Revert "Revert "Permission phase 2""

This reverts commit 8b9244b079.
2026-10-14 11:29:42 +00:00 · 2024-10-25 00:59:38 +05:30
parent 45b9de63f0
commit 93218d5a3f
100 changed files with 3390 additions and 1615 deletions
@@ -4,27 +4,40 @@ import { TableName } from "../schemas";

 export async function up(knex: Knex): Promise<void> {
  if (await knex.schema.hasTable(TableName.SecretSharing)) {
+    const hasEncryptedSecret = await knex.schema.hasColumn(TableName.SecretSharing, "encryptedSecret");
+    const hasIdentifier = await knex.schema.hasColumn(TableName.SecretSharing, "identifier");
+
    await knex.schema.alterTable(TableName.SecretSharing, (t) => {
      t.string("iv").nullable().alter();
      t.string("tag").nullable().alter();
      t.string("encryptedValue").nullable().alter();

-      t.binary("encryptedSecret").nullable();
+      if (!hasEncryptedSecret) {
+        t.binary("encryptedSecret").nullable();
+      }
      t.string("hashedHex").nullable().alter();

-      t.string("identifier", 64).nullable();
-      t.unique("identifier");
-      t.index("identifier");
+      if (!hasIdentifier) {
+        t.string("identifier", 64).nullable();
+        t.unique("identifier");
+        t.index("identifier");
+      }
    });
  }
 }

 export async function down(knex: Knex): Promise<void> {
+  const hasEncryptedSecret = await knex.schema.hasColumn(TableName.SecretSharing, "encryptedSecret");
+  const hasIdentifier = await knex.schema.hasColumn(TableName.SecretSharing, "identifier");
  if (await knex.schema.hasTable(TableName.SecretSharing)) {
    await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-      t.dropColumn("encryptedSecret");
+      if (hasEncryptedSecret) {
+        t.dropColumn("encryptedSecret");
+      }

-      t.dropColumn("identifier");
+      if (hasIdentifier) {
+        t.dropColumn("identifier");
+      }
    });
  }
 }
@@ -7,15 +7,18 @@ export async function up(knex: Knex): Promise<void> {
  if (await knex.schema.hasTable(TableName.KmsKey)) {
    const hasOrgId = await knex.schema.hasColumn(TableName.KmsKey, "orgId");
    const hasSlug = await knex.schema.hasColumn(TableName.KmsKey, "slug");
+    const hasProjectId = await knex.schema.hasColumn(TableName.KmsKey, "projectId");

    // drop constraint if exists (won't exist if rolled back, see below)
    await dropConstraintIfExists(TableName.KmsKey, "kms_keys_orgid_slug_unique", knex);

    // projectId for CMEK functionality
    await knex.schema.alterTable(TableName.KmsKey, (table) => {
-      table.string("projectId").nullable().references("id").inTable(TableName.Project).onDelete("CASCADE");
+      if (!hasProjectId) {
+        table.string("projectId").nullable().references("id").inTable(TableName.Project).onDelete("CASCADE");
+      }

-      if (hasOrgId) {
+      if (hasOrgId && hasSlug) {
        table.unique(["orgId", "projectId", "slug"]);
      }

@@ -30,6 +33,7 @@ export async function down(knex: Knex): Promise<void> {
  if (await knex.schema.hasTable(TableName.KmsKey)) {
    const hasOrgId = await knex.schema.hasColumn(TableName.KmsKey, "orgId");
    const hasName = await knex.schema.hasColumn(TableName.KmsKey, "name");
+    const hasProjectId = await knex.schema.hasColumn(TableName.KmsKey, "projectId");

    // remove projectId for CMEK functionality
    await knex.schema.alterTable(TableName.KmsKey, (table) => {
@@ -40,7 +44,9 @@ export async function down(knex: Knex): Promise<void> {
      if (hasOrgId) {
        table.dropUnique(["orgId", "projectId", "slug"]);
      }
-      table.dropColumn("projectId");
+      if (hasProjectId) {
+        table.dropColumn("projectId");
+      }
    });
  }
 }
@@ -0,0 +1,101 @@
+/* eslint-disable no-await-in-loop */
+import { packRules, unpackRules } from "@casl/ability/extra";
+import { Knex } from "knex";
+
+import {
+  backfillPermissionV1SchemaToV2Schema,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
+
+import { TableName } from "../schemas";
+
+const CHUNK_SIZE = 1000;
+export async function up(knex: Knex): Promise<void> {
+  const hasVersion = await knex.schema.hasColumn(TableName.ProjectRoles, "version");
+  if (!hasVersion) {
+    await knex.schema.alterTable(TableName.ProjectRoles, (t) => {
+      t.integer("version").defaultTo(1).notNullable();
+    });
+
+    const docs = await knex(TableName.ProjectRoles).select("*");
+    const updatedDocs = docs
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (updatedDocs.length) {
+      for (let i = 0; i < updatedDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.ProjectRoles).insert(chunk).onConflict("id").merge();
+      }
+    }
+
+    // secret permission is split into multiple ones like secrets, folders, imports and dynamic-secrets
+    // so we just find all the privileges with respective mapping and map it as needed
+    const identityPrivileges = await knex(TableName.IdentityProjectAdditionalPrivilege).select("*");
+    const updatedIdentityPrivilegesDocs = identityPrivileges
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets) &&
+          !permissionString.includes(ProjectPermissionSub.SecretFolders)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (updatedIdentityPrivilegesDocs.length) {
+      for (let i = 0; i < updatedIdentityPrivilegesDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedIdentityPrivilegesDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.IdentityProjectAdditionalPrivilege).insert(chunk).onConflict("id").merge();
+      }
+    }
+
+    const userPrivileges = await knex(TableName.ProjectUserAdditionalPrivilege).select("*");
+    const updatedUserPrivilegeDocs = userPrivileges
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets) &&
+          !permissionString.includes(ProjectPermissionSub.SecretFolders)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (docs.length) {
+      for (let i = 0; i < updatedUserPrivilegeDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedUserPrivilegeDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.ProjectUserAdditionalPrivilege).insert(chunk).onConflict("id").merge();
+      }
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasVersion = await knex.schema.hasColumn(TableName.ProjectRoles, "version");
+  if (hasVersion) {
+    await knex.schema.alterTable(TableName.ProjectRoles, (t) => {
+      t.dropColumn("version");
+    });
+
+    // permission change can be ignored
+  }
+}
@@ -4,6 +4,7 @@ import ms from "ms";
 import { z } from "zod";

 import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-types";
+import { backfillPermissionV1SchemaToV2Schema } from "@app/ee/services/permission/project-permission";
 import { IDENTITY_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -79,7 +80,9 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
        ...req.body,
        slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
        isTemporary: false,
-        permissions: JSON.stringify(packRules(permission))
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
      });
      return { privilege };
    }
@@ -159,7 +162,9 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
        ...req.body,
        slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
        isTemporary: true,
-        permissions: JSON.stringify(packRules(permission))
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
      });
      return { privilege };
    }
@@ -244,7 +249,11 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
        projectSlug: req.body.projectSlug,
        data: {
          ...updatedInfo,
-          permissions: permission ? JSON.stringify(packRules(permission)) : undefined
+          permissions: permission
+            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+              // @ts-ignore-error this is valid ts
+              JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
+            : undefined
        }
      });
      return { privilege };
@@ -3,7 +3,10 @@ import slugify from "@sindresorhus/slugify";
 import { z } from "zod";

 import { ProjectMembershipRole, ProjectMembershipsSchema, ProjectRolesSchema } from "@app/db/schemas";
-import { ProjectPermissionSchema } from "@app/ee/services/permission/project-permission";
+import {
+  backfillPermissionV1SchemaToV2Schema,
+  ProjectPermissionV1Schema
+} from "@app/ee/services/permission/project-permission";
 import { PROJECT_ROLE } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -43,7 +46,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
          .describe(PROJECT_ROLE.CREATE.slug),
        name: z.string().min(1).trim().describe(PROJECT_ROLE.CREATE.name),
        description: z.string().trim().optional().describe(PROJECT_ROLE.CREATE.description),
-        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.CREATE.permissions)
+        permissions: ProjectPermissionV1Schema.array().describe(PROJECT_ROLE.CREATE.permissions)
      }),
      response: {
        200: z.object({
@@ -61,7 +64,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
        projectSlug: req.params.projectSlug,
        data: {
          ...req.body,
-          permissions: JSON.stringify(packRules(req.body.permissions))
+          permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions)))
        }
      });
      return { role };
@@ -103,7 +106,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
          }),
        name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
        description: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.description),
-        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
+        permissions: ProjectPermissionV1Schema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
      }),
      response: {
        200: z.object({
@@ -122,7 +125,9 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
        roleId: req.params.roleId,
        data: {
          ...req.body,
-          permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
+          permissions: req.body.permissions
+            ? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions)))
+            : undefined
        }
      });
      return { role };
@@ -1,13 +1,16 @@
+import { packRules } from "@casl/ability/extra";
 import slugify from "@sindresorhus/slugify";
 import ms from "ms";
 import { z } from "zod";

 import { ProjectUserAdditionalPrivilegeSchema } from "@app/db/schemas";
+import { backfillPermissionV1SchemaToV2Schema } from "@app/ee/services/permission/project-permission";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
 import { PROJECT_USER_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { ProjectSpecificPrivilegePermissionSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";

