Merge branch 'main' into feat/showWarningOnImportedSecretDeletion

frontend/src/hooks/api/accessApproval/types.ts

@@ -79,6 +79,8 @@ export type TAccessApprovalRequest = {
     member: string;
     status: string;
   }[];
+
+  note?: string;
 };
 
 export type TAccessApproval = {
@@ -119,6 +121,7 @@ export type TProjectUserPrivilege = {
 
 export type TCreateAccessRequestDTO = {
   projectSlug: string;
+  note?: string;
 } & Omit<TProjectUserPrivilege, "id" | "createdAt" | "updatedAt" | "slug" | "projectMembershipId">;
 
 export type TGetAccessApprovalRequestsDTO = {

frontend/src/hooks/api/appConnections/camunda/index.ts

@@ -0,0 +1 @@
+export * from "./queries";

frontend/src/hooks/api/appConnections/camunda/queries.tsx

@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TCamundaCluster } from "./types";
+
+const camundaConnectionKeys = {
+  all: [...appConnectionKeys.all, "camunda"] as const,
+  listClusters: (connectionId: string) =>
+    [...camundaConnectionKeys.all, "clusters", connectionId] as const
+};
+
+export const useCamundaConnectionListClusters = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TCamundaCluster[],
+      unknown,
+      TCamundaCluster[],
+      ReturnType<typeof camundaConnectionKeys.listClusters>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: camundaConnectionKeys.listClusters(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ clusters: TCamundaCluster[] }>(
+        `/api/v1/app-connections/camunda/${connectionId}/clusters`
+      );
+
+      return data.clusters;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/camunda/types.ts

@@ -0,0 +1,4 @@
+export type TCamundaCluster = {
+  name: string;
+  uuid: string;
+};

frontend/src/hooks/api/appConnections/enums.ts

@@ -6,6 +6,9 @@ export enum AppConnection {
   AzureAppConfiguration = "azure-app-configuration",
   Databricks = "databricks",
   Humanitec = "humanitec",
+  TerraformCloud = "terraform-cloud",
+  Vercel = "vercel",
   Postgres = "postgres",
-  MsSql = "mssql"
+  MsSql = "mssql",
+  Camunda = "camunda"
 }

frontend/src/hooks/api/appConnections/terraform-cloud/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/terraform-cloud/queries.tsx

@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TTerraformCloudOrganization } from "./types";
+
+const terraformCloudConnectionKeys = {
+  all: [...appConnectionKeys.all, "terraform-cloud"] as const,
+  listOrganizations: (connectionId: string) =>
+    [...terraformCloudConnectionKeys.all, "organizations", connectionId] as const
+};
+
+export const useTerraformCloudConnectionListOrganizations = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TTerraformCloudOrganization[],
+      unknown,
+      TTerraformCloudOrganization[],
+      ReturnType<typeof terraformCloudConnectionKeys.listOrganizations>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: terraformCloudConnectionKeys.listOrganizations(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TTerraformCloudOrganization[]>(
+        `/api/v1/app-connections/terraform-cloud/${connectionId}/organizations`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/terraform-cloud/types.ts

@@ -0,0 +1,56 @@
+export type TTerraformCloudOrganization = {
+  name: string;
+  id: string;
+  variableSets: TTerraformCloudVariableSet[];
+  workspaces: TTerraformCloudWorkspace[];
+};
+
+export type TTerraformCloudVariableSet = {
+  id: string;
+  name: string;
+};
+
+export type TTerraformCloudWorkspace = {
+  id: string;
+  name: string;
+};
+
+export type TTerraformCloudConnectionOrganization = {
+  id: string;
+  name: string;
+  variableSets: TTerraformCloudConnectionVariableSet[];
+  workspaces: TTerraformCloudConnectionWorkspace[];
+};
+
+export type TTerraformCloudConnectionVariableSet = {
+  id: string;
+  name: string;
+  description: string;
+  global: boolean;
+};
+
+export type TTerraformCloudConnectionWorkspace = {
+  id: string;
+  name: string;
+};
+
+export enum TerraformCloudSyncScope {
+  VariableSet = "variable-set",
+  Workspace = "workspace"
+}
+
+export enum TerraformCloudSyncCategory {
+  Environment = "env",
+  Terraform = "terraform"
+}
+
+export const TERRAFORM_CLOUD_SYNC_SCOPES = {
+  [TerraformCloudSyncScope.VariableSet]: {
+    name: "Variable Set",
+    description: "Sync secrets to a specific variable set in Terraform Cloud."
+  },
+  [TerraformCloudSyncScope.Workspace]: {
+    name: "Workspace",
+    description: "Sync secrets to a specific workspace in Terraform Cloud."
+  }
+};

