feature secret rotations v2

backend/src/services/app-connection/app-connection-enums.ts

@@ -5,7 +5,9 @@ export enum AppConnection {
   GCP = "gcp",
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
-  Humanitec = "humanitec"
+  Humanitec = "humanitec",
+  Postgres = "postgres",
+  MsSql = "mssql"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -1,30 +1,22 @@
 import { TAppConnections } from "@app/db/schemas/app-connections";
 import { generateHash } from "@app/lib/crypto/encryption";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { TAppConnectionServiceFactoryDep } from "@app/services/app-connection/app-connection-service";
-import { TAppConnection, TAppConnectionConfig } from "@app/services/app-connection/app-connection-types";
+import { BadRequestError } from "@app/lib/errors";
+import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
 import {
-  AwsConnectionMethod,
-  getAwsConnectionListItem,
-  validateAwsConnectionCredentials
-} from "@app/services/app-connection/aws";
-import {
-  DatabricksConnectionMethod,
-  getDatabricksConnectionListItem,
-  validateDatabricksConnectionCredentials
-} from "@app/services/app-connection/databricks";
-import {
-  GcpConnectionMethod,
-  getGcpConnectionListItem,
-  validateGcpConnectionCredentials
-} from "@app/services/app-connection/gcp";
-import {
-  getGitHubConnectionListItem,
-  GitHubConnectionMethod,
-  validateGitHubConnectionCredentials
-} from "@app/services/app-connection/github";
+  transferSqlConnectionCredentialsToPlatform,
+  validateSqlConnectionCredentials
+} from "@app/services/app-connection/shared/sql";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
+import { AppConnection } from "./app-connection-enums";
+import { TAppConnectionServiceFactoryDep } from "./app-connection-service";
+import {
+  TAppConnection,
+  TAppConnectionConfig,
+  TAppConnectionCredentialsValidator,
+  TAppConnectionTransitionCredentialsToPlatform
+} from "./app-connection-types";
+import { AwsConnectionMethod, getAwsConnectionListItem, validateAwsConnectionCredentials } from "./aws";
 import {
   AzureAppConfigurationConnectionMethod,
   getAzureAppConfigurationConnectionListItem,
@@ -35,11 +27,20 @@ import {
   getAzureKeyVaultConnectionListItem,
   validateAzureKeyVaultConnectionCredentials
 } from "./azure-key-vault";
+import {
+  DatabricksConnectionMethod,
+  getDatabricksConnectionListItem,
+  validateDatabricksConnectionCredentials
+} from "./databricks";
+import { GcpConnectionMethod, getGcpConnectionListItem, validateGcpConnectionCredentials } from "./gcp";
+import { getGitHubConnectionListItem, GitHubConnectionMethod, validateGitHubConnectionCredentials } from "./github";
 import {
   getHumanitecConnectionListItem,
   HumanitecConnectionMethod,
   validateHumanitecConnectionCredentials
 } from "./humanitec";
+import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
+import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 
 export const listAppConnectionOptions = () => {
   return [
@@ -49,7 +50,9 @@ export const listAppConnectionOptions = () => {
     getAzureKeyVaultConnectionListItem(),
     getAzureAppConfigurationConnectionListItem(),
     getDatabricksConnectionListItem(),
-    getHumanitecConnectionListItem()
+    getHumanitecConnectionListItem(),
+    getPostgresConnectionListItem(),
+    getMsSqlConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -95,30 +98,22 @@ export const decryptAppConnectionCredentials = async ({
   return JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
 };
 
+const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TAppConnectionCredentialsValidator> = {
+  [AppConnection.AWS]: validateAwsConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.Databricks]: validateDatabricksConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.GitHub]: validateGitHubConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.GCP]: validateGcpConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.AzureKeyVault]: validateAzureKeyVaultConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.AzureAppConfiguration]:
+    validateAzureAppConfigurationConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.Humanitec]: validateHumanitecConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.Postgres]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
+  [AppConnection.MsSql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator
+};
+
 export const validateAppConnectionCredentials = async (
   appConnection: TAppConnectionConfig
-): Promise<TAppConnection["credentials"]> => {
-  const { app } = appConnection;
-  switch (app) {
-    case AppConnection.AWS:
-      return validateAwsConnectionCredentials(appConnection);
-    case AppConnection.Databricks:
-      return validateDatabricksConnectionCredentials(appConnection);
-    case AppConnection.GitHub:
-      return validateGitHubConnectionCredentials(appConnection);
-    case AppConnection.GCP:
-      return validateGcpConnectionCredentials(appConnection);
-    case AppConnection.AzureKeyVault:
-      return validateAzureKeyVaultConnectionCredentials(appConnection);
-    case AppConnection.AzureAppConfiguration:
-      return validateAzureAppConfigurationConnectionCredentials(appConnection);
-    case AppConnection.Humanitec:
-      return validateHumanitecConnectionCredentials(appConnection);
-    default:
-      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-      throw new Error(`Unhandled App Connection ${app}`);
-  }
-};
+): Promise<TAppConnection["credentials"]> => VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
 
 export const getAppConnectionMethodName = (method: TAppConnection["method"]) => {
   switch (method) {
@@ -136,8 +131,11 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
       return "Service Account Impersonation";
     case DatabricksConnectionMethod.ServicePrincipal:
       return "Service Principal";
-    case HumanitecConnectionMethod.API_TOKEN:
+    case HumanitecConnectionMethod.ApiToken:
       return "API Token";
+    case PostgresConnectionMethod.UsernameAndPassword:
+    case MsSqlConnectionMethod.UsernameAndPassword:
+      return "Username & Password";
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection Method: ${method}`);
@@ -158,3 +156,24 @@ export const decryptAppConnection = async (
     credentialsHash: generateHash(appConnection.encryptedCredentials)
   } as TAppConnection;
 };
+
+const platformManagedCredentialsNotSupported: TAppConnectionTransitionCredentialsToPlatform = ({ app }) => {
+  throw new BadRequestError({
+    message: `${APP_CONNECTION_NAME_MAP[app]} Connections do not support platform managed credentials.`
+  });
+};
+
+export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
+  AppConnection,
+  TAppConnectionTransitionCredentialsToPlatform
+> = {
+  [AppConnection.AWS]: platformManagedCredentialsNotSupported,
+  [AppConnection.Databricks]: platformManagedCredentialsNotSupported,
+  [AppConnection.GitHub]: platformManagedCredentialsNotSupported,
+  [AppConnection.GCP]: platformManagedCredentialsNotSupported,
+  [AppConnection.AzureKeyVault]: platformManagedCredentialsNotSupported,
+  [AppConnection.AzureAppConfiguration]: platformManagedCredentialsNotSupported,
+  [AppConnection.Humanitec]: platformManagedCredentialsNotSupported,
+  [AppConnection.Postgres]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
+  [AppConnection.MsSql]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform
+};

backend/src/services/app-connection/app-connection-maps.ts

@@ -7,5 +7,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AzureKeyVault]: "Azure Key Vault",
   [AppConnection.AzureAppConfiguration]: "Azure App Configuration",
   [AppConnection.Databricks]: "Databricks",
-  [AppConnection.Humanitec]: "Humanitec"
+  [AppConnection.Humanitec]: "Humanitec",
+  [AppConnection.Postgres]: "PostgreSQL",
+  [AppConnection.MsSql]: "Microsoft SQL Server"
 };

backend/src/services/app-connection/app-connection-schemas.ts

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { AppConnectionsSchema } from "@app/db/schemas/app-connections";
 import { AppConnections } from "@app/lib/api-docs";
 import { slugSchema } from "@app/server/lib/schemas";
+import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
+import { TAppConnectionBaseConfig } from "@app/services/app-connection/app-connection-types";
 
 import { AppConnection } from "./app-connection-enums";
 
