map((sync) => sync.folderId!)
       );
 
       // TODO (scott): replace with cached folder path once implemented
@@ -191,7 +200,9 @@ export const secretSyncDALFactory = (
         if (folder) folderRecord[folder.id] = folder;
       });
 
-      return secretSyncs.map((secretSync) => expandSecretSync(secretSync, folderRecord[secretSync.folderId]));
+      return secretSyncs.map((secretSync) =>
+        expandSecretSync(secretSync, secretSync.folderId ? folderRecord[secretSync.folderId] : undefined)
+      );
     } catch (error) {
       throw new DatabaseError({ error, name: "Find - Secret Sync" });
     }

backend/src/services/secret-sync/secret-sync-errors.ts

@@ -0,0 +1,14 @@
+export class SecretSyncError extends Error {
+  name: string;
+
+  error: unknown;
+
+  secretKey?: string;
+
+  constructor({ name, error, secretKey }: { name?: string; error?: unknown; secretKey?: string } = {}) {
+    super();
+    this.name = name || "SecretSyncError";
+    this.error = error;
+    this.secretKey = secretKey;
+  }
+}

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -1,9 +1,12 @@
+import { AxiosError } from "axios";
+
 import {
   AWS_PARAMETER_STORE_SYNC_LIST_OPTION,
   AwsParameterStoreSyncFns
 } from "@app/services/secret-sync/aws-parameter-store";
 import { GITHUB_SYNC_LIST_OPTION, GithubSyncFns } from "@app/services/secret-sync/github";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
 import {
   TSecretMap,
   TSecretSyncListItem,
@@ -59,8 +62,6 @@ const stripAffixes = (secretSync: TSecretSyncWithCredentials, unprocessedSecretM
   return secretMap;
 };
 
-// TODO(scott): ideally do this in a map to reduce code but requires typescript trickery...
-
 export const SecretSyncFns = {
   syncSecrets: (secretSync: TSecretSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
     const affixedSecretMap = addAffixes(secretSync, secretMap);
@@ -76,14 +77,14 @@ export const SecretSyncFns = {
         );
     }
   },
-  importSecrets: async (secretSync: TSecretSyncWithCredentials): Promise<TSecretMap> => {
+  getSecrets: async (secretSync: TSecretSyncWithCredentials): Promise<TSecretMap> => {
     let secretMap: TSecretMap;
     switch (secretSync.destination) {
       case SecretSync.AWSParameterStore:
-        secretMap = await AwsParameterStoreSyncFns.importSecrets(secretSync);
+        secretMap = await AwsParameterStoreSyncFns.getSecrets(secretSync);
         break;
       case SecretSync.GitHub:
-        secretMap = await GithubSyncFns.importSecrets(secretSync);
+        secretMap = await GithubSyncFns.getSecrets(secretSync);
         break;
       default:
         throw new Error(
@@ -108,3 +109,18 @@ export const SecretSyncFns = {
     }
   }
 };
+
+export const parseSyncErrorMessage = (err: unknown): string => {
+  if (err instanceof SecretSyncError) {
+    return JSON.stringify({
+      secretKey: err.secretKey,
+      error: parseSyncErrorMessage(err.error)
+    });
+  }
+
+  if (err instanceof AxiosError) {
+    return err?.response?.data ? JSON.stringify(err?.response?.data) : err?.message ?? "An unknown error occurred.";
+  }
+
+  return (err as Error)?.message || "An unknown error occurred.";
+};

backend/src/services/secret-sync/secret-sync-queue.ts

@@ -31,7 +31,7 @@ import {
   SecretSyncImportBehavior,
   SecretSyncInitialSyncBehavior
 } from "@app/services/secret-sync/secret-sync-enums";
-import { SecretSyncFns } from "@app/services/secret-sync/secret-sync-fns";
+import { parseSyncErrorMessage, SecretSyncFns } from "@app/services/secret-sync/secret-sync-fns";
 import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
 import {
   SecretSyncAction,
@@ -74,7 +74,7 @@ type TSecretSyncQueueFactoryDep = {
     | "deleteMany"
   >;
   secretImportDAL: Pick<TSecretImportDALFactory, "find" | "findByFolderIds">;
-  secretSyncDAL: Pick<TSecretSyncDALFactory, "findById" | "find" | "updateById">;
+  secretSyncDAL: Pick<TSecretSyncDALFactory, "findById" | "find" | "updateById" | "deleteById">;
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
   projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findAllProjectMembers">;
   projectDAL: TProjectDALFactory;
@@ -94,19 +94,6 @@ type SecretSyncActionJob = Job<
   TQueueSecretSyncSyncSecretsByIdDTO | TQueueSecretSyncImportSecretsByIdDTO | TQueueSecretSyncRemoveSecretsByIdDTO
 >;
 
-const getRequeueDelay = (failureCount?: number) => {
-  if (!failureCount) return 0;
-
-  const baseDelay = 1000;
-  const maxDelay = 30000;
-
-  const delay = Math.min(baseDelay * 2 ** failureCount, maxDelay);
-
-  const jitter = delay * (0.5 + Math.random() * 0.5);
-
-  return jitter;
-};
-
 export const secretSyncQueueFactory = ({
   queueService,
   kmsService,
@@ -178,12 +165,12 @@ export const secretSyncQueueFactory = ({
   });
 
   const $getSecrets = async (secretSync: TSecretSyncRaw | TSecretSyncWithCredentials, includeImports = true) => {
-    const {
-      projectId,
-      folderId,
-      environment: { slug: environmentSlug },
-      folder: { path: secretPath }
-    } = secretSync;
+    const { projectId, folderId, environment, folder } = secretSync;
+
+    if (!folderId || !environment || !folder)
+      throw new Error(
+        "Invalid Secret Sync source configuration: folder no longer exists. Please update source environment and secret path."
+      );
 
     const secretMap: TSecretMap = {};
 
@@ -210,8 +197,8 @@ export const secretSyncQueueFactory = ({
         const secretKey = secret.key;
         const secretValue = decryptSecretValue(secret.encryptedValue);
         const expandedSecretValue = await expandSecretReferences({
-          environment: environmentSlug,
-          secretPath,
+          environment: environment.slug,
+          secretPath: folder.path,
           skipMultilineEncoding: secret.skipMultilineEncoding,
           value: secretValue
         });
@@ -260,7 +247,7 @@ export const secretSyncQueueFactory = ({
 
   const queueSecretSyncSyncSecretsById = async (payload: TQueueSecretSyncSyncSecretsByIdDTO) =>
     queueService.queue(QueueName.AppConnectionSecretSync, QueueJobs.SecretSyncSyncSecrets, payload, {
-      delay: getRequeueDelay(payload.failedToAcquireLockCount),
+      delay: payload.failedToAcquireLockCount ? 1000 : 0, // we don't want to delay initial job
       attempts: 5,
       backoff: {
         type: "exponential",
@@ -309,9 +296,14 @@ export const secretSyncQueueFactory = ({
     secretSync: TSecretSyncWithCredentials,
     importBehavior: SecretSyncImportBehavior
   ): Promise<TSecretMap> => {
-    const { projectId, environment } = secretSync;
+    const { projectId, environment, folder } = secretSync;
 
-    const importedSecrets = await SecretSyncFns.importSecrets(secretSync);
+    if (!environment || !folder)
+      throw new Error(
+        "Invalid Secret Sync source configuration: folder no longer exists. Please update source environment and secret path."
+      );
+
+    const importedSecrets = await SecretSyncFns.getSecrets(secretSync);
 
     if (!Object.keys(importedSecrets).length) return {};
 
@@ -345,7 +337,7 @@ export const secretSyncQueueFactory = ({
     if (secretsToCreate.length) {
       await $createManySecretsRawFn({
         projectId,
-        path: secretSync.folder.path,
+        path: folder.path,
         environment: environment.slug,
         secrets: secretsToCreate
       });
@@ -354,7 +346,7 @@ export const secretSyncQueueFactory = ({
     if (importBehavior === SecretSyncImportBehavior.PrioritizeDestination && secretsToUpdate.length) {
       await $updateManySecretsRawFn({
         projectId,
-        path: secretSync.folder.path,
+        path: folder.path,
         environment: environment.slug,
         secrets: secretsToUpdate
       });
@@ -444,13 +436,7 @@ export const secretSyncQueueFactory = ({
         });
       }
 
-      syncMessage =
-        // eslint-disable-next-line no-nested-ternary
-        (err instanceof AxiosError
-          ? err?.response?.data
-            ? JSON.stringify(err?.response?.data)
-            : err?.message
-          : (err as Error)?.message) || "An unknown error occurred.";
+      syncMessage = parseSyncErrorMessage(err);
 
       // re-throw so job fails
       throw err;
@@ -566,13 +552,7 @@ export const secretSyncQueueFactory = ({
         });
       }
 
-      importMessage =
-        // eslint-disable-next-line no-nested-ternary
-        (err instanceof AxiosError
-          ? err?.response?.data
-            ? JSON.stringify(err?.response?.data)
-            : err?.message
-          : (err as Error)?.message) || "An unknown error occurred.";
+      importMessage = parseSyncErrorMessage(err);
 
       // re-throw so job fails
       throw err;
@@ -629,7 +609,7 @@ export const secretSyncQueueFactory = ({
 
   const $handleRemoveSecretsJob = async (job: TSecretSyncRemoveSecretsDTO) => {
     const {
-      data: { syncId, auditLogInfo }
+      data: { syncId, auditLogInfo, deleteSyncOnComplete }
     } = job;
 
     const secretSync = await secretSyncDAL.findById(syncId);
@@ -691,13 +671,7 @@ export const secretSyncQueueFactory = ({
         });
       }
 