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -39,6 +39,14 @@ export type THumanitecConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Humanitec;
 };
 
+export type TTerraformCloudConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.TerraformCloud;
+};
+
+export type TVercelConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Vercel;
+};
+
 export type TPostgresConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Postgres;
 };
@@ -47,6 +55,10 @@ export type TMsSqlConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.MsSql;
 };
 
+export type TCamundaConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Camunda;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
@@ -55,8 +67,11 @@ export type TAppConnectionOption =
   | TAzureKeyVaultConnectionOption
   | TDatabricksConnectionOption
   | THumanitecConnectionOption
+  | TTerraformCloudConnectionOption
+  | TVercelConnectionOption
   | TPostgresConnectionOption
-  | TMsSqlConnectionOption;
+  | TMsSqlConnectionOption
+  | TCamundaConnectionOption;
 
 export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
@@ -66,6 +81,9 @@ export type TAppConnectionOptionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnectionOption;
   [AppConnection.Databricks]: TDatabricksConnectionOption;
   [AppConnection.Humanitec]: THumanitecConnectionOption;
+  [AppConnection.TerraformCloud]: TTerraformCloudConnectionOption;
+  [AppConnection.Vercel]: TVercelConnectionOption;
   [AppConnection.Postgres]: TPostgresConnectionOption;
   [AppConnection.MsSql]: TMsSqlConnectionOption;
+  [AppConnection.Camunda]: TCamundaConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/camunda-connection.ts

@@ -0,0 +1,14 @@
+import { AppConnection } from "../enums";
+import { TRootAppConnection } from "./root-connection";
+
+export enum CamundaConnectionMethod {
+  ClientCredentials = "client-credentials"
+}
+
+export type TCamundaConnection = TRootAppConnection & { app: AppConnection.Camunda } & {
+  method: CamundaConnectionMethod.ClientCredentials;
+  credentials: {
+    clientId: string;
+    clientSecret: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/index.ts

@@ -3,22 +3,28 @@ import { TAppConnectionOption } from "./app-options";
 import { TAwsConnection } from "./aws-connection";
 import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
 import { TAzureKeyVaultConnection } from "./azure-key-vault-connection";
+import { TCamundaConnection } from "./camunda-connection";
 import { TDatabricksConnection } from "./databricks-connection";
 import { TGcpConnection } from "./gcp-connection";
 import { TGitHubConnection } from "./github-connection";
 import { THumanitecConnection } from "./humanitec-connection";
 import { TMsSqlConnection } from "./mssql-connection";
 import { TPostgresConnection } from "./postgres-connection";
+import { TTerraformCloudConnection } from "./terraform-cloud-connection";
+import { TVercelConnection } from "./vercel-connection";
 
 export * from "./aws-connection";
 export * from "./azure-app-configuration-connection";
 export * from "./azure-key-vault-connection";
+export * from "./camunda-connection";
 export * from "./databricks-connection";
 export * from "./gcp-connection";
 export * from "./github-connection";
 export * from "./humanitec-connection";
 export * from "./mssql-connection";
 export * from "./postgres-connection";
+export * from "./terraform-cloud-connection";
+export * from "./vercel-connection";
 
 export type TAppConnection =
   | TAwsConnection
@@ -28,8 +34,11 @@ export type TAppConnection =
   | TAzureAppConfigurationConnection
   | TDatabricksConnection
   | THumanitecConnection
+  | TTerraformCloudConnection
+  | TVercelConnection
   | TPostgresConnection
-  | TMsSqlConnection;
+  | TMsSqlConnection
+  | TCamundaConnection;
 
 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
 
@@ -64,6 +73,9 @@ export type TAppConnectionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
+  [AppConnection.TerraformCloud]: TTerraformCloudConnection;
+  [AppConnection.Vercel]: TVercelConnection;
   [AppConnection.Postgres]: TPostgresConnection;
   [AppConnection.MsSql]: TMsSqlConnection;
+  [AppConnection.Camunda]: TCamundaConnection;
 };

frontend/src/hooks/api/appConnections/types/terraform-cloud-connection.ts

@@ -0,0 +1,15 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum TerraformCloudConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TTerraformCloudConnection = TRootAppConnection & {
+  app: AppConnection.TerraformCloud;
+} & {
+  method: TerraformCloudConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/vercel-connection.ts