 export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodProvider) => {
@@ -31,7 +34,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
          })
          .optional()
          .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.slug),
-        permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions)
+        permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+          PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions
+        )
      }),
      response: {
        200: z.object({
@@ -49,7 +54,17 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
        ...req.body,
        slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
        isTemporary: false,
-        permissions: JSON.stringify(req.body.permissions)
+        permissions: JSON.stringify(
+          packRules(
+            backfillPermissionV1SchemaToV2Schema(
+              req.body.permissions.actions.map((action) => ({
+                action,
+                subject: req.body.permissions.subject,
+                conditions: req.body.permissions.conditions
+              }))
+            )
+          )
+        )
      });
      return { privilege };
    }
@@ -75,7 +90,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
          })
          .optional()
          .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.slug),
-        permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions),
+        permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+          PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions
+        ),
        temporaryMode: z
          .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
          .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.temporaryMode),
@@ -104,7 +121,17 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
        ...req.body,
        slug: req.body.slug ? slugify(req.body.slug) : `privilege-${slugify(alphaNumericNanoId(12))}`,
        isTemporary: true,
-        permissions: JSON.stringify(req.body.permissions)
+        permissions: JSON.stringify(
+          packRules(
+            backfillPermissionV1SchemaToV2Schema(
+              req.body.permissions.actions.map((action) => ({
+                action,
+                subject: req.body.permissions.subject,
+                conditions: req.body.permissions.conditions
+              }))
+            )
+          )
+        )
      });
      return { privilege };
    }
@@ -131,7 +158,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
              message: "Slug must be a valid slug"
            })
            .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.slug),
-          permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions),
+          permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+            PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions
+          ).optional(),
          isTemporary: z.boolean().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.isTemporary),
          temporaryMode: z
            .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
@@ -160,7 +189,19 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
        actorOrgId: req.permission.orgId,
        actorAuthMethod: req.permission.authMethod,
        ...req.body,
-        permissions: req.body.permissions ? JSON.stringify(req.body.permissions) : undefined,
+        permissions: req.body.permissions
+          ? JSON.stringify(
+              packRules(
+                backfillPermissionV1SchemaToV2Schema(
+                  req.body.permissions.actions.map((action) => ({
+                    action,
+                    subject: req.body.permissions!.subject,
+                    conditions: req.body.permissions!.conditions
+                  }))
+                )
+              )
+            )
+          : undefined,
        privilegeId: req.params.privilegeId
      });
      return { privilege };
@@ -0,0 +1,11 @@
+import { registerProjectRoleRouter } from "./project-role-router";
+
+export const registerV2EERoutes = async (server: FastifyZodProvider) => {
+  // org role starts with organization
+  await server.register(
+    async (projectRouter) => {
+      await projectRouter.register(registerProjectRoleRouter);
+    },
+    { prefix: "/workspace" }
+  );
+};
@@ -0,0 +1,272 @@
+import { packRules } from "@casl/ability/extra";
+import slugify from "@sindresorhus/slugify";
+import { z } from "zod";
+
+import { ProjectMembershipRole, ProjectMembershipsSchema, ProjectRolesSchema } from "@app/db/schemas";
+import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
+import { PROJECT_ROLE } from "@app/lib/api-docs";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { SanitizedRoleSchema } from "@app/server/routes/sanitizedSchemas";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/:projectSlug/roles",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Create a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.CREATE.projectSlug)
+      }),
+      body: z.object({
+        slug: z
+          .string()
+          .toLowerCase()
+          .trim()
+          .min(1)
+          .refine(
+            (val) => !Object.values(ProjectMembershipRole).includes(val as ProjectMembershipRole),
+            "Please choose a different slug, the slug you have entered is reserved"
+          )
+          .refine((v) => slugify(v) === v, {
+            message: "Slug must be a valid"
+          })
+          .describe(PROJECT_ROLE.CREATE.slug),
+        name: z.string().min(1).trim().describe(PROJECT_ROLE.CREATE.name),
+        description: z.string().trim().optional().describe(PROJECT_ROLE.CREATE.description),
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.CREATE.permissions)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.createRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        data: {
+          ...req.body,
+          permissions: JSON.stringify(packRules(req.body.permissions))
+        }
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:projectSlug/roles/:roleId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Update a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.UPDATE.projectSlug),
+        roleId: z.string().trim().describe(PROJECT_ROLE.UPDATE.roleId)
+      }),
+      body: z.object({
+        slug: z
+          .string()
+          .toLowerCase()
+          .trim()
+          .optional()
+          .describe(PROJECT_ROLE.UPDATE.slug)
+          .refine(
+            (val) =>
+              typeof val === "undefined" ||
+              !Object.values(ProjectMembershipRole).includes(val as ProjectMembershipRole),
+            "Please choose a different slug, the slug you have entered is reserved"
+          )
+          .refine((val) => typeof val === "undefined" || slugify(val) === val, {
+            message: "Slug must be a valid"
+          }),
+        name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
+        description: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.description),
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.updateRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleId: req.params.roleId,
+        data: {
+          ...req.body,
+          permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
+        }
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:projectSlug/roles/:roleId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Delete a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.DELETE.projectSlug),
+        roleId: z.string().trim().describe(PROJECT_ROLE.DELETE.roleId)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.deleteRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleId: req.params.roleId
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectSlug/roles",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      description: "List project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.LIST.projectSlug)
+      }),
+      response: {
+        200: z.object({
+          roles: ProjectRolesSchema.omit({ permissions: true }).array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const roles = await server.services.projectRole.listRoles({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug
+      });
+      return { roles };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectSlug/roles/slug/:roleSlug",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.GET_ROLE_BY_SLUG.projectSlug),
+        roleSlug: z.string().trim().describe(PROJECT_ROLE.GET_ROLE_BY_SLUG.roleSlug)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.getRoleBySlug({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleSlug: req.params.roleSlug
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/permissions",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          data: z.object({
+            membership: ProjectMembershipsSchema.extend({
+              roles: z
+                .object({
+                  role: z.string()
+                })
+                .array()
+            }),
+            permissions: z.any().array()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { permissions, membership } = await server.services.projectRole.getUserPermission(
+        req.permission.id,
+        req.params.projectId,
+        req.permission.authMethod,
+        req.permission.orgId
+      );
+
+      return { data: { permissions, membership } };
+    }
+  });
+};
@@ -14,7 +14,7 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {

  const accessApprovalPolicyFindQuery = async (
    tx: Knex,
-    filter: TFindFilter<TAccessApprovalPolicies>,
+    filter: TFindFilter<TAccessApprovalPolicies & { projectId: string }>,
    customFilter?: {
      policyId?: string;
    }
@@ -1,36 +0,0 @@
-import { ForbiddenError, subject } from "@casl/ability";
-
-import { ActorType } from "@app/services/auth/auth-type";
-
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
-import { TIsApproversValid } from "./access-approval-policy-types";
-
-export const isApproversValid = async ({
-  userIds,
-  projectId,
-  orgId,
-  envSlug,
-  actorAuthMethod,
-  secretPath,
-  permissionService
-}: TIsApproversValid) => {
-  try {
-    for await (const userId of userIds) {
-      const { permission: approverPermission } = await permissionService.getProjectPermission(
-        ActorType.USER,
-        userId,
-        projectId,
-        actorAuthMethod,
-        orgId
-      );
-
-      ForbiddenError.from(approverPermission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.Secrets, { environment: envSlug, secretPath })
-      );
-    }
-  } catch {
-    return false;
-  }
-  return true;
-};
@@ -11,7 +11,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TAccessApprovalPolicyApproverDALFactory } from "./access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "./access-approval-policy-dal";
-import { isApproversValid } from "./access-approval-policy-fns";
 import {
  ApproverType,
  TCreateAccessApprovalPolicy,
@@ -134,22 +133,6 @@ export const accessApprovalPolicyServiceFactory = ({
      .map((user) => user.id);
    verifyAllApprovers.push(...verifyGroupApprovers);

-    const approversValid = await isApproversValid({
-      projectId: project.id,
-      orgId: actorOrgId,
-      envSlug: environment,
-      secretPath,
-      actorAuthMethod,
-      permissionService,
-      userIds: verifyAllApprovers
-    });
-
-    if (!approversValid) {
-      throw new BadRequestError({
-        message: "One or more approvers doesn't have access to be specified secret path"
-      });
-    }
-
    const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => {
      const doc = await accessApprovalPolicyDAL.create(
        {
@@ -293,22 +276,6 @@ export const accessApprovalPolicyServiceFactory = ({
          userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
        }

-        const approversValid = await isApproversValid({
-          projectId: accessApprovalPolicy.projectId,
-          orgId: actorOrgId,
-          envSlug: accessApprovalPolicy.environment.slug,
-          secretPath: doc.secretPath!,
-          actorAuthMethod,
-          permissionService,
-          userIds: userApproverIds
-        });
-
-        if (!approversValid) {
-          throw new BadRequestError({
-            message: "One or more approvers doesn't have access to be specified secret path"
-          });
-        }
-
        await accessApprovalPolicyApproverDAL.insertMany(
          userApproverIds.map((userId) => ({
            approverUserId: userId,
@@ -319,45 +286,6 @@ export const accessApprovalPolicyServiceFactory = ({
      }

      if (groupApprovers) {
-        const usersPromises: Promise<
-          {
-            id: string;
-            email: string | null | undefined;
-            username: string;
-            firstName: string | null | undefined;
-            lastName: string | null | undefined;
-            isPartOfGroup: boolean;
-          }[]
-        >[] = [];
-
-        for (const groupId of groupApprovers) {
-          usersPromises.push(
-            groupDAL
-              .findAllGroupPossibleMembers({ orgId: actorOrgId, groupId, offset: 0 })
-              .then((group) => group.members)
-          );
-        }
-        const verifyGroupApprovers = (await Promise.all(usersPromises))
-          .flat()
-          .filter((user) => user.isPartOfGroup)
-          .map((user) => user.id);
-
-        const approversValid = await isApproversValid({
-          projectId: accessApprovalPolicy.projectId,
-          orgId: actorOrgId,
-          envSlug: accessApprovalPolicy.environment.slug,
-          secretPath: doc.secretPath!,
-          actorAuthMethod,
-          permissionService,
-          userIds: verifyGroupApprovers
-        });
-
-        if (!approversValid) {
-          throw new BadRequestError({
-            message: "One or more approvers doesn't have access to be specified secret path"
-          });
-        }
-
        await accessApprovalPolicyApproverDAL.insertMany(
          groupApprovers.map((groupId) => ({
            approverGroupId: groupId,
@@ -17,7 +17,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal";

 import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-policy/access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
-import { isApproversValid } from "../access-approval-policy/access-approval-policy-fns";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -78,7 +77,6 @@ export const accessApprovalRequestServiceFactory = ({
  permissionService,
  accessApprovalRequestDAL,
  accessApprovalRequestReviewerDAL,
-  projectMembershipDAL,
  accessApprovalPolicyDAL,
  accessApprovalPolicyApproverDAL,
  additionalPrivilegeDAL,
@@ -331,22 +329,6 @@ export const accessApprovalRequestServiceFactory = ({
      throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
    }

