merge main

2026-10-14 18:41:21 +00:00 · 2025-06-02 16:24:55 -07:00
parent d924580599 739ef8e05a
commit 8730d14104
722 changed files with 30947 additions and 13097 deletions
@@ -32,7 +32,7 @@ const formSchema = z.object({
  environments: z
    .object({
      name: z.string().trim().min(1),
-      slug: slugSchema({ min: 1, max: 32 })
+      slug: slugSchema({ min: 1, max: 64 })
    })
    .array()
    .nullish()
@@ -21,7 +21,7 @@ import {
 import { slugSchema } from "@app/lib/schemas";

 const formSchema = z.object({
-  name: slugSchema({ min: 1, max: 32, field: "Name" }),
+  name: slugSchema({ min: 1, max: 64, field: "Name" }),
  description: z.string().max(500).optional()
 });

@@ -18,9 +18,7 @@ export const ViewLdapPasswordRotationGeneratedCredentials = ({
    <ViewRotationGeneratedCredentialsDisplay
      activeCredentials={
        <>
-          <CredentialDisplay label="Distinguished Name (DN)">
-            {activeCredentials?.dn}
-          </CredentialDisplay>
+          <CredentialDisplay label="DN/UPN">{activeCredentials?.dn}</CredentialDisplay>
          <CredentialDisplay isSensitive label="Password">
            {activeCredentials?.password}
          </CredentialDisplay>
@@ -28,9 +26,7 @@ export const ViewLdapPasswordRotationGeneratedCredentials = ({
      }
      inactiveCredentials={
        <>
-          <CredentialDisplay label="Distinguished Name (DN)">
-            {inactiveCredentials?.dn}
-          </CredentialDisplay>
+          <CredentialDisplay label="DN/UPN">{inactiveCredentials?.dn}</CredentialDisplay>
          <CredentialDisplay isSensitive label="Password">
            {inactiveCredentials?.password}
          </CredentialDisplay>
@@ -62,6 +62,7 @@ const Content = ({ secretRotation }: ContentProps) => {
  let Component: ReactNode;
  switch (generatedCredentialsResponse.type) {
    case SecretRotation.PostgresCredentials:
+    case SecretRotation.MySqlCredentials:
    case SecretRotation.MsSqlCredentials:
      Component = (
        <ViewSqlCredentialsRotationGeneratedCredentials
@@ -1,11 +1,13 @@
 import { CredentialDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/CredentialDisplay";
 import { ViewRotationGeneratedCredentialsDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/ViewRotationGeneratedCredentialsDisplay";
 import { TMsSqlCredentialsRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/mssql-credentials-rotation";
+import { TMySqlCredentialsRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/mysql-credentials-rotation";
 import { TPostgresCredentialsRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/postgres-credentials-rotation";

 type Props = {
  generatedCredentialsResponse:
    | TMsSqlCredentialsRotationGeneratedCredentialsResponse
+    | TMySqlCredentialsRotationGeneratedCredentialsResponse
    | TPostgresCredentialsRotationGeneratedCredentialsResponse;
 };

@@ -48,7 +48,8 @@ const FORM_TABS: { name: string; key: string; fields: (keyof TSecretRotationV2Fo
      "rotateAtUtc"
    ]
  },
-  { name: "Parameters", key: "parameters", fields: ["parameters"] },
+  // @ts-expect-error temporary parameters aren't present on all forms
+  { name: "Parameters", key: "parameters", fields: ["parameters", "temporaryParameters"] },
  { name: "Mappings", key: "secretsMapping", fields: ["secretsMapping"] },
  { name: "Details", key: "details", fields: ["name", "description"] },
  { name: "Review", key: "review", fields: [] }
@@ -75,7 +76,7 @@ export const SecretRotationV2Form = ({
  const { rotationOption } = useSecretRotationV2Option(type);

  const formMethods = useForm<TSecretRotationV2Form>({
-    resolver: zodResolver(SecretRotationV2FormSchema),
+    resolver: zodResolver(SecretRotationV2FormSchema(Boolean(secretRotation))),
    defaultValues: secretRotation
      ? {
          ...secretRotation,
@@ -2,40 +2,135 @@ import { Controller, useFormContext } from "react-hook-form";

 import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
 import { DEFAULT_PASSWORD_REQUIREMENTS } from "@app/components/secret-rotations-v2/forms/schemas/shared";
-import { FormControl, Input } from "@app/components/v2";
+import { FormControl, Input, Select, SelectItem } from "@app/components/v2";
 import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { LdapPasswordRotationMethod } from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";

 export const LdapPasswordRotationParametersFields = () => {
-  const { control } = useFormContext<
+  const { control, watch, setValue } = useFormContext<
    TSecretRotationV2Form & {
      type: SecretRotation.LdapPassword;
    }
  >();

+  const [id, rotationMethod] = watch(["id", "parameters.rotationMethod"]);
+  const isUpdate = Boolean(id);
+
  return (
    <>
      <Controller
-        name="parameters.dn"
+        name="parameters.rotationMethod"
        control={control}
+        defaultValue={LdapPasswordRotationMethod.ConnectionPrincipal}
        render={({ field: { value, onChange }, fieldState: { error } }) => (
          <FormControl
-            isError={Boolean(error)}
+            tooltipText={
+              <>
+                <span>Determines how the rotation will be performed:</span>
+                <ul className="ml-4 mt-2 flex list-disc flex-col gap-2">
+                  <li>
+                    <span className="font-medium">Connection Principal</span> - The Connection
+                    principal will rotate the target principal&#39;s password.
+                  </li>
+                  <li>
+                    <span className="font-medium">Target Principal</span> - The target principal
+                    will rotate their own password.
+                  </li>
+                </ul>
+              </>
+            }
+            tooltipClassName="max-w-sm"
            errorText={error?.message}
-            label="Distinguished Name (DN)"
+            isError={Boolean(error?.message)}
+            label="Rotation Method"
+            helperText={
+              // eslint-disable-next-line no-nested-ternary
+              isUpdate
+                ? "Cannot be updated."
+                : value === LdapPasswordRotationMethod.ConnectionPrincipal
+                  ? "The connection principal will rotate the target principal's password"
+                  : "The target principal will rotate their own password"
+            }
          >
-            <Input
+            <Select
+              isDisabled={isUpdate}
              value={value}
-              onChange={onChange}
-              placeholder="CN=John,OU=Users,DC=example,DC=com"
-            />
+              onValueChange={(val) => {
+                setValue(
+                  "temporaryParameters",
+                  val === LdapPasswordRotationMethod.TargetPrincipal
+                    ? {
+                        password: ""
+                      }
+                    : undefined
+                );
+                onChange(val);
+              }}
+              className="w-full border border-mineshaft-500 capitalize"
+              position="popper"
+              dropdownContainerClassName="max-w-none"
+            >
+              {Object.values(LdapPasswordRotationMethod).map((method) => {
+                return (
+                  <SelectItem value={method} className="capitalize" key={method}>
+                    {method.replace("-", " ")}
+                  </SelectItem>
+                );
+              })}
+            </Select>
          </FormControl>
        )}
      />
+      <div className="flex gap-3">
+        <Controller
+          name="parameters.dn"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              className="flex-1"
+              isError={Boolean(error)}
+              errorText={error?.message}
+              label="Target Principal's DN/UPN"
+              tooltipText="The DN/UPN of the principal that you want to perform password rotation on."
+              tooltipClassName="max-w-sm"
+              helperText={isUpdate ? "Cannot be updated." : undefined}
+            >
+              <Input
+                isDisabled={isUpdate}
+                value={value}
+                onChange={onChange}
+                placeholder="CN=John,OU=Users,DC=example,DC=com"
+              />
+            </FormControl>
+          )}
+        />
+        {rotationMethod === LdapPasswordRotationMethod.TargetPrincipal && !isUpdate && (
+          <Controller
+            name="temporaryParameters.password"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                className="flex-1"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                label="Target Principal's Password"
+              >
+                <Input
+                  value={value}
+                  onChange={onChange}
+                  type="password"
+                  placeholder="****************"
+                />
+              </FormControl>
+            )}
+          />
+        )}
+      </div>
      <div className="flex flex-col gap-3">
        <div className="w-full border-b border-mineshaft-600">
          <span className="text-sm text-mineshaft-300">Password Requirements</span>
        </div>
-        <div className="grid grid-cols-2 gap-3 rounded border border-mineshaft-600 bg-mineshaft-700 px-3 py-2">
+        <div className="grid grid-cols-2 gap-x-3 gap-y-1 rounded border border-mineshaft-600 bg-mineshaft-700 px-3 pt-3">
          <Controller
            control={control}
            name="parameters.passwordRequirements.length"
@@ -45,7 +140,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Password Length"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="The length of the password to generate"
+                tooltipText="The length of the password to generate"
              >
                <Input
                  type="number"
@@ -67,7 +162,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Digit Count"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="Minimum number of digits"
+                tooltipText="Minimum number of digits"
              >
                <Input
                  type="number"
@@ -88,7 +183,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Lowercase Character Count"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="Minimum number of lowercase characters"
+                tooltipText="Minimum number of lowercase characters"
              >
                <Input
                  type="number"
@@ -109,7 +204,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Uppercase Character Count"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="Minimum number of uppercase characters"
+                tooltipText="Minimum number of uppercase characters"
              >
                <Input
                  type="number"
@@ -130,7 +225,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Symbol Count"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="Minimum number of symbols"
+                tooltipText="Minimum number of symbols"
              >
                <Input
                  type="number"
@@ -151,7 +246,7 @@ export const LdapPasswordRotationParametersFields = () => {
                label="Allowed Symbols"
                isError={Boolean(error)}
                errorText={error?.message}
-                helperText="Symbols to use in generated password"
+                tooltipText="Symbols to use in generated password"
              >
                <Input
                  placeholder="-_.~!*"
@@ -12,6 +12,7 @@ import { SqlCredentialsRotationParametersFields } from "./shared";
 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationParametersFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationParametersFields,
+  [SecretRotation.MySqlCredentials]: SqlCredentialsRotationParametersFields,
  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationParametersFields,
  [SecretRotation.AzureClientSecret]: AzureClientSecretRotationParametersFields,
  [SecretRotation.LdapPassword]: LdapPasswordRotationParametersFields,
@@ -15,13 +15,35 @@ export const LdapPasswordRotationReviewFields = () => {

  const [parameters, { dn, password }] = watch(["parameters", "secretsMapping"]);

+  const { passwordRequirements } = parameters;
+
  return (
    <>
      <SecretRotationReviewSection label="Parameters">
-        <GenericFieldLabel label="Distinguished Name (DN)">{parameters.dn}</GenericFieldLabel>
+        <GenericFieldLabel label="DN/UPN">{parameters.dn}</GenericFieldLabel>
      </SecretRotationReviewSection>
+      {passwordRequirements && (
+        <SecretRotationReviewSection label="Password Requirements">
+          <GenericFieldLabel label="Length">{passwordRequirements.length}</GenericFieldLabel>
+          <GenericFieldLabel label="Minimum Digits">
+            {passwordRequirements.required.digits}
+          </GenericFieldLabel>
+          <GenericFieldLabel label="Minimum Lowercase Characters">
+            {passwordRequirements.required.lowercase}
+          </GenericFieldLabel>
+          <GenericFieldLabel label="Minimum Uppercase Characters">
+            {passwordRequirements.required.uppercase}
+          </GenericFieldLabel>
+          <GenericFieldLabel label="Minimum Symbols">
+            {passwordRequirements.required.symbols}
+          </GenericFieldLabel>
+          <GenericFieldLabel label="Allowed Symbols">
+            {passwordRequirements.allowedSymbols}
+          </GenericFieldLabel>
+        </SecretRotationReviewSection>
+      )}
      <SecretRotationReviewSection label="Secrets Mapping">
-        <GenericFieldLabel label="Distinguished Name (DN)">{dn}</GenericFieldLabel>
+        <GenericFieldLabel label="DN/UPN">{dn}</GenericFieldLabel>
        <GenericFieldLabel label="Password">{password}</GenericFieldLabel>
      </SecretRotationReviewSection>
    </>
@@ -15,6 +15,7 @@ import { SqlCredentialsRotationReviewFields } from "./shared";
 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationReviewFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationReviewFields,
+  [SecretRotation.MySqlCredentials]: SqlCredentialsRotationReviewFields,
  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationReviewFields,
  [SecretRotation.AzureClientSecret]: AzureClientSecretRotationReviewFields,
  [SecretRotation.LdapPassword]: LdapPasswordRotationReviewFields,
@@ -1,7 +1,7 @@
 import { ReactNode } from "react";

 type Props = {
-  label: "Parameters" | "Secrets Mapping";
+  label: "Parameters" | "Secrets Mapping" | "Password Requirements";
  children: ReactNode;
 };

@@ -17,7 +17,7 @@ export const LdapPasswordRotationSecretsMappingFields = () => {

  const items = [
    {
-      name: "DN",
+      name: "DN/UPN",
      input: (
        <Controller
          render={({ field: { value, onChange }, fieldState: { error } }) => (
@@ -12,6 +12,7 @@ import { SqlCredentialsRotationSecretsMappingFields } from "./shared";
 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationSecretsMappingFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationSecretsMappingFields,
+  [SecretRotation.MySqlCredentials]: SqlCredentialsRotationSecretsMappingFields,
  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationSecretsMappingFields,
  [SecretRotation.AzureClientSecret]: AzureClientSecretRotationSecretsMappingFields,
  [SecretRotation.LdapPassword]: LdapPasswordRotationSecretsMappingFields,
@@ -5,17 +5,39 @@ import { AwsIamUserSecretRotationSchema } from "@app/components/secret-rotations
 import { AzureClientSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/azure-client-secret-rotation-schema";
 import { LdapPasswordRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/ldap-password-rotation-schema";
 import { MsSqlCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/mssql-credentials-rotation-schema";
+import { MySqlCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/mysql-credentials-rotation-schema";
 import { PostgresCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/postgres-credentials-rotation-schema";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { LdapPasswordRotationMethod } from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";