-      removeMessage =
-        // eslint-disable-next-line no-nested-ternary
-        (err instanceof AxiosError
-          ? err?.response?.data
-            ? JSON.stringify(err?.response?.data)
-            : err?.message
-          : (err as Error)?.message) || "An unknown error occurred.";
+      removeMessage = parseSyncErrorMessage(err);
 
       // re-throw so job fails
       throw err;
@@ -731,19 +705,23 @@ export const secretSyncQueueFactory = ({
       });
 
       if (isSuccess || isFinalAttempt) {
-        const updatedSecretSync = await secretSyncDAL.updateById(secretSync.id, {
-          removeStatus,
-          lastRemoveJobId: job.id,
-          lastRemoveMessage: removeMessage,
-          lastRemovedAt: isSuccess ? ranAt : undefined
-        });
-
-        if (!isSuccess) {
-          await $queueSendSecretSyncFailedNotifications({
-            secretSync: updatedSecretSync,
-            action: SecretSyncAction.RemoveSecrets,
-            auditLogInfo
+        if (isSuccess && deleteSyncOnComplete) {
+          await secretSyncDAL.deleteById(secretSync.id);
+        } else {
+          const updatedSecretSync = await secretSyncDAL.updateById(secretSync.id, {
+            removeStatus,
+            lastRemoveJobId: job.id,
+            lastRemoveMessage: removeMessage,
+            lastRemovedAt: isSuccess ? ranAt : undefined
           });
+
+          if (!isSuccess) {
+            await $queueSendSecretSyncFailedNotifications({
+              secretSync: updatedSecretSync,
+              action: SecretSyncAction.RemoveSecrets,
+              auditLogInfo
+            });
+          }
         }
       }
     }
@@ -806,8 +784,8 @@ export const secretSyncQueueFactory = ({
         syncDestination,
         content: `Your ${syncDestination} Sync named "${name}" failed while attempting to ${action.toLowerCase()} secrets.`,
         failureMessage,
-        secretPath: folder.path,
-        environment: environment.name,
+        secretPath: folder?.path,
+        environment: environment?.name,
         projectName: project.name,
         syncUrl: `${appCfg.SITE_URL}/integrations/secret-syncs/${destination}/${secretSync.id}`
       }

backend/src/services/secret-sync/secret-sync-schemas.ts

@@ -43,8 +43,8 @@ export const BaseSecretSyncSchema = (destination: SecretSync, syncOptionsConfig?
       name: z.string(),
       id: z.string().uuid()
     }),
-    environment: z.object({ slug: z.string(), name: z.string(), id: z.string().uuid() }),
-    folder: z.object({ id: z.string(), path: z.string() })
+    environment: z.object({ slug: z.string(), name: z.string(), id: z.string().uuid() }).nullable(),
+    folder: z.object({ id: z.string(), path: z.string() }).nullable()
   });
 
 export const GenericCreateSecretSyncFieldsSchema = (destination: SecretSync, syncOptionsConfig?: TSyncOptionsConfig) =>

backend/src/services/secret-sync/secret-sync-service.ts

@@ -2,7 +2,11 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretSyncActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
@@ -65,15 +69,14 @@ export const secretSyncServiceFactory = ({
       projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
-
-    const folders = await folderDAL.findByProjectId(projectId);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Read,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     const secretSyncs = await secretSyncDAL.find({
       ...(destination && { destination }),
-      $in: {
-        folderId: folders.map((folder) => folder.id)
-      }
+      projectId
     });
 
     return secretSyncs as TSecretSync[];
@@ -96,7 +99,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Read,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -134,7 +140,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Read,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -163,7 +172,7 @@ export const secretSyncServiceFactory = ({
       throw new BadRequestError({ message: "Project version does not support Secret Syncs" });
 
     ForbiddenError.from(projectPermission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionSecretSyncActions.Create,
       ProjectPermissionSub.SecretSyncs
     );
 
@@ -187,17 +196,13 @@ export const secretSyncServiceFactory = ({
     // validates permission to connect and app is valid for sync destination
     await appConnectionService.connectAppConnectionById(destinationApp, params.connectionId, actor);
 
-    const projectFolders = await folderDAL.findByProjectId(folder.projectId);
-
     const secretSync = await secretSyncDAL.transaction(async (tx) => {
       const isConflictingName = Boolean(
         (
           await secretSyncDAL.find(
             {
               name: params.name,
-              $in: {
-                folderId: projectFolders.map((f) => f.id)
-              }
+              projectId
             },
             tx
           )
@@ -212,7 +217,8 @@ export const secretSyncServiceFactory = ({
       const sync = await secretSyncDAL.create({
         folderId: folder.id,
         ...params,
-        ...(params.isEnabled && { syncStatus: SecretSyncStatus.Pending })
+        ...(params.isEnabled && { syncStatus: SecretSyncStatus.Pending }),
+        projectId
       });
 
       return sync;
@@ -243,7 +249,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Edit,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -251,12 +260,17 @@ export const secretSyncServiceFactory = ({
       });
 
     const updatedSecretSync = await secretSyncDAL.transaction(async (tx) => {
+      let { folderId } = secretSync;
+
       if (
-        (secretPath && secretPath !== secretSync.folder.path) ||
-        (environment && environment !== secretSync.environment.slug)
+        (secretPath && secretPath !== secretSync.folder?.path) ||
+        (environment && environment !== secretSync.environment?.slug)
       ) {
-        const updatedEnvironment = environment ?? secretSync.environment.slug;
-        const updatedSecretPath = secretPath ?? secretSync.folder.path;
+        const updatedEnvironment = environment ?? secretSync.environment?.slug;
+        const updatedSecretPath = secretPath ?? secretSync.folder?.path;
+
+        if (!updatedEnvironment || !updatedSecretPath)
+          throw new BadRequestError({ message: "Must specify both source environment and secret path" });
 
         ForbiddenError.from(permission).throwUnlessCan(
           ProjectPermissionActions.Read,
@@ -272,19 +286,17 @@ export const secretSyncServiceFactory = ({
           throw new BadRequestError({
             message: `Could not find folder with path "${secretPath}" in environment "${environment}" for project with ID "${secretSync.projectId}"`
           });
+
+        folderId = newFolder.id;
       }
 
       if (params.name && secretSync.name !== params.name) {
-        const projectFolders = await folderDAL.findByProjectId(secretSync.projectId);
-
         const isConflictingName = Boolean(
           (
             await secretSyncDAL.find(
               {
                 name: params.name,
-                $in: {
-                  folderId: projectFolders.map((f) => f.id)
-                }
+                projectId: secretSync.projectId
               },
               tx
             )
@@ -301,7 +313,8 @@ export const secretSyncServiceFactory = ({
 
       const updatedSync = await secretSyncDAL.updateById(syncId, {
         ...params,
-        ...(isEnabled && { syncStatus: SecretSyncStatus.Pending })
+        ...(isEnabled && folderId && { syncStatus: SecretSyncStatus.Pending }),
+        folderId
       });
 
       return updatedSync;
@@ -312,7 +325,10 @@ export const secretSyncServiceFactory = ({
     return updatedSecretSync as TSecretSync;
   };
 
-  const deleteSecretSync = async ({ destination, syncId }: TDeleteSecretSyncDTO, actor: OrgServiceActor) => {
+  const deleteSecretSync = async (
+    { destination, syncId, removeSecrets }: TDeleteSecretSyncDTO,
+    actor: OrgServiceActor
+  ) => {
     const secretSync = await secretSyncDAL.findById(syncId);
 
     if (!secretSync)
@@ -329,13 +345,41 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Delete,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
         message: `Secret sync with ID "${secretSync.id}" is not configured for ${SECRET_SYNC_NAME_MAP[destination]}`
       });
 
+    if (removeSecrets) {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionSecretSyncActions.RemoveSecrets,
+        ProjectPermissionSub.SecretSyncs
+      );
+
+      if (!secretSync.folderId)
+        throw new BadRequestError({
+          message: `Invalid source configuration: folder no longer exists. Please configure a valid source and try again.`
+        });
+
+      const isSyncJobRunning = Boolean(await keyStore.getItem(KeyStorePrefixes.SecretSyncLock(syncId)));
+
+      if (isSyncJobRunning)
+        throw new BadRequestError({ message: `A job for this sync is already in progress. Please try again shortly.` });
+
+      await secretSyncQueue.queueSecretSyncRemoveSecretsById({ syncId, deleteSyncOnComplete: true });
+
+      const updatedSecretSync = await secretSyncDAL.updateById(syncId, {
+        removeStatus: SecretSyncStatus.Pending
+      });
+
+      return updatedSecretSync;
+    }
+
     await secretSyncDAL.deleteById(syncId);
 
     return secretSync as TSecretSync;
@@ -361,13 +405,21 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.SyncSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
         message: `Secret sync with ID "${secretSync.id}" is not configured for ${SECRET_SYNC_NAME_MAP[destination]}`
       });
 
+    if (!secretSync.folderId)
+      throw new BadRequestError({
+        message: `Invalid source configuration: folder no longer exists. Please configure a valid source and try again.`
+      });
+
     const isSyncJobRunning = Boolean(await keyStore.getItem(KeyStorePrefixes.SecretSyncLock(syncId)));
 
     if (isSyncJobRunning)
@@ -408,13 +460,21 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.ImportSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
         message: `Secret sync with ID "${secretSync.id}" is not configured for ${SECRET_SYNC_NAME_MAP[destination]}`
       });
 