-    const reviewerProjectMembership = await projectMembershipDAL.findById(membership.id);
-
-    const approversValid = await isApproversValid({
-      projectId: accessApprovalRequest.projectId,
-      orgId: actorOrgId,
-      envSlug: accessApprovalRequest.environment,
-      secretPath: accessApprovalRequest.policy.secretPath!,
-      actorAuthMethod,
-      permissionService,
-      userIds: [reviewerProjectMembership.userId]
-    });
-
-    if (!approversValid) {
-      throw new ForbiddenRequestError({ message: "You don't have access to approve this request" });
-    }
-
    const existingReviews = await accessApprovalRequestReviewerDAL.find({ requestId: accessApprovalRequest.id });
    if (existingReviews.some((review) => review.status === ApprovalStatus.REJECTED)) {
      throw new BadRequestError({ message: "The request has already been rejected by another reviewer" });
@@ -4,7 +4,10 @@ import ms from "ms";
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -72,8 +75,8 @@ export const dynamicSecretLeaseServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.Lease,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const plan = await licenseService.getPlan(actorOrgId);
@@ -151,8 +154,8 @@ export const dynamicSecretLeaseServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.Lease,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const plan = await licenseService.getPlan(actorOrgId);
@@ -230,8 +233,8 @@ export const dynamicSecretLeaseServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.Lease,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -299,8 +302,8 @@ export const dynamicSecretLeaseServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.Lease,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -341,8 +344,8 @@ export const dynamicSecretLeaseServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.Lease,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -3,7 +3,10 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection } from "@app/lib/types";
@@ -77,8 +80,8 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const plan = await licenseService.getPlan(actorOrgId);
@@ -148,8 +151,8 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const plan = await licenseService.getPlan(actorOrgId);
@@ -231,8 +234,8 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -291,8 +294,12 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -340,8 +347,8 @@ export const dynamicSecretServiceFactory = ({
      // verify user has access to each env in request
      environmentSlugs.forEach((environmentSlug) =>
        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+          ProjectPermissionDynamicSecretActions.ReadRootCredential,
+          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
        )
      );
    }
@@ -380,8 +387,8 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -428,8 +435,8 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -471,8 +478,8 @@ export const dynamicSecretServiceFactory = ({
      // verify user has access to each env in request
      environmentSlugs.forEach((environmentSlug) =>
        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+          ProjectPermissionDynamicSecretActions.ReadRootCredential,
+          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
        )
      );
    }
@@ -1,10 +1,10 @@
 import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
-import { z } from "zod";

 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
@@ -32,16 +32,6 @@ export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
  typeof identityProjectAdditionalPrivilegeServiceFactory
 >;

-// TODO(akhilmhdh): move this to more centralized
-export const UnpackedPermissionSchema = z.object({
-  subject: z
-    .union([z.string().min(1), z.string().array()])
-    .transform((el) => (typeof el !== "string" ? el[0] : el))
-    .optional(),
-  action: z.union([z.string().min(1), z.string().array()]).transform((el) => (typeof el === "string" ? [el] : el)),
-  conditions: z.unknown().optional()
-});
-
 const unpackPermissions = (permissions: unknown) =>
  UnpackedPermissionSchema.array().parse(
    unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
@@ -207,7 +197,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
    });
    return {
      ...additionalPrivilege,
-
      permissions: unpackPermissions(additionalPrivilege.permissions)
    };
  };
@@ -335,7 +324,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
    });
    return identityPrivileges.map((el) => ({
      ...el,
-
      permissions: unpackPermissions(el.permissions)
    }));
  };
@@ -67,7 +67,7 @@ export const permissionServiceFactory = ({
            throw new NotFoundError({ name: "OrgRoleInvalid", message: `Organization role '${role}' not found` });
        }
      })
-      .reduce((curr, prev) => prev.concat(curr), []);
+      .reduce((prev, curr) => prev.concat(curr), []);

    return createMongoAbility<OrgPermissionSet>(rules, {
      conditionsMatcher
@@ -98,7 +98,7 @@ export const permissionServiceFactory = ({
            });
        }
      })
-      .reduce((curr, prev) => prev.concat(curr), []);
+      .reduce((prev, curr) => prev.concat(curr), []);

    return rules;
  };
@@ -11,8 +11,8 @@ export enum PermissionConditionOperators {
 }

 export const PermissionConditionSchema = {
-  [PermissionConditionOperators.$IN]: z.string().min(1).array(),
-  [PermissionConditionOperators.$ALL]: z.string().min(1).array(),
+  [PermissionConditionOperators.$IN]: z.string().trim().min(1).array(),
+  [PermissionConditionOperators.$ALL]: z.string().trim().min(1).array(),
  [PermissionConditionOperators.$REGEX]: z
    .string()
    .min(1)
@@ -1,9 +1,8 @@
 import { AbilityBuilder, createMongoAbility, ForcedSubject, MongoAbility } from "@casl/ability";
 import { z } from "zod";

-import { TableName } from "@app/db/schemas";
 import { conditionsMatcher } from "@app/lib/casl";
-import { BadRequestError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";

 import { PermissionConditionOperators, PermissionConditionSchema } from "./permission-types";

@@ -23,6 +22,14 @@ export enum ProjectPermissionCmekActions {
  Decrypt = "decrypt"
 }

+export enum ProjectPermissionDynamicSecretActions {
+  ReadRootCredential = "read-root-credential",
+  CreateRootCredential = "create-root-credential",
+  EditRootCredential = "edit-root-credential",
+  DeleteRootCredential = "delete-root-credential",
+  Lease = "lease"
+}
+
 export enum ProjectPermissionSub {
  Role = "role",
  Member = "member",
@@ -38,6 +45,8 @@ export enum ProjectPermissionSub {
  Project = "workspace",
  Secrets = "secrets",
  SecretFolders = "secret-folders",
+  SecretImports = "secret-imports",
+  DynamicSecrets = "dynamic-secrets",
  SecretRollback = "secret-rollback",
  SecretApproval = "secret-approval",
  SecretRotation = "secret-rotation",
@@ -54,19 +63,8 @@ export enum ProjectPermissionSub {
 export type SecretSubjectFields = {
  environment: string;
  secretPath: string;
-  // secretName: string;
-  // secretTags: string[];
-};
-
-export const CaslSecretsV2SubjectKnexMapper = (field: string) => {
-  switch (field) {
-    case "secretName":
-      return `${TableName.SecretV2}.key`;
-    case "secretTags":
-      return `${TableName.SecretTag}.slug`;
-    default:
-      break;
-  }
+  secretName?: string;
+  secretTags?: string[];
 };

 export type SecretFolderSubjectFields = {
@@ -74,6 +72,16 @@ export type SecretFolderSubjectFields = {
  secretPath: string;
 };

+export type DynamicSecretSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
+export type SecretImportSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
 export type ProjectPermissionSet =
  | [
      ProjectPermissionActions,
@@ -86,6 +94,20 @@ export type ProjectPermissionSet =
        | (ForcedSubject<ProjectPermissionSub.SecretFolders> & SecretFolderSubjectFields)
      )
    ]
+  | [
+      ProjectPermissionDynamicSecretActions,
+      (
+        | ProjectPermissionSub.DynamicSecrets
+        | (ForcedSubject<ProjectPermissionSub.DynamicSecrets> & DynamicSecretSubjectFields)
+      )
+    ]
+  | [
+      ProjectPermissionActions,
+      (
+        | ProjectPermissionSub.SecretImports
+        | (ForcedSubject<ProjectPermissionSub.SecretImports> & SecretImportSubjectFields)
+      )
+    ]
  | [ProjectPermissionActions, ProjectPermissionSub.Role]
  | [ProjectPermissionActions, ProjectPermissionSub.Tags]
  | [ProjectPermissionActions, ProjectPermissionSub.Member]
@@ -120,7 +142,9 @@ const CASL_ACTION_SCHEMA_NATIVE_ENUM = <ACTION extends z.EnumLike>(actions: ACTI
 const CASL_ACTION_SCHEMA_ENUM = <ACTION extends z.EnumValues>(actions: ACTION) =>
  z.union([z.enum(actions), z.enum(actions).array().min(1)]).transform((el) => (typeof el === "string" ? [el] : el));

-const SecretConditionSchema = z
+// akhilmhdh: don't modify this for v2
+// if you want to update create a new schema
+const SecretConditionV1Schema = z
  .object({
    environment: z.union([
      z.string(),
@@ -146,16 +170,50 @@ const SecretConditionSchema = z
  })
  .partial();

-export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
-  z.object({
-    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
-      "Describe what action an entity can take."
-    ),
-    conditions: SecretConditionSchema.describe(
-      "When specified, only matching conditions will be allowed to access given resource."
-    ).optional()
-  }),
+const SecretConditionV2Schema = z
+  .object({
+    environment: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretPath: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretName: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretTags: z
+      .object({
+        [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+      })
+      .partial()
+  })
+  .partial();
+
+const GeneralPermissionSchema = [
  z.object({
    subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
@@ -259,7 +317,7 @@ export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
    )
  }),
  z.object({
-    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to. "),
+    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
      "Describe what action an entity can take."
    )
@@ -288,18 +346,78 @@ export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
      "Describe what action an entity can take."
    )
  }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_ENUM([ProjectPermissionActions.Read]).describe(
-      "Describe what action an entity can take."
-    )
-  }),
  z.object({
    subject: z.literal(ProjectPermissionSub.Cmek).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCmekActions).describe(
      "Describe what action an entity can take."
    )
  })
+];
+
+export const ProjectPermissionV1Schema = z.discriminatedUnion("subject", [
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_ENUM([ProjectPermissionActions.Read]).describe(
+      "Describe what action an entity can take."
+    )
+  }),
+  ...GeneralPermissionSchema
+]);
+
+export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV2Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretImports).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.DynamicSecrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionDynamicSecretActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  ...GeneralPermissionSchema
 ]);

 const buildAdminPermissionRules = () => {
@@ -308,6 +426,8 @@ const buildAdminPermissionRules = () => {
  // Admins get full access to everything
  [
    ProjectPermissionSub.Secrets,
+    ProjectPermissionSub.SecretFolders,
+    ProjectPermissionSub.SecretImports,
    ProjectPermissionSub.SecretApproval,
    ProjectPermissionSub.SecretRotation,
    ProjectPermissionSub.Member,
@@ -339,6 +459,17 @@ const buildAdminPermissionRules = () => {
    );
  });

