feat(secret-sync): Add Azure Devops Secret Sync

backend/src/services/app-connection/app-connection-enums.ts

@@ -7,6 +7,7 @@ export enum AppConnection {
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
   AzureClientSecrets = "azure-client-secrets",
+  AzureDevOps = "azure-devops",
   Humanitec = "humanitec",
   TerraformCloud = "terraform-cloud",
   Vercel = "vercel",

backend/src/services/app-connection/app-connection-fns.ts

@@ -39,6 +39,11 @@ import {
   getAzureClientSecretsConnectionListItem,
   validateAzureClientSecretsConnectionCredentials
 } from "./azure-client-secrets";
+import { AzureDevOpsConnectionMethod } from "./azure-devops/azure-devops-enums";
+import {
+  getAzureDevopsConnectionListItem,
+  validateAzureDevOpsConnectionCredentials
+} from "./azure-devops/azure-devops-fns";
 import {
   AzureKeyVaultConnectionMethod,
   getAzureKeyVaultConnectionListItem,
@@ -98,6 +103,7 @@ export const listAppConnectionOptions = () => {
     getGcpConnectionListItem(),
     getAzureKeyVaultConnectionListItem(),
     getAzureAppConfigurationConnectionListItem(),
+    getAzureDevopsConnectionListItem(),
     getDatabricksConnectionListItem(),
     getHumanitecConnectionListItem(),
     getTerraformCloudConnectionListItem(),
@@ -173,6 +179,7 @@ export const validateAppConnectionCredentials = async (
       validateAzureAppConfigurationConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.AzureClientSecrets]:
       validateAzureClientSecretsConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.AzureDevOps]: validateAzureDevOpsConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Humanitec]: validateHumanitecConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Postgres]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.MsSql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
@@ -201,6 +208,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case AzureAppConfigurationConnectionMethod.OAuth:
     case AzureClientSecretsConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
+    case AzureDevOpsConnectionMethod.OAuth:
       return "OAuth";
     case AwsConnectionMethod.AccessKey:
     case OCIConnectionMethod.AccessKey:
@@ -217,6 +225,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case TerraformCloudConnectionMethod.ApiToken:
     case VercelConnectionMethod.ApiToken:
     case OnePassConnectionMethod.ApiToken:
+    case AzureDevOpsConnectionMethod.ApiToken:
       return "API Token";
     case PostgresConnectionMethod.UsernameAndPassword:
     case MsSqlConnectionMethod.UsernameAndPassword:
@@ -270,6 +279,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.GCP]: platformManagedCredentialsNotSupported,
   [AppConnection.AzureKeyVault]: platformManagedCredentialsNotSupported,
   [AppConnection.AzureAppConfiguration]: platformManagedCredentialsNotSupported,
+  [AppConnection.AzureDevOps]: platformManagedCredentialsNotSupported,
   [AppConnection.Humanitec]: platformManagedCredentialsNotSupported,
   [AppConnection.Postgres]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
   [AppConnection.MsSql]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,

backend/src/services/app-connection/app-connection-maps.ts

@@ -8,6 +8,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AzureKeyVault]: "Azure Key Vault",
   [AppConnection.AzureAppConfiguration]: "Azure App Configuration",
   [AppConnection.AzureClientSecrets]: "Azure Client Secrets",
+  [AppConnection.AzureDevOps]: "Azure DevOps",
   [AppConnection.Databricks]: "Databricks",
   [AppConnection.Humanitec]: "Humanitec",
   [AppConnection.TerraformCloud]: "Terraform Cloud",
@@ -33,6 +34,7 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.AzureKeyVault]: AppConnectionPlanType.Regular,
   [AppConnection.AzureAppConfiguration]: AppConnectionPlanType.Regular,
   [AppConnection.AzureClientSecrets]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureDevOps]: AppConnectionPlanType.Regular,
   [AppConnection.Databricks]: AppConnectionPlanType.Regular,
   [AppConnection.Humanitec]: AppConnectionPlanType.Regular,
   [AppConnection.TerraformCloud]: AppConnectionPlanType.Regular,