+    if (!secretSync.folderId)
+      throw new BadRequestError({
+        message: `Invalid source configuration: folder no longer exists. Please configure a valid source and try again.`
+      });
+
     const isSyncJobRunning = Boolean(await keyStore.getItem(KeyStorePrefixes.SecretSyncLock(syncId)));
 
     if (isSyncJobRunning)
@@ -449,13 +509,21 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretSyncs);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.RemoveSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
         message: `Secret sync with ID "${secretSync.id}" is not configured for ${SECRET_SYNC_NAME_MAP[destination]}`
       });
 
+    if (!secretSync.folderId)
+      throw new BadRequestError({
+        message: `Invalid source configuration: folder no longer exists. Please configure a valid source and try again.`
+      });
+
     const isSyncJobRunning = Boolean(await keyStore.getItem(KeyStorePrefixes.SecretSyncLock(syncId)));
 
     if (isSyncJobRunning)

backend/src/services/secret-sync/secret-sync-types.ts

@@ -62,6 +62,7 @@ export type TUpdateSecretSyncDTO = Partial<Omit<TCreateSecretSyncDTO, "connectio
 export type TDeleteSecretSyncDTO = {
   destination: SecretSync;
   syncId: string;
+  removeSecrets: boolean;
 };
 
 type AuditLogInfo = Pick<TCreateAuditLogDTO, "userAgent" | "userAgentType" | "ipAddress" | "actor">;
@@ -110,6 +111,7 @@ export type TTriggerSecretSyncImportSecretsByIdDTO = {
 export type TQueueSecretSyncRemoveSecretsByIdDTO = {
   syncId: string;
   auditLogInfo?: AuditLogInfo;
+  deleteSyncOnComplete?: boolean;
 };
 
 export type TTriggerSecretSyncRemoveSecretsByIdDTO = {

backend/src/services/smtp/templates/secretSyncFailed.handlebars

@@ -21,8 +21,12 @@
       <p><strong>Name</strong>: {{syncName}}</p>
       <p><strong>Destination</strong>: {{syncDestination}}</p>
       <p><strong>Project</strong>: {{projectName}}</p>
-      <p><strong>Environment</strong>: {{environment}}</p>
-      <p><strong>Secret Path</strong>: {{secretPath}}</p>
+      {{#if environment}}
+          <p><strong>Environment</strong>: {{environment}}</p>
+      {{/if}}
+      {{#if secretPath}}
+          <p><strong>Secret Path</strong>: {{secretPath}}</p>
+      {{/if}}
     </div>
 
     {{#if failureMessage}}

docs/api-reference/endpoints/app-connections/aws/get-by-name.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Get by Name"
-openapi: "GET /api/v1/app-connections/aws/name/{connectionName}"
+openapi: "GET /api/v1/app-connections/aws/connection-name/{connectionName}"
 ---

docs/api-reference/endpoints/app-connections/github/get-by-name.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Get by Name"
-openapi: "GET /api/v1/app-connections/github/name/{connectionName}"
+openapi: "GET /api/v1/app-connections/github/connection-name/{connectionName}"
 ---

docs/api-reference/endpoints/secret-syncs/aws-parameter-store/get-by-name.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Get by Name"
-openapi: "GET /api/v1/secret-syncs/aws-parameter-store/name/{syncName}"
+openapi: "GET /api/v1/secret-syncs/aws-parameter-store/sync-name/{syncName}"
 ---

docs/api-reference/endpoints/secret-syncs/github/get-by-name.mdx

@@ -1,4 +1,4 @@
 ---
 title: "Get by Name"
-openapi: "GET /api/v1/secret-syncs/github/name/{syncName}"
+openapi: "GET /api/v1/secret-syncs/github/sync-name/{syncName}"
 ---

frontend/src/components/secret-syncs/CreateSecretSyncModal.tsx

@@ -51,6 +51,7 @@ export const CreateSecretSyncModal = ({ onOpenChange, ...props }: Props) => {
             "Add Sync"
           )
         }
+        onPointerDownOutside={(e) => e.preventDefault()}
         className="max-w-2xl"
         subTitle={selectedSync ? undefined : "Select a third-party service to sync secrets to."}
         bodyClassName="overflow-visible"

frontend/src/components/secret-syncs/DeleteSecretSyncModal.tsx

@@ -1,5 +1,7 @@
+import { useState } from "react";
+
 import { createNotification } from "@app/components/notifications";
-import { DeleteActionModal } from "@app/components/v2";
+import { DeleteActionModal, Switch } from "@app/components/v2";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
 import { TSecretSync, useDeleteSecretSync } from "@app/hooks/api/secretSyncs";
 
@@ -12,6 +14,7 @@ type Props = {
 
 export const DeleteSecretSyncModal = ({ isOpen, onOpenChange, secretSync, onComplete }: Props) => {
   const deleteSync = useDeleteSecretSync();
+  const [removeSecrets, setRemoveSecrets] = useState(false);
 
   if (!secretSync) return null;
 
@@ -23,7 +26,8 @@ export const DeleteSecretSyncModal = ({ isOpen, onOpenChange, secretSync, onComp
     try {
       await deleteSync.mutateAsync({
         syncId,
-        destination
+        destination,
+        removeSecrets
       });
 
       createNotification({
@@ -37,7 +41,7 @@ export const DeleteSecretSyncModal = ({ isOpen, onOpenChange, secretSync, onComp
       console.error(err);
 
       createNotification({
-        text: `Failed remove ${destinationName} Sync`,
+        text: `Failed to remove ${destinationName} Sync`,
         type: "error"
       });
     }
@@ -50,6 +54,17 @@ export const DeleteSecretSyncModal = ({ isOpen, onOpenChange, secretSync, onComp
       title={`Are you sure want to delete ${name}?`}
       deleteKey={name}
       onDeleteApproved={handleDeleteSecretSync}
-    />
+    >
+      <Switch
+        containerClassName="mt-4"
+        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-red/50"
+        thumbClassName="bg-mineshaft-800"
+        isChecked={removeSecrets}
+        onCheckedChange={setRemoveSecrets}
+        id="remove-secrets"
+      >
+        Remove Synced Secrets
+      </Switch>
+    </DeleteActionModal>
   );
 };

frontend/src/components/secret-syncs/SecretSyncStatusBadge.tsx

@@ -21,7 +21,7 @@ export const SecretSyncStatusBadge = ({ status }: Props) => {
   switch (status) {
     case SecretSyncStatus.Failed:
       variant = "danger";
-      text = "Failed";
+      text = "Failed to Sync";
       icon = faExclamationTriangle;
       break;
     case SecretSyncStatus.Succeeded:
@@ -39,7 +39,7 @@ export const SecretSyncStatusBadge = ({ status }: Props) => {
   }
 
   return (
-    <Badge className="flex h-5 w-min items-center gap-1.5" variant={variant}>
+    <Badge className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap" variant={variant}>
       <FontAwesomeIcon icon={icon} />
       <span>{text}</span>
     </Badge>

frontend/src/components/secret-syncs/forms/EditSecretSyncForm.tsx

@@ -8,7 +8,7 @@ import { Button, ModalClose } from "@app/components/v2";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
 import { TSecretSync, useUpdateSecretSync } from "@app/hooks/api/secretSyncs";
 
-import { SecretSyncFormSchema, TSecretSyncForm } from "./schemas";
+import { TSecretSyncForm, UpdateSecretSyncFormSchema } from "./schemas";
 import { SecretSyncDestinationFields } from "./SecretSyncDestinationFields";
 import { SecretSyncDetailsFields } from "./SecretSyncDetailsFields";
 import { SecretSyncOptionsFields } from "./SecretSyncOptionsFields";
@@ -25,10 +25,11 @@ export const EditSecretSyncForm = ({ secretSync, fields, onComplete }: Props) =>
   const { name: destinationName } = SECRET_SYNC_MAP[secretSync.destination];
 
   const formMethods = useForm<TSecretSyncForm>({
-    resolver: zodResolver(SecretSyncFormSchema),
+    resolver: zodResolver(UpdateSecretSyncFormSchema),
     defaultValues: {
       ...secretSync,
-      secretPath: secretSync.folder.path,
+      environment: secretSync.environment ?? undefined,
+      secretPath: secretSync.folder?.path,
       description: secretSync.description ?? ""
     },
     reValidateMode: "onChange"
@@ -39,7 +40,7 @@ export const EditSecretSyncForm = ({ secretSync, fields, onComplete }: Props) =>
       const updatedSecretSync = await updateSecretSync.mutateAsync({
         syncId: secretSync.id,
         ...formData,
-        environment: environment.slug
+        environment: environment?.slug
       });
 
       createNotification({

frontend/src/components/secret-syncs/forms/SecretSyncConnectionField.tsx

@@ -4,7 +4,8 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Link } from "@tanstack/react-router";
 
 import { FilterableSelect, FormControl } from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects, useOrgPermission } from "@app/context";
+import { OrgPermissionSubjects, useOrgPermission } from "@app/context";
+import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
 import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
 import { SECRET_SYNC_CONNECTION_MAP } from "@app/helpers/secretSyncs";
 import { useListAvailableAppConnections } from "@app/hooks/api/appConnections";
@@ -27,7 +28,7 @@ export const SecretSyncConnectionField = ({ onChange: callback }: Props) => {
   const connectionName = APP_CONNECTION_MAP[app].name;
 
   const canCreateConnection = permission.can(
-    OrgPermissionActions.Create,
+    OrgPermissionAppConnectionActions.Create,
     OrgPermissionSubjects.AppConnections
   );
 

frontend/src/components/secret-syncs/forms/schemas/aws-parameter-store-sync-destination-schema.ts