+  can(
+    [
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
+      ProjectPermissionDynamicSecretActions.Lease
+    ],
+    ProjectPermissionSub.DynamicSecrets
+  );
+
  can([ProjectPermissionActions.Edit, ProjectPermissionActions.Delete], ProjectPermissionSub.Project);
  can([ProjectPermissionActions.Read, ProjectPermissionActions.Create], ProjectPermissionSub.SecretRollback);
  can([ProjectPermissionActions.Edit], ProjectPermissionSub.Kms);
@@ -370,6 +501,34 @@ const buildMemberPermissionRules = () => {
    ],
    ProjectPermissionSub.Secrets
  );
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
+    ],
+    ProjectPermissionSub.SecretFolders
+  );
+  can(
+    [
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
+      ProjectPermissionDynamicSecretActions.Lease
+    ],
+    ProjectPermissionSub.DynamicSecrets
+  );
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
+    ],
+    ProjectPermissionSub.SecretImports
+  );

  can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretApproval);
  can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretRotation);
@@ -493,6 +652,9 @@ const buildViewerPermissionRules = () => {
  const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);

  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
+  can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation);
@@ -595,17 +757,52 @@ export const isAtLeastAsPrivilegedWorkspace = (
 };
 /* eslint-enable */

-export const SecretV2SubjectFieldMapper = (arg: string) => {
-  switch (arg) {
-    case "environment":
-      return null;
-    case "secretPath":
-      return null;
-    case "secretName":
-      return `${TableName.SecretV2}.key`;
-    case "secretTags":
-      return `${TableName.SecretTag}.slug`;
-    default:
-      throw new BadRequestError({ message: `Invalid dynamic knex operator field: ${arg}` });
-  }
+export const backfillPermissionV1SchemaToV2Schema = (data: z.infer<typeof ProjectPermissionV1Schema>[]) => {
+  const formattedData = UnpackedPermissionSchema.array().parse(data);
+  const secretSubjects = formattedData.filter((el) => el.subject === ProjectPermissionSub.Secrets);
+
+  // this means the folder permission as readonly is set
+  const hasReadOnlyFolder = formattedData.filter((el) => el.subject === ProjectPermissionSub.SecretFolders);
+  const secretImportPolicies = secretSubjects.map(({ subject, ...el }) => ({
+    ...el,
+    subject: ProjectPermissionSub.SecretImports as const
+  }));
+
+  const secretFolderPolicies = secretSubjects.map(({ subject, ...el }) => ({
+    ...el,
+    subject: ProjectPermissionSub.SecretFolders
+  }));
+
+  const dynamicSecretPolicies = secretSubjects.map(({ subject, ...el }) => {
+    const action = el.action.map((e) => {
+      switch (e) {
+        case ProjectPermissionActions.Edit:
+          return ProjectPermissionDynamicSecretActions.EditRootCredential;
+        case ProjectPermissionActions.Create:
+          return ProjectPermissionDynamicSecretActions.CreateRootCredential;
+        case ProjectPermissionActions.Delete:
+          return ProjectPermissionDynamicSecretActions.DeleteRootCredential;
+        case ProjectPermissionActions.Read:
+          return ProjectPermissionDynamicSecretActions.ReadRootCredential;
+        default:
+          return ProjectPermissionDynamicSecretActions.ReadRootCredential;
+      }
+    });
+
+    return {
+      ...el,
+      action: el.action.includes(ProjectPermissionActions.Edit)
+        ? [...action, ProjectPermissionDynamicSecretActions.Lease]
+        : action,
+      subject: ProjectPermissionSub.DynamicSecrets
+    };
+  });
+
+  return formattedData.concat(
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore-error this is valid ts
+    secretImportPolicies,
+    dynamicSecretPolicies,
+    hasReadOnlyFolder.length ? [] : secretFolderPolicies
+  );
 };
@@ -1,11 +1,13 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
+import { PackRule, unpackRules } from "@casl/ability/extra";
 import ms from "ms";

 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";

 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSet, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "./project-user-additional-privilege-dal";
 import {
  ProjectUserAdditionalPrivilegeTemporaryMode,
@@ -26,6 +28,11 @@ export type TProjectUserAdditionalPrivilegeServiceFactory = ReturnType<
  typeof projectUserAdditionalPrivilegeServiceFactory
 >;

+const unpackPermissions = (permissions: unknown) =>
+  UnpackedPermissionSchema.array().parse(
+    unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
+  );
+
 export const projectUserAdditionalPrivilegeServiceFactory = ({
  projectUserAdditionalPrivilegeDAL,
  projectMembershipDAL,
@@ -68,7 +75,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
        slug,
        permissions: customPermission
      });
-      return additionalPrivilege;
+      return {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      };
    }

    const relativeTempAllocatedTimeInMs = ms(dto.temporaryRange);
@@ -83,7 +93,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
      temporaryAccessStartTime: new Date(dto.temporaryAccessStartTime),
      temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
    });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: unpackPermissions(additionalPrivilege.permissions)
+    };
  };

  const updateById = async ({
@@ -136,7 +149,11 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
        temporaryAccessStartTime: new Date(temporaryAccessStartTime || ""),
        temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
      });
-      return additionalPrivilege;
+
+      return {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      };
    }

    const additionalPrivilege = await projectUserAdditionalPrivilegeDAL.updateById(userPrivilege.id, {
@@ -147,7 +164,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
      temporaryRange: null,
      temporaryMode: null
    });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: unpackPermissions(additionalPrivilege.permissions)
+    };
  };

  const deleteById = async ({ actorId, actor, actorOrgId, actorAuthMethod, privilegeId }: TDeleteUserPrivilegeDTO) => {
@@ -174,7 +194,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);

    const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
-    return deletedPrivilege;
+    return {
+      ...deletedPrivilege,
+      permissions: unpackPermissions(deletedPrivilege.permissions)
+    };
  };

  const getPrivilegeDetailsById = async ({
@@ -206,7 +229,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);

-    return userPrivilege;
+    return {
+      ...userPrivilege,
+      permissions: unpackPermissions(userPrivilege.permissions)
+    };
  };

  const listPrivileges = async ({
@@ -233,7 +259,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
      userId: projectMembership.userId,
      projectId: projectMembership.projectId
    });
-    return userPrivileges;
+    return userPrivileges.map((el) => ({
+      ...el,
+      permissions: unpackPermissions(el.permissions)
+    }));
  };

  return {
@@ -14,7 +14,7 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {

  const secretApprovalPolicyFindQuery = (
    tx: Knex,
-    filter: TFindFilter<TSecretApprovalPolicies>,
+    filter: TFindFilter<TSecretApprovalPolicies & { projectId: string }>,
    customFilter?: {
      sapId?: string;
    }
@@ -1,4 +1,4 @@
-import { ForbiddenError, subject } from "@casl/ability";
+import { ForbiddenError } from "@casl/ability";
 import picomatch from "picomatch";

 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -356,17 +356,8 @@ export const secretApprovalPolicyServiceFactory = ({
    environment,
    secretPath
  }: TGetBoardSapDTO) => {
-    const { permission } = await permissionService.getProjectPermission(
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { secretPath, environment })
-    );
+    await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod, actorOrgId);
+
    return getSecretApprovalPolicy(projectId, environment, secretPath);
  };

@@ -43,7 +43,7 @@ import {
  fnSecretBulkDelete as fnSecretV2BridgeBulkDelete,
  fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
  fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
+  getAllSecretReferences as getAllSecretReferencesV2Bridge
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
@@ -531,11 +531,11 @@ export const secretApprovalRequestServiceFactory = ({
                skipMultilineEncoding: el.skipMultilineEncoding,
                key: el.key,
                references: el.encryptedValue
-                  ? getAllNestedSecretReferencesV2Bridge(
+                  ? getAllSecretReferencesV2Bridge(
                      secretManagerDecryptor({
                        cipherTextBlob: el.encryptedValue
                      }).toString()
-                    )
+                    ).nestedReferences
                  : [],
                type: SecretType.Shared
              })),
@@ -555,11 +555,11 @@ export const secretApprovalRequestServiceFactory = ({
                    ? {
                        encryptedValue: el.encryptedValue as Buffer,
                        references: el.encryptedValue
-                          ? getAllNestedSecretReferencesV2Bridge(
+                          ? getAllSecretReferencesV2Bridge(
                              secretManagerDecryptor({
                                cipherTextBlob: el.encryptedValue
                              }).toString()
-                            )
+                            ).nestedReferences
                          : []
                      }
                    : {};
@@ -1143,10 +1143,6 @@ export const secretApprovalRequestServiceFactory = ({
      actorAuthMethod,
      actorOrgId
    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-    );

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
    if (!folder)
@@ -1309,7 +1305,24 @@ export const secretApprovalRequestServiceFactory = ({

    const tagIds = unique(Object.values(commitTagIds).flat());
    const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "One or more tags not found" });
+    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
+    const tagsGroupById = groupBy(tags, (i) => i.id);
+
+    commits.forEach((commit) => {
+      let action = ProjectPermissionActions.Create;
+      if (commit.op === SecretOperations.Update) action = ProjectPermissionActions.Edit;
+      if (commit.op === SecretOperations.Delete) action = ProjectPermissionActions.Delete;
+
+      ForbiddenError.from(permission).throwUnlessCan(
+        action,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName: commit.key,
+          secretTags: commitTagIds?.[commit.key]?.map((secretTagId) => tagsGroupById[secretTagId][0].slug)
+        })
+      );
+    });

    const secretApprovalRequest = await secretApprovalRequestDAL.transaction(async (tx) => {
      const doc = await secretApprovalRequestDAL.create(
@@ -28,8 +28,7 @@ import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret
 import {
  fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
  fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences,
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
+  getAllSecretReferences
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
@@ -253,11 +252,12 @@ export const secretReplicationServiceFactory = ({
      const sourceLocalSecrets = await secretV2BridgeDAL.find({ folderId: folder.id, type: SecretType.Shared });
      const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id });
      const sourceImportedSecrets = await fnSecretsV2FromImports({
-        allowedImports: sourceSecretImports,
+        secretImports: sourceSecretImports,
        secretDAL: secretV2BridgeDAL,
        folderDAL,
        secretImportDAL,
-        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : "")
+        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
+        hasSecretAccess: () => true
      });
      // secrets that gets replicated across imports
      const sourceDecryptedLocalSecrets = sourceLocalSecrets.map((el) => ({
@@ -419,7 +419,7 @@ export const secretReplicationServiceFactory = ({
                        encryptedValue: doc.encryptedValue,
                        encryptedComment: doc.encryptedComment,
                        skipMultilineEncoding: doc.skipMultilineEncoding,
-                        references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : []
+                        references: doc.secretValue ? getAllSecretReferences(doc.secretValue).nestedReferences : []
                      };
                    })
                  });
@@ -445,7 +445,7 @@ export const secretReplicationServiceFactory = ({
                          encryptedValue: doc.encryptedValue as Buffer,
                          encryptedComment: doc.encryptedComment,
                          skipMultilineEncoding: doc.skipMultilineEncoding,
-                          references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : []
+                          references: doc.secretValue ? getAllSecretReferences(doc.secretValue).nestedReferences : []
                        }
                      };
                    })
@@ -694,7 +694,7 @@ export const secretReplicationServiceFactory = ({
                      secretCommentTag: doc.secretCommentTag,
                      secretCommentCiphertext: doc.secretCommentCiphertext,
                      skipMultilineEncoding: doc.skipMultilineEncoding,
-                      references: getAllNestedSecretReferences(doc.secretValue)
+                      references: getAllSecretReferences(doc.secretValue).nestedReferences
                    };
                  })
                });
@@ -730,7 +730,7 @@ export const secretReplicationServiceFactory = ({
                        secretCommentTag: doc.secretCommentTag,
                        secretCommentCiphertext: doc.secretCommentCiphertext,
                        skipMultilineEncoding: doc.skipMultilineEncoding,
-                        references: getAllNestedSecretReferences(doc.secretValue)
+                        references: getAllSecretReferences(doc.secretValue).nestedReferences
                      }
                    };
                  })
@@ -1,7 +1,7 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import Ajv from "ajv";