-const SecretRotationUnionSchema = z.discriminatedUnion("type", [
-  Auth0ClientSecretRotationSchema,
-  AzureClientSecretRotationSchema,
-  PostgresCredentialsRotationSchema,
-  MsSqlCredentialsRotationSchema,
-  LdapPasswordRotationSchema,
-  AwsIamUserSecretRotationSchema
-]);
+export const SecretRotationV2FormSchema = (isUpdate: boolean) =>
+  z
+    .intersection(
+      z.discriminatedUnion("type", [
+        Auth0ClientSecretRotationSchema,
+        AzureClientSecretRotationSchema,
+        PostgresCredentialsRotationSchema,
+        MsSqlCredentialsRotationSchema,
+        MySqlCredentialsRotationSchema,
+        LdapPasswordRotationSchema,
+        AwsIamUserSecretRotationSchema
+      ]),
+      z.object({ id: z.string().optional() })
+    )
+    .superRefine((val, ctx) => {
+      if (val.type !== SecretRotation.LdapPassword || isUpdate) return;

-export const SecretRotationV2FormSchema = SecretRotationUnionSchema;
+      // this has to go on union or breaks discrimination
+      if (
+        val.parameters.rotationMethod === LdapPasswordRotationMethod.TargetPrincipal &&
+        !val.temporaryParameters?.password
+      ) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "Password required",
+          path: ["temporaryParameters", "password"]
+        });
+      }
+    });

-export type TSecretRotationV2Form = z.infer<typeof SecretRotationV2FormSchema>;
+export type TSecretRotationV2Form = z.infer<ReturnType<typeof SecretRotationV2FormSchema>>;
@@ -2,8 +2,9 @@ import { z } from "zod";

 import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
 import { PasswordRequirementsSchema } from "@app/components/secret-rotations-v2/forms/schemas/shared";
-import { DistinguishedNameRegex } from "@app/helpers/string";
+import { DistinguishedNameRegex, UserPrincipalNameRegex } from "@app/helpers/string";
 import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { LdapPasswordRotationMethod } from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";

 export const LdapPasswordRotationSchema = z
  .object({
@@ -12,13 +13,24 @@ export const LdapPasswordRotationSchema = z
      dn: z
        .string()
        .trim()
-        .regex(DistinguishedNameRegex, "Invalid Distinguished Name format")
-        .min(1, "Distinguished Name (DN) required"),
-      passwordRequirements: PasswordRequirementsSchema.optional()
+        .min(1, "DN/UPN required")
+        .refine(
+          (value) => DistinguishedNameRegex.test(value) || UserPrincipalNameRegex.test(value),
+          {
+            message: "Invalid DN/UPN format"
+          }
+        ),
+      passwordRequirements: PasswordRequirementsSchema.optional(),
+      rotationMethod: z.nativeEnum(LdapPasswordRotationMethod).optional()
    }),
    secretsMapping: z.object({
-      dn: z.string().trim().min(1, "Distinguished Name (DN) required"),
+      dn: z.string().trim().min(1, "DN/UPN required"),
      password: z.string().trim().min(1, "Password required")
-    })
+    }),
+    temporaryParameters: z
+      .object({
+        password: z.string().min(1, "Password required")
+      })
+      .optional()
  })
  .merge(BaseSecretRotationSchema);
@@ -0,0 +1,12 @@
+import { z } from "zod";
+
+import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
+import { SqlCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/shared";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const MySqlCredentialsRotationSchema = z
+  .object({
+    type: z.literal(SecretRotation.MySqlCredentials)
+  })
+  .merge(SqlCredentialsRotationSchema)
+  .merge(BaseSecretRotationSchema);
@@ -1,5 +1,7 @@
 import { z } from "zod";

+export type TPasswordRequirements = z.infer<typeof PasswordRequirementsSchema>;
+
 export const PasswordRequirementsSchema = z
  .object({
    length: z
@@ -2,16 +2,23 @@ import { faWrench } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";

 import { Spinner, Tooltip } from "@app/components/v2";
+import { useSubscription } from "@app/context";
 import { SECRET_SYNC_MAP } from "@app/helpers/secretSyncs";
+import { usePopUp } from "@app/hooks";
 import { SecretSync, useSecretSyncOptions } from "@app/hooks/api/secretSyncs";

+import { UpgradePlanModal } from "../license/UpgradePlanModal";
+
 type Props = {
  onSelect: (destination: SecretSync) => void;
 };

 export const SecretSyncSelect = ({ onSelect }: Props) => {
+  const { subscription } = useSubscription();
  const { isPending, data: secretSyncOptions } = useSecretSyncOptions();

+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["upgradePlan"] as const);
+
  if (isPending) {
    return (
      <div className="flex h-full flex-col items-center justify-center py-2.5">
@@ -23,14 +30,17 @@ export const SecretSyncSelect = ({ onSelect }: Props) => {

  return (
    <div className="grid grid-cols-4 gap-2">
-      {secretSyncOptions?.map(({ destination }) => {
+      {secretSyncOptions?.map(({ destination, enterprise }) => {
        const { image, name } = SECRET_SYNC_MAP[destination];
        return (
          <button
            type="button"
-            key={destination}
-            onClick={() => onSelect(destination)}
-            className="group relative flex h-28 cursor-pointer flex-col items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-700 p-4 duration-200 hover:bg-mineshaft-600"
+            onClick={() =>
+              enterprise && !subscription.enterpriseSecretSyncs
+                ? handlePopUpOpen("upgradePlan")
+                : onSelect(destination)
+            }
+            className="group relative flex h-28 cursor-pointer flex-col items-center justify-center overflow-hidden rounded-md border border-mineshaft-600 bg-mineshaft-700 p-4 duration-200 hover:bg-mineshaft-600"
          >
            <img
              src={`/images/integrations/${image}`}
@@ -45,6 +55,11 @@ export const SecretSyncSelect = ({ onSelect }: Props) => {
          </button>
        );
      })}
+      <UpgradePlanModal
+        isOpen={popUp.upgradePlan.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
+        text="You can use every Secret Sync if you switch to Infisical's Enterprise plan."
+      />
      <Tooltip
        side="bottom"
        className="max-w-sm py-4"
@@ -0,0 +1,74 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import {
+  TOnePassVault,
+  useOnePassConnectionListVaults
+} from "@app/hooks/api/appConnections/1password";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const OnePassSyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.OnePass }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: vaults, isLoading: isVaultsLoading } = useOnePassConnectionListVaults(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.vaultId", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.vaultId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Vault"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the vault exists in the connection's OnePass instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the vault you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isVaultsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={vaults?.find((v) => v.id === value) ?? null}
+              onChange={(option) => onChange((option as SingleValue<TOnePassVault>)?.id ?? null)}
+              options={vaults}
+              placeholder="Select a vault..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
@@ -3,6 +3,7 @@ import { useFormContext } from "react-hook-form";
 import { SecretSync } from "@app/hooks/api/secretSyncs";

 import { TSecretSyncForm } from "../schemas";
+import { OnePassSyncFields } from "./1PasswordSyncFields";
 import { AwsParameterStoreSyncFields } from "./AwsParameterStoreSyncFields";
 import { AwsSecretsManagerSyncFields } from "./AwsSecretsManagerSyncFields";
 import { AzureAppConfigurationSyncFields } from "./AzureAppConfigurationSyncFields";
@@ -55,6 +56,8 @@ export const SecretSyncDestinationFields = () => {
      return <TeamCitySyncFields />;
    case SecretSync.OCIVault:
      return <OCIVaultSyncFields />;
+    case SecretSync.OnePass:
+      return <OnePassSyncFields />;
    default:
      throw new Error(`Unhandled Destination Config Field: ${destination}`);
  }
@@ -49,6 +49,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
    case SecretSync.Windmill:
    case SecretSync.HCVault:
    case SecretSync.TeamCity:
+    case SecretSync.OnePass:
    case SecretSync.OCIVault:
      AdditionalSyncOptionsFieldsComponent = null;
      break;
@@ -145,11 +146,15 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                      href="https://infisical.com/docs/integrations/secret-syncs/overview#key-schemas"
                      target="_blank"
                      rel="noopener noreferrer"
+                      className="underline"
                    >
                      Key Schema
                    </a>{" "}
                    to ensure that Infisical only manages the specific keys you intend, keeping
                    everything else untouched.
+                    <br />
+                    <br />
+                    Destination secrets that do not match the schema will not be deleted or updated.
                  </span>
                }
              >
@@ -0,0 +1,12 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const OnePassSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.OnePass }>();
+  const vaultId = watch("destinationConfig.vaultId");
+
+  return <GenericFieldLabel label="Vault ID">{vaultId}</GenericFieldLabel>;
+};
@@ -24,6 +24,7 @@ import { GitHubSyncReviewFields } from "./GitHubSyncReviewFields";
 import { HCVaultSyncReviewFields } from "./HCVaultSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
 import { OCIVaultSyncReviewFields } from "./OCIVaultSyncReviewFields";
+import { OnePassSyncReviewFields } from "./OnePassSyncReviewFields";
 import { TeamCitySyncReviewFields } from "./TeamCitySyncReviewFields";
 import { TerraformCloudSyncReviewFields } from "./TerraformCloudSyncReviewFields";
 import { VercelSyncReviewFields } from "./VercelSyncReviewFields";
@@ -96,6 +97,9 @@ export const SecretSyncReviewFields = () => {
    case SecretSync.OCIVault:
      DestinationFieldsComponent = <OCIVaultSyncReviewFields />;
      break;
+    case SecretSync.OnePass:
+      DestinationFieldsComponent = <OnePassSyncReviewFields />;
+      break;
    default:
      throw new Error(`Unhandled Destination Review Fields: ${destination}`);
  }
@@ -0,0 +1,13 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const OnePassSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.OnePass),
+    destinationConfig: z.object({
+      vaultId: z.string().trim().min(1, "Vault ID required")
+    })
+  })
+);
@@ -1,5 +1,6 @@
 import { z } from "zod";

+import { OnePassSyncDestinationSchema } from "./1password-sync-destination-schema";
 import { AwsParameterStoreSyncDestinationSchema } from "./aws-parameter-store-sync-destination-schema";
 import { AwsSecretsManagerSyncDestinationSchema } from "./aws-secrets-manager-sync-destination-schema";
 import { AzureAppConfigurationSyncDestinationSchema } from "./azure-app-configuration-sync-destination-schema";
@@ -31,7 +32,8 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
  WindmillSyncDestinationSchema,
  HCVaultSyncDestinationSchema,
  TeamCitySyncDestinationSchema,
-  OCIVaultSyncDestinationSchema
+  OCIVaultSyncDestinationSchema,
+  OnePassSyncDestinationSchema
 ]);

 export const SecretSyncFormSchema = SecretSyncUnionSchema;
@@ -51,6 +51,7 @@ type Props = Omit<TextareaHTMLAttributes<HTMLTextAreaElement>, "onChange" | "val
  isVisible?: boolean;
  isReadOnly?: boolean;
  isDisabled?: boolean;
+  canEditButNotView?: boolean;
  secretPath?: string;
  environment?: string;
  containerClassName?: string;
@@ -70,6 +71,7 @@ export const InfisicalSecretInput = forwardRef<HTMLTextAreaElement, Props>(
      containerClassName,
      secretPath: propSecretPath,
      environment: propEnvironment,
+      canEditButNotView,
      ...props
    },
    ref
@@ -273,6 +275,7 @@ export const InfisicalSecretInput = forwardRef<HTMLTextAreaElement, Props>(
        <Popover.Trigger asChild>
          <SecretInput
            {...props}
+            canEditButNotView={canEditButNotView}
            ref={handleRef}
            onKeyDown={handleKeyDown}
            value={value}
@@ -3,6 +3,7 @@ import { forwardRef, TextareaHTMLAttributes } from "react";
 import { twMerge } from "tailwind-merge";

 import { useToggle } from "@app/hooks";
+import { HIDDEN_SECRET_VALUE } from "@app/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem";

 const REGEX = /(\${([a-zA-Z0-9-_.]+)})/g;
 const replaceContentWithDot = (str: string) => {
@@ -51,6 +52,7 @@ type Props = TextareaHTMLAttributes<HTMLTextAreaElement> & {
  isReadOnly?: boolean;
  isDisabled?: boolean;
  containerClassName?: string;
+  canEditButNotView?: boolean;
 };

 const commonClassName = "font-mono text-sm caret-white border-none outline-none w-full break-all";
@@ -66,6 +68,7 @@ export const SecretInput = forwardRef<HTMLTextAreaElement, Props>(
      isDisabled,
      isReadOnly,
      onFocus,
+      canEditButNotView,
      ...props
    },
    ref
@@ -93,7 +96,15 @@ export const SecretInput = forwardRef<HTMLTextAreaElement, Props>(
            onFocus={(evt) => {
              onFocus?.(evt);
              setIsSecretFocused.on();
-              evt.currentTarget.select();
+              if (canEditButNotView && value === HIDDEN_SECRET_VALUE) {
+                evt.currentTarget.select();
+              }
+            }}
+            onMouseDown={(e) => {
+              if (canEditButNotView && value === HIDDEN_SECRET_VALUE) {
+                e.preventDefault();
+                e.currentTarget.select();
+              }
            }}
            disabled={isDisabled}
            spellCheck={false}
@@ -125,6 +125,7 @@ export const SelectItem = forwardRef<HTMLDivElement, SelectItemProps>(
    return (
      <SelectPrimitive.Item
        {...props}
+        disabled={isDisabled}
        className={twMerge(
          "relative mb-0.5 cursor-pointer select-none items-center overflow-hidden truncate rounded-md py-2 pl-10 pr-4 text-sm outline-none transition-all hover:bg-mineshaft-500 data-[highlighted]:bg-mineshaft-700/80",
          isSelected && "bg-primary",
@@ -280,8 +280,8 @@ export const ROUTE_PATHS = Object.freeze({
  },
  CertManager: {
    CertAuthDetailsByIDPage: setRoute(
-      "/cert-manager/$projectId/ca/$caId",
-      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/ca/$caId"
+      "/cert-manager/$projectId/ca/$caName",
+      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/ca/$caName"
    ),
    SubscribersPage: setRoute(
      "/cert-manager/$projectId/subscribers",
@@ -2,6 +2,7 @@ export { useOrgPermission } from "./OrgPermissionContext";
 export type { TOrgPermission } from "./types";
 export {
  OrgPermissionActions,
+  OrgPermissionBillingActions,
  OrgPermissionGroupActions,
  OrgPermissionIdentityActions,
  OrgPermissionSubjects
@@ -7,6 +7,11 @@ export enum OrgPermissionActions {
  Delete = "delete"
 }