@@ -7,22 +7,10 @@ export const AwsParameterStoreSyncDestinationSchema = z.object({
   destinationConfig: z.object({
     path: z
       .string()
+      .trim()
       .min(1, "Parameter Store Path required")
-      .superRefine((val, ctx) => {
-        if (!/^\/([/]|(([\w-]+\/)+))?$/.test(val)) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'Invalid path - must follow "/example/path/" format'
-          });
-        }
-
-        if (val.length > 2048) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "Cannot exceed 2048 characters"
-          });
-        }
-      }),
+      .max(2048, "Cannot exceed 2048 characters")
+      .regex(/^\/([/]|(([\w-]+\/)+))?$/),
     region: z.string().min(1, "Region required")
   })
 });

frontend/src/components/secret-syncs/forms/schemas/github-sync-destination-schema.ts

@@ -29,17 +29,17 @@ export const GitHubSyncDestinationSchema = z.object({
       })
     ])
     .superRefine((options, ctx) => {
-      if (options.scope !== GitHubSyncScope.Organization) return;
-
-      if (
-        options.visibility === GitHubSyncVisibility.Selected &&
-        !options.selectedRepositoryIds?.length
-      ) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: "Select at least 1 repository",
-          path: ["selectedRepositoryIds"]
-        });
+      if (options.scope === GitHubSyncScope.Organization) {
+        if (
+          options.visibility === GitHubSyncVisibility.Selected &&
+          !options.selectedRepositoryIds?.length
+        ) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "Select at least 1 repository",
+            path: ["selectedRepositoryIds"]
+          });
+        }
       }
     })
 });

frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts

@@ -28,11 +28,13 @@ const BaseSecretSyncSchema = z.object({
   isEnabled: z.boolean()
 });
 
-export const SecretSyncFormSchema = z
-  .discriminatedUnion("destination", [
-    AwsParameterStoreSyncDestinationSchema,
-    GitHubSyncDestinationSchema
-  ])
-  .and(BaseSecretSyncSchema);
+const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
+  AwsParameterStoreSyncDestinationSchema,
+  GitHubSyncDestinationSchema
+]);
+
+export const SecretSyncFormSchema = SecretSyncUnionSchema.and(BaseSecretSyncSchema);
+
+export const UpdateSecretSyncFormSchema = SecretSyncUnionSchema.and(BaseSecretSyncSchema.partial());
 
 export type TSecretSyncForm = z.infer<typeof SecretSyncFormSchema>;

frontend/src/context/OrgPermissionContext/types.ts

@@ -61,7 +61,7 @@ export type OrgPermissionSet =
   | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]
   | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs]
   | [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
-  | [OrgPermissionActions, OrgPermissionSubjects.AppConnections];
+  | [OrgPermissionAppConnectionActions, OrgPermissionSubjects.AppConnections];
 // TODO(scott): add back once org UI refactored
 // | [
 //     OrgPermissionAppConnectionActions,

frontend/src/context/ProjectPermissionContext/types.ts

@@ -24,6 +24,16 @@ export enum ProjectPermissionCmekActions {
   Decrypt = "decrypt"
 }
 
+export enum ProjectPermissionSecretSyncActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  SyncSecrets = "sync-secrets",
+  ImportSecrets = "import-secrets",
+  RemoveSecrets = "remove-secrets"
+}
+
 export enum PermissionConditionOperators {
   $IN = "$in",
   $ALL = "$all",
@@ -174,7 +184,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.SshCertificates]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
-  | [ProjectPermissionActions, ProjectPermissionSub.SecretSyncs]
+  | [ProjectPermissionSecretSyncActions, ProjectPermissionSub.SecretSyncs]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]

frontend/src/helpers/secretSyncs.ts

@@ -39,10 +39,10 @@ export const SECRET_SYNC_IMPORT_BEHAVIOR_MAP: Record<
 > = {
   [SecretSyncImportBehavior.PrioritizeSource]: (destinationName: string) => ({
     name: "Prioritize Infisical Values",
-    description: `Infisical will import any secrets present in the ${destinationName} destination prior to syncing, prioritizing values present in Infisical over ${destinationName}.`
+    description: `Infisical will import any secrets present in the ${destinationName} destination, prioritizing values present in Infisical over ${destinationName}.`
   }),
   [SecretSyncImportBehavior.PrioritizeDestination]: (destinationName: string) => ({
     name: `Prioritize ${destinationName} Values`,
-    description: `Infisical will import any secrets present in the ${destinationName} destination prior to syncing, prioritizing values present in ${destinationName} over Infisical.`
+    description: `Infisical will import any secrets present in the ${destinationName} destination, prioritizing values present in ${destinationName} over Infisical.`
   })
 };

frontend/src/hooks/api/secretSyncs/mutations.tsx

@@ -48,8 +48,10 @@ export const useUpdateSecretSync = () => {
 export const useDeleteSecretSync = () => {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async ({ syncId, destination }: TDeleteSecretSyncDTO) => {
-      const { data } = await apiRequest.delete(`/api/v1/secret-syncs/${destination}/${syncId}`);
+    mutationFn: async ({ syncId, destination, removeSecrets }: TDeleteSecretSyncDTO) => {
+      const { data } = await apiRequest.delete(`/api/v1/secret-syncs/${destination}/${syncId}`, {
+        params: { removeSecrets }
+      });
 
       return data;
     },

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -37,6 +37,7 @@ export type TUpdateSecretSyncDTO = Partial<
 export type TDeleteSecretSyncDTO = {
   destination: SecretSync;
   syncId: string;
+  removeSecrets: boolean;
 };
 
 export type TTriggerSecretSyncSyncSecretsDTO = {

frontend/src/hooks/api/secretSyncs/types/root-sync.ts

@@ -6,7 +6,7 @@ export type TRootSecretSync = {
   name: string;
   description?: string | null;
   version: number;
-  folderId: string;
+  folderId: string | null;
   connectionId: string;
   createdAt: string;
   updatedAt: string;
@@ -38,9 +38,9 @@ export type TRootSecretSync = {
     id: string;
     name: string;
     slug: string;
-  };
+  } | null;
   folder: {
     id: string;
     path: string;
-  };
+  } | null;
 };

frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts

@@ -2,6 +2,7 @@
 import { z } from "zod";
 
 import { OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
 import { TPermission } from "@app/hooks/api/roles/types";
 
 const generalPermissionSchema = z
@@ -13,6 +14,16 @@ const generalPermissionSchema = z
   })
   .optional();
 
+const appConnectionsPermissionSchema = z
+  .object({
+    [OrgPermissionAppConnectionActions.Read]: z.boolean().optional(),
+    [OrgPermissionAppConnectionActions.Edit]: z.boolean().optional(),
+    [OrgPermissionAppConnectionActions.Create]: z.boolean().optional(),
+    [OrgPermissionAppConnectionActions.Delete]: z.boolean().optional(),
+    [OrgPermissionAppConnectionActions.Connect]: z.boolean().optional()
+  })
+  .optional();
+
 const adminConsolePermissionSchmea = z
   .object({
     "access-all-projects": z.boolean().optional()
@@ -50,7 +61,7 @@ export const formSchema = z.object({
       "organization-admin-console": adminConsolePermissionSchmea,
       [OrgPermissionSubjects.Kms]: generalPermissionSchema,
       [OrgPermissionSubjects.ProjectTemplates]: generalPermissionSchema,
-      [OrgPermissionSubjects.AppConnections]: generalPermissionSchema
+      "app-connections": appConnectionsPermissionSchema
     })
     .optional()
 });

frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionAppConnectionRow.tsx

@@ -0,0 +1,186 @@
+import { useEffect, useMemo } from "react";
+import { Control, Controller, UseFormSetValue, useWatch } from "react-hook-form";
+import { faChevronDown, faChevronRight } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import { Checkbox, Select, SelectItem, Td, Tr } from "@app/components/v2";
+import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
+import { useToggle } from "@app/hooks";
+
+import { TFormSchema } from "../OrgRoleModifySection.utils";
+
+type Props = {
+  isEditable: boolean;
+  setValue: UseFormSetValue<TFormSchema>;
+  control: Control<TFormSchema>;
+};
+
+enum Permission {
+  NoAccess = "no-access",
+  ReadOnly = "read-only",
+  FullAccess = "full-access",
+  Custom = "custom"
+}
+
+const PERMISSION_ACTIONS = [
+  { action: OrgPermissionAppConnectionActions.Read, label: "Read" },
+  { action: OrgPermissionAppConnectionActions.Create, label: "Create" },
+  { action: OrgPermissionAppConnectionActions.Edit, label: "Modify" },
+  { action: OrgPermissionAppConnectionActions.Delete, label: "Remove" },
+  { action: OrgPermissionAppConnectionActions.Connect, label: "Connect" }
+] as const;
+
+export const OrgPermissionAppConnectionRow = ({ isEditable, control, setValue }: Props) => {
+  const [isRowExpanded, setIsRowExpanded] = useToggle();
+  const [isCustom, setIsCustom] = useToggle();
+
+  const rule = useWatch({
+    control,
+    name: "permissions.app-connections"
+  });
+
+  const selectedPermissionCategory = useMemo(() => {
+    const actions = Object.keys(rule || {}) as Array<keyof typeof rule>;
+    const totalActions = PERMISSION_ACTIONS.length;
+    const score = actions.map((key) => (rule?.[key] ? 1 : 0)).reduce((a, b) => a + b, 0 as number);
+
+    if (isCustom) return Permission.Custom;
+    if (score === 0) return Permission.NoAccess;
+    if (score === totalActions) return Permission.FullAccess;
+    if (score === 1 && rule?.[OrgPermissionAppConnectionActions.Read]) return Permission.ReadOnly;
+
+    return Permission.Custom;
+  }, [rule, isCustom]);
+
+  useEffect(() => {
+    if (selectedPermissionCategory === Permission.Custom) setIsCustom.on();
+    else setIsCustom.off();
+  }, [selectedPermissionCategory]);
+
+  useEffect(() => {
+    const isRowCustom = selectedPermissionCategory === Permission.Custom;
+    if (isRowCustom) {
+      setIsRowExpanded.on();
+    }
+  }, []);
+
+  const handlePermissionChange = (val: Permission) => {
+    if (!val) return;
+    if (val === Permission.Custom) {
+      setIsRowExpanded.on();
+      setIsCustom.on();
+      return;
+    }
+    setIsCustom.off();
+
+    switch (val) {
+      case Permission.FullAccess:
+        setValue(
+          "permissions.app-connections",
+          {
+            [OrgPermissionAppConnectionActions.Read]: true,
+            [OrgPermissionAppConnectionActions.Edit]: true,
+            [OrgPermissionAppConnectionActions.Create]: true,
+            [OrgPermissionAppConnectionActions.Delete]: true,
+            [OrgPermissionAppConnectionActions.Connect]: true
+          },
+          { shouldDirty: true }
+        );
+        break;
+      case Permission.ReadOnly:
+        setValue(
+          "permissions.app-connections",
+          {
+            [OrgPermissionAppConnectionActions.Read]: true,
+            [OrgPermissionAppConnectionActions.Edit]: false,
+            [OrgPermissionAppConnectionActions.Create]: false,
+            [OrgPermissionAppConnectionActions.Delete]: false,
+            [OrgPermissionAppConnectionActions.Connect]: false
+          },
+          { shouldDirty: true }
+        );
+        break;
+
+      case Permission.NoAccess:
+      default:
+        setValue(
+          "permissions.app-connections",
+          {
+            [OrgPermissionAppConnectionActions.Read]: false,
+            [OrgPermissionAppConnectionActions.Edit]: false,
+            [OrgPermissionAppConnectionActions.Create]: false,
+            [OrgPermissionAppConnectionActions.Delete]: false,
+            [OrgPermissionAppConnectionActions.Connect]: false
+          },
+          { shouldDirty: true }
+        );
+    }
+  };
+
+  return (
+    <>
+      <Tr
+        className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
+        onClick={() => setIsRowExpanded.toggle()}
+      >
+        <Td>
+          <FontAwesomeIcon icon={isRowExpanded ? faChevronDown : faChevronRight} />
+        </Td>
+        <Td>App Connections</Td>
+        <Td>
+          <Select
+            value={selectedPermissionCategory}
+            className="w-40 bg-mineshaft-600"
+            dropdownContainerClassName="border border-mineshaft-600 bg-mineshaft-800"
+            onValueChange={handlePermissionChange}
+            isDisabled={!isEditable}
+          >
+            <SelectItem value={Permission.NoAccess}>No Access</SelectItem>
+            <SelectItem value={Permission.ReadOnly}>Read Only</SelectItem>
+            <SelectItem value={Permission.FullAccess}>Full Access</SelectItem>
+            <SelectItem value={Permission.Custom}>Custom</SelectItem>
+          </Select>
+        </Td>
+      </Tr>
+      {isRowExpanded && (
+        <Tr>
+          <Td
+            colSpan={3}
+            className={`bg-bunker-600 px-0 py-0 ${isRowExpanded && "border-mineshaft-500 p-8"}`}
+          >
+            <div className="grid grid-cols-3 gap-4">
+              {PERMISSION_ACTIONS.map(({ action, label }) => {
+                return (
+                  <Controller
+                    name={`permissions.app-connections.${action}`}
+                    key={`permissions.app-connections.${action}`}
+                    control={control}
+                    render={({ field }) => (
+                      <Checkbox
+                        isChecked={field.value}
+                        onCheckedChange={(e) => {
+                          if (!isEditable) {
+                            createNotification({
+                              type: "error",
+                              text: "Failed to update default role"
+                            });
+                            return;
+                          }
+                          field.onChange(e);
+                        }}
+                        id={`permissions.app-connections.${action}`}
+                      >
+                        {label}
+                      </Checkbox>
+                    )}
+                  />
+                );
+              })}
+            </div>
+          </Td>
+        </Tr>
+      )}
+    </>
+  );
+};

frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx

@@ -5,6 +5,7 @@ import { createNotification } from "@app/components/notifications";
 import { Button, Table, TableContainer, TBody, Th, THead, Tr } from "@app/components/v2";
 import { OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useGetOrgRole, useUpdateOrgRole } from "@app/hooks/api";
+import { OrgPermissionAppConnectionRow } from "@app/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionAppConnectionRow";
 
 import {
   formRolePermission2API,
@@ -69,8 +70,7 @@ const SIMPLE_PERMISSION_OPTIONS = [
     title: "External KMS",
     formName: OrgPermissionSubjects.Kms
   },
-  { title: "Project Templates", formName: OrgPermissionSubjects.ProjectTemplates },
-  { title: "App Connections", formName: OrgPermissionSubjects.AppConnections }
+  { title: "Project Templates", formName: OrgPermissionSubjects.ProjectTemplates }
 ] as const;
 
 type Props = {
@@ -165,6 +165,11 @@ export const RolePermissionsSection = ({ roleId }: Props) => {
                   />
                 );
               })}
+              <OrgPermissionAppConnectionRow
+                control={control}
+                setValue={setValue}
+                isEditable={isCustomRole}
+              />
               <OrgRoleWorkspaceRow
                 control={control}
                 setValue={setValue}

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/AppConnectionsTab.tsx

@@ -3,7 +3,8 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { OrgPermissionCan } from "@app/components/permissions";
 import { Button } from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
 import { withPermission } from "@app/hoc";
 import { usePopUp } from "@app/hooks";
 
@@ -41,7 +42,7 @@ export const AppConnectionsTab = withPermission(
               </p>
             </div>
             <OrgPermissionCan
-              I={OrgPermissionActions.Create}
+              I={OrgPermissionAppConnectionActions.Create}
               a={OrgPermissionSubjects.AppConnections}
             >
               {(isAllowed) => (
@@ -70,7 +71,7 @@ export const AppConnectionsTab = withPermission(
     );
   },
   {
-    action: OrgPermissionActions.Read,
+    action: OrgPermissionAppConnectionActions.Read,
     subject: OrgPermissionSubjects.AppConnections
   }
 );

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionRow.tsx

@@ -23,7 +23,8 @@ import {
   Tooltip,
   Tr
 } from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
 import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
 import { useToggle } from "@app/hooks";
 import { TAppConnection } from "@app/hooks/api/appConnections";
@@ -119,7 +120,7 @@ export const AppConnectionRow = ({
                 Copy Connection ID
               </DropdownMenuItem>
               <OrgPermissionCan
-                I={OrgPermissionActions.Edit}
+                I={OrgPermissionAppConnectionActions.Edit}
                 a={OrgPermissionSubjects.AppConnections}
               >
                 {(isAllowed: boolean) => (
@@ -133,7 +134,7 @@ export const AppConnectionRow = ({
                 )}
               </OrgPermissionCan>
               <OrgPermissionCan
-                I={OrgPermissionActions.Edit}
+                I={OrgPermissionAppConnectionActions.Edit}
                 a={OrgPermissionSubjects.AppConnections}
               >
                 {(isAllowed: boolean) => (
@@ -147,7 +148,7 @@ export const AppConnectionRow = ({
                 )}
               </OrgPermissionCan>
               <OrgPermissionCan
-                I={OrgPermissionActions.Delete}
+                I={OrgPermissionAppConnectionActions.Delete}
                 a={OrgPermissionSubjects.AppConnections}
               >
                 {(isAllowed: boolean) => (

frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/DeleteAppConnectionModal.tsx

@@ -33,7 +33,7 @@ export const DeleteAppConnectionModal = ({ isOpen, onOpenChange, appConnection }
       console.error(err);
 
       createNotification({
-        text: `Failed remove ${APP_CONNECTION_MAP[app].name} connection`,
+        text: `Failed to remove ${APP_CONNECTION_MAP[app].name} connection`,
         type: "error"
       });
     }

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx

@@ -8,6 +8,7 @@ import {
 import {
   PermissionConditionOperators,
   ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSecretSyncActions,
   TPermissionCondition,
   TPermissionConditionOperators
 } from "@app/context/ProjectPermissionContext/types";
@@ -37,6 +38,16 @@ const DynamicSecretPolicyActionSchema = z.object({
   [ProjectPermissionDynamicSecretActions.Lease]: z.boolean().optional()
 });
 