@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum VercelConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TVercelConnection = TRootAppConnection & { app: AppConnection.Vercel } & {
+  method: VercelConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+  };
+};

frontend/src/hooks/api/appConnections/vercel/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/vercel/queries.tsx

@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TVercelConnectionOrganization } from "./types";
+
+const vercelConnectionKeys = {
+  all: [...appConnectionKeys.all, "vercel"] as const,
+  listOrganizations: (connectionId: string) =>
+    [...vercelConnectionKeys.all, "organizations", connectionId] as const
+};
+
+export const useVercelConnectionListOrganizations = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TVercelConnectionOrganization[],
+      unknown,
+      TVercelConnectionOrganization[],
+      ReturnType<typeof vercelConnectionKeys.listOrganizations>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: vercelConnectionKeys.listOrganizations(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TVercelConnectionOrganization[]>(
+        `/api/v1/app-connections/vercel/${connectionId}/projects`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/vercel/types.ts

@@ -0,0 +1,30 @@
+export type TVercelApp = {
+  id: string;
+  name: string;
+  envs: { id: string; name: string }[];
+};
+
+export type TVercelConnectionEnvironment = {
+  id: string;
+  slug: string;
+  type: string;
+  target?: string[];
+  gitBranch?: string;
+  createdAt?: number;
+  updatedAt?: number;
+};
+
+export type TVercelConnectionApp = {
+  id: string;
+  name: string;
+  envs?: TVercelConnectionEnvironment[];
+  previewBranches?: string[];
+  projectId: string;
+};
+
+export type TVercelConnectionOrganization = {
+  id: string;
+  name: string;
+  slug: string;
+  apps: TVercelConnectionApp[];
+};

frontend/src/hooks/api/auditLogs/constants.tsx

@@ -106,6 +106,10 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.GET_CMEK]: "Get KMS key",
   [EventType.CMEK_ENCRYPT]: "Encrypt with KMS key",
   [EventType.CMEK_DECRYPT]: "Decrypt with KMS key",
+  [EventType.CMEK_SIGN]: "Sign with KMS key",
+  [EventType.CMEK_VERIFY]: "Verify with KMS key",
+  [EventType.CMEK_LIST_SIGNING_ALGORITHMS]: "List signing algorithms for KMS key",
+  [EventType.CMEK_GET_PUBLIC_KEY]: "Get public key for KMS key",
   [EventType.UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]:
     "Update SSO group to organization role mapping",
   [EventType.GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]: "List SSO group to organization role mapping",

frontend/src/hooks/api/auditLogs/enums.tsx

@@ -110,6 +110,10 @@ export enum EventType {
   GET_CMEK = "get-cmek",
   CMEK_ENCRYPT = "cmek-encrypt",
   CMEK_DECRYPT = "cmek-decrypt",
+  CMEK_SIGN = "cmek-sign",
+  CMEK_VERIFY = "cmek-verify",
+  CMEK_LIST_SIGNING_ALGORITHMS = "cmek-list-signing-algorithms",
+  CMEK_GET_PUBLIC_KEY = "cmek-get-public-key",
   UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
   GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "get-external-group-org-role-mapping",
   GET_PROJECT_TEMPLATES = "get-project-templates",

frontend/src/hooks/api/cmeks/mutations.tsx

@@ -8,6 +8,10 @@ import {
   TCmekDecryptResponse,
   TCmekEncrypt,
   TCmekEncryptResponse,
+  TCmekSign,
+  TCmekSignResponse,
+  TCmekVerify,
+  TCmekVerifyResponse,
   TCreateCmek,
   TDeleteCmek,
   TUpdateCmek
@@ -74,6 +78,44 @@ export const useCmekEncrypt = () => {
   });
 };
 
