merge main

backend/src/services/app-connection/1password/1password-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum OnePassConnectionMethod {
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/1password/1password-connection-fns.ts

@@ -0,0 +1,66 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { removeTrailingSlash } from "@app/lib/fn";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { OnePassConnectionMethod } from "./1password-connection-enums";
+import { TOnePassConnection, TOnePassConnectionConfig, TOnePassVault } from "./1password-connection-types";
+
+export const getOnePassInstanceUrl = async (config: TOnePassConnectionConfig) => {
+  const instanceUrl = removeTrailingSlash(config.credentials.instanceUrl);
+
+  await blockLocalAndPrivateIpAddresses(instanceUrl);
+
+  return instanceUrl;
+};
+
+export const getOnePassConnectionListItem = () => {
+  return {
+    name: "1Password" as const,
+    app: AppConnection.OnePass as const,
+    methods: Object.values(OnePassConnectionMethod) as [OnePassConnectionMethod.ApiToken]
+  };
+};
+
+export const validateOnePassConnectionCredentials = async (config: TOnePassConnectionConfig) => {
+  const instanceUrl = await getOnePassInstanceUrl(config);
+
+  const { apiToken } = config.credentials;
+
+  try {
+    await request.get(`${instanceUrl}/v1/vaults`, {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate connection: verify credentials"
+    });
+  }
+
+  return config.credentials;
+};
+
+export const listOnePassVaults = async (appConnection: TOnePassConnection) => {
+  const instanceUrl = await getOnePassInstanceUrl(appConnection);
+  const { apiToken } = appConnection.credentials;
+
+  const resp = await request.get<TOnePassVault[]>(`${instanceUrl}/v1/vaults`, {
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      Accept: "application/json"
+    }
+  });
+
+  return resp.data;
+};

backend/src/services/app-connection/1password/1password-connection-schemas.ts

@@ -0,0 +1,64 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { OnePassConnectionMethod } from "./1password-connection-enums";
+
+export const OnePassConnectionAccessTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.ONEPASS.apiToken),
+  instanceUrl: z
+    .string()
+    .trim()
+    .url("Invalid Connect Server instance URL")
+    .min(1, "Instance URL required")
+    .describe(AppConnections.CREDENTIALS.ONEPASS.instanceUrl)
+});
+
+const BaseOnePassConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.OnePass) });
+
+export const OnePassConnectionSchema = BaseOnePassConnectionSchema.extend({
+  method: z.literal(OnePassConnectionMethod.ApiToken),
+  credentials: OnePassConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedOnePassConnectionSchema = z.discriminatedUnion("method", [
+  BaseOnePassConnectionSchema.extend({
+    method: z.literal(OnePassConnectionMethod.ApiToken),
+    credentials: OnePassConnectionAccessTokenCredentialsSchema.pick({
+      instanceUrl: true
+    })
+  })
+]);
+
+export const ValidateOnePassConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(OnePassConnectionMethod.ApiToken).describe(AppConnections.CREATE(AppConnection.OnePass).method),
+    credentials: OnePassConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.OnePass).credentials
+    )
+  })
+]);
+
+export const CreateOnePassConnectionSchema = ValidateOnePassConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.OnePass)
+);
+
+export const UpdateOnePassConnectionSchema = z
+  .object({
+    credentials: OnePassConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.OnePass).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.OnePass));
+
+export const OnePassConnectionListItemSchema = z.object({
+  name: z.literal("1Password"),
+  app: z.literal(AppConnection.OnePass),
+  methods: z.nativeEnum(OnePassConnectionMethod).array()
+});

backend/src/services/app-connection/1password/1password-connection-service.ts

@@ -0,0 +1,30 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listOnePassVaults } from "./1password-connection-fns";
+import { TOnePassConnection } from "./1password-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TOnePassConnection>;
+
+export const onePassConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listVaults = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.OnePass, connectionId, actor);
+
+    try {
+      const vaults = await listOnePassVaults(appConnection);
+      return vaults;
+    } catch (error) {
+      logger.error(error, "Failed to establish connection with 1Password");
+      return [];
+    }
+  };
+
+  return {
+    listVaults
+  };
+};

backend/src/services/app-connection/1password/1password-connection-types.ts

@@ -0,0 +1,35 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateOnePassConnectionSchema,
+  OnePassConnectionSchema,
+  ValidateOnePassConnectionCredentialsSchema
+} from "./1password-connection-schemas";
+
+export type TOnePassConnection = z.infer<typeof OnePassConnectionSchema>;
+
+export type TOnePassConnectionInput = z.infer<typeof CreateOnePassConnectionSchema> & {
+  app: AppConnection.OnePass;
+};
+
+export type TValidateOnePassConnectionCredentialsSchema = typeof ValidateOnePassConnectionCredentialsSchema;
+
+export type TOnePassConnectionConfig = DiscriminativePick<TOnePassConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
+
+export type TOnePassVault = {
+  id: string;
+  name: string;
+  type: string;
+  items: number;
+
+  attributeVersion: number;
+  contentVersion: number;
+
+  createdAt: string;
+  updatedAt: string;
+};