+export enum OrgPermissionBillingActions {
+  Read = "read",
+  ManageBilling = "manage-billing"
+}
+
 export enum OrgGatewayPermissionActions {
  // is there a better word for this. This mean can an identity be a gateway
  CreateGateways = "create-gateways",
@@ -100,7 +105,7 @@ export type OrgPermissionSet =
  | [OrgPermissionActions, OrgPermissionSubjects.Ldap]
  | [OrgPermissionGroupActions, OrgPermissionSubjects.Groups]
  | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning]
-  | [OrgPermissionActions, OrgPermissionSubjects.Billing]
+  | [OrgPermissionBillingActions, OrgPermissionSubjects.Billing]
  | [OrgPermissionActions, OrgPermissionSubjects.Kms]
  | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]
  | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs]
@@ -10,6 +10,7 @@ export {
  ProjectPermissionKmipActions,
  ProjectPermissionMemberActions,
  ProjectPermissionPkiSubscriberActions,
+  ProjectPermissionPkiTemplateActions,
  ProjectPermissionSshHostActions,
  ProjectPermissionSub
 } from "./types";
@@ -104,6 +104,15 @@ export enum ProjectPermissionPkiSubscriberActions {
  ListCerts = "list-certs"
 }

+export enum ProjectPermissionPkiTemplateActions {
+  Read = "read",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete",
+  IssueCert = "issue-cert",
+  ListCerts = "list-certs"
+}
+
 export enum ProjectPermissionSecretRotationActions {
  Read = "read",
  ReadGeneratedCredentials = "read-generated-credentials",
@@ -261,6 +270,11 @@ export type PkiSubscriberSubjectFields = {
  name: string;
 };

+export type PkiTemplateSubjectFields = {
+  name: string;
+  // (dangtony98): consider adding [commonName] as a subject field in the future
+};
+
 export type ProjectPermissionSet =
  | [
      ProjectPermissionSecretActions,
@@ -318,7 +332,13 @@ export type ProjectPermissionSet =
    ]
  | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
  | [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
-  | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
+  | [
+      ProjectPermissionPkiTemplateActions,
+      (
+        | ProjectPermissionSub.CertificateTemplates
+        | (ForcedSubject<ProjectPermissionSub.CertificateTemplates> & PkiTemplateSubjectFields)
+      )
+    ]
  | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateAuthorities]
  | [ProjectPermissionActions, ProjectPermissionSub.SshCertificateTemplates]
  | [ProjectPermissionActions, ProjectPermissionSub.SshCertificates]
@@ -2,6 +2,7 @@ export { useOrganization } from "./OrganizationContext";
 export type { TOrgPermission } from "./OrgPermissionContext";
 export {
  OrgPermissionActions,
+  OrgPermissionBillingActions,
  OrgPermissionGroupActions,
  OrgPermissionIdentityActions,
  OrgPermissionSubjects,
@@ -18,6 +19,7 @@ export {
  ProjectPermissionKmipActions,
  ProjectPermissionMemberActions,
  ProjectPermissionPkiSubscriberActions,
+  ProjectPermissionPkiTemplateActions,
  ProjectPermissionSshHostActions,
  ProjectPermissionSub,
  useProjectPermission
@@ -25,6 +25,8 @@ import {
  HumanitecConnectionMethod,
  LdapConnectionMethod,
  MsSqlConnectionMethod,
+  MySqlConnectionMethod,
+  OnePassConnectionMethod,
  PostgresConnectionMethod,
  TAppConnection,
  TeamCityConnectionMethod,
@@ -36,7 +38,7 @@ import { OCIConnectionMethod } from "@app/hooks/api/appConnections/types/oci-con

 export const APP_CONNECTION_MAP: Record<
  AppConnection,
-  { name: string; image: string; size?: number; icon?: IconDefinition }
+  { name: string; image: string; size?: number; icon?: IconDefinition; enterprise?: boolean }
 > = {
  [AppConnection.AWS]: { name: "AWS", image: "Amazon Web Services.png" },
  [AppConnection.GitHub]: { name: "GitHub", image: "GitHub.png" },
@@ -64,13 +66,15 @@ export const APP_CONNECTION_MAP: Record<
  [AppConnection.Vercel]: { name: "Vercel", image: "Vercel.png" },
  [AppConnection.Postgres]: { name: "PostgreSQL", image: "Postgres.png" },
  [AppConnection.MsSql]: { name: "Microsoft SQL Server", image: "MsSql.png" },
+  [AppConnection.MySql]: { name: "MySQL", image: "MySql.png" },
  [AppConnection.Camunda]: { name: "Camunda", image: "Camunda.png" },
  [AppConnection.Windmill]: { name: "Windmill", image: "Windmill.png" },
  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 },
  [AppConnection.HCVault]: { name: "Hashicorp Vault", image: "Vault.png", size: 65 },
  [AppConnection.LDAP]: { name: "LDAP", image: "LDAP.png", size: 65 },
  [AppConnection.TeamCity]: { name: "TeamCity", image: "TeamCity.png" },
-  [AppConnection.OCI]: { name: "OCI", image: "Oracle.png" }
+  [AppConnection.OCI]: { name: "OCI", image: "Oracle.png", enterprise: true },
+  [AppConnection.OnePass]: { name: "1Password", image: "1Password.png" }
 };

 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
@@ -98,9 +102,11 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
    case HumanitecConnectionMethod.ApiToken:
    case TerraformCloudConnectionMethod.ApiToken:
    case VercelConnectionMethod.ApiToken:
+    case OnePassConnectionMethod.ApiToken:
      return { name: "API Token", icon: faKey };
    case PostgresConnectionMethod.UsernameAndPassword:
    case MsSqlConnectionMethod.UsernameAndPassword:
+    case MySqlConnectionMethod.UsernameAndPassword:
      return { name: "Username & Password", icon: faLock };
    case HCVaultConnectionMethod.AccessToken:
    case TeamCityConnectionMethod.AccessToken:
@@ -15,6 +15,11 @@ export const SECRET_ROTATION_MAP: Record<
    image: "MsSql.png",
    size: 50
  },
+  [SecretRotation.MySqlCredentials]: {
+    name: "MySQL Credentials",
+    image: "MySql.png",
+    size: 50
+  },
  [SecretRotation.Auth0ClientSecret]: {
    name: "Auth0 Client Secret",
    image: "Auth0.png",
@@ -40,6 +45,7 @@ export const SECRET_ROTATION_MAP: Record<
 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
  [SecretRotation.PostgresCredentials]: AppConnection.Postgres,
  [SecretRotation.MsSqlCredentials]: AppConnection.MsSql,
+  [SecretRotation.MySqlCredentials]: AppConnection.MySql,
  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0,
  [SecretRotation.AzureClientSecret]: AppConnection.AzureClientSecrets,
  [SecretRotation.LdapPassword]: AppConnection.LDAP,
@@ -50,6 +56,7 @@ export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnectio
 export const IS_ROTATION_DUAL_CREDENTIALS: Record<SecretRotation, boolean> = {
  [SecretRotation.PostgresCredentials]: true,
  [SecretRotation.MsSqlCredentials]: true,
+  [SecretRotation.MySqlCredentials]: true,
  [SecretRotation.Auth0ClientSecret]: false,
  [SecretRotation.AzureClientSecret]: true,
  [SecretRotation.LdapPassword]: false,
@@ -51,6 +51,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
  [SecretSync.OCIVault]: {
    name: "OCI Vault",
    image: "Oracle.png"
+  },
+  [SecretSync.OnePass]: {
+    name: "1Password",
+    image: "1Password.png"
  }
 };

@@ -69,7 +73,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
  [SecretSync.Windmill]: AppConnection.Windmill,
  [SecretSync.HCVault]: AppConnection.HCVault,
  [SecretSync.TeamCity]: AppConnection.TeamCity,
-  [SecretSync.OCIVault]: AppConnection.OCI
+  [SecretSync.OCIVault]: AppConnection.OCI,
+  [SecretSync.OnePass]: AppConnection.OnePass
 };

 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<
@@ -15,3 +15,5 @@ export const isValidPath = (val: string): boolean => {

 export const DistinguishedNameRegex =
  /^(?:(?:[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)(?:(?:\\+[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)*)(?:,(?:[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)(?:(?:\\+[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)*))*)?$/;
+
+export const UserPrincipalNameRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
@@ -0,0 +1,73 @@
+const TABLE_PREFERENCES_KEY = "userTablePreferences";
+
+export enum PreferenceKey {
+  PerPage = "perPage"
+}
+
+interface TableSpecificPreferences {
+  [preferenceKey: string]: any;
+}
+
+interface UserTablePreferences {
+  [tableName: string]: TableSpecificPreferences;
+}
+
+// Retrieves all table preferences from localStorage
+const getAllTablePreferences = (): UserTablePreferences => {
+  try {
+    const preferencesString = localStorage.getItem(TABLE_PREFERENCES_KEY);
+    if (preferencesString) {
+      return JSON.parse(preferencesString) as UserTablePreferences;
+    }
+  } catch (error) {
+    console.error("Error reading user table preferences from localStorage:", error);
+  }
+  return {};
+};
+
+// Saves all table preferences to localStorage
+const saveAllTablePreferences = (preferences: UserTablePreferences): void => {
+  try {
+    localStorage.setItem(TABLE_PREFERENCES_KEY, JSON.stringify(preferences));
+  } catch (error) {
+    console.error("Error saving user table preferences to localStorage:", error);
+  }
+};
+
+// Retrieves a specific preference for a given table
+export const getUserTablePreference = <T>(
+  tableName: string,
+  preferenceKey: PreferenceKey,
+  defaultValue: T
+): T => {
+  const preferences = getAllTablePreferences();
+  if (
+    preferences &&
+    typeof preferences === "object" &&
+    tableName in preferences &&
+    preferenceKey in preferences[tableName]
+  ) {
+    const value = preferences[tableName][preferenceKey];
+
+    if (value !== undefined && value !== null) {
+      return value as T;
+    }
+  }
+  return defaultValue;
+};
+
+// Sets a specific preference for a given table and saves it to localStorage
+export const setUserTablePreference = (
+  tableName: string,
+  preferenceKey: PreferenceKey,
+  value: any
+): void => {
+  const preferences = getAllTablePreferences();
+
+  if (!preferences[tableName]) {
+    preferences[tableName] = {};
+  }
+
+  preferences[tableName][preferenceKey] = value;
+  saveAllTablePreferences(preferences);
+};
@@ -21,6 +21,7 @@ export const useCreateAccessApprovalPolicy = () => {
      projectSlug,
      approvals,
      approvers,
+      bypassers,
      name,
      secretPath,
      enforcementLevel,
@@ -30,6 +31,7 @@ export const useCreateAccessApprovalPolicy = () => {
        environment,
        projectSlug,
        approvals,
+        bypassers,
        approvers,
        secretPath,
        name,
@@ -53,6 +55,7 @@ export const useUpdateAccessApprovalPolicy = () => {
    mutationFn: async ({
      id,
      approvers,
+      bypassers,
      approvals,
      name,
      secretPath,
@@ -62,6 +65,7 @@ export const useUpdateAccessApprovalPolicy = () => {
      const { data } = await apiRequest.patch(`/api/v1/access-approvals/policies/${id}`, {
        approvals,
        approvers,
+        bypassers,
        secretPath,
        name,
        enforcementLevel,
@@ -131,20 +135,27 @@ export const useReviewAccessRequest = () => {
      projectSlug: string;
      envSlug?: string;
      requestedBy?: string;
+      bypassReason?: string;
    }
  >({
-    mutationFn: async ({ requestId, status }) => {
+    mutationFn: async ({ requestId, status, bypassReason }) => {
      const { data } = await apiRequest.post(
        `/api/v1/access-approvals/requests/${requestId}/review`,
        {
-          status
+          status,
+          bypassReason
        }
      );
      return data;
    },
-    onSuccess: (_, { projectSlug, envSlug, requestedBy }) => {
+    onSuccess: (_, { projectSlug, envSlug, requestedBy, bypassReason }) => {
      queryClient.invalidateQueries({
-        queryKey: accessApprovalKeys.getAccessApprovalRequests(projectSlug, envSlug, requestedBy)
+        queryKey: accessApprovalKeys.getAccessApprovalRequests(
+          projectSlug,
+          envSlug,
+          requestedBy,
+          bypassReason
+        )
      });
      queryClient.invalidateQueries({
        queryKey: accessApprovalKeys.getAccessApprovalRequestCount(projectSlug)
@@ -19,8 +19,12 @@ export const accessApprovalKeys = {
  getAccessApprovalPolicyOfABoard: (workspaceId: string, environment: string) =>
    [{ workspaceId, environment }, "access-approval-policy"] as const,

-  getAccessApprovalRequests: (projectSlug: string, envSlug?: string, requestedBy?: string) =>
-    [{ projectSlug, envSlug, requestedBy }, "access-approvals-requests"] as const,
+  getAccessApprovalRequests: (
+    projectSlug: string,
+    envSlug?: string,
+    requestedBy?: string,
+    bypassReason?: string
+  ) => [{ projectSlug, envSlug, requestedBy, bypassReason }, "access-approvals-requests"] as const,
  getAccessApprovalRequestCount: (projectSlug: string) =>
    [{ projectSlug }, "access-approval-request-count"] as const
 };
@@ -16,6 +16,7 @@ export type TAccessApprovalPolicy = {
  enforcementLevel: EnforcementLevel;
  updatedAt: Date;
  approvers?: Approver[];
+  bypassers?: Bypasser[];
  allowedSelfApprovals: boolean;
 };

@@ -24,11 +25,21 @@ export enum ApproverType {
  Group = "group"
 }

+export enum BypasserType {
+  User = "user",
+  Group = "group"
+}
+
 export type Approver = {
  id: string;
  type: ApproverType;
 };