+export const useCmekSign = () => {
+  return useMutation({
+    mutationFn: async ({
+      keyId,
+      data,
+      signingAlgorithm,
+      isBase64Encoded
+    }: TCmekSign & { isBase64Encoded: boolean }) => {
+      const res = await apiRequest.post<TCmekSignResponse>(`/api/v1/kms/keys/${keyId}/sign`, {
+        data: isBase64Encoded ? data : encodeBase64(Buffer.from(data)),
+        signingAlgorithm
+      });
+
+      return res.data;
+    }
+  });
+};
+
+export const useCmekVerify = () => {
+  return useMutation({
+    mutationFn: async ({
+      keyId,
+      data,
+      signature,
+      signingAlgorithm,
+      isBase64Encoded
+    }: TCmekVerify & { isBase64Encoded: boolean }) => {
+      const res = await apiRequest.post<TCmekVerifyResponse>(`/api/v1/kms/keys/${keyId}/verify`, {
+        data: isBase64Encoded ? data : encodeBase64(Buffer.from(data)),
+        signature,
+        signingAlgorithm
+      });
+
+      return res.data;
+    }
+  });
+};
+
 export const useCmekDecrypt = () => {
   return useMutation({
     mutationFn: async ({ keyId, ciphertext }: TCmekDecrypt) => {

frontend/src/hooks/api/cmeks/types.ts

@@ -1,10 +1,18 @@
+import { z } from "zod";
+
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 
+export enum KmsKeyUsage {
+  ENCRYPT_DECRYPT = "encrypt-decrypt",
+  SIGN_VERIFY = "sign-verify"
+}
+
 export type TCmek = {
   id: string;
+  keyUsage: KmsKeyUsage;
   name: string;
   description?: string;
-  encryptionAlgorithm: EncryptionAlgorithm;
+  encryptionAlgorithm: AsymmetricKeyAlgorithm | SymmetricKeyAlgorithm;
   projectId: string;
   isDisabled: boolean;
   isReserved: boolean;
@@ -17,7 +25,8 @@ export type TCmek = {
 type ProjectRef = { projectId: string };
 type KeyRef = { keyId: string };
 
-export type TCreateCmek = Pick<TCmek, "name" | "description" | "encryptionAlgorithm"> & ProjectRef;
+export type TCreateCmek = Pick<TCmek, "name" | "description" | "encryptionAlgorithm" | "keyUsage"> &
+  ProjectRef;
 export type TUpdateCmek = KeyRef &
   Partial<Pick<TCmek, "name" | "description" | "isDisabled">> &
   ProjectRef;
@@ -26,6 +35,13 @@ export type TDeleteCmek = KeyRef & ProjectRef;
 export type TCmekEncrypt = KeyRef & { plaintext: string; isBase64Encoded?: boolean };
 export type TCmekDecrypt = KeyRef & { ciphertext: string };
 
+export type TCmekSign = KeyRef & { data: string; signingAlgorithm: SigningAlgorithm };
+export type TCmekVerify = KeyRef & {
+  data: string;
+  signature: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
 export type TProjectCmeksList = {
   keys: TCmek[];
   totalCount: number;
@@ -44,6 +60,18 @@ export type TCmekEncryptResponse = {
   ciphertext: string;
 };
 
+export type TCmekSignResponse = {
+  signature: string;
+  keyId: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
+export type TCmekVerifyResponse = {
+  signatureValid: boolean;
+  keyId: string;
+  signingAlgorithm: SigningAlgorithm;
+};
+
 export type TCmekDecryptResponse = {
   plaintext: string;
 };
@@ -52,7 +80,35 @@ export enum CmekOrderBy {
   Name = "name"
 }
 
-export enum EncryptionAlgorithm {
+export enum AsymmetricKeyAlgorithm {
+  RSA_4096 = "RSA_4096",
+  ECC_NIST_P256 = "ECC_NIST_P256"
+}
+
+// Supported symmetric encrypt/decrypt algorithms
+export enum SymmetricKeyAlgorithm {
   AES_GCM_256 = "aes-256-gcm",
   AES_GCM_128 = "aes-128-gcm"
 }
+
+export const AllowedEncryptionKeyAlgorithms = z.enum([
+  ...Object.values(SymmetricKeyAlgorithm),
+  ...Object.values(AsymmetricKeyAlgorithm)
+] as [string, ...string[]]).options;
+
+export enum SigningAlgorithm {
+  // RSA PSS algorithms
+  RSASSA_PSS_SHA_256 = "RSASSA_PSS_SHA_256",
+  RSASSA_PSS_SHA_384 = "RSASSA_PSS_SHA_384",
+  RSASSA_PSS_SHA_512 = "RSASSA_PSS_SHA_512",
+
+  // RSA PKCS#1 v1.5 algorithms
+  RSASSA_PKCS1_V1_5_SHA_256 = "RSASSA_PKCS1_V1_5_SHA_256",
+  RSASSA_PKCS1_V1_5_SHA_384 = "RSASSA_PKCS1_V1_5_SHA_384",
+  RSASSA_PKCS1_V1_5_SHA_512 = "RSASSA_PKCS1_V1_5_SHA_512",
+
+  // ECDSA algorithms
+  ECDSA_SHA_256 = "ECDSA_SHA_256",
+  ECDSA_SHA_384 = "ECDSA_SHA_384",
+  ECDSA_SHA_512 = "ECDSA_SHA_512"
+}