backend/src/services/app-connection/app-connection-service.ts

@@ -41,6 +41,8 @@ import { awsConnectionService } from "./aws/aws-connection-service";
 import { ValidateAzureAppConfigurationConnectionCredentialsSchema } from "./azure-app-configuration";
 import { ValidateAzureClientSecretsConnectionCredentialsSchema } from "./azure-client-secrets";
 import { azureClientSecretsConnectionService } from "./azure-client-secrets/azure-client-secrets-service";
+import { ValidateAzureDevOpsConnectionCredentialsSchema } from "./azure-devops/azure-devops-schemas";
+import { azureDevOpsConnectionService } from "./azure-devops/azure-devops-service";
 import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
 import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
@@ -84,6 +86,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
   [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
   [AppConnection.AzureAppConfiguration]: ValidateAzureAppConfigurationConnectionCredentialsSchema,
+  [AppConnection.AzureDevOps]: ValidateAzureDevOpsConnectionCredentialsSchema,
   [AppConnection.Databricks]: ValidateDatabricksConnectionCredentialsSchema,
   [AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema,
   [AppConnection.TerraformCloud]: ValidateTerraformCloudConnectionCredentialsSchema,
@@ -498,6 +501,7 @@ export const appConnectionServiceFactory = ({
     camunda: camundaConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     vercel: vercelConnectionService(connectAppConnectionById),
     azureClientSecrets: azureClientSecretsConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
+    azureDevOps: azureDevOpsConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     auth0: auth0ConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     hcvault: hcVaultConnectionService(connectAppConnectionById),
     windmill: windmillConnectionService(connectAppConnectionById),

backend/src/services/app-connection/app-connection-types.ts

@@ -39,6 +39,12 @@ import {
   TAzureClientSecretsConnectionInput,
   TValidateAzureClientSecretsConnectionCredentialsSchema
 } from "./azure-client-secrets";
+import {
+  TAzureDevOpsConnection,
+  TAzureDevOpsConnectionConfig,
+  TAzureDevOpsConnectionInput,
+  TValidateAzureDevOpsConnectionCredentialsSchema
+} from "./azure-devops/azure-devops-types";
 import {
   TAzureKeyVaultConnection,
   TAzureKeyVaultConnectionConfig,
@@ -132,6 +138,7 @@ export type TAppConnection = { id: string } & (
   | TGcpConnection
   | TAzureKeyVaultConnection
   | TAzureAppConfigurationConnection
+  | TAzureDevOpsConnection
   | TDatabricksConnection
   | THumanitecConnection
   | TTerraformCloudConnection
@@ -161,6 +168,7 @@ export type TAppConnectionInput = { id: string } & (
   | TGcpConnectionInput
   | TAzureKeyVaultConnectionInput
   | TAzureAppConfigurationConnectionInput
+  | TAzureDevOpsConnectionInput
   | TDatabricksConnectionInput
   | THumanitecConnectionInput
   | TTerraformCloudConnectionInput
@@ -197,6 +205,7 @@ export type TAppConnectionConfig =
   | TGcpConnectionConfig
   | TAzureKeyVaultConnectionConfig
   | TAzureAppConfigurationConnectionConfig
+  | TAzureDevOpsConnectionConfig
   | TAzureClientSecretsConnectionConfig
   | TDatabricksConnectionConfig
   | THumanitecConnectionConfig
@@ -220,6 +229,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateAzureKeyVaultConnectionCredentialsSchema
   | TValidateAzureAppConfigurationConnectionCredentialsSchema
   | TValidateAzureClientSecretsConnectionCredentialsSchema
+  | TValidateAzureDevOpsConnectionCredentialsSchema
   | TValidateDatabricksConnectionCredentialsSchema
   | TValidateHumanitecConnectionCredentialsSchema
   | TValidatePostgresConnectionCredentialsSchema

backend/src/services/app-connection/azure-devops/azure-devops-enums.ts

@@ -0,0 +1,4 @@
+export enum AzureDevOpsConnectionMethod {
+  OAuth = "oauth",
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/azure-devops/azure-devops-fns.ts