+const SecretSyncPolicyActionSchema = z.object({
+  [ProjectPermissionSecretSyncActions.Read]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.Create]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.Edit]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.Delete]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.SyncSecrets]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.ImportSecrets]: z.boolean().optional(),
+  [ProjectPermissionSecretSyncActions.RemoveSecrets]: z.boolean().optional()
+});
+
 const SecretRollbackPolicyActionSchema = z.object({
   read: z.boolean().optional(),
   create: z.boolean().optional()
@@ -138,7 +149,7 @@ export const projectRoleFormSchema = z.object({
       [ProjectPermissionSub.SecretRotation]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Kms]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Cmek]: CmekPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.SecretSyncs]: GeneralPolicyActionSchema.array().default([])
+      [ProjectPermissionSub.SecretSyncs]: SecretSyncPolicyActionSchema.array().default([])
     })
     .partial()
     .optional()
@@ -219,8 +230,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ProjectPermissionSub.SecretApproval,
         ProjectPermissionSub.Tags,
         ProjectPermissionSub.SecretRotation,
-        ProjectPermissionSub.Kms,
-        ProjectPermissionSub.SecretSyncs
+        ProjectPermissionSub.Kms
       ].includes(subject)
     ) {
       // from above statement we are sure it won't be undefined
@@ -333,6 +343,31 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
       if (canDelete) formVal[subject]![0].delete = true;
       if (canEncrypt) formVal[subject]![0].encrypt = true;
       if (canDecrypt) formVal[subject]![0].decrypt = true;
+      return;
+    }
+
+    if (subject === ProjectPermissionSub.SecretSyncs) {
+      const canRead = action.includes(ProjectPermissionSecretSyncActions.Read);
+      const canEdit = action.includes(ProjectPermissionSecretSyncActions.Edit);
+      const canDelete = action.includes(ProjectPermissionSecretSyncActions.Delete);
+      const canCreate = action.includes(ProjectPermissionSecretSyncActions.Create);
+      const canSyncSecrets = action.includes(ProjectPermissionSecretSyncActions.SyncSecrets);
+      const canImportSecrets = action.includes(ProjectPermissionSecretSyncActions.ImportSecrets);
+      const canRemoveSecrets = action.includes(ProjectPermissionSecretSyncActions.RemoveSecrets);
+
+      if (!formVal[subject]) formVal[subject] = [{}];
+
+      // from above statement we are sure it won't be undefined
+      if (canRead) formVal[subject]![0][ProjectPermissionSecretSyncActions.Read] = true;
+      if (canEdit) formVal[subject]![0][ProjectPermissionSecretSyncActions.Edit] = true;
+      if (canCreate) formVal[subject]![0][ProjectPermissionSecretSyncActions.Create] = true;
+      if (canDelete) formVal[subject]![0][ProjectPermissionSecretSyncActions.Delete] = true;
+      if (canSyncSecrets)
+        formVal[subject]![0][ProjectPermissionSecretSyncActions.SyncSecrets] = true;
+      if (canImportSecrets)
+        formVal[subject]![0][ProjectPermissionSecretSyncActions.ImportSecrets] = true;
+      if (canRemoveSecrets)
+        formVal[subject]![0][ProjectPermissionSecretSyncActions.RemoveSecrets] = true;
     }
   });
   return formVal;
@@ -676,10 +711,19 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
   [ProjectPermissionSub.SecretSyncs]: {
     title: "Secret Syncs",
     actions: [
-      { label: "Read", value: "read" },
-      { label: "Create", value: "create" },
-      { label: "Modify", value: "edit" },
-      { label: "Remove", value: "delete" }
+      { label: "Read", value: ProjectPermissionSecretSyncActions.Read },
+      { label: "Create", value: ProjectPermissionSecretSyncActions.Create },
+      { label: "Modify", value: ProjectPermissionSecretSyncActions.Edit },
+      { label: "Remove", value: ProjectPermissionSecretSyncActions.Delete },
+      { label: "Trigger Syncs", value: ProjectPermissionSecretSyncActions.SyncSecrets },
+      {
+        label: "Import Secrets from Destination",
+        value: ProjectPermissionSecretSyncActions.ImportSecrets
+      },
+      {
+        label: "Remove Secrets from Destination",
+        value: ProjectPermissionSecretSyncActions.RemoveSecrets
+      }
     ]
   }
 };

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/index.ts

@@ -0,0 +1 @@
+export * from "./SecretSyncDestinationCol";

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncRow.tsx

@@ -12,6 +12,7 @@ import {
   faToggleOff,
   faToggleOn,
   faTrash,
+  faTriangleExclamation,
   faXmark
 } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
@@ -38,12 +39,13 @@ import {
   Tr
 } from "@app/components/v2";
 import { ROUTE_PATHS } from "@app/const/routes";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
 import { useToggle } from "@app/hooks";
 import { SecretSyncStatus, TSecretSync, useSecretSyncOption } from "@app/hooks/api/secretSyncs";
-import { SecretSyncDestinationCol } from "@app/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol";
 
+import { SecretSyncDestinationCol } from "./SecretSyncDestinationCol";
 import { SecretSyncTableCell } from "./SecretSyncTableCell";
 
 type Props = {
@@ -66,7 +68,7 @@ export const SecretSyncRow = ({
   const navigate = useNavigate();
   const {
     id,
-    folder: { path: secretPath },
+    folder,
     lastSyncMessage,
     destination,
     lastSyncedAt,
@@ -130,7 +132,7 @@ export const SecretSyncRow = ({
       className={twMerge(
         "group h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700",
         syncStatus === SecretSyncStatus.Failed && "bg-red/5 hover:bg-red/10",
-        !isEnabled && "bg-mineshaft-400/15 opacity-50"
+        !isEnabled && "bg-mineshaft-400/15 opacity-50 hover:opacity-100"
       )}
       key={`sync-${id}`}
     >
@@ -158,7 +160,23 @@ export const SecretSyncRow = ({
           <p className="truncate text-xs leading-4 text-bunker-300">{destinationDetails.name}</p>
         </div>
       </Td>
-      <SecretSyncTableCell primaryText={secretPath} secondaryText={environment.name} />
+      {folder && environment ? (
+        <SecretSyncTableCell primaryText={folder.path} secondaryText={environment.name} />
+      ) : (
+        <Td>
+          <Tooltip content="The source location for this sync has been deleted. Configure a new source or remove this sync.">
+            <div className="w-min">
+              <Badge
+                className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap"
+                variant="primary"
+              >
+                <FontAwesomeIcon icon={faTriangleExclamation} />
+                <span>Source Folder Deleted</span>
+              </Badge>
+            </div>
+          </Tooltip>
+        </Td>
+      )}
       <SecretSyncDestinationCol secretSync={secretSync} />
       <Td>
         <div className="flex items-center gap-1">
@@ -242,64 +260,100 @@ export const SecretSyncRow = ({
               >
                 Copy Sync ID
               </DropdownMenuItem>
-              <DropdownMenuItem
-                icon={<FontAwesomeIcon icon={faRotate} />}
-                onClick={(e) => {
-                  e.stopPropagation();
-                  onTriggerSyncSecrets(secretSync);
-                }}
-              >
-                <Tooltip
-                  position="left"
-                  sideOffset={42}
-                  content={`Manually trigger a sync for this ${destinationName} destination.`}
-                >
-                  <div className="flex h-full w-full items-center justify-between gap-1">
-                    <span> Trigger Sync</span>
-                    <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faInfoCircle} />
-                  </div>
-                </Tooltip>
-              </DropdownMenuItem>
-              {syncOption?.canImportSecrets && (
-                <DropdownMenuItem
-                  icon={<FontAwesomeIcon icon={faDownload} />}
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    onTriggerImportSecrets(secretSync);
-                  }}
-                >
-                  <Tooltip
-                    position="left"
-                    sideOffset={42}
-                    content={`Import secrets from this ${destinationName} destination into Infisical.`}
-                  >
-                    <div className="flex h-full w-full items-center justify-between gap-1">
-                      <span>Import Secrets</span>
-                      <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faInfoCircle} />
-                    </div>
-                  </Tooltip>
-                </DropdownMenuItem>
-              )}
-              <DropdownMenuItem
-                icon={<FontAwesomeIcon icon={faEraser} />}
-                onClick={(e) => {
-                  e.stopPropagation();
-                  onTriggerRemoveSecrets(secretSync);
-                }}
-              >
-                <Tooltip
-                  position="left"
-                  sideOffset={42}
-                  content={`Remove secrets synced by Infisical from this ${destinationName} destination.`}
-                >
-                  <div className="flex h-full w-full items-center justify-between gap-1">
-                    <span>Remove Secrets</span>
-                    <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faInfoCircle} />
-                  </div>
-                </Tooltip>
-              </DropdownMenuItem>
               <ProjectPermissionCan
-                I={ProjectPermissionActions.Edit}
+                I={ProjectPermissionSecretSyncActions.SyncSecrets}
+                a={ProjectPermissionSub.SecretSyncs}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faRotate} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onTriggerSyncSecrets(secretSync);
+                    }}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Manually trigger a sync for this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span> Trigger Sync</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              {syncOption?.canImportSecrets && (
+                <ProjectPermissionCan
+                  I={ProjectPermissionSecretSyncActions.ImportSecrets}
+                  a={ProjectPermissionSub.SecretSyncs}
+                >
+                  {(isAllowed: boolean) => (
+                    <DropdownMenuItem
+                      icon={<FontAwesomeIcon icon={faDownload} />}
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        onTriggerImportSecrets(secretSync);
+                      }}
+                      isDisabled={!isAllowed}
+                    >
+                      <Tooltip
+                        position="left"
+                        sideOffset={42}
+                        content={`Import secrets from this ${destinationName} destination into Infisical.`}
+                      >
+                        <div className="flex h-full w-full items-center justify-between gap-1">
+                          <span>Import Secrets</span>
+                          <FontAwesomeIcon
+                            className="text-bunker-300"
+                            size="sm"
+                            icon={faInfoCircle}
+                          />
+                        </div>
+                      </Tooltip>
+                    </DropdownMenuItem>
+                  )}
+                </ProjectPermissionCan>
+              )}
+              <ProjectPermissionCan
+                I={ProjectPermissionSecretSyncActions.RemoveSecrets}
+                a={ProjectPermissionSub.SecretSyncs}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faEraser} />}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onTriggerRemoveSecrets(secretSync);
+                    }}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Remove secrets synced by Infisical from this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span>Remove Secrets</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              <ProjectPermissionCan
+                I={ProjectPermissionSecretSyncActions.Edit}
                 a={ProjectPermissionSub.SecretSyncs}
               >
                 {(isAllowed: boolean) => (
@@ -316,7 +370,7 @@ export const SecretSyncRow = ({
                 )}
               </ProjectPermissionCan>
               <ProjectPermissionCan
-                I={ProjectPermissionActions.Delete}
+                I={ProjectPermissionSecretSyncActions.Delete}
                 a={ProjectPermissionSub.SecretSyncs}
               >
                 {(isAllowed: boolean) => (

