Merge pull request #3736 from Infisical/feat/azureDevopsSecretSync

Feat/azure devops secret sync

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/AzureDevOpsSyncFields.tsx

@@ -0,0 +1,76 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import { useGetAzureDevOpsProjects } from "@app/hooks/api/appConnections/azure";
+import { AzureDevOpsProject } from "@app/hooks/api/appConnections/azure/types";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const AzureDevOpsSyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.AzureDevOps }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: { projects } = { projects: [] }, isLoading: isProjectsLoading } =
+    useGetAzureDevOpsProjects(connectionId, {
+      enabled: Boolean(connectionId)
+    });
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.devopsProjectId", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.devopsProjectId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Project"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the project exists in the connection's Azure DevOps instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the project you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={projects?.find((v) => v.appId === value) ?? null}
+              onChange={(option) => {
+                onChange((option as SingleValue<AzureDevOpsProject>)?.appId ?? null);
+                setValue(
+                  "destinationConfig.devopsProjectName",
+                  (option as SingleValue<AzureDevOpsProject>)?.name ?? ""
+                );
+              }}
+              options={projects}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx

@@ -7,6 +7,7 @@ import { OnePassSyncFields } from "./1PasswordSyncFields";
 import { AwsParameterStoreSyncFields } from "./AwsParameterStoreSyncFields";
 import { AwsSecretsManagerSyncFields } from "./AwsSecretsManagerSyncFields";
 import { AzureAppConfigurationSyncFields } from "./AzureAppConfigurationSyncFields";
+import { AzureDevOpsSyncFields } from "./AzureDevOpsSyncFields";
 import { AzureKeyVaultSyncFields } from "./AzureKeyVaultSyncFields";
 import { CamundaSyncFields } from "./CamundaSyncFields";
 import { DatabricksSyncFields } from "./DatabricksSyncFields";
@@ -38,6 +39,8 @@ export const SecretSyncDestinationFields = () => {
       return <AzureKeyVaultSyncFields />;
     case SecretSync.AzureAppConfiguration:
       return <AzureAppConfigurationSyncFields />;
+    case SecretSync.AzureDevOps:
+      return <AzureDevOpsSyncFields />;
     case SecretSync.Databricks:
       return <DatabricksSyncFields />;
     case SecretSync.Humanitec:

frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx

@@ -41,6 +41,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
     case SecretSync.GCPSecretManager:
     case SecretSync.AzureKeyVault:
     case SecretSync.AzureAppConfiguration:
+    case SecretSync.AzureDevOps:
     case SecretSync.Databricks:
     case SecretSync.Humanitec:
     case SecretSync.TerraformCloud:

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/AzureDevOpsSyncReviewFields.tsx

@@ -0,0 +1,18 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const AzureDevOpsSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.AzureDevOps }>();
+  const devopsProjectId = watch("destinationConfig.devopsProjectId");
+  const devopsProjectName = watch("destinationConfig.devopsProjectName");
+
+  return (
+    <>
+      <GenericFieldLabel label="Project">{devopsProjectName}</GenericFieldLabel>
+      <GenericFieldLabel label="Project ID">{devopsProjectId}</GenericFieldLabel>
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx

@@ -16,6 +16,7 @@ import {
   AwsSecretsManagerSyncReviewFields
 } from "./AwsSecretsManagerSyncReviewFields";
 import { AzureAppConfigurationSyncReviewFields } from "./AzureAppConfigurationSyncReviewFields";
+import { AzureDevOpsSyncReviewFields } from "./AzureDevOpsSyncReviewFields";
 import { AzureKeyVaultSyncReviewFields } from "./AzureKeyVaultSyncReviewFields";
 import { CamundaSyncReviewFields } from "./CamundaSyncReviewFields";
 import { DatabricksSyncReviewFields } from "./DatabricksSyncReviewFields";
@@ -70,6 +71,9 @@ export const SecretSyncReviewFields = () => {
     case SecretSync.AzureAppConfiguration:
       DestinationFieldsComponent = <AzureAppConfigurationSyncReviewFields />;
       break;
+    case SecretSync.AzureDevOps:
+      DestinationFieldsComponent = <AzureDevOpsSyncReviewFields />;
+      break;
     case SecretSync.Databricks:
       DestinationFieldsComponent = <DatabricksSyncReviewFields />;
       break;