-import { ProjectVersion } from "@app/db/schemas";
+import { ProjectVersion, TableName } from "@app/db/schemas";
 import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
@@ -103,13 +103,14 @@ export const secretRotationServiceFactory = ({
      ProjectPermissionActions.Edit,
      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
    );
+
    const project = await projectDAL.findById(projectId);
    const shouldUseBridge = project.version === ProjectVersion.V3;

    if (shouldUseBridge) {
      const selectedSecrets = await secretV2BridgeDAL.find({
        folderId: folder.id,
-        $in: { id: Object.values(outputs) }
+        $in: { [`${TableName.SecretV2}.id` as "id"]: Object.values(outputs) }
      });
      if (selectedSecrets.length !== Object.values(outputs).length)
        throw new NotFoundError({ message: `Secrets not found in folder with ID '${folder.id}'` });
@@ -1,111 +0,0 @@
-import { AnyAbility, ExtractSubjectType } from "@casl/ability";
-import { AbilityQuery, rulesToQuery } from "@casl/ability/extra";
-import { Tables } from "knex/types/tables";
-
-import { BadRequestError, UnauthorizedError } from "../errors";
-import { TKnexDynamicOperator } from "../knex/dynamic";
-
-type TBuildKnexQueryFromCaslDTO<K extends AnyAbility> = {
-  ability: K;
-  subject: ExtractSubjectType<Parameters<K["rulesFor"]>[1]>;
-  action: Parameters<K["rulesFor"]>[0];
-};
-
-export const buildKnexQueryFromCaslOperators = <K extends AnyAbility>({
-  ability,
-  subject,
-  action
-}: TBuildKnexQueryFromCaslDTO<K>) => {
-  const query = rulesToQuery(ability, action, subject, (rule) => {
-    if (!rule.ast) throw new Error("Ast not defined");
-    return rule.ast;
-  });
-
-  if (query === null) throw new UnauthorizedError({ message: `You don't have permission to do ${action} ${subject}` });
-  return query;
-};
-
-type TFieldMapper<T extends keyof Tables> = {
-  [K in T]: `${K}.${Exclude<keyof Tables[K]["base"], symbol>}`;
-}[T];
-
-type TFormatCaslFieldsWithTableNames<T extends keyof Tables> = {
-  // handle if any missing operator else throw error let the app break because this is executing again the db
-  missingOperatorCallback?: (operator: string) => void;
-  fieldMapping: (arg: string) => TFieldMapper<T> | null;
-  dynamicQuery: TKnexDynamicOperator;
-};
-
-export const formatCaslOperatorFieldsWithTableNames = <T extends keyof Tables>({
-  missingOperatorCallback = (arg) => {
-    throw new BadRequestError({ message: `Unknown permission operator: ${arg}` });
-  },
-  dynamicQuery: dynamicQueryAst,
-  fieldMapping
-}: TFormatCaslFieldsWithTableNames<T>) => {
-  const stack: [TKnexDynamicOperator, TKnexDynamicOperator | null][] = [[dynamicQueryAst, null]];
-
-  while (stack.length) {
-    const [filterAst, parentAst] = stack.pop()!;
-
-    if (filterAst.operator === "and" || filterAst.operator === "or" || filterAst.operator === "not") {
-      filterAst.value.forEach((el) => {
-        stack.push([el, filterAst]);
-      });
-
-      // eslint-disable-next-line no-continue
-      continue;
-    }
-
-    if (
-      filterAst.operator === "eq" ||
-      filterAst.operator === "ne" ||
-      filterAst.operator === "in" ||
-      filterAst.operator === "endsWith" ||
-      filterAst.operator === "startsWith"
-    ) {
-      const attrPath = fieldMapping(filterAst.field);
-      if (attrPath) {
-        filterAst.field = attrPath;
-      } else if (parentAst && Array.isArray(parentAst.value)) {
-        parentAst.value = parentAst.value.filter((childAst) => childAst !== filterAst) as string[];
-      } else throw new Error("Unknown casl field");
-      // eslint-disable-next-line no-continue
-      continue;
-    }
-
-    if (parentAst && Array.isArray(parentAst.value)) {
-      parentAst.value = parentAst.value.filter((childAst) => childAst !== filterAst) as string[];
-    } else {
-      missingOperatorCallback?.(filterAst.operator);
-    }
-  }
-  return dynamicQueryAst;
-};
-
-export const convertCaslOperatorToKnexOperator = <T extends keyof Tables>(
-  caslKnexOperators: AbilityQuery,
-  fieldMapping: (arg: string) => TFieldMapper<T> | null
-) => {
-  const value = [];
-  if (caslKnexOperators.$and) {
-    value.push({
-      operator: "not" as const,
-      value: caslKnexOperators.$and as TKnexDynamicOperator[]
-    });
-  }
-  if (caslKnexOperators.$or) {
-    value.push({
-      operator: "or" as const,
-      value: caslKnexOperators.$or as TKnexDynamicOperator[]
-    });
-  }
-
-  return formatCaslOperatorFieldsWithTableNames({
-    dynamicQuery: {
-      operator: "and",
-      value
-    },
-    fieldMapping
-  });
-};
@@ -81,3 +81,25 @@ export const chunkArray = <T>(array: T[], chunkSize: number): T[][] => {
  }
  return chunks;
 };
+
+/*
+ * Returns all items from the first list that
+ * do not exist in the second list.
+ */
+export const diff = <T>(
+  root: readonly T[],
+  other: readonly T[],
+  identity: (item: T) => string | number | symbol = (t: T) => t as unknown as string | number | symbol
+): T[] => {
+  if (!root?.length && !other?.length) return [];
+  if (root?.length === undefined) return [...other];
+  if (!other?.length) return [...root];
+  const bKeys = other.reduce(
+    (acc, item) => {
+      acc[identity(item)] = true;
+      return acc;
+    },
+    {} as Record<string | number | symbol, boolean>
+  );
+  return root.filter((a) => !bKeys[identity(a)]);
+};
@@ -2,32 +2,31 @@ import { Knex } from "knex";

 import { UnauthorizedError } from "../errors";

-type TKnexDynamicPrimitiveOperator = {
+type TKnexDynamicPrimitiveOperator<T extends object> = {
  operator: "eq" | "ne" | "startsWith" | "endsWith";
  value: string;
-  field: string;
+  field: Extract<keyof T, string>;
 };

-type TKnexDynamicInOperator = {
+type TKnexDynamicInOperator<T extends object> = {
  operator: "in";
  value: string[] | number[];
-  field: string;
+  field: Extract<keyof T, string>;
 };

-type TKnexNonGroupOperator = TKnexDynamicInOperator | TKnexDynamicPrimitiveOperator;
+type TKnexNonGroupOperator<T extends object> = TKnexDynamicInOperator<T> | TKnexDynamicPrimitiveOperator<T>;

-type TKnexGroupOperator = {
+type TKnexGroupOperator<T extends object> = {
  operator: "and" | "or" | "not";
-  value: (TKnexNonGroupOperator | TKnexGroupOperator)[];
+  value: (TKnexNonGroupOperator<T> | TKnexGroupOperator<T>)[];
 };

-// akhilmhdh: This is still in pending state and not yet ready. If you want to use it ping me.
-// used when you need to write a complex query with the orm
-// use it when you need complex or and and condition - most of the time not needed
-// majorly used with casl permission to filter data based on permission
-export type TKnexDynamicOperator = TKnexGroupOperator | TKnexNonGroupOperator;
+export type TKnexDynamicOperator<T extends object> = TKnexGroupOperator<T> | TKnexNonGroupOperator<T>;

-export const buildDynamicKnexQuery = (dynamicQuery: TKnexDynamicOperator, rootQueryBuild: Knex.QueryBuilder) => {
+export const buildDynamicKnexQuery = <T extends object>(
+  rootQueryBuild: Knex.QueryBuilder,
+  dynamicQuery: TKnexDynamicOperator<T>
+) => {
  const stack = [{ filterAst: dynamicQuery, queryBuilder: rootQueryBuild }];

  while (stack.length) {
@@ -50,34 +49,25 @@ export const buildDynamicKnexQuery = (dynamicQuery: TKnexDynamicOperator, rootQu
        break;
      }
      case "and": {
-        void queryBuilder.andWhere((subQueryBuilder) => {
-          filterAst.value.forEach((el) => {
-            stack.push({
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
+        filterAst.value.forEach((el) => {
+          void queryBuilder.andWhere((subQueryBuilder) => {
+            buildDynamicKnexQuery(subQueryBuilder, el);
          });
        });
        break;
      }
      case "or": {
-        void queryBuilder.orWhere((subQueryBuilder) => {
-          filterAst.value.forEach((el) => {
-            stack.push({
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
+        filterAst.value.forEach((el) => {
+          void queryBuilder.orWhere((subQueryBuilder) => {
+            buildDynamicKnexQuery(subQueryBuilder, el);
          });
        });
        break;
      }
      case "not": {
-        void queryBuilder.whereNot((subQueryBuilder) => {
-          filterAst.value.forEach((el) => {
-            stack.push({
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
+        filterAst.value.forEach((el) => {
+          void queryBuilder.whereNot((subQueryBuilder) => {
+            buildDynamicKnexQuery(subQueryBuilder, el);
          });
        });
        break;
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { Tables } from "knex/types/tables";

 import { DatabaseError } from "../errors";
+import { buildDynamicKnexQuery, TKnexDynamicOperator } from "./dynamic";

 export * from "./connection";
 export * from "./join";
@@ -20,9 +21,10 @@ export const withTransaction = <K extends object>(db: Knex, dal: K) => ({
 export type TFindFilter<R extends object = object> = Partial<R> & {
  $in?: Partial<{ [k in keyof R]: R[k][] }>;
  $search?: Partial<{ [k in keyof R]: R[k] }>;
+  $complex?: TKnexDynamicOperator<R>;
 };
 export const buildFindFilter =
-  <R extends object = object>({ $in, $search, ...filter }: TFindFilter<R>) =>
+  <R extends object = object>({ $in, $search, $complex, ...filter }: TFindFilter<R>) =>
  (bd: Knex.QueryBuilder<R, R>) => {
    void bd.where(filter);
    if ($in) {
@@ -39,6 +41,9 @@ export const buildFindFilter =
        }
      });
    }
+    if ($complex) {
+      return buildDynamicKnexQuery(bd, $complex);
+    }
    return bd;
  };

@@ -63,7 +63,7 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
      void res.status(HttpStatusCodes.Forbidden).send({
        statusCode: HttpStatusCodes.Forbidden,
        error: "PermissionDenied",
-        message: `You are not allowed to ${error.action} on ${error.subjectType}`
+        message: `You are not allowed to ${error.action} on ${error.subjectType} - ${JSON.stringify(error.subject)}`
      });
    } else if (error instanceof ForbiddenRequestError) {
      void res.status(HttpStatusCodes.Forbidden).send({
@@ -5,6 +5,7 @@ import { z } from "zod";

 import { registerCertificateEstRouter } from "@app/ee/routes/est/certificate-est-router";
 import { registerV1EERoutes } from "@app/ee/routes/v1";
+import { registerV2EERoutes } from "@app/ee/routes/v2";
 import { accessApprovalPolicyApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
 import { accessApprovalPolicyDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-dal";
 import { accessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
@@ -1422,7 +1423,13 @@ export const registerRoutes = async (
    },
    { prefix: "/api/v1" }
  );
-  await server.register(registerV2Routes, { prefix: "/api/v2" });
+  await server.register(
+    async (v2Server) => {
+      await v2Server.register(registerV2EERoutes);
+      await v2Server.register(registerV2Routes);
+    },
+    { prefix: "/api/v2" }
+  );
  await server.register(registerV3Routes, { prefix: "/api/v3" });

  server.addHook("onClose", async () => {
@@ -9,9 +9,10 @@ import {
  SecretApprovalPoliciesSchema,
  UsersSchema
 } from "@app/db/schemas";
-import { UnpackedPermissionSchema } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";

+import { UnpackedPermissionSchema } from "./santizedSchemas/permission";
+
 // sometimes the return data must be santizied to avoid leaking important values
 // always prefer pick over omit in zod
 export const integrationAuthPubSchema = IntegrationAuthsSchema.pick({
@@ -0,0 +1,11 @@
+import { z } from "zod";
+
+export const UnpackedPermissionSchema = z.object({
+  subject: z
+    .union([z.string().min(1), z.string().array()])
+    .transform((el) => (typeof el !== "string" ? el[0] : el))
+    .optional(),
+  action: z.union([z.string().min(1), z.string().array()]).transform((el) => (typeof el === "string" ? [el] : el)),
+  conditions: z.unknown().optional(),
+  inverted: z.boolean().optional()
+});
@@ -3,7 +3,10 @@ import { z } from "zod";

 import { SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { DASHBOARD } from "@app/lib/api-docs";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
@@ -192,15 +195,15 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
        req.permission.orgId
      );

-      const permissiveEnvs = // filter envs user has access to
+      const allowedDynamicSecretEnvironments = // filter envs user has access to
        environments.filter((environment) =>
          permission.can(
-            ProjectPermissionActions.Read,
-            subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+            ProjectPermissionDynamicSecretActions.Lease,
+            subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })
          )
        );

-      if (includeDynamicSecrets && permissiveEnvs.length) {
+      if (includeDynamicSecrets && allowedDynamicSecretEnvironments.length) {
        // this is the unique count, ie duplicate secrets across envs only count as 1
        totalDynamicSecretCount = await server.services.dynamicSecret.getCountMultiEnv({
          actor: req.permission.type,
@@ -209,7 +212,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
          actorOrgId: req.permission.orgId,
          projectId,
          search,
-          environmentSlugs: permissiveEnvs,
+          environmentSlugs: allowedDynamicSecretEnvironments,
          path: secretPath,
          isInternal: true
        });
@@ -224,7 +227,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            search,
            orderBy,
            orderDirection,
-            environmentSlugs: permissiveEnvs,
+            environmentSlugs: allowedDynamicSecretEnvironments,
            path: secretPath,
            limit: remainingLimit,
            offset: adjustedOffset,
@@ -241,13 +244,13 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
        }
      }

-      if (includeSecrets && permissiveEnvs.length) {
+      if (includeSecrets) {
        // this is the unique count, ie duplicate secrets across envs only count as 1
        totalSecretCount = await server.services.secret.getSecretsCountMultiEnv({
          actorId: req.permission.id,
          actor: req.permission.type,
          actorOrgId: req.permission.orgId,
-          environments: permissiveEnvs,
+          environments,
          actorAuthMethod: req.permission.authMethod,
          projectId,
          path: secretPath,
@@ -260,7 +263,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            actorId: req.permission.id,
            actor: req.permission.type,
            actorOrgId: req.permission.orgId,
-            environments: permissiveEnvs,
+            environments,
            actorAuthMethod: req.permission.authMethod,
            projectId,
            path: secretPath,
@@ -272,7 +275,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            isInternal: true
          });

-          for await (const environment of permissiveEnvs) {
+          for await (const environment of environments) {
            const secretCountFromEnv = secrets.filter((secret) => secret.environment === environment).length;

            if (secretCountFromEnv) {
@@ -19,7 +19,7 @@ import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
-import { fnSecretBulkInsert, getAllNestedSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
+import { fnSecretBulkInsert, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
 import type { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
 import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
@@ -242,7 +242,7 @@ export const importDataIntoInfisicalFn = async ({
          }
          await fnSecretBulkInsert({
            inputSecrets: secretBatch.map((el) => {
-              const references = getAllNestedSecretReferences(el.secretValue);
+              const references = getAllSecretReferences(el.secretValue).nestedReferences;

              return {
                version: 1,
@@ -67,7 +67,8 @@ const getIntegrationSecretsV2 = async (
    folderDAL,
    secretDAL: secretV2BridgeDAL,
    secretImportDAL,
-    allowedImports: secretImports
+    secretImports,
+    hasSecretAccess: () => true
  });

  for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
@@ -90,7 +90,10 @@ export const integrationServiceFactory = ({

    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: sourceEnvironment, secretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath
+      })
    );

    const folder = await folderDAL.findBySecretPath(integrationAuth.projectId, sourceEnvironment, secretPath);
@@ -167,7 +170,10 @@ export const integrationServiceFactory = ({
    if (environment || secretPath) {
      ForbiddenError.from(permission).throwUnlessCan(
        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, { environment: newEnvironment, secretPath: newSecretPath })
+        subject(ProjectPermissionSub.Secrets, {
+          environment: newEnvironment,
+          secretPath: newSecretPath
+        })
      );
    }

@@ -2,7 +2,6 @@ import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";

 import { ProjectMembershipRole } from "@app/db/schemas";
-import { UnpackedPermissionSchema } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
  ProjectPermissionActions,
@@ -10,6 +9,7 @@ import {
  ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";

 import { ActorAuthMethod } from "../auth/auth-type";
 import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/identity-project-membership-role-dal";
@@ -1,6 +0,0 @@
-import { RawRule } from "@casl/ability";
-
-import { ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-
-export const shouldCheckFolderPermission = (rules: RawRule[]) =>
-  rules.some((rule) => (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders));
@@ -12,7 +12,6 @@ import { OrderByDirection } from "@app/lib/types";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
-import { shouldCheckFolderPermission } from "./secret-folder-fns";
 import {
  TCreateFolderDTO,
  TDeleteFolderDTO,
@@ -60,20 +59,10 @@ export const secretFolderServiceFactory = ({
      actorOrgId
    );

-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );

    const env = await projectEnvDAL.findOne({ projectId, slug: environment });
    if (!env) {
@@ -169,20 +158,10 @@ export const secretFolderServiceFactory = ({
    );

    folders.forEach(({ environment, path: secretPath }) => {
-      // we do this because we've split Secret and SecretFolder resources
-      // previously, if one can create/update/read/delete secrets then they can do the same for folders
-      // for backwards compatibility, we handle authorization only when SecretFolders subject is used
-      if (shouldCheckFolderPermission(permission.rules)) {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-        );
-      } else {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-        );
-      }
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Edit,
+        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+      );
    });

    const result = await folderDAL.transaction(async (tx) =>
@@ -287,20 +266,10 @@ export const secretFolderServiceFactory = ({
      actorOrgId
    );

-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );

    const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
    if (!parentFolder)
@@ -377,20 +346,10 @@ export const secretFolderServiceFactory = ({
      actorOrgId
    );

-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );

    const env = await projectEnvDAL.findOne({ projectId, slug: environment });
    if (!env) throw new NotFoundError({ message: `Environment with slug '${environment}' not found` });
@@ -27,6 +27,7 @@ type TSecretImportSecretsV2 = {
    slug: string;
    name: string;
  };
+  id: string;
  folderId: string | undefined;
  importFolderId: string;
  secrets: (TSecretsV2 & {
@@ -139,24 +140,22 @@ export const fnSecretsFromImports = async ({
  return secrets;
 };

+/* eslint-disable no-await-in-loop, no-continue */
 export const fnSecretsV2FromImports = async ({
-  allowedImports: possibleCyclicImports,
+  secretImports: rootSecretImports,
  folderDAL,
  secretDAL,
  secretImportDAL,
-  depth = 0,
-  cyclicDetector = new Set(),
  decryptor,
-  expandSecretReferences
+  expandSecretReferences,
+  hasSecretAccess
 }: {
-  allowedImports: (Omit<TSecretImports, "importEnv"> & {
+  secretImports: (Omit<TSecretImports, "importEnv"> & {
    importEnv: { id: string; slug: string; name: string };
  })[];
  folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
  secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
  secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
-  depth?: number;
-  cyclicDetector?: Set<string>;
  decryptor: (value?: Buffer | null) => string;
  expandSecretReferences?: (inputSecret: {
    value?: string;
@@ -164,92 +163,107 @@ export const fnSecretsV2FromImports = async ({
    secretPath: string;
    environment: string;
  }) => Promise<string | undefined>;
+  hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
-  // avoid going more than a depth
-  if (depth >= LEVEL_BREAK) return [];
+  const cyclicDetector = new Set();
+  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
+    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
+  ];