+export type Bypasser = {
+  id: string;
+  type: BypasserType;
+};
+
 export type TAccessApprovalRequest = {
  id: string;
  policyId: string;
@@ -68,6 +79,7 @@ export type TAccessApprovalRequest = {
    name: string;
    approvals: number;
    approvers: string[];
+    bypassers: string[];
    secretPath?: string | null;
    envId: string;
    enforcementLevel: EnforcementLevel;
@@ -146,6 +158,7 @@ export type TCreateAccessPolicyDTO = {
  name?: string;
  environment: string;
  approvers?: Approver[];
+  bypassers?: Bypasser[];
  approvals?: number;
  secretPath?: string;
  enforcementLevel?: EnforcementLevel;
@@ -156,6 +169,7 @@ export type TUpdateAccessPolicyDTO = {
  id: string;
  name?: string;
  approvers?: Approver[];
+  bypassers?: Bypasser[];
  secretPath?: string;
  environment?: string;
  approvals?: number;
@@ -1,16 +1,2 @@
-export {
-  useAdminDeleteUser,
-  useAdminGrantServerAdminAccess,
-  useAdminRemoveIdentitySuperAdminAccess,
-  useCreateAdminUser,
-  useInvalidateCache,
-  useRemoveUserServerAdminAccess,
-  useUpdateServerConfig,
-  useUpdateServerEncryptionStrategy
-} from "./mutation";
-export {
-  useAdminGetUsers,
-  useGetAdminIntegrationsConfig,
-  useGetServerConfig,
-  useGetServerRootKmsEncryptionDetails
-} from "./queries";
+export * from "./mutation";
+export * from "./queries";
@@ -63,6 +63,41 @@ export const useAdminDeleteUser = () => {
      queryClient.invalidateQueries({
        queryKey: [adminStandaloneKeys.getUsers]
      });
+      queryClient.invalidateQueries({ queryKey: adminStandaloneKeys.getOrganizations });
+    }
+  });
+};
+
+export const useAdminDeleteOrganizationMembership = () => {
+  const queryClient = useQueryClient();
+  return useMutation<object, object, { organizationId: string; membershipId: string }>({
+    mutationFn: async ({ organizationId, membershipId }) => {
+      await apiRequest.delete(
+        `/api/v1/admin/organization-management/organizations/${organizationId}/memberships/${membershipId}`
+      );
+
+      return {};
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: [adminStandaloneKeys.getOrganizations]
+      });
+    }
+  });
+};
+
+export const useAdminDeleteOrganization = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (organizationId: string) => {
+      await apiRequest.delete(
+        `/api/v1/admin/organization-management/organizations/${organizationId}`
+      );
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: [adminStandaloneKeys.getOrganizations]
+      });
    }
  });
 };
@@ -6,8 +6,10 @@ import { Identity } from "@app/hooks/api/identities/types";
 import { User } from "../types";
 import {
  AdminGetIdentitiesFilters,
+  AdminGetOrganizationsFilters,
  AdminGetUsersFilters,
  AdminIntegrationsConfig,
+  OrganizationWithProjects,
  TGetInvalidatingCacheStatus,
  TGetServerRootKmsEncryptionDetails,
  TServerConfig
@@ -15,12 +17,15 @@ import {

 export const adminStandaloneKeys = {
  getUsers: "get-users",
+  getOrganizations: "get-organizations",
  getIdentities: "get-identities"
 };

 export const adminQueryKeys = {
  serverConfig: () => ["server-config"] as const,
  getUsers: (filters: AdminGetUsersFilters) => [adminStandaloneKeys.getUsers, { filters }] as const,
+  getOrganizations: (filters: AdminGetOrganizationsFilters) =>
+    [adminStandaloneKeys.getOrganizations, { filters }] as const,
  getIdentities: (filters: AdminGetIdentitiesFilters) =>
    [adminStandaloneKeys.getIdentities, { filters }] as const,
  getAdminSlackConfig: () => ["admin-slack-config"] as const,
@@ -34,6 +39,28 @@ export const fetchServerConfig = async () => {
  return data.config;
 };

+export const useAdminGetOrganizations = (filters: AdminGetOrganizationsFilters) => {
+  return useInfiniteQuery({
+    initialPageParam: 0,
+    queryKey: adminQueryKeys.getOrganizations(filters),
+    queryFn: async ({ pageParam }) => {
+      const { data } = await apiRequest.get<{ organizations: OrganizationWithProjects[] }>(
+        "/api/v1/admin/organization-management/organizations",
+        {
+          params: {
+            ...filters,
+            offset: pageParam
+          }
+        }
+      );
+
+      return data.organizations;
+    },
+    getNextPageParam: (lastPage, pages) =>
+      lastPage.length !== 0 ? pages.length * filters.limit : undefined
+  });
+};
+
 export const useGetServerConfig = ({
  options = {}
 }: {
@@ -1,3 +1,5 @@
+import { Organization } from "../types";
+
 export enum LoginMethod {
  EMAIL = "email",
  GOOGLE = "google",
@@ -8,6 +10,27 @@ export enum LoginMethod {
  OIDC = "oidc"
 }

+export type OrganizationWithProjects = Organization & {
+  members: {
+    user: {
+      id: string;
+      email: string | null;
+      username: string;
+      firstName: string | null;
+      lastName: string | null;
+    };
+    membershipId: string;
+    role: string;
+    roleId: string | null;
+  }[];
+  projects: {
+    name: string;
+    id: string;
+    slug: string;
+    createdAt: string;
+  }[];
+};
+
 export type TServerConfig = {
  initialized: boolean;
  allowSignUp: boolean;
@@ -51,6 +74,11 @@ export type TCreateAdminUserDTO = {
  salt: string;
 };

+export type AdminGetOrganizationsFilters = {
+  limit: number;
+  searchTerm: string;
+};
+
 export type AdminGetUsersFilters = {
  limit: number;
  searchTerm: string;
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TOnePassVault } from "./types";
+
+const onePassConnectionKeys = {
+  all: [...appConnectionKeys.all, "1password"] as const,
+  listVaults: (connectionId: string) =>
+    [...onePassConnectionKeys.all, "vaults", connectionId] as const
+};
+
+export const useOnePassConnectionListVaults = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TOnePassVault[],
+      unknown,
+      TOnePassVault[],
+      ReturnType<typeof onePassConnectionKeys.listVaults>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: onePassConnectionKeys.listVaults(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TOnePassVault[]>(
+        `/api/v1/app-connections/1password/${connectionId}/vaults`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
@@ -0,0 +1,12 @@
+export type TOnePassVault = {
+  id: string;
+  name: string;
+  type: string;
+  items: number;
+
+  attributeVersion: number;
+  contentVersion: number;
+
+  createdAt: string;
+  updatedAt: string;
+};
@@ -12,11 +12,13 @@ export enum AppConnection {
  Vercel = "vercel",
  Postgres = "postgres",
  MsSql = "mssql",
+  MySql = "mysql",
  Camunda = "camunda",
  Windmill = "windmill",
  Auth0 = "auth0",
  HCVault = "hashicorp-vault",
  LDAP = "ldap",
  TeamCity = "teamcity",
-  OCI = "oci"
+  OCI = "oci",
+  OnePass = "1password"
 }
@@ -0,0 +1,14 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum OnePassConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TOnePassConnection = TRootAppConnection & { app: AppConnection.OnePass } & {
+  method: OnePassConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+    instanceUrl: string;
+  };
+};
@@ -65,6 +65,10 @@ export type TMsSqlConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.MsSql;
 };

+export type TMySqlConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.MySql;
+};
+
 export type TCamundaConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Camunda;
 };
@@ -93,6 +97,10 @@ export type TOCIConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.OCI;
 };

+export type TOnePassConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.OnePass;
+};
+
 export type TAppConnectionOption =
  | TAwsConnectionOption
  | TGitHubConnectionOption
@@ -106,12 +114,14 @@ export type TAppConnectionOption =
  | TVercelConnectionOption
  | TPostgresConnectionOption
  | TMsSqlConnectionOption
+  | TMySqlConnectionOption
  | TCamundaConnectionOption
  | TWindmillConnectionOption
  | TAuth0ConnectionOption
  | THCVaultConnectionOption
  | TTeamCityConnectionOption
-  | TOCIConnectionOption;
+  | TOCIConnectionOption
+  | TOnePassConnectionOption;

 export type TAppConnectionOptionMap = {
  [AppConnection.AWS]: TAwsConnectionOption;
@@ -127,6 +137,7 @@ export type TAppConnectionOptionMap = {
  [AppConnection.Vercel]: TVercelConnectionOption;
  [AppConnection.Postgres]: TPostgresConnectionOption;
  [AppConnection.MsSql]: TMsSqlConnectionOption;
+  [AppConnection.MySql]: TMySqlConnectionOption;
  [AppConnection.Camunda]: TCamundaConnectionOption;
  [AppConnection.Windmill]: TWindmillConnectionOption;
  [AppConnection.Auth0]: TAuth0ConnectionOption;
@@ -134,4 +145,5 @@ export type TAppConnectionOptionMap = {
  [AppConnection.LDAP]: TLdapConnectionOption;
  [AppConnection.TeamCity]: TTeamCityConnectionOption;
  [AppConnection.OCI]: TOCIConnectionOption;
+  [AppConnection.OnePass]: TOnePassConnectionOption;
 };
@@ -1,4 +1,5 @@
 import { AppConnection } from "../enums";
+import { TOnePassConnection } from "./1password-connection";
 import { TAppConnectionOption } from "./app-options";
 import { TAuth0Connection } from "./auth0-connection";
 import { TAwsConnection } from "./aws-connection";
@@ -14,6 +15,7 @@ import { THCVaultConnection } from "./hc-vault-connection";
 import { THumanitecConnection } from "./humanitec-connection";
 import { TLdapConnection } from "./ldap-connection";
 import { TMsSqlConnection } from "./mssql-connection";
+import { TMySqlConnection } from "./mysql-connection";
 import { TOCIConnection } from "./oci-connection";
 import { TPostgresConnection } from "./postgres-connection";
 import { TTeamCityConnection } from "./teamcity-connection";
@@ -21,6 +23,7 @@ import { TTerraformCloudConnection } from "./terraform-cloud-connection";
 import { TVercelConnection } from "./vercel-connection";
 import { TWindmillConnection } from "./windmill-connection";

+export * from "./1password-connection";
 export * from "./auth0-connection";
 export * from "./aws-connection";
 export * from "./azure-app-configuration-connection";
@@ -35,6 +38,7 @@ export * from "./hc-vault-connection";
 export * from "./humanitec-connection";
 export * from "./ldap-connection";
 export * from "./mssql-connection";
+export * from "./mysql-connection";
 export * from "./oci-connection";
 export * from "./postgres-connection";
 export * from "./teamcity-connection";
@@ -56,13 +60,15 @@ export type TAppConnection =
  | TVercelConnection
  | TPostgresConnection
  | TMsSqlConnection
+  | TMySqlConnection
  | TCamundaConnection
  | TWindmillConnection
  | TAuth0Connection
  | THCVaultConnection
  | TLdapConnection
  | TTeamCityConnection
-  | TOCIConnection;
+  | TOCIConnection
+  | TOnePassConnection;

 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;

@@ -103,6 +109,7 @@ export type TAppConnectionMap = {
  [AppConnection.Vercel]: TVercelConnection;
  [AppConnection.Postgres]: TPostgresConnection;
  [AppConnection.MsSql]: TMsSqlConnection;
+  [AppConnection.MySql]: TMySqlConnection;
  [AppConnection.Camunda]: TCamundaConnection;
  [AppConnection.Windmill]: TWindmillConnection;
  [AppConnection.Auth0]: TAuth0Connection;
@@ -110,4 +117,5 @@ export type TAppConnectionMap = {
  [AppConnection.LDAP]: TLdapConnection;
  [AppConnection.TeamCity]: TTeamCityConnection;
  [AppConnection.OCI]: TOCIConnection;
+  [AppConnection.OnePass]: TOnePassConnection;
 };
@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+import { TBaseSqlConnectionCredentials } from "./shared";
+
+export enum MySqlConnectionMethod {
+  UsernameAndPassword = "username-and-password"
+}
+
+export type TMySqlConnection = TRootAppConnection & { app: AppConnection.MySql } & {
+  method: MySqlConnectionMethod.UsernameAndPassword;
+  credentials: TBaseSqlConnectionCredentials;
+};
@@ -68,6 +68,7 @@ export const eventToNameMap: { [K in EventType]: string } = {
  [EventType.IMPORT_CA_CERT]: "Import CA certificate",
  [EventType.GET_CA_CRL]: "Get CA CRL",
  [EventType.ISSUE_CERT]: "Issue certificate",
+  [EventType.IMPORT_CERT]: "Import certificate",
  [EventType.GET_CERT]: "Get certificate",
  [EventType.DELETE_CERT]: "Delete certificate",
  [EventType.REVOKE_CERT]: "Revoke certificate",
@@ -123,7 +124,6 @@ export const eventToNameMap: { [K in EventType]: string } = {
  [EventType.CREATE_PROJECT_TEMPLATE]: "Create project template",
  [EventType.UPDATE_PROJECT_TEMPLATE]: "Update project template",
  [EventType.DELETE_PROJECT_TEMPLATE]: "Delete project template",
-  [EventType.APPLY_PROJECT_TEMPLATE]: "Apply project template",
  [EventType.GET_APP_CONNECTIONS]: "List App Connections",
  [EventType.GET_AVAILABLE_APP_CONNECTIONS_DETAILS]: "List App Connections Details",
  [EventType.GET_APP_CONNECTION]: "Get App Connection",
@@ -203,7 +203,21 @@ export const eventToNameMap: { [K in EventType]: string } = {
  [EventType.SECRET_SCANNING_FINDING_LIST]: "List Secret Scanning Findings",
  [EventType.SECRET_SCANNING_FINDING_UPDATE]: "Update Secret Scanning Finding Status",
  [EventType.SECRET_SCANNING_CONFIG_GET]: "Get Secret Scanning Configuration",
-  [EventType.SECRET_SCANNING_CONFIG_UPDATE]: "Update Secret Scanning Configuration"
+  [EventType.SECRET_SCANNING_CONFIG_UPDATE]: "Update Secret Scanning Configuration",
+
+  [EventType.CREATE_PKI_SUBSCRIBER]: "Create PKI subscriber",
+  [EventType.UPDATE_PKI_SUBSCRIBER]: "Update PKI subscriber",
+  [EventType.DELETE_PKI_SUBSCRIBER]: "Delete PKI subscriber",
+  [EventType.GET_PKI_SUBSCRIBER]: "Get PKI subscriber",
+  [EventType.ISSUE_PKI_SUBSCRIBER_CERT]: "Issue PKI subscriber certificate",
+  [EventType.SIGN_PKI_SUBSCRIBER_CERT]: "Sign PKI subscriber certificate",
+  [EventType.AUTOMATED_RENEW_SUBSCRIBER_CERT]: "Automated renew PKI subscriber certificate",
+  [EventType.LIST_PKI_SUBSCRIBER_CERTS]: "List PKI subscriber certificates",
+
+  [EventType.UPDATE_ORG]: "Update Organization",
+  [EventType.CREATE_PROJECT]: "Create Project",
+  [EventType.UPDATE_PROJECT]: "Update Project",
+  [EventType.DELETE_PROJECT]: "Delete Project"
 };