frontend/src/components/secret-syncs/forms/schemas/azure-devops-sync-destination-schema.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const AzureDevOpsSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.AzureDevOps),
+    destinationConfig: z.object({
+      devopsProjectId: z.string().trim().min(1, { message: "Azure DevOps Project ID is required" }),
+      devopsProjectName: z
+        .string()
+        .trim()
+        .min(1, { message: "Azure DevOps Project Name is required" })
+    })
+  })
+);

frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts

@@ -4,6 +4,7 @@ import { OnePassSyncDestinationSchema } from "./1password-sync-destination-schem
 import { AwsParameterStoreSyncDestinationSchema } from "./aws-parameter-store-sync-destination-schema";
 import { AwsSecretsManagerSyncDestinationSchema } from "./aws-secrets-manager-sync-destination-schema";
 import { AzureAppConfigurationSyncDestinationSchema } from "./azure-app-configuration-sync-destination-schema";
+import { AzureDevOpsSyncDestinationSchema } from "./azure-devops-sync-destination-schema";
 import { AzureKeyVaultSyncDestinationSchema } from "./azure-key-vault-sync-destination-schema";
 import { CamundaSyncDestinationSchema } from "./camunda-sync-destination-schema";
 import { DatabricksSyncDestinationSchema } from "./databricks-sync-destination-schema";
@@ -24,6 +25,7 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
   GcpSyncDestinationSchema,
   AzureKeyVaultSyncDestinationSchema,
   AzureAppConfigurationSyncDestinationSchema,
+  AzureDevOpsSyncDestinationSchema,
   DatabricksSyncDestinationSchema,
   HumanitecSyncDestinationSchema,
   TerraformCloudSyncDestinationSchema,

frontend/src/helpers/appConnections.ts

@@ -15,6 +15,7 @@ import {
   AwsConnectionMethod,
   AzureAppConfigurationConnectionMethod,
   AzureClientSecretsConnectionMethod,
+  AzureDevOpsConnectionMethod,
   AzureKeyVaultConnectionMethod,
   CamundaConnectionMethod,
   DatabricksConnectionMethod,
@@ -60,6 +61,7 @@ export const APP_CONNECTION_MAP: Record<
     name: "Azure Client Secrets",
     image: "Microsoft Azure.png"
   },
+  [AppConnection.AzureDevOps]: { name: "Azure DevOps", image: "Microsoft Azure.png" },
   [AppConnection.Databricks]: { name: "Databricks", image: "Databricks.png" },
   [AppConnection.Humanitec]: { name: "Humanitec", image: "Humanitec.png" },
   [AppConnection.TerraformCloud]: { name: "Terraform Cloud", image: "Terraform Cloud.png" },
@@ -85,6 +87,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case AzureKeyVaultConnectionMethod.OAuth:
     case AzureAppConfigurationConnectionMethod.OAuth:
     case AzureClientSecretsConnectionMethod.OAuth:
+    case AzureDevOpsConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
       return { name: "OAuth", icon: faPassport };
     case AwsConnectionMethod.AccessKey:
@@ -109,6 +112,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
       return { name: "Username & Password", icon: faLock };
     case HCVaultConnectionMethod.AccessToken:
     case TeamCityConnectionMethod.AccessToken:
+    case AzureDevOpsConnectionMethod.AccessToken:
     case WindmillConnectionMethod.AccessToken:
       return { name: "Access Token", icon: faKey };
     case Auth0ConnectionMethod.ClientCredentials:

frontend/src/helpers/secretSyncs.ts

@@ -17,6 +17,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
     name: "Azure App Configuration",
     image: "Microsoft Azure.png"
   },
+  [SecretSync.AzureDevOps]: {
+    name: "Azure DevOps",
+    image: "Microsoft Azure.png"
+  },
   [SecretSync.Databricks]: {
     name: "Databricks",
     image: "Databricks.png"
@@ -66,6 +70,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.GCPSecretManager]: AppConnection.GCP,
   [SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
   [SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration,
+  [SecretSync.AzureDevOps]: AppConnection.AzureDevOps,
   [SecretSync.Databricks]: AppConnection.Databricks,
   [SecretSync.Humanitec]: AppConnection.Humanitec,
   [SecretSync.TerraformCloud]: AppConnection.TerraformCloud,

