Fix merge conflicts with auth changes

.env.example

@@ -9,6 +9,7 @@ JWT_SIGNUP_SECRET=3679e04ca949f914c03332aaaeba805a
 JWT_REFRESH_SECRET=5f2f3c8f0159068dc2bbb3a652a716ff
 JWT_AUTH_SECRET=4be6ba5602e0fa0ac6ac05c3cd4d247f
 JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
+JWT_PROVIDER_AUTH_SECRET=f32f716d70a42c5703f4656015e76201
 
 # JWT lifetime
 # Optional lifetimes for JWT tokens expressed in seconds or a string 
@@ -16,6 +17,7 @@ JWT_SERVICE_SECRET=f32f716d70a42c5703f4656015e76200
 JWT_AUTH_LIFETIME=
 JWT_REFRESH_LIFETIME=
 JWT_SIGNUP_LIFETIME=
+JWT_PROVIDER_AUTH_LIFETIME=
 
 # MongoDB
 # Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
@@ -66,3 +68,6 @@ STRIPE_PRODUCT_STARTER=
 STRIPE_PRODUCT_TEAM=
 STRIPE_PRODUCT_PRO=
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+
+CLIENT_ID_GOOGLE=
+CLIENT_SECRET_GOOGLE=

README.md

@@ -69,7 +69,9 @@ The fastest and most reliable way to get started with Infisical is signing up fo
 
 ### Deploy Infisical on premise
 
-Deployment options: [AWS EC2](https://infisical.com/docs/self-hosting/overview), [Kubernetes](https://infisical.com/docs/self-hosting/overview), and [more](https://infisical.com/docs/self-hosting/overview).
+<a href="https://infisical.com/docs/self-hosting/deployment-options/digital-ocean-marketplace"><img src=".github/images/do-k8-install-btn.png" width="200"/></a> <a href="https://infisical.com/docs/self-hosting/deployment-options/aws-ec2"><img src=".github/images/deploy-aws-button.png" width="150" width="300" /></a>
+
+View all [deployment options](https://infisical.com/docs/self-hosting/overview)
 
 ### Run Infisical locally
 

backend/package.json

@@ -20,7 +20,6 @@
     "crypto-js": "^4.1.1",
     "dotenv": "^16.0.1",
     "express": "^4.18.1",
-    "express-async-errors": "^3.1.1",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^6.14.2",
     "handlebars": "^4.7.7",
@@ -33,9 +32,13 @@
     "lodash": "^4.17.21",
     "mongoose": "^6.10.5",
     "node-cache": "^5.1.2",
+    "nanoid": "^3.3.6",
     "nodemailer": "^6.8.0",
+    "passport": "^0.6.0",
+    "passport-google-oauth20": "^2.0.0",
     "posthog-node": "^2.6.0",
     "query-string": "^7.1.3",
+    "rate-limit-mongo": "^2.3.2",
     "request-ip": "^3.3.0",
     "rimraf": "^3.0.2",
     "stripe": "^10.7.0",
@@ -88,6 +91,7 @@
     "@types/lodash": "^4.14.191",
     "@types/node": "^18.11.3",
     "@types/nodemailer": "^6.4.6",
+    "@types/passport": "^1.0.12",
     "@types/supertest": "^2.0.12",
     "@types/swagger-jsdoc": "^6.0.1",
     "@types/swagger-ui-express": "^4.1.3",

backend/src/config/index.ts

@@ -23,6 +23,8 @@ export const getJwtRefreshLifetime = async () => (await client.getSecret('JWT_RE
 export const getJwtRefreshSecret = async () => (await client.getSecret('JWT_REFRESH_SECRET')).secretValue;
 export const getJwtServiceSecret = async () => (await client.getSecret('JWT_SERVICE_SECRET')).secretValue;
 export const getJwtSignupLifetime = async () => (await client.getSecret('JWT_SIGNUP_LIFETIME')).secretValue || '15m';
+export const getJwtProviderAuthSecret = async () => (await client.getSecret('JWT_PROVIDER_AUTH_SECRET')).secretValue;
+export const getJwtProviderAuthLifetime = async () => (await client.getSecret('JWT_PROVIDER_AUTH_LIFETIME')).secretValue || '15m';
 export const getJwtSignupSecret = async () => (await client.getSecret('JWT_SIGNUP_SECRET')).secretValue;
 export const getMongoURL = async () => (await client.getSecret('MONGO_URL')).secretValue;
 export const getNodeEnv = async () => (await client.getSecret('NODE_ENV')).secretValue || 'production';
@@ -34,12 +36,14 @@ export const getClientIdVercel = async () => (await client.getSecret('CLIENT_ID_
 export const getClientIdNetlify = async () => (await client.getSecret('CLIENT_ID_NETLIFY')).secretValue;
 export const getClientIdGitHub = async () => (await client.getSecret('CLIENT_ID_GITHUB')).secretValue;
 export const getClientIdGitLab = async () => (await client.getSecret('CLIENT_ID_GITLAB')).secretValue;
+export const getClientIdGoogle = async () => (await client.getSecret('CLIENT_ID_GOOGLE')).secretValue;
 export const getClientSecretAzure = async () => (await client.getSecret('CLIENT_SECRET_AZURE')).secretValue;
 export const getClientSecretHeroku = async () => (await client.getSecret('CLIENT_SECRET_HEROKU')).secretValue;
 export const getClientSecretVercel = async () => (await client.getSecret('CLIENT_SECRET_VERCEL')).secretValue;
 export const getClientSecretNetlify = async () => (await client.getSecret('CLIENT_SECRET_NETLIFY')).secretValue;
 export const getClientSecretGitHub = async () => (await client.getSecret('CLIENT_SECRET_GITHUB')).secretValue;
 export const getClientSecretGitLab = async () => (await client.getSecret('CLIENT_SECRET_GITLAB')).secretValue;
+export const getClientSecretGoogle = async () => (await client.getSecret('CLIENT_SECRET_GOOGLE')).secretValue;
 export const getClientSlugVercel = async () => (await client.getSecret('CLIENT_SLUG_VERCEL')).secretValue;
 export const getPostHogHost = async () => (await client.getSecret('POSTHOG_HOST')).secretValue || 'https://app.posthog.com';
 export const getPostHogProjectApiKey = async () => (await client.getSecret('POSTHOG_PROJECT_API_KEY')).secretValue || 'phc_nSin8j5q2zdhpFDI1ETmFNUIuTG4DwKVyIigrY10XiE';

backend/src/controllers/v1/authController.ts

@@ -270,3 +270,7 @@ export const getNewToken = async (req: Request, res: Response) => {
     });
   }
 };
+
+export const handleAuthProviderCallback = (req: Request, res: Response) => {
+  res.redirect(`/login/provider/success?token=${encodeURIComponent(req.providerAuthToken)}`);
+}

backend/src/controllers/v1/secretsFolderController.ts

@@ -1,107 +1,218 @@
-import { Request, Response } from 'express';
-import { Secret } from '../../models';
-import Folder from '../../models/folder';
-import { BadRequestError } from '../../utils/errors';
-import { ROOT_FOLDER_PATH, getFolderPath, getParentPath, normalizePath, validateFolderName } from '../../utils/folder';
-import { ADMIN, MEMBER } from '../../variables';
-import { validateMembership } from '../../helpers/membership';
+import { Request, Response } from "express";
+import { Secret } from "../../models";
+import Folder from "../../models/folder";
+import { BadRequestError } from "../../utils/errors";
+import {
+  appendFolder,
+  deleteFolderById,
+  getAllFolderIds,
+  searchByFolderIdWithDir,
+  searchByFolderId,
+  validateFolderName,
+  generateFolderId,
+  getParentFromFolderId,
+} from "../../services/FolderService";
+import { ADMIN, MEMBER } from "../../variables";
+import { validateMembership } from "../../helpers/membership";
+import { FolderVersion } from "../../ee/models";
+import { EESecretService } from "../../ee/services";
 
 // TODO
 // verify workspace id/environment
 export const createFolder = async (req: Request, res: Response) => {
-  const { workspaceId, environment, folderName, parentFolderId } = req.body
+  const { workspaceId, environment, folderName, parentFolderId } = req.body;
   if (!validateFolderName(folderName)) {
-    throw BadRequestError({ message: "Folder name cannot contain spaces. Only underscore and dashes" })
+    throw BadRequestError({
+      message: "Folder name cannot contain spaces. Only underscore and dashes",
+    });
   }
 
-  if (parentFolderId) {
-    const parentFolder = await Folder.find({ environment: environment, workspace: workspaceId, id: parentFolderId });
-    if (!parentFolder) {
-      throw BadRequestError({ message: "The parent folder doesn't exist" })
-    }
-  }
-
-  let completePath = await getFolderPath(parentFolderId)
-  if (completePath == ROOT_FOLDER_PATH) {
-    completePath = ""
-  }
-
-  const currentFolderPath = completePath + "/" + folderName // construct new path with current folder to be created
-  const normalizedCurrentPath = normalizePath(currentFolderPath)
-  const normalizedParentPath = getParentPath(normalizedCurrentPath)
-
-  const existingFolder = await Folder.findOne({
-    name: folderName,
+  const folders = await Folder.findOne({
     workspace: workspaceId,
-    environment: environment,
-    parent: parentFolderId,
-    path: normalizedCurrentPath
+    environment,
+  }).lean();
+  // space has no folders initialized
+  if (!folders) {
+    const id = generateFolderId();
+    const folder = new Folder({
+      workspace: workspaceId,
+      environment,
+      nodes: {
+        id: "root",
+        name: "root",
+        version: 1,
+        children: [{ id, name: folderName, children: [], version: 1 }],
+      },
+    });
+    await folder.save();
+    const folderVersion = new FolderVersion({
+      workspace: workspaceId,
+      environment,
+      nodes: folder.nodes,
+    });
+    await folderVersion.save();
+    await EESecretService.takeSecretSnapshot({
+      workspaceId,
+      environment,
+    });
+    return res.json({ folder: { id, name: folderName } });
+  }
+
+  const folder = appendFolder(folders.nodes, { folderName, parentFolderId });
+  await Folder.findByIdAndUpdate(folders._id, folders);
+
+  const parentFolder = searchByFolderId(folders.nodes, parentFolderId);
+  const folderVersion = new FolderVersion({
+    workspace: workspaceId,
+    environment,
+    nodes: parentFolder,
+  });
+  await folderVersion.save();
+
+  await EESecretService.takeSecretSnapshot({
+    workspaceId,
+    environment,
+    folderId: parentFolderId,
   });
 
-  if (existingFolder) {
-    return res.json(existingFolder)
+  return res.json({ folder });
+};
+
+export const updateFolderById = async (req: Request, res: Response) => {
+  const { folderId } = req.params;
+  const { name, workspaceId, environment } = req.body;
+
+  const folders = await Folder.findOne({ workspace: workspaceId, environment });
+  if (!folders) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
-  const newFolder = new Folder({
-    name: folderName,
-    workspace: workspaceId,
-    environment: environment,
-    parent: parentFolderId,
-    path: normalizedCurrentPath,
-    parentPath: normalizedParentPath
+  // check that user is a member of the workspace
+  await validateMembership({
+    userId: req.user._id.toString(),
+    workspaceId,
+    acceptedRoles: [ADMIN, MEMBER],
   });
 
-  await newFolder.save();
+  const parentFolder = getParentFromFolderId(folders.nodes, folderId);
+  if (!parentFolder) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
+  }
+  const folder = parentFolder.children.find(({ id }) => id === folderId);
+  if (!folder) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
+  }
 
-  return res.json(newFolder)
-}
+  parentFolder.version += 1;
+  folder.name = name;
+
+  await Folder.findByIdAndUpdate(folders._id, folders);
+  const folderVersion = new FolderVersion({
+    workspace: workspaceId,
+    environment,
+    nodes: parentFolder,
+  });
+  await folderVersion.save();
+
+  await EESecretService.takeSecretSnapshot({
+    workspaceId,
+    environment,
+    folderId: parentFolder.id,
+  });
+
+  return res.json({
+    message: "Successfully updated folder",
+    folder: { name: folder.name, id: folder.id },
+  });
+};
 
 export const deleteFolder = async (req: Request, res: Response) => {
-  const { folderId } = req.params
-  const queue: any[] = [folderId];
+  const { folderId } = req.params;
+  const { workspaceId, environment } = req.body;
 
-  const folder = await Folder.findById(folderId);
-  if (!folder) {
-    throw BadRequestError({ message: "The folder doesn't exist" })
+  const folders = await Folder.findOne({ workspace: workspaceId, environment });
+  if (!folders) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
   }
 
   // check that user is a member of the workspace
   await validateMembership({
     userId: req.user._id.toString(),
-    workspaceId: folder.workspace as any,
-    acceptedRoles: [ADMIN, MEMBER]
+    workspaceId,
+    acceptedRoles: [ADMIN, MEMBER],
   });
 
-  while (queue.length > 0) {
-    const currentFolderId = queue.shift();
+  const delOp = deleteFolderById(folders.nodes, folderId);
+  if (!delOp) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
+  }
+  const { deletedNode: delFolder, parent: parentFolder } = delOp;
 
-    const childFolders = await Folder.find({ parent: currentFolderId });
-    for (const childFolder of childFolders) {
-      queue.push(childFolder._id);
-    }
+  parentFolder.version += 1;
+  const delFolderIds = getAllFolderIds(delFolder);
 
-    await Secret.deleteMany({ folder: currentFolderId });
-
-    await Folder.deleteOne({ _id: currentFolderId });
+  await Folder.findByIdAndUpdate(folders._id, folders);
+  const folderVersion = new FolderVersion({
+    workspace: workspaceId,
+    environment,
+    nodes: parentFolder,
+  });
+  await folderVersion.save();
+  if (delFolderIds.length) {
+    await Secret.deleteMany({
+      folder: { $in: delFolderIds.map(({ id }) => id) },
+      workspace: workspaceId,
+      environment,
+    });
   }
 
-  res.send()
-}
+  await EESecretService.takeSecretSnapshot({
+    workspaceId,
+    environment,
+    folderId: parentFolder.id,
+  });
+
+  res.send({ message: "successfully deleted folders", folders: delFolderIds });
+};
 
 // TODO: validate workspace
-export const getFolderById = async (req: Request, res: Response) => {
-  const { folderId } = req.params
+export const getFolders = async (req: Request, res: Response) => {
+  const { workspaceId, environment, parentFolderId } = req.query as {
+    workspaceId: string;
+    environment: string;
+    parentFolderId?: string;
+  };
 
-  const folder = await Folder.findById(folderId);
-  if (!folder) {
-    throw BadRequestError({ message: "The folder doesn't exist" })
+  const folders = await Folder.findOne({ workspace: workspaceId, environment });
+  if (!folders) {
+    res.send({ folders: [], dir: [] });
+    return;
   }
+
   // check that user is a member of the workspace
   await validateMembership({
     userId: req.user._id.toString(),
-    workspaceId: folder.workspace as any,
-    acceptedRoles: [ADMIN, MEMBER]
+    workspaceId,
+    acceptedRoles: [ADMIN, MEMBER],
   });
 
-  res.send({ folder })
-}
+  if (!parentFolderId) {
+    const rootFolders = folders.nodes.children.map(({ id, name }) => ({
+      id,
+      name,
+    }));
+    res.send({ folders: rootFolders });
+    return;
+  }
+
+  const folderBySearch = searchByFolderIdWithDir(folders.nodes, parentFolderId);
+  if (!folderBySearch) {
+    throw BadRequestError({ message: "The folder doesn't exist" });
+  }
+  const { folder, dir } = folderBySearch;
+
+  res.send({
+    folders: folder.children.map(({ id, name }) => ({ id, name })),
+    dir,
+  });
+};

backend/src/controllers/v2/authController.ts

@@ -294,6 +294,8 @@ export const verifyMfaToken = async (req: Request, res: Response) => {
 
   if (!user) throw new Error('Failed to find user');
 
+  await LoginSRPDetail.deleteOne({ userId: user.id })
+
   await checkUserDevice({
     user,
     ip: req.ip,

backend/src/controllers/v3/authController.ts

@@ -0,0 +1,260 @@
+/* eslint-disable @typescript-eslint/no-var-requires */
+import { Request, Response } from 'express';
+import jwt from 'jsonwebtoken';
+import * as Sentry from '@sentry/node';
+import * as bigintConversion from 'bigint-conversion';
+const jsrp = require('jsrp');
+import { User, LoginSRPDetail } from '../../models';
+import { issueAuthTokens, createToken, validateProviderAuthToken } from '../../helpers/auth';
+import { checkUserDevice } from '../../helpers/user';
+import { sendMail } from '../../helpers/nodemailer';
+import { TokenService } from '../../services';
+import { EELogService } from '../../ee/services';
+import { BadRequestError, InternalServerError } from '../../utils/errors';
+import {
+    TOKEN_EMAIL_MFA,
+    ACTION_LOGIN
+} from '../../variables';
+import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
+import {
+    getJwtMfaLifetime,
+    getJwtMfaSecret,
+    getHttpsEnabled,
+} from '../../config';
+import { AuthProvider } from '../../models/user';
+
+declare module 'jsonwebtoken' {
+    export interface ProviderAuthJwtPayload extends jwt.JwtPayload {
+        userId: string;
+        email: string;
+        authProvider: AuthProvider;
+        isUserCompleted: boolean,
+    }
+}
+
+/**
+ * Log in user step 1: Return [salt] and [serverPublicKey] as part of step 1 of SRP protocol
+ * @param req
+ * @param res
+ * @returns
+ */
+export const login1 = async (req: Request, res: Response) => {
+    try {
+        const {
+            email,
+            providerAuthToken,
+            clientPublicKey
+        }: {
+            email: string;
+            clientPublicKey: string,
+            providerAuthToken?: string;
+        } = req.body;
+
+        const user = await User.findOne({
+            email,
+        }).select('+salt +verifier');
+
+        if (!user) throw new Error('Failed to find user');
+
+        if (user.authProvider) {
+            await validateProviderAuthToken({
+                email,
+                user,
+                providerAuthToken,
+            })
+        }
+
+        const server = new jsrp.server();
+        server.init(
+            {
+                salt: user.salt,
+                verifier: user.verifier
+            },
+            async () => {
+                // generate server-side public key
+                const serverPublicKey = server.getPublicKey();
+                await LoginSRPDetail.findOneAndReplace({
+                    email: email
+                }, {
+                    email,
+                    userId: user.id,
+                    clientPublicKey: clientPublicKey,
+                    serverBInt: bigintConversion.bigintToBuf(server.bInt),
+                }, { upsert: true, returnNewDocument: false });
+
+                return res.status(200).send({
+                    serverPublicKey,
+                    salt: user.salt
+                });
+            }
+        );
+    } catch (err) {
+        Sentry.setUser(null);
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to start authentication process'
+        });
+    }
+};
+
+/**
+ * Log in user step 2: complete step 2 of SRP protocol and return token and their (encrypted)
+ * private key
+ * @param req
+ * @param res
+ * @returns
+ */
+export const login2 = async (req: Request, res: Response) => {
+    try {
+
+        if (!req.headers['user-agent']) throw InternalServerError({ message: 'User-Agent header is required' });
+
+        const { email, clientProof, providerAuthToken } = req.body;
+
+        const user = await User.findOne({
+            email,
+        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag');
+
+        if (!user) throw new Error('Failed to find user');
+
+        if (user.authProvider) {
+            await validateProviderAuthToken({
+                email,
+                user,
+                providerAuthToken,
+            })
+        }
+
+        const loginSRPDetail = await LoginSRPDetail.findOneAndDelete({ email: email })
+
+        if (!loginSRPDetail) {
+            return BadRequestError(Error("Failed to find login details for SRP"))
+        }
+
+        const server = new jsrp.server();
+        server.init(
+            {
+                salt: user.salt,
+                verifier: user.verifier,
+                b: loginSRPDetail.serverBInt
+            },
+            async () => {
+                server.setClientPublicKey(loginSRPDetail.clientPublicKey);
+
+                // compare server and client shared keys
+                if (server.checkClientProof(clientProof)) {
+
+                    if (user.isMfaEnabled) {
+                        // case: user has MFA enabled
+
+                        // generate temporary MFA token
+                        const token = createToken({
+                            payload: {
+                                userId: user._id.toString()
+                            },
+                            expiresIn: await getJwtMfaLifetime(),
+                            secret: await getJwtMfaSecret()
+                        });
+
+                        const code = await TokenService.createToken({
+                            type: TOKEN_EMAIL_MFA,
+                            email
+                        });
+
+                        // send MFA code [code] to [email]
+                        await sendMail({
+                            template: 'emailMfa.handlebars',
+                            subjectLine: 'Infisical MFA code',
+                            recipients: [user.email],
+                            substitutions: {
+                                code
+                            }
+                        });
+
+                        return res.status(200).send({
+                            mfaEnabled: true,
+                            token
+                        });
+                    }
+
+                    await checkUserDevice({
+                        user,
+                        ip: req.ip,
+                        userAgent: req.headers['user-agent'] ?? ''
+                    });
+
+                    // issue tokens
+                    const tokens = await issueAuthTokens({ userId: user._id.toString() });
+
+                    // store (refresh) token in httpOnly cookie
+                    res.cookie('jid', tokens.refreshToken, {
+                        httpOnly: true,
+                        path: '/',
+                        sameSite: 'strict',
+                        secure: await getHttpsEnabled()
+                    });
+
+                    // case: user does not have MFA enablgged
+                    // return (access) token in response
+
+                    interface ResponseData {
+                        mfaEnabled: boolean;
+                        encryptionVersion: any;
+                        protectedKey?: string;
+                        protectedKeyIV?: string;
+                        protectedKeyTag?: string;
+                        token: string;
+                        publicKey?: string;
+                        encryptedPrivateKey?: string;
+                        iv?: string;
+                        tag?: string;
+                    }
+
+                    const response: ResponseData = {
+                        mfaEnabled: false,
+                        encryptionVersion: user.encryptionVersion,
+                        token: tokens.token,
+                        publicKey: user.publicKey,
+                        encryptedPrivateKey: user.encryptedPrivateKey,
+                        iv: user.iv,
+                        tag: user.tag
+                    }
+
+                    if (
+                        user?.protectedKey &&
+                        user?.protectedKeyIV &&
+                        user?.protectedKeyTag
+                    ) {
+                        response.protectedKey = user.protectedKey;
+                        response.protectedKeyIV = user.protectedKeyIV
+                        response.protectedKeyTag = user.protectedKeyTag;
+                    }
+
+                    const loginAction = await EELogService.createAction({
+                        name: ACTION_LOGIN,
+                        userId: user._id
+                    });
+
+                    loginAction && await EELogService.createLog({
+                        userId: user._id,
+                        actions: [loginAction],
+                        channel: getChannelFromUserAgent(req.headers['user-agent']),
+                        ipAddress: req.ip
+                    });
+
+                    return res.status(200).send(response);
+                }
+
+                return res.status(400).send({
+                    message: 'Failed to authenticate. Try again?'
+                });
+            }
+        );
+    } catch (err) {
+        Sentry.setUser(null);
+        Sentry.captureException(err);
+        return res.status(400).send({
+            message: 'Failed to authenticate. Try again?'
+        });
+    }
+};

backend/src/controllers/v3/index.ts

@@ -1,7 +1,11 @@
 import * as secretsController from './secretsController';
 import * as workspacesController from './workspacesController';
+import * as authController from './authController';
+import * as signupController from './signupController';
 
 export {
+    authController,
     secretsController,
-    workspacesController
-}
+    signupController,
+    workspacesController,
+}

backend/src/controllers/v3/signupController.ts

@@ -0,0 +1,192 @@
+import jwt from 'jsonwebtoken';
+import { Request, Response } from 'express';
+import * as Sentry from '@sentry/node';
+import { User, MembershipOrg } from '../../models';
+import { completeAccount } from '../../helpers/user';
+import {
+	initializeDefaultOrg
+} from '../../helpers/signup';
+import { issueAuthTokens, validateProviderAuthToken } from '../../helpers/auth';
+import { INVITED, ACCEPTED } from '../../variables';
+import { standardRequest } from '../../config/request';
+import { getLoopsApiKey, getHttpsEnabled, getJwtSignupSecret } from '../../config';
+import { BadRequestError } from '../../utils/errors';
+import { TelemetryService } from '../../services';
+
+/**
+ * Complete setting up user by adding their personal and auth information as part of the
+ * signup flow
+ * @param req
+ * @param res
+ * @returns
+ */
+export const completeAccountSignup = async (req: Request, res: Response) => {
+	let user, token, refreshToken;
+	try {
+		const {
+			email,
+			firstName,
+			lastName,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
+			publicKey,
+			encryptedPrivateKey,
+			encryptedPrivateKeyIV,
+			encryptedPrivateKeyTag,
+			salt,
+			verifier,
+			organizationName,
+			providerAuthToken,
+			attributionSource,
+		}: {
+			email: string;
+			firstName: string;
+			lastName: string;
+			protectedKey: string;
+			protectedKeyIV: string;
+			protectedKeyTag: string;
+			publicKey: string;
+			encryptedPrivateKey: string;
+			encryptedPrivateKeyIV: string;
+			encryptedPrivateKeyTag: string;
+			salt: string;
+			verifier: string;
+			organizationName: string;
+			providerAuthToken?: string;
+			attributionSource?: string;
+		} = req.body;
+
+		user = await User.findOne({ email });
+
+		if (!user || (user && user?.publicKey)) {
+			// case 1: user doesn't exist.
+			// case 2: user has already completed account
+			return res.status(403).send({
+				error: 'Failed to complete account for complete user'
+			});
+		}
+
+		if (providerAuthToken) {
+			await validateProviderAuthToken({
+				email,
+				providerAuthToken,
+				user,
+			});
+		} else {
+			const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>req.headers['authorization']?.split(' ', 2) ?? [null, null]
+			if (AUTH_TOKEN_TYPE === null) {
+				throw BadRequestError({ message: `Missing Authorization Header in the request header.` });
+			}
+			if (AUTH_TOKEN_TYPE.toLowerCase() !== 'bearer') {
+				throw BadRequestError({ message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.` })
+			}
+			if (AUTH_TOKEN_VALUE === null) {
+				throw BadRequestError({
+					message: 'Missing Authorization Body in the request header',
+				})
+			}
+
+			const decodedToken = <jwt.UserIDJwtPayload>(
+				jwt.verify(AUTH_TOKEN_VALUE, await getJwtSignupSecret())
+			);
+
+			if (decodedToken.userId !== user.id) {
+				throw BadRequestError();
+			}
+		}
+
+		// complete setting up user's account
+		user = await completeAccount({
+			userId: user._id.toString(),
+			firstName,
+			lastName,
+			encryptionVersion: 2,
+			protectedKey,
+			protectedKeyIV,
+			protectedKeyTag,
+			publicKey,
+			encryptedPrivateKey,
+			encryptedPrivateKeyIV,
+			encryptedPrivateKeyTag,
+			salt,
+			verifier
+		});
+
+		if (!user)
+			throw new Error('Failed to complete account for non-existent user'); // ensure user is non-null
+
+		// initialize default organization and workspace
+		await initializeDefaultOrg({
+			organizationName,
+			user
+		});
+
+		// update organization membership statuses that are
+		// invited to completed with user attached
+		await MembershipOrg.updateMany(
+			{
+				inviteEmail: email,
+				status: INVITED
+			},
+			{
+				user,
+				status: ACCEPTED
+			}
+		);
+
+		// issue tokens
+		const tokens = await issueAuthTokens({
+			userId: user._id.toString()
+		});
+
+		token = tokens.token;
+
+		// sending a welcome email to new users
+		if (await getLoopsApiKey()) {
+			await standardRequest.post("https://app.loops.so/api/v1/events/send", {
+				"email": email,
+				"eventName": "Sign Up",
+				"firstName": firstName,
+				"lastName": lastName
+			}, {
+				headers: {
+					"Accept": "application/json",
+					"Authorization": "Bearer " + (await getLoopsApiKey())
+				},
+			});
+		}
+
+		// store (refresh) token in httpOnly cookie
+		res.cookie('jid', tokens.refreshToken, {
+			httpOnly: true,
+			path: '/',
+			sameSite: 'strict',
+			secure: await getHttpsEnabled()
+		});
+
+		const postHogClient = await TelemetryService.getPostHogClient();
+		if (postHogClient) {
+			postHogClient.capture({
+				event: 'User Signed Up',
+				distinctId: email,
+				properties: {
+					email,
+					attributionSource
+				}
+			});
+		}
+	} catch (err) {
+		Sentry.setUser(null);
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to complete account setup'
+		});
+	}
+
+	return res.status(200).send({
+		message: 'Successfully set up account',
+		user,
+		token
+	});
+};

backend/src/ee/controllers/v1/secretController.ts

@@ -1,16 +1,16 @@
-import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
-import { Secret } from '../../../models';
-import { SecretVersion } from '../../models';
-import { EESecretService } from '../../services';
+import { Request, Response } from "express";
+import * as Sentry from "@sentry/node";
+import { Secret } from "../../../models";
+import { SecretVersion } from "../../models";
+import { EESecretService } from "../../services";
 
 /**
  * Return secret versions for secret with id [secretId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
- export const getSecretVersions = async (req: Request, res: Response) => {
-	/* 
+export const getSecretVersions = async (req: Request, res: Response) => {
+  /* 
     #swagger.summary = 'Return secret versions'
     #swagger.description = 'Return secret versions'
     
@@ -55,41 +55,43 @@ import { EESecretService } from '../../services';
         }
     }   
     */
-	let secretVersions;
-	try {
-		const { secretId } = req.params;
+  let secretVersions;
+  try {
+    const { secretId, workspaceId, environment, folderId } = req.params;
 
-		const offset: number = parseInt(req.query.offset as string);
-		const limit: number = parseInt(req.query.limit as string);
-		
-		secretVersions = await SecretVersion.find({
-			secret: secretId
-		})
-		.sort({ createdAt: -1 })
-		.skip(offset)
-		.limit(limit);
+    const offset: number = parseInt(req.query.offset as string);
+    const limit: number = parseInt(req.query.limit as string);
 
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get secret versions'
-		});
-	}
-	
-	return res.status(200).send({
-		secretVersions
-	});
-}
+    secretVersions = await SecretVersion.find({
+      secret: secretId,
+      workspace: workspaceId,
+      environment,
+      folder: folderId,
+    })
+      .sort({ createdAt: -1 })
+      .skip(offset)
+      .limit(limit);
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to get secret versions",
+    });
+  }
+
+  return res.status(200).send({
+    secretVersions,
+  });
+};
 
 /**
  * Roll back secret with id [secretId] to version [version]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const rollbackSecretVersion = async (req: Request, res: Response) => {
-	/* 
+  /* 
     #swagger.summary = 'Roll back secret to a version.'
     #swagger.description = 'Roll back secret to a version.'
     