 export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = {
@@ -81,6 +81,7 @@ export enum EventType {
  IMPORT_CA_CERT = "import-certificate-authority-cert",
  GET_CA_CRL = "get-certificate-authority-crl",
  ISSUE_CERT = "issue-cert",
+  IMPORT_CERT = "import-cert",
  GET_CERT = "get-cert",
  DELETE_CERT = "delete-cert",
  REVOKE_CERT = "revoke-cert",
@@ -131,7 +132,6 @@ export enum EventType {
  CREATE_PROJECT_TEMPLATE = "create-project-template",
  UPDATE_PROJECT_TEMPLATE = "update-project-template",
  DELETE_PROJECT_TEMPLATE = "delete-project-template",
-  APPLY_PROJECT_TEMPLATE = "apply-project-template",
  GET_APP_CONNECTIONS = "get-app-connections",
  GET_AVAILABLE_APP_CONNECTIONS_DETAILS = "get-available-app-connections-details",
  GET_APP_CONNECTION = "get-app-connection",
@@ -197,5 +197,19 @@ export enum EventType {
  SECRET_SCANNING_FINDING_LIST = "secret-scanning-finding-list",
  SECRET_SCANNING_FINDING_UPDATE = "secret-scanning-finding-update",
  SECRET_SCANNING_CONFIG_GET = "secret-scanning-config-get",
-  SECRET_SCANNING_CONFIG_UPDATE = "secret-scanning-config-update"
+  SECRET_SCANNING_CONFIG_UPDATE = "secret-scanning-config-update",
+
+  CREATE_PKI_SUBSCRIBER = "create-pki-subscriber",
+  UPDATE_PKI_SUBSCRIBER = "update-pki-subscriber",
+  DELETE_PKI_SUBSCRIBER = "delete-pki-subscriber",
+  GET_PKI_SUBSCRIBER = "get-pki-subscriber",
+  ISSUE_PKI_SUBSCRIBER_CERT = "issue-pki-subscriber-cert",
+  SIGN_PKI_SUBSCRIBER_CERT = "sign-pki-subscriber-cert",
+  AUTOMATED_RENEW_SUBSCRIBER_CERT = "automated-renew-subscriber-cert",
+  LIST_PKI_SUBSCRIBER_CERTS = "list-pki-subscriber-certs",
+  UPDATE_ORG = "update-org",
+
+  CREATE_PROJECT = "create-project",
+  UPDATE_PROJECT = "update-project",
+  DELETE_PROJECT = "delete-project"
 }
@@ -505,7 +505,8 @@ interface CreateCa {
  type: EventType.CREATE_CA;
  metadata: {
    caId: string;
-    dn: string;
+    name: string;
+    dn?: string;
  };
 }

@@ -514,12 +515,14 @@ interface GetCa {
  metadata: {
    caId: string;
    dn: string;
+    name: string;
  };
 }

 interface UpdateCa {
  type: EventType.UPDATE_CA;
  metadata: {
+    name: string;
    caId: string;
    dn: string;
    status: CaStatus;
@@ -530,6 +533,7 @@ interface DeleteCa {
  type: EventType.DELETE_CA;
  metadata: {
    caId: string;
+    name: string;
    dn: string;
  };
 }
@@ -583,6 +587,14 @@ interface IssueCert {
    serialNumber: string;
  };
 }
+interface ImportCert {
+  type: EventType.IMPORT_CERT;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}

 interface GetCert {
  type: EventType.GET_CERT;
@@ -895,6 +907,7 @@ export type Event =
  | ImportCaCert
  | GetCaCrl
  | IssueCert
+  | ImportCert
  | GetCert
  | DeleteCert
  | RevokeCert
@@ -1,10 +1,10 @@
 import { SshCaStatus } from "../sshCa";
 import { SshCertTemplateStatus } from "../sshCertificateTemplates";
-import { CaStatus, CaType } from "./enums";
+import { CaStatus, InternalCaType } from "./enums";

-export const caTypeToNameMap: { [K in CaType]: string } = {
-  [CaType.ROOT]: "Root",
-  [CaType.INTERMEDIATE]: "Intermediate"
+export const caTypeToNameMap: { [K in InternalCaType]: string } = {
+  [InternalCaType.ROOT]: "Root",
+  [InternalCaType.INTERMEDIATE]: "Intermediate"
 };

 export const caStatusToNameMap: { [K in CaStatus]: string } = {
@@ -1,4 +1,9 @@
 export enum CaType {
+  INTERNAL = "internal",
+  ACME = "acme"
+}
+
+export enum InternalCaType {
  ROOT = "root",
  INTERMEDIATE = "intermediate"
 }
@@ -12,3 +17,7 @@ export enum CaStatus {
 export enum CaRenewalType {
  EXISTING = "existing"
 }
+
+export enum AcmeDnsProvider {
+  ROUTE53 = "route53"
+}
@@ -1,4 +1,4 @@
-export { CaRenewalType, CaStatus, CaType } from "./enums";
+export { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
 export {
  useCreateCa,
  useCreateCertificate,
@@ -9,10 +9,13 @@ export {
  useUpdateCa
 } from "./mutations";
 export {
+  useGetCa,
  useGetCaById,
  useGetCaCert,
  useGetCaCerts,
  useGetCaCertTemplates,
  useGetCaCrls,
-  useGetCaCsr
+  useGetCaCsr,
+  useListCasByProjectId,
+  useListCasByTypeAndProjectId
 } from "./queries";
@@ -3,64 +3,82 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";

 import { workspaceKeys } from "../workspace";
+import { CaType } from "./enums";
 import { caKeys } from "./queries";
 import {
-  TCertificateAuthority,
-  TCreateCaDTO,
+  TCreateCertificateAuthorityDTO,
  TCreateCertificateDTO,
  TCreateCertificateResponse,
-  TDeleteCaDTO,
+  TDeleteCertificateAuthorityDTO,
  TImportCaCertificateDTO,
  TImportCaCertificateResponse,
  TRenewCaDTO,
  TRenewCaResponse,
  TSignIntermediateDTO,
  TSignIntermediateResponse,
-  TUpdateCaDTO
+  TUnifiedCertificateAuthority,
+  TUpdateCertificateAuthorityDTO
 } from "./types";

-export const useCreateCa = () => {
+export const useUpdateCa = () => {
  const queryClient = useQueryClient();
-  return useMutation<TCertificateAuthority, object, TCreateCaDTO>({
-    mutationFn: async (body) => {
-      const {
-        data: { ca }
-      } = await apiRequest.post<{ ca: TCertificateAuthority }>("/api/v1/pki/ca/", body);
-      return ca;
+  return useMutation<TUnifiedCertificateAuthority, object, TUpdateCertificateAuthorityDTO>({
+    mutationFn: async ({ caName, ...body }) => {
+      const { data } = await apiRequest.patch<TUnifiedCertificateAuthority>(
+        `/api/v1/pki/ca/${body.type}/${caName}`,
+        body
+      );
+
+      return data;
    },
-    onSuccess: (_, { projectSlug }) => {
-      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceCas({ projectSlug }) });
+    onSuccess: ({ projectId, type }, { caName }) => {
+      caKeys.getCaByNameAndProjectId(caName, projectId);
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
+      });
+      queryClient.invalidateQueries({
+        queryKey: caKeys.getCaByNameAndProjectId(caName, projectId)
+      });
    }
  });
 };

-export const useUpdateCa = () => {
+export const useCreateCa = () => {
  const queryClient = useQueryClient();
-  return useMutation<TCertificateAuthority, object, TUpdateCaDTO>({
-    mutationFn: async ({ caId, projectSlug, ...body }) => {
-      const {
-        data: { ca }
-      } = await apiRequest.patch<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`, body);
-      return ca;
+  return useMutation<TUnifiedCertificateAuthority, object, TCreateCertificateAuthorityDTO>({
+    mutationFn: async (body) => {
+      const { data } = await apiRequest.post<TUnifiedCertificateAuthority>(
+        `/api/v1/pki/ca/${body.type}`,
+        body
+      );
+      return data;
    },
-    onSuccess: ({ id }, { projectSlug }) => {
-      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceCas({ projectSlug }) });
-      queryClient.invalidateQueries({ queryKey: caKeys.getCaById(id) });
+    onSuccess: (_, { type, projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
+      });
    }
  });
 };

 export const useDeleteCa = () => {
  const queryClient = useQueryClient();
-  return useMutation<TCertificateAuthority, object, TDeleteCaDTO>({
-    mutationFn: async ({ caId }) => {
-      const {
-        data: { ca }
-      } = await apiRequest.delete<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`);
-      return ca;
+  return useMutation<TUnifiedCertificateAuthority, object, TDeleteCertificateAuthorityDTO>({
+    mutationFn: async ({ caName, type, projectId }) => {
+      const { data } = await apiRequest.delete<TUnifiedCertificateAuthority>(
+        `/api/v1/pki/ca/${type}/${caName}`,
+        {
+          data: {
+            projectId
+          }
+        }
+      );
+      return data;
    },
-    onSuccess: (_, { projectSlug }) => {
-      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceCas({ projectSlug }) });
+    onSuccess: (_, { type, projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
+      });
    }
  });
 };
@@ -78,7 +96,7 @@ export const useSignIntermediate = () => {
  });
 };

-export const useImportCaCertificate = () => {
+export const useImportCaCertificate = (projectId: string) => {
  const queryClient = useQueryClient();
  return useMutation<TImportCaCertificateResponse, object, TImportCaCertificateDTO>({
    mutationFn: async ({ caId, ...body }) => {
@@ -92,6 +110,9 @@ export const useImportCaCertificate = () => {
      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceCas({ projectSlug }) });
      queryClient.invalidateQueries({ queryKey: caKeys.getCaCerts(caId) });
      queryClient.invalidateQueries({ queryKey: caKeys.getCaCert(caId) });
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listCasByTypeAndProjectId(CaType.INTERNAL, projectId)
+      });
    }
  });
 };
@@ -3,10 +3,14 @@ import { useQuery } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";

 import { TCertificateTemplate } from "../certificateTemplates/types";
-import { TCertificateAuthority } from "./types";
+import { CaType } from "./enums";
+import { TCertificateAuthority, TUnifiedCertificateAuthority } from "./types";

 export const caKeys = {
  getCaById: (caId: string) => [{ caId }, "ca"],
+  getCaByNameAndProjectId: (caName: string, projectId: string) => [{ caName, projectId }, "ca"],
+  listCasByTypeAndProjectId: (type: CaType, projectId: string) => [{ type, projectId }, "cas"],
+  listCasByProjectId: (projectId: string) => [{ projectId }, "cas"],
  getCaCerts: (caId: string) => [{ caId }, "ca-cert"],
  getCaCrls: (caId: string) => [{ caId }, "ca-crls"],
  getCaCert: (caId: string) => [{ caId }, "ca-cert"],
@@ -16,6 +20,53 @@ export const caKeys = {
  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"]
 };

+export const useGetCa = ({
+  caName,
+  projectId,
+  type
+}: {
+  caName: string;
+  projectId: string;
+  type: CaType;
+}) => {
+  return useQuery({
+    queryKey: caKeys.getCaByNameAndProjectId(caName, projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TUnifiedCertificateAuthority>(
+        `/api/v1/pki/ca/${type}/${caName}?projectId=${projectId}`
+      );
+      return data;
+    },
+    enabled: Boolean(caName && projectId && type)
+  });
+};
+
+export const useListCasByTypeAndProjectId = (type: CaType, projectId: string) => {
+  return useQuery({
+    queryKey: caKeys.listCasByTypeAndProjectId(type, projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TUnifiedCertificateAuthority[]>(
+        `/api/v1/pki/ca/${type}?projectId=${projectId}`
+      );
+
+      return data;
+    }
+  });
+};
+
+export const useListCasByProjectId = (projectId: string) => {
+  return useQuery({
+    queryKey: caKeys.listCasByProjectId(projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        certificateAuthorities: TUnifiedCertificateAuthority[];
+      }>(`/api/v2/pki/ca?projectId=${projectId}`);
+
+      return data.certificateAuthorities;
+    }
+  });
+};
+
 export const useGetCaById = (caId: string) => {
  return useQuery({
    queryKey: caKeys.getCaById(caId),
@@ -1,11 +1,73 @@
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "../certificates/enums";
-import { CaRenewalType, CaStatus, CaType } from "./enums";
+import { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
+
+export type TAcmeCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.ACME;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    dnsAppConnectionId: string;
+    dnsProviderConfig: {
+      provider: AcmeDnsProvider.ROUTE53;
+      hostedZoneId: string;
+    };
+    directoryUrl: string;
+    accountEmail: string;
+  };
+};
+
+export type TInternalCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.INTERNAL;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    type: InternalCaType;
+    friendlyName?: string;
+    commonName: string;
+    organization: string;
+    ou: string;
+    country: string;
+    province: string;
+    locality: string;
+    maxPathLength: number;
+    keyAlgorithm: CertKeyAlgorithm;
+    notAfter?: string;
+    notBefore?: string;
+    dn?: string;
+    parentCaId?: string;
+    serialNumber?: string;
+    activeCaCertId?: string;
+  };
+};
+
+export type TUnifiedCertificateAuthority =
+  | TAcmeCertificateAuthority
+  | TInternalCertificateAuthority;
+
+export type TCreateCertificateAuthorityDTO = Omit<TUnifiedCertificateAuthority, "id">;
+export type TUpdateCertificateAuthorityDTO = Partial<TUnifiedCertificateAuthority> & {
+  caName: string;
+  projectId: string;
+  type: CaType;
+};
+
+export type TDeleteCertificateAuthorityDTO = {
+  caName: string;
+  type: CaType;
+  projectId: string;
+};

 export type TCertificateAuthority = {
  id: string;
  parentCaId?: string;
  projectId: string;
-  type: CaType;
+  type: InternalCaType;
  status: CaStatus;
  friendlyName: string;
  organization: string;
@@ -25,22 +87,6 @@ export type TCertificateAuthority = {
  updatedAt: string;
 };

-export type TCreateCaDTO = {
-  projectSlug: string;
-  type: string;
-  friendlyName?: string;
-  organization: string;
-  ou: string;
-  country: string;
-  province: string;
-  locality: string;
-  commonName: string;
-  notAfter?: string;
-  maxPathLength: number;
-  keyAlgorithm: CertKeyAlgorithm;
-  requireTemplateForIssuance: boolean;
-};
-
 export type TUpdateCaDTO = {
  projectSlug: string;
  caId: string;
@@ -1,8 +1,11 @@
 export {
  useCreateCertTemplate,
+  useCreateCertTemplateV2,
  useCreateEstConfig,
  useDeleteCertTemplate,
+  useDeleteCertTemplateV2,
  useUpdateCertTemplate,
+  useUpdateCertTemplateV2,
  useUpdateEstConfig
 } from "./mutations";
-export { useGetCertTemplate, useGetEstConfig } from "./queries";
+export { useGetCertTemplate, useGetEstConfig, useListCertificateTemplates } from "./queries";
@@ -8,9 +8,12 @@ import { certTemplateKeys } from "./queries";
 import {
  TCertificateTemplate,
  TCreateCertificateTemplateDTO,
+  TCreateCertificateTemplateV2DTO,
  TCreateEstConfigDTO,
  TDeleteCertificateTemplateDTO,
+  TDeleteCertificateTemplateV2DTO,
  TUpdateCertificateTemplateDTO,
+  TUpdateCertificateTemplateV2DTO,
  TUpdateEstConfigDTO
 } from "./types";

@@ -73,6 +76,58 @@ export const useDeleteCertTemplate = () => {
  });
 };

+export const useCreateCertTemplateV2 = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateTemplate, object, TCreateCertificateTemplateV2DTO>({
+    mutationFn: async (dto) => {
+      const { data } = await apiRequest.post<{
+        certificateTemplate: TCertificateTemplate;
+      }>("/api/v2/pki/certificate-templates", dto);
+      return data.certificateTemplate;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certTemplateKeys.listTemplates({ projectId }) });
+    }
+  });
+};
+
+export const useUpdateCertTemplateV2 = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateTemplate, object, TUpdateCertificateTemplateV2DTO>({
+    mutationFn: async (dto) => {
+      const { data } = await apiRequest.patch<{ certificateTemplate: TCertificateTemplate }>(
+        `/api/v2/pki/certificate-templates/${dto.templateName}`,
+        dto
+      );
+
+      return data.certificateTemplate;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certTemplateKeys.listTemplates({ projectId }) });
+    }
+  });
+};
+
+export const useDeleteCertTemplateV2 = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TCertificateTemplate, object, TDeleteCertificateTemplateV2DTO>({
+    mutationFn: async (dto) => {
+      const { data } = await apiRequest.delete<{ certificateTemplate: TCertificateTemplate }>(
+        `/api/v2/pki/certificate-templates/${dto.templateName}`,
+        {
+          data: {
+            projectId: dto.projectId
+          }
+        }
+      );
+      return data.certificateTemplate;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certTemplateKeys.listTemplates({ projectId }) });
+    }
+  });
+};
+
 export const useCreateEstConfig = () => {
  const queryClient = useQueryClient();
  return useMutation<object, object, TCreateEstConfigDTO>({
@@ -2,10 +2,20 @@ import { useQuery } from "@tanstack/react-query";

 import { apiRequest } from "@app/config/request";

-import { TCertificateTemplate, TEstConfig } from "./types";
+import {
+  TCertificateTemplate,
+  TCertificateTemplateV2,
+  TEstConfig,
+  TListCertificateTemplatesDTO
+} from "./types";

 export const certTemplateKeys = {
  getCertTemplateById: (id: string) => [{ id }, "cert-template"],
+  listTemplates: ({ projectId, ...el }: { limit?: number; offset?: number; projectId: string }) => [
+    "list-template",
+    projectId,
+    el
+  ],
  getEstConfig: (id: string) => [{ id }, "cert-template-est-config"]
 };

@@ -22,6 +32,29 @@ export const useGetCertTemplate = (id: string) => {
  });
 };

+export const useListCertificateTemplates = ({
+  limit = 100,
+  offset = 0,
+  projectId
+}: TListCertificateTemplatesDTO) => {
+  return useQuery({
+    queryKey: certTemplateKeys.listTemplates({ limit, offset, projectId }),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        certificateTemplates: TCertificateTemplateV2[];
+        totalCount?: number;
+      }>("/api/v2/pki/certificate-templates", {
+        params: {
+          limit,
+          offset,
+          projectId
+        }
+      });
+      return data;
+    }
+  });
+};
+
 export const useGetEstConfig = (certificateTemplateId: string) => {
  return useQuery({
    queryKey: certTemplateKeys.getEstConfig(certificateTemplateId),
@@ -14,6 +14,26 @@ export type TCertificateTemplate = {
  extendedKeyUsages: CertExtendedKeyUsage[];
 };

+export type TCertificateTemplateV2 = {
+  id: string;
+  caId: string;
+  caName: string;
+  projectId: string;
+  pkiCollectionId?: string;
+  name: string;
+  commonName: string;
+  subjectAlternativeName: string;
+  ttl: string;
+  keyUsages: CertKeyUsage[];
+  extendedKeyUsages: CertExtendedKeyUsage[];
+  updatedAt: string;
+  createdAt: string;
+  ca: {
+    name: string;
+    id: string;
+  };
+};
+
 export type TCreateCertificateTemplateDTO = {
  caId: string;
  pkiCollectionId?: string;
@@ -44,6 +64,34 @@ export type TDeleteCertificateTemplateDTO = {
  projectId: string;
 };

+export type TCreateCertificateTemplateV2DTO = {
+  caName: string;
+  name: string;
+  commonName: string;
+  subjectAlternativeName: string;
+  ttl: string;
+  projectId: string;
+  keyUsages: CertKeyUsage[];
+  extendedKeyUsages: CertExtendedKeyUsage[];
+};
+
+export type TUpdateCertificateTemplateV2DTO = {
+  templateName: string;
+  caName?: string;
+  name?: string;
+  commonName?: string;
+  subjectAlternativeName?: string;
+  ttl?: string;
+  projectId: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+};
+
+export type TDeleteCertificateTemplateV2DTO = {
+  templateName: string;
+  projectId: string;
+};
+
 export type TCreateEstConfigDTO = {
  certificateTemplateId: string;
  caChain?: string;
@@ -67,3 +115,9 @@ export type TEstConfig = {
  isEnabled: boolean;
  disableBootstrapCertValidation: boolean;
 };
+
+export type TListCertificateTemplatesDTO = {
+  limit?: number;
+  offset?: number;
+  projectId: string;
+};
@@ -1,2 +1,2 @@
-export { useDeleteCert, useRevokeCert } from "./mutations";
+export { useDeleteCert, useImportCertificate, useRevokeCert } from "./mutations";
 export { useGetCert, useGetCertBody } from "./queries";
@@ -4,7 +4,13 @@ import { apiRequest } from "@app/config/request";

 import { pkiSubscriberKeys } from "../pkiSubscriber/queries";
 import { workspaceKeys } from "../workspace";
-import { TCertificate, TDeleteCertDTO, TRevokeCertDTO } from "./types";
+import {
+  TCertificate,
+  TDeleteCertDTO,
+  TImportCertificateDTO,
+  TImportCertificateResponse,
+  TRevokeCertDTO
+} from "./types";

 export const useDeleteCert = () => {
  const queryClient = useQueryClient();
@@ -49,3 +55,21 @@ export const useRevokeCert = () => {
    }
  });
 };
+
+export const useImportCertificate = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TImportCertificateResponse, object, TImportCertificateDTO>({
+    mutationFn: async (body) => {
+      const { data } = await apiRequest.post<TImportCertificateResponse>(
+        "/api/v1/pki/certificates/import-certificate",
+        body
+      );
+      return data;
+    },
+    onSuccess: (_, { projectSlug }) => {
+      queryClient.invalidateQueries({
+        queryKey: workspaceKeys.forWorkspaceCertificates(projectSlug)
+      });
+    }
+  });
+};
@@ -25,3 +25,21 @@ export type TRevokeCertDTO = {
  serialNumber: string;
  revocationReason: string;
 };
+
+export type TImportCertificateDTO = {
+  projectSlug: string;
+
+  certificatePem: string;
+  privateKeyPem: string;
+  chainPem: string;
+
+  pkiCollectionId?: string;
+  friendlyName?: string;
+};
+
+export type TImportCertificateResponse = {
+  certificate: string;
+  certificateChain: string;
+  privateKey: string;
+  serialNumber: string;
+};
@@ -13,6 +13,7 @@ export type TDynamicSecret = {
  status?: DynamicSecretStatus;
  statusDetails?: string;
  maxTTL: string;
+  usernameTemplate?: string | null;
  metadata?: { key: string; value: string }[];
 };

@@ -31,7 +32,8 @@ export enum DynamicSecretProviders {
  SapHana = "sap-hana",
  Snowflake = "snowflake",
  Totp = "totp",
-  SapAse = "sap-ase"
+  SapAse = "sap-ase",
+  Kubernetes = "kubernetes"
 }

 export enum SqlProviders {
@@ -261,6 +263,20 @@ export type TDynamicSecretProvider =
            algorithm?: string;
            digits?: number;
          };
+    }
+  | {
+      type: DynamicSecretProviders.Kubernetes;
+      inputs: {
+        url: string;
+        clusterToken: string;
+        ca?: string;
+        serviceAccountName: string;
+        credentialType: "dynamic" | "static";
+        namespace: string;
+        gatewayId?: string;
+        sslEnabled: boolean;
+        audiences: string[];
+      };
    };

 export type TCreateDynamicSecretDTO = {
@@ -272,6 +288,7 @@ export type TCreateDynamicSecretDTO = {
  environmentSlug: string;
  name: string;
  metadata?: { key: string; value: string }[];
+  usernameTemplate?: string;
 };

 export type TUpdateDynamicSecretDTO = {
@@ -285,6 +302,7 @@ export type TUpdateDynamicSecretDTO = {
    defaultTTL?: string;
    maxTTL?: string | null;
    inputs?: unknown;
+    usernameTemplate?: string | null;
  };
 };

@@ -163,7 +163,8 @@ export const useUpdateIdentityUniversalAuth = () => {
      accessTokenTTL,
      accessTokenMaxTTL,
      accessTokenNumUsesLimit,
-      accessTokenTrustedIps
+      accessTokenTrustedIps,
+      accessTokenPeriod
    }) => {
      const {
        data: { identityUniversalAuth }
@@ -172,7 +173,8 @@ export const useUpdateIdentityUniversalAuth = () => {
        accessTokenTTL,
        accessTokenMaxTTL,
        accessTokenNumUsesLimit,
-        accessTokenTrustedIps
+        accessTokenTrustedIps,
+        accessTokenPeriod
      });
      return identityUniversalAuth;
    },
@@ -107,6 +107,7 @@ export type IdentityUniversalAuth = {
  accessTokenMaxTTL: number;
  accessTokenNumUsesLimit: number;
  accessTokenTrustedIps: IdentityTrustedIp[];
+  accessTokenPeriod: number;
 };

 export type AddIdentityUniversalAuthDTO = {
@@ -118,6 +119,7 @@ export type AddIdentityUniversalAuthDTO = {
  accessTokenTTL: number;
  accessTokenMaxTTL: number;
  accessTokenNumUsesLimit: number;
+  accessTokenPeriod: number;
  accessTokenTrustedIps: {
    ipAddress: string;
  }[];
@@ -132,6 +134,7 @@ export type UpdateIdentityUniversalAuthDTO = {
  accessTokenTTL?: number;
  accessTokenMaxTTL?: number;
  accessTokenNumUsesLimit?: number;
+  accessTokenPeriod?: number;
  accessTokenTrustedIps?: {
    ipAddress: string;
  }[];
@@ -118,7 +118,9 @@ export const useUpdateOrg = () => {
      kmsProductEnabled,
      sshProductEnabled,
      scannerProductEnabled,
-      shareSecretsProductEnabled
+      shareSecretsProductEnabled,
+      maxSharedSecretLifetime,
+      maxSharedSecretViewLimit
    }) => {
      return apiRequest.patch(`/api/v1/organization/${orgId}`, {
        name,
@@ -136,7 +138,9 @@ export const useUpdateOrg = () => {
        kmsProductEnabled,
        sshProductEnabled,
        scannerProductEnabled,
-        shareSecretsProductEnabled
+        shareSecretsProductEnabled,
+        maxSharedSecretLifetime,
+        maxSharedSecretViewLimit
      });
    },
    onSuccess: () => {
@@ -26,6 +26,8 @@ export type Organization = {
  sshProductEnabled: boolean;
  scannerProductEnabled: boolean;
  shareSecretsProductEnabled: boolean;
+  maxSharedSecretLifetime: number;
+  maxSharedSecretViewLimit: number | null;
 };

 export type UpdateOrgDTO = {
@@ -46,6 +48,8 @@ export type UpdateOrgDTO = {
  sshProductEnabled?: boolean;
  scannerProductEnabled?: boolean;
  shareSecretsProductEnabled?: boolean;
+  maxSharedSecretViewLimit?: number | null;
+  maxSharedSecretLifetime?: number;
 };

 export type BillingDetails = {
@@ -2,6 +2,7 @@ export {
  useCreatePkiSubscriber,
  useDeletePkiSubscriber,
  useIssuePkiSubscriberCert,
+  useOrderPkiSubscriberCert,
  useUpdatePkiSubscriber
 } from "./mutations";
 export { useGetPkiSubscriber, useGetPkiSubscriberCertificates } from "./queries";
@@ -108,3 +108,17 @@ export const useIssuePkiSubscriberCert = () => {
    }
  });
 };
+
+export const useOrderPkiSubscriberCert = () => {
+  return useMutation<{ message: string }, object, TIssuePkiSubscriberCertDTO>({
+    mutationFn: async ({ subscriberName, projectId }) => {
+      const { data } = await apiRequest.post(
+        `/api/v1/pki/subscribers/${subscriberName}/order-certificate`,
+        {
+          projectId
+        }
+      );
+      return data;
+    }
+  });
+};
@@ -1,6 +1,7 @@
 import { useQuery } from "@tanstack/react-query";

 import { apiRequest } from "@app/config/request";
+import { TReactQueryOptions } from "@app/types/reactQuery";

 import { TCertificate } from "../certificates/types";
 import { TPkiSubscriber } from "./types";
@@ -38,13 +39,16 @@ export const pkiSubscriberKeys = {
    ] as const
 };

-export const useGetPkiSubscriber = ({
-  subscriberName,
-  projectId
-}: {
-  subscriberName: string;
-  projectId: string;
-}) => {
+export const useGetPkiSubscriber = (
+  {
+    subscriberName,
+    projectId
+  }: {
+    subscriberName: string;
+    projectId: string;
+  },
+  options?: TReactQueryOptions["options"]
+) => {
  return useQuery({
    queryKey: pkiSubscriberKeys.getPkiSubscriber({ subscriberName, projectId }),
    queryFn: async () => {
@@ -58,21 +62,25 @@ export const useGetPkiSubscriber = ({
      );
      return pkiSubscriber;
    },
-    enabled: Boolean(subscriberName) && Boolean(projectId)
+    enabled: Boolean(subscriberName) && Boolean(projectId),
+    ...options
  });
 };

-export const useGetPkiSubscriberCertificates = ({
-  subscriberName,
-  projectId,
-  offset,
-  limit
-}: {
-  subscriberName: string;
-  projectId: string;
-  offset: number;
-  limit: number;
-}) => {
+export const useGetPkiSubscriberCertificates = (
+  {
+    subscriberName,
+    projectId,
+    offset,
+    limit
+  }: {
+    subscriberName: string;
+    projectId: string;
+    offset: number;
+    limit: number;
+  },
+  options?: TReactQueryOptions["options"]
+) => {
  return useQuery({
    queryKey: pkiSubscriberKeys.specificPkiSubscriberCertificates({
      subscriberName,
@@ -97,6 +105,7 @@ export const useGetPkiSubscriberCertificates = ({
      );
      return { certificates, totalCount };
    },
-    enabled: Boolean(subscriberName) && Boolean(projectId)
+    enabled: Boolean(subscriberName) && Boolean(projectId),
+    ...options
  });
 };
@@ -5,6 +5,11 @@ export enum PkiSubscriberStatus {
  DISABLED = "disabled"
 }

+export enum SubscriberOperationStatus {
+  SUCCESS = "success",
+  FAILED = "failed"
+}
+
 export type TPkiSubscriber = {
  id: string;
  projectId: string;
@@ -12,10 +17,16 @@ export type TPkiSubscriber = {
  name: string;
  commonName: string;
  status: PkiSubscriberStatus;
-  ttl: string;
+  ttl?: string;
  subjectAlternativeNames: string[];
  keyUsages: CertKeyUsage[];
  extendedKeyUsages: CertExtendedKeyUsage[];
+  supportsImmediateCertIssuance?: boolean;
+  enableAutoRenewal?: boolean;
+  autoRenewalPeriodInDays?: number;
+  lastOperationStatus?: SubscriberOperationStatus;
+  lastOperationMessage?: string;
+  lastOperationAt?: string;
 };

 export type TCreatePkiSubscriberDTO = {
@@ -23,10 +34,12 @@ export type TCreatePkiSubscriberDTO = {
  caId: string;
  name: string;
  commonName: string;
-  ttl: string;
+  ttl?: string;
  subjectAlternativeNames: string[];
  keyUsages: CertKeyUsage[];
  extendedKeyUsages: CertExtendedKeyUsage[];
+  enableAutoRenewal?: boolean;
+  autoRenewalPeriodInDays?: number;
 };

 export type TUpdatePkiSubscriberDTO = {
@@ -40,6 +53,8 @@ export type TUpdatePkiSubscriberDTO = {
  subjectAlternativeNames?: string[];
  keyUsages?: CertKeyUsage[];
  extendedKeyUsages?: CertExtendedKeyUsage[];
+  enableAutoRenewal?: boolean;
+  autoRenewalPeriodInDays?: number;
 };

 export type TDeletePkiSubscriberDTO = {
@@ -51,3 +66,8 @@ export type TIssuePkiSubscriberCertDTO = {
  subscriberName: string;
  projectId: string;
 };
+
+export type TOrderPkiSubscriberCertDTO = {
+  subscriberName: string;
+  projectId: string;
+};
@@ -14,6 +14,7 @@ export const useCreateSecretApprovalPolicy = () => {
      workspaceId,
      approvals,
      approvers,
+      bypassers,
      secretPath,
      name,
      enforcementLevel,
@@ -24,6 +25,7 @@ export const useCreateSecretApprovalPolicy = () => {
        workspaceId,
        approvals,
        approvers,
+        bypassers,
        secretPath,
        name,
        enforcementLevel,
@@ -46,6 +48,7 @@ export const useUpdateSecretApprovalPolicy = () => {
    mutationFn: async ({
      id,
      approvers,
+      bypassers,
      approvals,
      secretPath,
      name,
@@ -55,6 +58,7 @@ export const useUpdateSecretApprovalPolicy = () => {
      const { data } = await apiRequest.patch(`/api/v1/secret-approvals/${id}`, {
        approvals,
        approvers,
+        bypassers,
        secretPath,
        name,
        enforcementLevel,
@@ -25,6 +25,16 @@ export type Approver = {
  type: ApproverType;
 };

+export enum BypasserType {
+  User = "user",
+  Group = "group"
+}
+
+export type Bypasser = {
+  id: string;
+  type: BypasserType;
+};
+
 export type TGetSecretApprovalPoliciesDTO = {
  workspaceId: string;
 };
@@ -41,6 +51,7 @@ export type TCreateSecretPolicyDTO = {
  environment: string;
  secretPath?: string | null;
  approvers?: Approver[];
+  bypassers?: Bypasser[];
  approvals?: number;
  enforcementLevel: EnforcementLevel;
  allowedSelfApprovals: boolean;
@@ -50,6 +61,7 @@ export type TUpdateSecretPolicyDTO = {
  id: string;
  name?: string;
  approvers?: Approver[];
+  bypassers?: Bypasser[];
  secretPath?: string | null;
  approvals?: number;
  allowedSelfApprovals?: boolean;
@@ -57,7 +57,7 @@ export type TSecretApprovalRequest = {
  secretPath: string;
  hasMerged: boolean;
  status: "open" | "close";
-  policy: Omit<TSecretApprovalPolicy, "approvers"> & {
+  policy: Omit<TSecretApprovalPolicy, "approvers" | "bypassers"> & {
    approvers: {
      userId: string;
      email: string;
@@ -65,6 +65,13 @@ export type TSecretApprovalRequest = {
      lastName: string;
      username: string;
    }[];
+    bypassers: {
+      userId: string;
+      email: string;
+      firstName: string;
+      lastName: string;
+      username: string;
+    }[];
  };
  statusChangedByUserId: string;
  statusChangedByUser?: {
@@ -1,6 +1,7 @@
 export enum SecretRotation {
  PostgresCredentials = "postgres-credentials",
  MsSqlCredentials = "mssql-credentials",
+  MySqlCredentials = "mysql-credentials",
  Auth0ClientSecret = "auth0-client-secret",
  AzureClientSecret = "azure-client-secret",
  LdapPassword = "ldap-password",
@@ -31,9 +31,15 @@ import { TSqlCredentialsRotationOption } from "@app/hooks/api/secretRotationsV2/
 import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types";
 import { DiscriminativePick } from "@app/types";

+import {
+  TMySqlCredentialsRotation,
+  TMySqlCredentialsRotationGeneratedCredentialsResponse
+} from "./mysql-credentials-rotation";
+
 export type TSecretRotationV2 = (
  | TPostgresCredentialsRotation
  | TMsSqlCredentialsRotation
+  | TMySqlCredentialsRotation
  | TAuth0ClientSecretRotation
  | TAzureClientSecretRotation
  | TLdapPasswordRotation
@@ -56,6 +62,7 @@ export type TSecretRotationV2Response = { secretRotation: TSecretRotationV2 };
 export type TViewSecretRotationGeneratedCredentialsResponse =
  | TPostgresCredentialsRotationGeneratedCredentialsResponse
  | TMsSqlCredentialsRotationGeneratedCredentialsResponse
+  | TMySqlCredentialsRotationGeneratedCredentialsResponse
  | TAuth0ClientSecretRotationGeneratedCredentialsResponse
  | TAzureClientSecretRotationGeneratedCredentialsResponse
  | TLdapPasswordRotationGeneratedCredentialsResponse
@@ -105,6 +112,7 @@ export type TViewSecretRotationV2GeneratedCredentialsDTO = {
 export type TSecretRotationOptionMap = {
  [SecretRotation.PostgresCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.MsSqlCredentials]: TSqlCredentialsRotationOption;
+  [SecretRotation.MySqlCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationOption;
  [SecretRotation.AzureClientSecret]: TAzureClientSecretRotationOption;
  [SecretRotation.LdapPassword]: TLdapPasswordRotationOption;
@@ -114,6 +122,7 @@ export type TSecretRotationOptionMap = {
 export type TSecretRotationGeneratedCredentialsResponseMap = {
  [SecretRotation.PostgresCredentials]: TPostgresCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.MsSqlCredentials]: TMsSqlCredentialsRotationGeneratedCredentialsResponse;
+  [SecretRotation.MySqlCredentials]: TMySqlCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
  [SecretRotation.AzureClientSecret]: TAzureClientSecretRotationGeneratedCredentialsResponse;
  [SecretRotation.LdapPassword]: TLdapPasswordRotationGeneratedCredentialsResponse;
@@ -1,3 +1,4 @@
+import { TPasswordRequirements } from "@app/components/secret-rotations-v2/forms/schemas/shared";
 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
 import {
@@ -5,10 +6,17 @@ import {
  TSecretRotationV2GeneratedCredentialsResponseBase
 } from "@app/hooks/api/secretRotationsV2/types/shared";

+export enum LdapPasswordRotationMethod {
+  ConnectionPrincipal = "connection-principal",
+  TargetPrincipal = "target-principal"
+}
+
 export type TLdapPasswordRotation = TSecretRotationV2Base & {
  type: SecretRotation.LdapPassword;
  parameters: {
    dn: string;
+    rotationMethod?: LdapPasswordRotationMethod;
+    passwordRequirements?: TPasswordRequirements;
  };
  secretsMapping: {
    dn: string;
@@ -0,0 +1,17 @@
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase,
+  TSqlCredentialsRotationGeneratedCredentials,
+  TSqlCredentialsRotationProperties
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export type TMySqlCredentialsRotation = TSecretRotationV2Base & {
+  type: SecretRotation.MySqlCredentials;
+} & TSqlCredentialsRotationProperties;
+
+export type TMySqlCredentialsRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.MySqlCredentials,
+    TSqlCredentialsRotationGeneratedCredentials
+  >;
@@ -14,8 +14,11 @@ export type TSqlCredentialsRotationProperties = {

 export type TSqlCredentialsRotationOption = {
  name: string;
-  type: SecretRotation.PostgresCredentials | SecretRotation.MsSqlCredentials;
-  connection: AppConnection.Postgres | AppConnection.MsSql;
+  type:
+    | SecretRotation.PostgresCredentials
+    | SecretRotation.MsSqlCredentials
+    | SecretRotation.MySqlCredentials;
+  connection: AppConnection.Postgres | AppConnection.MsSql | AppConnection.MySql;
  template: {
    secretsMapping: TSqlCredentialsRotationProperties["secretsMapping"];
    createUserStatement: string;
@@ -11,13 +11,10 @@ export const secretSharingKeys = {
  allSecretRequests: () => ["secretRequests"] as const,
  specificSecretRequests: ({ offset, limit }: { offset: number; limit: number }) =>
    [...secretSharingKeys.allSecretRequests(), { offset, limit }] as const,
-  getSecretById: (arg: {
-    id: string;
-    hashedHex: string | null;
-    password?: string;
-    email?: string;
-    hash?: string;
-  }) => ["shared-secret", arg],
+  getSecretById: (arg: { id: string; hashedHex: string | null; password?: string }) => [
+    "shared-secret",
+    arg
+  ],
  getSecretRequestById: (arg: { id: string }) => ["secret-request", arg] as const
 };

@@ -73,34 +70,24 @@ export const useGetSecretRequests = ({
 export const useGetActiveSharedSecretById = ({
  sharedSecretId,
  hashedHex,
-  password,
-  email,
-  hash
+  password
 }: {
  sharedSecretId: string;
  hashedHex: string | null;
  password?: string;
-
-  // For secrets shared to specific emails (optional)
-  email?: string;
-  hash?: string;
 }) => {
  return useQuery({
    queryKey: secretSharingKeys.getSecretById({
      id: sharedSecretId,
      hashedHex,
-      password,
-      email,
-      hash
+      password
    }),
    queryFn: async () => {
      const { data } = await apiRequest.post<TViewSharedSecretResponse>(
        `/api/v1/secret-sharing/shared/public/${sharedSecretId}`,
        {
          ...(hashedHex && { hashedHex }),
-          password,
-          email,
-          hash
+          password
        }
      );

@@ -13,7 +13,8 @@ export enum SecretSync {
  Windmill = "windmill",
  HCVault = "hashicorp-vault",
  TeamCity = "teamcity",
-  OCIVault = "oci-vault"
+  OCIVault = "oci-vault",
+  OnePass = "1password"
 }

 export enum SecretSyncStatus {
@@ -0,0 +1,15 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TOnePassSync = TRootSecretSync & {
+  destination: SecretSync.OnePass;
+  destinationConfig: {
+    vaultId: string;
+  };
+  connection: {
+    app: AppConnection.OnePass;
+    name: string;
+    id: string;
+  };
+};
@@ -1,6 +1,7 @@
 import { SecretSync, SecretSyncImportBehavior } from "@app/hooks/api/secretSyncs";
 import { DiscriminativePick } from "@app/types";