frontend/src/hooks/api/appConnections/azure/queries.tsx

@@ -3,12 +3,14 @@ import { useQuery, UseQueryOptions } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import { appConnectionKeys } from "../queries";
-import { TAzureClient } from "./types";
+import { AzureDevOpsProjectsResponse, TAzureClient } from "./types";
 
 const azureConnectionKeys = {
   all: [...appConnectionKeys.all, "azure"] as const,
   listClients: (connectionId: string) =>
-    [...azureConnectionKeys.all, "clients", connectionId] as const
+    [...azureConnectionKeys.all, "clients", connectionId] as const,
+  listDevopsProjects: (connectionId: string) =>
+    [...azureConnectionKeys.all, "devops-projects", connectionId] as const
 };
 
 export const useAzureConnectionListClients = (
@@ -35,3 +37,29 @@ export const useAzureConnectionListClients = (
     ...options
   });
 };
+
+export const fetchAzureDevOpsProjects = async (
+  connectionId: string
+): Promise<AzureDevOpsProjectsResponse> => {
+  if (!connectionId) {
+    throw new Error("Connection ID is required");
+  }
+
+  const { data } = await apiRequest.get<AzureDevOpsProjectsResponse>(
+    `/api/v1/app-connections/azure-devops/${connectionId}/projects`
+  );
+
+  return data;
+};
+
+export const useGetAzureDevOpsProjects = (
+  connectionId: string,
+  options?: Omit<UseQueryOptions<AzureDevOpsProjectsResponse, Error>, "queryKey" | "queryFn">
+) => {
+  return useQuery({
+    queryKey: azureConnectionKeys.listDevopsProjects(connectionId),
+    queryFn: () => fetchAzureDevOpsProjects(connectionId),
+    enabled: Boolean(connectionId),
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/azure/types.ts

@@ -3,3 +3,13 @@ export type TAzureClient = {
   appId: string;
   id: string;
 };
+
+export interface AzureDevOpsProject {
+  id: string;
+  name: string;
+  appId: string;
+}
+
+export interface AzureDevOpsProjectsResponse {
+  projects: AzureDevOpsProject[];
+}

frontend/src/hooks/api/appConnections/enums.ts

@@ -6,6 +6,7 @@ export enum AppConnection {
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
   AzureClientSecrets = "azure-client-secrets",
+  AzureDevOps = "azure-devops",
   Databricks = "databricks",
   Humanitec = "humanitec",
   TerraformCloud = "terraform-cloud",

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -45,6 +45,11 @@ export type TDatabricksConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Databricks;
 };
 
+export type TAzureDevOpsConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.AzureDevOps;
+  oauthClientId?: string;
+};
+
 export type THumanitecConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Humanitec;
 };
@@ -108,6 +113,7 @@ export type TAppConnectionOption =
   | TAzureAppConfigurationConnectionOption
   | TAzureKeyVaultConnectionOption
   | TAzureClientSecretsConnectionOption
+  | TAzureDevOpsConnectionOption
   | TDatabricksConnectionOption
   | THumanitecConnectionOption
   | TTerraformCloudConnectionOption
@@ -131,6 +137,7 @@ export type TAppConnectionOptionMap = {
   [AppConnection.AzureKeyVault]: TAzureKeyVaultConnectionOption;
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnectionOption;
   [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnectionOption;
+  [AppConnection.AzureDevOps]: TAzureDevOpsConnectionOption;
   [AppConnection.Databricks]: TDatabricksConnectionOption;
   [AppConnection.Humanitec]: THumanitecConnectionOption;
   [AppConnection.TerraformCloud]: TTerraformCloudConnectionOption;

frontend/src/hooks/api/appConnections/types/azure-devops-connection.ts

@@ -0,0 +1,27 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum AzureDevOpsConnectionMethod {
+  OAuth = "oauth",
+  AccessToken = "access-token"
+}
+
+export type TAzureDevOpsConnection = TRootAppConnection & {
+  app: AppConnection.AzureDevOps;
+} & (
+    | {
+        method: AzureDevOpsConnectionMethod.OAuth;
+        credentials: {
+          code: string;
+          tenantId: string;
+          orgName: string;
+        };
+      }
+    | {
+        method: AzureDevOpsConnectionMethod.AccessToken;
+        credentials: {
+          accessToken: string;
+          orgName: string;
+        };
+      }
+  );