backend/src/services/app-connection/1password/index.ts

@@ -0,0 +1,4 @@
+export * from "./1password-connection-enums";
+export * from "./1password-connection-fns";
+export * from "./1password-connection-schemas";
+export * from "./1password-connection-types";

backend/src/services/app-connection/app-connection-enums.ts

@@ -12,13 +12,15 @@ export enum AppConnection {
   Vercel = "vercel",
   Postgres = "postgres",
   MsSql = "mssql",
+  MySql = "mysql",
   Camunda = "camunda",
   Windmill = "windmill",
   Auth0 = "auth0",
   HCVault = "hashicorp-vault",
   LDAP = "ldap",
   TeamCity = "teamcity",
-  OCI = "oci"
+  OCI = "oci",
+  OnePass = "1password"
 }
 
 export enum AWSRegion {
@@ -67,3 +69,8 @@ export enum AWSRegion {
   // South America
   SA_EAST_1 = "sa-east-1" // Sao Paulo
 }
+
+export enum AppConnectionPlanType {
+  Enterprise = "enterprise",
+  Regular = "regular"
+}

backend/src/services/app-connection/app-connection-fns.ts

@@ -1,14 +1,25 @@
 import { TAppConnections } from "@app/db/schemas/app-connections";
+import {
+  getOCIConnectionListItem,
+  OCIConnectionMethod,
+  validateOCIConnectionCredentials
+} from "@app/ee/services/app-connections/oci";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { generateHash } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
-import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
+import { APP_CONNECTION_NAME_MAP, APP_CONNECTION_PLAN_MAP } from "@app/services/app-connection/app-connection-maps";
 import {
   transferSqlConnectionCredentialsToPlatform,
   validateSqlConnectionCredentials
 } from "@app/services/app-connection/shared/sql";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
-import { AppConnection } from "./app-connection-enums";
+import {
+  getOnePassConnectionListItem,
+  OnePassConnectionMethod,
+  validateOnePassConnectionCredentials
+} from "./1password";
+import { AppConnection, AppConnectionPlanType } from "./app-connection-enums";
 import { TAppConnectionServiceFactoryDep } from "./app-connection-service";
 import {
   TAppConnection,
@@ -58,7 +69,8 @@ import {
 } from "./humanitec";
 import { getLdapConnectionListItem, LdapConnectionMethod, validateLdapConnectionCredentials } from "./ldap";
 import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
-import { getOCIConnectionListItem, OCIConnectionMethod, validateOCIConnectionCredentials } from "./oci";
+import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
+import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import {
   getTeamCityConnectionListItem,
@@ -92,6 +104,7 @@ export const listAppConnectionOptions = () => {
     getVercelConnectionListItem(),
     getPostgresConnectionListItem(),
     getMsSqlConnectionListItem(),
+    getMySqlConnectionListItem(),
     getCamundaConnectionListItem(),
     getAzureClientSecretsConnectionListItem(),
     getWindmillConnectionListItem(),
@@ -99,7 +112,8 @@ export const listAppConnectionOptions = () => {
     getHCVaultConnectionListItem(),
     getLdapConnectionListItem(),
     getTeamCityConnectionListItem(),
-    getOCIConnectionListItem()
+    getOCIConnectionListItem(),
+    getOnePassConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -162,6 +176,7 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Humanitec]: validateHumanitecConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Postgres]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.MsSql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.MySql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Camunda]: validateCamundaConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Vercel]: validateVercelConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.TerraformCloud]: validateTerraformCloudConnectionCredentials as TAppConnectionCredentialsValidator,
@@ -170,7 +185,8 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.HCVault]: validateHCVaultConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.LDAP]: validateLdapConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.TeamCity]: validateTeamCityConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.OCI]: validateOCIConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.OCI]: validateOCIConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.OnePass]: validateOnePassConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
@@ -201,9 +217,11 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case HumanitecConnectionMethod.ApiToken:
     case TerraformCloudConnectionMethod.ApiToken:
     case VercelConnectionMethod.ApiToken:
+    case OnePassConnectionMethod.ApiToken:
       return "API Token";
     case PostgresConnectionMethod.UsernameAndPassword:
     case MsSqlConnectionMethod.UsernameAndPassword:
+    case MySqlConnectionMethod.UsernameAndPassword:
       return "Username & Password";
     case WindmillConnectionMethod.AccessToken:
     case HCVaultConnectionMethod.AccessToken:
@@ -256,6 +274,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Humanitec]: platformManagedCredentialsNotSupported,
   [AppConnection.Postgres]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
   [AppConnection.MsSql]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
+  [AppConnection.MySql]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
   [AppConnection.TerraformCloud]: platformManagedCredentialsNotSupported,
   [AppConnection.Camunda]: platformManagedCredentialsNotSupported,
   [AppConnection.Vercel]: platformManagedCredentialsNotSupported,
@@ -265,5 +284,21 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.HCVault]: platformManagedCredentialsNotSupported,
   [AppConnection.LDAP]: platformManagedCredentialsNotSupported, // we could support this in the future
   [AppConnection.TeamCity]: platformManagedCredentialsNotSupported,
-  [AppConnection.OCI]: platformManagedCredentialsNotSupported
+  [AppConnection.OCI]: platformManagedCredentialsNotSupported,
+  [AppConnection.OnePass]: platformManagedCredentialsNotSupported
+};
+
+export const enterpriseAppCheck = async (
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">,
+  appConnection: AppConnection,
+  orgId: string,
+  errorMessage: string
+) => {
+  if (APP_CONNECTION_PLAN_MAP[appConnection] === AppConnectionPlanType.Enterprise) {
+    const plan = await licenseService.getPlan(orgId);
+    if (!plan.enterpriseAppConnections)
+      throw new BadRequestError({
+        message: errorMessage
+      });
+  }
 };

backend/src/services/app-connection/app-connection-maps.ts

@@ -1,4 +1,4 @@
-import { AppConnection } from "./app-connection-enums";
+import { AppConnection, AppConnectionPlanType } from "./app-connection-enums";
 
 export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AWS]: "AWS",
@@ -14,11 +14,38 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.Vercel]: "Vercel",
   [AppConnection.Postgres]: "PostgreSQL",
   [AppConnection.MsSql]: "Microsoft SQL Server",
+  [AppConnection.MySql]: "MySQL",
   [AppConnection.Camunda]: "Camunda",
   [AppConnection.Windmill]: "Windmill",
   [AppConnection.Auth0]: "Auth0",
   [AppConnection.HCVault]: "Hashicorp Vault",
   [AppConnection.LDAP]: "LDAP",
   [AppConnection.TeamCity]: "TeamCity",
-  [AppConnection.OCI]: "OCI"
+  [AppConnection.OCI]: "OCI",
+  [AppConnection.OnePass]: "1Password"
+};
+
+export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
+  [AppConnection.AWS]: AppConnectionPlanType.Regular,
+  [AppConnection.GitHub]: AppConnectionPlanType.Regular,
+  [AppConnection.GitHubRadar]: AppConnectionPlanType.Regular,
+  [AppConnection.GCP]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureKeyVault]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureAppConfiguration]: AppConnectionPlanType.Regular,
+  [AppConnection.AzureClientSecrets]: AppConnectionPlanType.Regular,
+  [AppConnection.Databricks]: AppConnectionPlanType.Regular,
+  [AppConnection.Humanitec]: AppConnectionPlanType.Regular,
+  [AppConnection.TerraformCloud]: AppConnectionPlanType.Regular,
+  [AppConnection.Vercel]: AppConnectionPlanType.Regular,
+  [AppConnection.Postgres]: AppConnectionPlanType.Regular,
+  [AppConnection.MsSql]: AppConnectionPlanType.Regular,
+  [AppConnection.Camunda]: AppConnectionPlanType.Regular,
+  [AppConnection.Windmill]: AppConnectionPlanType.Regular,
+  [AppConnection.Auth0]: AppConnectionPlanType.Regular,
+  [AppConnection.HCVault]: AppConnectionPlanType.Regular,
+  [AppConnection.LDAP]: AppConnectionPlanType.Regular,
+  [AppConnection.TeamCity]: AppConnectionPlanType.Regular,
+  [AppConnection.OCI]: AppConnectionPlanType.Enterprise,
+  [AppConnection.OnePass]: AppConnectionPlanType.Regular,
+  [AppConnection.MySql]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -1,5 +1,8 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
+import { ValidateOCIConnectionCredentialsSchema } from "@app/ee/services/app-connections/oci";
+import { ociConnectionService } from "@app/ee/services/app-connections/oci/oci-connection-service";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionAppConnectionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { generateHash } from "@app/lib/crypto/encryption";
@@ -9,6 +12,7 @@ import { DiscriminativePick, OrgServiceActor } from "@app/lib/types";
 import {
   decryptAppConnection,
   encryptAppConnectionCredentials,
+  enterpriseAppCheck,
   getAppConnectionMethodName,
   listAppConnectionOptions,
   TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM,
@@ -18,6 +22,8 @@ import { auth0ConnectionService } from "@app/services/app-connection/auth0/auth0
 import { githubRadarConnectionService } from "@app/services/app-connection/github-radar/github-radar-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
+import { ValidateOnePassConnectionCredentialsSchema } from "./1password";
+import { onePassConnectionService } from "./1password/1password-connection-service";
 import { TAppConnectionDALFactory } from "./app-connection-dal";
 import { AppConnection } from "./app-connection-enums";
 import { APP_CONNECTION_NAME_MAP } from "./app-connection-maps";
@@ -51,8 +57,7 @@ import { ValidateHumanitecConnectionCredentialsSchema } from "./humanitec";
 import { humanitecConnectionService } from "./humanitec/humanitec-connection-service";
 import { ValidateLdapConnectionCredentialsSchema } from "./ldap";
 import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
-import { ValidateOCIConnectionCredentialsSchema } from "./oci";
-import { ociConnectionService } from "./oci/oci-connection-service";
+import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
 import { ValidateTeamCityConnectionCredentialsSchema } from "./teamcity";
 import { teamcityConnectionService } from "./teamcity/teamcity-connection-service";
@@ -67,6 +72,7 @@ export type TAppConnectionServiceFactoryDep = {
   appConnectionDAL: TAppConnectionDALFactory;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
 
 export type TAppConnectionServiceFactory = ReturnType<typeof appConnectionServiceFactory>;
@@ -84,6 +90,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Vercel]: ValidateVercelConnectionCredentialsSchema,
   [AppConnection.Postgres]: ValidatePostgresConnectionCredentialsSchema,
   [AppConnection.MsSql]: ValidateMsSqlConnectionCredentialsSchema,
+  [AppConnection.MySql]: ValidateMySqlConnectionCredentialsSchema,
   [AppConnection.Camunda]: ValidateCamundaConnectionCredentialsSchema,
   [AppConnection.AzureClientSecrets]: ValidateAzureClientSecretsConnectionCredentialsSchema,
   [AppConnection.Windmill]: ValidateWindmillConnectionCredentialsSchema,
@@ -91,13 +98,15 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.HCVault]: ValidateHCVaultConnectionCredentialsSchema,
   [AppConnection.LDAP]: ValidateLdapConnectionCredentialsSchema,
   [AppConnection.TeamCity]: ValidateTeamCityConnectionCredentialsSchema,
-  [AppConnection.OCI]: ValidateOCIConnectionCredentialsSchema
+  [AppConnection.OCI]: ValidateOCIConnectionCredentialsSchema,
+  [AppConnection.OnePass]: ValidateOnePassConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
   appConnectionDAL,
   permissionService,
-  kmsService
+  kmsService,
+  licenseService
 }: TAppConnectionServiceFactoryDep) => {
   const listAppConnectionsByOrg = async (actor: OrgServiceActor, app?: AppConnection) => {
     const { permission } = await permissionService.getOrgPermission(
@@ -194,6 +203,13 @@ export const appConnectionServiceFactory = ({
       OrgPermissionSubjects.AppConnections
     );
 
+    await enterpriseAppCheck(
+      licenseService,
+      app,
+      actor.orgId,
+      "Failed to create app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+    );
+
     const validatedCredentials = await validateAppConnectionCredentials({
       app,
       credentials,
@@ -256,6 +272,13 @@ export const appConnectionServiceFactory = ({
 
     if (!appConnection) throw new NotFoundError({ message: `Could not find App Connection with ID ${connectionId}` });
 
+    await enterpriseAppCheck(
+      licenseService,
+      appConnection.app as AppConnection,
+      actor.orgId,
+      "Failed to update app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+    );
+
     const { permission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -402,6 +425,13 @@ export const appConnectionServiceFactory = ({
 
     if (!appConnection) throw new NotFoundError({ message: `Could not find App Connection with ID ${connectionId}` });
 
+    await enterpriseAppCheck(
+      licenseService,
+      app,
+      actor.orgId,
+      "Failed to connect app due to plan restriction. Upgrade plan to access enterprise app connections."
+    );
+
     const { permission: orgPermission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -472,6 +502,7 @@ export const appConnectionServiceFactory = ({
     hcvault: hcVaultConnectionService(connectAppConnectionById),
     windmill: windmillConnectionService(connectAppConnectionById),
     teamcity: teamcityConnectionService(connectAppConnectionById),
-    oci: ociConnectionService(connectAppConnectionById)
+    oci: ociConnectionService(connectAppConnectionById, licenseService),
+    onepass: onePassConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -1,7 +1,19 @@
+import {
+  TOCIConnection,
+  TOCIConnectionConfig,
+  TOCIConnectionInput,
+  TValidateOCIConnectionCredentialsSchema
+} from "@app/ee/services/app-connections/oci";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
+import {
+  TOnePassConnection,
+  TOnePassConnectionConfig,
+  TOnePassConnectionInput,
+  TValidateOnePassConnectionCredentialsSchema
+} from "./1password";
 import { AWSRegion } from "./app-connection-enums";
 import {
   TAuth0Connection,
@@ -82,12 +94,7 @@ import {
   TValidateLdapConnectionCredentialsSchema
 } from "./ldap";
 import { TMsSqlConnection, TMsSqlConnectionInput, TValidateMsSqlConnectionCredentialsSchema } from "./mssql";
-import {
-  TOCIConnection,
-  TOCIConnectionConfig,
-  TOCIConnectionInput,
-  TValidateOCIConnectionCredentialsSchema
-} from "./oci";
+import { TMySqlConnection, TMySqlConnectionInput, TValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import {
   TPostgresConnection,
   TPostgresConnectionInput,
@@ -131,6 +138,7 @@ export type TAppConnection = { id: string } & (
   | TVercelConnection
   | TPostgresConnection
   | TMsSqlConnection
+  | TMySqlConnection
   | TCamundaConnection
   | TAzureClientSecretsConnection
   | TWindmillConnection
@@ -139,11 +147,12 @@ export type TAppConnection = { id: string } & (
   | TLdapConnection
   | TTeamCityConnection
   | TOCIConnection
+  | TOnePassConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
 
-export type TSqlConnection = TPostgresConnection | TMsSqlConnection;
+export type TSqlConnection = TPostgresConnection | TMsSqlConnection | TMySqlConnection;
 
 export type TAppConnectionInput = { id: string } & (
   | TAwsConnectionInput
@@ -158,6 +167,7 @@ export type TAppConnectionInput = { id: string } & (
   | TVercelConnectionInput
   | TPostgresConnectionInput
   | TMsSqlConnectionInput
+  | TMySqlConnectionInput
   | TCamundaConnectionInput
   | TAzureClientSecretsConnectionInput
   | TWindmillConnectionInput
@@ -166,9 +176,10 @@ export type TAppConnectionInput = { id: string } & (
   | TLdapConnectionInput
   | TTeamCityConnectionInput
   | TOCIConnectionInput
+  | TOnePassConnectionInput
 );
 
-export type TSqlConnectionInput = TPostgresConnectionInput | TMsSqlConnectionInput;
+export type TSqlConnectionInput = TPostgresConnectionInput | TMsSqlConnectionInput | TMySqlConnectionInput;
 
 export type TCreateAppConnectionDTO = Pick<
   TAppConnectionInput,
@@ -198,7 +209,8 @@ export type TAppConnectionConfig =
   | THCVaultConnectionConfig
   | TLdapConnectionConfig
   | TTeamCityConnectionConfig
-  | TOCIConnectionConfig;
+  | TOCIConnectionConfig
+  | TOnePassConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -212,6 +224,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateHumanitecConnectionCredentialsSchema
   | TValidatePostgresConnectionCredentialsSchema
   | TValidateMsSqlConnectionCredentialsSchema
+  | TValidateMySqlConnectionCredentialsSchema
   | TValidateCamundaConnectionCredentialsSchema
   | TValidateVercelConnectionCredentialsSchema
   | TValidateTerraformCloudConnectionCredentialsSchema
@@ -220,7 +233,8 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateHCVaultConnectionCredentialsSchema
   | TValidateLdapConnectionCredentialsSchema
   | TValidateTeamCityConnectionCredentialsSchema
-  | TValidateOCIConnectionCredentialsSchema;
+  | TValidateOCIConnectionCredentialsSchema
+  | TValidateOnePassConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/ldap/ldap-connection-schemas.ts

@@ -1,8 +1,7 @@
-import RE2 from "re2";
 import { z } from "zod";
 
 import { AppConnections } from "@app/lib/api-docs";
-import { DistinguishedNameRegex } from "@app/lib/regex";
+import { DistinguishedNameRegex, LdapUrlRegex, UserPrincipalNameRegex } from "@app/lib/regex";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import {
   BaseAppConnectionSchema,
@@ -14,17 +13,14 @@ import { LdapConnectionMethod, LdapProvider } from "./ldap-connection-enums";
 
 export const LdapConnectionSimpleBindCredentialsSchema = z.object({
   provider: z.nativeEnum(LdapProvider).describe(AppConnections.CREDENTIALS.LDAP.provider),
-  url: z
-    .string()
-    .trim()
-    .min(1, "URL required")
-    .regex(new RE2(/^ldaps?:\/\//))
-    .describe(AppConnections.CREDENTIALS.LDAP.url),
+  url: z.string().trim().min(1, "URL required").regex(LdapUrlRegex).describe(AppConnections.CREDENTIALS.LDAP.url),
   dn: z
     .string()
     .trim()
-    .regex(new RE2(DistinguishedNameRegex), "Invalid DN format, ie; CN=user,OU=users,DC=example,DC=com")
-    .min(1, "Distinguished Name (DN) required")
+    .min(1, "DN/UPN required")
+    .refine((value) => DistinguishedNameRegex.test(value) || UserPrincipalNameRegex.test(value), {
+      message: "Invalid DN/UPN format"
+    })
     .describe(AppConnections.CREDENTIALS.LDAP.dn),
   password: z.string().trim().min(1, "Password required").describe(AppConnections.CREDENTIALS.LDAP.password),
   sslRejectUnauthorized: z.boolean().optional().describe(AppConnections.CREDENTIALS.LDAP.sslRejectUnauthorized),

backend/src/services/app-connection/mysql/index.ts

@@ -0,0 +1,4 @@
+export * from "./mysql-connection-enums";
+export * from "./mysql-connection-fns";
+export * from "./mysql-connection-schemas";
+export * from "./mysql-connection-types";

backend/src/services/app-connection/mysql/mysql-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum MySqlConnectionMethod {
+  UsernameAndPassword = "username-and-password"
+}

backend/src/services/app-connection/mysql/mysql-connection-fns.ts

@@ -0,0 +1,12 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { MySqlConnectionMethod } from "./mysql-connection-enums";
+
+export const getMySqlConnectionListItem = () => {
+  return {
+    name: "MySQL" as const,
+    app: AppConnection.MySql as const,
+    methods: Object.values(MySqlConnectionMethod) as [MySqlConnectionMethod.UsernameAndPassword],
+    supportsPlatformManagement: true as const
+  };
+};

backend/src/services/app-connection/mysql/mysql-connection-schemas.ts

@@ -0,0 +1,66 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AppConnection } from "../app-connection-enums";
+import { BaseSqlUsernameAndPasswordConnectionSchema } from "../shared/sql";
+import { MySqlConnectionMethod } from "./mysql-connection-enums";
+
+export const MySqlConnectionAccessTokenCredentialsSchema = BaseSqlUsernameAndPasswordConnectionSchema;
+
+const BaseMySqlConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.MySql) });
+
+export const MySqlConnectionSchema = BaseMySqlConnectionSchema.extend({
+  method: z.literal(MySqlConnectionMethod.UsernameAndPassword),
+  credentials: MySqlConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedMySqlConnectionSchema = z.discriminatedUnion("method", [
+  BaseMySqlConnectionSchema.extend({
+    method: z.literal(MySqlConnectionMethod.UsernameAndPassword),
+    credentials: MySqlConnectionAccessTokenCredentialsSchema.pick({
+      host: true,
+      database: true,
+      port: true,
+      username: true,
+      sslEnabled: true,
+      sslRejectUnauthorized: true,
+      sslCertificate: true
+    })
+  })
+]);
+
+export const ValidateMySqlConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(MySqlConnectionMethod.UsernameAndPassword)
+      .describe(AppConnections.CREATE(AppConnection.MySql).method),
+    credentials: MySqlConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.MySql).credentials
+    )
+  })
+]);
+
+export const CreateMySqlConnectionSchema = ValidateMySqlConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.MySql, { supportsPlatformManagedCredentials: true })
+);
+
+export const UpdateMySqlConnectionSchema = z
+  .object({
+    credentials: MySqlConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.MySql).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.MySql, { supportsPlatformManagedCredentials: true }));
+
+export const MySqlConnectionListItemSchema = z.object({
+  name: z.literal("MySQL"),
+  app: z.literal(AppConnection.MySql),
+  methods: z.nativeEnum(MySqlConnectionMethod).array(),
+  supportsPlatformManagement: z.literal(true)
+});

backend/src/services/app-connection/mysql/mysql-connection-types.ts

@@ -0,0 +1,16 @@
+import z from "zod";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateMySqlConnectionSchema,
+  MySqlConnectionSchema,
+  ValidateMySqlConnectionCredentialsSchema
+} from "./mysql-connection-schemas";
+
+export type TMySqlConnection = z.infer<typeof MySqlConnectionSchema>;
+
+export type TMySqlConnectionInput = z.infer<typeof CreateMySqlConnectionSchema> & {
+  app: AppConnection.MySql;
+};
+
+export type TValidateMySqlConnectionCredentialsSchema = typeof ValidateMySqlConnectionCredentialsSchema;

backend/src/services/app-connection/oci/index.ts

@@ -1,4 +0,0 @@
-export * from "./oci-connection-enums";
-export * from "./oci-connection-fns";
-export * from "./oci-connection-schemas";
-export * from "./oci-connection-types";

backend/src/services/app-connection/oci/oci-connection-enums.ts

@@ -1,3 +0,0 @@
-export enum OCIConnectionMethod {
-  AccessKey = "access-key"
-}

backend/src/services/app-connection/oci/oci-connection-fns.ts

@@ -1,139 +0,0 @@
-import { common, identity, keymanagement } from "oci-sdk";
-
-import { BadRequestError } from "@app/lib/errors";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-import { OCIConnectionMethod } from "./oci-connection-enums";
-import { TOCIConnection, TOCIConnectionConfig } from "./oci-connection-types";
-
-export const getOCIProvider = async (config: TOCIConnectionConfig) => {
-  const {
-    credentials: { fingerprint, privateKey, region, tenancyOcid, userOcid }
-  } = config;
-
-  const provider = new common.SimpleAuthenticationDetailsProvider(
-    tenancyOcid,
-    userOcid,
-    fingerprint,
-    privateKey,
-    null,
-    common.Region.fromRegionId(region)
-  );
-
-  return provider;
-};
-
-export const getOCIConnectionListItem = () => {
-  return {
-    name: "OCI" as const,
-    app: AppConnection.OCI as const,
-    methods: Object.values(OCIConnectionMethod) as [OCIConnectionMethod.AccessKey]
-  };
-};
-
-export const validateOCIConnectionCredentials = async (config: TOCIConnectionConfig) => {
-  const provider = await getOCIProvider(config);
-
-  try {
-    const identityClient = new identity.IdentityClient({
-      authenticationDetailsProvider: provider
-    });
-
-    // Get user details - a lightweight call that validates all credentials
-    await identityClient.getUser({ userId: config.credentials.userOcid });
-  } catch (error: unknown) {
-    if (error instanceof Error) {
-      throw new BadRequestError({
-        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
-      });
-    }
-    throw new BadRequestError({
-      message: "Unable to validate connection: verify credentials"
-    });
-  }
-
-  return config.credentials;
-};
-
-export const listOCICompartments = async (appConnection: TOCIConnection) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const identityClient = new identity.IdentityClient({ authenticationDetailsProvider: provider });
-  const keyManagementClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const rootCompartment = await identityClient
-    .getTenancy({
-      tenancyId: appConnection.credentials.tenancyOcid
-    })
-    .then((response) => ({
-      ...response.tenancy,
-      id: appConnection.credentials.tenancyOcid,
-      name: response.tenancy.name ? `${response.tenancy.name} (root)` : "root"
-    }));
-
-  const compartments = await identityClient.listCompartments({
-    compartmentId: appConnection.credentials.tenancyOcid,
-    compartmentIdInSubtree: true,
-    accessLevel: identity.requests.ListCompartmentsRequest.AccessLevel.Any,
-    lifecycleState: identity.models.Compartment.LifecycleState.Active
-  });
-
-  const allCompartments = [rootCompartment, ...compartments.items];
-  const filteredCompartments = [];
-
-  for await (const compartment of allCompartments) {
-    try {
-      // Check if user can list vaults in this compartment
-      await keyManagementClient.listVaults({
-        compartmentId: compartment.id,
-        limit: 1
-      });
-
-      filteredCompartments.push(compartment);
-    } catch (error) {
-      // Do nothing
-    }
-  }
-
-  return filteredCompartments;
-};
-
-export const listOCIVaults = async (appConnection: TOCIConnection, compartmentOcid: string) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const keyManagementClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const vaults = await keyManagementClient.listVaults({
-    compartmentId: compartmentOcid
-  });
-
-  return vaults.items.filter((v) => v.lifecycleState === keymanagement.models.Vault.LifecycleState.Active);
-};
-
-export const listOCIVaultKeys = async (appConnection: TOCIConnection, compartmentOcid: string, vaultOcid: string) => {
-  const provider = await getOCIProvider(appConnection);
-
-  const kmsVaultClient = new keymanagement.KmsVaultClient({
-    authenticationDetailsProvider: provider
-  });
-
-  const vault = await kmsVaultClient.getVault({
-    vaultId: vaultOcid
-  });
-
-  const keyManagementClient = new keymanagement.KmsManagementClient({
-    authenticationDetailsProvider: provider
-  });
-
-  keyManagementClient.endpoint = vault.vault.managementEndpoint;
-
-  const keys = await keyManagementClient.listKeys({
-    compartmentId: compartmentOcid
-  });
-
-  return keys.items.filter((v) => v.lifecycleState === keymanagement.models.KeySummary.LifecycleState.Enabled);
-};

backend/src/services/app-connection/oci/oci-connection-schemas.ts

@@ -1,65 +0,0 @@
-import z from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { OCIConnectionMethod } from "./oci-connection-enums";
-
-export const OCIConnectionAccessTokenCredentialsSchema = z.object({
-  userOcid: z.string().trim().min(1, "User OCID required").describe(AppConnections.CREDENTIALS.OCI.userOcid),
-  tenancyOcid: z.string().trim().min(1, "Tenancy OCID required").describe(AppConnections.CREDENTIALS.OCI.tenancyOcid),
-  region: z.string().trim().min(1, "Region required").describe(AppConnections.CREDENTIALS.OCI.region),
-  fingerprint: z.string().trim().min(1, "Fingerprint required").describe(AppConnections.CREDENTIALS.OCI.fingerprint),
-  privateKey: z.string().trim().min(1, "Private Key required").describe(AppConnections.CREDENTIALS.OCI.privateKey)
-});
-
-const BaseOCIConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.OCI) });
-
-export const OCIConnectionSchema = BaseOCIConnectionSchema.extend({
-  method: z.literal(OCIConnectionMethod.AccessKey),
-  credentials: OCIConnectionAccessTokenCredentialsSchema
-});
-
-export const SanitizedOCIConnectionSchema = z.discriminatedUnion("method", [
-  BaseOCIConnectionSchema.extend({
-    method: z.literal(OCIConnectionMethod.AccessKey),
-    credentials: OCIConnectionAccessTokenCredentialsSchema.pick({
-      userOcid: true,
-      tenancyOcid: true,
-      region: true,
-      fingerprint: true
-    })
-  })
-]);
-
-export const ValidateOCIConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(OCIConnectionMethod.AccessKey).describe(AppConnections.CREATE(AppConnection.OCI).method),
-    credentials: OCIConnectionAccessTokenCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.OCI).credentials
-    )
-  })
-]);
-
-export const CreateOCIConnectionSchema = ValidateOCIConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.OCI)
-);
-
-export const UpdateOCIConnectionSchema = z
-  .object({
-    credentials: OCIConnectionAccessTokenCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.OCI).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.OCI));
-
-export const OCIConnectionListItemSchema = z.object({
-  name: z.literal("OCI"),
-  app: z.literal(AppConnection.OCI),
-  methods: z.nativeEnum(OCIConnectionMethod).array()
-});

backend/src/services/app-connection/oci/oci-connection-service.ts

@@ -1,70 +0,0 @@
-import { logger } from "@app/lib/logger";
-import { OrgServiceActor } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import { listOCICompartments, listOCIVaultKeys, listOCIVaults } from "./oci-connection-fns";
-import { TOCIConnection } from "./oci-connection-types";
-
-type TGetAppConnectionFunc = (
-  app: AppConnection,
-  connectionId: string,
-  actor: OrgServiceActor
-) => Promise<TOCIConnection>;
-
-type TListOCIVaultsDTO = {
-  connectionId: string;
-  compartmentOcid: string;
-};
-
-type TListOCIVaultKeysDTO = {
-  connectionId: string;
-  compartmentOcid: string;
-  vaultOcid: string;
-};
-
-export const ociConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
-  const listCompartments = async (connectionId: string, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const compartments = await listOCICompartments(appConnection);
-      return compartments;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  const listVaults = async ({ connectionId, compartmentOcid }: TListOCIVaultsDTO, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const vaults = await listOCIVaults(appConnection, compartmentOcid);
-      return vaults;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  const listVaultKeys = async (
-    { connectionId, compartmentOcid, vaultOcid }: TListOCIVaultKeysDTO,
-    actor: OrgServiceActor
-  ) => {
-    const appConnection = await getAppConnection(AppConnection.OCI, connectionId, actor);
-
-    try {
-      const keys = await listOCIVaultKeys(appConnection, compartmentOcid, vaultOcid);
-      return keys;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with OCI");
-      return [];
-    }
-  };
-
-  return {
-    listCompartments,
-    listVaults,
-    listVaultKeys
-  };
-};

backend/src/services/app-connection/oci/oci-connection-types.ts

@@ -1,22 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  CreateOCIConnectionSchema,
-  OCIConnectionSchema,
-  ValidateOCIConnectionCredentialsSchema
-} from "./oci-connection-schemas";
-
-export type TOCIConnection = z.infer<typeof OCIConnectionSchema>;
-
-export type TOCIConnectionInput = z.infer<typeof CreateOCIConnectionSchema> & {
-  app: AppConnection.OCI;
-};
-
-export type TValidateOCIConnectionCredentialsSchema = typeof ValidateOCIConnectionCredentialsSchema;
-
-export type TOCIConnectionConfig = DiscriminativePick<TOCIConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};

backend/src/services/app-connection/shared/sql/sql-connection-fns.ts

@@ -15,7 +15,8 @@ const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
 
 const SQL_CONNECTION_CLIENT_MAP = {
   [AppConnection.Postgres]: "pg",
-  [AppConnection.MsSql]: "mssql"
+  [AppConnection.MsSql]: "mssql",
+  [AppConnection.MySql]: "mysql2"
 };
 
 const getConnectionConfig = ({
@@ -45,6 +46,17 @@ const getConnectionConfig = ({
           : { encrypt: false }
       };
     }
+    case AppConnection.MySql: {
+      return {
+        ssl: sslEnabled
+          ? {
+              rejectUnauthorized: sslRejectUnauthorized,
+              ca: sslCertificate,
+              servername: host
+            }
+          : false
+      };
+    }
     default:
       throw new Error(`Unhandled SQL Connection Config: ${app as AppConnection}`);
   }
@@ -101,7 +113,8 @@ export const SQL_CONNECTION_ALTER_LOGIN_STATEMENT: Record<
   (credentials: TSqlCredentialsRotationGeneratedCredentials[number]) => [string, Knex.RawBinding]
 > = {
   [AppConnection.Postgres]: ({ username, password }) => [`ALTER USER ?? WITH PASSWORD '${password}';`, [username]],
-  [AppConnection.MsSql]: ({ username, password }) => [`ALTER LOGIN ?? WITH PASSWORD = '${password}';`, [username]]
+  [AppConnection.MsSql]: ({ username, password }) => [`ALTER LOGIN ?? WITH PASSWORD = '${password}';`, [username]],
+  [AppConnection.MySql]: ({ username, password }) => [`ALTER USER ??@'%' IDENTIFIED BY '${password}';`, [username]]
 };
 
 export const transferSqlConnectionCredentialsToPlatform = async (