-  const allowedImports = possibleCyclicImports.filter(
-    ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
-  );
+  const processedImports: TSecretImportSecretsV2[] = [];

-  const importedFolders = (
-    await folderDAL.findByManySecretPath(
-      allowedImports.map(({ importEnv, importPath }) => ({
+  while (stack.length) {
+    const { secretImports, depth, parentImportedSecrets } = stack.pop()!;
+
+    if (depth > LEVEL_BREAK) continue;
+    const sanitizedImports = secretImports.filter(
+      ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
+    );
+
+    if (!sanitizedImports.length) continue;
+
+    const importedFolders = await folderDAL.findByManySecretPath(
+      sanitizedImports.map(({ importEnv, importPath }) => ({
        envId: importEnv.id,
        secretPath: importPath
      }))
-    )
-  ).filter(Boolean); // remove undefined ones
-  if (!importedFolders.length) {
-    return [];
-  }
+    );
+    if (!importedFolders.length) continue;

-  const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
-  const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
-  const importedSecrets = await secretDAL.find(
-    {
-      $in: { folderId: importedFolderIds },
-      type: SecretType.Shared
-    },
-    {
-      sort: [["id", "asc"]]
-    }
-  );
+    const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
+    const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);

-  const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
+    const importedSecrets = await secretDAL.find(
+      {
+        $in: { folderId: importedFolderIds },
+        type: SecretType.Shared
+      },
+      {
+        sort: [["id", "asc"]]
+      }
+    );
+    const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);

-  allowedImports.forEach(({ importPath, importEnv }) => {
-    cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
-  });
-  // now we need to check recursively deeper imports made inside other imports
-  // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
-  const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
-  let secretsFromDeeperImports: TSecretImportSecretsV2[] = [];
-  if (deeperImports.length) {
-    secretsFromDeeperImports = await fnSecretsV2FromImports({
-      allowedImports: deeperImports.filter(({ isReplication }) => !isReplication),
-      secretImportDAL,
-      folderDAL,
-      secretDAL,
-      depth: depth + 1,
-      cyclicDetector,
-      decryptor,
-      expandSecretReferences
+    sanitizedImports.forEach(({ importPath, importEnv }) => {
+      cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
+    });
+    // now we need to check recursively deeper imports made inside other imports
+    // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
+    const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
+    const deeperImportsGroupByFolderId = groupBy(deeperImports, (i) => i.folderId);
+
+    const isFirstIteration = !processedImports.length;
+    sanitizedImports.forEach(({ importPath, importEnv, id, folderId }, i) => {
+      const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
+      const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
+        .filter((item) =>
+          hasSecretAccess(
+            importEnv.slug,
+            importPath,
+            item.key,
+            item.tags.map((el) => el.slug)
+          )
+        )
+        .map((item) => ({
+          ...item,
+          secretKey: item.key,
+          secretValue: decryptor(item.encryptedValue),
+          secretComment: decryptor(item.encryptedComment),
+          environment: importEnv.slug,
+          workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+          _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+        }));
+
+      if (deeperImportsGroupByFolderId?.[sourceImportFolder?.id || ""]) {
+        stack.push({
+          secretImports: deeperImportsGroupByFolderId[sourceImportFolder?.id || ""],
+          depth: depth + 1,
+          parentImportedSecrets: secretsWithDuplicate
+        });
+      }
+
+      if (isFirstIteration) {
+        processedImports.push({
+          secretPath: importPath,
+          environment: importEnv.slug,
+          environmentInfo: importEnv,
+          folderId: importedFolders?.[i]?.id,
+          id,
+          importFolderId: folderId,
+          secrets: secretsWithDuplicate
+        });
+      } else {
+        parentImportedSecrets.push(...secretsWithDuplicate);
+      }
    });
  }
-  const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId);
-
-  const processedImports = allowedImports.map(({ importPath, importEnv, id, folderId }, i) => {
-    const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
-    const folderDeeperImportSecrets =
-      secretsFromdeeperImportGroupedByFolderId?.[sourceImportFolder?.id || ""]?.[0]?.secrets || [];
-    const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
-      .map((item) => ({
-        ...item,
-        secretKey: item.key,
-        secretValue: decryptor(item.encryptedValue),
-        secretComment: decryptor(item.encryptedComment),
-        environment: importEnv.slug,
-        workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-        _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-      }))
-      .concat(folderDeeperImportSecrets);
-
-    return {
-      secretPath: importPath,
-      environment: importEnv.slug,
-      environmentInfo: importEnv,
-      folderId: importedFolders?.[i]?.id,
-      id,
-      importFolderId: folderId,
-      secrets: unique(secretsWithDuplicate, (el) => el.secretKey)
-    };
-  });
-
+  /* eslint-enable */
  if (expandSecretReferences) {
    await Promise.allSettled(
-      processedImports.map((processedImport) =>
-        Promise.allSettled(
+      processedImports.map((processedImport) => {
+        // eslint-disable-next-line
+        processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
+        return Promise.allSettled(
          processedImport.secrets.map(async (decryptedSecret, index) => {
            const expandedSecretValue = await expandSecretReferences({
              value: decryptedSecret.secretValue,
@@ -260,8 +274,8 @@ export const fnSecretsV2FromImports = async ({
            // eslint-disable-next-line no-param-reassign
            processedImport.secrets[index].secretValue = expandedSecretValue || "";
          })
-        )
-      )
+        );
+      })
    );
  }

@@ -84,12 +84,12 @@ export const secretImportServiceFactory = ({
    // check if user has permission to import into destination  path
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    // check if user has permission to import from target path
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
      subject(ProjectPermissionSub.Secrets, {
        environment: data.environment,
        secretPath: data.path
@@ -198,7 +198,7 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -292,7 +292,7 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -364,8 +364,8 @@ export const secretImportServiceFactory = ({

    // check if user has permission to import into destination  path
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    const plan = await licenseService.getPlan(actorOrgId);
@@ -393,7 +393,7 @@ export const secretImportServiceFactory = ({

    // check if user has permission to import from target path
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
      subject(ProjectPermissionSub.Secrets, {
        environment: secretImportDoc.importEnv.slug,
        secretPath: secretImportDoc.importPath
@@ -441,7 +441,7 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -476,7 +476,7 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -526,7 +526,7 @@ export const secretImportServiceFactory = ({

    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, {
+      subject(ProjectPermissionSub.SecretImports, {
        environment: folder.environment.envSlug,
        secretPath: folderWithPath.path
      })
@@ -573,20 +573,19 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );
    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
    if (!folder) return [];
    // this will already order by position
    // so anything based on this order will also be in right position
    const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
-
-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
+    const allowedImports = secretImports.filter((el) =>
      permission.can(
        ProjectPermissionActions.Read,
        subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
-          secretPath: importPath
+          environment: el.importEnv.slug,
+          secretPath: el.importPath
        })
      )
    );
@@ -611,7 +610,7 @@ export const secretImportServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
    );
    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
    if (!folder) return [];
@@ -619,16 +618,6 @@ export const secretImportServiceFactory = ({
    // so anything based on this order will also be in right position
    const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });

-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
-          secretPath: importPath
-        })
-      )
-    );
-
    const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
    if (shouldUseSecretV2Bridge) {
      const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
@@ -636,11 +625,21 @@ export const secretImportServiceFactory = ({
        projectId
      });
      const importedSecrets = await fnSecretsV2FromImports({
-        allowedImports,
+        secretImports,
        folderDAL,
        secretDAL: secretV2BridgeDAL,
        secretImportDAL,
-        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : "")
+        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
+        hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
+          permission.can(
+            ProjectPermissionActions.Read,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: expandEnvironment,
+              secretPath: expandSecretPath,
+              secretName: expandSecretKey,
+              secretTags: expandSecretTags
+            })
+          )
      });
      return importedSecrets;
    }
@@ -651,7 +650,21 @@ export const secretImportServiceFactory = ({
        name: "bot_not_found_error"
      });

-    const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL });
+    const allowedImports = secretImports.filter((el) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: el.importEnv.slug,
+          secretPath: el.importPath
+        })
+      )
+    );
+    const importedSecrets = await fnSecretsFromImports({
+      allowedImports,
+      folderDAL,
+      secretDAL,
+      secretImportDAL
+    });
    return importedSecrets.map((el) => ({
      ...el,
      secrets: el.secrets.map((encryptedSecret) =>
@@ -4,7 +4,14 @@ import { validate as uuidValidate } from "uuid";
 import { TDbClient } from "@app/db";
 import { SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
+import {
+  buildFindFilter,
+  ormify,
+  selectAllTableCols,
+  sqlNestRelationships,
+  TFindFilter,
+  TFindOpt
+} from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";

@@ -13,6 +20,97 @@ export type TSecretV2BridgeDALFactory = ReturnType<typeof secretV2BridgeDALFacto
 export const secretV2BridgeDALFactory = (db: TDbClient) => {
  const secretOrm = ormify(db, TableName.SecretV2);