frontend/src/hooks/api/appConnections/types/index.ts

@@ -5,6 +5,7 @@ import { TAuth0Connection } from "./auth0-connection";
 import { TAwsConnection } from "./aws-connection";
 import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
 import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
+import { TAzureDevOpsConnection } from "./azure-devops-connection";
 import { TAzureKeyVaultConnection } from "./azure-key-vault-connection";
 import { TCamundaConnection } from "./camunda-connection";
 import { TDatabricksConnection } from "./databricks-connection";
@@ -28,6 +29,7 @@ export * from "./auth0-connection";
 export * from "./aws-connection";
 export * from "./azure-app-configuration-connection";
 export * from "./azure-client-secrets-connection";
+export * from "./azure-devops-connection";
 export * from "./azure-key-vault-connection";
 export * from "./camunda-connection";
 export * from "./databricks-connection";
@@ -54,6 +56,7 @@ export type TAppConnection =
   | TAzureKeyVaultConnection
   | TAzureAppConfigurationConnection
   | TAzureClientSecretsConnection
+  | TAzureDevOpsConnection
   | TDatabricksConnection
   | THumanitecConnection
   | TTerraformCloudConnection
@@ -103,6 +106,7 @@ export type TAppConnectionMap = {
   [AppConnection.AzureKeyVault]: TAzureKeyVaultConnection;
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
   [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
+  [AppConnection.AzureDevOps]: TAzureDevOpsConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
   [AppConnection.TerraformCloud]: TTerraformCloudConnection;

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -5,6 +5,7 @@ export enum SecretSync {
   GCPSecretManager = "gcp-secret-manager",
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
+  AzureDevOps = "azure-devops",
   Databricks = "databricks",
   Humanitec = "humanitec",
   TerraformCloud = "terraform-cloud",

frontend/src/hooks/api/secretSyncs/types/azure-devops-sync.ts

@@ -0,0 +1,16 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TAzureDevOpsSync = TRootSecretSync & {
+  destination: SecretSync.AzureDevOps;
+  destinationConfig: {
+    devopsProjectId: string;
+    devopsProjectName: string;
+  };
+  connection: {
+    app: AppConnection.AzureDevOps;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -5,6 +5,7 @@ import { TOnePassSync } from "./1password-sync";
 import { TAwsParameterStoreSync } from "./aws-parameter-store-sync";
 import { TAwsSecretsManagerSync } from "./aws-secrets-manager-sync";
 import { TAzureAppConfigurationSync } from "./azure-app-configuration-sync";
+import { TAzureDevOpsSync } from "./azure-devops-sync";
 import { TAzureKeyVaultSync } from "./azure-key-vault-sync";
 import { TCamundaSync } from "./camunda-sync";
 import { TDatabricksSync } from "./databricks-sync";
@@ -32,6 +33,7 @@ export type TSecretSync =
   | TGcpSync
   | TAzureKeyVaultSync
   | TAzureAppConfigurationSync
+  | TAzureDevOpsSync
   | TDatabricksSync
   | THumanitecSync
   | TTerraformCloudSync

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx

@@ -14,6 +14,7 @@ import { Auth0ConnectionForm } from "./Auth0ConnectionForm";
 import { AwsConnectionForm } from "./AwsConnectionForm";
 import { AzureAppConfigurationConnectionForm } from "./AzureAppConfigurationConnectionForm";
 import { AzureClientSecretsConnectionForm } from "./AzureClientSecretsConnectionForm";
+import { AzureDevOpsConnectionForm } from "./AzureDevOpsConnectionForm";
 import { AzureKeyVaultConnectionForm } from "./AzureKeyVaultConnectionForm";
 import { CamundaConnectionForm } from "./CamundaConnectionForm";
 import { DatabricksConnectionForm } from "./DatabricksConnectionForm";
@@ -99,6 +100,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
       return <CamundaConnectionForm onSubmit={onSubmit} />;
     case AppConnection.AzureClientSecrets:
       return <AzureClientSecretsConnectionForm />;
+    case AppConnection.AzureDevOps:
+      return <AzureDevOpsConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Windmill:
       return <WindmillConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Auth0:
@@ -179,6 +182,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
       return <CamundaConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.AzureClientSecrets:
       return <AzureClientSecretsConnectionForm appConnection={appConnection} />;
+    case AppConnection.AzureDevOps:
+      return <AzureDevOpsConnectionForm appConnection={appConnection} onSubmit={onSubmit} />;
     case AppConnection.Windmill:
       return <WindmillConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.Auth0:

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureDevOpsConnectionForm.tsx

@@ -0,0 +1,291 @@
+/* eslint-disable no-case-declarations */
+import crypto from "crypto";
+
+import { useState } from "react";
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { Button, FormControl, Input, ModalClose, Select, SelectItem } from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { isInfisicalCloud } from "@app/helpers/platform";
+import {
+  AzureDevOpsConnectionMethod,
+  TAzureDevOpsConnection,
+  useGetAppConnectionOption
+} from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type AccessTokenForm = z.infer<typeof accessTokenSchema>;
+
+type Props = {
+  appConnection?: TAzureDevOpsConnection;
+  onSubmit: (formData: AccessTokenForm) => Promise<void>;
+};
+
+// Base schema with common fields
+const baseSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.AzureDevOps),
+  method: z.nativeEnum(AzureDevOpsConnectionMethod)
+});
+
+// Method-specific schemas
+const oauthSchema = baseSchema.extend({
+  method: z.literal(AzureDevOpsConnectionMethod.OAuth),
+  tenantId: z.string().trim().min(1, "Tenant ID is required"),
+  orgName: z.string().trim().min(1, "Organization name is required")
+});
+
+const accessTokenSchema = baseSchema.extend({
+  method: z.literal(AzureDevOpsConnectionMethod.AccessToken),
+  credentials: z.object({
+    accessToken: z.string().trim().min(1, "Access Token is required"),
+    orgName: z.string().trim().min(1, "Organization name is required")
+  })
+});
+
+// Union schema
+const formSchema = z.discriminatedUnion("method", [oauthSchema, accessTokenSchema]);
+
+type FormData = z.infer<typeof formSchema>;
+
+const getDefaultValues = (appConnection?: TAzureDevOpsConnection): Partial<FormData> => {
+  if (!appConnection) {
+    return {
+      app: AppConnection.AzureDevOps,
+      method: AzureDevOpsConnectionMethod.OAuth
+    };
+  }
+
+  const base = {
+    name: appConnection.name,
+    description: appConnection.description,
+    app: appConnection.app,
+    method: appConnection.method
+  };
+  const { credentials } = appConnection;
+
+  switch (appConnection.method) {
+    case AzureDevOpsConnectionMethod.OAuth:
+      if ("tenantId" in credentials && "orgName" in credentials) {
+        return {
+          ...base,
+          method: AzureDevOpsConnectionMethod.OAuth,
+          tenantId: credentials.tenantId,
+          orgName: credentials.orgName
+        };
+      }
+      break;
+    case AzureDevOpsConnectionMethod.AccessToken:
+      if ("accessToken" in credentials && "orgName" in credentials) {
+        return {
+          ...base,
+          method: AzureDevOpsConnectionMethod.AccessToken,
+          credentials: {
+            accessToken: credentials.accessToken,
+            orgName: credentials.orgName
+          }
+        };
+      }
+      break;
+    default:
+      return base;
+  }
+
+  return base;
+};
+
+export const AzureDevOpsConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+  const [isRedirecting, setIsRedirecting] = useState(false);
+
+  const {
+    option: { oauthClientId },
+    isLoading
+  } = useGetAppConnectionOption(AppConnection.AzureDevOps);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: getDefaultValues(appConnection)
+  });
+
+  const {
+    handleSubmit,
+    control,
+    watch,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  const selectedMethod = watch("method");
+
+  const onSubmitHandler = async (formData: FormData) => {
+    switch (formData.method) {
+      case AzureDevOpsConnectionMethod.OAuth:
+        setIsRedirecting(true);
+        const state = crypto.randomBytes(16).toString("hex");
+        localStorage.setItem("latestCSRFToken", state);
+        localStorage.setItem(
+          "azureDevOpsConnectionFormData",
+          JSON.stringify({ ...formData, connectionId: appConnection?.id })
+        );
+
+        window.location.assign(
+          `https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://azconfig.io/.default%20openid%20offline_access&state=${state}<:>azure-devops`