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncsTable.tsx

@@ -43,6 +43,7 @@ import { usePagination, usePopUp, useResetPageHelper } from "@app/hooks";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import {
   SecretSync,
+  SecretSyncStatus,
   TSecretSync,
   useTriggerSecretSyncSyncSecrets,
   useUpdateSecretSync
@@ -71,6 +72,20 @@ enum SecretSyncStatusCol {
   Disabled = "disabled"
 }
 
+const getSyncStatusOrderValue = (syncStatus: SecretSyncStatus | null) => {
+  switch (syncStatus) {
+    case SecretSyncStatus.Failed:
+      return 0;
+    case SecretSyncStatus.Pending:
+    case SecretSyncStatus.Running:
+      return 1;
+    case SecretSyncStatus.Succeeded:
+      return 2;
+    default:
+      return 3;
+  }
+};
+
 type Props = {
   secretSyncs: TSecretSync[];
 };
@@ -124,7 +139,11 @@ export const SecretSyncsTable = ({ secretSyncs }: Props) => {
           if (filters.destinations.length && !filters.destinations.includes(destination))
             return false;
 
-          if (filters.environmentIds.length && !filters.environmentIds.includes(environment.id))
+          if (
+            filters.environmentIds.length &&
+            environment?.id &&
+            !filters.environmentIds.includes(environment.id)
+          )
             return false;
 
           const status = isEnabled ? syncStatus : SecretSyncStatusCol.Disabled;
@@ -143,8 +162,8 @@ export const SecretSyncsTable = ({ secretSyncs }: Props) => {
           return (
             SECRET_SYNC_MAP[destination].name.toLowerCase().includes(searchValue) ||
             name.toLowerCase().includes(searchValue) ||
-            folder.path.toLowerCase().includes(searchValue) ||
-            environment.name.toLowerCase().includes(searchValue) ||
+            folder?.path.toLowerCase().includes(searchValue) ||
+            environment?.name.toLowerCase().includes(searchValue) ||
             connection.name.toLowerCase().includes(searchValue) ||
             destinationValues.primaryText.toLowerCase().includes(searchValue) ||
             destinationValues.secondaryText?.toLowerCase().includes(searchValue)
@@ -155,9 +174,9 @@ export const SecretSyncsTable = ({ secretSyncs }: Props) => {
 
           switch (orderBy) {
             case SecretSyncsOrderBy.Source:
-              return syncOne.folder.path
+              return (syncOne.folder?.path ?? "")
                 .toLowerCase()
-                .localeCompare(syncTwo.folder.path.toLowerCase());
+                .localeCompare(syncTwo.folder?.path.toLowerCase() ?? "");
             case SecretSyncsOrderBy.Destination:
               return getSecretSyncDestinationColValues(syncOne)
                 .primaryText.toLowerCase()
@@ -165,9 +184,17 @@ export const SecretSyncsTable = ({ secretSyncs }: Props) => {
                   getSecretSyncDestinationColValues(syncTwo).primaryText.toLowerCase()
                 );
             case SecretSyncsOrderBy.Status:
-              return syncOne.connection.name
-                .toLowerCase()
-                .localeCompare(syncTwo.connection.name.toLowerCase());
+              if (!syncOne.isEnabled && syncTwo.isEnabled) return 1;
+              if (syncOne.isEnabled && !syncTwo.isEnabled) return -1;
+
+              if (!syncOne.syncStatus && syncTwo.syncStatus) return 1;
+              if (syncOne.syncStatus && !syncTwo.syncStatus) return -1;
+              if (!syncOne.syncStatus && !syncTwo.syncStatus) return 0;
+
+              return (
+                getSyncStatusOrderValue(syncOne.syncStatus) -
+                getSyncStatusOrderValue(syncTwo.syncStatus)
+              );
             case SecretSyncsOrderBy.Name:
             default:
               return syncOne.name.toLowerCase().localeCompare(syncTwo.name.toLowerCase());

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncsTab.tsx

@@ -4,7 +4,8 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { CreateSecretSyncModal } from "@app/components/secret-syncs";
 import { Button, Spinner } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context";
+import { ProjectPermissionSub, useWorkspace } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { usePopUp } from "@app/hooks";
 import { useListSecretSyncs } from "@app/hooks/api/secretSyncs";
 
@@ -56,7 +57,7 @@ export const SecretSyncsTab = () => {
             </p>
           </div>
           <ProjectPermissionCan
-            I={ProjectPermissionActions.Create}
+            I={ProjectPermissionSecretSyncActions.Create}
             a={ProjectPermissionSub.SecretSyncs}
           >
             {(isAllowed) => (

frontend/src/pages/secret-manager/IntegrationsListPage/route.tsx

@@ -7,7 +7,9 @@ import { IntegrationsListPageTabs } from "@app/types/integrations";
 import { IntegrationsListPage } from "./IntegrationsListPage";
 
 const IntegrationsListPageQuerySchema = z.object({
-  selectedTab: z.string().catch(IntegrationsListPageTabs.NativeIntegrations)
+  selectedTab: z
+    .nativeEnum(IntegrationsListPageTabs)
+    .catch(IntegrationsListPageTabs.NativeIntegrations)
 });
 
 export const Route = createFileRoute(

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/SecretSyncDetailsByIDPage.tsx

@@ -8,7 +8,8 @@ import { EditSecretSyncModal } from "@app/components/secret-syncs";
 import { SecretSyncEditFields } from "@app/components/secret-syncs/types";
 import { Button, ContentLoader, EmptyState } from "@app/components/v2";
 import { ROUTE_PATHS } from "@app/const/routes";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
 import { usePopUp } from "@app/hooks";
 import { SecretSync, useGetSecretSync } from "@app/hooks/api/secretSyncs";
@@ -140,7 +141,7 @@ export const SecretSyncDetailsByIDPage = () => {
       <ProjectPermissionCan
         renderGuardBanner
         passThrough={false}
-        I={ProjectPermissionActions.Read}
+        I={ProjectPermissionSecretSyncActions.Read}
         a={ProjectPermissionSub.SecretSyncs}
       >
         <PageContent />