frontend/src/hooks/api/identities/index.tsx

@@ -46,5 +46,6 @@ export {
   useGetIdentityTokenAuth,
   useGetIdentityTokensTokenAuth,
   useGetIdentityUniversalAuth,
-  useGetIdentityUniversalAuthClientSecrets
+  useGetIdentityUniversalAuthClientSecrets,
+  useSearchIdentities
 } from "./queries";

frontend/src/hooks/api/identities/queries.tsx

@@ -15,11 +15,13 @@ import {
   IdentityMembershipOrg,
   IdentityOidcAuth,
   IdentityTokenAuth,
-  IdentityUniversalAuth
+  IdentityUniversalAuth,
+  TSearchIdentitiesDTO
 } from "./types";
 
 export const identitiesKeys = {
   getIdentityById: (identityId: string) => [{ identityId }, "identity"] as const,
+  searchIdentities: (dto: TSearchIdentitiesDTO) => ["identity", "search", dto] as const,
   getIdentityUniversalAuth: (identityId: string) =>
     [{ identityId }, "identity-universal-auth"] as const,
   getIdentityUniversalAuthClientSecrets: (identityId: string) =>
@@ -53,6 +55,26 @@ export const useGetIdentityById = (identityId: string) => {
   });
 };
 
+export const useSearchIdentities = (dto: TSearchIdentitiesDTO) => {
+  const { limit, search, offset, orderBy, orderDirection } = dto;
+  return useQuery({
+    queryKey: identitiesKeys.searchIdentities(dto),
+    queryFn: async () => {
+      const { data } = await apiRequest.post<{
+        identities: IdentityMembershipOrg[];
+        totalCount: number;
+      }>("/api/v1/identities/search", {
+        limit,
+        offset,
+        orderBy,
+        orderDirection,
+        search
+      });
+      return data;
+    }
+  });
+};
+
 export const useGetIdentityProjectMemberships = (identityId: string) => {
   return useQuery({
     enabled: Boolean(identityId),

frontend/src/hooks/api/identities/types.ts

@@ -1,3 +1,5 @@
+import { OrderByDirection } from "../generic/types";
+import { OrgIdentityOrderBy } from "../organization/types";
 import { TOrgRole } from "../roles/types";
 import { ProjectUserMembershipTemporaryMode, Workspace } from "../workspace/types";
 import { IdentityAuthMethod, IdentityJwtConfigurationType } from "./enums";
@@ -540,3 +542,14 @@ export type TProjectIdentitiesList = {
   identityMemberships: IdentityMembership[];
   totalCount: number;
 };
+
+export type TSearchIdentitiesDTO = {
+  limit?: number;
+  offset?: number;
+  orderBy?: OrgIdentityOrderBy;
+  orderDirection?: OrderByDirection;
+  search: {
+    name?: { $contains: string };
+    role?: { $in: string[] };
+  };
+};

frontend/src/hooks/api/index.tsx

@@ -41,6 +41,7 @@ export * from "./serverDetails";
 export * from "./serviceTokens";
 export * from "./sshCa";
 export * from "./sshCertificateTemplates";
+export * from "./sshHost";
 export * from "./ssoConfig";
 export * from "./subscriptions";
 export * from "./tags";

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -6,7 +6,10 @@ export enum SecretSync {
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
   Databricks = "databricks",
-  Humanitec = "humanitec"
+  Humanitec = "humanitec",
+  TerraformCloud = "terraform-cloud",
+  Camunda = "camunda",
+  Vercel = "vercel"
 }
 
 export enum SecretSyncStatus {

frontend/src/hooks/api/secretSyncs/types/camunda-sync.ts

@@ -0,0 +1,21 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export enum CamundaSyncScope {
+  Cluster = "cluster"
+}
+
+export type TCamundaSync = TRootSecretSync & {
+  destination: SecretSync.Camunda;
+  destinationConfig: {
+    scope: string;
+    clusterUUID: string;
+    clusterName?: string;
+  };
+  connection: {
+    app: AppConnection.Camunda;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -7,8 +7,11 @@ import { DiscriminativePick } from "@app/types";
 import { TAwsSecretsManagerSync } from "./aws-secrets-manager-sync";
 import { TAzureAppConfigurationSync } from "./azure-app-configuration-sync";
 import { TAzureKeyVaultSync } from "./azure-key-vault-sync";
+import { TCamundaSync } from "./camunda-sync";
 import { TGcpSync } from "./gcp-sync";
 import { THumanitecSync } from "./humanitec-sync";
+import { TTerraformCloudSync } from "./terraform-cloud-sync";
+import { TVercelSync } from "./vercel-sync";
 
 export type TSecretSyncOption = {
   name: string;
@@ -24,7 +27,10 @@ export type TSecretSync =
   | TAzureKeyVaultSync
   | TAzureAppConfigurationSync
   | TDatabricksSync
-  | THumanitecSync;
+  | THumanitecSync
+  | TTerraformCloudSync
+  | TCamundaSync
+  | TVercelSync;
 
 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };
 

frontend/src/hooks/api/secretSyncs/types/terraform-cloud-sync.ts

@@ -0,0 +1,34 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+import { TerraformCloudSyncCategory } from "../../appConnections/terraform-cloud";
+
+export type TTerraformCloudSync = TRootSecretSync & {
+  destination: SecretSync.TerraformCloud;
+  destinationConfig:
+    | {
+        scope: TerraformCloudSyncScope.VariableSet;
+        org: string;
+        category: TerraformCloudSyncCategory;
+        variableSetId: string;
+        variableSetName: string;
+      }
+    | {
+        scope: TerraformCloudSyncScope.Workspace;
+        org: string;
+        category: TerraformCloudSyncCategory;
+        workspaceId: string;
+        workspaceName: string;
+      };
+  connection: {
+    app: AppConnection.TerraformCloud;
+    name: string;
+    id: string;
+  };
+};
+
+export enum TerraformCloudSyncScope {
+  VariableSet = "variable-set",
+  Workspace = "workspace"
+}

frontend/src/hooks/api/secretSyncs/types/vercel-sync.ts

@@ -0,0 +1,27 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export const VercelEnvironmentType = {
+  Development: "development",
+  Preview: "preview",
+  Production: "production"
+} as const;
+
+export type VercelEnvironment = (typeof VercelEnvironmentType)[keyof typeof VercelEnvironmentType];
+
+export type TVercelSync = TRootSecretSync & {
+  destination: SecretSync.Vercel;
+  destinationConfig: {
+    app: string;
+    env: VercelEnvironment | string;
+    branch?: string;
+    appName?: string;
+    teamId: string;
+  };
+  connection: {
+    app: AppConnection.Vercel;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/sshCa/constants.tsx

@@ -12,3 +12,47 @@ export const sshCertTypeToNameMap: { [K in SshCertType]: string } = {
   [SshCertType.USER]: "User",
   [SshCertType.HOST]: "Host"
 };
+
+export enum SshCaKeySource {
+  INTERNAL = "internal",
+  EXTERNAL = "external"
+}
+
+export enum SshCertKeyAlgorithm {
+  RSA_2048 = "RSA_2048",
+  RSA_4096 = "RSA_4096",
+  ECDSA_P256 = "EC_prime256v1",
+  ECDSA_P384 = "EC_secp384r1",
+  ED25519 = "ED25519"
+}
+
+export const sshCertKeyAlgorithmToNameMap: { [K in SshCertKeyAlgorithm]: string } = {
+  [SshCertKeyAlgorithm.RSA_2048]: "RSA 2048",
+  [SshCertKeyAlgorithm.RSA_4096]: "RSA 4096",
+  [SshCertKeyAlgorithm.ECDSA_P256]: "ECDSA P256",
+  [SshCertKeyAlgorithm.ECDSA_P384]: "ECDSA P384",
+  [SshCertKeyAlgorithm.ED25519]: "ED25519"
+};
+
+export const sshCertKeyAlgorithms = [
+  {
+    label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.RSA_2048],
+    value: SshCertKeyAlgorithm.RSA_2048
+  },
+  {
+    label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.RSA_4096],
+    value: SshCertKeyAlgorithm.RSA_4096
+  },
+  {
+    label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ECDSA_P256],
+    value: SshCertKeyAlgorithm.ECDSA_P256
+  },
+  {
+    label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ECDSA_P384],
+    value: SshCertKeyAlgorithm.ECDSA_P384
+  },
+  {
+    label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ED25519],
+    value: SshCertKeyAlgorithm.ED25519
+  }
+];

frontend/src/hooks/api/sshCa/types.ts

@@ -1,5 +1,4 @@
-import { CertKeyAlgorithm } from "../certificates/enums";
-import { SshCaStatus, SshCertType } from "./constants";
+import { SshCaKeySource, SshCaStatus, SshCertKeyAlgorithm, SshCertType } from "./constants";
 
 export type TSshCertificate = {
   id: string;
@@ -18,17 +17,28 @@ export type TSshCertificateAuthority = {
   projectId: string;
   status: SshCaStatus;
   friendlyName: string;
-  keyAlgorithm: CertKeyAlgorithm;
+  keyAlgorithm: SshCertKeyAlgorithm;
+  keySource: SshCaKeySource;
   createdAt: string;
   updatedAt: string;
   publicKey: string;
 };
 
-export type TCreateSshCaDTO = {
-  projectId: string;
-  friendlyName?: string;
-  keyAlgorithm: CertKeyAlgorithm;
-};
+export type TCreateSshCaDTO =
+  | {
+      projectId: string;
+      friendlyName?: string;
+      keySource: SshCaKeySource.INTERNAL;
+      keyAlgorithm: SshCertKeyAlgorithm;
+    }
+  | {
+      projectId: string;
+      friendlyName?: string;
+      keySource: SshCaKeySource.EXTERNAL;
+      keyAlgorithm: SshCertKeyAlgorithm;
+      publicKey: string;
+      privateKey: string;
+    };
 
 export type TUpdateSshCaDTO = {
   caId: string;
@@ -58,7 +68,7 @@ export type TSignSshKeyResponse = {
 export type TIssueSshCredsDTO = {
   projectId: string;
   certificateTemplateId: string;
-  keyAlgorithm: CertKeyAlgorithm;
+  keyAlgorithm: SshCertKeyAlgorithm;
   certType: SshCertType;
   principals: string[];
   ttl?: string;
@@ -70,5 +80,5 @@ export type TIssueSshCredsResponse = {
   signedKey: string;
   privateKey: string;
   publicKey: string;
-  keyAlgorithm: CertKeyAlgorithm;
+  keyAlgorithm: SshCertKeyAlgorithm;
 };

frontend/src/hooks/api/sshHost/index.tsx

@@ -0,0 +1,2 @@
+export { useCreateSshHost, useDeleteSshHost, useUpdateSshHost } from "./mutations";
+export { fetchSshHostUserCaPublicKey, useGetSshHostById } from "./queries";

frontend/src/hooks/api/sshHost/mutations.tsx

@@ -0,0 +1,45 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { workspaceKeys } from "../workspace/query-keys";
+import { TCreateSshHostDTO, TDeleteSshHostDTO, TSshHost, TUpdateSshHostDTO } from "./types";
+
+export const useCreateSshHost = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TSshHost, object, TCreateSshHostDTO>({
+    mutationFn: async (body) => {
+      const { data: host } = await apiRequest.post("/api/v1/ssh/hosts", body);
+      return host;
+    },
+    onSuccess: ({ projectId }) => {
+      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceSshHosts(projectId) });
+    }
+  });
+};
+
+export const useUpdateSshHost = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TSshHost, object, TUpdateSshHostDTO>({
+    mutationFn: async ({ sshHostId, ...body }) => {
+      const { data: host } = await apiRequest.patch(`/api/v1/ssh/hosts/${sshHostId}`, body);
+      return host;
+    },
+    onSuccess: ({ projectId }) => {
+      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceSshHosts(projectId) });
+    }
+  });
+};
+
+export const useDeleteSshHost = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TSshHost, object, TDeleteSshHostDTO>({
+    mutationFn: async ({ sshHostId }) => {
+      const { data: host } = await apiRequest.delete(`/api/v1/ssh/hosts/${sshHostId}`);
+      return host;
+    },
+    onSuccess: ({ projectId }) => {
+      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceSshHosts(projectId) });
+    }
+  });
+};