+        );
+        break;
+
+      case AzureDevOpsConnectionMethod.AccessToken:
+        onSubmit(formData);
+        break;
+
+      default:
+        throw new Error(`Unhandled Azure Connection method: ${(formData as FormData).method}`);
+    }
+  };
+
+  const isMissingConfig = selectedMethod === AzureDevOpsConnectionMethod.OAuth && !oauthClientId;
+  const methodDetails = getAppConnectionMethodDetails(selectedMethod);
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmitHandler)} className="space-y-6">
+        {!isUpdate && <GenericAppConnectionsFields />}
+
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.AzureDevOps].name
+              }. This field cannot be changed after creation.`}
+              errorText={
+                !isLoading && isMissingConfig
+                  ? `Environment variables have not been configured. ${
+                      isInfisicalCloud()
+                        ? "Please contact Infisical."
+                        : `See documentation to configure Azure ${methodDetails.name} Connections.`
+                    }`
+                  : error?.message
+              }
+              isError={Boolean(error?.message) || isMissingConfig}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(AzureDevOpsConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+
+        {/* OAuth-specific fields */}
+        {selectedMethod === AzureDevOpsConnectionMethod.OAuth && (
+          <>
+            <Controller
+              name="tenantId"
+              control={control}
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="The Directory (tenant) ID."
+                  isError={Boolean(error?.message)}
+                  label="Tenant ID"
+                  errorText={error?.message}
+                >
+                  <Input {...field} placeholder="e4f34ea5-ad23-4291-8585-66d20d603cc8" />
+                </FormControl>
+              )}
+            />
+            <Controller
+              name="orgName"
+              control={control}
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="Your Azure DevOps organization name."
+                  isError={Boolean(error?.message)}
+                  label="Organization Name"
+                  errorText={error?.message}
+                >
+                  <Input {...field} placeholder="myorganization" />
+                </FormControl>
+              )}
+            />
+          </>
+        )}
+
+        {/* Access Token-specific fields */}
+        {selectedMethod === AzureDevOpsConnectionMethod.AccessToken && (
+          <>
+            <Controller
+              name="credentials.accessToken"
+              control={control}
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="Personal Access Token from Azure DevOps."
+                  isError={Boolean(error?.message)}
+                  label="Access Token"
+                  errorText={error?.message}
+                >
+                  <Input
+                    {...field}
+                    type="password"
+                    placeholder="Enter your Personal Access Token"
+                  />
+                </FormControl>
+              )}
+            />
+            <Controller
+              name="credentials.orgName"
+              control={control}
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="Your Azure DevOps organization name."
+                  isError={Boolean(error?.message)}
+                  label="Organization Name"
+                  errorText={error?.message}
+                >
+                  <Input {...field} placeholder="myorganization" />
+                </FormControl>
+              )}
+            />
+          </>
+        )}
+
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting || isRedirecting}
+            isDisabled={isSubmitting || (!isUpdate && !isDirty) || isMissingConfig || isRedirecting}
+          >
+            {isUpdate ? "Reconnect to Azure" : "Connect to Azure"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};