+  const findOne = async (filter: Partial<TSecretsV2>, tx?: Knex) => {
+    try {
+      const docs = await (tx || db)(TableName.SecretV2)
+        .where(filter)
+        .leftJoin(
+          TableName.SecretV2JnTag,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
+        )
+        .leftJoin(
+          TableName.SecretTag,
+          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
+          `${TableName.SecretTag}.id`
+        )
+        .select(selectAllTableCols(TableName.SecretV2))
+        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
+        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
+
+      const data = sqlNestRelationships({
+        data: docs,
+        key: "id",
+        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        childrenMapper: [
+          {
+            key: "tagId",
+            label: "tags" as const,
+            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
+              id,
+              color,
+              slug,
+              name: slug
+            })
+          }
+        ]
+      });
+      return data?.[0];
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.SecretV2}: FindOne` });
+    }
+  };
+
+  const find = async (filter: TFindFilter<TSecretsV2>, { offset, limit, sort, tx }: TFindOpt<TSecretsV2> = {}) => {
+    try {
+      const query = (tx || db)(TableName.SecretV2)
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter(filter))
+        .leftJoin(
+          TableName.SecretV2JnTag,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
+        )
+        .leftJoin(
+          TableName.SecretTag,
+          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
+          `${TableName.SecretTag}.id`
+        )
+        .select(selectAllTableCols(TableName.SecretV2))
+        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
+        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
+      if (limit) void query.limit(limit);
+      if (offset) void query.offset(offset);
+      if (sort) {
+        void query.orderBy(sort.map(([column, order, nulls]) => ({ column: column as string, order, nulls })));
+      }
+
+      const docs = await query;
+      const data = sqlNestRelationships({
+        data: docs,
+        key: "id",
+        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        childrenMapper: [
+          {
+            key: "tagId",
+            label: "tags" as const,
+            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
+              id,
+              color,
+              slug,
+              name: slug
+            })
+          }
+        ]
+      });
+      return data;
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.SecretV2}: Find` });
+    }
+  };
+
  const update = async (filter: Partial<TSecretsV2>, data: Omit<TSecretsV2Update, "version">, tx?: Knex) => {
    try {
      const sec = await (tx || db)(TableName.SecretV2)
@@ -484,6 +582,8 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
    upsertSecretReferences,
    findReferencedSecretReferences,
    findAllProjectSecretValues,
-    countByFolderIds
+    countByFolderIds,
+    findOne,
+    find
  };
 };
@@ -30,9 +30,10 @@ export const shouldUseSecretV2Bridge = (version: number) => version === 3;
 * //   { environment: 'prod', secretPath: '/anotherFolder' }
 * // ]
 */
-export const getAllNestedSecretReferences = (maybeSecretReference: string) => {
+export const getAllSecretReferences = (maybeSecretReference: string) => {
  const references = Array.from(maybeSecretReference.matchAll(INTERPOLATION_SYNTAX_REG), (m) => m[1]);
-  return references
+
+  const nestedReferences = references
    .filter((el) => el.includes("."))
    .map((el) => {
      const [environment, ...secretPathList] = el.split(".");
@@ -42,6 +43,8 @@ export const getAllNestedSecretReferences = (maybeSecretReference: string) => {
        secretKey: secretPathList[secretPathList.length - 1]
      };
    });
+  const localReferences = references.filter((el) => !el.includes("."));
+  return { nestedReferences, localReferences };
 };

 // these functions are special functions shared by a couple of resources
@@ -325,16 +328,13 @@ type TRecursivelyFetchSecretsFromFoldersArg = {
  projectId: string;
  environment: string;
  currentPath: string;
-  hasAccess: (environment: string, secretPath: string) => boolean;
 };

 export const recursivelyGetSecretPaths = async ({
  folderDAL,
  projectEnvDAL,
  projectId,
-  environment,
-  currentPath,
-  hasAccess
+  environment
 }: TRecursivelyFetchSecretsFromFoldersArg) => {
  const env = await projectEnvDAL.findOne({
    projectId,
@@ -362,12 +362,7 @@ export const recursivelyGetSecretPaths = async ({
    folderId: p.folderId
  }));

-  // Filter out paths that the user does not have permission to access, and paths that are not in the current path
-  const allowedPaths = paths.filter(
-    (folder) => hasAccess(environment, folder.path) && folder.path.startsWith(currentPath === "/" ? "" : currentPath)
-  );
-
-  return allowedPaths;
+  return paths;
 };
 // used to convert multi line ones to quotes ones with \n
 const formatMultiValueEnv = (val?: string) => {
@@ -381,7 +376,7 @@ type TInterpolateSecretArg = {
  decryptSecretValue: (encryptedValue?: Buffer | null) => string | undefined;
  secretDAL: Pick<TSecretV2BridgeDALFactory, "findByFolderId">;
  folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
-  canExpandValue: (environment: string, secretPath: string) => boolean;
+  canExpandValue: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 };

 const MAX_SECRET_REFERENCE_DEPTH = 10;
@@ -392,29 +387,29 @@ export const expandSecretReferencesFactory = ({
  folderDAL,
  canExpandValue
 }: TInterpolateSecretArg) => {
-  const secretCache: Record<string, Record<string, string>> = {};
+  const secretCache: Record<string, Record<string, { value: string; tags: string[] }>> = {};
  const getCacheUniqueKey = (environment: string, secretPath: string) => `${environment}-${secretPath}`;

  const fetchSecret = async (environment: string, secretPath: string, secretKey: string) => {
    const cacheKey = getCacheUniqueKey(environment, secretPath);

    if (secretCache?.[cacheKey]) {
-      return secretCache[cacheKey][secretKey] || "";
+      return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
    }

    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) return "";
+    if (!folder) return { value: "", tags: [] };
    const secrets = await secretDAL.findByFolderId(folder.id);

-    const decryptedSecret = secrets.reduce<Record<string, string>>((prev, secret) => {
+    const decryptedSecret = secrets.reduce<Record<string, { value: string; tags: string[] }>>((prev, secret) => {
      // eslint-disable-next-line no-param-reassign
-      prev[secret.key] = decryptSecret(secret.encryptedValue) || "";
+      prev[secret.key] = { value: decryptSecret(secret.encryptedValue) || "", tags: secret.tags?.map((el) => el.slug) };
      return prev;
    }, {});

    secretCache[cacheKey] = decryptedSecret;

-    return secretCache[cacheKey][secretKey] || "";
+    return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
  };

  const recursivelyExpandSecret = async (dto: { value?: string; secretPath: string; environment: string }) => {
@@ -440,43 +435,43 @@ export const expandSecretReferencesFactory = ({
          if (entities.length === 1) {
            const [secretKey] = entities;

-            if (!canExpandValue(environment, secretPath))
+            // eslint-disable-next-line no-continue,no-await-in-loop
+            const referredValue = await fetchSecret(environment, secretPath, secretKey);
+            if (!canExpandValue(environment, secretPath, secretKey, referredValue.tags))
              throw new ForbiddenRequestError({
                message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to.`
              });

-            // eslint-disable-next-line no-continue,no-await-in-loop
-            const referedValue = await fetchSecret(environment, secretPath, secretKey);
            const cacheKey = getCacheUniqueKey(environment, secretPath);
-            secretCache[cacheKey][secretKey] = referedValue;
-            if (INTERPOLATION_SYNTAX_REG.test(referedValue)) {
+            secretCache[cacheKey][secretKey] = referredValue;
+            if (INTERPOLATION_SYNTAX_REG.test(referredValue.value)) {
              stack.push({
-                value: referedValue,
+                value: referredValue.value,
                secretPath,
                environment,
                depth: depth + 1
              });
            }
-            if (referedValue) {
-              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue);
+            if (referredValue) {
+              expandedValue = expandedValue.replaceAll(interpolationSyntax, referredValue.value);
            }
          } else {
            const secretReferenceEnvironment = entities[0];
            const secretReferencePath = path.join("/", ...entities.slice(1, entities.length - 1));
            const secretReferenceKey = entities[entities.length - 1];

-            if (!canExpandValue(secretReferenceEnvironment, secretReferencePath))
+            // eslint-disable-next-line no-await-in-loop
+            const referedValue = await fetchSecret(secretReferenceEnvironment, secretReferencePath, secretReferenceKey);
+            if (!canExpandValue(secretReferenceEnvironment, secretReferencePath, secretReferenceKey, referedValue.tags))
              throw new ForbiddenRequestError({
                message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to.`
              });

-            // eslint-disable-next-line no-await-in-loop
-            const referedValue = await fetchSecret(secretReferenceEnvironment, secretReferencePath, secretReferenceKey);
            const cacheKey = getCacheUniqueKey(secretReferenceEnvironment, secretReferencePath);
            secretCache[cacheKey][secretReferenceKey] = referedValue;
-            if (INTERPOLATION_SYNTAX_REG.test(referedValue)) {
+            if (INTERPOLATION_SYNTAX_REG.test(referedValue.value)) {
              stack.push({
-                value: referedValue,
+                value: referedValue.value,
                secretPath: secretReferencePath,
                environment: secretReferenceEnvironment,
                depth: depth + 1
@@ -484,7 +479,7 @@ export const expandSecretReferencesFactory = ({
            }

            if (referedValue) {
-              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue);
+              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue.value);
            }
          }
        }
@@ -15,6 +15,12 @@ type TPartialSecret = Pick<TSecretsV2, "id" | "reminderRepeatDays" | "reminderNo

 type TPartialInputSecret = Pick<TSecretsV2, "type" | "reminderNote" | "reminderRepeatDays" | "id">;

+export type TSecretReferenceDTO = {
+  environment: string;
+  secretPath: string;
+  secretKey: string;
+};
+
 export type TGetSecretsDTO = {
  expandSecretReferences?: boolean;
  path: string;
@@ -25,7 +25,7 @@ import { logger } from "@app/lib/logger";
 import {
  fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
  fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
+  getAllSecretReferences
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";

 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
@@ -793,7 +793,7 @@ export const createManySecretsRawFnFactory = ({
            : null,
          skipMultilineEncoding: secret.skipMultilineEncoding,
          tags: secret.tags,
-          references: getAllNestedSecretReferencesV2Bridge(secret.secretValue)
+          references: getAllSecretReferences(secret.secretValue).nestedReferences
        };
      });

@@ -973,7 +973,7 @@ export const updateManySecretsRawFnFactory = ({
            : null,
          skipMultilineEncoding: secret.skipMultilineEncoding,
          tags: secret.tags,
-          references: getAllNestedSecretReferencesV2Bridge(secret.secretValue)
+          references: getAllSecretReferences(secret.secretValue).nestedReferences
        };
      });

@@ -50,7 +50,7 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretImportDALFactory } from "../secret-import/secret-import-dal";
 import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
-import { expandSecretReferencesFactory, getAllNestedSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
+import { expandSecretReferencesFactory, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
@@ -342,7 +342,8 @@ export const secretQueueFactory = ({
      secretDAL: secretV2BridgeDAL,
      expandSecretReferences,
      secretImportDAL,
-      allowedImports: secretImports
+      secretImports,
+      hasSecretAccess: () => true
    });

    for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
@@ -1147,7 +1148,7 @@ export const secretQueueFactory = ({
                  : "";
              const encryptedValue = secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob;
              // create references
-              const references = getAllNestedSecretReferences(value);
+              const references = getAllSecretReferences(value).nestedReferences;
              secretReferences.push({ secretId: el.id, references });

              const encryptedComment = comment
@@ -2436,17 +2436,26 @@ export const secretServiceFactory = ({

    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment: sourceEnvironment, secretPath: sourceSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath: sourceSecretPath
+      })
    );

    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
    );

    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
    );

    const { botKey } = await projectBotService.getBotKey(project.id);