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncActionTriggers.tsx

@@ -33,7 +33,8 @@ import {
   Tooltip
 } from "@app/components/v2";
 import { ROUTE_PATHS } from "@app/const/routes";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
 import { usePopUp, useToggle } from "@app/hooks";
 import {
@@ -129,14 +130,22 @@ export const SecretSyncActionTriggers = ({ secretSync }: Props) => {
         <SecretSyncImportStatusBadge secretSync={secretSync} />
         <SecretSyncRemoveStatusBadge secretSync={secretSync} />
         <div>
-          <Button
-            variant="outline_bg"
-            leftIcon={<FontAwesomeIcon icon={faRotate} />}
-            onClick={handleTriggerSync}
-            className="h-9 rounded-r-none bg-mineshaft-500"
+          <ProjectPermissionCan
+            I={ProjectPermissionSecretSyncActions.SyncSecrets}
+            a={ProjectPermissionSub.SecretSyncs}
           >
-            Trigger Sync
-          </Button>
+            {(isAllowed: boolean) => (
+              <Button
+                variant="outline_bg"
+                leftIcon={<FontAwesomeIcon icon={faRotate} />}
+                onClick={handleTriggerSync}
+                className="h-9 rounded-r-none bg-mineshaft-500"
+                isDisabled={!isAllowed}
+              >
+                Trigger Sync
+              </Button>
+            )}
+          </ProjectPermissionCan>
           <DropdownMenu>
             <DropdownMenuTrigger asChild>
               <IconButton
@@ -158,39 +167,63 @@ export const SecretSyncActionTriggers = ({ secretSync }: Props) => {
                 Copy Sync ID
               </DropdownMenuItem>
               {syncOption?.canImportSecrets && (
-                <DropdownMenuItem
-                  icon={<FontAwesomeIcon icon={faDownload} />}
-                  onClick={() => handlePopUpOpen("importSecrets")}
+                <ProjectPermissionCan
+                  I={ProjectPermissionSecretSyncActions.ImportSecrets}
+                  a={ProjectPermissionSub.SecretSyncs}
                 >
-                  <Tooltip
-                    position="left"
-                    sideOffset={42}
-                    content={`Import secrets from this ${destinationName} destination into Infisical.`}
-                  >
-                    <div className="flex h-full w-full items-center justify-between gap-1">
-                      <span>Import Secrets</span>
-                      <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faInfoCircle} />
-                    </div>
-                  </Tooltip>
-                </DropdownMenuItem>
+                  {(isAllowed: boolean) => (
+                    <DropdownMenuItem
+                      icon={<FontAwesomeIcon icon={faDownload} />}
+                      onClick={() => handlePopUpOpen("importSecrets")}
+                      isDisabled={!isAllowed}
+                    >
+                      <Tooltip
+                        position="left"
+                        sideOffset={42}
+                        content={`Import secrets from this ${destinationName} destination into Infisical.`}
+                      >
+                        <div className="flex h-full w-full items-center justify-between gap-1">
+                          <span>Import Secrets</span>
+                          <FontAwesomeIcon
+                            className="text-bunker-300"
+                            size="sm"
+                            icon={faInfoCircle}
+                          />
+                        </div>
+                      </Tooltip>
+                    </DropdownMenuItem>
+                  )}
+                </ProjectPermissionCan>
               )}
-              <DropdownMenuItem
-                icon={<FontAwesomeIcon icon={faEraser} />}
-                onClick={() => handlePopUpOpen("removeSecrets")}
-              >
-                <Tooltip
-                  position="left"
-                  sideOffset={42}
-                  content={`Remove secrets synced by Infisical from this ${destinationName} destination.`}
-                >
-                  <div className="flex h-full w-full items-center justify-between gap-1">
-                    <span>Remove Secrets</span>
-                    <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faInfoCircle} />
-                  </div>
-                </Tooltip>
-              </DropdownMenuItem>
               <ProjectPermissionCan
-                I={ProjectPermissionActions.Edit}
+                I={ProjectPermissionSecretSyncActions.RemoveSecrets}
+                a={ProjectPermissionSub.SecretSyncs}
+              >
+                {(isAllowed: boolean) => (
+                  <DropdownMenuItem
+                    icon={<FontAwesomeIcon icon={faEraser} />}
+                    onClick={() => handlePopUpOpen("removeSecrets")}
+                    isDisabled={!isAllowed}
+                  >
+                    <Tooltip
+                      position="left"
+                      sideOffset={42}
+                      content={`Remove secrets synced by Infisical from this ${destinationName} destination.`}
+                    >
+                      <div className="flex h-full w-full items-center justify-between gap-1">
+                        <span>Remove Secrets</span>
+                        <FontAwesomeIcon
+                          className="text-bunker-300"
+                          size="sm"
+                          icon={faInfoCircle}
+                        />
+                      </div>
+                    </Tooltip>
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              <ProjectPermissionCan
+                I={ProjectPermissionSecretSyncActions.Edit}
                 a={ProjectPermissionSub.SecretSyncs}
               >
                 {(isAllowed: boolean) => (
@@ -206,7 +239,7 @@ export const SecretSyncActionTriggers = ({ secretSync }: Props) => {
                 )}
               </ProjectPermissionCan>
               <ProjectPermissionCan
-                I={ProjectPermissionActions.Delete}
+                I={ProjectPermissionSecretSyncActions.Delete}
                 a={ProjectPermissionSub.SecretSyncs}
               >
                 {(isAllowed: boolean) => (

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx

@@ -5,7 +5,8 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretSyncLabel } from "@app/components/secret-syncs";
 import { IconButton } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
 import { SecretSync, TSecretSync } from "@app/hooks/api/secretSyncs";
 import { AwsParameterStoreSyncDestinationSection } from "@app/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AwsParameterStoreSyncDestinationSection";
@@ -38,7 +39,7 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
       <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
         <h3 className="font-semibold text-mineshaft-100">Destination Configuration</h3>
         <ProjectPermissionCan
-          I={ProjectPermissionActions.Edit}
+          I={ProjectPermissionSecretSyncActions.Edit}
           a={ProjectPermissionSub.SecretSyncs}
         >
           {(isAllowed) => (

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDetailsSection.tsx

@@ -1,3 +1,4 @@
+import { useMemo } from "react";
 import { faBan, faEdit } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
@@ -5,7 +6,8 @@ import { format } from "date-fns";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretSyncLabel, SecretSyncStatusBadge } from "@app/components/secret-syncs";
 import { Badge, IconButton } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { SecretSyncStatus, TSecretSync } from "@app/hooks/api/secretSyncs";
 
 type Props = {
@@ -16,12 +18,26 @@ type Props = {
 export const SecretSyncDetailsSection = ({ secretSync, onEditDetails }: Props) => {
   const { syncStatus, lastSyncMessage, lastSyncedAt, name, description, isEnabled } = secretSync;
 
+  const failureMessage = useMemo(() => {
+    if (syncStatus === SecretSyncStatus.Failed) {
+      if (lastSyncMessage)
+        try {
+          return JSON.stringify(JSON.parse(lastSyncMessage), null, 2);
+        } catch {
+          return lastSyncMessage;
+        }
+
+      return "An Unknown Error Occurred.";
+    }
+    return null;
+  }, [syncStatus, lastSyncMessage]);
+
   return (
     <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
       <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
         <h3 className="font-semibold text-mineshaft-100">Details</h3>
         <ProjectPermissionCan
-          I={ProjectPermissionActions.Edit}
+          I={ProjectPermissionSecretSyncActions.Edit}
           a={ProjectPermissionSub.SecretSyncs}
         >
           {(isAllowed) => (
@@ -56,9 +72,9 @@ export const SecretSyncDetailsSection = ({ secretSync, onEditDetails }: Props) =
               {format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
             </SecretSyncLabel>
           )}
-          {syncStatus === SecretSyncStatus.Failed && lastSyncMessage && (
+          {syncStatus === SecretSyncStatus.Failed && failureMessage && (
             <SecretSyncLabel labelClassName="text-red" label="Last Sync Error">
-              <p className="break-words rounded bg-mineshaft-600 p-2 text-xs">{lastSyncMessage}</p>
+              <p className="break-words rounded bg-mineshaft-600 p-2 text-xs">{failureMessage}</p>
             </SecretSyncLabel>
           )}
         </div>

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection.tsx

@@ -4,7 +4,8 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretSyncLabel } from "@app/components/secret-syncs";
 import { IconButton } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP } from "@app/helpers/secretSyncs";
 import { TSecretSync } from "@app/hooks/api/secretSyncs";
 
@@ -26,7 +27,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
         <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
           <h3 className="font-semibold text-mineshaft-100">Sync Options</h3>
           <ProjectPermissionCan
-            I={ProjectPermissionActions.Edit}
+            I={ProjectPermissionSecretSyncActions.Edit}
             a={ProjectPermissionSub.SecretSyncs}
           >
             {(isAllowed) => (

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncSourceSection.tsx

@@ -1,10 +1,11 @@
-import { faEdit } from "@fortawesome/free-solid-svg-icons";
+import { faEdit, faTriangleExclamation } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretSyncLabel } from "@app/components/secret-syncs";
-import { IconButton } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { Badge, IconButton, Tooltip } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { TSecretSync } from "@app/hooks/api/secretSyncs";
 
 type Props = {
@@ -20,27 +21,42 @@ export const SecretSyncSourceSection = ({ secretSync, onEditSource }: Props) =>
       <div className="flex w-full flex-col gap-3 rounded-lg border border-mineshaft-600 bg-mineshaft-900 px-4 py-3">
         <div className="flex items-center justify-between border-b border-mineshaft-400 pb-2">
           <h3 className="font-semibold text-mineshaft-100">Source</h3>
-          <ProjectPermissionCan
-            I={ProjectPermissionActions.Edit}
-            a={ProjectPermissionSub.SecretSyncs}
-          >
-            {(isAllowed) => (
-              <IconButton
-                variant="plain"
-                colorSchema="secondary"
-                isDisabled={!isAllowed}
-                ariaLabel="Edit sync source"
-                onClick={onEditSource}
-              >
-                <FontAwesomeIcon icon={faEdit} />
-              </IconButton>
+          <div>
+            {(!folder || !environment) && (
+              <Tooltip content="The source location for this sync has been deleted. Configure a new source or remove this sync.">
+                <div className="mr-1 inline-block w-min">
+                  <Badge
+                    className="flex h-5 w-min items-center gap-1.5 whitespace-nowrap"
+                    variant="primary"
+                  >
+                    <FontAwesomeIcon icon={faTriangleExclamation} />
+                    <span>Folder Deleted</span>
+                  </Badge>
+                </div>
+              </Tooltip>
             )}
-          </ProjectPermissionCan>
+            <ProjectPermissionCan
+              I={ProjectPermissionSecretSyncActions.Edit}
+              a={ProjectPermissionSub.SecretSyncs}
+            >
+              {(isAllowed) => (
+                <IconButton
+                  variant="plain"
+                  colorSchema="secondary"
+                  isDisabled={!isAllowed}
+                  ariaLabel="Edit sync source"
+                  onClick={onEditSource}
+                >
+                  <FontAwesomeIcon icon={faEdit} />
+                </IconButton>
+              )}
+            </ProjectPermissionCan>
+          </div>
         </div>
         <div>
           <div className="space-y-3">
-            <SecretSyncLabel label="Environment">{environment.name}</SecretSyncLabel>
-            <SecretSyncLabel label="Path">{folder.path}</SecretSyncLabel>
+            <SecretSyncLabel label="Environment">{environment?.name}</SecretSyncLabel>
+            <SecretSyncLabel label="Path">{folder?.path}</SecretSyncLabel>
           </div>
         </div>
       </div>