@@ -0,0 +1,269 @@
+/* eslint-disable no-case-declarations */
+import { AxiosError, AxiosResponse } from "axios";
+
+import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
+import { BadRequestError, InternalServerError, NotFoundError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import {
+  decryptAppConnectionCredentials,
+  encryptAppConnectionCredentials,
+  getAppConnectionMethodName
+} from "@app/services/app-connection/app-connection-fns";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+import { TAppConnectionDALFactory } from "../app-connection-dal";
+import { AppConnection } from "../app-connection-enums";
+import { AzureDevOpsConnectionMethod } from "./azure-devops-enums";
+import {
+  ExchangeCodeAzureResponse,
+  TAzureDevOpsConnectionConfig,
+  TAzureDevOpsConnectionCredentials
+} from "./azure-devops-types";
+
+export const getAzureDevopsConnectionListItem = () => {
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
+
+  return {
+    name: "Azure DevOps" as const,
+    app: AppConnection.AzureDevOps as const,
+    methods: Object.values(AzureDevOpsConnectionMethod) as [
+      AzureDevOpsConnectionMethod.OAuth,
+      AzureDevOpsConnectionMethod.ApiToken
+    ],
+    oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
+  };
+};
+
+export const getAzureDevopsConnectionAccessToken = async (
+  connectionId: string,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+) => {
+  const appConnection = await appConnectionDAL.findById(connectionId);
+
+  if (!appConnection) {
+    throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
+  }
+
+  if (appConnection.app !== AppConnection.AzureDevOps) {
+    throw new BadRequestError({
+      message: `Connection with ID '${connectionId}' is not an Azure DevOps connection`
+    });
+  }
+
+  const credentials = (await decryptAppConnectionCredentials({
+    orgId: appConnection.orgId,
+    kmsService,
+    encryptedCredentials: appConnection.encryptedCredentials
+  })) as TAzureDevOpsConnectionCredentials;
+
+  // Handle different connection methods
+  switch (appConnection.method) {
+    case AzureDevOpsConnectionMethod.OAuth:
+      const appCfg = getConfig();
+      if (!appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID || !appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+        throw new BadRequestError({
+          message: `Azure environment variables have not been configured`
+        });
+      }
+
+      if (!("refreshToken" in credentials)) {
+        throw new BadRequestError({ message: "Invalid OAuth credentials" });
+      }
+
+      const { refreshToken, tenantId } = credentials;
+      const currentTime = Date.now();
+
+      const { data } = await request.post<ExchangeCodeAzureResponse>(
+        IntegrationUrls.AZURE_TOKEN_URL.replace("common", tenantId || "common"),
+        new URLSearchParams({
+          grant_type: "refresh_token",
+          scope: `https://app.vssps.visualstudio.com/.default`,
+          client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID,
+          client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
+          refresh_token: refreshToken
+        })
+      );
+
+      const updatedCredentials = {
+        ...credentials,
+        accessToken: data.access_token,
+        expiresAt: currentTime + data.expires_in * 1000,
+        refreshToken: data.refresh_token
+      };
+
+      const encryptedCredentials = await encryptAppConnectionCredentials({
+        credentials: updatedCredentials,
+        orgId: appConnection.orgId,
+        kmsService
+      });
+
+      await appConnectionDAL.updateById(appConnection.id, { encryptedCredentials });
+
+      return data.access_token;
+
+    case AzureDevOpsConnectionMethod.ApiToken:
+      if (!("apiKey" in credentials)) {
+        throw new BadRequestError({ message: "Invalid API token credentials" });
+      }
+      // For API token, return the basic auth token directly
+      return credentials.apiKey as string;
+
+    default:
+      throw new BadRequestError({ message: `Unsupported connection method` });
+  }
+};
+
+export const validateAzureDevOpsConnectionCredentials = async (config: TAzureDevOpsConnectionConfig) => {
+  const { credentials: inputCredentials, method } = config;
+
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
+
+  switch (method) {
+    case AzureDevOpsConnectionMethod.OAuth:
+      if (!SITE_URL) {
+        throw new InternalServerError({ message: "SITE_URL env var is required to complete Azure OAuth flow" });
+      }
+
+      if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+        throw new InternalServerError({
+          message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
+        });
+      }
+
+      let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
+      let tokenError: AxiosError | null = null;
+
+      try {
+        const oauthCredentials = inputCredentials as { code: string; tenantId: string };
+        tokenResp = await request.post<ExchangeCodeAzureResponse>(