frontend/src/pages/organization/AppConnections/OauthCallbackPage/OauthCallbackPage.tsx

@@ -8,10 +8,12 @@ import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
 import {
   AzureAppConfigurationConnectionMethod,
   AzureClientSecretsConnectionMethod,
+  AzureDevOpsConnectionMethod,
   AzureKeyVaultConnectionMethod,
   GitHubConnectionMethod,
   TAzureAppConfigurationConnection,
   TAzureClientSecretsConnection,
+  TAzureDevOpsConnection,
   TAzureKeyVaultConnection,
   TGitHubConnection,
   TGitHubRadarConnection,
@@ -42,6 +44,19 @@ type AzureClientSecretsFormData = BaseFormData &
   Pick<TAzureClientSecretsConnection, "name" | "method" | "description"> &
   Pick<TAzureClientSecretsConnection["credentials"], "tenantId">;
 
+type OAuthCredentials = Extract<
+  TAzureDevOpsConnection,
+  { method: AzureDevOpsConnectionMethod.OAuth }
+>["credentials"];
+type AccessTokenCredentials = Extract<
+  TAzureDevOpsConnection,
+  { method: AzureDevOpsConnectionMethod.AccessToken }
+>["credentials"];
+
+type AzureDevOpsFormData = BaseFormData &
+  Pick<TAzureDevOpsConnection, "name" | "method" | "description"> &
+  (Pick<OAuthCredentials, "tenantId" | "orgName"> | Pick<AccessTokenCredentials, "orgName">);
+
 type FormDataMap = {
   [AppConnection.GitHub]: GithubFormData & { app: AppConnection.GitHub };
   [AppConnection.GitHubRadar]: GithubRadarFormData & { app: AppConnection.GitHubRadar };
@@ -52,6 +67,9 @@ type FormDataMap = {
   [AppConnection.AzureClientSecrets]: AzureClientSecretsFormData & {
     app: AppConnection.AzureClientSecrets;
   };
+  [AppConnection.AzureDevOps]: AzureDevOpsFormData & {
+    app: AppConnection.AzureDevOps;
+  };
 };
 
 const formDataStorageFieldMap: Partial<Record<AppConnection, string>> = {
@@ -59,7 +77,8 @@ const formDataStorageFieldMap: Partial<Record<AppConnection, string>> = {
   [AppConnection.GitHubRadar]: "githubRadarConnectionFormData",
   [AppConnection.AzureKeyVault]: "azureKeyVaultConnectionFormData",
   [AppConnection.AzureAppConfiguration]: "azureAppConfigurationConnectionFormData",
-  [AppConnection.AzureClientSecrets]: "azureClientSecretsConnectionFormData"
+  [AppConnection.AzureClientSecrets]: "azureClientSecretsConnectionFormData",
+  [AppConnection.AzureDevOps]: "azureDevOpsConnectionFormData"
 };
 
 export const OAuthCallbackPage = () => {
@@ -258,6 +277,60 @@ export const OAuthCallbackPage = () => {
     };
   }, []);
 
+  const handleAzureDevOps = useCallback(async () => {
+    const formData = getFormData(AppConnection.AzureDevOps);
+    if (formData === null) return null;
+
+    clearState(AppConnection.AzureDevOps);
+
+    const { connectionId, name, description, returnUrl } = formData;
+
+    try {
+      if (!("tenantId" in formData)) {
+        throw new Error("Expected OAuth form data but got access token data");
+      }
+
+      if (connectionId) {
+        await updateAppConnection.mutateAsync({
+          app: AppConnection.AzureDevOps,
+          connectionId,
+          credentials: {
+            code: code as string,
+            tenantId: formData.tenantId as string,
+            orgName: formData.orgName
+          }
+        });
+      } else {
+        await createAppConnection.mutateAsync({
+          app: AppConnection.AzureDevOps,
+          name,
+          description,
+          method: AzureDevOpsConnectionMethod.OAuth,
+          credentials: {
+            code: code as string,
+            tenantId: formData.tenantId as string,
+            orgName: formData.orgName
+          }
+        });
+      }
+    } catch (err: any) {
+      createNotification({
+        title: `Failed to ${connectionId ? "update" : "add"} Azure DevOps Connection`,
+        text: err?.message,
+        type: "error"
+      });
+      navigate({
+        to: returnUrl ?? "/organization/app-connections"
+      });
+    }
+
+    return {
+      connectionId,
+      returnUrl,
+      appConnectionName: formData.app
+    };
+  }, []);
+
   const handleGithub = useCallback(async () => {
     const formData = getFormData(AppConnection.GitHub);
     if (formData === null) return null;
@@ -396,6 +469,8 @@ export const OAuthCallbackPage = () => {
         data = await handleAzureAppConfiguration();
       } else if (appConnection === AppConnection.AzureClientSecrets) {
         data = await handleAzureClientSecrets();
+      } else if (appConnection === AppConnection.AzureDevOps) {
+        data = await handleAzureDevOps();
       }
 
       if (data) {

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/AzureDevOpsSyncDestinationCol.tsx