frontend/src/hooks/api/sshHost/queries.tsx

@@ -0,0 +1,28 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TSshHost } from "./types";
+
+export const sshHostKeys = {
+  getSshHostById: (sshHostId: string) => [{ sshHostId }, "ssh-host"],
+  getSshHostUserCaPublicKey: (sshHostId: string) => [{ sshHostId }, "ssh-host-user-ca-public-key"]
+};
+
+export const useGetSshHostById = (sshHostId: string) => {
+  return useQuery({
+    queryKey: sshHostKeys.getSshHostById(sshHostId),
+    queryFn: async () => {
+      const { data: sshHost } = await apiRequest.get<TSshHost>(`/api/v1/ssh/hosts/${sshHostId}`);
+      return sshHost;
+    },
+    enabled: Boolean(sshHostId)
+  });
+};
+
+export const fetchSshHostUserCaPublicKey = async (sshHostId: string): Promise<string> => {
+  const { data } = await apiRequest.get<string>(
+    `/api/v1/ssh/hosts/${sshHostId}/user-ca-public-key`
+  );
+  return data;
+};

frontend/src/hooks/api/sshHost/types.ts

@@ -0,0 +1,43 @@
+export type TSshHost = {
+  id: string;
+  projectId: string;
+  hostname: string;
+  userCertTtl: string;
+  hostCertTtl: string;
+  loginMappings: {
+    loginUser: string;
+    allowedPrincipals: {
+      usernames: string[];
+    };
+  }[];
+};
+
+export type TCreateSshHostDTO = {
+  projectId: string;
+  hostname: string;
+  userCertTtl?: string;
+  hostCertTtl?: string;
+  loginMappings: {
+    loginUser: string;
+    allowedPrincipals: {
+      usernames: string[];
+    };
+  }[];
+};
+
+export type TUpdateSshHostDTO = {
+  sshHostId: string;
+  hostname?: string;
+  userCertTtl?: string;
+  hostCertTtl?: string;
+  loginMappings?: {
+    loginUser: string;
+    allowedPrincipals: {
+      usernames: string[];
+    };
+  }[];
+};
+
+export type TDeleteSshHostDTO = {
+  sshHostId: string;
+};

frontend/src/hooks/api/workspace/index.tsx

@@ -36,6 +36,7 @@ export {
   useListWorkspaceSshCas,
   useListWorkspaceSshCertificates,
   useListWorkspaceSshCertificateTemplates,
+  useListWorkspaceSshHosts,
   useNameWorkspaceSecrets,
   useSearchProjects,
   useToggleAutoCapitalization,

frontend/src/hooks/api/workspace/queries.tsx

@@ -17,6 +17,7 @@ import { TPkiCollection } from "../pkiCollections/types";
 import { EncryptedSecret } from "../secrets/types";
 import { TSshCertificate, TSshCertificateAuthority } from "../sshCa/types";
 import { TSshCertificateTemplate } from "../sshCertificateTemplates/types";
+import { TSshHost } from "../sshHost/types";
 import { userKeys } from "../users/query-keys";
 import { TWorkspaceUser } from "../users/types";
 import { ProjectSlackConfig } from "../workflowIntegrations/types";
@@ -827,6 +828,19 @@ export const useListWorkspaceSshCas = (projectId: string) => {
   });
 };
 
+export const useListWorkspaceSshHosts = (projectId: string) => {
+  return useQuery({
+    queryKey: workspaceKeys.getWorkspaceSshHosts(projectId),
+    queryFn: async () => {
+      const {
+        data: { hosts }
+      } = await apiRequest.get<{ hosts: TSshHost[] }>(`/api/v2/workspace/${projectId}/ssh-hosts`);
+      return hosts;
+    },
+    enabled: Boolean(projectId)
+  });
+};
+
 export const useListWorkspaceSshCertificateTemplates = (projectId: string) => {
   return useQuery({
     queryKey: workspaceKeys.getWorkspaceSshCertificateTemplates(projectId),

frontend/src/hooks/api/workspace/query-keys.tsx

@@ -58,6 +58,7 @@ export const workspaceKeys = {
   getWorkspaceSshCas: (projectId: string) => [{ projectId }, "workspace-ssh-cas"] as const,
   allWorkspaceSshCertificates: (projectId: string) =>
     [{ projectId }, "workspace-ssh-certificates"] as const,
+  getWorkspaceSshHosts: (projectId: string) => [{ projectId }, "workspace-ssh-hosts"] as const,
   specificWorkspaceSshCertificates: ({
     offset,
     limit,