@@ -14,7 +16,10 @@ export const BaseAppConnectionSchema = AppConnectionsSchema.omit({
   credentialsHash: z.string().optional()
 });
 
-export const GenericCreateAppConnectionFieldsSchema = (app: AppConnection) =>
+export const GenericCreateAppConnectionFieldsSchema = (
+  app: AppConnection,
+  { supportsPlatformManagedCredentials = false }: TAppConnectionBaseConfig = {}
+) =>
   z.object({
     name: slugSchema({ field: "name" }).describe(AppConnections.CREATE(app).name),
     description: z
@@ -22,10 +27,16 @@ export const GenericCreateAppConnectionFieldsSchema = (app: AppConnection) =>
       .trim()
       .max(256, "Description cannot exceed 256 characters")
       .nullish()
-      .describe(AppConnections.CREATE(app).description)
+      .describe(AppConnections.CREATE(app).description),
+    isPlatformManagedCredentials: supportsPlatformManagedCredentials
+      ? z.boolean().optional().default(false).describe(AppConnections.CREATE(app).isPlatformManagedCredentials)
+      : z.literal(false).optional().describe(`Not supported for ${APP_CONNECTION_NAME_MAP[app]} Connections.`)
   });
 
-export const GenericUpdateAppConnectionFieldsSchema = (app: AppConnection) =>
+export const GenericUpdateAppConnectionFieldsSchema = (
+  app: AppConnection,
+  { supportsPlatformManagedCredentials = false }: TAppConnectionBaseConfig = {}
+) =>
   z.object({
     name: slugSchema({ field: "name" }).describe(AppConnections.UPDATE(app).name).optional(),
     description: z
@@ -33,5 +44,8 @@ export const GenericUpdateAppConnectionFieldsSchema = (app: AppConnection) =>
       .trim()
       .max(256, "Description cannot exceed 256 characters")
       .nullish()
-      .describe(AppConnections.UPDATE(app).description)
+      .describe(AppConnections.UPDATE(app).description),
+    isPlatformManagedCredentials: supportsPlatformManagedCredentials
+      ? z.boolean().optional().describe(AppConnections.UPDATE(app).isPlatformManagedCredentials)
+      : z.literal(false).optional().describe(`Not supported for ${APP_CONNECTION_NAME_MAP[app]} Connections.`)
   });

backend/src/services/app-connection/app-connection-service.ts

@@ -6,25 +6,27 @@ import { generateHash } from "@app/lib/crypto/encryption";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { DiscriminativePick, OrgServiceActor } from "@app/lib/types";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import {
   decryptAppConnection,
   encryptAppConnectionCredentials,
   getAppConnectionMethodName,
   listAppConnectionOptions,
+  TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM,
   validateAppConnectionCredentials
 } from "@app/services/app-connection/app-connection-fns";
-import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
-import {
-  TAppConnection,
-  TAppConnectionConfig,
-  TCreateAppConnectionDTO,
-  TUpdateAppConnectionDTO,
-  TValidateAppConnectionCredentials
-} from "@app/services/app-connection/app-connection-types";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TAppConnectionDALFactory } from "./app-connection-dal";
+import { AppConnection } from "./app-connection-enums";
+import { APP_CONNECTION_NAME_MAP } from "./app-connection-maps";
+import {
+  TAppConnection,
+  TAppConnectionConfig,
+  TAppConnectionRaw,
+  TCreateAppConnectionDTO,
+  TUpdateAppConnectionDTO,
+  TValidateAppConnectionCredentials
+} from "./app-connection-types";
 import { ValidateAwsConnectionCredentialsSchema } from "./aws";
 import { awsConnectionService } from "./aws/aws-connection-service";
 import { ValidateAzureAppConfigurationConnectionCredentialsSchema } from "./azure-app-configuration";
@@ -37,6 +39,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "./github";
 import { githubConnectionService } from "./github/github-connection-service";
 import { ValidateHumanitecConnectionCredentialsSchema } from "./humanitec";
 import { humanitecConnectionService } from "./humanitec/humanitec-connection-service";
+import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
+import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
 
 export type TAppConnectionServiceFactoryDep = {
   appConnectionDAL: TAppConnectionDALFactory;
@@ -53,7 +57,9 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
   [AppConnection.AzureAppConfiguration]: ValidateAzureAppConfigurationConnectionCredentialsSchema,
   [AppConnection.Databricks]: ValidateDatabricksConnectionCredentialsSchema,
-  [AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema
+  [AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema,
+  [AppConnection.Postgres]: ValidatePostgresConnectionCredentialsSchema,
+  [AppConnection.MsSql]: ValidateMsSqlConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -163,20 +169,42 @@ export const appConnectionServiceFactory = ({
       orgId: actor.orgId
     } as TAppConnectionConfig);
 
-    const encryptedCredentials = await encryptAppConnectionCredentials({
-      credentials: validatedCredentials,
-      orgId: actor.orgId,
-      kmsService
-    });
-
     try {
-      const connection = await appConnectionDAL.create({
-        orgId: actor.orgId,
-        encryptedCredentials,
-        method,
-        app,
-        ...params
-      });
+      const createTransaction = (connectionCredentials: TAppConnection["credentials"]) =>
+        appConnectionDAL.transaction(async (tx) => {
+          const encryptedCredentials = await encryptAppConnectionCredentials({
+            credentials: connectionCredentials,
+            orgId: actor.orgId,
+            kmsService
+          });
+
+          return appConnectionDAL.create(
+            {
+              orgId: actor.orgId,
+              encryptedCredentials,
+              method,
+              app,
+              ...params
+            },
+            tx
+          );
+        });
+
+      let connection: TAppConnectionRaw;
+
+      if (params.isPlatformManagedCredentials) {
+        connection = await TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM[app](
+          {
+            app,
+            orgId: actor.orgId,
+            credentials: validatedCredentials,
+            method
+          } as TAppConnectionConfig,
+          (platformCredentials) => createTransaction(platformCredentials)
+        );
+      } else {
+        connection = await createTransaction(validatedCredentials);
+      }
 
       return {
         ...connection,
@@ -213,11 +241,18 @@ export const appConnectionServiceFactory = ({
       OrgPermissionSubjects.AppConnections
     );
 
-    let encryptedCredentials: undefined | Buffer;
+    // prevent updating credentials or management status if platform managed
+    if (appConnection.isPlatformManagedCredentials && (params.isPlatformManagedCredentials === false || credentials)) {
+      throw new BadRequestError({
+        message: "Cannot update credentials or management status for platform managed connections"
+      });
+    }
+
+    let updatedCredentials: undefined | TAppConnection["credentials"];
+
+    const { app, method } = appConnection as DiscriminativePick<TAppConnectionConfig, "app" | "method">;
 
     if (credentials) {
-      const { app, method } = appConnection as DiscriminativePick<TAppConnectionConfig, "app" | "method">;
-
       if (
         !VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[app].safeParse({
           method,
@@ -230,29 +265,58 @@ export const appConnectionServiceFactory = ({
           } Connection with method ${getAppConnectionMethodName(method)}`
         });
 
-      const validatedCredentials = await validateAppConnectionCredentials({
+      updatedCredentials = await validateAppConnectionCredentials({
         app,
         orgId: actor.orgId,
         credentials,
         method
       } as TAppConnectionConfig);
 
-      if (!validatedCredentials)
+      if (!updatedCredentials)
         throw new BadRequestError({ message: "Unable to validate connection - check credentials" });
-
-      encryptedCredentials = await encryptAppConnectionCredentials({
-        credentials: validatedCredentials,
-        orgId: actor.orgId,
-        kmsService
-      });
     }
 
     try {
-      const updatedConnection = await appConnectionDAL.updateById(connectionId, {
-        orgId: actor.orgId,
-        encryptedCredentials,
-        ...params
-      });
+      const updateTransaction = (connectionCredentials: TAppConnection["credentials"] | undefined) =>
+        appConnectionDAL.transaction(async (tx) => {
+          const encryptedCredentials = connectionCredentials
+            ? await encryptAppConnectionCredentials({
+                credentials: connectionCredentials,
+                orgId: actor.orgId,
+                kmsService
+              })
+            : undefined;
+
+          return appConnectionDAL.updateById(
+            connectionId,
+            {
+              orgId: actor.orgId,
+              encryptedCredentials,
+              ...params
+            },
+            tx
+          );
+        });
+
+      let updatedConnection: TAppConnectionRaw;
+
+      if (params.isPlatformManagedCredentials) {
+        if (!updatedCredentials)
+          // prevent enabling platform managed credentials without re-confirming credentials
+          throw new BadRequestError({ message: "Credentials required to transition to platform managed credentials" });
+
+        updatedConnection = await TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM[app](
+          {
+            app,
+            orgId: actor.orgId,
+            credentials: updatedCredentials,
+            method
+          } as TAppConnectionConfig,
+          (platformCredentials) => updateTransaction(platformCredentials)
+        );
+      } else {
+        updatedConnection = await updateTransaction(updatedCredentials);
+      }
 
       return await decryptAppConnection(updatedConnection, kmsService);
     } catch (err) {

backend/src/services/app-connection/app-connection-types.ts

@@ -1,24 +1,9 @@
-import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
-import {
-  TAwsConnection,
-  TAwsConnectionConfig,
-  TAwsConnectionInput,
-  TValidateAwsConnectionCredentials
-} from "@app/services/app-connection/aws";
-import {
-  TDatabricksConnection,
-  TDatabricksConnectionConfig,
-  TDatabricksConnectionInput,
-  TValidateDatabricksConnectionCredentials
-} from "@app/services/app-connection/databricks";
-import {
-  TGitHubConnection,
-  TGitHubConnectionConfig,
-  TGitHubConnectionInput,
-  TValidateGitHubConnectionCredentials
-} from "@app/services/app-connection/github";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
+import { AWSRegion } from "./app-connection-enums";
+import { TAwsConnection, TAwsConnectionConfig, TAwsConnectionInput, TValidateAwsConnectionCredentials } from "./aws";
 import {
   TAzureAppConfigurationConnection,
   TAzureAppConfigurationConnectionConfig,
@@ -31,13 +16,27 @@ import {
   TAzureKeyVaultConnectionInput,
   TValidateAzureKeyVaultConnectionCredentials
 } from "./azure-key-vault";
+import {
+  TDatabricksConnection,
+  TDatabricksConnectionConfig,
+  TDatabricksConnectionInput,
+  TValidateDatabricksConnectionCredentials
+} from "./databricks";
 import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
+import {
+  TGitHubConnection,
+  TGitHubConnectionConfig,
+  TGitHubConnectionInput,
+  TValidateGitHubConnectionCredentials
+} from "./github";
 import {
   THumanitecConnection,
   THumanitecConnectionConfig,
   THumanitecConnectionInput,
   TValidateHumanitecConnectionCredentials
 } from "./humanitec";
+import { TMsSqlConnection, TMsSqlConnectionInput, TValidateMsSqlConnectionCredentials } from "./mssql";
+import { TPostgresConnection, TPostgresConnectionInput, TValidatePostgresConnectionCredentials } from "./postgres";
 
 export type TAppConnection = { id: string } & (
   | TAwsConnection
@@ -47,8 +46,14 @@ export type TAppConnection = { id: string } & (
   | TAzureAppConfigurationConnection
   | TDatabricksConnection
   | THumanitecConnection
+  | TPostgresConnection
+  | TMsSqlConnection
 );
 
+export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
+
+export type TSqlConnection = TPostgresConnection | TMsSqlConnection;
+
 export type TAppConnectionInput = { id: string } & (
   | TAwsConnectionInput
   | TGitHubConnectionInput
@@ -57,11 +62,15 @@ export type TAppConnectionInput = { id: string } & (
   | TAzureAppConfigurationConnectionInput
   | TDatabricksConnectionInput
   | THumanitecConnectionInput
+  | TPostgresConnectionInput
+  | TMsSqlConnectionInput
 );
 
+export type TSqlConnectionInput = TPostgresConnectionInput | TMsSqlConnectionInput;
+
 export type TCreateAppConnectionDTO = Pick<
   TAppConnectionInput,
-  "credentials" | "method" | "name" | "app" | "description"
+  "credentials" | "method" | "name" | "app" | "description" | "isPlatformManagedCredentials"
 >;
 
 export type TUpdateAppConnectionDTO = Partial<Omit<TCreateAppConnectionDTO, "method" | "app">> & {
@@ -75,7 +84,8 @@ export type TAppConnectionConfig =
   | TAzureKeyVaultConnectionConfig
   | TAzureAppConfigurationConnectionConfig
   | TDatabricksConnectionConfig
-  | THumanitecConnectionConfig;
+  | THumanitecConnectionConfig
+  | TSqlConnectionConfig;
 
 export type TValidateAppConnectionCredentials =
   | TValidateAwsConnectionCredentials
@@ -84,10 +94,25 @@ export type TValidateAppConnectionCredentials =
   | TValidateAzureKeyVaultConnectionCredentials
   | TValidateAzureAppConfigurationConnectionCredentials
   | TValidateDatabricksConnectionCredentials
-  | TValidateHumanitecConnectionCredentials;
+  | TValidateHumanitecConnectionCredentials
+  | TValidatePostgresConnectionCredentials
+  | TValidateMsSqlConnectionCredentials;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;
   region: AWSRegion;
   destination: SecretSync.AWSParameterStore | SecretSync.AWSSecretsManager;
 };
+
+export type TAppConnectionCredentialsValidator = (
+  appConnection: TAppConnectionConfig
+) => Promise<TAppConnection["credentials"]>;
+
+export type TAppConnectionTransitionCredentialsToPlatform = (
+  appConnection: TAppConnectionConfig,
+  callback: (credentials: TAppConnection["credentials"]) => Promise<TAppConnectionRaw>
+) => Promise<TAppConnectionRaw>;
+
+export type TAppConnectionBaseConfig = {
+  supportsPlatformManagedCredentials?: boolean;
+};

backend/src/services/app-connection/aws/aws-connection-fns.ts

@@ -92,7 +92,7 @@ export const validateAwsConnectionCredentials = async (appConnection: TAwsConnec
     resp = await sts.getCallerIdentity().promise();
   } catch (e: unknown) {
     throw new BadRequestError({
-      message: `Unable to validate connection - verify credentials`
+      message: `Unable to validate connection: verify credentials`
     });
   }
 

backend/src/services/app-connection/aws/aws-connection-schemas.ts

@@ -48,11 +48,11 @@ export const SanitizedAwsConnectionSchema = z.discriminatedUnion("method", [
 
 export const ValidateAwsConnectionCredentialsSchema = z.discriminatedUnion("method", [
   z.object({
-    method: z.literal(AwsConnectionMethod.AssumeRole).describe(AppConnections?.CREATE(AppConnection.AWS).method),
+    method: z.literal(AwsConnectionMethod.AssumeRole).describe(AppConnections.CREATE(AppConnection.AWS).method),
     credentials: AwsConnectionAssumeRoleCredentialsSchema.describe(AppConnections.CREATE(AppConnection.AWS).credentials)
   }),
   z.object({
-    method: z.literal(AwsConnectionMethod.AccessKey).describe(AppConnections?.CREATE(AppConnection.AWS).method),
+    method: z.literal(AwsConnectionMethod.AccessKey).describe(AppConnections.CREATE(AppConnection.AWS).method),
     credentials: AwsConnectionAccessTokenCredentialsSchema.describe(
       AppConnections.CREATE(AppConnection.AWS).credentials
     )

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-fns.ts

@@ -57,7 +57,7 @@ export const validateAzureAppConfigurationConnectionCredentials = async (
       tokenError = e;
     } else {
       throw new BadRequestError({
-        message: `Unable to validate connection - verify credentials`
+        message: `Unable to validate connection: verify credentials`
       });
     }
   }

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts

@@ -129,7 +129,7 @@ export const validateAzureKeyVaultConnectionCredentials = async (config: TAzureK
       tokenError = e;
     } else {
       throw new BadRequestError({
-        message: `Unable to validate connection - verify credentials`
+        message: `Unable to validate connection: verify credentials`
       });
     }
   }

backend/src/services/app-connection/databricks/databricks-connection-fns.ts

@@ -86,7 +86,7 @@ export const validateDatabricksConnectionCredentials = async (appConnection: TDa
     };
   } catch (e: unknown) {
     throw new BadRequestError({
-      message: `Unable to validate connection - verify credentials`
+      message: `Unable to validate connection: verify credentials`
     });
   }
 };

backend/src/services/app-connection/databricks/databricks-connection-schemas.ts

@@ -49,7 +49,7 @@ export const ValidateDatabricksConnectionCredentialsSchema = z.discriminatedUnio
   z.object({
     method: z
       .literal(DatabricksConnectionMethod.ServicePrincipal)
-      .describe(AppConnections?.CREATE(AppConnection.Databricks).method),
+      .describe(AppConnections.CREATE(AppConnection.Databricks).method),
     credentials: DatabricksConnectionServicePrincipalInputCredentialsSchema.describe(
       AppConnections.CREATE(AppConnection.Databricks).credentials
     )

backend/src/services/app-connection/gcp/gcp-connection-fns.ts

@@ -4,10 +4,10 @@ import { GetAccessTokenResponse } from "google-auth-library/build/src/auth/oauth
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, InternalServerError } from "@app/lib/errors";
+import { getAppConnectionMethodName } from "@app/services/app-connection/app-connection-fns";
 import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
 
 import { AppConnection } from "../app-connection-enums";
-import { getAppConnectionMethodName } from "../app-connection-fns";
 import { GcpConnectionMethod } from "./gcp-connection-enums";
 import {
   GCPApp,

backend/src/services/app-connection/gcp/gcp-connection-schemas.ts

@@ -37,7 +37,7 @@ export const ValidateGcpConnectionCredentialsSchema = z.discriminatedUnion("meth
   z.object({
     method: z
       .literal(GcpConnectionMethod.ServiceAccountImpersonation)
-      .describe(AppConnections?.CREATE(AppConnection.GCP).method),
+      .describe(AppConnections.CREATE(AppConnection.GCP).method),
     credentials: GcpConnectionServiceAccountImpersonationCredentialsSchema.describe(
       AppConnections.CREATE(AppConnection.GCP).credentials
     )

backend/src/services/app-connection/github/github-connection-fns.ts

@@ -200,7 +200,7 @@ export const validateGitHubConnectionCredentials = async (config: TGitHubConnect
     });
   } catch (e: unknown) {
     throw new BadRequestError({
-      message: `Unable to validate connection - verify credentials`
+      message: `Unable to validate connection: verify credentials`
     });
   }
 

backend/src/services/app-connection/humanitec/humanitec-connection-enums.ts

@@ -1,3 +1,3 @@
 export enum HumanitecConnectionMethod {
-  API_TOKEN = "api-token"
+  ApiToken = "api-token"
 }

backend/src/services/app-connection/humanitec/humanitec-connection-fns.ts

@@ -18,7 +18,7 @@ export const getHumanitecConnectionListItem = () => {
   return {
     name: "Humanitec" as const,
     app: AppConnection.Humanitec as const,
-    methods: Object.values(HumanitecConnectionMethod) as [HumanitecConnectionMethod.API_TOKEN]
+    methods: Object.values(HumanitecConnectionMethod) as [HumanitecConnectionMethod.ApiToken]
   };
 };
 
@@ -40,7 +40,7 @@ export const validateHumanitecConnectionCredentials = async (config: THumanitecC
       });
     }
     throw new BadRequestError({
-      message: "Unable to validate connection - verify credentials"
+      message: "Unable to validate connection: verify credentials"
     });
   }
 

backend/src/services/app-connection/humanitec/humanitec-connection-schemas.ts

@@ -17,13 +17,13 @@ export const HumanitecConnectionAccessTokenCredentialsSchema = z.object({
 const BaseHumanitecConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Humanitec) });
 
 export const HumanitecConnectionSchema = BaseHumanitecConnectionSchema.extend({
-  method: z.literal(HumanitecConnectionMethod.API_TOKEN),
+  method: z.literal(HumanitecConnectionMethod.ApiToken),
   credentials: HumanitecConnectionAccessTokenCredentialsSchema
 });
 
 export const SanitizedHumanitecConnectionSchema = z.discriminatedUnion("method", [
   BaseHumanitecConnectionSchema.extend({
-    method: z.literal(HumanitecConnectionMethod.API_TOKEN),
+    method: z.literal(HumanitecConnectionMethod.ApiToken),
     credentials: HumanitecConnectionAccessTokenCredentialsSchema.pick({})
   })
 ]);
@@ -31,8 +31,8 @@ export const SanitizedHumanitecConnectionSchema = z.discriminatedUnion("method",
 export const ValidateHumanitecConnectionCredentialsSchema = z.discriminatedUnion("method", [
   z.object({
     method: z
-      .literal(HumanitecConnectionMethod.API_TOKEN)
-      .describe(AppConnections?.CREATE(AppConnection.Humanitec).method),
+      .literal(HumanitecConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.Humanitec).method),
     credentials: HumanitecConnectionAccessTokenCredentialsSchema.describe(
       AppConnections.CREATE(AppConnection.Humanitec).credentials
     )

backend/src/services/app-connection/mssql/index.ts

@@ -0,0 +1,4 @@
+export * from "./mssql-connection-enums";
+export * from "./mssql-connection-fns";
+export * from "./mssql-connection-schemas";
+export * from "./mssql-connection-types";

backend/src/services/app-connection/mssql/mssql-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum MsSqlConnectionMethod {
+  UsernameAndPassword = "username-and-password"
+}

backend/src/services/app-connection/mssql/mssql-connection-fns.ts

@@ -0,0 +1,12 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { MsSqlConnectionMethod } from "./mssql-connection-enums";
+
+export const getMsSqlConnectionListItem = () => {
+  return {
+    name: "Microsoft SQL Server" as const,
+    app: AppConnection.MsSql as const,
+    methods: Object.values(MsSqlConnectionMethod) as [MsSqlConnectionMethod.UsernameAndPassword],
+    supportsPlatformManagement: true as const
+  };
+};

backend/src/services/app-connection/mssql/mssql-connection-schemas.ts

@@ -0,0 +1,65 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AppConnection } from "../app-connection-enums";
+import { BaseSqlUsernameAndPasswordConnectionSchema } from "../shared/sql";
+import { MsSqlConnectionMethod } from "./mssql-connection-enums";
+
+export const MsSqlConnectionAccessTokenCredentialsSchema = BaseSqlUsernameAndPasswordConnectionSchema;
+
+const BaseMsSqlConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.MsSql)
+});
+
+export const MsSqlConnectionSchema = BaseMsSqlConnectionSchema.extend({
+  method: z.literal(MsSqlConnectionMethod.UsernameAndPassword),
+  credentials: MsSqlConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedMsSqlConnectionSchema = z.discriminatedUnion("method", [
+  BaseMsSqlConnectionSchema.extend({
+    method: z.literal(MsSqlConnectionMethod.UsernameAndPassword),
+    credentials: MsSqlConnectionAccessTokenCredentialsSchema.pick({
+      host: true,
+      database: true,
+      port: true,
+      username: true
+    })
+  })
+]);
+
+export const ValidateMsSqlConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(MsSqlConnectionMethod.UsernameAndPassword)
+      .describe(AppConnections.CREATE(AppConnection.MsSql).method),
+    credentials: MsSqlConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.MsSql).credentials
+    )
+  })
+]);
+
+export const CreateMsSqlConnectionSchema = ValidateMsSqlConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.MsSql, { supportsPlatformManagedCredentials: true })
+);
+
+export const UpdateMsSqlConnectionSchema = z
+  .object({
+    credentials: MsSqlConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.MsSql).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.MsSql, { supportsPlatformManagedCredentials: true }));
+
+export const MsSqlConnectionListItemSchema = z.object({
+  name: z.literal("Microsoft SQL Server"),
+  app: z.literal(AppConnection.MsSql),
+  methods: z.nativeEnum(MsSqlConnectionMethod).array(),
+  supportsPlatformManagement: z.literal(true)
+});

backend/src/services/app-connection/mssql/mssql-connection-types.ts

@@ -0,0 +1,16 @@
+import z from "zod";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateMsSqlConnectionSchema,
+  MsSqlConnectionSchema,
+  ValidateMsSqlConnectionCredentialsSchema
+} from "./mssql-connection-schemas";
+
+export type TMsSqlConnection = z.infer<typeof MsSqlConnectionSchema>;
+
+export type TMsSqlConnectionInput = z.infer<typeof CreateMsSqlConnectionSchema> & {
+  app: AppConnection.MsSql;
+};
+
+export type TValidateMsSqlConnectionCredentials = typeof ValidateMsSqlConnectionCredentialsSchema;

backend/src/services/app-connection/postgres/index.ts

@@ -0,0 +1,4 @@
+export * from "./postgres-connection-enums";
+export * from "./postgres-connection-fns";
+export * from "./postgres-connection-schemas";
+export * from "./postgres-connection-types";

backend/src/services/app-connection/postgres/postgres-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum PostgresConnectionMethod {
+  UsernameAndPassword = "username-and-password"
+}

backend/src/services/app-connection/postgres/postgres-connection-fns.ts

@@ -0,0 +1,12 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { PostgresConnectionMethod } from "./postgres-connection-enums";
+
+export const getPostgresConnectionListItem = () => {
+  return {
+    name: "PostgreSQL" as const,
+    app: AppConnection.Postgres as const,
+    methods: Object.values(PostgresConnectionMethod) as [PostgresConnectionMethod.UsernameAndPassword],
+    supportsPlatformManagement: true as const
+  };
+};

backend/src/services/app-connection/postgres/postgres-connection-schemas.ts

@@ -0,0 +1,63 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AppConnection } from "../app-connection-enums";
+import { BaseSqlUsernameAndPasswordConnectionSchema } from "../shared/sql";
+import { PostgresConnectionMethod } from "./postgres-connection-enums";
+
+export const PostgresConnectionAccessTokenCredentialsSchema = BaseSqlUsernameAndPasswordConnectionSchema;
+
+const BasePostgresConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Postgres) });
+
+export const PostgresConnectionSchema = BasePostgresConnectionSchema.extend({
+  method: z.literal(PostgresConnectionMethod.UsernameAndPassword),
+  credentials: PostgresConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedPostgresConnectionSchema = z.discriminatedUnion("method", [
+  BasePostgresConnectionSchema.extend({
+    method: z.literal(PostgresConnectionMethod.UsernameAndPassword),
+    credentials: PostgresConnectionAccessTokenCredentialsSchema.pick({
+      host: true,
+      database: true,
+      port: true,
+      username: true
+    })
+  })
+]);
+
+export const ValidatePostgresConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(PostgresConnectionMethod.UsernameAndPassword)
+      .describe(AppConnections.CREATE(AppConnection.Postgres).method),
+    credentials: PostgresConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Postgres).credentials
+    )
+  })
+]);
+
+export const CreatePostgresConnectionSchema = ValidatePostgresConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Postgres, { supportsPlatformManagedCredentials: true })
+);
+
+export const UpdatePostgresConnectionSchema = z
+  .object({
+    credentials: PostgresConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Postgres).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Postgres, { supportsPlatformManagedCredentials: true }));
+
+export const PostgresConnectionListItemSchema = z.object({
+  name: z.literal("PostgreSQL"),
+  app: z.literal(AppConnection.Postgres),
+  methods: z.nativeEnum(PostgresConnectionMethod).array(),
+  supportsPlatformManagement: z.literal(true)
+});

backend/src/services/app-connection/postgres/postgres-connection-types.ts

@@ -0,0 +1,16 @@
+import z from "zod";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreatePostgresConnectionSchema,
+  PostgresConnectionSchema,
+  ValidatePostgresConnectionCredentialsSchema
+} from "./postgres-connection-schemas";
+
+export type TPostgresConnection = z.infer<typeof PostgresConnectionSchema>;
+
+export type TPostgresConnectionInput = z.infer<typeof CreatePostgresConnectionSchema> & {
+  app: AppConnection.Postgres;
+};
+
+export type TValidatePostgresConnectionCredentials = typeof ValidatePostgresConnectionCredentialsSchema;

backend/src/services/app-connection/shared/sql/index.ts

@@ -0,0 +1,2 @@
+export * from "./sql-connection-fns";
+export * from "./sql-connection-schemas";

backend/src/services/app-connection/shared/sql/sql-connection-fns.ts

@@ -0,0 +1,113 @@
+import knex, { Knex } from "knex";
+
+import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
+import {
+  TSqlCredentialsRotationGeneratedCredentials,
+  TSqlCredentialsRotationWithConnection
+} from "@app/ee/services/secret-rotation-v2/shared/sql-credentials/sql-credentials-rotation-types";
+import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { TAppConnectionRaw, TSqlConnection } from "@app/services/app-connection/app-connection-types";
+import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
+
+const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
+
+const SQL_CONNECTION_CLIENT_MAP = {
+  [AppConnection.Postgres]: "pg",
+  [AppConnection.MsSql]: "mssql"
+};
+
+export const getSqlConnectionClient = async (
+  appConnection: Pick<TSqlConnection, "credentials" | "app">,
+  options?: Record<string, unknown>
+) => {
+  const {
+    app,
+    credentials: { host: baseHost, database, port, sslCertificate, password, username }
+  } = appConnection;
+
+  const ssl = sslCertificate ? { rejectUnauthorized: false, ca: sslCertificate } : undefined;
+
+  const [host] = await verifyHostInputValidity(baseHost);
+
+  const client = knex({
+    client: SQL_CONNECTION_CLIENT_MAP[app],
+    connection: {
+      database,
+      port,
+      host,
+      user: username,
+      password,
+      connectionTimeoutMillis: EXTERNAL_REQUEST_TIMEOUT,
+      ssl,
+      options
+    }
+  });
+
+  return client;
+};
+
+export const validateSqlConnectionCredentials = async (config: TSqlConnectionConfig) => {
+  const { credentials, app } = config;
+
+  const client = await getSqlConnectionClient({ app, credentials });
+
+  try {
+    await client.raw(`Select 1`);
+
+    return credentials;
+  } catch (error) {
+    throw new BadRequestError({
+      message:
+        (error as Error)?.message?.replaceAll(credentials.password, "********************") ??
+        "Unable to validate connection: verify credentials"
+    });
+  } finally {
+    await client.destroy();
+  }
+};
+
+export const SQL_CONNECTION_ALTER_LOGIN_STATEMENT: Record<
+  TSqlCredentialsRotationWithConnection["connection"]["app"],
+  (credentials: TSqlCredentialsRotationGeneratedCredentials[number]) => [string, Knex.RawBinding]
+> = {
+  [AppConnection.Postgres]: ({ username, password }) => [`ALTER USER ?? WITH PASSWORD '${password}';`, [username]],
+  [AppConnection.MsSql]: ({ username, password }) => [`ALTER LOGIN ?? WITH PASSWORD = '${password}';`, [username]]
+};
+
+export const transferSqlConnectionCredentialsToPlatform = async (
+  config: TSqlConnectionConfig,
+  callback: (credentials: TSqlConnectionConfig["credentials"]) => Promise<TAppConnectionRaw>
+) => {
+  const { credentials, app } = config;
+
+  const client = await getSqlConnectionClient({ app, credentials });
+
+  const newPassword = alphaNumericNanoId(32);
+
+  try {
+    return await client.transaction(async (tx) => {
+      await tx.raw(
+        ...SQL_CONNECTION_ALTER_LOGIN_STATEMENT[app]({ username: credentials.username, password: newPassword })
+      );
+      return callback({
+        ...credentials,
+        password: newPassword
+      });
+    });
+  } catch (error) {
+    // update/create service function will handle
+    if (error instanceof DatabaseError) {
+      throw error;
+    }
+
+    throw new BadRequestError({
+      message:
+        (error as Error)?.message?.replaceAll(newPassword, "********************") ??
+        "Encountered an error transferring credentials to platform"
+    });
+  } finally {
+    await client.destroy();
+  }
+};

backend/src/services/app-connection/shared/sql/sql-connection-schemas.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+
+export const BaseSqlUsernameAndPasswordConnectionSchema = z.object({
+  host: z.string().trim().min(1, "Host required").describe(AppConnections.CREDENTIALS.SQL_CONNECTION.host),
+  port: z.coerce.number().describe(AppConnections.CREDENTIALS.SQL_CONNECTION.port),
+  database: z.string().trim().min(1, "Database required").describe(AppConnections.CREDENTIALS.SQL_CONNECTION.database),
+  username: z.string().trim().min(1, "Username required").describe(AppConnections.CREDENTIALS.SQL_CONNECTION.username),
+  password: z.string().trim().min(1, "Password required").describe(AppConnections.CREDENTIALS.SQL_CONNECTION.password),
+  sslCertificate: z.string().trim().optional().describe(AppConnections.CREDENTIALS.SQL_CONNECTION.sslCertificate)
+});

backend/src/services/app-connection/shared/sql/sql-connection-types.ts

@@ -0,0 +1,6 @@
+import { DiscriminativePick } from "@app/lib/types";
+import { TSqlConnectionInput } from "@app/services/app-connection/app-connection-types";
+
+export type TSqlConnectionConfig = DiscriminativePick<TSqlConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};

backend/src/services/secret-sync/secret-sync-dal.ts

@@ -31,7 +31,11 @@ const baseSecretSyncQuery = ({ filter, db, tx }: { db: TDbClient; filter?: Secre
       db.ref("description").withSchema(TableName.AppConnection).as("connectionDescription"),
       db.ref("version").withSchema(TableName.AppConnection).as("connectionVersion"),
       db.ref("createdAt").withSchema(TableName.AppConnection).as("connectionCreatedAt"),
-      db.ref("updatedAt").withSchema(TableName.AppConnection).as("connectionUpdatedAt")
+      db.ref("updatedAt").withSchema(TableName.AppConnection).as("connectionUpdatedAt"),
+      db
+        .ref("isPlatformManagedCredentials")
+        .withSchema(TableName.AppConnection)
+        .as("connectionIsPlatformManagedCredentials")
     );
 
   if (filter) {
@@ -60,6 +64,7 @@ const expandSecretSync = (
     connectionCreatedAt,
     connectionUpdatedAt,
     connectionVersion,
+    connectionIsPlatformManagedCredentials,
     ...el
   } = secretSync;
 
@@ -77,7 +82,8 @@ const expandSecretSync = (
       description: connectionDescription,
       createdAt: connectionCreatedAt,
       updatedAt: connectionUpdatedAt,
-      version: connectionVersion
+      version: connectionVersion,
+      isPlatformManagedCredentials: connectionIsPlatformManagedCredentials
     },
     folder: folder
       ? {

backend/src/services/secret-sync/secret-sync-service.ts

@@ -119,14 +119,10 @@ export const secretSyncServiceFactory = ({
     { destination, syncName, projectId }: TFindSecretSyncByNameDTO,
     actor: OrgServiceActor
   ) => {
-    const folders = await folderDAL.findByProjectId(projectId);
-
-    // we prevent conflicting names within a project so this will only return one at most
-    const [secretSync] = await secretSyncDAL.find({
+    // we prevent conflicting names within a project
+    const secretSync = await secretSyncDAL.findOne({
       name: syncName,
-      $in: {
-        folderId: folders.map((folder) => folder.id)
-      }
+      projectId
     });
 
     if (!secretSync)

backend/src/services/secret-sync/secret-sync-types.ts

@@ -1,6 +1,6 @@
 import { Job } from "bullmq";
 
-import { TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types";
+import { AuditLogInfo } from "@app/ee/services/audit-log/audit-log-types";
 import { QueueJobs } from "@app/queue";
 import { ResourceMetadataDTO } from "@app/services/resource-metadata/resource-metadata-schema";
 import {
@@ -129,8 +129,6 @@ export type TDeleteSecretSyncDTO = {
   removeSecrets: boolean;
 };
 
-type AuditLogInfo = Pick<TCreateAuditLogDTO, "userAgent" | "userAgentType" | "ipAddress" | "actor">;
-
 export enum SecretSyncStatus {
   Pending = "pending",
   Running = "running",

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -35,15 +35,25 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
           `${TableName.SecretTag}.id`
         )
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`
+        )
         .select(selectAllTableCols(TableName.SecretV2))
         .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
         .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
-
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"))
+        .select(db.ref("rotationId").withSchema(TableName.SecretRotationV2SecretMapping));
       const data = sqlNestRelationships({
         data: docs,
         key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        parentMapper: (el) => ({
+          _id: el.id,
+          ...SecretsV2Schema.parse(el),
+          isRotatedSecret: Boolean(el.rotationId),
+          rotationId: el.rotationId
+        }),
         childrenMapper: [
           {
             key: "tagId",
@@ -79,6 +89,11 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           `${TableName.SecretTag}.id`
         )
         .leftJoin(TableName.ResourceMetadata, `${TableName.SecretV2}.id`, `${TableName.ResourceMetadata}.secretId`)
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`
+        )
         .select(
           db.ref("id").withSchema(TableName.ResourceMetadata).as("metadataId"),
           db.ref("key").withSchema(TableName.ResourceMetadata).as("metadataKey"),
@@ -87,7 +102,8 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
         .select(selectAllTableCols(TableName.SecretV2))
         .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
         .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"))
+        .select(db.ref("rotationId").withSchema(TableName.SecretRotationV2SecretMapping));
       if (limit) void query.limit(limit);
       if (offset) void query.offset(offset);
       if (sort) {
@@ -98,7 +114,12 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
       const data = sqlNestRelationships({
         data: docs,
         key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        parentMapper: (el) => ({
+          _id: el.id,
+          ...SecretsV2Schema.parse(el),
+          rotationId: el.rotationId,
+          isRotatedSecret: Boolean(el.rotationId)
+        }),
         childrenMapper: [
           {
             key: "tagId",
@@ -332,6 +353,11 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
       }
 
       const query = (tx || db.replicaNode())(TableName.SecretV2)
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`
+        )
         .whereIn("folderId", folderIds)
         .where((bd) => {
           if (filters?.search) {
@@ -414,6 +440,11 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           `${TableName.SecretTag}.id`
         )
         .leftJoin(TableName.ResourceMetadata, `${TableName.SecretV2}.id`, `${TableName.ResourceMetadata}.secretId`)
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`
+        )
         .where((qb) => {
           if (filters?.metadataFilter && filters.metadataFilter.length > 0) {
             filters.metadataFilter.forEach((meta) => {
@@ -444,6 +475,7 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           db.ref("key").withSchema(TableName.ResourceMetadata).as("metadataKey"),
           db.ref("value").withSchema(TableName.ResourceMetadata).as("metadataValue")
         )
+        .select(db.ref("rotationId").withSchema(TableName.SecretRotationV2SecretMapping))
         .where((bd) => {
           const slugs = filters?.tagSlugs?.filter(Boolean);
           if (slugs && slugs.length > 0) {
@@ -472,7 +504,12 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
       const data = sqlNestRelationships({
         data: secs,
         key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        parentMapper: (el) => ({
+          _id: el.id,
+          ...SecretsV2Schema.parse(el),
+          rotationId: el.rotationId,
+          isRotatedSecret: Boolean(el.rotationId)
+        }),
         childrenMapper: [
           {
             key: "tagId",

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -666,6 +666,8 @@ export const reshapeBridgeSecret = (
       name: string;
     }[];
     secretMetadata?: ResourceMetadataDTO;
+    isRotatedSecret?: boolean;
+    rotationId?: string;
   },
   secretValueHidden: boolean
 ) => ({
@@ -695,7 +697,8 @@ export const reshapeBridgeSecret = (
   secretMetadata: secret.secretMetadata,
   createdAt: secret.createdAt,
   updatedAt: secret.updatedAt,
-
+  isRotatedSecret: secret.isRotatedSecret,
+  rotationId: secret.rotationId,
   ...(secretValueHidden
     ? {
         secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK,

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -25,6 +25,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
+import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { diff, groupBy } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
@@ -414,6 +415,8 @@ export const secretV2BridgeServiceFactory = ({
       });
       if (!sharedSecretToModify)
         throw new NotFoundError({ message: `Secret with name ${inputSecret.secretName} not found` });
+      if (sharedSecretToModify.isRotatedSecret && (inputSecret.newSecretName || inputSecret.secretValue))
+        throw new BadRequestError({ message: "Cannot update rotated secret name or value" });
       secretId = sharedSecretToModify.id;
       secret = sharedSecretToModify;
     }
@@ -624,66 +627,79 @@ export const secretV2BridgeServiceFactory = ({
       })
     );
 
-    const deletedSecret = await secretDAL.transaction(async (tx) =>
-      fnSecretBulkDelete({
-        projectId,
-        folderId,
-        actorId,
-        secretDAL,
-        secretQueueService,
-        inputSecrets: [
-          {
-            type: inputSecret.type as SecretType,
-            secretKey: inputSecret.secretName
-          }
-        ],
-        tx
-      })
-    );
+    try {
+      const deletedSecret = await secretDAL.transaction(async (tx) =>
+        fnSecretBulkDelete({
+          projectId,
+          folderId,
+          actorId,
+          secretDAL,
+          secretQueueService,
+          inputSecrets: [
+            {
+              type: inputSecret.type as SecretType,
+              secretKey: inputSecret.secretName
+            }
+          ],
+          tx
+        })
+      );
 
-    if (inputSecret.type === SecretType.Shared) {
-      await snapshotService.performSnapshot(folderId);
-      await secretQueueService.syncSecrets({
-        secretPath,
-        actorId,
-        actor,
-        projectId,
-        orgId: actorOrgId,
-        environmentSlug: folder.environment.slug
+      if (inputSecret.type === SecretType.Shared) {
+        await snapshotService.performSnapshot(folderId);
+        await secretQueueService.syncSecrets({
+          secretPath,
+          actorId,
+          actor,
+          projectId,
+          orgId: actorOrgId,
+          environmentSlug: folder.environment.slug
+        });
+      }
+
+      const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
       });
-    }
 
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
+      const secretValueHidden = !hasSecretReadValueOrDescribePermission(
+        permission,
+        ProjectPermissionSecretActions.ReadValue,
+        {
+          environment,
+          secretPath,
+          secretName: secretToDelete.key,
+          secretTags: secretToDelete.tags?.map((el) => el.slug)
+        }
+      );
 
-    const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-      permission,
-      ProjectPermissionSecretActions.ReadValue,
-      {
+      return reshapeBridgeSecret(
+        projectId,
         environment,
         secretPath,
-        secretName: secretToDelete.key,
-        secretTags: secretToDelete.tags?.map((el) => el.slug)
+        {
+          ...deletedSecret[0],
+          value: deletedSecret[0].encryptedValue
+            ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedValue }).toString()
+            : "",
+          comment: deletedSecret[0].encryptedComment
+            ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedComment }).toString()
+            : ""
+        },
+        secretValueHidden
+      );
+    } catch (err) {
+      // deferred errors aren't return as DatabaseError
+      const error = err as { code: string; table: string };
+      if (
+        error?.code === DatabaseErrorCode.ForeignKeyViolation &&
+        error?.table === TableName.SecretRotationV2SecretMapping
+      ) {
+        throw new BadRequestError({ message: "Cannot delete rotated secrets" });
       }
-    );
 
-    return reshapeBridgeSecret(
-      projectId,
-      environment,
-      secretPath,
-      {
-        ...deletedSecret[0],
-        value: deletedSecret[0].encryptedValue
-          ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedValue }).toString()
-          : "",
-        comment: deletedSecret[0].encryptedComment
-          ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedComment }).toString()
-          : ""
-      },
-      secretValueHidden
-    );
+      throw err;
+    }
   };
 
   // get unique secrets count for multiple envs
@@ -946,6 +962,7 @@ export const secretV2BridgeServiceFactory = ({
       projectId
     });
 
+    // scott: if any of this changes it also needs to be mirrored in secret rotation for getting dashboard secrets
     const decryptedSecrets = secrets
       .filter((el) => {
         const canDescribeSecret = hasSecretReadValueOrDescribePermission(
@@ -1667,6 +1684,13 @@ export const secretV2BridgeServiceFactory = ({
               secretTags: el.tags.map((i) => i.slug)
             })
           );
+
+          if (el.isRotatedSecret) {
+            const input = secretsToUpdateGroupByPath[secretPath].find((i) => i.secretKey === el.key);
+
+            if (input && (input.newSecretName || input.secretValue))
+              throw new BadRequestError({ message: `Cannot update rotated secret name or value: ${el.key}` });
+          }
         });
 
         // get all tags
@@ -1969,61 +1993,76 @@ export const secretV2BridgeServiceFactory = ({
       );
     });
 
-    const secretsDeleted = await secretDAL.transaction(async (tx) =>
-      fnSecretBulkDelete({
-        secretDAL,
-        secretQueueService,
-        inputSecrets: inputSecrets.map(({ type, secretKey }) => ({
-          secretKey,
-          type: type || SecretType.Shared
-        })),
-        projectId,
-        folderId,
-        actorId,
-        tx
-      })
-    );
-
-    // await snapshotService.performSnapshot(folderId);
-    await secretQueueService.syncSecrets({
-      actor,
-      actorId,
-      secretPath,
-      projectId,
-      orgId: actorOrgId,
-      environmentSlug: folder.environment.slug
-    });
-
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-    return secretsDeleted.map((el) => {
-      const secretToDeleteMatch = secretsToDelete.find(
-        (i) => i.key === el.key && (i.type || SecretType.Shared) === el.type
+    try {
+      const secretsDeleted = await secretDAL.transaction(async (tx) =>
+        fnSecretBulkDelete({
+          secretDAL,
+          secretQueueService,
+          inputSecrets: inputSecrets.map(({ type, secretKey }) => ({
+            secretKey,
+            type: type || SecretType.Shared
+          })),
+          projectId,
+          folderId,
+          actorId,
+          tx
+        })
       );
 
-      const secretValueHidden =
-        !secretToDeleteMatch ||
-        !hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
+      await snapshotService.performSnapshot(folderId);
+      await secretQueueService.syncSecrets({
+        actor,
+        actorId,
+        secretPath,
+        projectId,
+        orgId: actorOrgId,
+        environmentSlug: folder.environment.slug
+      });
+
+      const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
+      return secretsDeleted.map((el) => {
+        const secretToDeleteMatch = secretsToDelete.find(
+          (i) => i.key === el.key && (i.type || SecretType.Shared) === el.type
+        );
+
+        const secretValueHidden =
+          !secretToDeleteMatch ||
+          !hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
+            environment,
+            secretPath,
+            secretName: el.key,
+            secretTags: secretToDeleteMatch.tags?.map((i) => i.slug)
+          });
+
+        return reshapeBridgeSecret(
+          projectId,
           environment,
           secretPath,
-          secretName: el.key,
-          secretTags: secretToDeleteMatch.tags?.map((i) => i.slug)
-        });
+          {
+            ...el,
+            value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
+            comment: el.encryptedComment
+              ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString()
+              : ""
+          },
+          secretValueHidden
+        );
+      });
+    } catch (err) {
+      // deferred errors aren't return as DatabaseError
+      const error = err as { code: string; table: string };
+      if (
+        error?.code === DatabaseErrorCode.ForeignKeyViolation &&
+        error?.table === TableName.SecretRotationV2SecretMapping
+      ) {
+        throw new BadRequestError({ message: "Cannot delete rotated secrets" });
+      }
 
-      return reshapeBridgeSecret(
-        projectId,
-        environment,
-        secretPath,
-        {
-          ...el,
-          value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
-          comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
-        },
-        secretValueHidden
-      );
-    });
+      throw err;
+    }
   };
 
   const getSecretVersions = async ({

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -132,7 +132,7 @@ export type TUpdateManySecretDTO = Omit<TProjectPermission, "projectId"> & {
   secrets: {
     secretKey: string;
     newSecretName?: string;
-    secretValue: string;
+    secretValue?: string;
     secretComment?: string;
     skipMultilineEncoding?: boolean;
     tagIds?: string[];

backend/src/services/secret/secret-types.ts

@@ -297,7 +297,7 @@ export type TUpdateManySecretRawDTO = Omit<TProjectPermission, "projectId"> & {
   secrets: {
     secretKey: string;
     newSecretName?: string;
-    secretValue: string;
+    secretValue?: string;
     secretComment?: string;
     skipMultilineEncoding?: boolean;
     tagIds?: string[];

backend/src/services/smtp/smtp-service.ts

@@ -40,7 +40,8 @@ export enum SmtpTemplates {
   ExternalImportSuccessful = "externalImportSuccessful.handlebars",
   ExternalImportFailed = "externalImportFailed.handlebars",
   ExternalImportStarted = "externalImportStarted.handlebars",
-  SecretRequestCompleted = "secretRequestCompleted.handlebars"
+  SecretRequestCompleted = "secretRequestCompleted.handlebars",
+  SecretRotationFailed = "secretRotationFailed.handlebars"
 }
 
 export enum SmtpHost {

backend/src/services/smtp/templates/secretRotationFailed.handlebars

@@ -0,0 +1,31 @@
+<html>
+
+  <head>
+    <meta charset="utf-8" />
+    <meta http-equiv="x-ua-compatible" content="ie=edge" />
+    <title>Your {{rotationType}} Rotation "{{rotationName}}" Failed to Rotate</title>
+  </head>
+
+  <body>
+    <h2>Infisical</h2>
+
+    <div>
+      <p>{{content}}</p>
+      <a href="{{rotationUrl}}?search={{rotationName}}&secretPath={{secretPath}}">
+        View in Infisical to see the cause of failure.
+      </a>
+    </div>
+
+    <br />
+    <div>
+      <p><strong>Name</strong>: {{rotationName}}</p>
+      <p><strong>Type</strong>: {{rotationType}}</p>
+      <p><strong>Project</strong>: {{projectName}}</p>
+      <p><strong>Environment</strong>: {{environment}}</p>
+      <p><strong>Secret Path</strong>: {{secretPath}}</p>
+    </div>
+
+    {{emailFooter}}
+  </body>
+
+</html>