+          IntegrationUrls.AZURE_TOKEN_URL.replace("common", oauthCredentials.tenantId || "common"),
+          new URLSearchParams({
+            grant_type: "authorization_code",
+            code: oauthCredentials.code,
+            scope: `https://app.vssps.visualstudio.com/.default`,
+            client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
+            client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
+            redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
+          })
+        );
+      } catch (e: unknown) {
+        if (e instanceof AxiosError) {
+          tokenError = e;
+        } else {
+          throw new BadRequestError({
+            message: `Unable to validate connection: verify credentials`
+          });
+        }
+      }
+
+      if (tokenError) {
+        if (tokenError instanceof AxiosError) {
+          throw new BadRequestError({
+            message: `Failed to get access token: ${
+              (tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
+            }`
+          });
+        } else {
+          throw new InternalServerError({
+            message: "Failed to get access token"
+          });
+        }
+      }
+
+      if (!tokenResp) {
+        throw new InternalServerError({
+          message: `Failed to get access token: Token was empty with no error`
+        });
+      }
+
+      const oauthCredentials = inputCredentials as { code: string; tenantId: string; orgName: string };
+      return {
+        tenantId: oauthCredentials.tenantId,
+        orgName: oauthCredentials.orgName,
+        accessToken: tokenResp.data.access_token,
+        refreshToken: tokenResp.data.refresh_token,
+        expiresAt: Date.now() + tokenResp.data.expires_in * 1000
+      };
+
+    case AzureDevOpsConnectionMethod.ApiToken:
+      const apiTokenCredentials = inputCredentials as { apiKey: string; orgName?: string };
+
+      try {
+        if (apiTokenCredentials.orgName) {
+          // Validate against specific organization
+          const response = await request.get(
+            `${IntegrationUrls.AZURE_DEVOPS_API_URL}/${apiTokenCredentials.orgName}/_apis/projects?api-version=7.2-preview.2&$top=1`,
+            {
+              headers: {
+                Authorization: `Basic ${Buffer.from(`:${apiTokenCredentials.apiKey}`).toString("base64")}`
+              }
+            }
+          );
+
+          if (response.status !== 200) {
+            throw new BadRequestError({
+              message: `Failed to validate connection: ${response.status}`
+            });
+          }
+
+          return {
+            apiKey: apiTokenCredentials.apiKey,
+            orgName: apiTokenCredentials.orgName
+          };
+        }
+        // Validate via profile and discover organizations
+        const profileResponse = await request.get<{ displayName: string }>(
+          `https://app.vssps.visualstudio.com/_apis/profile/profiles/me?api-version=7.1`,
+          {
+            headers: {
+              Authorization: `Basic ${Buffer.from(`:${apiTokenCredentials.apiKey}`).toString("base64")}`
+            }
+          }
+        );
+
+        let organizations: Array<{ accountId: string; accountName: string; accountUri: string }> = [];
+        try {
+          const orgsResponse = await request.get<{
+            value: Array<{ accountId: string; accountName: string; accountUri: string }>;
+          }>(`https://app.vssps.visualstudio.com/_apis/accounts?api-version=7.1`, {
+            headers: {
+              Authorization: `Basic ${Buffer.from(`:${apiTokenCredentials.apiKey}`).toString("base64")}`
+            }
+          });
+          organizations = orgsResponse.data.value || [];
+        } catch (orgError) {
+          logger.warn(orgError, "Could not fetch organizations automatically:");
+        }
+
+        return {
+          apiKey: apiTokenCredentials.apiKey,
+          userDisplayName: profileResponse.data.displayName,
+          organizations: organizations.map((org) => ({
+            accountId: org.accountId,
+            accountName: org.accountName,
+            accountUri: org.accountUri
+          }))
+        };
+      } catch (error) {
+        if (error instanceof AxiosError) {
+          const errorMessage = apiTokenCredentials.orgName
+            ? // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+              `Failed to validate API token for organization '${apiTokenCredentials.orgName}': ${error.response?.data?.message || error.message}`
+            : `Invalid Azure DevOps Personal Access Token: ${error.response?.status === 401 ? "Token is invalid or expired" : error.message}`;
+
+          throw new BadRequestError({ message: errorMessage });
+        }
+        throw new BadRequestError({
+          message: `Unable to validate Azure DevOps token`
+        });
+      }
+
+    default:
+      throw new InternalServerError({
+        message: `Unhandled Azure connection method: ${method as AzureDevOpsConnectionMethod}`
+      });
+  }
+};

backend/src/services/app-connection/azure-devops/azure-devops-schemas.ts

@@ -0,0 +1,112 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AzureDevOpsConnectionMethod } from "./azure-devops-enums";
+
+export const AzureDevOpsConnectionOAuthInputCredentialsSchema = z.object({
+  code: z.string().trim().min(1, "OAuth code required").describe(AppConnections.CREDENTIALS.AZURE_DEVOPS.code),
+  tenantId: z.string().trim().min(1, "Tenant ID required").describe(AppConnections.CREDENTIALS.AZURE_DEVOPS.tenantId),
+  orgName: z
+    .string()
+    .trim()
+    .min(1, "Organization name required")
+    .describe(AppConnections.CREDENTIALS.AZURE_DEVOPS.orgName)
+});
+
+export const AzureDevOpsConnectionOAuthOutputCredentialsSchema = z.object({
+  tenantId: z.string(),
+  orgName: z.string(),
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.number()
+});
+
+export const AzureDevOpsConnectionApiTokenInputCredentialsSchema = z.object({
+  apiKey: z.string().trim().min(1, "API Key required"),
+  orgName: z.string().trim().min(1, "Organization name required")
+});
+
+export const AzureDevOpsConnectionApiTokenOutputCredentialsSchema = z.object({
+  apiKey: z.string(),
+  orgName: z.string()
+});
+
+export const ValidateAzureDevOpsConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(AzureDevOpsConnectionMethod.OAuth)
+      .describe(AppConnections.CREATE(AppConnection.AzureDevOps).method),
+    credentials: AzureDevOpsConnectionOAuthInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureDevOps).credentials
+    )
+  }),
+  z.object({
+    method: z
+      .literal(AzureDevOpsConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.AzureDevOps).method),
+    credentials: AzureDevOpsConnectionApiTokenInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureDevOps).credentials
+    )
+  })
+]);
+
+export const CreateAzureDevOpsConnectionSchema = ValidateAzureDevOpsConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.AzureDevOps)
+);
+
+export const UpdateAzureDevOpsConnectionSchema = z
+  .object({
+    credentials: z
+      .union([AzureDevOpsConnectionOAuthInputCredentialsSchema, AzureDevOpsConnectionApiTokenInputCredentialsSchema])
+      .optional()
+      .describe(AppConnections.UPDATE(AppConnection.AzureDevOps).credentials)
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureDevOps));
+
+const BaseAzureDevOpsConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.AzureDevOps)
+});
+
+export const AzureDevOpsConnectionSchema = z.intersection(
+  BaseAzureDevOpsConnectionSchema,
+  z.discriminatedUnion("method", [
+    z.object({
+      method: z.literal(AzureDevOpsConnectionMethod.OAuth),
+      credentials: AzureDevOpsConnectionOAuthOutputCredentialsSchema
+    }),
+    z.object({
+      method: z.literal(AzureDevOpsConnectionMethod.ApiToken),
+      credentials: AzureDevOpsConnectionApiTokenOutputCredentialsSchema
+    })
+  ])
+);
+
+export const SanitizedAzureDevOpsConnectionSchema = z.discriminatedUnion("method", [
+  BaseAzureDevOpsConnectionSchema.extend({
+    method: z.literal(AzureDevOpsConnectionMethod.OAuth),
+    credentials: AzureDevOpsConnectionOAuthOutputCredentialsSchema.pick({
+      tenantId: true,
+      orgName: true
+    })
+  }),
+  BaseAzureDevOpsConnectionSchema.extend({
+    method: z.literal(AzureDevOpsConnectionMethod.ApiToken),
+    credentials: AzureDevOpsConnectionApiTokenOutputCredentialsSchema.pick({
+      orgName: true
+    })
+  })
+]);
+
+export const AzureDevOpsConnectionListItemSchema = z.object({
+  name: z.literal("Azure DevOps"),
+  app: z.literal(AppConnection.AzureDevOps),
+  methods: z.nativeEnum(AzureDevOpsConnectionMethod).array(),
+  oauthClientId: z.string().optional()
+});

backend/src/services/app-connection/azure-devops/azure-devops-service.ts

@@ -0,0 +1,127 @@
+/* eslint-disable @typescript-eslint/no-unsafe-member-access */
+/* eslint-disable no-case-declarations */
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { OrgServiceActor } from "@app/lib/types";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+import { AzureDevOpsConnectionMethod } from "./azure-devops-enums";
+import { getAzureDevopsConnectionAccessToken } from "./azure-devops-fns";
+import { TAzureDevOpsConnection } from "./azure-devops-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TAzureDevOpsConnection>;
+
+type TAzureDevOpsProject = {
+  id: string;
+  name: string;
+  description?: string;
+  url?: string;
+  state?: string;
+  visibility?: string;
+  lastUpdateTime?: string;
+  revision?: number;
+  abbreviation?: string;
+  defaultTeamImageUrl?: string;
+};
+
+type TAzureDevOpsProjectsResponse = {
+  count: number;
+  value: TAzureDevOpsProject[];
+};
+
+const getAuthHeaders = (appConnection: TAzureDevOpsConnection, accessToken: string) => {
+  switch (appConnection.method) {
+    case AzureDevOpsConnectionMethod.OAuth:
+      return {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      };
+    case AzureDevOpsConnectionMethod.ApiToken:
+      // For API token, create Basic auth header
+      const basicAuthToken = Buffer.from(`user:${accessToken}`).toString("base64");
+      return {
+        Authorization: `Basic ${basicAuthToken}`,
+        Accept: "application/json"
+      };
+    default:
+      throw new BadRequestError({ message: "Unsupported connection method" });
+  }
+};
+
+const listAzureDevOpsProjects = async (
+  appConnection: TAzureDevOpsConnection,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+): Promise<TAzureDevOpsProject[]> => {
+  const accessToken = await getAzureDevopsConnectionAccessToken(appConnection.id, appConnectionDAL, kmsService);
+
+  // Both OAuth and API Token methods use organization name from credentials
+  const credentials = appConnection.credentials as { orgName: string };
+  const { orgName } = credentials;
+
+  // Use the standard Azure DevOps Projects API endpoint
+  // This endpoint returns only projects that the authenticated user has access to
+  const devOpsEndpoint = `${IntegrationUrls.AZURE_DEVOPS_API_URL}/${orgName}/_apis/projects?api-version=7.1`;
+  try {
+    const { data } = await request.get<TAzureDevOpsProjectsResponse>(devOpsEndpoint, {
+      headers: getAuthHeaders(appConnection, accessToken)
+    });
+
+    return data.value || [];
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      // Provide more specific error messages based on the response
+      if (error?.response?.status === 401) {
+        throw new Error(
+          `Authentication failed for Azure DevOps organization: ${orgName}. Please check your credentials and ensure the token has the required scopes (vso.project or vso.profile).`
+        );
+      } else if (error?.response?.status === 403) {
+        throw new Error(
+          `Access denied to Azure DevOps organization: ${orgName}. Please ensure the user has access to the organization.`
+        );
+      } else if (error?.response?.status === 404) {
+        throw new Error(`Azure DevOps organization not found: ${orgName}. Please verify the organization name.`);
+      }
+    }
+    throw error;
+  }
+};
+
+export const azureDevOpsConnectionService = (
+  getAppConnection: TGetAppConnectionFunc,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.AzureDevOps, connectionId, actor);
+
+    const projects = await listAzureDevOpsProjects(appConnection, appConnectionDAL, kmsService);
+
+    return projects.map((project) => ({
+      id: project.id,
+      name: project.name,
+      appId: project.id,
+      description: project.description,
+      url: project.url,
+      state: project.state,
+      visibility: project.visibility,
+      lastUpdateTime: project.lastUpdateTime,
+      revision: project.revision,
+      abbreviation: project.abbreviation,
+      defaultTeamImageUrl: project.defaultTeamImageUrl
+    }));
+  };
+
+  return {
+    listProjects
+  };
+};

backend/src/services/app-connection/azure-devops/azure-devops-types.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  AzureDevOpsConnectionOAuthOutputCredentialsSchema,
+  AzureDevOpsConnectionSchema,
+  CreateAzureDevOpsConnectionSchema,
+  ValidateAzureDevOpsConnectionCredentialsSchema
+} from "./azure-devops-schemas";
+
+export type TAzureDevOpsConnection = z.infer<typeof AzureDevOpsConnectionSchema>;
+
+export type TAzureDevOpsConnectionInput = z.infer<typeof CreateAzureDevOpsConnectionSchema> & {
+  app: AppConnection.AzureDevOps;
+};
+
+export type TValidateAzureDevOpsConnectionCredentialsSchema = typeof ValidateAzureDevOpsConnectionCredentialsSchema;
+
+export type TAzureDevOpsConnectionConfig = DiscriminativePick<
+  TAzureDevOpsConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TAzureDevOpsConnectionCredentials = z.infer<typeof AzureDevOpsConnectionOAuthOutputCredentialsSchema>;
+
+export interface ExchangeCodeAzureResponse {
+  token_type: string;
+  scope: string;
+  expires_in: number;
+  ext_expires_in: number;
+  access_token: string;
+  refresh_token: string;
+  id_token: string;
+}
+
+export interface TAzureRegisteredApp {
+  id: string;
+  appId: string;
+  displayName: string;
+  description?: string;
+  createdDateTime: string;
+  identifierUris?: string[];
+  signInAudience?: string;
+}
+
+export interface TAzureListRegisteredAppsResponse {
+  "@odata.context": string;
+  "@odata.nextLink"?: string;
+  value: TAzureRegisteredApp[];
+}
+
+export interface TAzureDevOps {
+  keyId: string;
+  displayName?: string;
+  startDateTime: string;
+  endDateTime: string;
+  secretText?: string;
+}