@@ -137,97 +139,101 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
         }
     }   
     */
-	let secret;
-	try {
-		const { secretId } = req.params;
-		const { version } = req.body;
-		
-		// validate secret version
-		const oldSecretVersion = await SecretVersion.findOne({
-			secret: secretId,
-			version
-		}).select('+secretBlindIndex')
-		
-		if (!oldSecretVersion) throw new Error('Failed to find secret version');
-		
-		const {
-			workspace,
-			type,
-			user,
-			environment,
-			secretBlindIndex,
-			secretKeyCiphertext,
-			secretKeyIV,
-			secretKeyTag,
-			secretValueCiphertext,
-			secretValueIV,
-			secretValueTag,
-			algorithm,
-			keyEncoding
-		} = oldSecretVersion;
-		
-		// update secret
-		secret = await Secret.findByIdAndUpdate(
-			secretId,
-			{
-				$inc: {
-					version: 1
-				},
-				workspace,
-				type,
-				user,
-				environment,
-				...(secretBlindIndex ? { secretBlindIndex } : {}),
-				secretKeyCiphertext,
-				secretKeyIV,
-				secretKeyTag,
-				secretValueCiphertext,
-				secretValueIV,
-				secretValueTag,
-				algorithm,
-				keyEncoding
-			},
-			{
-				new: true
-			}
-		);
-		
-		if (!secret) throw new Error('Failed to find and update secret');
+  let secret;
+  try {
+    const { secretId } = req.params;
+    const { version } = req.body;
 
-		// add new secret version
-		await new SecretVersion({
-			secret: secretId,
-			version: secret.version,
-			workspace,
-			type,
-			user,
-			environment,
-			isDeleted: false,
-			...(secretBlindIndex ? { secretBlindIndex } : {}),
-			secretKeyCiphertext,
-			secretKeyIV,
-			secretKeyTag,
-			secretValueCiphertext,
-			secretValueIV,
-			secretValueTag,
-			algorithm,
-			keyEncoding
-		}).save();
-		
-		// take secret snapshot
-		await EESecretService.takeSecretSnapshot({
-			workspaceId: secret.workspace
-		});
-		
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to roll back secret version'
-		});
-	}
-	
-	return res.status(200).send({
-		secret
-	});
-}
+    // validate secret version
+    const oldSecretVersion = await SecretVersion.findOne({
+      secret: secretId,
+      version,
+    }).select("+secretBlindIndex");
+
+    if (!oldSecretVersion) throw new Error("Failed to find secret version");
+
+    const {
+      workspace,
+      type,
+      user,
+      environment,
+      secretBlindIndex,
+      secretKeyCiphertext,
+      secretKeyIV,
+      secretKeyTag,
+      secretValueCiphertext,
+      secretValueIV,
+      secretValueTag,
+      folder,
+      algorithm,
+      keyEncoding,
+    } = oldSecretVersion;
+
+    // update secret
+    secret = await Secret.findByIdAndUpdate(
+      secretId,
+      {
+        $inc: {
+          version: 1,
+        },
+        workspace,
+        type,
+        user,
+        environment,
+        ...(secretBlindIndex ? { secretBlindIndex } : {}),
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        folderId: folder,
+        algorithm,
+        keyEncoding,
+      },
+      {
+        new: true,
+      }
+    );
+
+    if (!secret) throw new Error("Failed to find and update secret");
+
+    // add new secret version
+    await new SecretVersion({
+      secret: secretId,
+      version: secret.version,
+      workspace,
+      type,
+      user,
+      environment,
+      isDeleted: false,
+      ...(secretBlindIndex ? { secretBlindIndex } : {}),
+      secretKeyCiphertext,
+      secretKeyIV,
+      secretKeyTag,
+      secretValueCiphertext,
+      secretValueIV,
+      secretValueTag,
+      folder,
+      algorithm,
+      keyEncoding,
+    }).save();
+
+    // take secret snapshot
+    await EESecretService.takeSecretSnapshot({
+      workspaceId: secret.workspace,
+      environment,
+      folderId: folder,
+    });
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to roll back secret version",
+    });
+  }
+
+  return res.status(200).send({
+    secret,
+  });
+};

backend/src/ee/controllers/v1/secretSnapshotController.ts

@@ -1,33 +1,48 @@
-import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
-import { SecretSnapshot } from '../../models';
+import { Request, Response } from "express";
+import * as Sentry from "@sentry/node";
+import {
+  ISecretVersion,
+  SecretSnapshot,
+  TFolderRootVersionSchema,
+} from "../../models";
 
 /**
  * Return secret snapshot with id [secretSnapshotId]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getSecretSnapshot = async (req: Request, res: Response) => {
-    let secretSnapshot;
-    try {
-        const { secretSnapshotId } = req.params;
+  let secretSnapshot;
+  try {
+    const { secretSnapshotId } = req.params;
 
-        secretSnapshot = await SecretSnapshot
-            .findById(secretSnapshotId)
-            .populate('secretVersions');
-        
-        if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
+    secretSnapshot = await SecretSnapshot.findById(secretSnapshotId)
+      .lean()
+      .populate<{ secretVersions: ISecretVersion[] }>("secretVersions")
+      .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
 
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get secret snapshot'
-		});
-    }
-    
-    return res.status(200).send({
-        secretSnapshot
+    if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to get secret snapshot",
     });
-}
+  }
+  const folderId = secretSnapshot.folderId;
+  // to show only the folder required secrets
+  secretSnapshot.secretVersions = secretSnapshot.secretVersions.filter(
+    ({ folder }) => folder === folderId
+  );
+
+  secretSnapshot.folderVersion =
+    secretSnapshot?.folderVersion?.nodes?.children?.map(({ id, name }) => ({
+      id,
+      name,
+    })) as any;
+
+  return res.status(200).send({
+    secretSnapshot,
+  });
+};

backend/src/ee/controllers/v1/workspaceController.ts

@@ -1,25 +1,30 @@
-import { Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
-import { Types } from 'mongoose';
+import { Request, Response } from "express";
+import * as Sentry from "@sentry/node";
+import { PipelineStage, Types } from "mongoose";
+import { Secret } from "../../../models";
 import {
-	Secret
-} from '../../../models';
-import { 
-	SecretSnapshot,
-	Log,
-	SecretVersion,
-	ISecretVersion
-} from '../../models';
-import { EESecretService } from '../../services';
-import { getLatestSecretVersionIds } from '../../helpers/secretVersion';
+  SecretSnapshot,
+  Log,
+  SecretVersion,
+  ISecretVersion,
+  FolderVersion,
+  TFolderRootVersionSchema,
+} from "../../models";
+import { EESecretService } from "../../services";
+import { getLatestSecretVersionIds } from "../../helpers/secretVersion";
+import Folder, { TFolderSchema } from "../../../models/folder";
+import { searchByFolderId } from "../../../services/FolderService";
 
 /**
  * Return secret snapshots for workspace with id [workspaceId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
- export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) => {
-	/* 
+export const getWorkspaceSecretSnapshots = async (
+  req: Request,
+  res: Response
+) => {
+  /* 
     #swagger.summary = 'Return project secret snapshot ids'
     #swagger.description = 'Return project secret snapshots ids'
     
@@ -64,66 +69,78 @@ import { getLatestSecretVersionIds } from '../../helpers/secretVersion';
         }
     }
     */
-	let secretSnapshots;
-	try {
-		const { workspaceId } = req.params;
+  let secretSnapshots;
+  try {
+    const { workspaceId } = req.params;
+    const { environment, folderId } = req.query;
 
-		const offset: number = parseInt(req.query.offset as string);
-		const limit: number = parseInt(req.query.limit as string);
-		
-		secretSnapshots = await SecretSnapshot.find({
-			workspace: workspaceId
-		})
-		.sort({ createdAt: -1 })
-		.skip(offset)
-		.limit(limit);
+    const offset: number = parseInt(req.query.offset as string);
+    const limit: number = parseInt(req.query.limit as string);
 
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get secret snapshots'
-		});
-	}
-	
-	return res.status(200).send({
-		secretSnapshots
-	});
-}
+    secretSnapshots = await SecretSnapshot.find({
+      workspace: workspaceId,
+      environment,
+      folderId: folderId || "root",
+    })
+      .sort({ createdAt: -1 })
+      .skip(offset)
+      .limit(limit);
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to get secret snapshots",
+    });
+  }
+
+  return res.status(200).send({
+    secretSnapshots,
+  });
+};
 
 /**
  * Return count of secret snapshots for workspace with id [workspaceId]
- * @param req 
- * @param res 
+ * @param req
+ * @param res
  */
-export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Response) => {
-	let count;
-	try {
-		const { workspaceId } = req.params;
-		count = await SecretSnapshot.countDocuments({
-			workspace: workspaceId
-		});
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to count number of secret snapshots'
-		});
-	}
-	
-	return res.status(200).send({
-		count
-	});
-}
+export const getWorkspaceSecretSnapshotsCount = async (
+  req: Request,
+  res: Response
+) => {
+  let count;
+  try {
+    const { workspaceId } = req.params;
+    const { environment, folderId } = req.query;
+
+    count = await SecretSnapshot.countDocuments({
+      workspace: workspaceId,
+      environment,
+      folderId: folderId || "root",
+    });
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to count number of secret snapshots",
+    });
+  }
+
+  return res.status(200).send({
+    count,
+  });
+};
 
 /**
  * Rollback secret snapshot with id [secretSnapshotId] to version [version]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
-export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Response) => {
-	/* 
+export const rollbackWorkspaceSecretSnapshot = async (
+  req: Request,
+  res: Response
+) => {
+  /* 
     #swagger.summary = 'Roll back project secrets to those captured in a secret snapshot version.'
     #swagger.description = 'Roll back project secrets to those captured in a secret snapshot version.'
     
@@ -173,168 +190,338 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
         }
     }   
     */
-	
-	let secrets;
-    try {	
-        const { workspaceId } = req.params;
-        const { version } = req.body;
-        
-		// validate secret snapshot
-		const secretSnapshot = await SecretSnapshot.findOne({
-			workspace: workspaceId,
-			version
-		}).populate<{ secretVersions: ISecretVersion[]}>({
-			path: 'secretVersions',
-			select: '+secretBlindIndex'
-		});
-        
-        if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
 
-		// TODO: fix any
-		const oldSecretVersionsObj: any = secretSnapshot.secretVersions
-			.reduce((accumulator, s) => ({ 
-				...accumulator, 
-				[`${s.secret.toString()}`]: s 
-			}), {});	
-		
-		const latestSecretVersionIds = await getLatestSecretVersionIds({
-			secretIds: secretSnapshot.secretVersions.map((sv) => sv.secret)
-		});
-		
-		// TODO: fix any
-		const latestSecretVersions: any = (await SecretVersion.find({
-			_id: {
-				$in: latestSecretVersionIds.map((s) => s.versionId)
-			}
-		}, 'secret version'))
-		.reduce((accumulator, s) => ({ 
-			...accumulator, 
-			[`${s.secret.toString()}`]: s 
-		}), {});
-		
-		// delete existing secrets
-		await Secret.deleteMany({
-			workspace: workspaceId
-		});
+  let secrets;
+  try {
+    const { workspaceId } = req.params;
+    const { version, environment, folderId = "root" } = req.body;
 
-		// add secrets
-        secrets = await Secret.insertMany(
-			secretSnapshot.secretVersions.map((sv) => {
-				const secretId = sv.secret;
-				const {
-					workspace,
-					type,
-					user,
-					environment,
-					secretBlindIndex,
-					secretKeyCiphertext,
-					secretKeyIV,
-					secretKeyTag,
-					secretKeyHash,
-					secretValueCiphertext,
-					secretValueIV,
-					secretValueTag,
-					secretValueHash,
-					createdAt
-				} = oldSecretVersionsObj[secretId.toString()];
-				
-				return ({
-					_id: secretId,
-					version: latestSecretVersions[secretId.toString()].version + 1,
-					workspace,
-					type,
-					user,
-					environment,
-					secretBlindIndex: secretBlindIndex ?? undefined,
-					secretKeyCiphertext,
-					secretKeyIV,
-					secretKeyTag,
-					secretKeyHash,
-					secretValueCiphertext,
-					secretValueIV,
-					secretValueTag,
-					secretValueHash,
-					secretCommentCiphertext: '',
-					secretCommentIV: '',
-					secretCommentTag: '',
-					createdAt
-				});
-			})
-		);
-		
-		// add secret versions
-		const secretV = await SecretVersion.insertMany(
-			secrets.map(({
-				_id,
-				version,
-				workspace,
-				type,
-				user,
-				environment,
-				secretBlindIndex,
-				secretKeyCiphertext,
-				secretKeyIV,
-				secretKeyTag,
-				secretKeyHash,
-				secretValueCiphertext,
-				secretValueIV,
-				secretValueTag,
-				secretValueHash
-			}) => ({
-				_id: new Types.ObjectId(),
-				secret: _id,
-				version,
-				workspace,
-				type,
-				user,
-				environment,
-				isDeleted: false,
-				secretBlindIndex: secretBlindIndex ?? undefined,
-				secretKeyCiphertext,
-				secretKeyIV,
-				secretKeyTag,
-				secretKeyHash,
-				secretValueCiphertext,
-				secretValueIV,
-				secretValueTag,
-				secretValueHash
-			}))
-		);
-		
-		// update secret versions of restored secrets as not deleted
-		await SecretVersion.updateMany({
-			secret: {
-				$in: secretSnapshot.secretVersions.map((sv) => sv.secret)
-			}
-		}, {
-			isDeleted: false
-		});
-		
-        // take secret snapshot
-		await EESecretService.takeSecretSnapshot({
-			workspaceId: new Types.ObjectId(workspaceId)
-		});
-    } catch (err) {
-        Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to roll back secret snapshot'
-		}); 
+    // validate secret snapshot
+    const secretSnapshot = await SecretSnapshot.findOne({
+      workspace: workspaceId,
+      version,
+      environment,
+      folderId: folderId,
+    })
+      .populate<{ secretVersions: ISecretVersion[] }>({
+        path: "secretVersions",
+        select: "+secretBlindIndex",
+      })
+      .populate<{ folderVersion: TFolderRootVersionSchema }>("folderVersion");
+
+    if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
+
+    const snapshotFolderTree = secretSnapshot.folderVersion;
+    const latestFolderTree = await Folder.findOne({
+      workspace: workspaceId,
+      environment,
+    });
+
+    const latestFolderVersion = await FolderVersion.findOne({
+      environment,
+      workspace: workspaceId,
+      "nodes.id": folderId,
+    }).sort({ "nodes.version": -1 });
+
+    const oldSecretVersionsObj: Record<string, ISecretVersion> = {};
+    const secretIds: Types.ObjectId[] = [];
+    const folderIds: string[] = [folderId];
+
+    secretSnapshot.secretVersions.forEach((snapSecVer) => {
+      oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
+      secretIds.push(snapSecVer.secret);
+    });
+
+    // the parent node from current latest one
+    // this will be modified according to the snapshot and latest snapshots
+    const newFolderTree =
+      latestFolderTree && searchByFolderId(latestFolderTree.nodes, folderId);
+
+    if (newFolderTree) {
+      newFolderTree.children = snapshotFolderTree?.nodes?.children || [];
+      const queue = [newFolderTree];
+      // a bfs algorithm in which we take the latest snapshots of all the folders in a level
+      while (queue.length) {
+        const groupByFolderId: Record<string, TFolderSchema> = {};
+        // the original queue is popped out completely to get what ever in a level
+        // subqueue is filled with all the children thus next level folders
+        // subQueue will then be transfered to the oriinal queue
+        const subQueue: TFolderSchema[] = [];
+        // get everything inside a level
+        while (queue.length) {
+          const folder = queue.pop() as TFolderSchema;
+          folder.children.forEach((el) => {
+            folderIds.push(el.id); // push ids and data into queu
+            subQueue.push(el);
+            // to modify the original tree very fast we keep a reference object
+            // key with folder id and pointing to the various nodes
+            groupByFolderId[el.id] = el;
+          });
+        }
+        // get latest snapshots of all the folder
+        const matchWsFoldersPipeline = {
+          $match: {
+            workspace: new Types.ObjectId(workspaceId),
+            environment,
+            folderId: {
+              $in: Object.keys(groupByFolderId),
+            },
+          },
+        };
+        const sortByFolderIdAndVersion: PipelineStage = {
+          $sort: { folderId: 1, version: -1 },
+        };
+        const pickLatestVersionOfEachFolder = {
+          $group: {
+            _id: "$folderId",
+            latestVersion: { $first: "$version" },
+            doc: {
+              $first: "$$ROOT",
+            },
+          },
+        };
+        const populateSecVersion = {
+          $lookup: {
+            from: SecretVersion.collection.name,
+            localField: "doc.secretVersions",
+            foreignField: "_id",
+            as: "doc.secretVersions",
+          },
+        };
+        const populateFolderVersion = {
+          $lookup: {
+            from: FolderVersion.collection.name,
+            localField: "doc.folderVersion",
+            foreignField: "_id",
+            as: "doc.folderVersion",
+          },
+        };
+        const unwindFolderVerField = {
+          $unwind: {
+            path: "$doc.folderVersion",
+            preserveNullAndEmptyArrays: true,
+          },
+        };
+        const latestSnapshotsByFolders: Array<{ doc: typeof secretSnapshot }> =
+          await SecretSnapshot.aggregate([
+            matchWsFoldersPipeline,
+            sortByFolderIdAndVersion,
+            pickLatestVersionOfEachFolder,
+            populateSecVersion,
+            populateFolderVersion,
+            unwindFolderVerField,
+          ]);
+
+        // recursive snapshotting each level
+        latestSnapshotsByFolders.forEach((snap) => {
+          // mutate the folder tree to update the nodes to the latest version tree
+          // we are reconstructing the folder tree by latest snapshots here
+          if (groupByFolderId[snap.doc.folderId]) {
+            groupByFolderId[snap.doc.folderId].children =
+              snap.doc?.folderVersion?.nodes?.children || [];
+          }
+
+          // push all children of next level snapshots
+          if (snap.doc.folderVersion?.nodes?.children) {
+            queue.push(...snap.doc.folderVersion.nodes.children);
+          }
+
+          snap.doc.secretVersions.forEach((snapSecVer) => {
+            // record all the secrets
+            oldSecretVersionsObj[snapSecVer.secret.toString()] = snapSecVer;
+            secretIds.push(snapSecVer.secret);
+          });
+        });
+
+        queue.push(...subQueue);
+      }
     }
-    
-	return res.status(200).send({
-		secrets
-	});
-}
+
+    // TODO: fix any
+    const latestSecretVersionIds = await getLatestSecretVersionIds({
+      secretIds,
+    });
+
+    // TODO: fix any
+    const latestSecretVersions: any = (
+      await SecretVersion.find(
+        {
+          _id: {
+            $in: latestSecretVersionIds.map((s) => s.versionId),
+          },
+        },
+        "secret version"
+      )
+    ).reduce(
+      (accumulator, s) => ({
+        ...accumulator,
+        [`${s.secret.toString()}`]: s,
+      }),
+      {}
+    );
+
+    const secDelQuery: Record<string, unknown> = {
+      workspace: workspaceId,
+      environment,
+      // undefined means root thus collect all secrets
+    };
+    if (folderId !== "root" && folderIds.length)
+      secDelQuery.folder = { $in: folderIds };
+
+    // delete existing secrets
+    await Secret.deleteMany(secDelQuery);
+    await Folder.deleteOne({
+      workspace: workspaceId,
+      environment,
+    });
+
+    // add secrets
+    secrets = await Secret.insertMany(
+      Object.keys(oldSecretVersionsObj).map((sv) => {
+        const {
+          secret: secretId,
+          workspace,
+          type,
+          user,
+          environment,
+          secretBlindIndex,
+          secretKeyCiphertext,
+          secretKeyIV,
+          secretKeyTag,
+          secretValueCiphertext,
+          secretValueIV,
+          secretValueTag,
+          createdAt,
+          algorithm,
+          keyEncoding,
+          folder: secFolderId,
+        } = oldSecretVersionsObj[sv];
+
+        return {
+          _id: secretId,
+          version: latestSecretVersions[secretId.toString()].version + 1,
+          workspace,
+          type,
+          user,
+          environment,
+          secretBlindIndex: secretBlindIndex ?? undefined,
+          secretKeyCiphertext,
+          secretKeyIV,
+          secretKeyTag,
+          secretValueCiphertext,
+          secretValueIV,
+          secretValueTag,
+          secretCommentCiphertext: "",
+          secretCommentIV: "",
+          secretCommentTag: "",
+          createdAt,
+          algorithm,
+          keyEncoding,
+          folder: secFolderId,
+        };
+      })
+    );
+
+    // add secret versions
+    const secretV = await SecretVersion.insertMany(
+      secrets.map(
+        ({
+          _id,
+          version,
+          workspace,
+          type,
+          user,
+          environment,
+          secretBlindIndex,
+          secretKeyCiphertext,
+          secretKeyIV,
+          secretKeyTag,
+          secretValueCiphertext,
+          secretValueIV,
+          secretValueTag,
+          algorithm,
+          keyEncoding,
+          folder: secFolderId,
+        }) => ({
+          _id: new Types.ObjectId(),
+          secret: _id,
+          version,
+          workspace,
+          type,
+          user,
+          environment,
+          isDeleted: false,
+          secretBlindIndex: secretBlindIndex ?? undefined,
+          secretKeyCiphertext,
+          secretKeyIV,
+          secretKeyTag,
+          secretValueCiphertext,
+          secretValueIV,
+          secretValueTag,
+          algorithm,
+          keyEncoding,
+          folder: secFolderId,
+        })
+      )
+    );
+
+    if (newFolderTree && latestFolderTree) {
+      // save the updated folder tree to the present one
+      newFolderTree.version = (latestFolderVersion?.nodes?.version || 0) + 1;
+      latestFolderTree._id = new Types.ObjectId();
+      latestFolderTree.isNew = true;
+      await latestFolderTree.save();
+
+      // create new folder version
+      const newFolderVersion = new FolderVersion({
+        workspace: workspaceId,
+        environment,
+        nodes: newFolderTree,
+      });
+      await newFolderVersion.save();
+    }
+
+    // update secret versions of restored secrets as not deleted
+    await SecretVersion.updateMany(
+      {
+        secret: {
+          $in: Object.keys(oldSecretVersionsObj).map(
+            (sv) => oldSecretVersionsObj[sv].secret
+          ),
+        },
+      },
+      {
+        isDeleted: false,
+      }
+    );
+
+    // take secret snapshot
+    await EESecretService.takeSecretSnapshot({
+      workspaceId: new Types.ObjectId(workspaceId),
+      environment,
+      folderId,
+    });
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to roll back secret snapshot",
+    });
+  }
+
+  return res.status(200).send({
+    secrets,
+  });
+};
 
 /**
  * Return (audit) logs for workspace with id [workspaceId]
- * @param req 
- * @param res 
- * @returns 
+ * @param req
+ * @param res
+ * @returns
  */
 export const getWorkspaceLogs = async (req: Request, res: Response) => {
-	/* 
+  /* 
     #swagger.summary = 'Return project (audit) logs'
     #swagger.description = 'Return project (audit) logs'
     
@@ -400,43 +587,41 @@ export const getWorkspaceLogs = async (req: Request, res: Response) => {
         }
     }   
     */
-	let logs
-	try {
-		const { workspaceId } = req.params;
+  let logs;
+  try {
+    const { workspaceId } = req.params;
 
-		const offset: number = parseInt(req.query.offset as string);
-		const limit: number = parseInt(req.query.limit as string);
-		const sortBy: string = req.query.sortBy as string;
-		const userId: string = req.query.userId as string;
-		const actionNames: string = req.query.actionNames as string;
-		
-		logs = await Log.find({
-			workspace: workspaceId,
-			...( userId ? { user: userId } : {}),
-			...( 
-				actionNames 
-				? { 
-					actionNames: {
-						$in: actionNames.split(',')
-					}
-				} : {}
-			)
-		})
-		.sort({ createdAt: sortBy === 'recent' ? -1 : 1 })
-		.skip(offset)
-		.limit(limit)
-		.populate('actions')
-		.populate('user serviceAccount serviceTokenData');
+    const offset: number = parseInt(req.query.offset as string);
+    const limit: number = parseInt(req.query.limit as string);
+    const sortBy: string = req.query.sortBy as string;
+    const userId: string = req.query.userId as string;
+    const actionNames: string = req.query.actionNames as string;
 
-	} catch (err) {
-		Sentry.setUser({ email: req.user.email });
-		Sentry.captureException(err);
-		return res.status(400).send({
-			message: 'Failed to get workspace logs'
-		});
-	}
-	
-	return res.status(200).send({
-		logs
-	});
-}
+    logs = await Log.find({
+      workspace: workspaceId,
+      ...(userId ? { user: userId } : {}),
+      ...(actionNames
+        ? {
+            actionNames: {
+              $in: actionNames.split(","),
+            },
+          }
+        : {}),
+    })
+      .sort({ createdAt: sortBy === "recent" ? -1 : 1 })
+      .skip(offset)
+      .limit(limit)
+      .populate("actions")
+      .populate("user serviceAccount serviceTokenData");
+  } catch (err) {
+    Sentry.setUser({ email: req.user.email });
+    Sentry.captureException(err);
+    return res.status(400).send({
+      message: "Failed to get workspace logs",
+    });
+  }
+
+  return res.status(200).send({
+    logs,
+  });
+};

backend/src/ee/helpers/secret.ts

@@ -1,6 +1,11 @@
 import { Types } from "mongoose";
 import { Secret, ISecret } from "../../models";
-import { SecretSnapshot, SecretVersion, ISecretVersion } from "../models";
+import {
+  SecretSnapshot,
+  SecretVersion,
+  ISecretVersion,
+  FolderVersion,
+} from "../models";
 
 /**
  * Save a secret snapshot that is a copy of the current state of secrets in workspace with id
@@ -12,22 +17,31 @@ import { SecretSnapshot, SecretVersion, ISecretVersion } from "../models";
  */
 const takeSecretSnapshotHelper = async ({
   workspaceId,
+  environment,
+  folderId = "root",
 }: {
   workspaceId: Types.ObjectId;
+  environment: string;
+  folderId?: string;
 }) => {
+  // get all folder ids
   const secretIds = (
     await Secret.find(
       {
         workspace: workspaceId,
+        environment,
+        folder: folderId,
       },
       "_id"
-    )
+    ).lean()
   ).map((s) => s._id);
 
   const latestSecretVersions = (
     await SecretVersion.aggregate([
       {
         $match: {
+          environment,
+          workspace: new Types.ObjectId(workspaceId),
           secret: {
             $in: secretIds,
           },
@@ -45,6 +59,11 @@ const takeSecretSnapshotHelper = async ({
       },
     ]).exec()
   ).map((s) => s.versionId);
+  const latestFolderVersion = await FolderVersion.findOne({
+    environment,
+    workspace: workspaceId,
+    "nodes.id": folderId,
+  }).sort({ "nodes.version": -1 });
 
   const latestSecretSnapshot = await SecretSnapshot.findOne({
     workspace: workspaceId,
@@ -52,8 +71,11 @@ const takeSecretSnapshotHelper = async ({
 
   const secretSnapshot = await new SecretSnapshot({
     workspace: workspaceId,
+    environment,
     version: latestSecretSnapshot ? latestSecretSnapshot.version + 1 : 1,
     secretVersions: latestSecretVersions,
+    folderId,
+    folderVersion: latestFolderVersion,
   }).save();
 
   return secretSnapshot;
@@ -96,5 +118,5 @@ const markDeletedSecretVersionsHelper = async ({
 export {
   takeSecretSnapshotHelper,
   addSecretVersionsHelper,
-  markDeletedSecretVersionsHelper
+  markDeletedSecretVersionsHelper,
 };

backend/src/ee/helpers/secretVersion.ts

@@ -1,92 +1,82 @@
-import { Types } from 'mongoose';
-import { SecretVersion } from '../models';
+import { Types } from "mongoose";
+import { SecretVersion } from "../models";
 
 /**
  * Return latest secret versions for secrets with ids [secretIds]
  * @param {Object} obj
  * @param {Object} obj.secretIds = ids of secrets to get latest versions for
- * @returns 
+ * @returns
  */
 const getLatestSecretVersionIds = async ({
-    secretIds
+  secretIds,
 }: {
-    secretIds: Types.ObjectId[];
+  secretIds: Types.ObjectId[];
 }) => {
-    interface LatestSecretVersionId {
-        _id: Types.ObjectId;
-        version: number;
-        versionId: Types.ObjectId;
-    }
-    
-    const latestSecretVersionIds = (await SecretVersion.aggregate([
-        {
-            $match: { 
-                secret: { 
-                    $in: secretIds 
-                } 
-            }
+  const latestSecretVersionIds = await SecretVersion.aggregate([
+    {
+      $match: {
+        secret: {
+          $in: secretIds,
         },
-        {
-            $group: {
-                _id: '$secret',
-                version: { $max: '$version' },
-                versionId: { $max: '$_id' } // id of latest secret version
-            }
-        },
-        {
-            $sort: { version: -1 }
-        }
-        ])
-        .exec());
-    
-    return latestSecretVersionIds;
-}
+      },
+    },
+    {
+      $group: {
+        _id: "$secret",
+        version: { $max: "$version" },
+        versionId: { $max: "$_id" }, // id of latest secret version
+      },
+    },
+    {
+      $sort: { version: -1 },
+    },
+  ]).exec();
+
+  return latestSecretVersionIds;
+};
 
 /**
  * Return latest [n] secret versions for secrets with ids [secretIds]
  * @param {Object} obj
  * @param {Object} obj.secretIds = ids of secrets to get latest versions for
  * @param {Number} obj.n - number of latest secret versions to return for each secret
- * @returns 
+ * @returns
  */
 const getLatestNSecretSecretVersionIds = async ({
-    secretIds,
-    n
+  secretIds,
+  n,
 }: {
-    secretIds: Types.ObjectId[];
-    n: number;
+  secretIds: Types.ObjectId[];
+  n: number;
 }) => {
-    // TODO: optimize query
-    const latestNSecretVersions = (await SecretVersion.aggregate([
-        {
-            $match: {
-            secret: {
-                $in: secretIds,
-            },
-            },
+  // TODO: optimize query
+  const latestNSecretVersions = await SecretVersion.aggregate([
+    {
+      $match: {
+        secret: {
+          $in: secretIds,
         },
-        {
-            $sort: { version: -1 },
-        },
-        {
-            $group: {
-            _id: "$secret",
-            versions: { $push: "$$ROOT" },
-            },
-        },
-        {
-            $project: {
-            _id: 0,
-            secret: "$_id",
-            versions: { $slice: ["$versions", n] },
-            },
-        }
-    ]));
-    
-    return latestNSecretVersions;
-}
+      },
+    },
+    {
+      $sort: { version: -1 },
+    },
+    {
+      $group: {
+        _id: "$secret",
+        versions: { $push: "$$ROOT" },
+      },
+    },
+    {
+      $project: {
+        _id: 0,
+        secret: "$_id",
+        versions: { $slice: ["$versions", n] },
+      },
+    },
+  ]);
 
-export {
-    getLatestSecretVersionIds,
-    getLatestNSecretSecretVersionIds
-}
+  return latestNSecretVersions;
+};
+
+export { getLatestSecretVersionIds, getLatestNSecretSecretVersionIds };

backend/src/ee/models/folderVersion.ts

@@ -0,0 +1,60 @@
+import { model, Schema, Types } from "mongoose";
+
+export type TFolderRootVersionSchema = {
+  _id: Types.ObjectId;
+  workspace: Types.ObjectId;
+  environment: string;
+  nodes: TFolderVersionSchema;
+};
+
+export type TFolderVersionSchema = {
+  id: string;
+  name: string;
+  version: number;
+  children: TFolderVersionSchema[];
+};
+
+const folderVersionSchema = new Schema<TFolderVersionSchema>({
+  id: {
+    required: true,
+    type: String,
+    default: "root",
+  },
+  name: {
+    required: true,
+    type: String,
+    default: "root",
+  },
+  version: {
+    required: true,
+    type: Number,
+    default: 1,
+  },
+});
+
+folderVersionSchema.add({ children: [folderVersionSchema] });
+
+const folderRootVersionSchema = new Schema<TFolderRootVersionSchema>(
+  {
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace",
+      required: true,
+    },
+    environment: {
+      type: String,
+      required: true,
+    },
+    nodes: folderVersionSchema,
+  },
+  {
+    timestamps: true,
+  }
+);
+
+const FolderVersion = model<TFolderRootVersionSchema>(
+  "FolderVersion",
+  folderRootVersionSchema
+);
+
+export default FolderVersion;

backend/src/ee/models/index.ts

@@ -1,15 +1,18 @@
-import SecretSnapshot, { ISecretSnapshot } from './secretSnapshot';
-import SecretVersion, { ISecretVersion } from './secretVersion';
-import Log, { ILog } from './log';
-import Action, { IAction } from './action';
+import SecretSnapshot, { ISecretSnapshot } from "./secretSnapshot";
+import SecretVersion, { ISecretVersion } from "./secretVersion";
+import FolderVersion, { TFolderRootVersionSchema } from "./folderVersion";
+import Log, { ILog } from "./log";
+import Action, { IAction } from "./action";
 
 export {
-    SecretSnapshot,
-    ISecretSnapshot,
-    SecretVersion,
-    ISecretVersion,
-    Log,
-    ILog,
-    Action,
-    IAction
-}
+  SecretSnapshot,
+  ISecretSnapshot,
+  SecretVersion,
+  ISecretVersion,
+  FolderVersion,
+  TFolderRootVersionSchema,
+  Log,
+  ILog,
+  Action,
+  IAction,
+};

backend/src/ee/models/secretSnapshot.ts

@@ -1,33 +1,54 @@
-import { Schema, model, Types } from 'mongoose';
+import { Schema, model, Types } from "mongoose";
 
 export interface ISecretSnapshot {
-    workspace: Types.ObjectId;
-    version: number;
-    secretVersions: Types.ObjectId[];
+  workspace: Types.ObjectId;
+  environment: string;
+  folderId: string | "root";
+  version: number;
+  secretVersions: Types.ObjectId[];
+  folderVersion: Types.ObjectId;
 }
 
 const secretSnapshotSchema = new Schema<ISecretSnapshot>(
-    {
-        workspace: {
-            type: Schema.Types.ObjectId,
-            ref: 'Workspace',
-            required: true
-        },
-        version: {
-            type: Number,
-            required: true
-        },
-        secretVersions: [{
-            type: Schema.Types.ObjectId,
-            ref: 'SecretVersion',
-            required: true
-        }]
+  {
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace",
+      required: true,
     },
-    {
-        timestamps: true
-    }
+    environment: {
+      type: String,
+      required: true,
+    },
+    folderId: {
+      type: String,
+      default: "root",
+    },
+    version: {
+      type: Number,
+      default: 1,
+      required: true,
+    },
+    secretVersions: [
+      {
+        type: Schema.Types.ObjectId,
+        ref: "SecretVersion",
+        required: true,
+      },
+    ],
+    folderVersion: {
+      type: Schema.Types.ObjectId,
+      ref: "FolderVersion",
+    },
+  },
+  {
+    timestamps: true,
+  }
 );
 
-const SecretSnapshot = model<ISecretSnapshot>('SecretSnapshot', secretSnapshotSchema);
+const SecretSnapshot = model<ISecretSnapshot>(
+  "SecretSnapshot",
+  secretSnapshotSchema
+);
 
-export default SecretSnapshot;
+export default SecretSnapshot;

backend/src/ee/models/secretVersion.ts

@@ -1,115 +1,126 @@
-import { Schema, model, Types } from 'mongoose';
+import { Schema, model, Types } from "mongoose";
 import {
-	SECRET_SHARED,
-	SECRET_PERSONAL,
-	ALGORITHM_AES_256_GCM,
-	ENCODING_SCHEME_UTF8,
-	ENCODING_SCHEME_BASE64
-} from '../../variables';
+  SECRET_SHARED,
+  SECRET_PERSONAL,
+  ALGORITHM_AES_256_GCM,
+  ENCODING_SCHEME_UTF8,
+  ENCODING_SCHEME_BASE64,
+} from "../../variables";
 
 export interface ISecretVersion {
-	_id: Types.ObjectId;
-	secret: Types.ObjectId;
-	version: number;
-	workspace: Types.ObjectId; // new
-	type: string; // new
-	user?: Types.ObjectId; // new
-	environment: string; // new
-	isDeleted: boolean;
-	secretBlindIndex?: string;
-	secretKeyCiphertext: string;
-	secretKeyIV: string;
-	secretKeyTag: string;
-	secretValueCiphertext: string;
-	secretValueIV: string;
-	secretValueTag: string;
-	algorithm: 'aes-256-gcm';
-	keyEncoding: 'utf8' | 'base64';
+  _id: Types.ObjectId;
+  secret: Types.ObjectId;
+  version: number;
+  workspace: Types.ObjectId; // new
+  type: string; // new
+  user?: Types.ObjectId; // new
+  environment: string; // new
+  isDeleted: boolean;
+  secretBlindIndex?: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  algorithm: "aes-256-gcm";
+  keyEncoding: "utf8" | "base64";
+  createdAt: string;
+  folder?: string;
 }
 
 const secretVersionSchema = new Schema<ISecretVersion>(
-	{
-		secret: { // could be deleted
-			type: Schema.Types.ObjectId,
-			ref: 'Secret',
-			required: true
-		},
-		version: {
-			type: Number,
-			default: 1,
-			required: true
-		},
-		workspace: {
-			type: Schema.Types.ObjectId,
-			ref: 'Workspace',
-			required: true
-		},
-		type: {
-			type: String,
-			enum: [SECRET_SHARED, SECRET_PERSONAL],
-			required: true
-		},
-		user: {
-			// user associated with the personal secret
-			type: Schema.Types.ObjectId,
-			ref: 'User'
-		},
-		environment: {
-			type: String,
-			required: true
-		},
-		isDeleted: { // consider removing field
-			type: Boolean,
-			default: false,
-			required: true
-		},
-		secretBlindIndex: {
-			type: String,
-			select: false
-		},
-		secretKeyCiphertext: {
-			type: String,
-			required: true
-		},
-		secretKeyIV: {
-			type: String, // symmetric
-			required: true
-		},
-		secretKeyTag: {
-			type: String, // symmetric
-			required: true
-		},
-		secretValueCiphertext: {
-			type: String,
-			required: true
-		},
-		secretValueIV: {
-			type: String, // symmetric
-			required: true
-		},
-		secretValueTag: {
-			type: String, // symmetric
-			required: true
-		},
-		algorithm: { // the encryption algorithm used
-			type: String,
-			enum: [ALGORITHM_AES_256_GCM],
-			required: true
-		},
-		keyEncoding: {
-			type: String,
-			enum: [
-				ENCODING_SCHEME_UTF8,
-				ENCODING_SCHEME_BASE64
-			],
-			required: true
-		},
-	},
-	{
-		timestamps: true
-	}
+  {
+    secret: {
+      // could be deleted
+      type: Schema.Types.ObjectId,
+      ref: "Secret",
+      required: true,
+    },
+    version: {
+      type: Number,
+      default: 1,
+      required: true,
+    },
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace",
+      required: true,
+    },
+    type: {
+      type: String,
+      enum: [SECRET_SHARED, SECRET_PERSONAL],
+      required: true,
+    },
+    user: {
+      // user associated with the personal secret
+      type: Schema.Types.ObjectId,
+      ref: "User",
+    },
+    environment: {
+      type: String,
+      required: true,
+    },
+    isDeleted: {
+      // consider removing field
+      type: Boolean,
+      default: false,
+      required: true,
+    },
+    secretBlindIndex: {
+      type: String,
+      select: false,
+    },
+    secretKeyCiphertext: {
+      type: String,
+      required: true,
+    },
+    secretKeyIV: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretKeyTag: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretValueCiphertext: {
+      type: String,
+      required: true,
+    },
+    secretValueIV: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretValueTag: {
+      type: String, // symmetric
+      required: true,
+    },
+    algorithm: {
+      // the encryption algorithm used
+      type: String,
+      enum: [ALGORITHM_AES_256_GCM],
+      required: true,
+      default: ALGORITHM_AES_256_GCM,
+    },
+    keyEncoding: {
+      type: String,
+      enum: [ENCODING_SCHEME_UTF8, ENCODING_SCHEME_BASE64],
+      required: true,
+      default: ENCODING_SCHEME_UTF8,
+    },
+    folder: {
+      type: String,
+      required: true,
+    },
+  },
+  {
+    timestamps: true,
+  }
 );
 
-const SecretVersion = model<ISecretVersion>('SecretVersion', secretVersionSchema);
+const SecretVersion = model<ISecretVersion>(
+  "SecretVersion",
+  secretVersionSchema
+);
 
-export default SecretVersion;
+export default SecretVersion;

backend/src/ee/routes/v1/workspace.ts

@@ -1,76 +1,82 @@
-import express from 'express';
+import express from "express";
 const router = express.Router();
 import {
-	requireAuth,
-	requireWorkspaceAuth,
-	validateRequest
-} from '../../../middleware';
-import { param, query, body } from 'express-validator';
-import { ADMIN, MEMBER } from '../../../variables';
-import { workspaceController } from '../../controllers/v1';
+  requireAuth,
+  requireWorkspaceAuth,
+  validateRequest,
+} from "../../../middleware";
+import { param, query, body } from "express-validator";
+import { ADMIN, MEMBER } from "../../../variables";
+import { workspaceController } from "../../controllers/v1";
 
 router.get(
-	'/:workspaceId/secret-snapshots',
-	requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: 'params'
-	}),
-	param('workspaceId').exists().trim(),
-	query('offset').exists().isInt(),
-	query('limit').exists().isInt(),
-	validateRequest,
-	workspaceController.getWorkspaceSecretSnapshots
+  "/:workspaceId/secret-snapshots",
+  requireAuth({
+    acceptedAuthModes: ["jwt", "apiKey"],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params",
+  }),
+  param("workspaceId").exists().trim(),
+  query("environment").isString().exists().trim(),
+  query("folderId").default("root").isString().trim(),
+  query("offset").exists().isInt(),
+  query("limit").exists().isInt(),
+  validateRequest,
+  workspaceController.getWorkspaceSecretSnapshots
 );
 
 router.get(
-	'/:workspaceId/secret-snapshots/count',
-	requireAuth({
-		acceptedAuthModes: ['jwt']
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: 'params'
-	}),
-	param('workspaceId').exists().trim(),
-	validateRequest,
-	workspaceController.getWorkspaceSecretSnapshotsCount
+  "/:workspaceId/secret-snapshots/count",
+  requireAuth({
+    acceptedAuthModes: ["jwt"],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params",
+  }),
+  param("workspaceId").exists().trim(),
+  query("environment").isString().exists().trim(),
+  query("folderId").default("root").isString().trim(),
+  validateRequest,
+  workspaceController.getWorkspaceSecretSnapshotsCount
 );
 
 router.post(
-	'/:workspaceId/secret-snapshots/rollback',
-	requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: 'params'
-	}),
-	param('workspaceId').exists().trim(),
-	body('version').exists().isInt(),
-	validateRequest,
-	workspaceController.rollbackWorkspaceSecretSnapshot
+  "/:workspaceId/secret-snapshots/rollback",
+  requireAuth({
+    acceptedAuthModes: ["jwt", "apiKey"],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params",
+  }),
+  param("workspaceId").exists().trim(),
+  body("environment").isString().exists().trim(),
+  query("folderId").default("root").isString().exists().trim(),
+  body("version").exists().isInt(),
+  validateRequest,
+  workspaceController.rollbackWorkspaceSecretSnapshot
 );
 
 router.get(
-	'/:workspaceId/logs',
-	requireAuth({
-		acceptedAuthModes: ['jwt', 'apiKey']
-	}),
-	requireWorkspaceAuth({
-		acceptedRoles: [ADMIN, MEMBER],
-		locationWorkspaceId: 'params'
-	}),
-	param('workspaceId').exists().trim(),
-	query('offset').exists().isInt(),
-	query('limit').exists().isInt(),
-	query('sortBy'),
-	query('userId'),
-	query('actionNames'),
-	validateRequest,
-	workspaceController.getWorkspaceLogs
+  "/:workspaceId/logs",
+  requireAuth({
+    acceptedAuthModes: ["jwt", "apiKey"],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: "params",
+  }),
+  param("workspaceId").exists().trim(),
+  query("offset").exists().isInt(),
+  query("limit").exists().isInt(),
+  query("sortBy"),
+  query("userId"),
+  query("actionNames"),
+  validateRequest,
+  workspaceController.getWorkspaceLogs
 );
 
-export default router;
+export default router;

backend/src/ee/services/EESecretService.ts

@@ -1,9 +1,9 @@
 import { Types } from 'mongoose';
 import { ISecretVersion } from '../models';
-import { 
-    takeSecretSnapshotHelper,
-    addSecretVersionsHelper,
-    markDeletedSecretVersionsHelper
+import {
+  takeSecretSnapshotHelper,
+  addSecretVersionsHelper,
+  markDeletedSecretVersionsHelper,
 } from '../helpers/secret';
 import EELicenseService from './EELicenseService';
 
@@ -11,58 +11,65 @@ import EELicenseService from './EELicenseService';
  * Class to handle Enterprise Edition secret actions
  */
 class EESecretService {
-    
-    /**
-     * Save a secret snapshot that is a copy of the current state of secrets in workspace with id
-     * [workspaceId] under a new snapshot with incremented version under the
-     * SecretSnapshot collection.
-     * Requires a valid license key [licenseKey]
-     * @param {Object} obj
-     * @param {String} obj.workspaceId
-     * @returns {SecretSnapshot} secretSnapshot - new secret snpashot
-     */
-    static async takeSecretSnapshot({
-        workspaceId
-    }: {
-        workspaceId: Types.ObjectId;
-    }) {
-        if (!EELicenseService.isLicenseValid) return;
-        return await takeSecretSnapshotHelper({ workspaceId });
-    }
-    
-    /**
-     * Add secret versions [secretVersions] to the SecretVersion collection.
-     * @param {Object} obj
-     * @param {Object[]} obj.secretVersions
-     * @returns {SecretVersion[]} newSecretVersions - new secret versions
-     */
-    static async addSecretVersions({
-        secretVersions
-    }: {
-        secretVersions: ISecretVersion[];
-    }) {
-        if (!EELicenseService.isLicenseValid) return;
-        return await addSecretVersionsHelper({
-            secretVersions
-        });
-    }
+  /**
+   * Save a secret snapshot that is a copy of the current state of secrets in workspace with id
+   * [workspaceId] under a new snapshot with incremented version under the
+   * SecretSnapshot collection.
+   * Requires a valid license key [licenseKey]
+   * @param {Object} obj
+   * @param {String} obj.workspaceId
+   * @returns {SecretSnapshot} secretSnapshot - new secret snpashot
+   */
+  static async takeSecretSnapshot({
+    workspaceId,
+    environment,
+    folderId,
+  }: {
+    workspaceId: Types.ObjectId;
+    environment: string;
+    folderId?: string;
+  }) {
+    if (!EELicenseService.isLicenseValid) return;
+    return await takeSecretSnapshotHelper({
+      workspaceId,
+      environment,
+      folderId,
+    });
+  }
 
-    /**
-     * Mark secret versions associated with secrets with ids [secretIds]
-     * as deleted.
-     * @param {Object} obj
-     * @param {ObjectId[]} obj.secretIds - secret ids
-     */
-    static async markDeletedSecretVersions({
-        secretIds
-    }: {
-        secretIds: Types.ObjectId[];
-    }) {
-        if (!EELicenseService.isLicenseValid) return;
-        await markDeletedSecretVersionsHelper({
-            secretIds
-        });
-    }
+  /**
+   * Add secret versions [secretVersions] to the SecretVersion collection.
+   * @param {Object} obj
+   * @param {Object[]} obj.secretVersions
+   * @returns {SecretVersion[]} newSecretVersions - new secret versions
+   */
+  static async addSecretVersions({
+    secretVersions,
+  }: {
+    secretVersions: ISecretVersion[];
+  }) {
+    if (!EELicenseService.isLicenseValid) return;
+    return await addSecretVersionsHelper({
+      secretVersions,
+    });
+  }
+
+  /**
+   * Mark secret versions associated with secrets with ids [secretIds]
+   * as deleted.
+   * @param {Object} obj
+   * @param {ObjectId[]} obj.secretIds - secret ids
+   */
+  static async markDeletedSecretVersions({
+    secretIds,
+  }: {
+    secretIds: Types.ObjectId[];
+  }) {
+    if (!EELicenseService.isLicenseValid) return;
+    await markDeletedSecretVersionsHelper({
+      secretIds,
+    });
+  }
 }
 
-export default EESecretService;
+export default EESecretService;

backend/src/helpers/auth.ts

@@ -19,6 +19,7 @@ import {
 import {
 	getJwtAuthLifetime,
 	getJwtAuthSecret,
+	getJwtProviderAuthSecret,
 	getJwtRefreshLifetime,
 	getJwtRefreshSecret
 } from '../config';
@@ -43,7 +44,7 @@ export const validateAuthMode = ({
 }) => {
 	const apiKey = headers['x-api-key'];
 	const authHeader = headers['authorization'];
-	
+
 	let authMode, authTokenValue;
 	if (apiKey === undefined && authHeader === undefined) {
 		// case: no auth or X-API-KEY header present
@@ -319,4 +320,29 @@ export const createToken = ({
 	return jwt.sign(payload, secret, {
 		expiresIn
 	});
-};
+};
+
+export const validateProviderAuthToken = async ({
+	email,
+	user,
+	providerAuthToken,
+}: {
+	email: string;
+	user: IUser,
+	providerAuthToken?: string;
+}) => {
+	if (!providerAuthToken) {
+		throw new Error('Invalid authentication request.');
+	}
+
+	const decodedToken = <jwt.ProviderAuthJwtPayload>(
+		jwt.verify(providerAuthToken, await getJwtProviderAuthSecret())
+	);
+	
+	if (
+		decodedToken.authProvider !== user.authProvider ||
+		decodedToken.email !== email
+	) {
+		throw new Error('Invalid authentication credentials.')
+	}
+}

backend/src/helpers/membership.ts

@@ -1,13 +1,7 @@
 import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
-import { 
-	Membership, 
-	Key
-} from '../models';
-import {
-	MembershipNotFoundError,
-	BadRequestError
-} from '../utils/errors';
+import { Membership, Key } from '../models';
+import { MembershipNotFoundError, BadRequestError } from '../utils/errors';
 
 /**
  * Validate that user with id [userId] is a member of workspace with id [workspaceId]
@@ -22,28 +16,31 @@ export const validateMembership = async ({
 	workspaceId,
 	acceptedRoles,
 }: {
-	userId: Types.ObjectId;
-	workspaceId: Types.ObjectId;
-	acceptedRoles?: Array<'admin' | 'member'>;
+  userId: Types.ObjectId | string;
+  workspaceId: Types.ObjectId | string;
+  acceptedRoles?: Array<'admin' | 'member'>;
 }) => {
-	
-	const membership = await Membership.findOne({
-		user: userId,
-		workspace: workspaceId
-	}).populate("workspace");
-	
-	if (!membership) {
-		throw MembershipNotFoundError({ message: 'Failed to find workspace membership' });
-	}
-	
-	if (acceptedRoles) {
-		if (!acceptedRoles.includes(membership.role)) {
-			throw BadRequestError({ message: 'Failed authorization for membership role' });
-		}
-	}
-	
-	return membership;
-}
+  const membership = await Membership.findOne({
+    user: userId,
+    workspace: workspaceId,
+  }).populate('workspace');
+
+  if (!membership) {
+    throw MembershipNotFoundError({
+      message: 'Failed to find workspace membership',
+    });
+  }
+
+  if (acceptedRoles) {
+    if (!acceptedRoles.includes(membership.role)) {
+      throw BadRequestError({
+        message: 'Failed authorization for membership role',
+      });
+    }
+  }
+
+  return membership;
+};
 
 /**
  * Return membership matching criteria specified in query [queryObj]
@@ -60,7 +57,7 @@ export const findMembership = async (queryObj: any) => {
 		throw new Error('Failed to find membership');
 	}
 
-	return membership;
+  return membership;
 };
 
 /**
@@ -76,35 +73,35 @@ export const addMemberships = async ({
 	workspaceId,
 	roles
 }: {
-	userIds: string[];
-	workspaceId: string;
-	roles: string[];
+  userIds: string[];
+  workspaceId: string;
+  roles: string[];
 }): Promise<void> => {
-	try {
-		const operations = userIds.map((userId, idx) => {
-			return {
-				updateOne: {
-					filter: {
-						user: userId,
-						workspace: workspaceId,
-						role: roles[idx]
-					},
-					update: {
-						user: userId,
-						workspace: workspaceId,
-						role: roles[idx]
-					},
-					upsert: true
-				}
-			};
-		});
+  try {
+    const operations = userIds.map((userId, idx) => {
+      return {
+        updateOne: {
+          filter: {
+            user: userId,
+            workspace: workspaceId,
+            role: roles[idx],
+          },
+          update: {
+            user: userId,
+            workspace: workspaceId,
+            role: roles[idx],
+          },
+          upsert: true,
+        },
+      };
+    });
 
-		await Membership.bulkWrite(operations as any);
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to add users to workspace');
-	}
+    await Membership.bulkWrite(operations as any);
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error('Failed to add users to workspace');
+  }
 };
 
 /**
@@ -119,19 +116,19 @@ export const deleteMembership = async ({ membershipId }: { membershipId: string
 			_id: membershipId
 		});
 
-		// delete keys associated with the membership
-		if (deletedMembership?.user) {
-			// case: membership had a registered user
-			await Key.deleteMany({
-				receiver: deletedMembership.user,
-				workspace: deletedMembership.workspace
-			});
-		}
-	} catch (err) {
-		Sentry.setUser(null);
-		Sentry.captureException(err);
-		throw new Error('Failed to delete membership');
-	}
+    // delete keys associated with the membership
+    if (deletedMembership?.user) {
+      // case: membership had a registered user
+      await Key.deleteMany({
+        receiver: deletedMembership.user,
+        workspace: deletedMembership.workspace,
+      });
+    }
+  } catch (err) {
+    Sentry.setUser(null);
+    Sentry.captureException(err);
+    throw new Error('Failed to delete membership');
+  }
 
 	return deletedMembership;
-};
+};

backend/src/helpers/rateLimiter.ts

@@ -1,9 +1,16 @@
 import rateLimit from 'express-rate-limit';
+const MongoStore = require('rate-limit-mongo');
 
-// 120 requests per minute
+// 200 per minute
 export const apiLimiter = rateLimit({
-  windowMs: 60 * 1000,
-  max: 240,
+  store: new MongoStore({
+    uri: process.env.MONGO_URL,
+    expireTimeMs: 1000 * 60,
+    collectionName: "expressRateRecords-apiLimiter",
+    errorHandler: console.error.bind(null, 'rate-limit-mongo')
+  }),
+  windowMs: 1000 * 60,
+  max: 200,
   standardHeaders: true,
   legacyHeaders: false,
   skip: (request) => {
@@ -11,18 +18,30 @@ export const apiLimiter = rateLimit({
   }
 });
 
-// 10 requests per minute
+// 50 requests per 1 hours
 const authLimit = rateLimit({
-  windowMs: 60 * 1000,
-  max: 10,
+  store: new MongoStore({
+    uri: process.env.MONGO_URL,
+    expireTimeMs: 1000 * 60 * 60,
+    errorHandler: console.error.bind(null, 'rate-limit-mongo'),
+    collectionName: "expressRateRecords-authLimit",
+  }),
+  windowMs: 1000 * 60 * 60,
+  max: 50,
   standardHeaders: true,
   legacyHeaders: false
 });
 
-// 10 requests per hour
+// 50 requests per 1 hour
 export const passwordLimiter = rateLimit({
-  windowMs: 60 * 60 * 1000,
-  max: 10,
+  store: new MongoStore({
+    uri: process.env.MONGO_URL,
+    expireTimeMs: 1000 * 60 * 60,
+    errorHandler: console.error.bind(null, 'rate-limit-mongo'),
+    collectionName: "expressRateRecords-passwordLimiter",
+  }),
+  windowMs: 1000 * 60 * 60,
+  max: 50,
   standardHeaders: true,
   legacyHeaders: false
 });

backend/src/helpers/secret.ts

@@ -1,5 +1,5 @@
 import { Types } from "mongoose";
-import { Secret, ISecret, Membership } from "../models";
+import { Secret, ISecret } from "../models";
 import { EESecretService, EELogService } from "../ee/services";
 import { IAction, SecretVersion } from "../ee/models";
 import {
@@ -12,8 +12,6 @@ import {
   ALGORITHM_AES_256_GCM,
   ENCODING_SCHEME_UTF8,
 } from "../variables";
-import _ from "lodash";
-import { BadRequestError, UnauthorizedRequestError } from "../utils/errors";
 
 interface V1PushSecret {
   ciphertextKey: string;
@@ -197,7 +195,7 @@ export const v1PushSecrets = async ({
         secretValueTag: newSecret.tagValue,
         secretValueHash: newSecret.hashValue,
         algorithm: ALGORITHM_AES_256_GCM,
-        keyEncoding: ENCODING_SCHEME_UTF8
+        keyEncoding: ENCODING_SCHEME_UTF8,
       });
     }),
   });
@@ -230,7 +228,7 @@ export const v1PushSecrets = async ({
             secretCommentTag: s.tagComment,
             secretCommentHash: s.hashComment,
             algorithm: ALGORITHM_AES_256_GCM,
-            keyEncoding: ENCODING_SCHEME_UTF8
+            keyEncoding: ENCODING_SCHEME_UTF8,
           };
 
           if (toAdd[idx].type === "personal") {
@@ -261,7 +259,7 @@ export const v1PushSecrets = async ({
           secretValueTag,
           secretValueHash,
           algorithm,
-          keyEncoding
+          keyEncoding,
         }) =>
           new SecretVersion({
             secret: _id,
@@ -280,7 +278,7 @@ export const v1PushSecrets = async ({
             secretValueTag,
             secretValueHash,
             algorithm,
-            keyEncoding
+            keyEncoding,
           })
       ),
     });
@@ -289,6 +287,7 @@ export const v1PushSecrets = async ({
   // (EE) take a secret snapshot
   await EESecretService.takeSecretSnapshot({
     workspaceId: new Types.ObjectId(workspaceId),
+    environment,
   });
 };
 
@@ -491,7 +490,7 @@ export const v2PushSecrets = async ({
           secret: secretDocument._id,
           isDeleted: false,
           algorithm: ALGORITHM_AES_256_GCM,
-          keyEncoding: ENCODING_SCHEME_UTF8
+          keyEncoding: ENCODING_SCHEME_UTF8,
         });
       }),
     });
@@ -508,6 +507,7 @@ export const v2PushSecrets = async ({
   // (EE) take a secret snapshot
   await EESecretService.takeSecretSnapshot({
     workspaceId: new Types.ObjectId(workspaceId),
+    environment,
   });
 
   // (EE) create (audit) log

backend/src/index.ts

@@ -1,172 +1,168 @@
-import dotenv from 'dotenv';
+import dotenv from "dotenv";
 dotenv.config();
-import express from 'express';
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-require('express-async-errors');
-import helmet from 'helmet';
-import cors from 'cors';
-import { DatabaseService } from './services';
-import { EELicenseService } from './ee/services';
-import { setUpHealthEndpoint } from './services/health';
-import cookieParser from 'cookie-parser';
-import swaggerUi = require('swagger-ui-express');
+import express, { Request, NextFunction, Response } from "express";
+import helmet from "helmet";
+import cors from "cors";
+import { DatabaseService } from "./services";
+import { EELicenseService } from "./ee/services";
+import { setUpHealthEndpoint } from "./services/health";
+import cookieParser from "cookie-parser";
+import swaggerUi = require("swagger-ui-express");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const swaggerFile = require('../spec.json');
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 import { apiLimiter } from './helpers/rateLimiter';
 import {
-    workspace as eeWorkspaceRouter,
-    secret as eeSecretRouter,
-    secretSnapshot as eeSecretSnapshotRouter,
-    action as eeActionRouter,
-    organizations as eeOrganizationsRouter,
-    cloudProducts as eeCloudProductsRouter
-} from './ee/routes/v1';
+  workspace as eeWorkspaceRouter,
+  secret as eeSecretRouter,
+  secretSnapshot as eeSecretSnapshotRouter,
+  action as eeActionRouter,
+  organizations as eeOrganizationsRouter,
+  cloudProducts as eeCloudProductsRouter,
+} from "./ee/routes/v1";
 import {
-    signup as v1SignupRouter,
-    auth as v1AuthRouter,
-    bot as v1BotRouter,
-    organization as v1OrganizationRouter,
-    workspace as v1WorkspaceRouter,
-    membershipOrg as v1MembershipOrgRouter,
-    membership as v1MembershipRouter,
-    key as v1KeyRouter,
-    inviteOrg as v1InviteOrgRouter,
-    user as v1UserRouter,
-    userAction as v1UserActionRouter,
-    secret as v1SecretRouter,
-    serviceToken as v1ServiceTokenRouter,
-    password as v1PasswordRouter,
-    stripe as v1StripeRouter,
-    integration as v1IntegrationRouter,
-    integrationAuth as v1IntegrationAuthRouter,
-    secretsFolder as v1SecretsFolder
-} from './routes/v1';
+  signup as v1SignupRouter,
+  auth as v1AuthRouter,
+  bot as v1BotRouter,
+  organization as v1OrganizationRouter,
+  workspace as v1WorkspaceRouter,
+  membershipOrg as v1MembershipOrgRouter,
+  membership as v1MembershipRouter,
+  key as v1KeyRouter,
+  inviteOrg as v1InviteOrgRouter,
+  user as v1UserRouter,
+  userAction as v1UserActionRouter,
+  secret as v1SecretRouter,
+  serviceToken as v1ServiceTokenRouter,
+  password as v1PasswordRouter,
+  stripe as v1StripeRouter,
+  integration as v1IntegrationRouter,
+  integrationAuth as v1IntegrationAuthRouter,
+  secretsFolder as v1SecretsFolder,
+} from "./routes/v1";
 import {
-    signup as v2SignupRouter,
-    auth as v2AuthRouter,
-    users as v2UsersRouter,
-    organizations as v2OrganizationsRouter,
-    workspace as v2WorkspaceRouter,
-    secret as v2SecretRouter, // begin to phase out
-    secrets as v2SecretsRouter,
-    serviceTokenData as v2ServiceTokenDataRouter,
-    serviceAccounts as v2ServiceAccountsRouter,
-    apiKeyData as v2APIKeyDataRouter,
-    environment as v2EnvironmentRouter,
-    tags as v2TagsRouter,
-} from './routes/v2';
+  signup as v2SignupRouter,
+  auth as v2AuthRouter,
+  users as v2UsersRouter,
+  organizations as v2OrganizationsRouter,
+  workspace as v2WorkspaceRouter,
+  secret as v2SecretRouter, // begin to phase out
+  secrets as v2SecretsRouter,
+  serviceTokenData as v2ServiceTokenDataRouter,
+  serviceAccounts as v2ServiceAccountsRouter,
+  apiKeyData as v2APIKeyDataRouter,
+  environment as v2EnvironmentRouter,
+  tags as v2TagsRouter,
+} from "./routes/v2";
 import {
-    secrets as v3SecretsRouter,
-    workspaces as v3WorkspacesRouter
-} from './routes/v3';
-import { healthCheck } from './routes/status';
-import { getLogger } from './utils/logger';
-import { RouteNotFoundError } from './utils/errors';
-import { requestErrorHandler } from './middleware/requestErrorHandler';
-import {
-    getNodeEnv,
-    getPort,
-    getSiteURL
-} from './config';
-import { setup } from './utils/setup';
+  auth as v3AuthRouter,
+  secrets as v3SecretsRouter,
+  signup as v3SignupRouter,
+  workspaces as v3WorkspacesRouter,
+} from "./routes/v3";
+import { healthCheck } from "./routes/status";
+import { getLogger } from "./utils/logger";
+import { RouteNotFoundError } from "./utils/errors";
+import { requestErrorHandler } from "./middleware/requestErrorHandler";
+import { getNodeEnv, getPort, getSiteURL } from "./config";
+import { setup } from "./utils/setup";
 
 const main = async () => {
-    await setup();
+  await setup();
 
-    await EELicenseService.initGlobalFeatureSet();
+  await EELicenseService.initGlobalFeatureSet();
 
-    const app = express();
-    app.enable('trust proxy');
-    app.use(express.json());
-    app.use(cookieParser());
-    app.use(
-        cors({
-            credentials: true,
-            origin: await getSiteURL()
-        })
+  const app = express();
+  app.enable('trust proxy');
+  app.use(express.json());
+  app.use(cookieParser());
+  app.use(
+      cors({
+          credentials: true,
+          origin: await getSiteURL()
+      })
+  );
+
+  if ((await getNodeEnv()) === 'production') {
+      // enable app-wide rate-limiting + helmet security
+      // in production
+      app.disable('x-powered-by');
+      app.use(apiLimiter);
+      app.use(helmet());
+  }
+
+  // (EE) routes
+  app.use('/api/v1/secret', eeSecretRouter);
+  app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
+  app.use('/api/v1/workspace', eeWorkspaceRouter);
+  app.use('/api/v1/action', eeActionRouter);
+  app.use('/api/v1/organizations', eeOrganizationsRouter);
+  app.use('/api/v1/cloud-products', eeCloudProductsRouter);
+
+  // v1 routes (default)
+  app.use('/api/v1/signup', v1SignupRouter);
+  app.use('/api/v1/auth', v1AuthRouter);
+  app.use('/api/v1/bot', v1BotRouter);
+  app.use('/api/v1/user', v1UserRouter);
+  app.use('/api/v1/user-action', v1UserActionRouter);
+  app.use('/api/v1/organization', v1OrganizationRouter);
+  app.use('/api/v1/workspace', v1WorkspaceRouter);
+  app.use('/api/v1/membership-org', v1MembershipOrgRouter);
+  app.use('/api/v1/membership', v1MembershipRouter);
+  app.use('/api/v1/key', v1KeyRouter);
+  app.use('/api/v1/invite-org', v1InviteOrgRouter);
+  app.use('/api/v1/secret', v1SecretRouter); // deprecate
+  app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecate
+  app.use('/api/v1/password', v1PasswordRouter);
+  app.use('/api/v1/stripe', v1StripeRouter);
+  app.use('/api/v1/integration', v1IntegrationRouter);
+  app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
+  app.use('/api/v1/folder', v1SecretsFolder)
+
+  // v2 routes (improvements)
+  app.use('/api/v2/signup', v2SignupRouter);
+  app.use('/api/v2/auth', v2AuthRouter);
+  app.use('/api/v2/users', v2UsersRouter);
+  app.use('/api/v2/organizations', v2OrganizationsRouter);
+  app.use('/api/v2/workspace', v2EnvironmentRouter);
+  app.use('/api/v2/workspace', v2TagsRouter);
+  app.use('/api/v2/workspace', v2WorkspaceRouter);
+  app.use('/api/v2/secret', v2SecretRouter); // deprecate
+  app.use('/api/v2/secrets', v2SecretsRouter); // note: in the process of moving to v3/secrets
+  app.use('/api/v2/service-token', v2ServiceTokenDataRouter);
+  app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new
+  app.use('/api/v2/api-key', v2APIKeyDataRouter);
+
+  // v3 routes (experimental)
+  app.use('/api/v3/secrets', v3SecretsRouter);
+  app.use('/api/v3/workspaces', v3WorkspacesRouter);
+
+  // api docs 
+  app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
+
+  // server status
+  app.use('/api', healthCheck)
+
+  //* Handle unrouted requests and respond with proper error message as well as status code
+  app.use((req: Request, res: Response, next: NextFunction) => {
+    if (res.headersSent) return next();
+    next(RouteNotFoundError({ message: `The requested source '(${req.method})${req.url}' was not found` }))
+  })
+
+  const server = app.listen(await getPort(), async () => {
+    (await getLogger("backend-main")).info(
+      `Server started listening at port ${await getPort()}`
     );
+  });
 
-    if ((await getNodeEnv()) === 'production') {
-        // enable app-wide rate-limiting + helmet security
-        // in production
-        app.disable('x-powered-by');
-        app.use(apiLimiter);
-        app.use(helmet());
-    }
+  // await createTestUserForDevelopment();
+  setUpHealthEndpoint(server);
 
-    // (EE) routes
-    app.use('/api/v1/secret', eeSecretRouter);
-    app.use('/api/v1/secret-snapshot', eeSecretSnapshotRouter);
-    app.use('/api/v1/workspace', eeWorkspaceRouter);
-    app.use('/api/v1/action', eeActionRouter);
-    app.use('/api/v1/organizations', eeOrganizationsRouter);
-    app.use('/api/v1/cloud-products', eeCloudProductsRouter);
+  server.on("close", async () => {
+    await DatabaseService.closeDatabase();
+  });
 
-    // v1 routes (default)
-    app.use('/api/v1/signup', v1SignupRouter);
-    app.use('/api/v1/auth', v1AuthRouter);
-    app.use('/api/v1/bot', v1BotRouter);
-    app.use('/api/v1/user', v1UserRouter);
-    app.use('/api/v1/user-action', v1UserActionRouter);
-    app.use('/api/v1/organization', v1OrganizationRouter);
-    app.use('/api/v1/workspace', v1WorkspaceRouter);
-    app.use('/api/v1/membership-org', v1MembershipOrgRouter);
-    app.use('/api/v1/membership', v1MembershipRouter);
-    app.use('/api/v1/key', v1KeyRouter);
-    app.use('/api/v1/invite-org', v1InviteOrgRouter);
-    app.use('/api/v1/secret', v1SecretRouter); // deprecate
-    app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecate
-    app.use('/api/v1/password', v1PasswordRouter);
-    app.use('/api/v1/stripe', v1StripeRouter);
-    app.use('/api/v1/integration', v1IntegrationRouter);
-    app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
-    app.use('/api/v1/folder', v1SecretsFolder)
+  return server;
+};
 
-    // v2 routes (improvements)
-    app.use('/api/v2/signup', v2SignupRouter);
-    app.use('/api/v2/auth', v2AuthRouter);
-    app.use('/api/v2/users', v2UsersRouter);
-    app.use('/api/v2/organizations', v2OrganizationsRouter);
-    app.use('/api/v2/workspace', v2EnvironmentRouter);
-    app.use('/api/v2/workspace', v2TagsRouter);
-    app.use('/api/v2/workspace', v2WorkspaceRouter);
-    app.use('/api/v2/secret', v2SecretRouter); // deprecate
-    app.use('/api/v2/secrets', v2SecretsRouter); // note: in the process of moving to v3/secrets
-    app.use('/api/v2/service-token', v2ServiceTokenDataRouter);
-    app.use('/api/v2/service-accounts', v2ServiceAccountsRouter); // new
-    app.use('/api/v2/api-key', v2APIKeyDataRouter);
-
-    // v3 routes (experimental)
-    app.use('/api/v3/secrets', v3SecretsRouter);
-    app.use('/api/v3/workspaces', v3WorkspacesRouter);
-
-    // api docs 
-    app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerFile))
-
-    // server status
-    app.use('/api', healthCheck)
-
-    //* Handle unrouted requests and respond with proper error message as well as status code
-    app.use((req, res, next) => {
-        if (res.headersSent) return next();
-        next(RouteNotFoundError({ message: `The requested source '(${req.method})${req.url}' was not found` }))
-    })
-
-    app.use(requestErrorHandler)
-
-    const server = app.listen(await getPort(), async () => {
-        (await getLogger("backend-main")).info(`Server started listening at port ${await getPort()}`)
-    });
-
-    // await createTestUserForDevelopment();
-    setUpHealthEndpoint(server);
-
-    server.on('close', async () => {
-        await DatabaseService.closeDatabase();
-    })
-
-    return server;
-}
-
-export default main();
+export default main();

backend/src/interfaces/services/SecretService/index.ts

@@ -1,52 +1,54 @@
-import { Types } from 'mongoose';
-import { AuthData } from '../../middleware';
+import { Types } from "mongoose";
+import { AuthData } from "../../middleware";
 
 export interface CreateSecretParams {
-    secretName: string;
-    workspaceId: Types.ObjectId;
-    environment: string;
-    type: 'shared' | 'personal';
-    authData: AuthData;
-    secretKeyCiphertext: string;
-    secretKeyIV: string;
-    secretKeyTag: string;
-    secretValueCiphertext: string;
-    secretValueIV: string;
-    secretValueTag: string;
-    secretCommentCiphertext?: string;
-    secretCommentIV?: string;
-    secretCommentTag?: string;
+  secretName: string;
+  workspaceId: Types.ObjectId;
+  environment: string;
+  folderId?: string;
+  type: "shared" | "personal";
+  authData: AuthData;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  secretCommentCiphertext?: string;
+  secretCommentIV?: string;
+  secretCommentTag?: string;
 }
 
 export interface GetSecretsParams {
-    workspaceId: Types.ObjectId;
-    environment: string;
-    authData: AuthData;
+  workspaceId: Types.ObjectId;
+  environment: string;
+  authData: AuthData;
 }
 
 export interface GetSecretParams {
-    secretName: string;
-    workspaceId: Types.ObjectId;
-    environment: string;
-    type?: 'shared' | 'personal';
-    authData: AuthData;
+  secretName: string;
+  workspaceId: Types.ObjectId;
+  environment: string;
+  type?: "shared" | "personal";
+  authData: AuthData;
 }
 
 export interface UpdateSecretParams {
-    secretName: string;
-    workspaceId: Types.ObjectId;
-    environment: string;
-    type: 'shared' | 'personal',
-    authData: AuthData
-    secretValueCiphertext: string;
-    secretValueIV: string;
-    secretValueTag: string;
+  secretName: string;
+  workspaceId: Types.ObjectId;
+  environment: string;
+  type: "shared" | "personal";
+  authData: AuthData;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  folderId?: string;
 }
 
 export interface DeleteSecretParams {
-    secretName: string;
-    workspaceId: Types.ObjectId;
-    environment: string;
-    type: 'shared' | 'personal';
-    authData: AuthData;
-}
+  secretName: string;
+  workspaceId: Types.ObjectId;
+  environment: string;
+  type: "shared" | "personal";
+  authData: AuthData;
+}

backend/src/middleware/requestErrorHandler.ts

@@ -1,29 +1,45 @@
 import * as Sentry from '@sentry/node';
-import { ErrorRequestHandler } from "express";
-import { InternalServerError } from "../utils/errors";
-import { getLogger } from "../utils/logger";
-import RequestError, { LogLevel } from "../utils/requestError";
-import { getNodeEnv } from '../config';
+import { ErrorRequestHandler } from 'express';
+import { InternalServerError } from '../utils/errors';
+import { getLogger } from '../utils/logger';
+import RequestError, { LogLevel } from '../utils/requestError';
 
-export const requestErrorHandler: ErrorRequestHandler = async (error: RequestError | Error, req, res, next) => {
-    if (res.headersSent) return next();
+export const requestErrorHandler: ErrorRequestHandler = async (
+  error: RequestError | Error,
+  req,
+  res,
+  next
+) => {
+  if (res.headersSent) return next();
 
-    //TODO: Find better way to type check for error. In current setting you need to cast type to get the functions and variables from RequestError
-    if (!(error instanceof RequestError)) {
-        error = InternalServerError({ context: { exception: error.message }, stack: error.stack });
-        (await getLogger('backend-main')).log((<RequestError>error).levelName.toLowerCase(), (<RequestError>error).message)
-    }
+  //TODO: Find better way to type check for error. In current setting you need to cast type to get the functions and variables from RequestError
+  if (!(error instanceof RequestError)) {
+    error = InternalServerError({
+      context: { exception: error.message },
+      stack: error.stack,
+    });
+    (await getLogger('backend-main')).log(
+      (<RequestError>error).levelName.toLowerCase(),
+      (<RequestError>error).message
+    );
+  }
 
-    //* Set Sentry user identification if req.user is populated
-    if (req.user !== undefined && req.user !== null) {
-        Sentry.setUser({ email: req.user.email })
-    }
-    //* Only sent error to Sentry if LogLevel is one of the following level 'ERROR', 'EMERGENCY' or 'CRITICAL'
-    //* with this we will eliminate false-positive errors like 'BadRequestError', 'UnauthorizedRequestError' and so on
-    if ([LogLevel.ERROR, LogLevel.EMERGENCY, LogLevel.CRITICAL].includes((<RequestError>error).level)) {
-        Sentry.captureException(error)
-    }
+  //* Set Sentry user identification if req.user is populated
+  if (req.user !== undefined && req.user !== null) {
+    Sentry.setUser({ email: (req.user as any).email });
+  }
+  //* Only sent error to Sentry if LogLevel is one of the following level 'ERROR', 'EMERGENCY' or 'CRITICAL'
+  //* with this we will eliminate false-positive errors like 'BadRequestError', 'UnauthorizedRequestError' and so on
+  if (
+    [LogLevel.ERROR, LogLevel.EMERGENCY, LogLevel.CRITICAL].includes(
+      (<RequestError>error).level
+    )
+  ) {
+    Sentry.captureException(error);
+  }
 
-    res.status((<RequestError>error).statusCode).json((<RequestError>error).format(req))
-    next()
-}
+  res
+    .status((<RequestError>error).statusCode)
+    .json((<RequestError>error).format(req));
+  next();
+};

backend/src/middleware/requireAuth.ts

@@ -42,10 +42,9 @@ const requireAuth = ({
 	acceptedAuthModes: string[];
 }) => {
 	return async (req: Request, res: Response, next: NextFunction) => {
-		
+
 		// validate auth token against accepted auth modes [acceptedAuthModes]
 		// and return token type [authTokenType] and value [authTokenValue]
-		
 		const { authMode, authTokenValue } = validateAuthMode({
 			headers: req.headers,
 			acceptedAuthModes
@@ -78,13 +77,13 @@ const requireAuth = ({
 				req.user = authPayload;
 				break;
 		}
-		
+
 		req.requestData = {
 			...req.params,
 			...req.query,
 			...req.body,
 		}
-		
+
 		req.authData = {
 			authMode,
 			authPayload, // User, ServiceAccount, ServiceTokenData
@@ -92,7 +91,7 @@ const requireAuth = ({
 			authIP: req.ip,
 			authUserAgent: req.headers['user-agent'] ?? 'other'
 		}
-		
+
 		return next();
 	}
 }

backend/src/models/folder.ts

@@ -1,36 +1,56 @@
-import { Schema, Types, model } from 'mongoose';
+import { Schema, model, Types } from "mongoose";
 
-const folderSchema = new Schema({
+export type TFolderRootSchema = {
+  _id: Types.ObjectId;
+  workspace: Types.ObjectId;
+  environment: string;
+  nodes: TFolderSchema;
+};
+
+export type TFolderSchema = {
+  id: string;
+  name: string;
+  version: number;
+  children: TFolderSchema[];
+};
+
+const folderSchema = new Schema<TFolderSchema>({
+  id: {
+    required: true,
+    type: String,
+  },
+  version: {
+    required: true,
+    type: Number,
+    default: 1,
+  },
   name: {
-    type: String,
     required: true,
-  },
-  workspace: {
-    type: Schema.Types.ObjectId,
-    ref: 'Workspace',
-    required: true,
-  },
-  environment: {
     type: String,
-    required: true,
+    default: "root",
   },
-  parent: {
-    type: Schema.Types.ObjectId,
-    ref: 'Folder',
-    required: false, // optional for root folders
-  },
-  path: {
-    type: String,
-    required: true
-  },
-  parentPath: {
-    type: String,
-    required: true,
-  },
-}, {
-  timestamps: true
 });
 
-const Folder = model('Folder', folderSchema);
+folderSchema.add({ children: [folderSchema] });
 
-export default Folder;
+const folderRootSchema = new Schema<TFolderRootSchema>(
+  {
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace",
+      required: true,
+    },
+    environment: {
+      type: String,
+      required: true,
+    },
+    nodes: folderSchema,
+  },
+  {
+    timestamps: true,
+  }
+);
+
+const Folder = model<TFolderRootSchema>("Folder", folderRootSchema);
+
+export default Folder;

backend/src/models/index.ts

@@ -16,7 +16,7 @@ import ServiceAccountKey, { IServiceAccountKey } from './serviceAccountKey'; //
 import ServiceAccountOrganizationPermission, { IServiceAccountOrganizationPermission } from './serviceAccountOrganizationPermission'; // new
 import ServiceAccountWorkspacePermission, { IServiceAccountWorkspacePermission } from './serviceAccountWorkspacePermission'; // new
 import TokenData, { ITokenData } from './tokenData';
-import User, { IUser } from './user';
+import User,{ AuthProvider, IUser } from './user';
 import UserAction, { IUserAction } from './userAction';
 import Workspace, { IWorkspace } from './workspace';
 import ServiceTokenData, { IServiceTokenData } from './serviceTokenData';
@@ -24,6 +24,7 @@ import APIKeyData, { IAPIKeyData } from './apiKeyData';
 import LoginSRPDetail, { ILoginSRPDetail } from './loginSRPDetail';
 
 export {
+	AuthProvider,
 	BackupPrivateKey,
 	IBackupPrivateKey,
 	Bot,

backend/src/models/loginSRPDetail.ts

@@ -5,6 +5,7 @@ export interface ILoginSRPDetail {
 	clientPublicKey: string;
 	email: string;
 	serverBInt: mongoose.Schema.Types.Buffer;
+	userId: string;
 	expireAt: Date;
 }
 
@@ -16,7 +17,6 @@ const loginSRPDetailSchema = new Schema<ILoginSRPDetail>(
 		},
 		email: {
 			type: String,
-			required: true,
 			unique: true
 		},
 		serverBInt: { type: mongoose.Schema.Types.Buffer },

backend/src/models/secret.ts

@@ -1,154 +1,144 @@
-import { Schema, model, Types } from 'mongoose';
+import { Schema, model, Types } from "mongoose";
 import {
-	SECRET_SHARED,
-	SECRET_PERSONAL,
-	ALGORITHM_AES_256_GCM,
-	ENCODING_SCHEME_UTF8,
-	ENCODING_SCHEME_BASE64
-} from '../variables';
-import { ROOT_FOLDER_PATH } from '../utils/folder';
+  SECRET_SHARED,
+  SECRET_PERSONAL,
+  ALGORITHM_AES_256_GCM,
+  ENCODING_SCHEME_UTF8,
+  ENCODING_SCHEME_BASE64,
+} from "../variables";
 
 export interface ISecret {
-	_id: Types.ObjectId;
-	version: number;
-	workspace: Types.ObjectId;
-	type: string;
-	user: Types.ObjectId;
-	environment: string;
-	secretBlindIndex?: string;
-	secretKeyCiphertext: string;
-	secretKeyIV: string;
-	secretKeyTag: string;
-	secretKeyHash: string;
-	secretValueCiphertext: string;
-	secretValueIV: string;
-	secretValueTag: string;
-	secretValueHash: string;
-	secretCommentCiphertext?: string;
-	secretCommentIV?: string;
-	secretCommentTag?: string;
-	secretCommentHash?: string;
-	algorithm: 'aes-256-gcm';
-	keyEncoding: 'utf8' | 'base64';
-	tags?: string[];
-	path?: string;
-	folder?: Types.ObjectId;
+  _id: Types.ObjectId;
+  version: number;
+  workspace: Types.ObjectId;
+  type: string;
+  user: Types.ObjectId;
+  environment: string;
+  secretBlindIndex?: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretKeyHash: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  secretValueHash: string;
+  secretCommentCiphertext?: string;
+  secretCommentIV?: string;
+  secretCommentTag?: string;
+  secretCommentHash?: string;
+  algorithm: "aes-256-gcm";
+  keyEncoding: "utf8" | "base64";
+  tags?: string[];
+  folder?: string;
 }
 
 const secretSchema = new Schema<ISecret>(
-	{
-		version: {
-			type: Number,
-			required: true,
-			default: 1
-		},
-		workspace: {
-			type: Schema.Types.ObjectId,
-			ref: 'Workspace',
-			required: true
-		},
-		type: {
-			type: String,
-			enum: [SECRET_SHARED, SECRET_PERSONAL],
-			required: true
-		},
-		user: {
-			// user associated with the personal secret
-			type: Schema.Types.ObjectId,
-			ref: 'User'
-		},
-		tags: {
-			ref: 'Tag',
-			type: [Schema.Types.ObjectId],
-			default: []
-		},
-		environment: {
-			type: String,
-			required: true
-		},
-		secretBlindIndex: {
-			type: String,
-			select: false
-		},
-		secretKeyCiphertext: {
-			type: String,
-			required: true
-		},
-		secretKeyIV: {
-			type: String, // symmetric
-			required: true
-		},
-		secretKeyTag: {
-			type: String, // symmetric
-			required: true
-		},
-		secretKeyHash: {
-			type: String
-		},
-		secretValueCiphertext: {
-			type: String,
-			required: true
-		},
-		secretValueIV: {
-			type: String, // symmetric
-			required: true
-		},
-		secretValueTag: {
-			type: String, // symmetric
-			required: true
-		},
-		secretValueHash: {
-			type: String
-		},
-		secretCommentCiphertext: {
-			type: String,
-			required: false
-		},
-		secretCommentIV: {
-			type: String, // symmetric
-			required: false
-		},
-		secretCommentTag: {
-			type: String, // symmetric
-			required: false
-		},
-		secretCommentHash: {
-			type: String,
-			required: false
-		},
-		algorithm: { // the encryption algorithm used
-			type: String,
-			enum: [ALGORITHM_AES_256_GCM],
-			required: true
-		},
-		keyEncoding: {
-			type: String,
-			enum: [
-				ENCODING_SCHEME_UTF8,
-				ENCODING_SCHEME_BASE64
-			],
-			required: true
-		},
-		// the full path to the secret in relation to folders
-		path: {
-			type: String,
-			required: false,
-			default: ROOT_FOLDER_PATH
-		},
-		folder: {
-			type: Schema.Types.ObjectId,
-			ref: 'Folder',
-			required: false,
-		},
-	},
-	{
-		timestamps: true
-	}
+  {
+    version: {
+      type: Number,
+      required: true,
+      default: 1,
+    },
+    workspace: {
+      type: Schema.Types.ObjectId,
+      ref: "Workspace",
+      required: true,
+    },
+    type: {
+      type: String,
+      enum: [SECRET_SHARED, SECRET_PERSONAL],
+      required: true,
+    },
+    user: {
+      // user associated with the personal secret
+      type: Schema.Types.ObjectId,
+      ref: "User",
+    },
+    tags: {
+      ref: "Tag",
+      type: [Schema.Types.ObjectId],
+      default: [],
+    },
+    environment: {
+      type: String,
+      required: true,
+    },
+    secretBlindIndex: {
+      type: String,
+      select: false,
+    },
+    secretKeyCiphertext: {
+      type: String,
+      required: true,
+    },
+    secretKeyIV: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretKeyTag: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretKeyHash: {
+      type: String,
+    },
+    secretValueCiphertext: {
+      type: String,
+      required: true,
+    },
+    secretValueIV: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretValueTag: {
+      type: String, // symmetric
+      required: true,
+    },
+    secretValueHash: {
+      type: String,
+    },
+    secretCommentCiphertext: {
+      type: String,
+      required: false,
+    },
+    secretCommentIV: {
+      type: String, // symmetric
+      required: false,
+    },
+    secretCommentTag: {
+      type: String, // symmetric
+      required: false,
+    },
+    secretCommentHash: {
+      type: String,
+      required: false,
+    },
+    algorithm: {
+      // the encryption algorithm used
+      type: String,
+      enum: [ALGORITHM_AES_256_GCM],
+      required: true,
+      default: ALGORITHM_AES_256_GCM,
+    },
+    keyEncoding: {
+      type: String,
+      enum: [ENCODING_SCHEME_UTF8, ENCODING_SCHEME_BASE64],
+      required: true,
+      default: ENCODING_SCHEME_UTF8,
+    },
+    folder: {
+      type: String,
+      default: "root",
+    },
+  },
+  {
+    timestamps: true,
+  }
 );
 
+secretSchema.index({ tags: 1 }, { background: true });
 
-secretSchema.index({ tags: 1 }, { background: true })
-
-const Secret = model<ISecret>('Secret', secretSchema);
+const Secret = model<ISecret>("Secret", secretSchema);
 
 export default Secret;

backend/src/models/user.ts

@@ -1,7 +1,13 @@
 import { Schema, model, Types, Document } from 'mongoose';
 
+export enum AuthProvider {
+	GOOGLE = 'google',
+}
+
 export interface IUser extends Document {
 	_id: Types.ObjectId;
+	authId?: string;
+	authProvider?: AuthProvider;
 	email: string;
 	firstName?: string;
 	lastName?: string;
@@ -26,9 +32,17 @@ export interface IUser extends Document {
 
 const userSchema = new Schema<IUser>(
 	{
+		authId: {
+			type: String,
+		},
+		authProvider: {
+			type: String,
+			enum: AuthProvider,
+		},
 		email: {
 			type: String,
-			required: true
+			required: true,
+			unique: true,
 		},
 		firstName: {
 			type: String

backend/src/routes/v1/auth.ts

@@ -1,6 +1,7 @@
 import express from 'express';
 const router = express.Router();
 import { body } from 'express-validator';
+import passport from 'passport';
 import { requireAuth, validateRequest } from '../../middleware';
 import { authController } from '../../controllers/v1';
 import { authLimiter } from '../../helpers/rateLimiter';
@@ -27,20 +28,37 @@ router.post( // deprecated (moved to api/v2/auth/login2)
 );
 
 router.post(
-  '/logout', 
+  '/logout',
   authLimiter,
   requireAuth({
     acceptedAuthModes: [AUTH_MODE_JWT]
-  }), 
+  }),
   authController.logout
 );
 
 router.post(
-  '/checkAuth', 
+  '/checkAuth',
   requireAuth({
     acceptedAuthModes: [AUTH_MODE_JWT]
-  }), 
+  }),
   authController.checkAuth
 );
 
+
+
+router.get(
+  '/redirect/google',
+  authLimiter,
+  passport.authenticate('google', {
+    scope: ['profile', 'email'],
+    session: false,
+  }),
+)
+
+router.get(
+  '/callback/google',
+  passport.authenticate('google', { failureRedirect: '/login/provider/error', session: false }),
+  authController.handleAuthProviderCallback,
+)
+
 export default router;

backend/src/routes/v1/index.ts

@@ -15,7 +15,7 @@ import password from './password';
 import stripe from './stripe';
 import integration from './integration';
 import integrationAuth from './integrationAuth';
-import secretsFolder from './secretsFolder'
+import secretsFolder from './secretsFolder';
 
 export {
 	signup,

backend/src/routes/v1/secretsFolder.ts

@@ -1,50 +1,70 @@
-import express, { Request, Response } from 'express';
+import express from "express";
 const router = express.Router();
 import {
   requireAuth,
   requireWorkspaceAuth,
-  validateRequest
-} from '../../middleware';
-import { body, param } from 'express-validator';
-import { createFolder, deleteFolder, getFolderById } from '../../controllers/v1/secretsFolderController';
-import { ADMIN, MEMBER } from '../../variables';
+  validateRequest,
+} from "../../middleware";
+import { body, param, query } from "express-validator";
+import {
+  createFolder,
+  deleteFolder,
+  getFolders,
+  updateFolderById,
+} from "../../controllers/v1/secretsFolderController";
+import { ADMIN, MEMBER } from "../../variables";
 
 router.post(
-  '/',
+  "/",
   requireAuth({
-    acceptedAuthModes: ['jwt']
+    acceptedAuthModes: ["jwt"],
   }),
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER],
-    locationWorkspaceId: 'body'
+    locationWorkspaceId: "body",
   }),
-  body('workspaceId').exists(),
-  body('environment').exists(),
-  body('folderName').exists(),
-  body('parentFolderId'),
+  body("workspaceId").exists(),
+  body("environment").exists(),
+  body("folderName").exists(),
+  body("parentFolderId"),
   validateRequest,
   createFolder
 );
 
-router.delete(
-  '/:folderId',
+router.patch(
+  "/:folderId",
   requireAuth({
-    acceptedAuthModes: ['jwt']
+    acceptedAuthModes: ["jwt"],
   }),
-  param('folderId').exists(),
+  body("workspaceId").exists(),
+  body("environment").exists(),
+  param("folderId").not().isIn(["root"]).exists(),
+  validateRequest,
+  updateFolderById
+);
+
+router.delete(
+  "/:folderId",
+  requireAuth({
+    acceptedAuthModes: ["jwt"],
+  }),
+  body("workspaceId").exists(),
+  body("environment").exists(),
+  param("folderId").not().isIn(["root"]).exists(),
   validateRequest,
   deleteFolder
 );
 
 router.get(
-  '/:folderId',
+  "/",
   requireAuth({
-    acceptedAuthModes: ['jwt']
+    acceptedAuthModes: ["jwt"],
   }),
-  param('folderId').exists(),
+  query("workspaceId").exists().isString().trim(),
+  query("environment").exists().isString().trim(),
+  query("parentFolderId").optional().isString().trim(),
   validateRequest,
-  getFolderById
+  getFolders
 );
 
-
-export default router;
+export default router;

backend/src/routes/v2/secrets.ts

@@ -2,204 +2,233 @@ import express from 'express';
 const router = express.Router();
 import { Types } from 'mongoose';
 import {
-    requireAuth,
-    requireWorkspaceAuth,
-    requireSecretsAuth,
-    validateRequest
+  requireAuth,
+  requireWorkspaceAuth,
+  requireSecretsAuth,
+  validateRequest,
 } from '../../middleware';
 import { validateClientForSecrets } from '../../validation';
 import { query, body } from 'express-validator';
 import { secretsController } from '../../controllers/v2';
 import {
-    ADMIN,
-    MEMBER,
-    SECRET_PERSONAL,
-    SECRET_SHARED,
-    PERMISSION_READ_SECRETS,
-    PERMISSION_WRITE_SECRETS,
-    AUTH_MODE_JWT,
-    AUTH_MODE_SERVICE_ACCOUNT,
-    AUTH_MODE_SERVICE_TOKEN,
-    AUTH_MODE_API_KEY
+  ADMIN,
+  MEMBER,
+  SECRET_PERSONAL,
+  SECRET_SHARED,
+  PERMISSION_READ_SECRETS,
+  PERMISSION_WRITE_SECRETS,
+  AUTH_MODE_JWT,
+  AUTH_MODE_SERVICE_ACCOUNT,
+  AUTH_MODE_SERVICE_TOKEN,
+  AUTH_MODE_API_KEY,
 } from '../../variables';
-import {
-    BatchSecretRequest
-} from '../../types/secret';
+import { BatchSecretRequest } from '../../types/secret';
 
 router.post(
-    '/batch',
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        locationWorkspaceId: 'body'
-    }),
-    body('workspaceId').exists().isString().trim(),
-    body('environment').exists().isString().trim(),
-    body('requests')
-        .exists()
-        .custom(async (requests: BatchSecretRequest[], { req }) => {
-            if (Array.isArray(requests)) {
-                const secretIds = requests
-                    .map((request) => request.secret._id)
-                    .filter((secretId) => secretId !== undefined)
+  '/batch',
+  requireAuth({
+    acceptedAuthModes: [
+      AUTH_MODE_JWT,
+      AUTH_MODE_API_KEY,
+      AUTH_MODE_SERVICE_TOKEN,
+    ],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: 'body',
+  }),
+  body('workspaceId').exists().isString().trim(),
+  body('folderId').default('root').isString().trim(),
+  body('environment').exists().isString().trim(),
+  body('requests')
+    .exists()
+    .custom(async (requests: BatchSecretRequest[], { req }) => {
+      if (Array.isArray(requests)) {
+        const secretIds = requests
+          .map((request) => request.secret._id)
+          .filter((secretId) => secretId !== undefined);
 
-                if (secretIds.length > 0) {
-                    req.secrets = await validateClientForSecrets({
-                        authData: req.authData,
-                        secretIds: secretIds.map((secretId: string) => new Types.ObjectId(secretId)),
-                        requiredPermissions: []
-                    });
-                }
-            }
-            return true;
-        }),
-    validateRequest,
-    secretsController.batchSecrets
+        if (secretIds.length > 0) {
+          req.secrets = await validateClientForSecrets({
+            authData: req.authData,
+            secretIds: secretIds.map(
+              (secretId: string) => new Types.ObjectId(secretId)
+            ),
+            requiredPermissions: [],
+          });
+        }
+      }
+      return true;
+    }),
+  validateRequest,
+  secretsController.batchSecrets
 );
 
 router.post(
-    '/',
-    body('workspaceId').exists().isString().trim(),
-    body('environment').exists().isString().trim(),
-    body('secrets')
-        .exists()
-        .custom((value) => {
-            if (Array.isArray(value)) {
-                // case: create multiple secrets
-                if (value.length === 0) throw new Error('secrets cannot be an empty array')
-                for (const secret of value) {
-                    if (
-                        !secret.type ||
-                        !(secret.type === SECRET_PERSONAL || secret.type === SECRET_SHARED) ||
-                        !secret.secretKeyCiphertext ||
-                        !secret.secretKeyIV ||
-                        !secret.secretKeyTag ||
-                        (typeof secret.secretValueCiphertext !== 'string') ||
-                        !secret.secretValueIV ||
-                        !secret.secretValueTag
-                    ) {
-                        throw new Error('secrets array must contain objects that have required secret properties');
-                    }
-                }
-            } else if (typeof value === 'object') {
-                // case: update 1 secret
-                if (
-                    !value.type ||
-                    !(value.type === SECRET_PERSONAL || value.type === SECRET_SHARED) ||
-                    !value.secretKeyCiphertext ||
-                    !value.secretKeyIV ||
-                    !value.secretKeyTag ||
-                    !value.secretValueCiphertext ||
-                    !value.secretValueIV ||
-                    !value.secretValueTag
-                ) {
-                    throw new Error('secrets object is missing required secret properties');
-                }
-            } else {
-                throw new Error('secrets must be an object or an array of objects')
-            }
+  '/',
+  body('workspaceId').exists().isString().trim(),
+  body('environment').exists().isString().trim(),
+  body('folderId').default('root').isString().trim(),
+  body('secrets')
+    .exists()
+    .custom((value) => {
+      if (Array.isArray(value)) {
+        // case: create multiple secrets
+        if (value.length === 0)
+          throw new Error('secrets cannot be an empty array');
+        for (const secret of value) {
+          if (
+            !secret.type ||
+            !(
+              secret.type === SECRET_PERSONAL || secret.type === SECRET_SHARED
+            ) ||
+            !secret.secretKeyCiphertext ||
+            !secret.secretKeyIV ||
+            !secret.secretKeyTag ||
+            typeof secret.secretValueCiphertext !== 'string' ||
+            !secret.secretValueIV ||
+            !secret.secretValueTag
+          ) {
+            throw new Error(
+              'secrets array must contain objects that have required secret properties'
+            );
+          }
+        }
+      } else if (typeof value === 'object') {
+        // case: update 1 secret
+        if (
+          !value.type ||
+          !(value.type === SECRET_PERSONAL || value.type === SECRET_SHARED) ||
+          !value.secretKeyCiphertext ||
+          !value.secretKeyIV ||
+          !value.secretKeyTag ||
+          !value.secretValueCiphertext ||
+          !value.secretValueIV ||
+          !value.secretValueTag
+        ) {
+          throw new Error(
+            'secrets object is missing required secret properties'
+          );
+        }
+      } else {
+        throw new Error('secrets must be an object or an array of objects');
+      }
 
-            return true;
-        }),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+      return true;
     }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        locationWorkspaceId: 'body',
-        locationEnvironment: 'body',
-        requiredPermissions: [PERMISSION_WRITE_SECRETS]
-    }),
-    secretsController.createSecrets
+  validateRequest,
+  requireAuth({
+    acceptedAuthModes: [
+      AUTH_MODE_JWT,
+      AUTH_MODE_API_KEY,
+      AUTH_MODE_SERVICE_TOKEN,
+    ],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: 'body',
+    locationEnvironment: 'body',
+    requiredPermissions: [PERMISSION_WRITE_SECRETS],
+  }),
+  secretsController.createSecrets
 );
 
 router.get(
-    '/',
-    query('workspaceId').exists().trim(),
-    query('environment').exists().trim(),
-    query('tagSlugs'),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN, AUTH_MODE_SERVICE_ACCOUNT]
-    }),
-    requireWorkspaceAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        locationWorkspaceId: 'query',
-        locationEnvironment: 'query',
-        requiredPermissions: [PERMISSION_READ_SECRETS]
-    }),
-    secretsController.getSecrets
+  '/',
+  query('workspaceId').exists().trim(),
+  query('environment').exists().trim(),
+  query('tagSlugs'),
+  query('folderId').default('root').isString().trim(),
+  validateRequest,
+  requireAuth({
+    acceptedAuthModes: [
+      AUTH_MODE_JWT,
+      AUTH_MODE_API_KEY,
+      AUTH_MODE_SERVICE_TOKEN,
+      AUTH_MODE_SERVICE_ACCOUNT,
+    ],
+  }),
+  requireWorkspaceAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    locationWorkspaceId: 'query',
+    locationEnvironment: 'query',
+    requiredPermissions: [PERMISSION_READ_SECRETS],
+  }),
+  secretsController.getSecrets
 );
 
 router.patch(
-    '/',
-    body('secrets')
-        .exists()
-        .custom((value) => {
-            if (Array.isArray(value)) {
-                // case: update multiple secrets
-                if (value.length === 0) throw new Error('secrets cannot be an empty array')
-                for (const secret of value) {
-                    if (
-                        !secret.id
-                    ) {
-                        throw new Error('Each secret must contain a ID property');
-                    }
-                }
-            } else if (typeof value === 'object') {
-                // case: update 1 secret
-                if (
-                    !value.id
-                ) {
-                    throw new Error('secret must contain a ID property');
-                }
-            } else {
-                throw new Error('secrets must be an object or an array of objects')
-            }
+  '/',
+  body('secrets')
+    .exists()
+    .custom((value) => {
+      if (Array.isArray(value)) {
+        // case: update multiple secrets
+        if (value.length === 0)
+          throw new Error('secrets cannot be an empty array');
+        for (const secret of value) {
+          if (!secret.id) {
+            throw new Error('Each secret must contain a ID property');
+          }
+        }
+      } else if (typeof value === 'object') {
+        // case: update 1 secret
+        if (!value.id) {
+          throw new Error('secret must contain a ID property');
+        }
+      } else {
+        throw new Error('secrets must be an object or an array of objects');
+      }
 
-            return true;
-        }),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
+      return true;
     }),
-    requireSecretsAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        requiredPermissions: [PERMISSION_WRITE_SECRETS]
-    }),
-    secretsController.updateSecrets
+  validateRequest,
+  requireAuth({
+    acceptedAuthModes: [
+      AUTH_MODE_JWT,
+      AUTH_MODE_API_KEY,
+      AUTH_MODE_SERVICE_TOKEN,
+    ],
+  }),
+  requireSecretsAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    requiredPermissions: [PERMISSION_WRITE_SECRETS],
+  }),
+  secretsController.updateSecrets
 );
 
 router.delete(
-    '/',
-    body('secretIds')
-        .exists()
-        .custom((value) => {
-            // case: delete 1 secret
-            if (typeof value === 'string') return true;
+  '/',
+  body('secretIds')
+    .exists()
+    .custom((value) => {
+      // case: delete 1 secret
+      if (typeof value === 'string') return true;
 
-            if (Array.isArray(value)) {
-                // case: delete multiple secrets
-                if (value.length === 0) throw new Error('secrets cannot be an empty array');
-                return value.every((id: string) => typeof id === 'string')
-            }
+      if (Array.isArray(value)) {
+        // case: delete multiple secrets
+        if (value.length === 0)
+          throw new Error('secrets cannot be an empty array');
+        return value.every((id: string) => typeof id === 'string');
+      }
 
-            throw new Error('secretIds must be a string or an array of strings');
-        })
-        .not()
-        .isEmpty(),
-    validateRequest,
-    requireAuth({
-        acceptedAuthModes: [AUTH_MODE_JWT, AUTH_MODE_API_KEY, AUTH_MODE_SERVICE_TOKEN]
-    }),
-    requireSecretsAuth({
-        acceptedRoles: [ADMIN, MEMBER],
-        requiredPermissions: [PERMISSION_WRITE_SECRETS]
-    }),
-    secretsController.deleteSecrets
+      throw new Error('secretIds must be a string or an array of strings');
+    })
+    .not()
+    .isEmpty(),
+  validateRequest,
+  requireAuth({
+    acceptedAuthModes: [
+      AUTH_MODE_JWT,
+      AUTH_MODE_API_KEY,
+      AUTH_MODE_SERVICE_TOKEN,
+    ],
+  }),
+  requireSecretsAuth({
+    acceptedRoles: [ADMIN, MEMBER],
+    requiredPermissions: [PERMISSION_WRITE_SECRETS],
+  }),
+  secretsController.deleteSecrets
 );
 
-export default router;
+export default router;

backend/src/routes/v3/auth.ts

@@ -0,0 +1,29 @@
+import express from 'express';
+import { body } from 'express-validator';
+import { validateRequest } from '../../middleware';
+import { authController } from '../../controllers/v3';
+import { authLimiter } from '../../helpers/rateLimiter';
+
+const router = express.Router();
+
+router.post(
+    '/login1',
+    authLimiter,
+    body('email').isString().trim(),
+    body('providerAuthToken').isString().trim().optional({nullable: true}),
+    body('clientPublicKey').isString().trim().notEmpty(),
+    validateRequest,
+    authController.login1
+);
+
+router.post(
+    '/login2',
+    authLimiter,
+    body('email').isString().trim(),
+    body('providerAuthToken').isString().trim().optional({nullable: true}),
+    body('clientProof').isString().trim().notEmpty(),
+    validateRequest,
+    authController.login2
+);
+
+export default router;

backend/src/routes/v3/index.ts

@@ -1,7 +1,11 @@
+import auth from './auth';
 import secrets from './secrets';
 import workspaces from './workspaces';
+import signup from './signup';
 
 export {
+    auth,
     secrets,
-    workspaces
-}
+    signup,
+    workspaces,
+}

backend/src/routes/v3/signup.ts

@@ -0,0 +1,29 @@
+import express from 'express';
+const router = express.Router();
+import { body } from 'express-validator';
+import { signupController } from '../../controllers/v3';
+import { authLimiter } from '../../helpers/rateLimiter';
+import { validateRequest } from '../../middleware';
+
+router.post(
+    '/complete-account/signup',
+    authLimiter,
+    body('email').exists().isString().trim().notEmpty().isEmail(),
+	body('firstName').exists().isString().trim().notEmpty(),
+	body('lastName').exists().isString().trim().optional({nullable: true}),
+	body('protectedKey').exists().isString().trim().notEmpty(),
+	body('protectedKeyIV').exists().isString().trim().notEmpty(),
+	body('protectedKeyTag').exists().isString().trim().notEmpty(),
+	body('publicKey').exists().isString().trim().notEmpty(),
+	body('encryptedPrivateKey').exists().isString().trim().notEmpty(),
+	body('encryptedPrivateKeyIV').exists().isString().trim().notEmpty(),
+	body('encryptedPrivateKeyTag').exists().isString().trim().notEmpty(),
+	body('salt').exists().isString().trim().notEmpty(),
+	body('verifier').exists().isString().trim().notEmpty(),
+	body('organizationName').exists().isString().trim().notEmpty(),
+	body('providerAuthToken').isString().trim().optional({nullable: true}),
+    validateRequest,
+    signupController.completeAccountSignup,
+);
+
+export default router;

backend/src/services/FolderService.ts

@@ -0,0 +1,189 @@
+import { nanoid } from "nanoid";
+import { TFolderSchema } from "../models/folder";
+
+type TAppendFolderDTO = {
+  folderName: string;
+  parentFolderId?: string;
+};
+
+type TRenameFolderDTO = {
+  folderName: string;
+  folderId: string;
+};
+
+export const validateFolderName = (folderName: string) => {
+  const validNameRegex = /^[a-zA-Z0-9-_]+$/;
+  return validNameRegex.test(folderName);
+};
+
+export const generateFolderId = (): string => nanoid(12);
+
+// simple bfs search
+export const searchByFolderId = (
+  root: TFolderSchema,
+  folderId: string
+): TFolderSchema | undefined => {
+  const queue = [root];
+  while (queue.length) {
+    const folder = queue.pop() as TFolderSchema;
+    if (folder.id === folderId) {
+      return folder;
+    }
+    queue.push(...folder.children);
+  }
+};
+
+export const folderBfsTraversal = async (
+  root: TFolderSchema,
+  callback: (data: TFolderSchema) => void | Promise<void>
+) => {
+  const queue = [root];
+  while (queue.length) {
+    const folder = queue.pop() as TFolderSchema;
+    await callback(folder);
+    queue.push(...folder.children);
+  }
+};
+
+// bfs and then append to the folder
+const appendChild = (folders: TFolderSchema, folderName: string) => {
+  const folder = folders.children.find(({ name }) => name === folderName);
+  if (folder) {
+    throw new Error("Folder already exists");
+  }
+  const id = generateFolderId();
+  folders.version += 1;
+  folders.children.push({
+    id,
+    name: folderName,
+    children: [],
+    version: 1,
+  });
+  return { id, name: folderName };
+};
+
+// root of append child wrapper
+export const appendFolder = (
+  folders: TFolderSchema,
+  { folderName, parentFolderId }: TAppendFolderDTO
+) => {
+  const isRoot = !parentFolderId;
+
+  if (isRoot) {
+    return appendChild(folders, folderName);
+  }
+  const folder = searchByFolderId(folders, parentFolderId);
+  if (!folder) {
+    throw new Error("Parent Folder not found");
+  }
+  return appendChild(folder, folderName);
+};
+
+export const renameFolder = (
+  folders: TFolderSchema,
+  { folderName, folderId }: TRenameFolderDTO
+) => {
+  const folder = searchByFolderId(folders, folderId);
+  if (!folder) {
+    throw new Error("Folder doesn't exist");
+  }
+
+  folder.name = folderName;
+};
+
+// bfs but stops on parent folder
+// Then unmount the required child and then return both
+export const deleteFolderById = (folders: TFolderSchema, folderId: string) => {
+  const queue = [folders];
+  while (queue.length) {
+    const folder = queue.pop() as TFolderSchema;
+    const index = folder.children.findIndex(({ id }) => folderId === id);
+    if (index !== -1) {
+      const deletedFolder = folder.children.splice(index, 1);
+      return { deletedNode: deletedFolder[0], parent: folder };
+    }
+    queue.push(...folder.children);
+  }
+};
+
+// bfs but return parent of the folderID
+export const getParentFromFolderId = (
+  folders: TFolderSchema,
+  folderId: string
+) => {
+  const queue = [folders];
+  while (queue.length) {
+    const folder = queue.pop() as TFolderSchema;
+    const index = folder.children.findIndex(({ id }) => folderId === id);
+    if (index !== -1) return folder;
+
+    queue.push(...folder.children);
+  }
+};
+
+// to get all folders ids from everything from below nodes
+export const getAllFolderIds = (folders: TFolderSchema) => {
+  const folderIds: Array<{ id: string; name: string }> = [];
+  const queue = [folders];
+  while (queue.length) {
+    const folder = queue.pop() as TFolderSchema;
+    folderIds.push({ id: folder.id, name: folder.name });
+    queue.push(...folder.children);
+  }
+  return folderIds;
+};
+
+// To get the path of a folder from the root. Used for breadcrumbs
+// LOGIC: We do dfs instead if bfs
+// Each time we go down we record the current node
+// We then record the number of childs of each root node
+// When we reach leaf node or when all childs of a root node are visited
+// We remove it from path recorded by using the total child record
+export const searchByFolderIdWithDir = (
+  folders: TFolderSchema,
+  folderId: string
+) => {
+  const stack = [folders];
+  const dir: Array<{ id: string; name: string }> = [];
+  const hits: Record<string, number> = {};
+
+  while (stack.length) {
+    const folder = stack.shift() as TFolderSchema;
+    // score the hit
+    hits[folder.id] = folder.children.length;
+    const parent = dir[dir.length - 1];
+    if (parent) hits[parent.id] -= 1;
+
+    if (folder.id === folderId) {
+      dir.push({ name: folder.name, id: folder.id });
+      return { folder, dir };
+    }
+
+    if (folder.children.length) {
+      dir.push({ name: folder.name, id: folder.id });
+      stack.unshift(...folder.children);
+    } else {
+      if (!hits[parent.id]) {
+        dir.pop();
+      }
+    }
+  }
+  return;
+};
+
+// to get folder of a path given
+// Like /frontend/folder#1
+export const getFolderByPath = (folders: TFolderSchema, searchPath: string) => {
+  const path = searchPath.split("/").filter(Boolean);
+  const queue = [folders];
+  let segment: TFolderSchema | undefined;
+  while (queue.length && path.length) {
+    const folder = queue.pop();
+    const segmentPath = path.shift();
+    segment = folder?.children.find(({ name }) => name === segmentPath);
+    if (!segment) return;
+
+    queue.push(segment);
+  }
+  return segment;
+};

backend/src/services/smtp.ts

@@ -1,6 +1,6 @@
 import nodemailer from 'nodemailer';
 import {
-  SMTP_HOST_SENDGRID, 
+  SMTP_HOST_SENDGRID,
   SMTP_HOST_MAILGUN,
   SMTP_HOST_SOCKETLABS,
   SMTP_HOST_ZOHOMAIL,
@@ -35,29 +35,29 @@ export const initSmtp = async () => {
         mailOpts.requireTLS = true;
         break;
       case SMTP_HOST_MAILGUN:
-        mailOpts.requireTLS = true; 
+        mailOpts.requireTLS = true;
         mailOpts.tls = {
           ciphers: 'TLSv1.2'
         }
         break;
       case SMTP_HOST_SOCKETLABS:
-        mailOpts.requireTLS = true; 
+        mailOpts.requireTLS = true;
         mailOpts.tls = {
           ciphers: 'TLSv1.2'
         }
         break;
       case SMTP_HOST_ZOHOMAIL:
-        mailOpts.requireTLS = true; 
+        mailOpts.requireTLS = true;
         mailOpts.tls = {
           ciphers: 'TLSv1.2'
         }
         break;
       case SMTP_HOST_GMAIL:
-        mailOpts.requireTLS = true; 
+        mailOpts.requireTLS = true;
         mailOpts.tls = {
           ciphers: 'TLSv1.2'
         }
-        break; 
+        break;
       default:
         if ((await getSmtpHost()).includes('amazonaws.com')) {
           mailOpts.tls = {
@@ -76,6 +76,7 @@ export const initSmtp = async () => {
     .then((err) => {
       Sentry.setUser(null);
       Sentry.captureMessage('SMTP - Successfully connected');
+      console.log("SMTP - Successfully connected")
     })
     .catch(async (err) => {
       Sentry.setUser(null);

backend/src/types/express/index.d.ts

@@ -9,6 +9,12 @@ import {
 	AuthData
 } from '../../interfaces/middleware';
 
+declare module 'express' {
+	interface Request {
+		user?: any;
+	}
+}
+
 // TODO: fix (any) types
 declare global {
 	namespace Express {
@@ -18,6 +24,7 @@ declare global {
 			workspace: any;
 			membership: any;
 			targetMembership: any;
+			providerAuthToken: any;
 			organization: any;
 			membershipOrg: any;
 			integration: any;

backend/src/types/secret/index.d.ts

@@ -1,53 +1,46 @@
-import { Types } from 'mongoose';
-import { Assign, Omit } from 'utility-types';
-import { ISecret } from '../../models';
-import { mongo } from 'mongoose';
+import { Types } from "mongoose";
+import { Assign, Omit } from "utility-types";
+import { ISecret } from "../../models";
+import { mongo } from "mongoose";
 
 // Everything is required, except the omitted types
-export type CreateSecretRequestBody = Omit<ISecret, "user" | "version" | "environment" | "workspace">;
+export type CreateSecretRequestBody = Omit<
+  ISecret,
+  "user" | "version" | "environment" | "workspace"
+>;
 
-// Omit the listed properties, then make everything optional and then make _id required 
-export type ModifySecretRequestBody = Assign<Partial<Omit<ISecret, "user" | "version" | "environment" | "workspace">>, { _id: string }>;
+// Omit the listed properties, then make everything optional and then make _id required
+export type ModifySecretRequestBody = Assign<
+  Partial<Omit<ISecret, "user" | "version" | "environment" | "workspace">>,
+  { _id: string }
+>;
 
 // Used for modeling sanitized secrets before uplaod. To be used for converting user input for uploading
-export type SanitizedSecretModify = Partial<Omit<ISecret, "user" | "version" | "environment" | "workspace">>;
+export type SanitizedSecretModify = Partial<
+  Omit<ISecret, "user" | "version" | "environment" | "workspace">
+>;
 
 // Everything is required, except the omitted types
 export type SanitizedSecretForCreate = Omit<ISecret, "version" | "_id">;
 
 export interface BatchSecretRequest {
-    id: string;
-    method: 'POST' | 'PATCH' | 'DELETE';
-    secret: Secret;
+  id: string;
+  method: "POST" | "PATCH" | "DELETE";
+  secret: Secret;
 }
 
 export interface BatchSecret {
-    _id: string;
-    type: 'shared' | 'personal',
-    secretBlindIndex: string;
-    secretKeyCiphertext: string;
-    secretKeyIV: string;
-    secretKeyTag: string;
-    secretValueCiphertext: string;
-    secretValueIV: string;
-    secretValueTag: string;
-    secretCommentCiphertext: string;
-    secretCommentIV: string;
-    secretCommentTag: string;
-    tags: string[];
+  _id: string;
+  type: "shared" | "personal";
+  secretBlindIndex: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  secretCommentCiphertext: string;
+  secretCommentIV: string;
+  secretCommentTag: string;
+  tags: string[];
 }
-
-export interface BatchSecret {
-    _id: string;
-    type: 'shared' | 'personal',
-    secretKeyCiphertext: string;
-    secretKeyIV: string;
-    secretKeyTag: string;
-    secretValueCiphertext: string;
-    secretValueIV: string;
-    secretValueTag: string;
-    secretCommentCiphertext: string;
-    secretCommentIV: string;
-    secretCommentTag: string;
-    tags: string[];
-}

backend/src/utils/auth.ts

@@ -1,10 +1,22 @@
+import express from 'express';
+import passport from 'passport';
 import { AuthData } from '../interfaces/middleware';
 import {
-    User,
-    ServiceAccount,
-    ServiceTokenData,
-    ServiceToken
+  AuthProvider,
+  User,
+  ServiceAccount,
+  ServiceTokenData,
 } from '../models';
+import { createToken } from '../helpers/auth';
+import {
+  getClientIdGoogle,
+  getClientSecretGoogle,
+  getJwtProviderAuthLifetime,
+  getJwtProviderAuthSecret
+} from '../config';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const GoogleStrategy = require('passport-google-oauth20').Strategy;
 
 // TODO: find a more optimal folder structure to store these types of functions
 
@@ -14,17 +26,17 @@ import {
  * @returns 
  */
 const getAuthDataPayloadIdObj = (authData: AuthData) => {
-    if (authData.authPayload instanceof User) {
-        return { userId: authData.authPayload._id };
-    }
+  if (authData.authPayload instanceof User) {
+    return { userId: authData.authPayload._id };
+  }
 
-    if (authData.authPayload instanceof ServiceAccount) {
-        return { serviceAccountId: authData.authPayload._id };
-    }
+  if (authData.authPayload instanceof ServiceAccount) {
+    return { serviceAccountId: authData.authPayload._id };
+  }
 
-    if (authData.authPayload instanceof ServiceTokenData) {
-        return { serviceTokenDataId: authData.authPayload._id };
-    }
+  if (authData.authPayload instanceof ServiceTokenData) {
+    return { serviceTokenDataId: authData.authPayload._id };
+  }
 };
 
 
@@ -35,20 +47,72 @@ const getAuthDataPayloadIdObj = (authData: AuthData) => {
  */
 const getAuthDataPayloadUserObj = (authData: AuthData) => {
 
-    if (authData.authPayload instanceof User) {
-        return { user: authData.authPayload._id };
-    }
+  if (authData.authPayload instanceof User) {
+    return { user: authData.authPayload._id };
+  }
 
-    if (authData.authPayload instanceof ServiceAccount) {
-        return { user: authData.authPayload.user };
-    }
+  if (authData.authPayload instanceof ServiceAccount) {
+    return { user: authData.authPayload.user };
+  }
 
-    if (authData.authPayload instanceof ServiceTokenData) {
-        return { user: authData.authPayload.user };
+  if (authData.authPayload instanceof ServiceTokenData) {
+    return { user: authData.authPayload.user };
+  }
+}
+
+const initializePassport = async () => {
+  const googleClientSecret = await getClientSecretGoogle();
+  const googleClientId = await getClientIdGoogle();
+
+  passport.use(new GoogleStrategy({
+    passReqToCallback: true,
+    clientID: googleClientId,
+    clientSecret: googleClientSecret,
+    callbackURL: '/api/v1/auth/callback/google',
+    scope: ['profile', ' email'],
+  }, async (
+    req: express.Request,
+    accessToken: string,
+    refreshToken: string,
+    profile: any,
+    cb: any
+  ) => {
+    try {
+      const email = profile.emails[0].value;
+      let user = await User.findOne({
+        authProvider: AuthProvider.GOOGLE,
+        authId: profile.id,
+      }).select('+publicKey')
+
+      if (!user) {
+        user = await new User({
+          email,
+          authProvider: AuthProvider.GOOGLE,
+          authId: profile.id,
+        }).save();
+      }
+
+      const providerAuthToken = createToken({
+        payload: {
+          userId: user._id.toString(),
+          email: user.email,
+          authProvider: user.authProvider,
+          isUserCompleted: !!user.publicKey
+        },
+        expiresIn: await getJwtProviderAuthLifetime(),
+        secret: await getJwtProviderAuthSecret(),
+      });
+
+      req.providerAuthToken = providerAuthToken;
+      cb(null, profile);
+    } catch (err) {
+      cb(null, false);
     }
+  }));
 }
 
 export {
-    getAuthDataPayloadIdObj,
-    getAuthDataPayloadUserObj
-}
+  getAuthDataPayloadIdObj,
+  getAuthDataPayloadUserObj,
+  initializePassport,
+}

backend/src/utils/folder.ts

@@ -1,87 +1,87 @@
-import Folder from "../models/folder";
+// import Folder from "../models/folder";
 
-export const ROOT_FOLDER_PATH = "/"
+// export const ROOT_FOLDER_PATH = "/"
 
-export const getFolderPath = async (folderId: string) => {
-  let currentFolder = await Folder.findById(folderId);
-  const pathSegments = [];
+// export const getFolderPath = async (folderId: string) => {
+//   let currentFolder = await Folder.findById(folderId);
+//   const pathSegments = [];
 
-  while (currentFolder) {
-    pathSegments.unshift(currentFolder.name);
-    currentFolder = currentFolder.parent ? await Folder.findById(currentFolder.parent) : null;
-  }
+//   while (currentFolder) {
+//     pathSegments.unshift(currentFolder.name);
+//     currentFolder = currentFolder.parent ? await Folder.findById(currentFolder.parent) : null;
+//   }
 
-  return '/' + pathSegments.join('/');
-};
+//   return '/' + pathSegments.join('/');
+// };
 
-/**
-  Returns the folder ID associated with the specified secret path in the given workspace and environment.
-  @param workspaceId - The ID of the workspace to search in.
-  @param environment - The environment to search in.
-  @param secretPath - The secret path to search for.
-  @returns The folder ID associated with the specified secret path, or undefined if the path is at the root folder level.
-  @throws Error if the specified secret path is not found.
-*/
-export const getFolderIdFromPath = async (workspaceId: string, environment: string, secretPath: string) => {
-  const secretPathParts = secretPath.split("/").filter(path => path != "")
-  if (secretPathParts.length <= 1) {
-    return undefined // root folder, so no folder id 
-  }
+// /**
+//   Returns the folder ID associated with the specified secret path in the given workspace and environment.
+//   @param workspaceId - The ID of the workspace to search in.
+//   @param environment - The environment to search in.
+//   @param secretPath - The secret path to search for.
+//   @returns The folder ID associated with the specified secret path, or undefined if the path is at the root folder level.
+//   @throws Error if the specified secret path is not found.
+// */
+// export const getFolderIdFromPath = async (workspaceId: string, environment: string, secretPath: string) => {
+//   const secretPathParts = secretPath.split("/").filter(path => path != "")
+//   if (secretPathParts.length <= 1) {
+//     return undefined // root folder, so no folder id
+//   }
 
-  const folderId = await Folder.find({ path: secretPath, workspace: workspaceId, environment: environment })
-  if (!folderId) {
-    throw Error("Secret path not found")
-  }
+//   const folderId = await Folder.find({ path: secretPath, workspace: workspaceId, environment: environment })
+//   if (!folderId) {
+//     throw Error("Secret path not found")
+//   }
 
-  return folderId
-}
+//   return folderId
+// }
 
-/**
- * Cleans up a path by removing empty parts, duplicate slashes,
- * and ensuring it starts with ROOT_FOLDER_PATH.
- * @param path - The input path to clean up.
- * @returns The cleaned-up path string.
- */
-export const normalizePath = (path: string) => {
-  if (path == undefined || path == "" || path == ROOT_FOLDER_PATH) {
-    return ROOT_FOLDER_PATH
-  }
+// /**
+//  * Cleans up a path by removing empty parts, duplicate slashes,
+//  * and ensuring it starts with ROOT_FOLDER_PATH.
+//  * @param path - The input path to clean up.
+//  * @returns The cleaned-up path string.
+//  */
+// export const normalizePath = (path: string) => {
+//   if (path == undefined || path == "" || path == ROOT_FOLDER_PATH) {
+//     return ROOT_FOLDER_PATH
+//   }
 
-  const pathParts = path.split("/").filter(part => part != "")
-  const cleanPathString = ROOT_FOLDER_PATH + pathParts.join("/")
+//   const pathParts = path.split("/").filter(part => part != "")
+//   const cleanPathString = ROOT_FOLDER_PATH + pathParts.join("/")
 
-  return cleanPathString
-}
+//   return cleanPathString
+// }
 
-export const getFoldersInDirectory = async (workspaceId: string, environment: string, pathString: string) => {
-  const normalizedPath = normalizePath(pathString)
-  const foldersInDirectory = await Folder.find({
-    workspace: workspaceId,
-    environment: environment,
-    parentPath: normalizedPath,
-  });
+// export const getFoldersInDirectory = async (workspaceId: string, environment: string, pathString: string) => {
+//   const normalizedPath = normalizePath(pathString)
+//   const foldersInDirectory = await Folder.find({
+//     workspace: workspaceId,
+//     environment: environment,
+//     parentPath: normalizedPath,
+//   });
 
-  return foldersInDirectory;
-}
+//   return foldersInDirectory;
+// }
 
-/**
- * Returns the parent path of the given path.
- * @param path - The input path.
- * @returns The parent path string.
- */
-export const getParentPath = (path: string) => {
-  const normalizedPath = normalizePath(path);
-  const folderParts = normalizedPath.split('/').filter(part => part !== '');
+// /**
+//  * Returns the parent path of the given path.
+//  * @param path - The input path.
+//  * @returns The parent path string.
+//  */
+// export const getParentPath = (path: string) => {
+//   const normalizedPath = normalizePath(path);
+//   const folderParts = normalizedPath.split('/').filter(part => part !== '');
 
-  let folderParent = ROOT_FOLDER_PATH;
-  if (folderParts.length > 1) {
-    folderParent = ROOT_FOLDER_PATH + folderParts.slice(0, folderParts.length - 1).join('/');
-  }
+//   let folderParent = ROOT_FOLDER_PATH;
+//   if (folderParts.length > 1) {
+//     folderParent = ROOT_FOLDER_PATH + folderParts.slice(0, folderParts.length - 1).join('/');
+//   }
 
-  return folderParent;
-}
+//   return folderParent;
+// }
 
-export const validateFolderName = (folderName: string) => {
-  const validNameRegex = /^[a-zA-Z0-9-_]+$/;
-  return validNameRegex.test(folderName);
-}
+// export const validateFolderName = (folderName: string) => {
+//   const validNameRegex = /^[a-zA-Z0-9-_]+$/;
+//   return validNameRegex.test(folderName);
+// }

backend/src/utils/patchAsyncRoutes.js

@@ -0,0 +1,69 @@
+/*
+Original work Copyright (c) 2016, Nikolay Nemshilov <nemshilov@gmail.com>
+Modified work Copyright (c) 2016, David Banham <david@banham.id.au>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+*/
+
+/* eslint-disable @typescript-eslint/no-var-requires */
+/* eslint-env node */
+const Layer = require('express/lib/router/layer');
+const Router = require('express/lib/router');
+
+const last = (arr = []) => arr[arr.length - 1];
+const noop = Function.prototype;
+
+function copyFnProps(oldFn, newFn) {
+  Object.keys(oldFn).forEach((key) => {
+    newFn[key] = oldFn[key];
+  });
+  return newFn;
+}
+
+function wrap(fn) {
+  const newFn = function newFn(...args) {
+    const ret = fn.apply(this, args);
+    const next = (args.length === 5 ? args[2] : last(args)) || noop;
+    if (ret && ret.catch) ret.catch(err => next(err));
+    return ret;
+  };
+  Object.defineProperty(newFn, 'length', {
+    value: fn.length,
+    writable: false,
+  });
+  return copyFnProps(fn, newFn);
+}
+
+function patchRouterParam() {
+  const originalParam = Router.prototype.constructor.param;
+  Router.prototype.constructor.param = function param(name, fn) {
+    fn = wrap(fn);
+    return originalParam.call(this, name, fn);
+  };
+}
+
+Object.defineProperty(Layer.prototype, 'handle', {
+  enumerable: true,
+  get() {
+    return this.__handle;
+  },
+  set(fn) {
+    fn = wrap(fn);
+    this.__handle = fn;
+  },
+});
+
+module.exports = {
+  patchRouterParam
+};

backend/src/utils/setup/backfillData.ts

@@ -1,211 +1,210 @@
-import crypto from 'crypto';
-import { encryptSymmetric128BitHexKeyUTF8 } from '../crypto';
-import { EESecretService } from '../../ee/services';
-import { SecretVersion } from '../../ee/models';
+import crypto from "crypto";
+import { Types } from "mongoose";
+import { encryptSymmetric128BitHexKeyUTF8 } from "../crypto";
+import { EESecretService } from "../../ee/services";
+import { ISecretVersion, SecretSnapshot, SecretVersion } from "../../ee/models";
 import {
-    Secret,
-    ISecret,
-    SecretBlindIndexData,
-    Workspace,
-    Bot,
-    BackupPrivateKey,
-    IntegrationAuth,
-} from '../../models';
+  Secret,
+  ISecret,
+  SecretBlindIndexData,
+  Workspace,
+  Bot,
+  BackupPrivateKey,
+  IntegrationAuth,
+} from "../../models";
+import { generateKeyPair } from "../../utils/crypto";
+import { client, getEncryptionKey, getRootEncryptionKey } from "../../config";
 import {
-    generateKeyPair
-} from '../../utils/crypto';
-import { 
-    client,
-    getEncryptionKey, 
-    getRootEncryptionKey 
-} from '../../config';
-import { 
-    ALGORITHM_AES_256_GCM,
-    ENCODING_SCHEME_UTF8,
-    ENCODING_SCHEME_BASE64
-} from '../../variables';
-import { InternalServerError } from '../errors';
+  ALGORITHM_AES_256_GCM,
+  ENCODING_SCHEME_UTF8,
+  ENCODING_SCHEME_BASE64,
+} from "../../variables";
+import { InternalServerError } from "../errors";
 
 /**
  * Backfill secrets to ensure that they're all versioned and have
  * corresponding secret versions
  */
 export const backfillSecretVersions = async () => {
-    await Secret.updateMany(
-        { version: { $exists: false } },
-        { $set: { version: 1 } }
-    );
-    
-    const unversionedSecrets: ISecret[] = await Secret.aggregate([
-        {
-            $lookup: {
-                from: "secretversions",
-                localField: "_id",
-                foreignField: "secret",
-                as: "versions",
-            },
-        },
-        {
-            $match: {
-                versions: { $size: 0 },
-            },
-        },
-    ]);
+  await Secret.updateMany(
+    { version: { $exists: false } },
+    { $set: { version: 1 } }
+  );
 
-    if (unversionedSecrets.length > 0) {
-        await EESecretService.addSecretVersions({
-            secretVersions: unversionedSecrets.map(
-            (s, idx) =>
-                new SecretVersion({
-                    ...s,
-                    secret: s._id,
-                    version: s.version ? s.version : 1,
-                    isDeleted: false,
-                    workspace: s.workspace,
-                    environment: s.environment,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                })
-            ),
-        });
-    }
-}
+  const unversionedSecrets: ISecret[] = await Secret.aggregate([
+    {
+      $lookup: {
+        from: "secretversions",
+        localField: "_id",
+        foreignField: "secret",
+        as: "versions",
+      },
+    },
+    {
+      $match: {
+        versions: { $size: 0 },
+      },
+    },
+  ]);
+
+  if (unversionedSecrets.length > 0) {
+    await EESecretService.addSecretVersions({
+      secretVersions: unversionedSecrets.map(
+        (s, idx) =>
+          new SecretVersion({
+            ...s,
+            secret: s._id,
+            version: s.version ? s.version : 1,
+            isDeleted: false,
+            workspace: s.workspace,
+            environment: s.environment,
+            algorithm: ALGORITHM_AES_256_GCM,
+            keyEncoding: ENCODING_SCHEME_UTF8,
+          })
+      ),
+    });
+  }
+  console.log("Migration: Secret version migration v1 complete")
+};
 
 /**
  * Backfill workspace bots to ensure that every workspace has a bot
  */
 export const backfillBots = async () => {
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
+  const encryptionKey = await getEncryptionKey();
+  const rootEncryptionKey = await getRootEncryptionKey();
 
-    const workspaceIdsWithBot = await Bot.distinct('workspace');
-    const workspaceIdsToAddBot = await Workspace.distinct('_id', {
-        _id: {
-            $nin: workspaceIdsWithBot
-        }
-    });
+  const workspaceIdsWithBot = await Bot.distinct("workspace");
+  const workspaceIdsToAddBot = await Workspace.distinct("_id", {
+    _id: {
+      $nin: workspaceIdsWithBot,
+    },
+  });
 
-    if (workspaceIdsToAddBot.length === 0) return;
+  if (workspaceIdsToAddBot.length === 0) return;
 
-    const botsToInsert = await Promise.all(
-        workspaceIdsToAddBot.map(async (workspaceToAddBot) => {
-            const { publicKey, privateKey } = generateKeyPair();
-            
-            if (rootEncryptionKey) {
-                const {
-                    ciphertext: encryptedPrivateKey,
-                    iv,
-                    tag
-                } = client.encryptSymmetric(privateKey, rootEncryptionKey);
+  const botsToInsert = await Promise.all(
+    workspaceIdsToAddBot.map(async (workspaceToAddBot) => {
+      const { publicKey, privateKey } = generateKeyPair();
 
-                return new Bot({
-                    name: 'Infisical Bot',
-                    workspace: workspaceToAddBot,
-                    isActive: false,
-                    publicKey,
-                    encryptedPrivateKey,
-                    iv,
-                    tag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_BASE64
-                });
-            } else if (encryptionKey) {
-                const {
-                    ciphertext: encryptedPrivateKey,
-                    iv,
-                    tag
-                } = encryptSymmetric128BitHexKeyUTF8({
-                    plaintext: privateKey,
-                    key: encryptionKey
-                });
+      if (rootEncryptionKey) {
+        const {
+          ciphertext: encryptedPrivateKey,
+          iv,
+          tag,
+        } = client.encryptSymmetric(privateKey, rootEncryptionKey);
 
-                return new Bot({
-                    name: 'Infisical Bot',
-                    workspace: workspaceToAddBot,
-                    isActive: false,
-                    publicKey,
-                    encryptedPrivateKey,
-                    iv,
-                    tag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                });
-            }
+        return new Bot({
+          name: "Infisical Bot",
+          workspace: workspaceToAddBot,
+          isActive: false,
+          publicKey,
+          encryptedPrivateKey,
+          iv,
+          tag,
+          algorithm: ALGORITHM_AES_256_GCM,
+          keyEncoding: ENCODING_SCHEME_BASE64,
+        });
+      } else if (encryptionKey) {
+        const {
+          ciphertext: encryptedPrivateKey,
+          iv,
+          tag,
+        } = encryptSymmetric128BitHexKeyUTF8({
+          plaintext: privateKey,
+          key: encryptionKey,
+        });
 
-            throw InternalServerError({
-                message: 'Failed to backfill workspace bots due to missing encryption key'
-            });
-        })
-    );
-    
-    await Bot.insertMany(botsToInsert);
-}
+        return new Bot({
+          name: "Infisical Bot",
+          workspace: workspaceToAddBot,
+          isActive: false,
+          publicKey,
+          encryptedPrivateKey,
+          iv,
+          tag,
+          algorithm: ALGORITHM_AES_256_GCM,
+          keyEncoding: ENCODING_SCHEME_UTF8,
+        });
+      }
+
+      throw InternalServerError({
+        message:
+          "Failed to backfill workspace bots due to missing encryption key",
+      });
+    })
+  );
+
+  await Bot.insertMany(botsToInsert);
+};
 
 /**
  * Backfill secret blind index data to ensure that every workspace
  * has a secret blind index data
  */
 export const backfillSecretBlindIndexData = async () => {
+  const encryptionKey = await getEncryptionKey();
+  const rootEncryptionKey = await getRootEncryptionKey();
 
-    const encryptionKey = await getEncryptionKey();
-    const rootEncryptionKey = await getRootEncryptionKey();
-    
-    const workspaceIdsBlindIndexed = await SecretBlindIndexData.distinct('workspace');
-    const workspaceIdsToBlindIndex = await Workspace.distinct('_id', {
-        _id: {
-            $nin: workspaceIdsBlindIndexed
-        }
-    });
+  const workspaceIdsBlindIndexed = await SecretBlindIndexData.distinct(
+    "workspace"
+  );
+  const workspaceIdsToBlindIndex = await Workspace.distinct("_id", {
+    _id: {
+      $nin: workspaceIdsBlindIndexed,
+    },
+  });
 
-    if (workspaceIdsToBlindIndex.length === 0) return;
-    
-    const secretBlindIndexDataToInsert = await Promise.all(
-        workspaceIdsToBlindIndex.map(async (workspaceToBlindIndex) => {
-            const salt = crypto.randomBytes(16).toString('base64');
-            
-            if (rootEncryptionKey) {
-                const { 
-                    ciphertext: encryptedSaltCiphertext,
-                    iv: saltIV,
-                    tag: saltTag
-                } = client.encryptSymmetric(salt, rootEncryptionKey)
+  if (workspaceIdsToBlindIndex.length === 0) return;
 
-                return new SecretBlindIndexData({
-                    workspace: workspaceToBlindIndex,
-                    encryptedSaltCiphertext,
-                    saltIV,
-                    saltTag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_BASE64
-                });
-            } else if (encryptionKey) {
-                const { 
-                    ciphertext: encryptedSaltCiphertext,
-                    iv: saltIV,
-                    tag: saltTag
-                } = encryptSymmetric128BitHexKeyUTF8({
-                    plaintext: salt,
-                    key: encryptionKey
-                });
+  const secretBlindIndexDataToInsert = await Promise.all(
+    workspaceIdsToBlindIndex.map(async (workspaceToBlindIndex) => {
+      const salt = crypto.randomBytes(16).toString("base64");
 
-                return new SecretBlindIndexData({
-                    workspace: workspaceToBlindIndex,
-                    encryptedSaltCiphertext,
-                    saltIV,
-                    saltTag,
-                    algorithm: ALGORITHM_AES_256_GCM,
-                    keyEncoding: ENCODING_SCHEME_UTF8
-                });
-            }
-            
-            throw InternalServerError({
-                message: 'Failed to backfill secret blind index data due to missing encryption key'
-            });
-        })
-    );
-    
-    SecretBlindIndexData.insertMany(secretBlindIndexDataToInsert);
-}
+      if (rootEncryptionKey) {
+        const {
+          ciphertext: encryptedSaltCiphertext,
+          iv: saltIV,
+          tag: saltTag,
+        } = client.encryptSymmetric(salt, rootEncryptionKey);
+
+        return new SecretBlindIndexData({
+          workspace: workspaceToBlindIndex,
+          encryptedSaltCiphertext,
+          saltIV,
+          saltTag,
+          algorithm: ALGORITHM_AES_256_GCM,
+          keyEncoding: ENCODING_SCHEME_BASE64,
+        });
+      } else if (encryptionKey) {
+        const {
+          ciphertext: encryptedSaltCiphertext,
+          iv: saltIV,
+          tag: saltTag,
+        } = encryptSymmetric128BitHexKeyUTF8({
+          plaintext: salt,
+          key: encryptionKey,
+        });
+
+        return new SecretBlindIndexData({
+          workspace: workspaceToBlindIndex,
+          encryptedSaltCiphertext,
+          saltIV,
+          saltTag,
+          algorithm: ALGORITHM_AES_256_GCM,
+          keyEncoding: ENCODING_SCHEME_UTF8,
+        });
+      }
+
+      throw InternalServerError({
+        message:
+          "Failed to backfill secret blind index data due to missing encryption key",
+      });
+    })
+  );
+
+  SecretBlindIndexData.insertMany(secretBlindIndexDataToInsert);
+};
 
 /**
  * Backfill Secret, SecretVersion, SecretBlindIndexData, Bot,
@@ -213,112 +212,165 @@ export const backfillSecretBlindIndexData = async () => {
  * they all have encryption metadata documented
  */
 export const backfillEncryptionMetadata = async () => {
+  // backfill secret encryption metadata
+  await Secret.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
 
-    // backfill secret encryption metadata
-    await Secret.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
+  // backfill secret version encryption metadata
+  await SecretVersion.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
 
-    // backfill secret version encryption metadata
-    await SecretVersion.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
+  // backfill secret blind index encryption metadata
+  await SecretBlindIndexData.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
 
-    // backfill secret blind index encryption metadata
-    await SecretBlindIndexData.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
+  // backfill bot encryption metadata
+  await Bot.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
 
-    // backfill bot encryption metadata
-    await Bot.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
+  // backfill backup private key encryption metadata
+  await BackupPrivateKey.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
 
-    // backfill backup private key encryption metadata
-    await BackupPrivateKey.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
+  // backfill integration auth encryption metadata
+  await IntegrationAuth.updateMany(
+    {
+      algorithm: {
+        $exists: false,
+      },
+      keyEncoding: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        algorithm: ALGORITHM_AES_256_GCM,
+        keyEncoding: ENCODING_SCHEME_UTF8,
+      },
+    }
+  );
+};
 
-    // backfill integration auth encryption metadata
-    await IntegrationAuth.updateMany(
-        {
-            algorithm: {
-                $exists: false
-            },
-            keyEncoding: {
-                $exists: false
-            }
-        },
-        {
-            $set: {
-                algorithm: ALGORITHM_AES_256_GCM,
-                keyEncoding: ENCODING_SCHEME_UTF8
-            }
-        }
-    );
-}
+export const backfillSecretFolders = async () => {
+  await Secret.updateMany(
+    {
+      folder: {
+        $exists: false,
+      },
+    },
+    {
+      $set: {
+        folder: "root",
+      },
+    }
+  );
+
+  let secretSnapshots = await SecretSnapshot.find({
+    environment: {
+      $exists: false,
+    },
+  })
+    .populate<{ secretVersions: ISecretVersion[] }>("secretVersions")
+    .limit(50);
+
+  while (secretSnapshots.length > 0) {
+    for (const secSnapshot of secretSnapshots) {
+      const groupSnapByEnv: Record<string, Array<ISecretVersion>> = {};
+      secSnapshot.secretVersions.forEach((secVer) => {
+        if (!groupSnapByEnv?.[secVer.environment])
+          groupSnapByEnv[secVer.environment] = [];
+        groupSnapByEnv[secVer.environment].push(secVer);
+      });
+
+      const newSnapshots = Object.keys(groupSnapByEnv).map((snapEnv) => ({
+        ...secSnapshot.toObject({ virtuals: false }),
+        _id: new Types.ObjectId(),
+        environment: snapEnv,
+        secretVersions: groupSnapByEnv[snapEnv],
+      }));
+
+      await SecretSnapshot.insertMany(newSnapshots);
+      await secSnapshot.delete();
+    }
+
+    secretSnapshots = await SecretSnapshot.find({
+      environment: {
+        $exists: false,
+      },
+    })
+      .populate<{ secretVersions: ISecretVersion[] }>("secretVersions")
+      .limit(50);
+  }
+
+  console.log("Migration: Folder migration v1 complete")
+};

backend/src/utils/setup/index.ts

@@ -3,25 +3,29 @@ import { DatabaseService, TelemetryService } from '../../services';
 import { setTransporter } from '../../helpers/nodemailer';
 import { EELicenseService } from '../../ee/services';
 import { initSmtp } from '../../services/smtp';
-import { createTestUserForDevelopment } from '../addDevelopmentUser'
+import { createTestUserForDevelopment } from '../addDevelopmentUser';
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { patchRouterParam } = require('../patchAsyncRoutes');
+import { validateEncryptionKeysConfig } from './validateConfig';
 import {
-    validateEncryptionKeysConfig
-} from './validateConfig';
-import { 
-    backfillSecretVersions, 
-    backfillBots,
-    backfillSecretBlindIndexData, 
-    backfillEncryptionMetadata
+  backfillSecretVersions,
+  backfillBots,
+  backfillSecretBlindIndexData,
+  backfillEncryptionMetadata,
+  backfillSecretFolders,
 } from './backfillData';
 import {
-    reencryptBotPrivateKeys,
-    reencryptSecretBlindIndexDataSalts
+  reencryptBotPrivateKeys,
+  reencryptSecretBlindIndexDataSalts,
 } from './reencryptData';
-import { 
-    getNodeEnv,
-    getMongoURL,
-    getSentryDSN
+import {
+  getNodeEnv,
+  getMongoURL,
+  getSentryDSN,
+  getClientSecretGoogle,
+  getClientIdGoogle,
 } from '../../config';
+import { initializePassport } from '../auth';
 
 /**
  * Prepare Infisical upon startup. This includes tasks like:
@@ -34,42 +38,58 @@ import {
  * - Re-encrypting data
  */
 export const setup = async () => {
-    await validateEncryptionKeysConfig();
-    await TelemetryService.logTelemetryMessage();
+  patchRouterParam();
+  await validateEncryptionKeysConfig();
+  await TelemetryService.logTelemetryMessage();
 
-    // initializing SMTP configuration
-    setTransporter(await initSmtp());
-    
-    // initializing global feature set
-    await EELicenseService.initGlobalFeatureSet();
-    
-    // initializing the database connection
-    await DatabaseService.initDatabase(await getMongoURL());
-    
-    /**
-     * NOTE: the order in this setup function is critical.
-     * It is important to backfill data before performing any re-encryption functionality.
-     */
+  // initializing SMTP configuration
+  setTransporter(await initSmtp());
 
-    // backfilling data to catch up with new collections and updated fields
-    await backfillSecretVersions();
-    await backfillBots();
-    await backfillSecretBlindIndexData();
-    await backfillEncryptionMetadata();
-    
-    // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
-    // to base64 256-bit ROOT_ENCRYPTION_KEY
-    // await reencryptBotPrivateKeys();
-    // await reencryptSecretBlindIndexDataSalts();
+  // initializing global feature set
+  await EELicenseService.initGlobalFeatureSet();
 
-    // initializing Sentry
-    Sentry.init({
-        dsn: await getSentryDSN(),
-        tracesSampleRate: 1.0,
-        debug: (await getNodeEnv()) === 'production' ? false : true,
-        environment: (await getNodeEnv())
-    });
+  // initializing the database connection
+  await DatabaseService.initDatabase(await getMongoURL());
 
-    await createTestUserForDevelopment();
-}
+  const googleClientSecret: string = await getClientSecretGoogle();
+  const googleClientId: string = await getClientIdGoogle();
 
+  if (googleClientId && googleClientSecret) {
+    await initializePassport();
+  }
+
+  // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
+  // to base64 256-bit ROOT_ENCRYPTION_KEY
+  // await reencryptBotPrivateKeys();
+  // await reencryptSecretBlindIndexDataSalts();
+
+  // initializing the database connection
+  await DatabaseService.initDatabase(await getMongoURL());
+
+  /**
+   * NOTE: the order in this setup function is critical.
+   * It is important to backfill data before performing any re-encryption functionality.
+   */
+
+  // backfilling data to catch up with new collections and updated fields
+  await backfillSecretVersions();
+  await backfillBots();
+  await backfillSecretBlindIndexData();
+  await backfillEncryptionMetadata();
+  await backfillSecretFolders();
+
+  // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
+  // to base64 256-bit ROOT_ENCRYPTION_KEY
+  await reencryptBotPrivateKeys();
+  await reencryptSecretBlindIndexDataSalts();
+
+  // initializing Sentry
+  Sentry.init({
+    dsn: await getSentryDSN(),
+    tracesSampleRate: 1.0,
+    debug: (await getNodeEnv()) === 'production' ? false : true,
+    environment: await getNodeEnv(),
+  });
+
+  await createTestUserForDevelopment();
+};

docs/mint.json

@@ -121,6 +121,12 @@
     {
       "group": "Self-host Infisical",
       "pages": [
+        {
+          "group": "Authentication",
+          "pages": [
+            "self-hosting/authentication/google"
+          ]
+        },
         {
           "group": "Deployment options",
           "pages": [

docs/self-hosting/authentication/google.mdx

@@ -0,0 +1,18 @@
+---
+title: "Google"
+description: "Learn to configure Google signin/signup when self-hosting Infisical."
+---
+To enable Google Auth for your Infisical project, you first need to set up a Google OAuth application.
+Follow Google's Setting up OAuth 2.0 documentation [here](https://support.google.com/googleapi/answer/6158849). After the setup, copy the Client ID and Client secret. You will need them below.
+
+## Configure Redirect URI
+Add the following URI to the Authorized redirect URIs section in the OAuth Client credentials page - `BASE_URL/api/v1/auth/callback/google`. Replace BASE_URL with the URL of your hosted Infisical instance. 
+![google redirect](../../images/authentication-google-redirect.png)
+
+## General Configuration
+You wil need to configure the following [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):
+
+- `CLIENT_ID_GOOGLE`: OAuth 2.0 Client ID obtained from the credentials page
+- `CLIENT_SECRET_GOOGLE`: OAuth 2.0 Client Secret obtained from the credentials page
+- `JWT_PROVIDER_AUTH_SECRET`: Secret Key for signing OAuth 2.0 access token
+- `JWT_PROVIDER_AUTH_LIFETIME`: Lifetime for OAuth 2.0 access token

docs/self-hosting/configuration/envars.mdx

@@ -69,7 +69,7 @@ Other environment variables are listed below to increase the functionality of yo
       Name label to be used in From field (e.g. Team)
     </ParamField>
   </Tab>
-  <Tab title="Integrations">
+  <Tab title="Secret Integrations">
     To sync secret to third party services, provide value for the related services 
 
     <ParamField query="CLIENT_ID_HEROKU" type="string" default="none" optional>
@@ -108,6 +108,18 @@ Other environment variables are listed below to increase the functionality of yo
       OAuth2 slug for Netlify integration
     </ParamField>
   </Tab>
+  <Tab title="Auth Integrations">
+    To integrate with external auth providers, provide value for the related keys
+    <ParamField query="JWT_PROVIDER_AUTH_SECRET" type="string" required>
+      Must be a random 16 byte hex string. Can be generated with `openssl rand -hex 16`
+    </ParamField>
+    <ParamField query="CLIENT_ID_GOOGLE" type="string" default="none" optional>
+      OAuth2 client ID for Google auth integration         
+    </ParamField>
+    <ParamField query="CLIENT_SECRET_GOOGLE" type="string" default="none" optional>
+      OAuth2 client secret for Google auth integration         
+    </ParamField>
+  </Tab>
   <Tab title="Others">
     #### JWT
     <ParamField query="JWT_SIGNUP_LIFETIME" type="string" default="15m" optional>
@@ -126,6 +138,10 @@ Other environment variables are listed below to increase the functionality of yo
       JWT token lifetime expressed in seconds or a string describing a time span
     </ParamField>
 
+    <ParamField query="JWT_PROVIDER_AUTH_LIFETIME" type="string" default="5m" optional>
+      JWT token lifetime expressed in seconds or a string describing a time span
+    </ParamField>
+
   <ParamField query="MONGO_USERNAME" type="string" default="none" optional></ParamField>
 
   <ParamField query="MONGO_PASSWORD" type="string" default="none" optional></ParamField>

docs/self-hosting/deployment-options/digital-ocean-marketplace.mdx

@@ -3,4 +3,25 @@ title: "Digital Ocean"
 description: "Learn to install Infisical on Digital Ocean"
 ---
 
-Documentation coming soon
+Infisical can be deployed on a Kubernetes cluster with a single click through our Digital Ocean marketplace application. 
+The initiation of the installation process triggers the creation of a Kubernetes cluster, followed by the installation of Infisical onto that cluster. 
+
+This automated deploymnet method uses the same proccess under the hood as the manual [Kubernetes installation guide](./kubernetes-helm).
+
+### Initiate the installation
+
+To start the process, click the following button and follow the instructions there.
+
+<a href="https://docs.digitalocean.com/products/marketplace/catalog/infisical/">
+<img src="../../images/do-k8-install-btn.png" width="300"/>
+</a>
+
+### Access Infisical Web
+Once the installation finishes, head to the `Networking` section via the sidebar and select `Load Balancers`.
+Within this section, you'll find the newly created load balancer for Infisical. You can access Infisical at the IP address allocated to that load balancer.
+
+### Adjusting configurations
+If you need to either upgrade or downgrade Infisical, or modify environment variables to alter its functionality, refer to our [Kubernetes installation](./kubernetes-helm) page for detailed instructions.
+
+Because Digital Ocean deploys the same Helm application as described in our [Kubernetes installation](./kubernetes-helm) guide, you can utilize that guide to implement the required changes. 
+It's important to note that any modifications requires familiarly with Helm package manager.

docs/self-hosting/overview.mdx

@@ -11,6 +11,9 @@ Choose from a variety of deployment options listed below to get started.
   Use our Helm chart to Install Infisical on your Kubernetes cluster
 </Card>
 <CardGroup cols={2}>
+  <Card title="Digital Ocean" color="#16a34a" href="deployment-options/digital-ocean-marketplace">
+    Automatically create and deploy Infisical on to a Kubernetes cluster 
+  </Card>
   <Card title="Fly.io" color="#dc2626" href="deployment-options/fly.io">
     Use our standalone docker image to deploy on Fly.io
   </Card>
@@ -20,9 +23,6 @@ Choose from a variety of deployment options listed below to get started.
   <Card title="AWS EC2" color="#0285c7" href="deployment-options/aws-ec2">
     Install infisical with just a few clicks using our Cloud Formation template
   </Card>
-  <Card title="Digital Ocean marketplace" color="#16a34a" href="deployment-options/digital-ocean-marketplace">
-    Use our one click installer to deploy Infisical
-  </Card>
   <Card title="Docker Compose" color="#0285c7" href="deployment-options/docker-compose">
     Install Infisical using our Docker Compose template 
   </Card>

frontend/package.json

@@ -62,6 +62,7 @@
     "jspdf": "^2.5.1",
     "jsrp": "^0.2.4",
     "lottie-react": "^2.4.0",
+    "jwt-decode": "^3.1.2",
     "markdown-it": "^13.0.1",
     "next": "^12.3.4",
     "posthog-js": "^1.58.0",

frontend/public/images/gradientLogo.svg

@@ -0,0 +1,9 @@
+<svg width="91" height="43" viewBox="0 0 91 43" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M21.9734 0C24.8526 0 27.4793 0.412021 29.8535 1.23606C32.2528 2.06011 34.4123 3.13386 36.3318 4.45732C38.2766 5.75581 39.9814 7.10424 41.4463 8.50261C42.2545 9.25174 42.987 9.98839 43.6436 10.7125C44.3003 11.4367 44.9317 12.1609 45.5379 12.885C46.0935 12.1609 46.6618 11.4617 47.2427 10.7875C47.8489 10.0883 48.6066 9.32665 49.5158 8.50261C51.7132 6.38008 54.4409 4.43235 57.699 2.65941C60.9824 0.886471 64.7835 0 69.1024 0C73.1435 0 76.8183 0.97387 80.127 2.92161C83.4609 4.84437 86.1002 7.42886 88.045 10.6751C90.015 13.9213 91 17.5171 91 21.4625C91 24.4591 90.4317 27.2683 89.2952 29.8902C88.1586 32.4872 86.5927 34.7721 84.5974 36.7448C82.6021 38.6925 80.2785 40.2282 77.6266 41.3519C74.9746 42.4506 72.1332 43 69.1024 43C66.2231 43 63.5712 42.6005 61.1465 41.8014C58.7472 40.9774 56.5751 39.9286 54.6303 38.6551C52.7108 37.3815 51.0186 36.0706 49.5537 34.7221C48.7202 33.8981 47.9752 33.124 47.3185 32.3998C46.6871 31.6507 46.0935 30.9141 45.5379 30.1899C44.9065 30.9141 44.2624 31.6507 43.6057 32.3998C42.9491 33.149 42.2166 33.9231 41.4084 34.7221C39.9688 36.0706 38.2766 37.3815 36.3318 38.6551C34.4123 39.9036 32.2528 40.9399 29.8535 41.7639C27.4793 42.588 24.8526 43 21.9734 43C17.8818 43 14.1817 42.0386 10.873 40.1159C7.56439 38.1931 4.92506 35.6086 2.95504 32.3624C0.985013 29.0912 0 25.4579 0 21.4625C0 18.491 0.555648 15.7192 1.66694 13.1472C2.8035 10.5502 4.36941 8.26539 6.3647 6.29269C8.38523 4.31998 10.7215 2.78427 13.3734 1.68554C16.0507 0.561848 18.9173 0 21.9734 0ZM10.4563 21.4625C10.4563 23.5351 10.974 25.4204 12.0096 27.1185C13.0451 28.8165 14.4342 30.1649 16.1769 31.1638C17.9197 32.1626 19.8518 32.662 21.9734 32.662C24.3475 32.662 26.5322 32.1376 28.5275 31.0889C30.5228 30.0401 32.3791 28.7166 34.0966 27.1185C35.1826 26.0947 36.1171 25.1083 36.9001 24.1594C37.683 23.2105 38.365 22.3116 38.9459 21.4625C38.3397 20.6635 37.6199 19.777 36.7864 18.8031C35.9782 17.8043 35.0816 16.8554 34.0966 15.9564C32.4802 14.3833 30.649 13.0598 28.6032 11.9861C26.5575 10.8873 24.3475 10.338 21.9734 10.338C19.8518 10.338 17.9197 10.8499 16.1769 11.8737C14.4342 12.8725 13.0451 14.221 12.0096 15.919C10.974 17.592 10.4563 19.4399 10.4563 21.4625ZM80.4679 21.4625C80.4679 19.4399 79.9502 17.592 78.9146 15.919C77.9044 14.221 76.5405 12.8725 74.8231 11.8737C73.1056 10.8499 71.1987 10.338 69.1024 10.338C67.486 10.338 65.9453 10.5877 64.4804 11.0871C63.0155 11.5865 61.639 12.2607 60.351 13.1098C59.0881 13.9588 57.9263 14.9077 56.8655 15.9564C55.729 17.0052 54.7313 18.079 53.8726 19.1777C53.0139 20.2515 52.3951 21.0131 52.0162 21.4625C52.6477 22.3365 53.3549 23.248 54.1378 24.1969C54.9208 25.1208 55.83 26.0947 56.8655 27.1185C58.5577 28.7166 60.4015 30.0401 62.3968 31.0889C64.4173 32.1376 66.6525 32.662 69.1024 32.662C71.1987 32.662 73.1056 32.1626 74.8231 31.1638C76.5405 30.1649 77.9044 28.8165 78.9146 27.1185C79.9502 25.4204 80.4679 23.5351 80.4679 21.4625Z" fill="url(#paint0_linear_491_1466)"/>
+<defs>
+<linearGradient id="paint0_linear_491_1466" x1="46" y1="-1.40259e-06" x2="66" y2="80.5" gradientUnits="userSpaceOnUse">
+<stop stop-color="#D9E8FF"/>
+<stop offset="1" stop-color="white" stop-opacity="0.36"/>
+</linearGradient>
+</defs>
+</svg>

frontend/public/locales/en/translations.json

@@ -131,7 +131,10 @@
     "need-account": "Need an Infisical account?",
     "create-account": "Create an account",
     "forgot-password": "Forgot your password?",
-    "error-login": "Wrong credentials."
+    "error-login": "Wrong credentials.",
+    "continue-with-google": "Continue with Google",
+    "continue-with-email": "Continue with Email",
+    "other-option": "Log in with another option"
   },
   "mfa": {
     "title": "Sign Up",
@@ -295,6 +298,10 @@
     "signup": "Sign Up",
     "already-have-account": "Have an account? Log in",
     "forgot-password": "Forgot your password?",
+    "initial-title": "Create your Infisical account",
+    "continue-with-google": "Continue with Google",
+    "continue-with-email": "Continue with Email",
+    "create-policy": "By signing up, you agree to our Terms of Service and Privacy Policy.",
     "verify": "Verify",
     "step1-start": "Let's get started",
     "step1-privacy": "By creating an account, you agree to our Terms and have read and acknowledged the Privacy Policy.",

frontend/src/components/basic/InputField.tsx

@@ -61,22 +61,6 @@ const InputField = ({
     <div className="flex-col w-full">
       <div className="flex flex-row text-mineshaft-300 items-center mb-0.5">
         <p className="text-sm font-semibold mr-1">{label}</p>
-        {/* {label === "Password" && router.asPath !== "/login" && (
-						<div className="mb-0.5 relative inline-block text-gray-400 underline hover:text-primary duration-200">
-							<FontAwesomeIcon
-								icon={faCircleExclamation}
-								className={`text-sm peer ${
-									error && "text-red"
-								}`}
-							/>
-							<span className="absolute hidden peer-hover:block duration-200 w-60 -left-28 -top-2 -translate-y-full px-2 py-2 bg-gray-700 rounded-md text-center text-gray-200 text-sm after:content-[''] after:absolute after:left-1/2 after:top-[100%] after:-translate-x-1/2 after:border-8 after:border-x-transparent after:border-b-transparent after:border-t-gray-700">
-								The password should contain at least 8
-								characters including at least 1 lowercase
-								character, uppercase character, number, and a
-								special character.
-							</span>
-						</div>
-					)} */}
       </div>
       <div
         className={`group relative flex flex-col justify-center w-full max-w-2xl border ${
@@ -95,7 +79,7 @@ const InputField = ({
               : ''
           } ${
             error ? 'focus:ring-red/50' : 'focus:ring-primary/50'
-          } relative peer bg-bunker-800 rounded-md text-gray-400 text-md p-2 w-full min-w-16 outline-none focus:ring-4 duration-200`}
+          } relative peer bg-mineshaft-900 rounded-md text-gray-400 text-md p-2 w-full min-w-16 outline-none focus:ring-4 duration-200`}
           name={name}
           spellCheck="false"
           autoComplete={autoComplete}

frontend/src/components/login/InitialLoginStep.tsx

@@ -0,0 +1,64 @@
+import { useTranslation } from 'react-i18next';
+import Link from 'next/link';
+import { useRouter } from 'next/router';
+
+// import { faGoogle } from '@fortawesome/free-brands-svg-icons';
+// import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { Button } from '../v2';
+
+export default function InitialLoginStep({
+    setIsLoginWithEmail,
+}: {
+    setIsLoginWithEmail: (value: boolean) => void;
+}) {
+
+    const router = useRouter();
+    const { t } = useTranslation();
+
+    return <div className='flex flex-col mx-auto w-full justify-center items-center'>
+        <h1 className='text-xl font-medium text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 text-center mb-8' >Login to Infisical</h1>
+        {/* <div className='lg:w-1/6 w-1/4 min-w-[20rem] rounded-md'>
+            <Button
+                colorSchema="primary" 
+                variant="solid"
+                onClick={() => {
+                    window.open('/api/v1/auth/redirect/google')
+                }} 
+                leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-1" />}
+                className="h-14 w-full mx-0"
+            > 
+                {t('login.continue-with-google')}
+            </Button>
+        </div> */}
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md'>
+            <Button
+                colorSchema="primary" 
+                variant="solid"
+                onClick={() => {
+                    setIsLoginWithEmail(true);
+                }} 
+                isFullWidth
+                className="h-14 w-full mx-0"
+            > 
+                {t('login.continue-with-email')} 
+            </Button>
+        </div>
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md mt-4'>
+            <Button
+                colorSchema="primary" 
+                variant="outline_bg"
+                onClick={() => router.push("/saml-sso")} 
+                isFullWidth
+                className="h-14 w-full mx-0"
+            > 
+                Continue with SAML SSO
+            </Button>
+        </div>
+        <div className="mt-4 text-bunker-400 text-sm flex flex-row">
+            <span className="mr-1">Don&apos;t have an acount yet?</span>
+            <Link href="/signup">
+                <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>{t('login.create-account')}</span>
+            </Link>
+        </div>
+    </div>
+}

frontend/src/components/login/LoginStep.tsx

@@ -5,11 +5,11 @@ import { useRouter } from 'next/router';
 import { faWarning } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 
-import Button from '@app/components/basic/buttons/Button';
 import Error from '@app/components/basic/Error';
-import InputField from '@app/components/basic/InputField';
 import attemptLogin from '@app/components/utilities/attemptLogin';
 
+import { Button, Input } from '../v2';
+
 /**
  * 1st step of login - user enters their username and password
  * @param {Object} obj
@@ -46,7 +46,10 @@ export default function LoginStep({
       }
 
       setIsLoading(true);
-      const isLoginSuccessful = await attemptLogin(email, password);
+      const isLoginSuccessful = await attemptLogin({
+        email,
+        password,
+      });
       if (isLoginSuccessful && isLoginSuccessful.success) {
         // case: login was successful
 
@@ -60,82 +63,71 @@ export default function LoginStep({
         // case: login does not require MFA step
         router.push(`/dashboard/${localStorage.getItem('projectData.id')}`);
       }
+
     } catch (err) {
       setLoginError(true);
     }
 
     setIsLoading(false);
-  };
+  }
 
   return (
     <form onSubmit={(e) => e.preventDefault()}>
-      <div className="h-7/12 mx-auto w-full max-w-md rounded-xl bg-bunker py-4 px-6 pt-8 drop-shadow-xl">
-        <p className="mx-auto mb-6 flex w-max justify-center text-3xl font-semibold text-bunker-100">
+      <div className="w-full mx-auto h-full px-6">
+        <p className="text-xl w-max mx-auto flex justify-center text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 mb-6">
           {t('login.login')}
         </p>
-        <div className="mt-4 flex max-h-24 w-full items-center justify-center rounded-lg md:mt-0 md:max-h-28 md:p-2">
-          <InputField
-            label={t('common.email')}
-            onChangeHandler={setEmail}
-            type="email"
+        <div className="flex items-center justify-center lg:w-1/6 w-1/4 min-w-[22rem] mx-auto w-full md:p-2 rounded-lg mt-4 md:mt-0 max-h-24 md:max-h-28">
+          <Input
             value={email}
-            placeholder=""
+            onChange={(e) => setEmail(e.target.value)}
+            type="email"
+            placeholder="Enter your email..."
             isRequired
             autoComplete="username"
+            className="h-12"
           />
         </div>
-        <div className="relative mt-6 flex max-h-24 w-full items-center justify-center rounded-lg md:mt-2 md:max-h-28 md:p-2">
-          <InputField
-            label={t('common.password')}
-            onChangeHandler={setPassword}
-            type="password"
-            value={password}
-            placeholder=""
-            isRequired
-            autoComplete="current-password"
-            id="current-password"
-          />
-          <div className="absolute top-2 right-3 cursor-pointer text-sm text-primary-700 duration-200 hover:text-primary">
-            <Link href="/verify-email">
-              <button
-                type="button"
-                className="ml-1.5 text-sm font-normal text-primary-700 underline-offset-4 duration-200 hover:text-primary"
-              >
-                {t('login.forgot-password')}
-              </button>
-            </Link>
-          </div>
-        </div>
-        {!isLoading && loginError && <Error text={t('login.error-login') ?? ''} />}
-        <div className="mx-auto mt-4 flex max-h-20 w-full max-w-md flex-col items-center justify-center text-sm md:p-2">
-          <div className="text-l m-8 mt-6 px-8 py-3 text-lg">
-            <Button
-              type="submit"
-              text={t('login.login') ?? ''}
-              onButtonPressed={async () => handleLogin()}
-              loading={isLoading}
-              size="lg"
+        <div className="relative flex items-center justify-center lg:w-1/6 w-1/4 min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
+          <div className="flex items-center justify-center w-full md:p-2 rounded-lg max-h-24 md:max-h-28">
+            <Input
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              type="password"
+              placeholder="Enter your password..."
+              isRequired
+              autoComplete="current-password"
+              id="current-password"
+              className="h-12"
             />
           </div>
         </div>
+        {!isLoading && loginError && <Error text={t('login.error-login') ?? ''} />}
+        <div className="flex flex-col items-center justify-center lg:w-1/6 w-1/4 min-w-[22rem] px-2 mt-4 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">
+          <div className="text-l py-1 text-lg w-full">
+            <Button
+              onClick={async () => handleLogin()}
+              size="sm"
+              isFullWidth
+              className='h-14'
+              colorSchema="primary"
+              variant="outline_bg"
+              isLoading={isLoading}
+            > {String(t('login.login'))} </Button>
+          </div>
+        </div>
+      </div>
+      <div className="text-bunker-400 text-sm flex flex-row w-max mx-auto">
+        <Link href="/verify-email">
+          <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>{t('login.forgot-password')}</span>
+        </Link>
       </div>
       {false && (
-        <div className="mx-auto mt-4 flex w-full max-w-md flex-row items-center rounded-md bg-white/10 p-2 text-gray-300">
+        <div className="w-full p-2 flex flex-row items-center bg-white/10 text-gray-300 rounded-md max-w-md mx-auto mt-4">
           <FontAwesomeIcon icon={faWarning} className="ml-2 mr-6 text-6xl" />
           {t('common.maintenance-alert')}
         </div>
       )}
-      <div className="mt-4 flex flex-row items-center justify-center md:pb-4">
-        <p className="flex w-max justify-center text-sm text-gray-400">{t('login.need-account')}</p>
-        <Link href="/signup">
-          <button
-            type="button"
-            className="ml-1.5 text-sm font-normal text-primary-700 underline-offset-4 duration-200 hover:text-primary"
-          >
-            {t('login.create-account')}
-          </button>
-        </Link>
-      </div>
     </form>
   );
 }

frontend/src/components/login/MFAStep.tsx

@@ -7,8 +7,8 @@ import { useRouter } from 'next/router';
 import attemptLoginMfa from '@app/components/utilities/attemptLoginMfa';
 import { useSendMfaToken } from '@app/hooks/api/auth';
 
-import Button from '../basic/buttons/Button';
 import Error from '../basic/Error';
+import { Button } from '../v2';
 
 // The style for the verification code input
 const props = {
@@ -52,10 +52,12 @@ interface VerifyMfaTokenError {
  */
 export default function MFAStep({
   email,
-  password
+  password,
+  providerAuthToken,
 }: {
   email: string;
   password: string;
+  providerAuthToken?: string;
 }): JSX.Element {
   const router = useRouter();
   const [isLoading, setIsLoading] = useState(false);
@@ -77,6 +79,7 @@ export default function MFAStep({
       const isLoginSuccessful = await attemptLoginMfa({
         email,
         password,
+        providerAuthToken,
         mfaToken: mfaCode
       });
 
@@ -112,10 +115,10 @@ export default function MFAStep({
   };
 
   return (
-    <form className="h-7/12 mx-auto mb-64 w-max rounded-xl bg-bunker px-8 pt-10 pb-4 drop-shadow-xl md:mb-16">
+    <form className="mx-auto w-max px-8 pb-4 pt-4 md:mb-16">
       <p className="text-l flex justify-center text-bunker-300">{t('mfa.step2-message')}</p>
-      <p className="text-l my-2 flex justify-center font-semibold text-bunker-300">{email} </p>
-      <div className="hidden md:block">
+      <p className="text-l my-1 flex justify-center font-semibold text-bunker-300">{email} </p>
+      <div className="hidden md:block w-max min-w-[20rem] mx-auto">
         <ReactCodeInput
           name=""
           inputMode="tel"
@@ -126,28 +129,46 @@ export default function MFAStep({
           className="mt-6 mb-2"
         />
       </div>
+      <div className="block md:hidden w-max mt-4 mx-auto">
+        <ReactCodeInput
+          name=""
+          inputMode="tel"
+          type="text"
+          fields={6}
+          onChange={setMfaCode}
+          {...props}
+          className="mt-2 mb-2"
+        />
+      </div>
       {typeof triesLeft === 'number' && (
         <Error text={`${t('mfa.step2-code-error')} ${triesLeft}`} />
       )}
-      <div className="min-w-28 mx-auto mt-4 mb-2 flex max-h-24 max-w-max flex-col items-center justify-center px-4 text-lg md:p-2">
-        <Button text={t('mfa.verify') ?? ''} onButtonPressed={() => handleLoginMfa()} size="lg" />
-      </div>
-      <div className="mx-auto flex max-h-24 w-full max-w-md flex-col items-center justify-center pt-2">
-        <div className="flex flex-row items-baseline gap-1 text-sm">
-          <span className="text-bunker-400">{t('mfa.step2-resend-alert')}</span>
-          <u
-            className={`font-normal ${
-              isLoadingResend
-                ? 'text-bunker-400'
-                : 'text-primary-700 duration-200 hover:text-primary'
-            }`}
-          >
-            <button disabled={isLoading} onClick={() => handleResendMfaCode()} type="button">
-              {isLoadingResend ? t('mfa.step2-resend-progress') : t('mfa.step2-resend-submit')}
-            </button>
-          </u>
+      <div className="flex flex-col mt-6 items-center justify-center lg:w-[19%] w-1/4 min-w-[20rem] mt-2 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">
+        <div className="text-l py-1 text-lg w-full">
+          <Button
+            onClick={() => handleLoginMfa()}
+            size="sm"
+            isFullWidth
+            className='h-14'
+            colorSchema="primary"
+            variant="outline_bg"
+          > {String(t('mfa.verify'))} </Button>
         </div>
-        <p className="pb-2 text-sm text-bunker-400">{t('mfa.step2-spam-alert')}</p>
+      </div>
+      <div className="flex flex-col items-center justify-center w-full max-h-24 max-w-md mx-auto pt-2">
+        <div className="flex flex-row items-baseline gap-1 text-sm">
+          <span className="text-bunker-400">{t('signup.step2-resend-alert')}</span>
+          <div className="mt-2 text-bunker-400 text-md flex flex-row">
+            <button disabled={isLoading} onClick={handleResendMfaCode} type="button">
+              <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>
+                {isLoadingResend
+                  ? t('signup.step2-resend-progress')
+                  : t('signup.step2-resend-submit')}
+              </span>
+            </button>
+          </div>
+        </div>
+        <p className="text-sm text-bunker-400 pb-2">{t('signup.step2-spam-alert')}</p>
       </div>
     </form>
   );

frontend/src/components/login/PasswordInputStep.tsx

@@ -0,0 +1,119 @@
+import React, { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import Link from 'next/link';
+import { useRouter } from 'next/router';
+
+import Error from '@app/components/basic/Error';
+import attemptLogin from '@app/components/utilities/attemptLogin';
+
+import SecurityClient from '../utilities/SecurityClient';
+import { Button, Input } from '../v2';
+
+export default function PasswordInputStep({
+  email,
+  password,
+  providerAuthToken,
+  setPassword,
+  setProviderAuthToken,
+  setStep
+}: {
+  email: string;
+  password: string;
+  providerAuthToken: string;
+  setPassword: (password: string) => void;
+  setProviderAuthToken: (value: string) => void;
+  setStep: (step: number) => void;
+}) {
+  const router = useRouter();
+  const [isLoading, setIsLoading] = useState(false);
+  const [loginError, setLoginError] = useState(false);
+
+  const { t } = useTranslation();
+
+  const handleLogin = async () => {
+    try {
+      setIsLoading(true);
+      const loginAttempt = await attemptLogin({
+        email,
+        password,
+        providerAuthToken,
+      });
+
+      if (loginAttempt && loginAttempt.success) {
+        // case: login was successful
+
+        if (loginAttempt.mfaEnabled) {
+          // case: login requires MFA step
+          setStep(2);
+          setIsLoading(false);
+          return;
+        }
+
+        // case: login does not require MFA step
+        router.push(`/dashboard/${localStorage.getItem('projectData.id')}`);
+      }
+    } catch (err) {
+      setLoginError(true);
+    }
+
+    setIsLoading(false);
+  };
+
+  return (
+    <form onSubmit={(e) => e.preventDefault()}>
+      <div className="h-full mx-auto w-full max-w-md px-6 pt-8">
+        <p className="mx-auto mb-6 flex w-max justify-center text-xl font-medium text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 text-center mb-8">
+          What’s your Infisical Password?
+        </p>
+        <div className="relative flex items-center justify-center lg:w-1/6 w-1/4 min-w-[22rem] mx-auto w-full rounded-lg max-h-24 md:max-h-28">
+          <div className="flex items-center justify-center w-full rounded-lg max-h-24 md:max-h-28">
+            <Input
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              type="password"
+              placeholder="Enter your password..."
+              isRequired
+              autoComplete="current-password"
+              id="current-password"
+              className="h-12"
+            />
+          </div>
+        </div>
+        {!isLoading && loginError && <Error text={t('login.error-login') ?? ''} />}
+        <div className='lg:w-1/6 w-1/4 w-full mx-auto flex items-center justify-center min-w-[22rem] text-center rounded-md mt-4'>
+          <Button
+              colorSchema="primary" 
+              variant="outline_bg"
+              onClick={async () => handleLogin()} 
+              isFullWidth
+              isLoading={isLoading}
+              className="h-14"
+          > 
+              {t('login.login')} 
+          </Button>
+        </div>
+        <div className="text-bunker-400 text-xs flex flex-col items-center w-max mx-auto mt-4">
+          <span className='duration-200 max-w-sm text-center px-4'>
+            Infisical Master Password serves as a decryption mechanism so that even Google is not able to access your secrets.
+          </span>
+          <Link href="/verify-email">
+            <span className='hover:underline mt-2 hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>{t('login.forgot-password')}</span>
+          </Link>
+        </div>
+        <div className="flex flex-row items-center justify-center">
+          <button
+            onClick={(e) => {
+              e.preventDefault();
+              SecurityClient.setProviderAuthToken('');
+              setProviderAuthToken('');
+            }}
+            type="button"
+            className="text-bunker-400 text-xs hover:underline mt-2 hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer"
+          >
+            {t('login.other-option')}
+          </button>
+        </div>
+      </div>
+    </form>
+  );
+}

frontend/src/components/navigation/NavHeader.tsx

@@ -1,3 +1,4 @@
+import { useMemo } from 'react';
 import Link from 'next/link';
 import { useRouter } from 'next/router';
 import { faAngleRight } from '@fortawesome/free-solid-svg-icons';
@@ -7,6 +8,17 @@ import { useOrganization, useWorkspace } from '@app/context';
 
 import { Select, SelectItem, Tooltip } from '../v2';
 
+type Props = {
+  pageName: string;
+  isProjectRelated?: boolean;
+  isOrganizationRelated?: boolean;
+  currentEnv?: string;
+  userAvailableEnvs?: any[];
+  onEnvChange?: (slug: string) => void;
+  folders?: Array<{ id: string; name: string }>;
+  isFolderMode?: boolean;
+};
+
 // TODO: make links clickable and clean up
 
 /**
@@ -28,20 +40,22 @@ export default function NavHeader({
   isProjectRelated,
   isOrganizationRelated,
   currentEnv,
-  userAvailableEnvs,
-  onEnvChange
-}: {
-  pageName: string;
-  isProjectRelated?: boolean;
-  isOrganizationRelated?: boolean;
-  currentEnv?: string;
-  userAvailableEnvs?: any[];
-  onEnvChange?: (slug: string) => void;
-}): JSX.Element {
+  userAvailableEnvs = [],
+  onEnvChange,
+  folders = [],
+  isFolderMode
+}: Props): JSX.Element {
   const { currentWorkspace } = useWorkspace();
   const { currentOrg } = useOrganization();
   const router = useRouter();
 
+  const isInRootFolder = isFolderMode && folders.length <= 1;
+
+  const selectedEnv = useMemo(
+    () => userAvailableEnvs?.find((uae) => uae.name === currentEnv),
+    [userAvailableEnvs, currentEnv]
+  );
+
   return (
     <div className="ml-6 flex flex-row items-center pt-6">
       <div className="mr-2 flex h-6 w-6 items-center justify-center rounded-md bg-primary-900 text-mineshaft-100">
@@ -72,13 +86,13 @@ export default function NavHeader({
       ) : (
         <div className="text-sm text-gray-400">{pageName}</div>
       )}
-      {currentEnv && (
+      {currentEnv && isInRootFolder && (
         <>
           <FontAwesomeIcon icon={faAngleRight} className="ml-3 mr-1.5 text-xs text-gray-400" />
           <div className="rounded-md pl-3 hover:bg-bunker-100/10">
             <Tooltip content="Select environment">
               <Select
-                value={userAvailableEnvs?.filter((uae) => uae.name === currentEnv)[0]?.slug}
+                value={selectedEnv?.slug}
                 onValueChange={(value) => {
                   if (value && onEnvChange) onEnvChange(value);
                 }}
@@ -95,6 +109,26 @@ export default function NavHeader({
           </div>
         </>
       )}
+      {isFolderMode &&
+        folders?.map(({ id, name }, index) => {
+          const query = { ...router.query };
+          if (name !== 'root') query.folderId = id;
+          else delete query.folderId;
+          return (
+            <div className="flex items-center space-x-3" key={`breadcrumb-folder-${id}`}>
+              <FontAwesomeIcon icon={faAngleRight} className="ml-3 mr-1.5 text-xs text-gray-400" />
+              {index + 1 === folders?.length ? (
+                <span className="text-sm font-semibold text-bunker-300">{name}</span>
+              ) : (
+                <Link passHref legacyBehavior href={{ pathname: '/dashboard/[id]', query }}>
+                  <a className="text-sm font-semibold capitalize text-primary/80 hover:text-primary">
+                    {name === 'root' ? selectedEnv?.name : name}
+                  </a>
+                </Link>
+              )}
+            </div>
+          );
+        })}
     </div>
   );
 }

frontend/src/components/signup/CodeInputStep.tsx

@@ -5,8 +5,8 @@ import { useTranslation } from 'react-i18next';
 
 import sendVerificationEmail from '@app/pages/api/auth/SendVerificationEmail';
 
-import Button from '../basic/buttons/Button';
 import Error from '../basic/Error';
+import { Button } from '../v2';
 
 // The style for the verification code input
 const props = {
@@ -51,6 +51,7 @@ interface CodeInputStepProps {
   incrementStep: () => void;
   setCode: (value: string) => void;
   codeError: boolean;
+  isCodeInputCheckLoading: boolean;
 }
 
 /**
@@ -66,7 +67,8 @@ export default function CodeInputStep({
   email,
   incrementStep,
   setCode,
-  codeError
+  codeError,
+  isCodeInputCheckLoading
 }: CodeInputStepProps): JSX.Element {
   const [isLoading, setIsLoading] = useState(false);
   const [isResendingVerificationEmail, setIsResendingVerificationEmail] = useState(false);
@@ -83,10 +85,10 @@ export default function CodeInputStep({
   };
 
   return (
-    <div className="h-7/12 mx-auto mb-64 w-max rounded-xl bg-bunker px-8 pt-10 pb-4 drop-shadow-xl md:mb-16">
-      <p className="text-l flex justify-center text-bunker-300">{t('signup.step2-message')}</p>
-      <p className="text-l my-2 flex justify-center font-semibold text-bunker-300">{email} </p>
-      <div className="hidden md:block">
+    <div className="mx-auto h-full w-full pb-4 px-8">
+      <p className="text-md flex justify-center text-bunker-200">{t('signup.step2-message')}</p>
+      <p className="text-md flex justify-center font-semibold my-1 text-bunker-200">{email} </p>
+      <div className="hidden md:block w-max min-w-[20rem] mx-auto">
         <ReactCodeInput
           name=""
           inputMode="tel"
@@ -97,7 +99,7 @@ export default function CodeInputStep({
           className="mt-6 mb-2"
         />
       </div>
-      <div className="block md:hidden">
+      <div className="block md:hidden w-max mt-4 mx-auto">
         <ReactCodeInput
           name=""
           inputMode="tel"
@@ -105,31 +107,37 @@ export default function CodeInputStep({
           fields={6}
           onChange={setCode}
           {...propsPhone}
-          className="mt-2 mb-6"
+          className="mt-2 mb-2"
         />
       </div>
       {codeError && <Error text={t('signup.step2-code-error')} />}
-      <div className="min-w-28 mx-auto mt-4 mb-2 flex max-h-24 max-w-max flex-col items-center justify-center px-4 text-lg md:p-2">
-        <Button text={t('signup.verify') ?? ''} onButtonPressed={incrementStep} size="lg" />
+      <div className="flex flex-col items-center justify-center lg:w-[19%] w-1/4 min-w-[20rem] mt-2 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">
+        <div className="text-l py-1 text-lg w-full">
+          <Button
+            onClick={incrementStep}
+            size="sm"
+            isFullWidth
+            className='h-14'
+            colorSchema="primary"
+            variant="outline_bg"
+            isLoading={isCodeInputCheckLoading}
+          > {String(t('signup.verify'))} </Button>
+        </div>
       </div>
-      <div className="mx-auto flex max-h-24 w-full max-w-md flex-col items-center justify-center pt-2">
+      <div className="flex flex-col items-center justify-center w-full max-h-24 max-w-md mx-auto pt-2">
         <div className="flex flex-row items-baseline gap-1 text-sm">
           <span className="text-bunker-400">{t('signup.step2-resend-alert')}</span>
-          <u
-            className={`font-normal ${
-              isResendingVerificationEmail
-                ? 'text-bunker-400'
-                : 'text-primary-700 duration-200 hover:text-primary'
-            }`}
-          >
+          <div className="mt-2 text-bunker-400 text-md flex flex-row">
             <button disabled={isLoading} onClick={resendVerificationEmail} type="button">
-              {isResendingVerificationEmail
-                ? t('signup.step2-resend-progress')
-                : t('signup.step2-resend-submit')}
+              <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>
+                {isResendingVerificationEmail
+                  ? t('signup.step2-resend-progress')
+                  : t('signup.step2-resend-submit')}
+              </span>
             </button>
-          </u>
+          </div>
         </div>
-        <p className="pb-2 text-sm text-bunker-400">{t('signup.step2-spam-alert')}</p>
+        <p className="text-sm text-bunker-400 pb-2">{t('signup.step2-spam-alert')}</p>
       </div>
     </div>
   );

frontend/src/components/signup/DonwloadBackupPDFStep.tsx

@@ -2,8 +2,8 @@ import { useTranslation } from 'react-i18next';
 import { faWarning } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 
-import Button from '../basic/buttons/Button';
 import issueBackupKey from '../utilities/cryptography/issueBackupKey';
+import { Button } from '../v2';
 
 interface DownloadBackupPDFStepProps {
   incrementStep: () => void;
@@ -30,33 +30,35 @@ export default function DonwloadBackupPDFStep({
   const { t } = useTranslation();
 
   return (
-    <div className="h-7/12 mx-1 mb-36 flex w-full max-w-xs flex-col items-center rounded-xl bg-bunker py-8 px-4 drop-shadow-xl md:mb-16 md:max-w-lg md:px-6">
-      <p className="flex justify-center text-center text-4xl font-semibold text-primary">
-        {t('signup.step4-message')}
+    <div className="flex flex-col items-center w-full h-full md:px-6 mx-auto mb-36 md:mb-16">
+      <p className="text-xl text-center font-medium flex justify-center text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
+        <FontAwesomeIcon icon={faWarning} className="ml-2 mr-3 pt-1 text-2xl text-bunker-200" />{t('signup.step4-message')}
       </p>
-      <div className="text-md mt-4 flex w-full max-w-md flex-col items-center justify-center rounded-md px-2 text-gray-400 md:mt-8">
-        <div>{t('signup.step4-description1')}</div>
-        <div className="mt-3">{t('signup.step4-description2')}</div>
-      </div>
-      <div className="mx-auto mt-4 flex w-full max-w-xs flex-row items-center rounded-md bg-white/10 p-2 text-gray-400 md:max-w-md">
-        <FontAwesomeIcon icon={faWarning} className="ml-2 mr-4 text-4xl" />
-        {t('signup.step4-description3')}
-      </div>
-      <div className="mx-auto mt-4 flex max-h-24 max-w-max flex-col items-center justify-center px-2 py-3 text-lg md:px-4 md:py-5">
-        <Button
-          text="Download PDF"
-          onButtonPressed={async () => {
-            await issueBackupKey({
-              email,
-              password,
-              personalName: name,
-              setBackupKeyError: () => {},
-              setBackupKeyIssued: () => {}
-            });
-            incrementStep();
-          }}
-          size="lg"
-        />
+      <div className="flex flex-col pb-2 bg-mineshaft-900 border border-mineshaft-700 items-center justify-center text-center lg:w-1/6 w-full md:min-w-[24rem] mt-8 max-w-md text-bunker-300 text-md rounded-md">
+        <div className="w-full mt-4 md:mt-8 flex flex-row text-center items-center m-2 text-bunker-300 rounded-md lg:w-1/6 lg:w-1/6 w-full md:min-w-[23rem] px-3 mx-auto">
+          <span className='mb-2'>{t('signup.step4-description1')} {t('signup.step4-description3')}</span>
+        </div>
+        <div className="flex flex-col items-center px-3 justify-center mt-0 md:mt-4 mb-2 md:mb-4 lg:w-1/6 w-full md:min-w-[20rem] mt-2 md:max-w-md mx-auto text-sm text-center md:text-left">
+          <div className="text-l py-1 text-lg w-full">
+            <Button
+              onClick={async () => {
+                await issueBackupKey({
+                  email,
+                  password,
+                  personalName: name,
+                  setBackupKeyError: () => { },
+                  setBackupKeyIssued: () => { }
+                });
+                incrementStep();
+              }}
+              size="sm"
+              isFullWidth
+              className='h-12'
+              colorSchema="primary"
+              variant="outline_bg"
+            > Download PDF </Button>
+          </div>
+        </div>
       </div>
     </div>
   );

frontend/src/components/signup/EnterEmailStep.tsx

@@ -4,8 +4,7 @@ import Link from 'next/link';
 
 import sendVerificationEmail from '@app/pages/api/auth/SendVerificationEmail';
 
-import Button from '../basic/buttons/Button';
-import InputField from '../basic/InputField';
+import { Button, Input } from '../v2';
 
 interface DownloadBackupPDFStepProps {
   incrementStep: () => void;
@@ -27,7 +26,6 @@ export default function EnterEmailStep({
   incrementStep
 }: DownloadBackupPDFStepProps): JSX.Element {
   const [emailError, setEmailError] = useState(false);
-  const [emailErrorMessage, setEmailErrorMessage] = useState('');
   const { t } = useTranslation();
 
   /**
@@ -37,11 +35,9 @@ export default function EnterEmailStep({
     let emailCheckBool = false;
     if (!email) {
       setEmailError(true);
-      setEmailErrorMessage('Please enter your email.');
       emailCheckBool = true;
     } else if (!email.includes('@') || !email.includes('.') || !/[a-z]/.test(email)) {
       setEmailError(true);
-      setEmailErrorMessage('Please enter a valid email.');
       emailCheckBool = true;
     } else {
       setEmailError(false);
@@ -56,41 +52,40 @@ export default function EnterEmailStep({
 
   return (
     <div>
-      <div className="h-7/12 mx-1 w-full max-w-md rounded-xl bg-bunker py-8 drop-shadow-xl md:px-6">
-        <p className="flex justify-center text-4xl font-semibold text-primary">
+      <div className="w-full md:px-6 mx-auto">
+        <p className="text-xl font-medium flex justify-center text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
           {t('signup.step1-start')}
         </p>
-        <div className="m-auto mt-4 flex max-h-24 w-5/6 items-center justify-center rounded-lg md:w-full md:p-2">
-          <InputField
-            label={t('common.email') ?? ''}
-            onChangeHandler={setEmail}
-            type="email"
+        <div className="flex flex-col items-center justify-center lg:w-1/6 w-1/4 min-w-[20rem] m-auto rounded-lg mt-8">
+          <Input
+            placeholder="Enter your email address..."
+            onChange={(e) => setEmail(e.target.value)}
             value={email}
-            placeholder=""
             isRequired
-            error={emailError}
-            errorText={emailErrorMessage}
             autoComplete="username"
+            className="h-12"
           />
+          {emailError && <p className="text-red-600 text-xs text-left w-full ml-1.5 mt-1.5">Please enter a valid email.</p>}
         </div>
-        <div className="mx-auto mt-4 flex max-h-28 w-5/6 max-w-xs flex-col items-center justify-center text-center text-sm md:mt-4 md:w-full md:max-w-md md:p-2 md:text-left">
-          <p className="mt-2 text-gray-400 md:mx-0.5">{t('signup.step1-privacy')}</p>
-          <div className="text-l m-2 mt-6 px-8 py-1 text-lg md:m-8">
+        <div className="flex flex-col items-center justify-center lg:w-1/6 w-1/4 min-w-[20rem] mt-2 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">
+          <div className="text-l py-1 text-lg w-full">
             <Button
-              text={t('signup.step1-submit') ?? ''}
-              type="submit"
-              onButtonPressed={emailCheck}
-              size="lg"
-            />
+              onClick={emailCheck}
+              size="sm"
+              isFullWidth
+              className='h-14'
+              colorSchema="primary"
+              variant="outline_bg"
+            > {String(t('signup.step1-submit'))} </Button>
           </div>
         </div>
       </div>
       <div className="mx-auto mb-48 mt-2 flex w-full max-w-md flex-col items-center justify-center pt-2 md:mb-16 md:pb-2">
         <Link href="/login">
           <button type="button" className="w-max pb-3 duration-200 hover:opacity-90">
-            <u className="text-sm font-normal text-primary-500">
+            <span className="text-sm text-mineshaft-400 hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer">
               {t('signup.already-have-account')}
-            </u>
+            </span>
           </button>
         </Link>
       </div>

frontend/src/components/signup/InitialSignupStep.tsx

@@ -0,0 +1,65 @@
+import { useTranslation } from 'react-i18next';
+import Link from 'next/link';
+import { useRouter } from 'next/router';
+
+// import { faGoogle } from '@fortawesome/free-brands-svg-icons';
+// import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { Button } from '../v2';
+
+export default function InitialSignupStep({
+    setIsSignupWithEmail,
+}: {
+    setIsSignupWithEmail: (value: boolean) => void
+}) {
+    const { t } = useTranslation();
+    const router = useRouter();
+
+    return <div className='flex flex-col mx-auto w-full justify-center items-center'>
+        <h1 className='text-xl font-medium text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200 text-center mb-8' >{t('signup.initial-title')}</h1>
+        {/* <div className='lg:w-1/6 w-1/4 min-w-[20rem] rounded-md'>
+            <Button
+                colorSchema="primary"
+                variant="solid"
+                onClick={() => {
+                    window.open('/api/v1/auth/redirect/google')
+                }}
+                leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-1" />}
+                className="h-14 w-full mx-0"
+            >
+                {t('signup.continue-with-google')}
+            </Button>
+        </div> */}
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md'>
+            <Button
+                colorSchema="primary"
+                variant="solid"
+                onClick={() => {
+                    setIsSignupWithEmail(true);
+                }}
+                isFullWidth
+                className="h-14 w-full mx-0"
+            >
+                {t('signup.continue-with-email')}
+            </Button>
+        </div>
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] text-center rounded-md mt-4'>
+            <Button
+                colorSchema="primary" 
+                variant="outline_bg"
+                onClick={() => router.push("/saml-sso")} 
+                isFullWidth
+                className="h-14 w-full mx-0"
+            > 
+                Continue with SAML SSO
+            </Button>
+        </div>
+        <div className='lg:w-1/6 w-1/4 min-w-[20rem] px-8 text-center mt-6 text-xs text-bunker-400'>
+            {t('signup.create-policy')}
+        </div>
+        <div className="mt-2 text-bunker-400 text-xs flex flex-row">
+            <Link href="/login">
+                <span className='hover:underline hover:underline-offset-4 hover:decoration-primary-700 hover:text-bunker-200 duration-200 cursor-pointer'>{t('signup.already-have-account')}</span>
+            </Link>
+        </div>
+    </div>
+}

frontend/src/components/signup/TeamInviteStep.tsx

@@ -7,8 +7,7 @@ import { usePopUp } from '@app/hooks/usePopUp';
 import addUserToOrg from '@app/pages/api/organization/addUserToOrg';
 import getWorkspaces from '@app/pages/api/workspace/getWorkspaces';
 
-import Button from '../basic/buttons/Button';
-import { EmailServiceSetupModal } from '../v2';
+import { Button, EmailServiceSetupModal } from '../v2';
 
 /**
  * This is the last step of the signup flow. People can optionally invite their teammates here.
@@ -37,50 +36,56 @@ export default function TeamInviteStep(): JSX.Element {
   };
 
   return (
-    <div className="h-7/12 mx-auto mb-64 w-max rounded-xl bg-bunker px-8 pt-6 pb-4 drop-shadow-xl md:mb-32">
-      <p className="flex justify-center text-4xl font-semibold text-primary">
+    <div className="w-max mx-auto min-w-lg h-full pb-4 px-8 mb-64 md:mb-32">
+      <p className="text-2xl font-semibold flex justify-center text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
         {t('signup.step5-invite-team')}
       </p>
-      <p className="mb-6 mt-4 flex max-w-xs justify-center text-center text-bunker-300 md:mx-8 md:max-w-sm">
+      <p className="text-center flex justify-center text-bunker-400 md:mx-8 mb-6 mt-4">
         {t('signup.step5-subtitle')}
       </p>
-      <div>
-        <div className="overflow-auto bg-bunker-800">
-          <div className="whitespace-pre-wrap break-words bg-transparent" />
+      <div className="bg-mineshaft-800 border border-mineshaft-500 w-max mx-auto pt-6 pb-4 px-8 rounded-xl drop-shadow-xl mb-6">
+        <div>
+          <div className="text-bunker-300 font-medium pl-1 pb-1 text-sm">
+            <span>Emails</span>
+          </div>
+          <textarea
+            className="bg-mineshaft-900/70 min-w-[30rem] h-20 w-full placeholder:text-bunker-400 py-1 px-2 rounded-md border border-mineshaft-500 text-sm text-bunker-300 outline-none focus:ring-2 ring-primary-800 ring-opacity-70"
+            value={emails}
+            onChange={(e) => setEmails(e.target.value)}
+            placeholder="email@example.com, email2@example.com..."
+          />
         </div>
-        <textarea
-          className="h-20 w-full rounded-md border border-mineshaft-500 bg-bunker-800 py-1 px-2 text-sm text-bunker-300 outline-none ring-primary-800 ring-opacity-70 placeholder:text-bunker-400 focus:ring-2"
-          value={emails}
-          onChange={(e) => setEmails(e.target.value)}
-          placeholder="email@example.com, email2@example.com..."
+        <div className="flex flex-row items-end justify-end mt-0 md:mt-4 md:mb-2 w-full md:min-w-[30rem] mt-2 md:max-w-md mx-auto text-sm">
+          <Button
+            onClick={() => {
+              if (serverDetails?.emailConfigured) {
+                inviteUsers({ emails })
+              } else {
+                handlePopUpOpen('setUpEmail');
+              }
+            }}
+            size="sm"
+            // isFullWidth
+            className='h-10'
+            colorSchema="primary"
+            variant="solid"
+          > {t('signup.step5-send-invites') ?? ''} </Button>
+        </div>
+        <EmailServiceSetupModal
+          isOpen={popUp.setUpEmail?.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle('setUpEmail', isOpen)}
         />
       </div>
-      <div className="min-w-28 mx-auto mt-4 mb-2 flex max-h-24 max-w-max flex-row items-center justify-center px-4 text-lg md:p-2">
-        <div
-          onKeyDown={() => null}
-          role="button"
-          tabIndex={0}
-          className="text-md mx-3 cursor-pointer rounded-md bg-mineshaft-700 py-3 px-5 text-bunker-300 duration-200 hover:bg-mineshaft-500 md:py-3.5 md:text-sm"
-          onClick={redirectToHome}
-        >
-          {t('signup.step5-skip')}
-        </div>
+      <div className="flex flex-row max-w-max min-w-28 items-center justify-center md:p-2 min-w-[20rem] max-h-24 mx-auto text-lg px-4 mt-4 mb-2">
         <Button
-          text={t('signup.step5-send-invites') ?? ''}
-          onButtonPressed={() => {
-            if (serverDetails?.emailConfigured) {
-              inviteUsers({ emails });
-            } else {
-              handlePopUpOpen('setUpEmail');
-            }
-          }}
-          size="lg"
-        />
+          onClick={redirectToHome}
+          size="sm"
+          isFullWidth
+          className='h-12'
+          colorSchema="secondary"
+          variant="outline"
+        > {t('signup.step5-skip') ?? 'Skip'} </Button>
       </div>
-      <EmailServiceSetupModal
-        isOpen={popUp.setUpEmail?.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle('setUpEmail', isOpen)}
-      />
     </div>
   );
 }

frontend/src/components/signup/UserInfoStep.tsx

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 
 import React, { useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { faCheck, faX } from '@fortawesome/free-solid-svg-icons';
+import { faCheck, faXmark } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import jsrp from 'jsrp';
 import nacl from 'tweetnacl';
@@ -12,13 +12,13 @@ import completeAccountInformationSignup from '@app/pages/api/auth/CompleteAccoun
 import getOrganizations from '@app/pages/api/organization/getOrgs';
 import ProjectService from '@app/services/ProjectService';
 
-import Button from '../basic/buttons/Button';
 import InputField from '../basic/InputField';
 import passwordCheck from '../utilities/checks/PasswordCheck';
 import Aes256Gcm from '../utilities/cryptography/aes-256-gcm';
 import { deriveArgonKey } from '../utilities/cryptography/crypto';
 import { saveTokenToLocalStorage } from '../utilities/saveTokenToLocalStorage';
 import SecurityClient from '../utilities/SecurityClient';
+import { Button, Input } from '../v2';
 
 // eslint-disable-next-line new-cap
 const client = new jsrp.client();
@@ -28,10 +28,13 @@ interface UserInfoStepProps {
   email: string;
   password: string;
   setPassword: (value: string) => void;
-  firstName: string;
-  setFirstName: (value: string) => void;
-  lastName: string;
-  setLastName: (value: string) => void;
+  name: string;
+  setName: (value: string) => void;
+  organizationName: string;
+  setOrganizationName: (value: string) => void;
+  attributionSource: string;
+  setAttributionSource: (value: string) => void;
+  providerAuthToken?: string;
 }
 
 /**
@@ -52,13 +55,16 @@ export default function UserInfoStep({
   email,
   password,
   setPassword,
-  firstName,
-  setFirstName,
-  lastName,
-  setLastName
+  name,
+  setName,
+  organizationName,
+  setOrganizationName,
+  attributionSource,
+  setAttributionSource,
+  providerAuthToken,
 }: UserInfoStepProps): JSX.Element {
-  const [firstNameError, setFirstNameError] = useState(false);
-  const [lastNameError, setLastNameError] = useState(false);
+  const [nameError, setNameError] = useState(false);
+  const [organizationNameError, setOrganizationNameError] = useState(false);
   const [passwordErrorLength, setPasswordErrorLength] = useState(false);
   const [passwordErrorNumber, setPasswordErrorNumber] = useState(false);
   const [passwordErrorLowerCase, setPasswordErrorLowerCase] = useState(false);
@@ -71,17 +77,17 @@ export default function UserInfoStep({
   const signupErrorCheck = async () => {
     setIsLoading(true);
     let errorCheck = false;
-    if (!firstName) {
-      setFirstNameError(true);
+    if (!name) {
+      setNameError(true);
       errorCheck = true;
     } else {
-      setFirstNameError(false);
+      setNameError(false);
     }
-    if (!lastName) {
-      setLastNameError(true);
+    if (!organizationName) {
+      setOrganizationNameError(true);
       errorCheck = true;
     } else {
-      setLastNameError(false);
+      setOrganizationNameError(false);
     }
     errorCheck = passwordCheck({
       password,
@@ -146,8 +152,8 @@ export default function UserInfoStep({
 
               const response = await completeAccountInformationSignup({
                 email,
-                firstName,
-                lastName,
+                firstName: name.split(" ")[0],
+                lastName: name.split(" ").slice(1).join(' '),
                 protectedKey,
                 protectedKeyIV,
                 protectedKeyTag,
@@ -155,14 +161,17 @@ export default function UserInfoStep({
                 encryptedPrivateKey,
                 encryptedPrivateKeyIV,
                 encryptedPrivateKeyTag,
+                providerAuthToken,
                 salt: result.salt,
                 verifier: result.verifier,
-                organizationName: `${firstName}'s organization`
+                organizationName,
+                attributionSource,
               });
 
               // unset signup JWT token and set JWT token
               SecurityClient.setSignupToken('');
               SecurityClient.setToken(response.token);
+              SecurityClient.setProviderAuthToken('');
 
               saveTokenToLocalStorage({
                 publicKey,
@@ -196,109 +205,117 @@ export default function UserInfoStep({
   };
 
   return (
-    <div className="h-7/12 mx-auto mb-36 w-max rounded-xl bg-bunker py-10 px-8 drop-shadow-xl md:mb-16">
-      <p className="mx-8 mb-6 flex justify-center text-4xl font-bold text-primary md:mx-16">
+    <div className="h-full mx-auto mb-36 w-max rounded-xl px-8 md:mb-16">
+      <p className="mx-8 mb-6 flex justify-center text-xl font-bold text-medium md:mx-16 text-transparent bg-clip-text bg-gradient-to-b from-white to-bunker-200">
         {t('signup.step3-message')}
       </p>
-      <div className="relative z-0 flex max-h-24 w-full items-center justify-end rounded-lg md:p-2">
-        <InputField
-          label={t('common.first-name')}
-          onChangeHandler={setFirstName}
-          type="name"
-          value={firstName}
-          isRequired
-          errorText={
-            t('common.validate-required', {
-              name: t('common.first-name')
-            }) as string
-          }
-          error={firstNameError}
-          autoComplete="given-name"
-        />
-      </div>
-      <div className="mt-2 flex max-h-24 w-full items-center justify-center rounded-lg md:p-2">
-        <InputField
-          label={t('common.last-name')}
-          onChangeHandler={setLastName}
-          type="name"
-          value={lastName}
-          isRequired
-          errorText={
-            t('common.validate-required', {
-              name: t('common.last-name')
-            }) as string
-          }
-          error={lastNameError}
-          autoComplete="family-name"
-        />
-      </div>
-      <div className="mt-2 flex max-h-60 w-full flex-col items-center justify-center rounded-lg md:p-2">
-        <InputField
-          label={t('section.password.password')}
-          onChangeHandler={(pass: string) => {
-            setPassword(pass);
-            passwordCheck({
-              password: pass,
-              setPasswordErrorLength,
-              setPasswordErrorNumber,
-              setPasswordErrorLowerCase,
-              errorCheck: false
-            });
-          }}
-          type="password"
-          value={password}
-          isRequired
-          error={passwordErrorLength && passwordErrorNumber && passwordErrorLowerCase}
-          autoComplete="new-password"
-          id="new-password"
-        />
-        {passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber ? (
-          <div className="mt-4 flex w-full flex-col items-start rounded-md bg-white/5 px-2 py-2">
-            <div className="mb-1 text-sm text-gray-400">{t('section.password.validate-base')}</div>
-            <div className="ml-1 flex flex-row items-center justify-start">
-              {passwordErrorLength ? (
-                <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-              )}
-              <div className={`${passwordErrorLength ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                {t('section.password.validate-length')}
-              </div>
-            </div>
-            <div className="ml-1 flex flex-row items-center justify-start">
-              {passwordErrorLowerCase ? (
-                <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-              )}
-              <div
-                className={`${passwordErrorLowerCase ? 'text-gray-400' : 'text-gray-600'} text-sm`}
-              >
-                {t('section.password.validate-case')}
-              </div>
-            </div>
-            <div className="ml-1 flex flex-row items-center justify-start">
-              {passwordErrorNumber ? (
-                <FontAwesomeIcon icon={faX} className="text-md mr-2.5 text-red" />
-              ) : (
-                <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
-              )}
-              <div className={`${passwordErrorNumber ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
-                {t('section.password.validate-number')}
+      <div className="h-full mx-auto mb-36 w-max rounded-xl py-6 px-8 md:mb-16 border border-mineshaft-600 bg-mineshaft-800">
+        <div className="relative z-0 lg:w-1/6 w-1/4 min-w-[20rem] flex flex-col items-center justify-end w-full py-2 rounded-lg">
+          <p className='text-left w-full text-sm text-bunker-300 mb-1 ml-1 font-medium'>Your Name</p>
+          <Input
+            placeholder="Jane Doe"
+            onChange={(e) => setName(e.target.value)}
+            value={name}
+            isRequired
+            autoComplete="given-name"
+            className="h-12"
+          />
+          {nameError && <p className='text-left w-full text-xs text-red-600 mt-1 ml-1'>Please, specify your name</p>}
+        </div>
+        <div className="relative z-0 lg:w-1/6 w-1/4 min-w-[20rem] flex flex-col items-center justify-end w-full py-2 rounded-lg">
+          <p className='text-left w-full text-sm text-bunker-300 mb-1 ml-1 font-medium'>Organization Name</p>
+          <Input
+            placeholder="Infisical"
+            onChange={(e) => setOrganizationName(e.target.value)}
+            value={organizationName}
+            isRequired
+            className="h-12"
+          />
+          {organizationNameError && <p className='text-left w-full text-xs text-red-600 mt-1 ml-1'>Please, specify your organization name</p>}
+        </div>
+        <div className="relative z-0 lg:w-1/6 w-1/4 min-w-[20rem] flex flex-col items-center justify-end w-full py-2 rounded-lg">
+          <p className='text-left w-full text-sm text-bunker-300 mb-1 ml-1 font-medium'>Where did you hear about us? <span className="font-light">(optional)</span></p>
+          <Input
+            placeholder=""
+            onChange={(e) => setAttributionSource(e.target.value)}
+            value={attributionSource}
+            isRequired
+            className="h-12"
+          />
+        </div>
+        <div className="mt-2 flex lg:w-1/6 w-1/4 min-w-[20rem] max-h-60 w-full flex-col items-center justify-center rounded-lg py-2">
+          <InputField
+            label={t('section.password.password')}
+            onChangeHandler={(pass: string) => {
+              setPassword(pass);
+              passwordCheck({
+                password: pass,
+                setPasswordErrorLength,
+                setPasswordErrorNumber,
+                setPasswordErrorLowerCase,
+                errorCheck: false
+              });
+            }}
+            type="password"
+            value={password}
+            isRequired
+            error={passwordErrorLength && passwordErrorNumber && passwordErrorLowerCase}
+            autoComplete="new-password"
+            id="new-password"
+          />
+          {passwordErrorLength || passwordErrorLowerCase || passwordErrorNumber ? (
+            <div className="mt-4 flex w-full flex-col items-start rounded-md bg-white/5 px-2 py-2">
+              <div className="mb-1 text-sm text-gray-400">{t('section.password.validate-base')}</div>
+              <div className="ml-1 flex flex-row items-center justify-start">
+                {passwordErrorLength ? (
+                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
+                ) : (
+                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
+                )}
+                <div className={`${passwordErrorLength ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
+                  {t('section.password.validate-length')}
+                </div>
+              </div>
+              <div className="ml-1 flex flex-row items-center justify-start">
+                {passwordErrorLowerCase ? (
+                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
+                ) : (
+                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
+                )}
+                <div
+                  className={`${passwordErrorLowerCase ? 'text-gray-400' : 'text-gray-600'} text-sm`}
+                >
+                  {t('section.password.validate-case')}
+                </div>
+              </div>
+              <div className="ml-1 flex flex-row items-center justify-start">
+                {passwordErrorNumber ? (
+                  <FontAwesomeIcon icon={faXmark} className="text-md text-red ml-0.5 mr-2.5" />
+                ) : (
+                  <FontAwesomeIcon icon={faCheck} className="text-md mr-2 text-primary" />
+                )}
+                <div className={`${passwordErrorNumber ? 'text-gray-400' : 'text-gray-600'} text-sm`}>
+                  {t('section.password.validate-number')}
+                </div>
               </div>
             </div>
+          ) : (
+            <div className="py-2" />
+          )}
+        </div>
+        <div className="flex flex-col items-center justify-center lg:w-[19%] w-1/4 min-w-[20rem] mt-2 max-w-xs md:max-w-md mx-auto text-sm text-center md:text-left">
+          <div className="text-l py-1 text-lg w-full">
+            <Button
+              onClick={signupErrorCheck}
+              size="sm"
+              isFullWidth
+              className='h-14'
+              colorSchema="primary"
+              variant="outline_bg"
+              isLoading={isLoading}
+            > {String(t('signup.signup'))} </Button>
           </div>
-        ) : (
-          <div className="py-2" />
-        )}
-      </div>
-      <div className="mx-auto flex max-h-48 max-w-max flex-col items-center justify-center px-2 py-3 text-lg md:p-2">
-        <Button
-          text={t('signup.signup') ?? ''}
-          loading={isLoading}
-          onButtonPressed={signupErrorCheck}
-          size="lg"
-        />
+        </div>
       </div>
     </div>
   );

frontend/src/components/utilities/SecurityClient.ts

@@ -4,8 +4,20 @@ import {
   setMfaTempToken,
   setSignupTempToken} from '@app/reactQuery';
 
+
+export const PROVIDER_AUTH_TOKEN_KEY = 'infisical__provider-auth-token';
+
 // depreciated: go for apiRequest module in config/api
 export default class SecurityClient {
+
+  static setProviderAuthToken(tokenStr: string) {
+    localStorage.setItem(PROVIDER_AUTH_TOKEN_KEY, tokenStr || '')
+  }
+
+  static getProviderAuthToken() {
+    return localStorage.getItem(PROVIDER_AUTH_TOKEN_KEY);
+  }
+
   static setSignupToken(tokenStr: string) {
     setSignupTempToken(tokenStr);
   }

frontend/src/components/utilities/attemptLogin.ts

@@ -26,9 +26,17 @@ interface IsLoginSuccessful {
  * @param {string} password - password of user to log in
  */
 const attemptLogin = async (
-  email: string,
-  password: string
+  {
+    email,
+    password,
+    providerAuthToken,
+  }: {
+    email: string;
+    password: string;
+    providerAuthToken?: string;
+  }
 ): Promise<IsLoginSuccessful> => {
+
   const telemetry = new Telemetry().getInstance();
   return new Promise((resolve, reject) => {
     client.init(
@@ -39,7 +47,11 @@ const attemptLogin = async (
       async () => {
         try {
           const clientPublicKey = client.getPublicKey();
-          const { serverPublicKey, salt } = await login1(email, clientPublicKey);
+          const { serverPublicKey, salt } = await login1({
+            email,
+            clientPublicKey,
+            providerAuthToken,
+          });
 
           client.setSalt(salt);
           client.setServerPublicKey(serverPublicKey);
@@ -57,8 +69,11 @@ const attemptLogin = async (
             iv, 
             tag 
           } = await login2(
-            email,
-            clientProof
+            {
+              email,
+              clientProof,
+              providerAuthToken,
+            }
           );
           
           if (mfaEnabled) {
@@ -80,7 +95,9 @@ const attemptLogin = async (
             token
           ) {
             // case: MFA is not enabled
-            
+
+            // unset provider auth token in case it was used
+            SecurityClient.setProviderAuthToken('');            
             // set JWT token
             SecurityClient.setToken(token);
             
@@ -137,4 +154,4 @@ const attemptLogin = async (
   });
 };
 
-export default attemptLogin;
+export default attemptLogin;

frontend/src/components/utilities/attemptLoginMfa.ts

@@ -23,10 +23,12 @@ const client = new jsrp.client();
 const attemptLoginMfa = async ({
     email,
     password,
+    providerAuthToken,
     mfaToken
 }: {
     email: string;
     password: string;
+    providerAuthToken?: string,
     mfaToken: string;
 }): Promise<Boolean> => {
     return new Promise((resolve, reject) => {
@@ -36,7 +38,11 @@ const attemptLoginMfa = async ({
         }, async () => {
             try {
                 const clientPublicKey = client.getPublicKey();
-                const { salt } = await login1(email, clientPublicKey);
+                const { salt } = await login1({
+                    email,
+                    clientPublicKey,
+                    providerAuthToken,
+                });
                 
                 const {
                     encryptionVersion,
@@ -56,6 +62,7 @@ const attemptLoginMfa = async ({
                 // unset temporary (MFA) JWT token and set JWT token
                 SecurityClient.setMfaToken('');
                 SecurityClient.setToken(token);
+                SecurityClient.setProviderAuthToken('');
 
                 const privateKey = await KeyService.decryptPrivateKey({
                     encryptionVersion,

frontend/src/components/v2/Button/Button.tsx

@@ -63,6 +63,11 @@ const buttonVariants = cva(
         variant: 'star',
         className: 'bg-mineshaft-700 border border-mineshaft-600 hover:bg-primary hover:text-black hover:border-primary-400 duration-100'
       },
+      {
+        colorSchema: 'primary',
+        variant: 'solid',
+        className: 'bg-primary-500 bg-opacity-90 hover:bg-primary-500 hover:text-black'
+      },
       {
         colorSchema: 'primary',
         variant: 'selected',
@@ -71,7 +76,7 @@ const buttonVariants = cva(
       {
         colorSchema: 'primary',
         variant: 'outline_bg',
-        className: 'bg-mineshaft-700 border border-mineshaft-600 hover:bg-primary/[0.15] hover:border-primary/60 text-bunker-200 duration-100'
+        className: 'bg-mineshaft-600 border border-mineshaft-500 hover:bg-primary/[0.1] hover:border-primary/40 text-bunker-200'
       },
       {
         colorSchema: 'secondary',
@@ -91,7 +96,7 @@ const buttonVariants = cva(
       {
         colorSchema: 'secondary',
         variant: 'outline',
-        className: 'hover:bg-mineshaft'
+        className: 'border-mineshaft-700 hover:border-mineshaft-500'
       },
       {
         colorSchema: 'danger',
@@ -172,10 +177,10 @@ export const Button = forwardRef<HTMLButtonElement, ButtonProps>(
       >
         {isLoading && (
           <img
-            src="/images/loading/loadingblack.gif"
+            src="/images/loading/loading.gif"
             width={36}
             alt="loading animation"
-            className="absolute rounded-xl"
+            className="absolute rounded-xl opacity-80"
           />
         )}
         <div

frontend/src/components/v2/EmptyState/EmptyState.tsx

@@ -1,4 +1,5 @@
 import { ReactNode } from 'react';
+import { SizeProp } from '@fortawesome/fontawesome-svg-core';
 import { faCubesStacked, IconDefinition } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import { twMerge } from 'tailwind-merge';
@@ -8,13 +9,25 @@ type Props = {
   className?: string;
   children?: ReactNode;
   icon?: IconDefinition;
+  iconSize?: SizeProp;
 };
 
-export const EmptyState = ({ title, className, children, icon = faCubesStacked }: Props) => (
-  <div className={twMerge('flex w-full bg-bunker-700 flex-col items-center px-2 pt-6 text-bunker-300', className)}>
-    <FontAwesomeIcon icon={icon} size="2x" className='mr-4' />
-    <div className='flex flex-row items-center py-4'>
-      <div className="text-bunker-300 text-sm">{title}</div>
+export const EmptyState = ({
+  title,
+  className,
+  children,
+  icon = faCubesStacked,
+  iconSize = '2x'
+}: Props) => (
+  <div
+    className={twMerge(
+      'flex w-full flex-col items-center bg-bunker-700 px-2 pt-6 text-bunker-300',
+      className
+    )}
+  >
+    <FontAwesomeIcon icon={icon} size={iconSize} className="mr-4" />
+    <div className="flex flex-row items-center py-4">
+      <div className="text-sm text-bunker-300">{title}</div>
       <div>{children}</div>
     </div>
   </div>

frontend/src/components/v2/Input/Input.tsx

@@ -13,7 +13,7 @@ type Props = {
 };
 
 const inputVariants = cva(
-  'input w-full py-[0.375rem] text-gray-400 placeholder:text-sm placeholder-gray-500 placeholder-opacity-50 outline-none focus:ring-2',
+  'input w-full py-[0.375rem] text-gray-400 placeholder:text-sm placeholder-gray-500 placeholder-opacity-50 outline-none focus:ring-2 hover:ring-[0.05rem] hover:ring-bunker-400/60 duration-100',
   {
     variants: {
       size: {
@@ -27,13 +27,13 @@ const inputVariants = cva(
         false: ''
       },
       variant: {
-        filled: ['bg-bunker-800', 'text-gray-400'],
+        filled: ['bg-mineshaft-900', 'text-gray-400'],
         outline: ['bg-transparent'],
         plain: 'bg-transparent outline-none'
       },
       isError: {
         true: 'focus:ring-red/50 placeholder-red-300',
-        false: 'focus:ring-mineshaft-400/80 duration-200 focus:ring-1'
+        false: 'focus:ring-primary-400/50 focus:ring-1'
       }
     },
     compoundVariants: []
@@ -48,7 +48,7 @@ const inputParentContainerVariants = cva('inline-flex font-inter items-center bo
     },
     isError: {
       true: 'border-red',
-      false: 'border-mineshaft-600'
+      false: 'border-mineshaft-500'
     },
     isFullWidth: {
       true: 'w-full',

frontend/src/components/v2/Tooltip/Tooltip.tsx

@@ -35,7 +35,7 @@ export const Tooltip = ({
       sideOffset={5}
       {...props}
       className={twMerge(
-        `z-20 select-none max-w-[15rem] rounded-md bg-mineshaft-800 border border-mineshaft-600 py-2 px-4 font-light text-sm text-bunker-200 shadow-md 
+        `z-50 max-w-[15rem] select-none rounded-md border border-mineshaft-600 bg-mineshaft-800 py-2 px-4 text-sm font-light text-bunker-200 shadow-md 
 data-[state=delayed-open]:data-[side=top]:animate-slideDownAndFade
 data-[state=delayed-open]:data-[side=right]:animate-slideLeftAndFade
 data-[state=delayed-open]:data-[side=left]:animate-slideRightAndFade

frontend/src/config/request.ts

@@ -1,5 +1,6 @@
 import axios from 'axios';
 
+import SecurityClient from '@app/components/utilities/SecurityClient';
 import {
   getAuthToken,
   getMfaTempToken,
@@ -16,6 +17,7 @@ apiRequest.interceptors.request.use((config) => {
   const signupTempToken = getSignupTempToken();
   const mfaTempToken = getMfaTempToken();
   const token = getAuthToken();
+  const providerAuthToken = SecurityClient.getProviderAuthToken();
   
   if (signupTempToken && config.headers) {
     // eslint-disable-next-line no-param-reassign
@@ -26,6 +28,9 @@ apiRequest.interceptors.request.use((config) => {
   } else if (token && config.headers) {
     // eslint-disable-next-line no-param-reassign
     config.headers.Authorization = `Bearer ${token}`;
+  } else if(providerAuthToken && config.headers) {
+    // eslint-disable-next-line no-param-reassign
+    config.headers.Authorization = `Bearer ${providerAuthToken}`;
   }
   return config;
 });

frontend/src/const.ts

@@ -16,7 +16,10 @@ export const publicPaths = [
   `/terms`,
   `/subprocessors`,
   `/verify-email`,
-  `/password-reset`
+  `/password-reset`,
+  `/saml-sso`,
+  `/login/provider/success`,
+  `/login/provider/error`
 ];
 
 export const languageMap = {

frontend/src/hooks/api/index.tsx

@@ -2,6 +2,7 @@ export * from './auth';
 export * from './incidentContacts';
 export * from './keys';
 export * from './organization';
+export * from './secretFolders';
 export * from './secrets';
 export * from './secretSnapshots';
 export * from './serviceAccounts';

frontend/src/hooks/api/secretFolders/index.tsx

@@ -0,0 +1 @@
+export { useCreateFolder, useDeleteFolder, useGetProjectFolders, useUpdateFolder } from './queries';

frontend/src/hooks/api/secretFolders/queries.tsx

@@ -0,0 +1,129 @@
+import { useCallback } from 'react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+
+import { apiRequest } from '@app/config/request';
+
+import { secretSnapshotKeys } from '../secretSnapshots/queries';
+import {
+  CreateFolderDTO,
+  DeleteFolderDTO,
+  GetProjectFoldersDTO,
+  TSecretFolder,
+  UpdateFolderDTO
+} from './types';
+
+const queryKeys = {
+  getSecretFolders: (workspaceId: string, environment: string, parentFolderId?: string) =>
+    ['secret-folders', { workspaceId, environment, parentFolderId }] as const
+};
+
+export const useGetProjectFolders = ({
+  workspaceId,
+  parentFolderId,
+  environment,
+  isPaused,
+  sortDir
+}: GetProjectFoldersDTO) =>
+  useQuery({
+    queryKey: queryKeys.getSecretFolders(workspaceId, environment, parentFolderId),
+    enabled: Boolean(workspaceId) && Boolean(environment) && !isPaused,
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ folders: TSecretFolder[]; dir: TSecretFolder[] }>(
+        '/api/v1/folders',
+        {
+          params: {
+            workspaceId,
+            environment,
+            parentFolderId
+          }
+        }
+      );
+      return data;
+    },
+    select: useCallback(
+      ({ folders, dir }: { folders: TSecretFolder[]; dir: TSecretFolder[] }) => ({
+        dir,
+        folders: folders.sort((a, b) =>
+          sortDir === 'asc'
+            ? a?.name?.localeCompare(b?.name || '')
+            : b?.name?.localeCompare(a?.name || '')
+        )
+      }),
+      [sortDir]
+    )
+  });
+
+export const useCreateFolder = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<{}, {}, CreateFolderDTO>({
+    mutationFn: async (dto) => {
+      const { data } = await apiRequest.post('/api/v1/folders', dto);
+      return data;
+    },
+    onSuccess: (_, { workspaceId, environment, parentFolderId }) => {
+      queryClient.invalidateQueries(
+        queryKeys.getSecretFolders(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.count(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.list(workspaceId, environment, parentFolderId)
+      );
+    }
+  });
+};
+
+export const useUpdateFolder = (parentFolderId: string) => {
+  const queryClient = useQueryClient();
+
+  return useMutation<{}, {}, UpdateFolderDTO>({
+    mutationFn: async ({ folderId, name, environment, workspaceId }) => {
+      const { data } = await apiRequest.patch(`/api/v1/folders/${folderId}`, {
+        name,
+        environment,
+        workspaceId
+      });
+      return data;
+    },
+    onSuccess: (_, { workspaceId, environment }) => {
+      queryClient.invalidateQueries(
+        queryKeys.getSecretFolders(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.count(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.list(workspaceId, environment, parentFolderId)
+      );
+    }
+  });
+};
+
+export const useDeleteFolder = (parentFolderId: string) => {
+  const queryClient = useQueryClient();
+
+  return useMutation<{}, {}, DeleteFolderDTO>({
+    mutationFn: async ({ folderId, environment, workspaceId }) => {
+      const { data } = await apiRequest.delete(`/api/v1/folders/${folderId}`, {
+        data: {
+          environment,
+          workspaceId
+        }
+      });
+      return data;
+    },
+    onSuccess: (_, { workspaceId, environment }) => {
+      queryClient.invalidateQueries(
+        queryKeys.getSecretFolders(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.count(workspaceId, environment, parentFolderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.list(workspaceId, environment, parentFolderId)
+      );
+    }
+  });
+};

frontend/src/hooks/api/secretFolders/types.ts

@@ -0,0 +1,32 @@
+export type TSecretFolder = {
+  id: string;
+  name: string;
+};
+
+export type GetProjectFoldersDTO = {
+  workspaceId: string;
+  environment: string;
+  parentFolderId?: string;
+  isPaused?: boolean;
+  sortDir?: 'asc' | 'desc';
+};
+
+export type CreateFolderDTO = {
+  workspaceId: string;
+  environment: string;
+  folderName: string;
+  parentFolderId?: string;
+};
+
+export type UpdateFolderDTO = {
+  workspaceId: string;
+  environment: string;
+  name: string;
+  folderId: string;
+};
+
+export type DeleteFolderDTO = {
+  workspaceId: string;
+  environment: string;
+  folderId: string;
+};

frontend/src/hooks/api/secretSnapshots/queries.tsx

@@ -17,18 +17,31 @@ import {
 } from './types';
 
 export const secretSnapshotKeys = {
-  list: (workspaceId: string) => [{ workspaceId }, 'secret-snapshot'] as const,
+  list: (workspaceId: string, env: string, folderId?: string) =>
+    [{ workspaceId, env, folderId }, 'secret-snapshot'] as const,
   snapshotSecrets: (snapshotId: string) => [{ snapshotId }, 'secret-snapshot'] as const,
-  count: (workspaceId: string) => [{ workspaceId }, 'count', 'secret-snapshot']
+  count: (workspaceId: string, env: string, folderId?: string) => [
+    { workspaceId, env, folderId },
+    'count',
+    'secret-snapshot'
+  ]
 };
 
-const fetchWorkspaceSecretSnaphots = async (workspaceId: string, limit = 10, offset = 0) => {
+const fetchWorkspaceSecretSnaphots = async (
+  workspaceId: string,
+  environment: string,
+  folderId?: string,
+  limit = 10,
+  offset = 0
+) => {
   const res = await apiRequest.get<{ secretSnapshots: TWorkspaceSecretSnapshot[] }>(
     `/api/v1/workspace/${workspaceId}/secret-snapshots`,
     {
       params: {
         limit,
-        offset
+        offset,
+        environment,
+        folderId
       }
     }
   );
@@ -38,9 +51,16 @@ const fetchWorkspaceSecretSnaphots = async (workspaceId: string, limit = 10, off
 
 export const useGetWorkspaceSecretSnapshots = (dto: GetWorkspaceSecretSnapshotsDTO) =>
   useInfiniteQuery({
-    enabled: Boolean(dto.workspaceId),
-    queryKey: secretSnapshotKeys.list(dto.workspaceId),
-    queryFn: ({ pageParam }) => fetchWorkspaceSecretSnaphots(dto.workspaceId, dto.limit, pageParam),
+    enabled: Boolean(dto.workspaceId && dto.environment),
+    queryKey: secretSnapshotKeys.list(dto.workspaceId, dto.environment, dto?.folder),
+    queryFn: ({ pageParam }) =>
+      fetchWorkspaceSecretSnaphots(
+        dto.workspaceId,
+        dto.environment,
+        dto?.folder,
+        dto.limit,
+        pageParam
+      ),
     getNextPageParam: (lastPage, pages) =>
       lastPage.length !== 0 ? pages.length * dto.limit : undefined
   });
@@ -115,40 +135,54 @@ export const useGetSnapshotSecrets = ({ decryptFileKey, env, snapshotId }: TSnap
         }
       });
 
-      return { version: data.version, secrets: sharedSecrets, createdAt: data.createdAt };
+      return {
+        version: data.version,
+        secrets: sharedSecrets,
+        createdAt: data.createdAt,
+        folders: data.folderVersion
+      };
     }
   });
 
-const fetchWorkspaceSecretSnaphotCount = async (workspaceId: string) => {
+const fetchWorkspaceSecretSnaphotCount = async (
+  workspaceId: string,
+  environment: string,
+  folderId?: string
+) => {
   const res = await apiRequest.get<{ count: number }>(
-    `/api/v1/workspace/${workspaceId}/secret-snapshots/count`
+    `/api/v1/workspace/${workspaceId}/secret-snapshots/count`,
+    {
+      params: {
+        environment,
+        folderId
+      }
+    }
   );
   return res.data.count;
 };
 
-export const useGetWsSnapshotCount = (workspaceId: string) =>
+export const useGetWsSnapshotCount = (workspaceId: string, env: string, folderId?: string) =>
   useQuery({
-    enabled: Boolean(workspaceId),
-    queryKey: secretSnapshotKeys.count(workspaceId),
-    queryFn: () => fetchWorkspaceSecretSnaphotCount(workspaceId)
+    enabled: Boolean(workspaceId && env),
+    queryKey: secretSnapshotKeys.count(workspaceId, env, folderId),
+    queryFn: () => fetchWorkspaceSecretSnaphotCount(workspaceId, env, folderId)
   });
 
 export const usePerformSecretRollback = () => {
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TSecretRollbackDTO>({
-    mutationFn: async (dto) => {
+    mutationFn: async ({ workspaceId, ...dto }) => {
       const { data } = await apiRequest.post(
-        `/api/v1/workspace/${dto.workspaceId}/secret-snapshots/rollback`,
-        {
-          version: dto.version
-        }
+        `/api/v1/workspace/${workspaceId}/secret-snapshots/rollback`,
+        dto
       );
       return data;
     },
-    onSuccess: (_, dto) => {
-      queryClient.invalidateQueries(secretSnapshotKeys.list(dto.workspaceId));
-      queryClient.invalidateQueries(secretSnapshotKeys.count(dto.workspaceId));
+    onSuccess: (_, { workspaceId, environment, folderId }) => {
+      queryClient.invalidateQueries([{ workspaceId, environment }, 'secrets']);
+      queryClient.invalidateQueries(secretSnapshotKeys.list(workspaceId, environment, folderId));
+      queryClient.invalidateQueries(secretSnapshotKeys.count(workspaceId, environment, folderId));
     }
   });
 };

frontend/src/hooks/api/secretSnapshots/types.ts

@@ -13,6 +13,7 @@ export type TWorkspaceSecretSnapshot = {
 
 export type TSnapshotSecret = Omit<TWorkspaceSecretSnapshot, 'secretVersions'> & {
   secretVersions: EncryptedSecretVersion[];
+  folderVersion: Array<{ name: string; id: string }>;
 };
 
 export type TSnapshotSecretProps = {
@@ -24,9 +25,13 @@ export type TSnapshotSecretProps = {
 export type GetWorkspaceSecretSnapshotsDTO = {
   workspaceId: string;
   limit: number;
+  environment: string;
+  folder?: string;
 };
 
 export type TSecretRollbackDTO = {
   workspaceId: string;
   version: number;
+  environment: string;
+  folderId?: string;
 };

frontend/src/hooks/api/secrets/queries.tsx

@@ -19,19 +19,24 @@ import {
 
 export const secretKeys = {
   // this is also used in secretSnapshot part
-  getProjectSecret: (workspaceId: string, env: string | string[]) => [
-    { workspaceId, env },
+  getProjectSecret: (workspaceId: string, env: string | string[], folderId?: string) => [
+    { workspaceId, env, folderId },
     'secrets'
   ],
   getSecretVersion: (secretId: string) => [{ secretId }, 'secret-versions']
 };
 
-const fetchProjectEncryptedSecrets = async (workspaceId: string, env: string | string[]) => {
+const fetchProjectEncryptedSecrets = async (
+  workspaceId: string,
+  env: string | string[],
+  folderId?: string
+) => {
   if (typeof env === 'string') {
     const { data } = await apiRequest.get<{ secrets: EncryptedSecret[] }>('/api/v2/secrets', {
       params: {
         environment: env,
-        workspaceId
+        workspaceId,
+        folderId: folderId || undefined
       }
     });
     return data.secrets;
@@ -46,7 +51,8 @@ const fetchProjectEncryptedSecrets = async (workspaceId: string, env: string | s
       const { data } = await apiRequest.get<{ secrets: EncryptedSecret[] }>('/api/v2/secrets', {
         params: {
           environment: envPoint,
-          workspaceId
+          workspaceId,
+          folderId
         }
       });
       allEnvData = allEnvData.concat(data.secrets);
@@ -63,13 +69,14 @@ export const useGetProjectSecrets = ({
   workspaceId,
   env,
   decryptFileKey,
-  isPaused
+  isPaused,
+  folderId
 }: GetProjectSecretsDTO) =>
   useQuery({
     // wait for all values to be available
     enabled: Boolean(decryptFileKey && workspaceId && env) && !isPaused,
-    queryKey: secretKeys.getProjectSecret(workspaceId, env),
-    queryFn: () => fetchProjectEncryptedSecrets(workspaceId, env),
+    queryKey: secretKeys.getProjectSecret(workspaceId, env, folderId),
+    queryFn: () => fetchProjectEncryptedSecrets(workspaceId, env, folderId),
     select: (data) => {
       const PRIVATE_KEY = localStorage.getItem('PRIVATE_KEY') as string;
       const latestKey = decryptFileKey;
@@ -283,9 +290,15 @@ export const useBatchSecretsOp = () => {
       return data;
     },
     onSuccess: (_, dto) => {
-      queryClient.invalidateQueries(secretKeys.getProjectSecret(dto.workspaceId, dto.environment));
-      queryClient.invalidateQueries(secretSnapshotKeys.list(dto.workspaceId));
-      queryClient.invalidateQueries(secretSnapshotKeys.count(dto.workspaceId));
+      queryClient.invalidateQueries(
+        secretKeys.getProjectSecret(dto.workspaceId, dto.environment, dto.folderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.list(dto.workspaceId, dto.environment, dto?.folderId)
+      );
+      queryClient.invalidateQueries(
+        secretSnapshotKeys.count(dto.workspaceId, dto.environment, dto?.folderId)
+      );
     }
   });
 };

frontend/src/hooks/api/secrets/types.ts

@@ -61,6 +61,7 @@ type SecretTagArg = { _id: string; name: string; slug: string };
 
 export type UpdateSecretArg = {
   _id: string;
+  folderId?: string;
   type: 'shared' | 'personal';
   secretName: string;
   secretKeyCiphertext: string;
@@ -81,6 +82,7 @@ export type DeleteSecretArg = { _id: string };
 
 export type BatchSecretDTO = {
   workspaceId: string;
+  folderId: string;
   environment: string;
   requests: Array<
     | { method: 'POST'; secret: CreateSecretArg }
@@ -93,6 +95,7 @@ export type GetProjectSecretsDTO = {
   workspaceId: string;
   env: string | string[];
   decryptFileKey: UserWsKeyPair;
+  folderId?: string;
   isPaused?: boolean;
   onSuccess?: (data: DecryptedSecret[]) => void;
 };

frontend/src/hooks/useProviderAuth.ts

@@ -0,0 +1,99 @@
+import { useEffect, useState } from 'react';
+import { useRouter } from 'next/router';
+import jwt_decode from 'jwt-decode';
+
+import { useNotificationContext } from '@app/components/context/Notifications/NotificationProvider';
+import SecurityClient, { PROVIDER_AUTH_TOKEN_KEY } from '@app/components/utilities/SecurityClient';
+
+export const useProviderAuth = () => {
+    const router = useRouter();
+    const { providerAuthToken: redirectedProviderAuthToken } = router.query;
+    const [email, setEmail] = useState<string>('');
+    const [userId, setUserId] = useState<string>('');
+    const [providerAuthToken, setProviderAuthToken] = useState<string>(
+        redirectedProviderAuthToken as string || ''
+    );
+    const [isProviderUserCompleted, setIsProviderUserCompleted] = useState<boolean>();
+    const { createNotification } = useNotificationContext();
+    const AUTH_ERROR_KEY = 'PROVIDER_AUTH_ERROR'
+
+    const handleRedirectWithToken = () => {
+        if (providerAuthToken) {
+            const {
+                userId: resultUserId,
+                email: resultEmail,
+                isUserCompleted: resultIsUserCompleted,
+            } = jwt_decode(providerAuthToken) as any;
+            setEmail(resultEmail);
+            setUserId(resultUserId);
+            setIsProviderUserCompleted(resultIsUserCompleted);
+        }
+
+    }
+
+    useEffect(() => {
+        handleRedirectWithToken();
+
+        // reset when there is no redirect auth token
+        if (!providerAuthToken) {
+            SecurityClient.setProviderAuthToken('');
+        }
+
+        window.localStorage.removeItem(AUTH_ERROR_KEY);
+
+        const handleStorageChange = (event: StorageEvent) => {
+            if (event.storageArea !== localStorage) {
+                return;
+            }
+
+            if (event.key === PROVIDER_AUTH_TOKEN_KEY) {
+                if (event.newValue) {
+                    const token = event.newValue;
+                    const {
+                        userId: resultUserId,
+                        email: resultEmail,
+                        isUserCompleted: resultIsUserCompleted,
+                    } = jwt_decode(token) as any;
+                    setIsProviderUserCompleted(resultIsUserCompleted);
+                    setProviderAuthToken(token);
+                    setEmail(resultEmail);
+                    setUserId(resultUserId);
+                } else {
+                    setProviderAuthToken('');
+                    setEmail('');
+                    setUserId('');
+                    setIsProviderUserCompleted(false);
+                }
+                setProviderAuthToken(event.newValue || '');
+            }
+
+            if (event.key === AUTH_ERROR_KEY) {
+                if (event.newValue) {
+                    createNotification({
+                        text: 'An error has occured during login.',
+                        type: 'error',
+                        timeoutMs: 6000,
+                    })
+
+                    window.localStorage.removeItem(AUTH_ERROR_KEY);
+                }
+            }
+        };
+
+        window.addEventListener('storage', handleStorageChange);
+
+        return () => {
+            window.removeEventListener('storage', handleStorageChange);
+        };
+    }, []);
+
+    return {
+        email,
+        isProviderUserCompleted,
+        providerAuthToken,
+        userId,
+        setEmail,
+        setProviderAuthToken,
+        setUserId,
+    };
+};

frontend/src/pages/_app.tsx

@@ -57,9 +57,11 @@ const App = ({ Component, pageProps, ...appProps }: NextAppProp): JSX.Element =>
   ) {
     return (
       <QueryClientProvider client={queryClient}>
-        <AuthProvider>
-          <Component {...pageProps} />
-        </AuthProvider>
+        <NotificationProvider>
+          <AuthProvider>
+            <Component {...pageProps} />
+          </AuthProvider>
+        </NotificationProvider>
       </QueryClientProvider>
     );
   }

frontend/src/pages/api/auth/CompleteAccountInformationSignup.ts

@@ -8,6 +8,7 @@ interface Props {
   protectedKey: string;
   protectedKeyIV: string;
   protectedKeyTag: string;
+  providerAuthToken?: string;
   publicKey: string;
   encryptedPrivateKey: string;
   encryptedPrivateKeyIV: string;
@@ -15,6 +16,7 @@ interface Props {
   organizationName: string;
   salt: string;
   verifier: string;
+  attributionSource?: string;
 }
 
 /**
@@ -49,9 +51,11 @@ const completeAccountInformationSignup = async ({
   encryptedPrivateKeyTag,
   salt,
   verifier,
-  organizationName
+  organizationName,
+  providerAuthToken,
+  attributionSource
 }: Props) => {
-  const { data } = await apiRequest.post('/api/v2/signup/complete-account/signup', {
+  const { data } = await apiRequest.post('/api/v3/signup/complete-account/signup', {
     email,
     firstName,
     lastName,
@@ -64,7 +68,9 @@ const completeAccountInformationSignup = async ({
     encryptedPrivateKeyTag,
     salt,
     verifier,
-    organizationName
+    organizationName,
+    providerAuthToken,
+    attributionSource,
   });
 
   return data;

frontend/src/pages/api/auth/Login1.ts

@@ -9,16 +9,17 @@ interface Login1 {
  * @param {*} clientPublicKey
  * @returns
  */
-const login1 = async (email: string, clientPublicKey: string) => {
-  const response = await fetch("/api/v2/auth/login1", {
+const login1 = async (loginDetails: {
+  email: string;
+  clientPublicKey: string;
+  providerAuthToken?: string;
+}) => {
+  const response = await fetch("/api/v3/auth/login1", {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
     },
-    body: JSON.stringify({
-      email,
-      clientPublicKey,
-    }),
+    body: JSON.stringify(loginDetails),
   });
   // need precise error handling about the status code
   if (response?.status === 200) {

frontend/src/pages/api/auth/Login2.ts

@@ -17,16 +17,17 @@ interface Login2Response {
  * @param {*} clientPublicKey
  * @returns
  */
-const login2 = async (email: string, clientProof: string) => {
-  const response = await fetch('/api/v2/auth/login2', {
+const login2 = async (loginDetails: {
+  email: string;
+  clientProof: string;
+  providerAuthToken?: string;
+}) => {
+  const response = await fetch('/api/v3/auth/login2', {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json'
     },
-    body: JSON.stringify({
-      email,
-      clientProof
-    }),
+    body: JSON.stringify(loginDetails),
     credentials: 'include'
   });
   // need precise error handling about the status code