+import { TOnePassSync } from "./1password-sync";
 import { TAwsParameterStoreSync } from "./aws-parameter-store-sync";
 import { TAwsSecretsManagerSync } from "./aws-secrets-manager-sync";
 import { TAzureAppConfigurationSync } from "./azure-app-configuration-sync";
@@ -21,6 +22,7 @@ export type TSecretSyncOption = {
  name: string;
  destination: SecretSync;
  canImportSecrets: boolean;
+  enterprise?: boolean;
 };

 export type TSecretSync =
@@ -38,7 +40,8 @@ export type TSecretSync =
  | TWindmillSync
  | THCVaultSync
  | TTeamCitySync
-  | TOCIVaultSync;
+  | TOCIVaultSync
+  | TOnePassSync;

 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };

@@ -51,4 +51,6 @@ export type SubscriptionPlan = {
  projectTemplates: boolean;
  kmip: boolean;
  secretScanning: boolean;
+  enterpriseSecretSyncs: boolean;
+  enterpriseAppConnections: boolean;
 };
@@ -1,6 +1,7 @@
 export {
  useAddUserToWsE2EE,
  useAddUserToWsNonE2EE,
+  useRemoveMyDuplicateAccounts,
  useRevokeMySessionById,
  useSendEmailVerificationCode,
  useVerifyEmailVerificationCode
@@ -14,6 +15,7 @@ export {
  useDeleteOrgMembership,
  useGetMyAPIKeys,
  useGetMyAPIKeysV2,
+  useGetMyDuplicateAccount,
  useGetMyIp,
  useGetMyOrganizationProjects,
  useGetMySessions,
@@ -184,3 +184,12 @@ export const useRevokeMySessionById = () => {
    }
  });
 };
+
+export const useRemoveMyDuplicateAccounts = () => {
+  return useMutation({
+    mutationFn: async () => {
+      const { data } = await apiRequest.post("/api/v1/user/remove-duplicate-accounts");
+      return data;
+    }
+  });
+};
@@ -37,6 +37,33 @@ export const useGetUser = () =>
    queryFn: fetchUserDetails
  });

+export const fetchUserDuplicateAccounts = async () => {
+  const { data } = await apiRequest.get<{
+    users: Array<
+      User & {
+        isMyAccount: boolean;
+        organizations: { name: string; slug: string }[];
+        devices: {
+          ip: string;
+          userAgent: string;
+        }[];
+      }
+    >;
+  }>("/api/v1/user/duplicate-accounts");
+  return data.users;
+};
+
+export const useGetMyDuplicateAccount = () =>
+  useQuery({
+    queryKey: userKeys.getMyDuplicateAccount,
+    staleTime: 60 * 1000, // 1 min in ms
+    queryFn: fetchUserDuplicateAccounts,
+    select: (users) => ({
+      duplicateAccounts: users.filter((el) => !el.isMyAccount),
+      myAccount: users?.find((el) => el.isMyAccount)
+    })
+  });
+
 export const useDeleteMe = () => {
  const queryClient = useQueryClient();

@@ -1,5 +1,6 @@
 export const userKeys = {
  getUser: ["user"] as const,
+  getMyDuplicateAccount: ["user-duplicate-account"] as const,
  getPrivateKey: ["user"] as const,
  userAction: ["user-action"] as const,
  userProjectFavorites: (orgId: string) => [{ orgId }, "user-project-favorites"] as const,
@@ -1,27 +1,23 @@
 import { useTranslation } from "react-i18next";
-import { faArrowLeft, faInfo, faMobile, faQuestion } from "@fortawesome/free-solid-svg-icons";
+import { faMobile } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Link, Outlet } from "@tanstack/react-router";
+import { Outlet, useRouterState } from "@tanstack/react-router";

-import { WishForm } from "@app/components/features/WishForm";
 import { Banner } from "@app/components/page-frames/Banner";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger
-} from "@app/components/v2";
-import { envConfig } from "@app/config/env";
+import { BreadcrumbContainer, TBreadcrumbFormat } from "@app/components/v2";
 import { useServerConfig } from "@app/context";
-import { ProjectType } from "@app/hooks/api/workspace/types";

 import { InsecureConnectionBanner } from "../OrganizationLayout/components/InsecureConnectionBanner";
-import { INFISICAL_SUPPORT_OPTIONS } from "../OrganizationLayout/components/MinimizedOrgSidebar/MinimizedOrgSidebar";
+import { AdminSidebar } from "./Sidebar";

 export const AdminLayout = () => {
  const { t } = useTranslation();
  const { config } = useServerConfig();

+  const matches = useRouterState({ select: (s) => s.matches.at(-1)?.context });
+
+  const breadcrumbs = matches && "breadcrumbs" in matches ? matches.breadcrumbs : undefined;
+
  const containerHeight = config.pageFrameContent ? "h-[94vh]" : "h-screen";

  return (
@@ -30,54 +26,11 @@ export const AdminLayout = () => {
      <div className={`dark hidden ${containerHeight} w-full flex-col overflow-x-hidden md:flex`}>
        {!window.isSecureContext && <InsecureConnectionBanner />}
        <div className="flex flex-grow flex-col overflow-y-hidden md:flex-row">
-          <aside className="dark w-full border-r border-mineshaft-600 bg-gradient-to-tr from-mineshaft-700 via-mineshaft-800 to-mineshaft-900 md:w-60">
-            <nav className="items-between flex h-full flex-col justify-between overflow-y-auto dark:[color-scheme:dark]">
-              <div className="flex-grow">
-                <Link to={`/organization/${ProjectType.SecretManager}/overview` as const}>
-                  <div className="my-6 flex cursor-default items-center justify-center pr-2 text-sm text-mineshaft-300 hover:text-mineshaft-100">
-                    <FontAwesomeIcon icon={faArrowLeft} className="pr-3" />
-                    Back to organization
-                  </div>
-                </Link>
-              </div>
-              <div className="relative mt-10 flex w-full cursor-default flex-col items-center px-3 text-sm text-mineshaft-400">
-                {(window.location.origin.includes("https://app.infisical.com") ||
-                  window.location.origin.includes("https://gamma.infisical.com")) && <WishForm />}
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <div className="mb-2 w-full pl-5 duration-200 hover:text-mineshaft-200">
-                      <FontAwesomeIcon icon={faQuestion} className="mr-3 px-[0.1rem]" />
-                      Help & Support
-                    </div>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="start" className="p-1">
-                    {INFISICAL_SUPPORT_OPTIONS.map(([icon, text, url]) => (
-                      <DropdownMenuItem key={url as string}>
-                        <a
-                          target="_blank"
-                          rel="noopener noreferrer"
-                          href={String(url)}
-                          className="flex w-full items-center rounded-md font-normal text-mineshaft-300 duration-200"
-                        >
-                          <div className="relative flex w-full cursor-pointer select-none items-center justify-start rounded-md">
-                            {icon}
-                            <div className="text-sm">{text}</div>
-                          </div>
-                        </a>
-                      </DropdownMenuItem>
-                    ))}
-                    {envConfig.PLATFORM_VERSION && (
-                      <div className="mb-2 mt-2 w-full cursor-default pl-5 text-sm duration-200 hover:text-mineshaft-200">
-                        <FontAwesomeIcon icon={faInfo} className="mr-4 px-[0.1rem]" />
-                        Version: {envConfig.PLATFORM_VERSION}
-                      </div>
-                    )}
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </div>
-            </nav>
-          </aside>
-          <main className="flex-1 overflow-y-auto overflow-x-hidden bg-bunker-800 dark:[color-scheme:dark]">
+          <AdminSidebar />
+          <main className="flex-1 overflow-y-auto overflow-x-hidden bg-bunker-800 px-4 pb-4 dark:[color-scheme:dark]">
+            {breadcrumbs ? (
+              <BreadcrumbContainer breadcrumbs={breadcrumbs as TBreadcrumbFormat[]} />
+            ) : null}
            <Outlet />
          </main>
        </div>
@@ -0,0 +1,141 @@
+import { faArrowLeft, faInfo, faQuestion } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { Link, useMatchRoute } from "@tanstack/react-router";
+
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Menu,
+  MenuGroup,
+  MenuItem
+} from "@app/components/v2";
+import { envConfig } from "@app/config/env";
+import { ProjectType } from "@app/hooks/api/workspace/types";
+
+import { INFISICAL_SUPPORT_OPTIONS } from "../OrganizationLayout/components/MinimizedOrgSidebar/MinimizedOrgSidebar";
+
+const generalTabs = [
+  {
+    label: "General",
+    icon: "settings-cog",
+    link: "/admin/"
+  },
+  {
+    label: "Encryption",
+    icon: "lock-closed",
+    link: "/admin/encryption"
+  },
+  {
+    label: "Authentication",
+    icon: "check",
+    link: "/admin/authentication"
+  },
+  {
+    label: "Integrations",
+    icon: "sliding-carousel",
+    link: "/admin/integrations"
+  },
+  {
+    label: "Caching",
+    icon: "note",
+    link: "/admin/caching"
+  }
+];
+
+const resourceTabs = [
+  {
+    label: "Organizations",
+    icon: "groups",
+    link: "/admin/resources/organizations"
+  },
+  {
+    label: "User Identities",
+    icon: "user",
+    link: "/admin/resources/user-identities"
+  },
+  {
+    label: "Machine Identities",
+    icon: "key-user",
+    link: "/admin/resources/machine-identities"
+  }
+];
+
+export const AdminSidebar = () => {
+  const matchRoute = useMatchRoute();
+
+  return (
+    <aside className="dark w-full border-r border-mineshaft-600 bg-gradient-to-tr from-mineshaft-700 via-mineshaft-800 to-mineshaft-900 md:w-60">
+      <nav className="items-between flex h-full flex-col justify-between overflow-y-auto dark:[color-scheme:dark]">
+        <div className="flex-grow">
+          <Link to={`/organization/${ProjectType.SecretManager}/overview` as const}>
+            <div className="my-6 flex cursor-default items-center justify-center pr-2 text-sm text-mineshaft-300 hover:text-mineshaft-100">
+              <FontAwesomeIcon icon={faArrowLeft} className="pr-3" />
+              Back to organization
+            </div>
+          </Link>
+          <Menu>
+            <MenuGroup title="General">
+              {generalTabs.map((tab) => {
+                const isActive = matchRoute({ to: tab.link, fuzzy: false });
+                return (
+                  <Link key={tab.link} to={tab.link}>
+                    <MenuItem isSelected={Boolean(isActive)} icon={tab.icon}>
+                      {tab.label}
+                    </MenuItem>
+                  </Link>
+                );
+              })}
+            </MenuGroup>
+            <MenuGroup title="Resources">
+              {resourceTabs.map((tab) => {
+                const isActive = matchRoute({ to: tab.link, fuzzy: false });
+                return (
+                  <Link key={tab.link} to={tab.link}>
+                    <MenuItem isSelected={Boolean(isActive)} icon={tab.icon}>
+                      {tab.label}
+                    </MenuItem>
+                  </Link>
+                );
+              })}
+            </MenuGroup>
+          </Menu>
+        </div>
+        <div className="relative mb-4 mt-10 flex w-full cursor-default flex-col items-center px-3 text-sm text-mineshaft-400">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <div className="mb-2 w-full pl-5 duration-200 hover:text-mineshaft-200">
+                <FontAwesomeIcon icon={faQuestion} className="mr-3 px-[0.1rem]" />
+                Help & Support
+              </div>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="start" className="p-1">
+              {INFISICAL_SUPPORT_OPTIONS.map(([icon, text, url]) => (
+                <DropdownMenuItem key={url as string}>
+                  <a
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    href={String(url)}
+                    className="flex w-full items-center rounded-md font-normal text-mineshaft-300 duration-200"
+                  >
+                    <div className="relative flex w-full cursor-pointer select-none items-center justify-start rounded-md">
+                      {icon}
+                      <div className="text-sm">{text}</div>
+                    </div>
+                  </a>
+                </DropdownMenuItem>
+              ))}
+              {envConfig.PLATFORM_VERSION && (
+                <div className="mb-2 mt-2 w-full cursor-default pl-5 text-sm duration-200 hover:text-mineshaft-200">
+                  <FontAwesomeIcon icon={faInfo} className="mr-4 px-[0.1rem]" />
+                  Version: {envConfig.PLATFORM_VERSION}
+                </div>
+              )}
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </nav>
+    </aside>
+  );
+};
@@ -134,6 +134,24 @@ export const ProjectLayout = () => {
                              </MenuItem>
                            )}
                          </Link>
+                          <Link
+                            to={
+                              `/${ProjectType.CertificateManager}/$projectId/certificate-templates` as const
+                            }
+                            params={{
+                              projectId: currentWorkspace.id
+                            }}
+                          >
+                            {({ isActive }) => (
+                              <MenuItem
+                                iconMode="reverse"
+                                isSelected={isActive}
+                                icon="pki-template"
+                              >
+                                Certificate Templates
+                              </MenuItem>
+                            )}
+                          </Link>
                          <Link
                            to={
                              `/${ProjectType.CertificateManager}/$projectId/certificates` as const
@@ -44,3 +44,25 @@ export const timeAgo = (inputDate: Date, currentDate: Date): string => {
    elapsedMilliseconds >= 0 ? "ago" : "from now"
  }`;
 };
+
+export enum TimeUnit {
+  DAY = "days",
+  WEEK = "weeks",
+  MONTH = "months",
+  YEAR = "years"
+}
+
+export const convertTimeUnitValueToDays = (unit: TimeUnit, value: number) => {
+  switch (unit) {
+    case TimeUnit.DAY:
+      return value;
+    case TimeUnit.WEEK:
+      return value * 7;
+    case TimeUnit.MONTH:
+      return value * 30;
+    case TimeUnit.YEAR:
+      return value * 365;
+    default:
+      throw new Error(`Unknown time unit: ${unit}`);
+  }
+};
--- a/Show More
+++ b/Show More