@@ -0,0 +1,14 @@
+import { TAzureDevOpsSync } from "@app/hooks/api/secretSyncs/types/azure-devops-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TAzureDevOpsSync;
+};
+
+export const AzureDevOpsSyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx

@@ -4,6 +4,7 @@ import { OnePassSyncDestinationCol } from "./1PasswordSyncDestinationCol";
 import { AwsParameterStoreSyncDestinationCol } from "./AwsParameterStoreSyncDestinationCol";
 import { AwsSecretsManagerSyncDestinationCol } from "./AwsSecretsManagerSyncDestinationCol";
 import { AzureAppConfigurationDestinationSyncCol } from "./AzureAppConfigurationDestinationSyncCol";
+import { AzureDevOpsSyncDestinationCol } from "./AzureDevOpsSyncDestinationCol";
 import { AzureKeyVaultDestinationSyncCol } from "./AzureKeyVaultDestinationSyncCol";
 import { CamundaSyncDestinationCol } from "./CamundaSyncDestinationCol";
 import { DatabricksSyncDestinationCol } from "./DatabricksSyncDestinationCol";
@@ -55,6 +56,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
       return <OCIVaultSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.OnePass:
       return <OnePassSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.AzureDevOps:
+      return <AzureDevOpsSyncDestinationCol secretSync={secretSync} />;
     default:
       throw new Error(
         `Unhandled Secret Sync Destination Col: ${(secretSync as TSecretSync).destination}`

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts

@@ -112,6 +112,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
       primaryText = destinationConfig.vaultId;
       secondaryText = "Vault ID";
       break;
+    case SecretSync.AzureDevOps:
+      primaryText = destinationConfig.devopsProjectName;
+      secondaryText = destinationConfig.devopsProjectId;
+      break;
     default:
       throw new Error(`Unhandled Destination Col Values ${destination}`);
   }

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AzureDevOpsSyncDestinationSection.tsx

@@ -0,0 +1,14 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TAzureDevOpsSync } from "@app/hooks/api/secretSyncs/types/azure-devops-sync";
+
+type Props = {
+  secretSync: TAzureDevOpsSync;
+};
+
+export const AzureDevOpsSyncDestinationSection = ({ secretSync }: Props) => {
+  const {
+    destinationConfig: { devopsProjectName }
+  } = secretSync;
+
+  return <GenericFieldLabel label="Project">{devopsProjectName}</GenericFieldLabel>;
+};

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx

@@ -14,6 +14,7 @@ import { OnePassSyncDestinationSection } from "./1PasswordSyncDestinationSection
 import { AwsParameterStoreSyncDestinationSection } from "./AwsParameterStoreSyncDestinationSection";
 import { AwsSecretsManagerSyncDestinationSection } from "./AwsSecretsManagerSyncDestinationSection";
 import { AzureAppConfigurationSyncDestinationSection } from "./AzureAppConfigurationSyncDestinationSection";
+import { AzureDevOpsSyncDestinationSection } from "./AzureDevOpsSyncDestinationSection";
 import { AzureKeyVaultSyncDestinationSection } from "./AzureKeyVaultSyncDestinationSection";
 import { CamundaSyncDestinationSection } from "./CamundaSyncDestinationSection";
 import { DatabricksSyncDestinationSection } from "./DatabricksSyncDestinationSection";
@@ -89,6 +90,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
     case SecretSync.OnePass:
       DestinationComponents = <OnePassSyncDestinationSection secretSync={secretSync} />;
       break;
+    case SecretSync.AzureDevOps:
+      DestinationComponents = <AzureDevOpsSyncDestinationSection secretSync={secretSync} />;
+      break;
     default:
       throw new Error(`Unhandled Destination Section components: ${destination}`);
   }

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx

@@ -41,6 +41,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
     case SecretSync.GCPSecretManager:
     case SecretSync.AzureKeyVault:
     case SecretSync.AzureAppConfiguration:
+    case SecretSync.AzureDevOps:
     case SecretSync.Databricks:
     case SecretSync.Humanitec:
     case SecretSync.TerraformCloud: